@paniolo/scan 0.2.3 → 0.2.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/dist/standards/rule-evidence.json +419 -0
  2. package/package.json +1 -1
package/dist/standards/rule-evidence.json ADDED
@@ -0,0 +1,419 @@
1
+ {
2
+ "schema_version": 1,
3
+ "rules": {
4
+ "actions-sha-pinned": {
5
+ "source_type": "security-practice",
6
+ "evidence_level": "E4",
7
+ "source_urls": [
8
+ "docs/rules-catalog.md",
9
+ "https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions"
10
+ ],
11
+ "verified_on": "2026-06-13",
12
+ "fixture_ids": []
13
+ },
14
+ "adapter-content-duplication": {
15
+ "source_type": "meta-harness-methodology",
16
+ "evidence_level": "E4",
17
+ "source_urls": ["docs/meta-harness.md", "docs/harness-analysis.md"],
18
+ "verified_on": "2026-06-13",
19
+ "fixture_ids": ["weak", "normal", "mature"]
20
+ },
21
+ "adapter-context-budget": {
22
+ "source_type": "research-motivated-threshold",
23
+ "evidence_level": "E3",
24
+ "source_urls": ["docs/ai/scoring-calibration.md", "https://arxiv.org/abs/2602.20478"],
25
+ "verified_on": "2026-06-13",
26
+ "fixture_ids": ["weak", "normal", "mature"]
27
+ },
28
+ "adapter-points-to-shared": {
29
+ "source_type": "meta-harness-methodology",
30
+ "evidence_level": "E4",
31
+ "source_urls": ["docs/meta-harness.md", "docs/architecture.md"],
32
+ "verified_on": "2026-06-13",
33
+ "fixture_ids": ["normal", "mature"]
34
+ },
35
+ "adapter-thin-claude": {
36
+ "source_type": "meta-harness-methodology",
37
+ "evidence_level": "E4",
38
+ "source_urls": ["docs/ai/scoring-calibration.md", "docs/architecture.md"],
39
+ "verified_on": "2026-06-13",
40
+ "fixture_ids": ["weak", "normal", "mature"]
41
+ },
42
+ "adapter-thin-copilot": {
43
+ "source_type": "meta-harness-methodology",
44
+ "evidence_level": "E4",
45
+ "source_urls": ["docs/ai/scoring-calibration.md", "docs/architecture.md"],
46
+ "verified_on": "2026-06-13",
47
+ "fixture_ids": []
48
+ },
49
+ "adapter-thin-gemini": {
50
+ "source_type": "meta-harness-methodology",
51
+ "evidence_level": "E4",
52
+ "source_urls": ["docs/ai/scoring-calibration.md", "docs/architecture.md"],
53
+ "verified_on": "2026-06-13",
54
+ "fixture_ids": ["mature"]
55
+ },
56
+ "agent-frontmatter": {
57
+ "source_type": "agent-skills-spec",
58
+ "evidence_level": "E4",
59
+ "source_urls": ["docs/rules-catalog.md", "docs/ai/rules.md"],
60
+ "verified_on": "2026-06-13",
61
+ "fixture_ids": ["mature"]
62
+ },
63
+ "agent-resource-budget-caps": {
64
+ "source_type": "research-motivated-security-posture",
65
+ "evidence_level": "E2",
66
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.20953"],
67
+ "verified_on": "2026-06-13",
68
+ "fixture_ids": []
69
+ },
70
+ "agents-md-mentions-skills": {
71
+ "source_type": "meta-harness-methodology",
72
+ "evidence_level": "E4",
73
+ "source_urls": ["docs/ai/available-skills.md", "docs/architecture.md"],
74
+ "verified_on": "2026-06-13",
75
+ "fixture_ids": ["normal", "mature"]
76
+ },
77
+ "always-loaded-budget": {
78
+ "source_type": "research-motivated-threshold",
79
+ "evidence_level": "E3",
80
+ "source_urls": ["docs/ai/scoring-calibration.md", "https://arxiv.org/abs/2602.20478"],
81
+ "verified_on": "2026-06-13",
82
+ "fixture_ids": ["weak", "normal", "mature"]
83
+ },
84
+ "ci-enforcement-gates": {
85
+ "source_type": "intelligence-layer-methodology",
86
+ "evidence_level": "E4",
87
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/rules.md"],
88
+ "verified_on": "2026-06-13",
89
+ "fixture_ids": []
90
+ },
91
+ "ci-guidance-lint": {
92
+ "source_type": "corpus-calibrated-maturity-signal",
93
+ "evidence_level": "E4",
94
+ "source_urls": ["docs/ai/scoring-calibration.md", "docs/rules-catalog.md"],
95
+ "verified_on": "2026-06-13",
96
+ "fixture_ids": []
97
+ },
98
+ "ci-validation-gates": {
99
+ "source_type": "intelligence-layer-methodology",
100
+ "evidence_level": "E4",
101
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/scoring-calibration.md"],
102
+ "verified_on": "2026-06-13",
103
+ "fixture_ids": []
104
+ },
105
+ "claude-agent-routing": {
106
+ "source_type": "meta-harness-methodology",
107
+ "evidence_level": "E4",
108
+ "source_urls": ["docs/architecture.md", "docs/ai/ai-system.md"],
109
+ "verified_on": "2026-06-13",
110
+ "fixture_ids": ["mature"]
111
+ },
112
+ "claude-hooks-valid": {
113
+ "source_type": "security-practice",
114
+ "evidence_level": "E4",
115
+ "source_urls": ["docs/rules-catalog.md", "docs/ai/rules.md"],
116
+ "verified_on": "2026-06-13",
117
+ "fixture_ids": []
118
+ },
119
+ "codex-hooks-valid": {
120
+ "source_type": "security-practice",
121
+ "evidence_level": "E4",
122
+ "source_urls": ["docs/rules-catalog.md", "docs/ai/rules.md"],
123
+ "verified_on": "2026-06-13",
124
+ "fixture_ids": []
125
+ },
126
+ "correction-loop-documented": {
127
+ "source_type": "corpus-calibrated-maturity-signal",
128
+ "evidence_level": "E4",
129
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/scoring-calibration.md"],
130
+ "verified_on": "2026-06-13",
131
+ "fixture_ids": []
132
+ },
133
+ "emphasis-keyword-density": {
134
+ "source_type": "instruction-quality-heuristic",
135
+ "evidence_level": "E5",
136
+ "source_urls": ["docs/rules-catalog.md", "docs/ai/rules.md"],
137
+ "verified_on": "2026-06-13",
138
+ "fixture_ids": []
139
+ },
140
+ "env-files-gitignored": {
141
+ "source_type": "security-practice",
142
+ "evidence_level": "E4",
143
+ "source_urls": [
144
+ "docs/rules-catalog.md",
145
+ "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
146
+ ],
147
+ "verified_on": "2026-06-13",
148
+ "fixture_ids": []
149
+ },
150
+ "escalation-protocol-discoverability": {
151
+ "source_type": "research-motivated-security-posture",
152
+ "evidence_level": "E2",
153
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2604.09408"],
154
+ "verified_on": "2026-06-13",
155
+ "fixture_ids": []
156
+ },
157
+ "focused-test-commands-present": {
158
+ "source_type": "intelligence-layer-methodology",
159
+ "evidence_level": "E4",
160
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/rules.md"],
161
+ "verified_on": "2026-06-13",
162
+ "fixture_ids": []
163
+ },
164
+ "forbidden-legacy-paths": {
165
+ "source_type": "meta-harness-methodology",
166
+ "evidence_level": "E4",
167
+ "source_urls": ["docs/ai/ai-system.md", "docs/ai/rules.md"],
168
+ "verified_on": "2026-06-13",
169
+ "fixture_ids": []
170
+ },
171
+ "guidance-links-resolve": {
172
+ "source_type": "meta-harness-methodology",
173
+ "evidence_level": "E4",
174
+ "source_urls": ["docs/ai/rules.md", "docs/architecture.md"],
175
+ "verified_on": "2026-06-13",
176
+ "fixture_ids": ["normal", "mature"]
177
+ },
178
+ "guidance-maintenance-script": {
179
+ "source_type": "corpus-calibrated-maturity-signal",
180
+ "evidence_level": "E4",
181
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/scoring-calibration.md"],
182
+ "verified_on": "2026-06-13",
183
+ "fixture_ids": []
184
+ },
185
+ "high-impact-action-confirmation": {
186
+ "source_type": "research-motivated-security-posture",
187
+ "evidence_level": "E2",
188
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.11088"],
189
+ "verified_on": "2026-06-13",
190
+ "fixture_ids": []
191
+ },
192
+ "hook-no-network-exfil": {
193
+ "source_type": "security-practice",
194
+ "evidence_level": "E4",
195
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.11088"],
196
+ "verified_on": "2026-06-13",
197
+ "fixture_ids": []
198
+ },
199
+ "hook-stop-circuit-breaker": {
200
+ "source_type": "security-practice",
201
+ "evidence_level": "E4",
202
+ "source_urls": ["docs/rules-catalog.md", "docs/architecture.md"],
203
+ "verified_on": "2026-06-13",
204
+ "fixture_ids": []
205
+ },
206
+ "identity-language-absent": {
207
+ "source_type": "instruction-quality-heuristic",
208
+ "evidence_level": "E5",
209
+ "source_urls": ["docs/rules-catalog.md", "docs/ai/rules.md"],
210
+ "verified_on": "2026-06-13",
211
+ "fixture_ids": []
212
+ },
213
+ "jsdoc-enforcement-present": {
214
+ "source_type": "corpus-calibrated-maturity-signal",
215
+ "evidence_level": "E4",
216
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/scoring-calibration.md"],
217
+ "verified_on": "2026-06-13",
218
+ "fixture_ids": []
219
+ },
220
+ "lint-gate-present": {
221
+ "source_type": "intelligence-layer-methodology",
222
+ "evidence_level": "E4",
223
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/rules.md"],
224
+ "verified_on": "2026-06-13",
225
+ "fixture_ids": []
226
+ },
227
+ "llm-output-schema-validated": {
228
+ "source_type": "research-motivated-boundary-rule",
229
+ "evidence_level": "E2",
230
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.06847"],
231
+ "verified_on": "2026-06-13",
232
+ "fixture_ids": []
233
+ },
234
+ "local-context-patterns": {
235
+ "source_type": "intelligence-layer-methodology",
236
+ "evidence_level": "E4",
237
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/rules.md"],
238
+ "verified_on": "2026-06-13",
239
+ "fixture_ids": []
240
+ },
241
+ "memory-docs-indexed": {
242
+ "source_type": "intelligence-layer-methodology",
243
+ "evidence_level": "E4",
244
+ "source_urls": [
245
+ "docs/full-spectrum-intelligence-layer.md",
246
+ "https://arxiv.org/abs/2602.20478"
247
+ ],
248
+ "verified_on": "2026-06-13",
249
+ "fixture_ids": []
250
+ },
251
+ "memory-write-provenance": {
252
+ "source_type": "research-motivated-security-posture",
253
+ "evidence_level": "E2",
254
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.11088"],
255
+ "verified_on": "2026-06-13",
256
+ "fixture_ids": []
257
+ },
258
+ "model-interface-pinned": {
259
+ "source_type": "research-motivated-boundary-rule",
260
+ "evidence_level": "E2",
261
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.06847"],
262
+ "verified_on": "2026-06-13",
263
+ "fixture_ids": []
264
+ },
265
+ "no-dangerous-auto-approve": {
266
+ "source_type": "security-practice",
267
+ "evidence_level": "E4",
268
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.11088"],
269
+ "verified_on": "2026-06-13",
270
+ "fixture_ids": []
271
+ },
272
+ "no-duplicate-agent-trees": {
273
+ "source_type": "meta-harness-methodology",
274
+ "evidence_level": "E4",
275
+ "source_urls": ["docs/ai/ai-system.md", "docs/architecture.md"],
276
+ "verified_on": "2026-06-13",
277
+ "fixture_ids": []
278
+ },
279
+ "no-duplicate-skill-trees": {
280
+ "source_type": "meta-harness-methodology",
281
+ "evidence_level": "E4",
282
+ "source_urls": ["docs/ai/ai-system.md", "docs/architecture.md"],
283
+ "verified_on": "2026-06-13",
284
+ "fixture_ids": []
285
+ },
286
+ "no-pull-request-target": {
287
+ "source_type": "security-practice",
288
+ "evidence_level": "E4",
289
+ "source_urls": [
290
+ "docs/rules-catalog.md",
291
+ "https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions"
292
+ ],
293
+ "verified_on": "2026-06-13",
294
+ "fixture_ids": []
295
+ },
296
+ "pr-template-ai-harness-check": {
297
+ "source_type": "corpus-calibrated-maturity-signal",
298
+ "evidence_level": "E4",
299
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/scoring-calibration.md"],
300
+ "verified_on": "2026-06-13",
301
+ "fixture_ids": []
302
+ },
303
+ "qmd-script-present": {
304
+ "source_type": "meta-harness-methodology",
305
+ "evidence_level": "E4",
306
+ "source_urls": ["docs/ai/qmd.md", "docs/architecture.md"],
307
+ "verified_on": "2026-06-13",
308
+ "fixture_ids": []
309
+ },
310
+ "secret-scanning-configured": {
311
+ "source_type": "security-practice",
312
+ "evidence_level": "E4",
313
+ "source_urls": [
314
+ "docs/rules-catalog.md",
315
+ "https://owasp.org/www-project-top-10-for-large-language-model-applications/"
316
+ ],
317
+ "verified_on": "2026-06-13",
318
+ "fixture_ids": []
319
+ },
320
+ "shared-agents-md": {
321
+ "source_type": "meta-harness-methodology",
322
+ "evidence_level": "E4",
323
+ "source_urls": ["docs/meta-harness.md", "docs/architecture.md"],
324
+ "verified_on": "2026-06-13",
325
+ "fixture_ids": ["weak", "normal", "mature"]
326
+ },
327
+ "shared-rules-doc": {
328
+ "source_type": "corpus-calibrated-maturity-signal",
329
+ "evidence_level": "E4",
330
+ "source_urls": ["docs/ai/scoring-calibration.md", "docs/meta-harness.md"],
331
+ "verified_on": "2026-06-13",
332
+ "fixture_ids": ["weak", "normal", "mature"]
333
+ },
334
+ "skill-doc-deep-links": {
335
+ "source_type": "meta-harness-methodology",
336
+ "evidence_level": "E4",
337
+ "source_urls": ["docs/ai/rules.md", "docs/ai/doc-best-practices.md"],
338
+ "verified_on": "2026-06-13",
339
+ "fixture_ids": []
340
+ },
341
+ "skill-frontmatter": {
342
+ "source_type": "agent-skills-spec",
343
+ "evidence_level": "E4",
344
+ "source_urls": ["docs/ai/rules.md", "docs/ai/skill-best-practices.md"],
345
+ "verified_on": "2026-06-13",
346
+ "fixture_ids": ["normal", "mature"]
347
+ },
348
+ "skill-line-count": {
349
+ "source_type": "meta-harness-methodology",
350
+ "evidence_level": "E4",
351
+ "source_urls": ["docs/ai/scoring-calibration.md", "docs/ai/skill-best-practices.md"],
352
+ "verified_on": "2026-06-13",
353
+ "fixture_ids": ["normal", "mature"]
354
+ },
355
+ "skills-index": {
356
+ "source_type": "meta-harness-methodology",
357
+ "evidence_level": "E4",
358
+ "source_urls": ["docs/ai/available-skills.md", "docs/architecture.md"],
359
+ "verified_on": "2026-06-13",
360
+ "fixture_ids": ["normal", "mature"]
361
+ },
362
+ "strict-typecheck-present": {
363
+ "source_type": "intelligence-layer-methodology",
364
+ "evidence_level": "E4",
365
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/rules.md"],
366
+ "verified_on": "2026-06-13",
367
+ "fixture_ids": []
368
+ },
369
+ "test-gates-present": {
370
+ "source_type": "intelligence-layer-methodology",
371
+ "evidence_level": "E4",
372
+ "source_urls": ["docs/full-spectrum-intelligence-layer.md", "docs/ai/rules.md"],
373
+ "verified_on": "2026-06-13",
374
+ "fixture_ids": []
375
+ },
376
+ "tool-allowlist-inventory": {
377
+ "source_type": "research-motivated-security-posture",
378
+ "evidence_level": "E2",
379
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.11088"],
380
+ "verified_on": "2026-06-13",
381
+ "fixture_ids": []
382
+ },
383
+ "tool-contract-tests-present": {
384
+ "source_type": "research-motivated-boundary-rule",
385
+ "evidence_level": "E2",
386
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.06847"],
387
+ "verified_on": "2026-06-13",
388
+ "fixture_ids": []
389
+ },
390
+ "untrusted-input-action-boundary": {
391
+ "source_type": "research-motivated-security-posture",
392
+ "evidence_level": "E2",
393
+ "source_urls": ["docs/rules-catalog.md", "https://arxiv.org/abs/2603.11088"],
394
+ "verified_on": "2026-06-13",
395
+ "fixture_ids": []
396
+ },
397
+ "vscode-agents-location": {
398
+ "source_type": "harness-wiring-practice",
399
+ "evidence_level": "E4",
400
+ "source_urls": ["docs/architecture.md", "docs/ai/ai-system.md"],
401
+ "verified_on": "2026-06-13",
402
+ "fixture_ids": []
403
+ },
404
+ "vscode-custom-hooks": {
405
+ "source_type": "harness-wiring-practice",
406
+ "evidence_level": "E4",
407
+ "source_urls": ["docs/architecture.md", "docs/ai/ai-system.md"],
408
+ "verified_on": "2026-06-13",
409
+ "fixture_ids": []
410
+ },
411
+ "vscode-skills-location": {
412
+ "source_type": "harness-wiring-practice",
413
+ "evidence_level": "E4",
414
+ "source_urls": ["docs/architecture.md", "docs/ai/ai-system.md"],
415
+ "verified_on": "2026-06-13",
416
+ "fixture_ids": []
417
+ }
418
+ }
419
+ }
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@paniolo/scan",
3
- "version": "0.2.3",
3
+ "version": "0.2.4",
4
4
  "description": "The AI Technical Debt Scanner — diagnostic-only CLI that scores your repo's AI harness across Copilot, Cursor, Codex, Antigravity, Claude Code, and Gemini. No writes, no telemetry.",
5
5
  "keywords": [
6
6
  "agents",