@orionscanner/cli 0.1.0

package/docs/ARCHITECTURE.md

@@ -0,0 +1,183 @@
+# Orion Engine Architecture
+
+## Overview
+
+Orion Engine is a **polyglot code audit platform** with 38 native analysis engines, built as a single MIT-licensed Python package. No external tool dependencies (Semgrep, TruffleHog, Safety, Bandit, etc.).
+
+## Core Design Principles
+
+| Principle | Implementation |
+|-----------|----------------|
+| **Total Coverage** | 38 engines covering security, quality, architecture, supply chain, compliance |
+| **Hardened** | No silent failures, secret zeroization, resource limits, per-engine timeouts |
+| **Atomic** | Per-engine isolation - one failure doesn't cascade |
+| **Native** | Pure Python, zero subprocess calls, zero external tool dependencies |
+| **Orchestrated** | Single `OrionEngine().run()` entry point for all 38 engines |
+| **Scalable** | Async/await, connection pooling, stateless engines, polyglot dispatch |
+
+## Architecture Overview
+
+```
+��─────────────────────────────────────────────────────────────��
+│                    OrionEngine                              │
+│  (Orchestrator - single run() entry point)                  │
+��──────────────────────────��──────────────────────────────────��
+                           │
+         ��─────────────────��─────────────────��
+         ��                 ��                 ��
+��────────────────�� ��────────────────�� ��────────────────��
+│ Polyglot       │ │ Engine         │ │ Registry       │
+│ Dispatcher     │ │ Registry       │ │ (38 engines)   │
+��──────��─────────�� └────────────────�� └────────────────��
+       │
+       ��
+��─────────────────────────────────────────────────────────────��
+│                 Language Detection                           │
+│  .py → Python    .js/.ts → JS/TS    .html → HTML             │
+│  .java → Java    .go → Go         .rs → Rust                 │
+│  Dockerfile      docker-compose    .yaml/.json/.toml        │
+��──────────────────────────��────────────────────────────────────��
+                           │
+         ��─────────────────��─────────────────��
+         ��                 ��                 ��
+��────────────────�� ��────────────────�� ��────────────────��
+│ Python AST     │ Universal Regex  │ Language-Specific│
+│ Analyzers      │ (Fallback)       │ Analyzers        │
+��────────────────�� └────────────────�� └────────────────��
+```
+
+## Core Components
+
+### 1. OrionEngine (Orchestrator)
+- Single entry point: `OrionEngine().run(irs, config)`
+- Manages 38 engines concurrently with timeouts
+- Aggregates findings, handles errors silently
+
+### 2. Polyglot Dispatcher
+- Detects language from file extension/filename
+- Routes to language-specific analyzer or universal fallback
+- Supports 20+ languages out of the box
+
+### 3. Engine Registry
+- Auto-discovers 38 engines on first use
+- Maps engine name → engine class
+- Provides health checks and resource limits
+
+### 4. IR (Intermediate Representation)
+- Content-addressed (SHA-256)
+- Carries: content, path, language, project_root, metadata
+- Immutable, serializable
+
+## 38 Engines by Category
+
+### Security (7)
+| Engine | Purpose | Languages |
+|--------|---------|-----------|
+| `sast` | SQLi, XSS, CMDi, SSRF, path traversal, secrets, weak crypto | Python (AST), JS/TS (regex), Universal |
+| `secrets` | API keys, tokens, passwords (regex + entropy) | All text files |
+| `deps` | Vulnerable deps (requirements.txt, package.json, Cargo.toml, etc.) | Python, JS/TS, Go, Rust, Java, PHP, Ruby |
+| `taint` | User input → dangerous sink tracking | Python (AST), JS/TS (planned) |
+| `authorization` | Missing auth on routes | Python (Flask/FastAPI/Django), JS/TS (Express) |
+| `sandbox_escape` | `__import__('os')`, `eval(compile())`, etc. | Python |
+| `prompt_security` | Prompt injection detection | All text files |
+
+### AST/IR Analysis (8)
+`callgraph`, `cfg`, `symbol`, `dataflow`, `orphan`, `dead_import`, `wiring_trace`, `state`
+
+### Quality (7)
+`complexity`, `duplication`, `error_handling`, `logging_c`, `license`, `lint`, `test_coverage`
+
+### Config/Infra (7)
+`config_engine`, `config_validation`, `contract_probe`, `perf_guard`, `data_residency`, `regression`, `container`
+
+### Meta/Supply Chain (9)
+`chaos`, `chaos_config`, `noise`, `hunter`, `supply_chain_sbom`, `compliance`, `provenance`, `fp_learn`, `architecture`
+
+## Data Flow
+
+```
+User Code → Files → IR List → OrionEngine.run()
+                                    │
+                                    ��
+                         ��──────────────────────��
+                         │ For each IR:         │
+                         │ 1. Detect language   │
+                         │ 2. Route to analyzer │
+                         │ 3. Collect findings  │
+                         └──────────────────────��
+                                    │
+                                    ��
+                         ��──────────────────────��
+                         │ Aggregate & Dedupe   │
+                         │ Score & Grade        │
+                         │ Generate Reports     │
+                         └──────────────────────��
+```
+
+## Configuration
+
+```python
+config = EngineConfig(
+    toggles={
+        "exclude": ["tests/", "vendor/", "*.min.js"],
+        "only_engines": ["sast", "secrets", "deps"],
+        "severity_threshold": "medium",
+    },
+    resource_limits=ResourceLimits(
+        max_cpu_seconds=120,
+        max_memory_mb=1024,
+        max_files=50000
+    ),
+    network_policy=NetworkPolicy(allow_outbound=False)
+)
+```
+
+## Reports
+
+Three formats generated in `ORION SCANNER REPORTS/`:
+- **HTML** - Dark theme, sidebar nav, expandable findings, score/grade
+- **JSON** - Machine-readable, CI/CD integration
+- **TXT** - Human-readable summary
+
+## Extending Engines
+
+```python
+class MyEngine:
+    name = "my_engine"
+    version = "1.0.0"
+    
+    async def check_availability(self) -> bool: return True
+    
+    def resource_limits(self):
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=256)
+    
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        # Language-aware analysis
+        language = ir.metadata.get("language")
+        # ... analysis logic
+        return EngineResult(engine=self.name, findings=[...], ok=True)
+
+# Register
+EngineRegistry().register("my_engine", MyEngine)
+```
+
+## Polyglot Support Matrix
+
+| Language | SAST | Secrets | Deps | Taint | Callgraph | Config |
+|----------|------|---------|------|-------|-----------|--------|
+| Python | �� AST | �� | �� | �� AST | �� | �� |
+| JavaScript | �� Regex | �� | �� | ��� Planned | ��� | �� |
+| TypeScript | �� Regex | �� | �� | ��� Planned | ��� | �� |
+| Java | ��� Regex | �� | �� | ��� | ��� | �� |
+| Go | ��� Regex | �� | �� | ��� | ��� | �� |
+| Rust | ��� Regex | �� | �� | ��� | ��� | �� |
+| PHP | ��� Regex | �� | �� | ��� | ��� | �� |
+| Ruby | ��� Regex | �� | �� | ��� | ��� | �� |
+| C/C++ | ��� Regex | �� | ��� | ��� | ��� | �� |
+| C# | ��� Regex | �� | �� | ��� | ��� | �� |
+| Go/Rust/JS/TS | Universal | �� | �� | Universal | ��� | �� |
+| HTML/CSS | ��� Regex | �� | ��� | Universal | ��� | ��� |
+| Dockerfile | ��� Regex | �� | �� | Universal | ��� | �� |
+| YAML/JSON/TOML | ��� | �� | �� | ��� | ��� | �� |
+
+��� = Full support | ��� = Regex/Universal fallback | ��� = Not applicable

package/docs/CHANGELOG.md

@@ -0,0 +1,112 @@
+# Changelog
+
+All notable changes to Orion Engine.
+
+## [0.1.0] - 2026-08-14
+
+### Added
+- **38 Native Engines** — SAST, Secrets, Deps, Taint, Callgraph, CFG, Symbol, Dataflow, Authorization, Orphan, Prompt Security, Contract Probe, Wiring Trace, State, License, Complexity, Duplication, Dead Import, Error Handling, Logging, Config Engine, Chaos, Chaos Config, Regression, Perf Guard, Data Residency, Noise, Supply Chain SBOM, Hunter, Lint, Architecture, Test Coverage, Container, Compliance, Provenance, FP Learn, Sandbox Escape, Config Validation
+- **Polyglot Support** — 20+ languages via automatic detection and universal regex fallback
+- **Polyglot Dispatcher** — Routes files to language-specific analyzers or universal regex
+- **Language Infrastructure** — 20+ languages, capabilities registry, extension mapping
+- **Professional HTML Reports** — Dark theme, sidebar nav, expandable findings, score/grade (A-F), responsive design
+- **Interactive CLI** — Menu system (9 options), multi-colored spinner, auto clear-screen
+- **Three Report Formats** — HTML (dark theme), JSON (CI/CD), TXT (human-readable)
+- **False Positive Learning** — Reads `.orion-feedback.json`, reduces confidence on matches
+- **Compliance Mapping** — GDPR, PCI-DSS, SOC2, HIPAA
+- **SBOM Generation** — CycloneDX format with purl, hashes, licenses
+- **Provenance Attestation** — SLSA-like: git commit, file hashes, builder identity
+- **FP Learning** — Reads feedback, reduces confidence on similar patterns
+- **Config Validation** — Self-validates OrionEngine config
+
+### Core Platform
+- `OrionEngine` — Single orchestrator, async, 38 engines concurrent
+- `EngineConfig` — Toggles, resource limits, network policy
+- `ResourceLimits` — CPU, memory, file size, file count limits
+- `NetworkPolicy` — Outbound control with allowlist
+- `OrionIR` — Content-addressed (SHA-256), immutable
+- `EngineResult` / `Finding` — Structured results with evidence
+- `EngineRegistry` — Auto-discovery of 38 engines
+
+### Language Support (20+)
+Python, JavaScript, TypeScript, Java, Go, Rust, PHP, Ruby, C/C++, C#, HTML, CSS, YAML, JSON, TOML, XML, Dockerfile, Shell, PowerShell, Markdown
+
+### Security Engines
+- **sast** — SQLi, XSS, CMDi, SSRF, path traversal, hardcoded creds, weak crypto, deserialization
+- **secrets** — API keys, tokens, passwords (regex + entropy), test pattern filtering
+- **deps** — Vulnerable deps (requirements.txt, package.json, Cargo.toml, go.mod, pom.xml, composer.json, Gemfile, Pipfile, poetry.lock, yarn.lock, pnpm-lock.yaml)
+- **taint** — User input → dangerous sinks (SQL, shell, code exec, template, deserialization)
+- **authorization** — Missing auth on Flask/FastAPI/Django/Express/Spring/Gin/Laravel/Rails/ASP.NET routes
+- **sandbox_escape** — `__import__('os')`, `eval(compile())`, `ctypes`, `__subclasses__()`, `Function` constructor, `Runtime.exec`, `Process.Start`
+- **prompt_security** — Prompt injection, jailbreak, base64 payloads, special tokens
+
+### AST/IR Analysis Engines
+- **callgraph** — Function calls, recursion, undefined functions, deep chains
+- **cfg** — Control flow: unreachable code, infinite loops, missing returns, cyclomatic complexity
+- **symbol** — Symbol table: shadowed builtins, undefined names, unused imports, late-binding closures
+- **dataflow** — Variable def/use: use-before-def, dead stores, mutable defaults, global mutations
+- **orphan** — Zero incoming imports (excludes entry points)
+- **dead_import** — Unused imports across scopes
+- **wiring_trace** — Config → usage tracing
+- **state** — Mutable globals, class attrs, function defaults, `global`/`nonlocal`
+
+### Quality Engines
+- **complexity** — Cyclomatic & cognitive complexity (>10/20/50)
+- **duplication** — Sliding window token normalization, SHA256 clustering
+- **error_handling** — Bare except, swallowed errors, lost causes, assert in prod, sys.exit in libs
+- **logging_c** — print() in prod, PII in logs, missing getLogger, DEBUG in prod, no structured logging
+- **license** — SPDX headers, GPL/AGPL detection, root LICENSE, dep conflicts
+- **lint** — Unused vars, undefined names, import order, line length, docstrings, wildcards, ==None, bare except
+- **test_coverage** — Untested public functions, test-only-mocks, no assertions, long tests, missing conftest
+
+### Config/Infra Engines
+- **config_engine** — Required keys, types, placeholders, secrets, duplicates, URLs, emails
+- **chaos** — No retry/circuit-breaker/timeout/idempotency, global locks, direct instantiation
+- **chaos_config** — Empty/null/negative/huge values, invalid enums, circular refs, long strings
+- **regression** — Monkey patching, dynamic imports, sys.modules mutation, builtins/env mutation
+- **perf_guard** — N+1 queries, O(n²) loops, string concat, large in-memory, missing pagination, sync I/O in async
+- **data_residency** — PII: emails, phones, SSN, credit cards (Luhn), IPs, UUIDs, API keys
+- **container** — Dockerfile, docker-compose, K8s YAML, Helm: root, latest tag, secrets, privileged, host namespaces, healthcheck, limits
+
+### Meta/Supply Chain Engines
+- **noise** — Low confidence + recent changes + high churn, duplicates, generated files
+- **hunter** — Cross-engine correlation: SQLi+auth=CRITICAL, XSS+CSP=HIGH, secret+public=CRITICAL
+- **supply_chain_sbom** — CycloneDX: purl, hashes, licenses, external refs
+- **compliance** — GDPR (Art 25/32/33), PCI-DSS (Req 3/4/6/8), SOC2 (CC6.1/6.7/7.2), HIPAA (164.312)
+- **provenance** — Git commit/tag/branch, SHA256 file hashes, builder identity, dep hashes
+- **fp_learn** — Reads `.orion-feedback.json`, reduces confidence by 0.3 on feature match
+- **config_validation** — Validates paths, globs, limits, network policy, parallelism, timeout
+- **architecture** — Cyclic imports, layer violations (domain→app→infra→pres), god classes/modules, feature envy
+
+### Reports
+- **HTML** — Dark theme, fixed sidebar, expandable findings, score/grade (A-F), responsive, print-ready
+- **JSON** — Machine-readable, CI/CD ready
+- **TXT** — Human-readable summary
+
+### CLI
+- `orion` — Interactive menu (9 options)
+- `orion .` — Full audit
+- `orion . --security` — Security engines only
+- `orion . --quality` — Quality engines only
+- `orion . --arch` — Architecture engines only
+- `orion path` — Scan file or directory
+- `orion . --config-json '{}'` — Custom config
+
+### Removed
+- All GPL/AGPL dependencies (Semgrep, TruffleHog, Safety, Bandit)
+- External tool subprocess calls
+- Old adapter/check/intelligence/reporting architecture
+- Benchmarks, fixtures, test suites (legacy)
+- Docker, npm, GUI, serve, sandbox modules
+
+## Upgrade Guide
+
+### From 0.x (Legacy)
+- Complete rewrite — no migration path
+- Install fresh: `pip install -e .`
+- Config format changed — use new `EngineConfig`
+- API changed — use `OrionEngine().run(irs, config)`
+
+---
+
+**Orion Engine v0.1.0** — 38 native MIT engines, polyglot, zero external deps, professional reports.

package/docs/CONTRIBUTING.md

@@ -0,0 +1,157 @@
+# Contributing
+
+## Development Setup
+
+```bash
+git clone https://github.com/chandrahotha/OrionEngine
+cd OrionEngine
+pip install -e .[dev]
+pre-commit install
+```
+
+## Code Style
+
+- **Python 3.10+** — type hints required
+- **Black** — formatting (`black src/`)
+- **Ruff** — linting (`ruff check src/`)
+- **MyPy** — type checking (`mypy src/`)
+- **Async first** — all engines async
+
+## Adding a New Engine
+
+1. Create directory: `src/orion/engine/my_engine/`
+2. Create `engine.py`:
+
+```python
+from orion.engine.languages import detect_language, Language, get_capabilities
+from orion.engine.dispatcher import UniversalRegexAnalyzer, PolyglotEngine
+from orion.engine.config import EngineConfig, ResourceLimits
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+class Engine:
+    name = "my_engine"
+    version = "1.0.0"
+    
+    def __init__(self):
+        self.universal = UniversalRegexAnalyzer(
+            categories=["secrets", "sql_injection", "xss", "command_injection"]
+        )
+    
+    async def check_availability(self) -> bool:
+        return True
+    
+    def resource_limits(self) -> ResourceLimits:
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=512)
+    
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        language = ir.metadata.get("language")
+        if isinstance(language, str):
+            try:
+                language = Language(language.lower())
+            except ValueError:
+                from orion.engine.languages import detect_language
+                language = detect_language(ir.metadata.get("path", ""))
+        
+        if language == Language.PYTHON:
+            return await self._run_python(ir, config)
+        
+        return self.universal.run(ir, config)
+    
+    async def _run_python(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        # Python-specific AST analysis
+        findings = []
+        # ... your analysis
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+# Backward compatibility
+Engine = Engine
+```
+
+3. Register in `src/orion/engine/registry.py` (auto-discovery works automatically)
+
+## Testing
+
+```bash
+# Run all tests
+pytest tests/
+
+# Run specific engine tests
+pytest tests/test_sast.py -v
+
+# Type check
+mypy src/
+
+# Lint
+ruff check src/
+
+# Format
+black src/
+```
+
+## Engine Guidelines
+
+1. **No silent failures** — wrap in try/except, return errors in `EngineResult.errors`
+2. **Confidence scoring** — every finding needs `metadata["confidence"]` (0.0-1.0)
+3. **Evidence** — include `snippet`, `cwe`, `cvss`, `line`, `file` in metadata
+4. **Language support** — use `detect_language()`, `get_capabilities()`, `UniversalRegexAnalyzer`
+5. **Resource limits** — respect `config.get_limits().max_cpu_seconds`
+5. **No silent failures** — engine errors go to `EngineResult.errors`, not stdout
+6. **Async** — `run()` must be async, use `asyncio.wait_for` for timeouts
+
+## Polyglot Support
+
+Add language support to your engine:
+
+```python
+async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+    language = ir.metadata.get("language")
+    if isinstance(language, str):
+        try:
+            language = Language(language.lower())
+        except ValueError:
+            from orion.engine.languages import detect_language
+            language = detect_language(ir.metadata.get("path", ""))
+    
+    caps = get_capabilities(language)
+    
+    if language == Language.PYTHON:
+        return await self._run_python_ast(ir, config)
+    elif language in (Language.JAVASCRIPT, Language.TYPESCRIPT):
+        return await self._run_js_regex(ir, config)
+    elif language in (Language.JAVA, Language.GO, Language.RUST, Language.PHP, Language.RUBY):
+        return await self._run_universal(ir, config)
+    
+    return self.universal.run(ir, config)
+```
+
+## Adding Language Support
+
+1. Add to `Language` enum in `languages.py`
+2. Add extension mapping in `EXTENSION_MAP`
+3. Add `LanguageCapabilities` in `LANGUAGE_CAPABILITIES`
+4. Add patterns to `UNIVERSAL_PATTERNS` in `dispatcher.py`
+5. Test with sample files
+
+## Reporting Bugs
+
+Use GitHub Issues with:
+- Orion version (`orion --version` or check `pyproject.toml`)
+- Python version
+- OS
+- Minimal reproduction code
+- Expected vs actual behavior
+- Engine(s) involved
+
+## Pull Request Process
+
+1. Fork & create feature branch
+2. Write tests for new functionality
+3. Ensure all tests pass
+4. Run `black`, `ruff`, `mypy`
+5. Update docs if needed
+6. Submit PR with clear description
+
+## License
+
+MIT — all contributions must be MIT-compatible.

package/docs/ENGINE_CATALOG.md

@@ -0,0 +1,87 @@
+# Engine Catalog — 38 Native Engines
+
+All engines are **native, MIT-licensed, zero external dependencies**. Each engine routes to the appropriate language analyzer automatically via the Polyglot Dispatcher.
+
+## Security Engines (7)
+
+| Engine | Description | Primary Languages | Detection Method |
+|--------|-------------|-------------------|------------------|
+| **sast** | Static Application Security Testing — SQLi, XSS, CMDi, SSRF, path traversal, hardcoded creds, weak crypto, deserialization | Python (AST), JS/TS (regex), Universal regex fallback | AST + Regex |
+| **secrets** | API keys, tokens, passwords, private keys — regex + Shannon entropy, test pattern filtering | All text files | Regex + Entropy |
+| **deps** | Vulnerable dependencies — requirements.txt, package.json, Cargo.toml, go.mod, pom.xml, composer.json, Gemfile, Pipfile, poetry.lock, yarn.lock, pnpm-lock.yaml | Python, JS/TS, Go, Rust, Java, PHP, Ruby, .NET | Manifest parsing + CVE DB |
+| **taint** | Taint tracking: user input → dangerous sinks (SQL, shell, code exec, template, deserialization) | Python (AST), JS/TS (planned), Universal fallback | AST + Regex |
+| **authorization** | Missing auth on routes — Flask, FastAPI, Django, Express, Fastify, Spring, Gin, Laravel, Rails, ASP.NET | Python, JS/TS, Java, Go, PHP, Ruby, C# | AST + Regex |
+| **sandbox_escape** | `__import__('os')`, `eval(compile())`, `ctypes`, `__subclasses__()`, `Function` constructor, `Runtime.exec`, `Process.Start` | Python, JS/TS, Java, PHP, Ruby, C# | Regex |
+| **prompt_security** | Prompt injection, jailbreak patterns, base64 payloads, special tokens | All text files | Regex + Heuristics |
+
+## AST/IR Analysis Engines (8)
+
+| Engine | Description | Languages |
+|--------|-------------|-----------|
+| **callgraph** | Function call graph, recursive calls, undefined functions, deep chains | Python (AST), JS/TS, Java, Go, Rust, PHP, Ruby, C# (regex) |
+| **cfg** | Control flow graph per function — unreachable code, infinite loops, missing returns, cyclomatic complexity | Python (AST), Universal fallback |
+| **symbol** | Symbol table — shadowed builtins, undefined names, unused imports, late-binding closures | Python (AST), Universal fallback |
+| **dataflow** | Variable def/use — use-before-def, dead stores, mutable defaults, global mutations | Python (AST), Universal fallback |
+| **orphan** | Files with zero incoming imports — excludes `__init__.py`, tests, scripts, entry points | Python (AST), JS/TS, Java, Go, Rust, PHP, Ruby (regex) |
+| **dead_import** | Unused imports — tracks Name/Attribute usage across scopes | Python (AST), JS/TS, Java, Go, Rust, PHP, Ruby (regex) |
+| **wiring_trace** | Config wiring — traces from .env/config.yaml/settings.py to usage sites | Python, JS/TS, Java, Go, Rust, PHP, Ruby (config files) |
+| **state** | Mutable state — globals, class attrs, function defaults, `global`/`nonlocal` | Python (AST), Universal fallback |
+
+## Quality Engines (7)
+
+| Engine | Description | Languages |
+|--------|-------------|-----------|
+| **complexity** | Cyclomatic & cognitive complexity — functions >10/20/50 | Python (AST), Universal regex fallback |
+| **duplication** | Code duplication — sliding window (5 lines), token normalization, SHA256 clustering | Python, JS/TS, Java, Go, Rust, C/C++, C# |
+| **error_handling** | Bare `except:`, `except Exception: pass`, lost causes, `assert` in prod, `sys.exit()` in libs | Python (AST), Universal fallback |
+| **logging_c** | `print()` in prod, PII in logs, missing `getLogger(__name__)`, DEBUG in prod, missing structured logging | Python (AST), Universal fallback |
+| **license** | SPDX headers, GPL/AGPL detection, root LICENSE file, dep license conflicts | All source files |
+| **lint** | Unused vars, undefined names, import order, line length >100, missing docstrings, wildcard imports, `== None`, bare except | Python (AST), Universal fallback |
+| **test_coverage** | Untested public functions, test-only-mocks, no-assertions, long tests, missing conftest.py | Python (AST), Universal fallback |
+
+## Config/Infra Engines (7)
+
+| Engine | Description | Languages |
+|--------|-------------|-----------|
+| **config_engine** | Config validation — required keys, types, placeholders, secrets in non-.env, duplicates, URLs, emails | YAML, JSON, TOML, .env, .ini, .properties, Python |
+| **chaos** | Chaos resilience — no retry/circuit-breaker/timeout/idempotency, global locks, direct instantiation | Python (AST), Universal fallback |
+| **chaos_config** | Config edge cases — empty/null/negative/huge values, invalid enums, circular refs, long strings | YAML, JSON, TOML, .env, .ini, .properties, Python |
+| **regression** | Monkey patching, dynamic imports, `sys.modules` mutation, `builtins`/`os.environ` mutation, signal/atexit handlers | Python (AST), Universal fallback |
+| **perf_guard** | N+1 queries, O(n²) loops, `list.append` in hot loops, string `+=`, large in-memory loads, missing pagination, sync I/O in async | Python (AST), Universal fallback |
+| **data_residency** | Hardcoded PII — emails, phones, SSN, credit cards (Luhn), IPs, UUIDs, API keys | All text files (regex) |
+| **container** | Dockerfile, docker-compose, K8s YAML, Helm — root user, latest tag, secrets in ENV, privileged, host namespaces, missing healthcheck/read-only/limits | Dockerfile, docker-compose, K8s YAML, Helm values |
+
+## Meta/Supply Chain Engines (9)
+
+| Engine | Description | Languages |
+|--------|-------------|-----------|
+| **noise** | Suppresses low-confidence + recent changes + high churn, duplicates, generated files | All findings |
+| **hunter** | Cross-engine correlation — SQLi + missing auth = CRITICAL, XSS + missing CSP = HIGH, secret + public repo = CRITICAL | All findings |
+| **supply_chain_sbom** | CycloneDX SBOM — components with purl, hashes, licenses, external references | All dep files |
+| **compliance** | Maps findings to GDPR (Art 25/32/33), PCI-DSS (Req 3/4/6/8), SOC2 (CC6.1/6.7/7.2), HIPAA (164.312) | All findings |
+| **provenance** | SLSA-like — git commit/tag/branch, SHA256 file hashes, builder identity (CI env), dep hashes | Git, all source files |
+| **fp_learn** | Reads `.orion-feedback.json`, extracts features, reduces confidence by 0.3 on match | All findings |
+| **config_validation** | Validates OrionEngine config — paths, globs, limits, network policy, parallelism, timeout | Config object |
+| **architecture** | Cyclic imports, layer violations (domain→app→infra→pres), god classes/modules, feature envy, data classes with behavior | Python (AST), JS/TS, Java, Go, Rust, PHP, Ruby (regex) |
+| **config_validation** | Validates EngineConfig — paths exist, globs valid, limits positive, network policy consistent | Config object |
+
+## Language Support Matrix
+
+| Language | SAST | Secrets | Deps | Taint | Callgraph | Config | Container |
+|----------|------|---------|------|-------|-----------|--------|-----------|
+| Python | ���� AST | ���� | ���� | ���� AST | ���� AST | ���� | ���� |
+| JavaScript | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| TypeScript | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| Java | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| Go | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| Rust | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| PHP | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| Ruby | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| C/C++ | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| C# | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| HTML | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+| CSS | ���� | ���� | ���� | ���� | ���� | ���� | ���� |
+| YAML/JSON/TOML | ���� | ���� | ���� | ���� | ���� | ���� | ���� |
+| Dockerfile | ���� Regex | ���� | ���� | ���� Regex | ���� Regex | ���� | ���� |
+
+�� = Full AST support | ���� = Regex/Universal fallback | ���� = Not applicable