agentic-qe 3.14.2 → 3.14.4

package/dist/coordination/consensus/providers/openrouter-provider.d.ts

@@ -14,7 +14,7 @@ import { BaseModelProvider } from '../model-provider';
  * Popular models available through OpenRouter
  * OpenRouter supports 100+ models - these are the most useful for security verification
  */
-export type OpenRouterModel = 'anthropic/claude-3.5-sonnet' | 'anthropic/claude-3-opus' | 'anthropic/claude-3-sonnet' | 'anthropic/claude-3-haiku' | 'openai/gpt-4-turbo' | 'openai/gpt-4' | 'openai/gpt-4o' | 'openai/gpt-4o-mini' | 'google/gemini-pro-1.5' | 'google/gemini-flash-1.5' | 'meta-llama/llama-3.1-405b-instruct' | 'meta-llama/llama-3.1-70b-instruct' | 'meta-llama/llama-3.1-8b-instruct' | 'mistralai/mistral-large' | 'mistralai/mistral-medium' | 'mistralai/mixtral-8x22b-instruct' | 'deepseek/deepseek-chat' | 'deepseek/deepseek-coder' | 'qwen/qwen-2.5-72b-instruct' | 'cohere/command-r-plus' | string;
+export type OpenRouterModel = 'anthropic/claude-sonnet-5' | 'anthropic/claude-opus-5' | 'anthropic/claude-opus-5.5' | 'anthropic/claude-haiku-4.5' | 'openai/gpt-6-sol' | 'openai/gpt-6-luna' | 'openai/gpt-6-astra' | 'openai/gpt-oss-120b' | 'google/gemini-3.8-flash' | 'google/gemini-3.1-pro-preview' | 'google/gemini-2.5-pro' | 'google/gemini-2.5-flash' | 'meta-llama/llama-4-maverick' | 'meta-llama/llama-4-scout' | 'mistralai/mistral-large-2512' | 'deepseek/deepseek-v4-pro' | 'deepseek/deepseek-v4.1-flash' | 'qwen/qwen3-coder' | string;
 /**
  * Model tier for cost/capability classification
  */
@@ -67,7 +67,7 @@ export declare function getCostOptimizedModels(): OpenRouterModel[];
  * ```typescript
  * const provider = new OpenRouterModelProvider({
  *   apiKey: process.env.OPENROUTER_API_KEY,
- *   defaultModel: 'anthropic/claude-3.5-sonnet',
+ *   defaultModel: 'anthropic/claude-sonnet-5',
  * });
  *
  * const result = await provider.complete('Analyze this code for vulnerabilities...');
@@ -135,13 +135,13 @@ export declare class OpenRouterModelProvider extends BaseModelProvider {
  *
  * // With specific model
  * const provider = createOpenRouterProvider({
- *   defaultModel: 'meta-llama/llama-3.1-70b-instruct',
+ *   defaultModel: 'meta-llama/llama-4-maverick',
  * });
  *
  * // With fallback models
  * const provider = createOpenRouterProvider({
- *   defaultModel: 'anthropic/claude-3.5-sonnet',
- *   fallbackModels: ['openai/gpt-4o', 'google/gemini-pro-1.5'],
+ *   defaultModel: 'anthropic/claude-sonnet-5',
+ *   fallbackModels: ['openai/gpt-6-sol', 'google/gemini-2.5-pro'],
  * });
  * ```
  */

package/dist/coordination/consensus/providers/openrouter-provider.js

@@ -10,42 +10,69 @@
  */
 import { BaseModelProvider } from '../model-provider.js';
 import { toErrorMessage, toError } from '../../../shared/error-utils.js';
+import { resolveModelPricing } from '../../../shared/llm/cost-tracker.js';
 // ============================================================================
 // Model Cost and Tier Information
 // ============================================================================
 /**
- * Cost per 1M tokens for popular models (input/output)
- * Updated as of 2024 - check OpenRouter for current prices
+ * Cost per 1M tokens for current models (input/output)
+ * From the OpenRouter public catalog (2026-09-27) - check OpenRouter for current prices
  */
 const MODEL_COSTS = {
     // Claude models
-    'anthropic/claude-3.5-sonnet': { input: 3, output: 15, tier: 'standard' },
-    'anthropic/claude-3-opus': { input: 15, output: 75, tier: 'premium' },
-    'anthropic/claude-3-sonnet': { input: 3, output: 15, tier: 'standard' },
-    'anthropic/claude-3-haiku': { input: 0.25, output: 1.25, tier: 'cheap' },
+    'anthropic/claude-sonnet-5': { input: 2, output: 10, tier: 'standard' },
+    'anthropic/claude-opus-5': { input: 5, output: 25, tier: 'premium' },
+    'anthropic/claude-opus-5.5': { input: 4, output: 20, tier: 'premium' },
+    'anthropic/claude-haiku-4.5': { input: 1, output: 5, tier: 'cheap' },
     // OpenAI models
-    'openai/gpt-4-turbo': { input: 10, output: 30, tier: 'standard' },
-    'openai/gpt-4': { input: 30, output: 60, tier: 'premium' },
-    'openai/gpt-4o': { input: 5, output: 15, tier: 'standard' },
-    'openai/gpt-4o-mini': { input: 0.15, output: 0.6, tier: 'cheap' },
+    'openai/gpt-6-astra': { input: 10, output: 50, tier: 'premium' },
+    'openai/gpt-6-sol': { input: 2, output: 10, tier: 'standard' },
+    'openai/gpt-6-luna': { input: 0.1, output: 0.5, tier: 'cheap' },
+    'openai/gpt-oss-120b': { input: 0.15, output: 0.6, tier: 'cheap' },
     // Google models
-    'google/gemini-pro-1.5': { input: 3.5, output: 10.5, tier: 'standard' },
-    'google/gemini-flash-1.5': { input: 0.075, output: 0.3, tier: 'cheap' },
+    'google/gemini-3.1-pro-preview': { input: 2, output: 12, tier: 'standard' },
+    'google/gemini-2.5-pro': { input: 1.25, output: 10, tier: 'standard' },
+    'google/gemini-3.8-flash': { input: 0.75, output: 3.75, tier: 'cheap' },
+    'google/gemini-2.5-flash': { input: 0.3, output: 2.5, tier: 'cheap' },
     // Llama models
-    'meta-llama/llama-3.1-405b-instruct': { input: 2.7, output: 2.7, tier: 'standard' },
-    'meta-llama/llama-3.1-70b-instruct': { input: 0.52, output: 0.75, tier: 'cheap' },
-    'meta-llama/llama-3.1-8b-instruct': { input: 0.055, output: 0.055, tier: 'free' },
+    'meta-llama/llama-4-maverick': { input: 0.1875, output: 0.6525, tier: 'cheap' },
+    'meta-llama/llama-4-scout': { input: 0.1, output: 0.3, tier: 'cheap' },
     // Mistral models
-    'mistralai/mistral-large': { input: 3, output: 9, tier: 'standard' },
-    'mistralai/mixtral-8x22b-instruct': { input: 0.65, output: 0.65, tier: 'cheap' },
+    'mistralai/mistral-large-2512': { input: 0.5, output: 1.5, tier: 'cheap' },
     // DeepSeek models
-    'deepseek/deepseek-chat': { input: 0.14, output: 0.28, tier: 'cheap' },
-    'deepseek/deepseek-coder': { input: 0.14, output: 0.28, tier: 'cheap' },
+    'deepseek/deepseek-v4-pro': { input: 0.348, output: 0.696, tier: 'cheap' },
+    'deepseek/deepseek-v4.1-flash': { input: 0.035, output: 0.29, tier: 'cheap' },
     // Qwen models
-    'qwen/qwen-2.5-72b-instruct': { input: 0.35, output: 0.4, tier: 'cheap' },
-    // Cohere models
-    'cohere/command-r-plus': { input: 2.5, output: 10, tier: 'standard' },
+    'qwen/qwen3-coder': { input: 0.3, output: 1, tier: 'cheap' },
 };
+/**
+ * Deprecated models no longer served by OpenRouter. Pricing only, so historical
+ * usage still costs correctly — excluded from supported models and tier lists.
+ */
+const DEPRECATED_MODEL_COSTS = {
+    'anthropic/claude-3.5-sonnet': { input: 3, output: 15 },
+    'anthropic/claude-3-opus': { input: 15, output: 75 },
+    'anthropic/claude-3-sonnet': { input: 3, output: 15 },
+    'anthropic/claude-3-haiku': { input: 0.25, output: 1.25 },
+    'openai/gpt-4-turbo': { input: 10, output: 30 },
+    'openai/gpt-4': { input: 30, output: 60 },
+    'openai/gpt-4o': { input: 5, output: 15 },
+    'openai/gpt-4o-mini': { input: 0.15, output: 0.6 },
+    'google/gemini-pro-1.5': { input: 3.5, output: 10.5 },
+    'google/gemini-flash-1.5': { input: 0.075, output: 0.3 },
+    'meta-llama/llama-3.1-405b-instruct': { input: 2.7, output: 2.7 },
+    'meta-llama/llama-3.1-70b-instruct': { input: 0.52, output: 0.75 },
+    'meta-llama/llama-3.1-8b-instruct': { input: 0.055, output: 0.055 },
+    'mistralai/mistral-large': { input: 3, output: 9 },
+    'mistralai/mixtral-8x22b-instruct': { input: 0.65, output: 0.65 },
+    'deepseek/deepseek-chat': { input: 0.14, output: 0.28 },
+    'deepseek/deepseek-coder': { input: 0.14, output: 0.28 },
+    'qwen/qwen-2.5-72b-instruct': { input: 0.35, output: 0.4 },
+    'cohere/command-r-plus': { input: 2.5, output: 10 },
+};
+function lookupModelCost(model) {
+    return MODEL_COSTS[model] ?? DEPRECATED_MODEL_COSTS[model] ?? resolveModelPricing(model);
+}
 /**
  * Get models by tier for cost optimization
  */
@@ -60,10 +87,10 @@ export function getModelsByTier(tier) {
  */
 export function getRecommendedSecurityModels() {
     return [
-        'anthropic/claude-3.5-sonnet', // Best for security analysis
-        'openai/gpt-4o', // Strong reasoning
-        'google/gemini-pro-1.5', // Good code understanding
-        'mistralai/mistral-large', // Cost-effective alternative
+        'anthropic/claude-sonnet-5', // Best for security analysis
+        'openai/gpt-6-sol', // Strong reasoning
+        'google/gemini-2.5-pro', // Good code understanding
+        'deepseek/deepseek-v4-pro', // Cost-effective alternative
     ];
 }
 /**
@@ -71,17 +98,17 @@ export function getRecommendedSecurityModels() {
  */
 export function getCostOptimizedModels() {
     return [
-        'anthropic/claude-3-haiku', // Fast and cheap Claude
-        'openai/gpt-4o-mini', // Cheap GPT-4
-        'google/gemini-flash-1.5', // Very cheap Gemini
-        'deepseek/deepseek-chat', // Very cheap alternative
+        'anthropic/claude-haiku-4.5', // Fast and cheap Claude
+        'openai/gpt-6-luna', // Cheap GPT-6
+        'google/gemini-3.8-flash', // Cheap Gemini
+        'qwen/qwen3-coder', // Very cheap alternative
     ];
 }
 // ============================================================================
 // OpenRouter Provider Implementation
 // ============================================================================
 const DEFAULT_CONFIG = {
-    defaultModel: 'anthropic/claude-3.5-sonnet',
+    defaultModel: 'anthropic/claude-sonnet-5',
     defaultTimeout: 120000, // 2 minutes
     maxRetries: 3,
     retryDelayMs: 1000,
@@ -97,7 +124,7 @@ const DEFAULT_CONFIG = {
  * ```typescript
  * const provider = new OpenRouterModelProvider({
  *   apiKey: process.env.OPENROUTER_API_KEY,
- *   defaultModel: 'anthropic/claude-3.5-sonnet',
+ *   defaultModel: 'anthropic/claude-sonnet-5',
  * });
  *
  * const result = await provider.complete('Analyze this code for vulnerabilities...');
@@ -127,7 +154,7 @@ export class OpenRouterModelProvider extends BaseModelProvider {
         this.id = `openrouter-${(this.config.defaultModel ?? 'default').replace(/[^a-z0-9]/gi, '-')}`;
         this.name = `OpenRouter (${this.config.defaultModel ?? 'default'})`;
         // Set cost per token based on default model
-        const modelCosts = MODEL_COSTS[this.config.defaultModel];
+        const modelCosts = lookupModelCost(this.config.defaultModel);
         if (modelCosts) {
             this.costPerToken = {
                 input: modelCosts.input / 1_000_000,
@@ -183,7 +210,7 @@ export class OpenRouterModelProvider extends BaseModelProvider {
                     this.requestCount++;
                     // Track cost
                     if (response.usage) {
-                        const costs = MODEL_COSTS[tryModel] || { input: 1, output: 2 };
+                        const costs = lookupModelCost(tryModel) || { input: 1, output: 2 };
                         const cost = (response.usage.prompt_tokens * costs.input +
                             response.usage.completion_tokens * costs.output) /
                             1_000_000;
@@ -330,13 +357,13 @@ Format your response with: verdict (confirmed/rejected/uncertain), confidence (0
  *
  * // With specific model
  * const provider = createOpenRouterProvider({
- *   defaultModel: 'meta-llama/llama-3.1-70b-instruct',
+ *   defaultModel: 'meta-llama/llama-4-maverick',
  * });
  *
  * // With fallback models
  * const provider = createOpenRouterProvider({
- *   defaultModel: 'anthropic/claude-3.5-sonnet',
- *   fallbackModels: ['openai/gpt-4o', 'google/gemini-pro-1.5'],
+ *   defaultModel: 'anthropic/claude-sonnet-5',
+ *   fallbackModels: ['openai/gpt-6-sol', 'google/gemini-2.5-pro'],
  * });
  * ```
  */

package/dist/coordination/handlers/handler-types.d.ts

@@ -5,6 +5,7 @@
  * of DomainTaskExecutor needed to register and implement handlers.
  */
 import type { Result } from '../../shared/types';
+import type { MemoryBackend } from '../../kernel/interfaces.js';
 import type { QueenTask, TaskType } from '../queen-coordinator';
 import type { CoverageAnalyzerService } from '../../domains/coverage-analysis';
 import type { SecurityScannerService } from '../../domains/security-compliance';
@@ -20,6 +21,8 @@ export type InstanceTaskHandler = (task: QueenTask) => Promise<Result<unknown, E
 export interface TaskHandlerContext {
     /** Register a handler for a given task type */
     registerHandler(type: TaskType, handler: InstanceTaskHandler): void;
+    /** Initialized kernel memory, including canonical measured quality evidence. */
+    readonly memory: MemoryBackend;
     /** Lazy service getters */
     getCoverageAnalyzer(): CoverageAnalyzerService;
     getSecurityScanner(): SecurityScannerService;

package/dist/coordination/handlers/quality-handlers.js

@@ -7,11 +7,21 @@
 import { ok, err } from '../../shared/types/index.js';
 import { toError } from '../../shared/error-utils.js';
 import { discoverSourceFiles } from './handler-utils.js';
+import { evaluateQualityEvidence, loadQualityEvidence, } from '../../domains/quality-assessment/quality-evidence.js';
 export function registerQualityHandlers(ctx) {
     // Register quality assessment handler - REAL IMPLEMENTATION
     ctx.registerHandler('assess-quality', async (task) => {
         const payload = task.payload;
         try {
+            // An explicit gate evaluates the same measured, timestamped evidence as
+            // `aqe quality --gate`. Static source scores cannot substitute for it.
+            if (payload.runGate === true) {
+                const measured = await loadQualityEvidence(ctx.memory);
+                return ok({
+                    ...evaluateQualityEvidence(measured),
+                    metrics: measured,
+                });
+            }
             const analyzer = ctx.getQualityAnalyzer();
             const threshold = payload.threshold || 80;
             // Determine source files to analyze

package/dist/coordination/handlers/security-handlers.js

@@ -7,48 +7,47 @@
 import * as fs from 'fs/promises';
 import * as path from 'path';
 import { ok, err } from '../../shared/types/index.js';
+import { createHash } from 'node:crypto';
 import { toError } from '../../shared/error-utils.js';
 import { FilePath } from '../../shared/value-objects/index.js';
-import { discoverSourceFiles, generateSecurityRecommendations } from './handler-utils.js';
+import { generateSecurityRecommendations } from './handler-utils.js';
+import { discoverSecurityFiles, isSecuritySourceFile } from '../../domains/security-compliance/scan-discovery.js';
 export function registerSecurityHandlers(ctx) {
     // Register security scan handler - REAL IMPLEMENTATION
     ctx.registerHandler('scan-security', async (task) => {
         const payload = task.payload;
         try {
-            const scanner = ctx.getSecurityScanner();
-            const targetPath = payload.target || process.cwd();
-            // Discover files to scan
-            const filesToScan = await discoverSourceFiles(targetPath);
-            if (filesToScan.length === 0) {
-                return ok({
-                    vulnerabilities: 0,
-                    critical: 0,
-                    high: 0,
-                    medium: 0,
-                    low: 0,
-                    informational: 0,
-                    topVulnerabilities: [],
-                    recommendations: ['No source files found to scan'],
-                    scanTypes: {
-                        sast: payload.sast !== false,
-                        dast: payload.dast || false,
-                    },
-                    warning: `No source files found in ${targetPath}`,
-                });
-            }
+            const targetPath = path.resolve(payload.target || process.cwd());
+            const sastRequested = payload.sast !== false;
+            const discoveryResult = sastRequested ? await discoverSecurityFiles(targetPath) : undefined;
+            const filesToScan = discoveryResult?.files ?? [];
+            const fileEvidence = [];
+            const engines = [];
+            const genericRules = new Map();
+            const genericErrors = [];
+            const manifestErrors = [];
+            const manifestRules = new Map();
+            const limitations = [];
             // Separate files by language capability
-            const jstsFiles = filesToScan.filter(f => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(f));
-            const otherFiles = filesToScan.filter(f => !/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(f));
+            const jstsFiles = filesToScan.filter(f => /\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(f));
+            const otherFiles = filesToScan.filter(f => !/\.(ts|tsx|js|jsx|mjs|cjs)$/i.test(f));
             // Run basic cross-language security patterns on non-JS/TS files
             const crossLangVulns = [];
             // Run secret/CORS patterns on ALL files (not just otherFiles) to catch JS/TS secrets too
             for (const filePath of filesToScan) {
+                if (!isSecuritySourceFile(filePath)) {
+                    fileEvidence.push({ path: filePath, engineId: 'generic-patterns', status: 'unsupported',
+                        readLines: 0, analyzedLines: 0, reason: 'Outside the declared source-language policy.' });
+                    continue;
+                }
                 try {
-                    const content = await fs.readFile(filePath, 'utf-8');
+                    const source = await fs.readFile(filePath);
+                    const content = source.toString('utf-8');
                     const lines = content.split('\n');
-                    const relPath = filePath.startsWith(targetPath)
-                        ? filePath.slice(targetPath.length).replace(/^\//, '')
-                        : filePath;
+                    fileEvidence.push({ path: filePath, engineId: 'generic-patterns', status: 'analyzed',
+                        sourceDigest: createHash('sha256').update(source).digest('hex'),
+                        readLines: lines.length, analyzedLines: lines.length });
+                    const relPath = path.relative(targetPath, filePath) || path.basename(filePath);
                     // Pattern: Hardcoded secrets/keys
                     // Fix #287: Use \w* around keywords to match SECRET_KEY, JWT_SECRET, API_TOKEN, etc.
                     const secretPatterns = [
@@ -56,7 +55,8 @@ export function registerSecurityHandlers(ctx) {
                         { regex: /\w*(?:token|auth_token|access_key|secret_key)\w*\s*[=:]\s*['"][^'"]{8,}['"]/gi, title: 'Hardcoded credential', severity: 'critical' },
                         { regex: /(?:AWS_SECRET|GITHUB_TOKEN|SLACK_TOKEN|OPENAI_API_KEY)\s*[=:]\s*['"][^'"]+['"]/gi, title: 'Hardcoded cloud credential', severity: 'critical' },
                     ];
-                    for (const pattern of secretPatterns) {
+                    for (const [index, pattern] of secretPatterns.entries()) {
+                        genericRules.set(`secret-${index}`, pattern.regex.toString());
                         for (let i = 0; i < lines.length; i++) {
                             // Use matchAll to find ALL secrets on a single line (not just first)
                             const matches = [...lines[i].matchAll(pattern.regex)];
@@ -73,6 +73,7 @@ export function registerSecurityHandlers(ctx) {
                     }
                     // Pattern: SQL injection risks
                     const sqlPatterns = /(?:execute|query|cursor\.execute)\s*\(\s*(?:f['"]|['"].*%s|['"].*\+\s*\w)/gi;
+                    genericRules.set('sql-interpolation', sqlPatterns.toString());
                     for (let i = 0; i < lines.length; i++) {
                         if (sqlPatterns.test(lines[i])) {
                             crossLangVulns.push({
@@ -93,7 +94,8 @@ export function registerSecurityHandlers(ctx) {
                         /@CrossOrigin\(\s*origins?\s*=\s*["']\*["']/i, // Spring Boot
                         /\.Header\(\)\.Set\(["']Access-Control-Allow-Origin["'],\s*["']\*["']/i, // Go
                     ];
-                    for (const corsPattern of corsPatterns) {
+                    for (const [index, corsPattern] of corsPatterns.entries()) {
+                        genericRules.set(`cors-${index}`, corsPattern.toString());
                         if (corsPattern.test(content)) {
                             crossLangVulns.push({
                                 title: 'CORS wildcard origin',
@@ -106,6 +108,7 @@ export function registerSecurityHandlers(ctx) {
                         }
                     }
                     // Pattern: Debug/development mode enabled
+                    genericRules.set('debug-mode', /(?:DEBUG|debug)\s*[=:]\s*(?:True|true|1)/i.toString());
                     if (/(?:DEBUG|debug)\s*[=:]\s*(?:True|true|1)/i.test(content)) {
                         crossLangVulns.push({
                             title: 'Debug mode enabled',
@@ -116,6 +119,7 @@ export function registerSecurityHandlers(ctx) {
                         });
                     }
                     // Pattern: Eval/exec usage
+                    genericRules.set('eval-exec', /\b(?:eval|exec)\s*\(/i.toString());
                     if (/\b(?:eval|exec)\s*\(/i.test(content)) {
                         crossLangVulns.push({
                             title: 'Dangerous eval/exec usage',
@@ -126,16 +130,24 @@ export function registerSecurityHandlers(ctx) {
                         });
                     }
                 }
-                catch {
-                    // Skip unreadable files
+                catch (error) {
+                    const reason = `Source read failed: ${safeErrorCode(error)}`;
+                    genericErrors.push(`${filePath}: ${reason}`);
+                    fileEvidence.push({ path: filePath, engineId: 'generic-patterns', status: 'unreadable',
+                        readLines: 0, analyzedLines: 0, reason });
                 }
             }
             // Also check dependency manifests for known vulnerable packages
             const depManifests = ['requirements.txt', 'pyproject.toml', 'Gemfile', 'go.mod', 'Cargo.toml'];
-            for (const manifest of depManifests) {
+            for (const manifest of sastRequested ? depManifests : []) {
                 const manifestPath = path.join(targetPath, manifest);
                 try {
-                    const manifestContent = await fs.readFile(manifestPath, 'utf-8');
+                    const manifestSource = await fs.readFile(manifestPath);
+                    const manifestContent = manifestSource.toString('utf-8');
+                    const manifestLines = manifestContent.split('\n').length;
+                    fileEvidence.push({ path: manifestPath, engineId: 'dependency-manifest-patterns', status: 'analyzed',
+                        sourceDigest: createHash('sha256').update(manifestSource).digest('hex'), readLines: manifestLines, analyzedLines: manifestLines });
+                    manifestRules.set('dependency-audit-advisory', 'Presence of a supported dependency manifest');
                     crossLangVulns.push({
                         title: 'Dependency audit recommended',
                         severity: 'informational',
@@ -151,6 +163,7 @@ export function registerSecurityHandlers(ctx) {
                             { pkg: 'python-multipart', pattern: /python-multipart/i, cve: 'CVE-2026-24486', severity: 'critical', title: 'python-multipart DoS (CVE-2026-24486)', description: 'python-multipart denial of service via crafted multipart data — upgrade to >=0.0.18' },
                         ];
                         for (const known of knownCVEs) {
+                            manifestRules.set(known.cve, known.pattern.toString());
                             if (known.pattern.test(manifestContent)) {
                                 crossLangVulns.push({
                                     title: known.title,
@@ -163,32 +176,108 @@ export function registerSecurityHandlers(ctx) {
                         }
                     }
                 }
-                catch {
-                    // Manifest doesn't exist
+                catch (error) {
+                    const code = error.code;
+                    if (code !== 'ENOENT' && code !== 'ENOTDIR') {
+                        const reason = `Manifest read failed: ${safeErrorCode(error)}`;
+                        manifestErrors.push(`${manifestPath}: ${reason}`);
+                        fileEvidence.push({ path: manifestPath, engineId: 'dependency-manifest-patterns', status: 'unreadable',
+                            readLines: 0, analyzedLines: 0, reason });
+                    }
                 }
             }
+            const genericAnalyzed = fileEvidence.filter(file => file.engineId === 'generic-patterns' && file.status === 'analyzed').length;
+            const manifestsAnalyzed = fileEvidence.filter(file => file.engineId === 'dependency-manifest-patterns' && file.status === 'analyzed').length;
+            engines.push({ id: 'dependency-manifest-patterns', requested: sastRequested, required: false,
+                status: !sastRequested ? 'disabled' : manifestErrors.length > 0 ? (manifestsAnalyzed > 0 ? 'partial' : 'failed') : manifestsAnalyzed > 0 ? 'completed' : 'not-run',
+                scope: 'parent-directory', target: targetPath, analyzedFiles: manifestsAnalyzed,
+                ruleIds: [...manifestRules.keys()].sort(), rulesetDigest: createHash('sha256').update(JSON.stringify([...manifestRules.entries()].sort())).digest('hex'),
+                ruleCoverage: 'known', errors: manifestErrors, limitations: ['Manifest name patterns are advisories, not a resolved dependency or version audit.'] });
+            const genericLimitations = ['Generic text patterns do not establish language-specific or dependency vulnerability coverage.'];
+            engines.push({ id: 'generic-patterns', requested: sastRequested, required: sastRequested,
+                status: !sastRequested ? 'disabled' : genericErrors.length > 0 ? (genericAnalyzed > 0 ? 'partial' : 'failed')
+                    : genericAnalyzed === filesToScan.length && genericAnalyzed > 0 ? 'completed'
+                        : genericAnalyzed > 0 ? 'partial' : filesToScan.length > 0 ? 'unavailable' : 'not-run',
+                scope: 'requested-files', analyzedFiles: genericAnalyzed,
+                ruleIds: [...genericRules.keys()].sort(),
+                rulesetDigest: createHash('sha256').update(JSON.stringify([...genericRules.entries()].sort())).digest('hex'),
+                ruleCoverage: 'known', errors: genericErrors, limitations: genericLimitations });
             // Convert JS/TS file paths to FilePath value objects for the SAST scanner
             const filePathObjects = jstsFiles.map(filePath => FilePath.create(filePath));
-            // Run SAST scan on JS/TS files if requested and files exist
+            // Only returned execution receipts can establish SAST coverage.
             let sastResult = null;
-            if (payload.sast !== false && filePathObjects.length > 0) {
-                const result = await scanner.scanFiles(filePathObjects);
-                if (result.success) {
-                    sastResult = result.value;
+            if (sastRequested && filePathObjects.length > 0) {
+                try {
+                    const result = await ctx.getSecurityScanner().scanFiles(filePathObjects);
+                    if (result.success) {
+                        sastResult = result.value;
+                        if (sastResult.evidence) {
+                            fileEvidence.push(...sastResult.evidence.files);
+                            engines.push(...sastResult.evidence.engines);
+                            limitations.push(...sastResult.evidence.limitations);
+                        }
+                        else {
+                            engines.push(unverifiedEngine('sast', 'requested-files'));
+                        }
+                    }
+                    else {
+                        engines.push(failedEngine('sast', 'requested-files', result.error));
+                    }
+                }
+                catch (error) {
+                    engines.push(failedEngine('sast', 'requested-files', error));
                 }
             }
-            // Run DAST scan if URL provided and dast is enabled
+            else {
+                engines.push({ id: 'sast', requested: sastRequested, required: false,
+                    status: sastRequested ? 'not-run' : 'disabled', scope: 'requested-files', analyzedFiles: 0,
+                    ruleCoverage: 'unknown', errors: [], limitations: sastRequested ? ['No JS/TS files were available for language-specific SAST.'] : [] });
+            }
             let dastResult = null;
             if (payload.dast && payload.targetUrl) {
-                const result = await scanner.scanUrl(payload.targetUrl, {
-                    activeScanning: true,
-                    maxDepth: 3,
-                    timeout: 30000,
-                });
-                if (result.success) {
-                    dastResult = result.value;
+                try {
+                    const result = await ctx.getSecurityScanner().scanUrl(payload.targetUrl, {
+                        activeScanning: true, maxDepth: 3, timeout: 30000,
+                    });
+                    if (result.success) {
+                        dastResult = result.value;
+                        // Legacy DAST results contain findings, but no execution coverage receipt.
+                        engines.push({ ...unverifiedEngine('dast', 'url'), target: payload.targetUrl });
+                    }
+                    else {
+                        engines.push({ ...failedEngine('dast', 'url', result.error), target: payload.targetUrl });
+                    }
                 }
+                catch (error) {
+                    engines.push({ ...failedEngine('dast', 'url', error), target: payload.targetUrl });
+                }
+            }
+            else {
+                engines.push({ id: 'dast', requested: payload.dast === true, required: payload.dast === true,
+                    status: payload.dast ? 'not-run' : 'disabled', scope: 'url', ruleCoverage: 'unknown',
+                    errors: payload.dast ? ['DAST was requested without targetUrl.'] : [], limitations: [] });
             }
+            if (payload.compliance?.length) {
+                engines.push({ id: 'compliance', requested: true, required: true, status: 'not-run',
+                    scope: 'requested-files', ruleCoverage: 'unknown', errors: [],
+                    limitations: ['Requested compliance checks are not executed by this task handler.'] });
+            }
+            const requestedPaths = new Set(filesToScan);
+            const analyzedPaths = new Set(fileEvidence.filter(file => file.status === 'analyzed' && requestedPaths.has(file.path)).map(file => file.path));
+            const requiredEngines = engines.filter(engine => engine.requested && engine.required);
+            const hasExecuted = analyzedPaths.size > 0;
+            const complete = hasExecuted && requiredEngines.every(engine => engine.status === 'completed') &&
+                (!discoveryResult || discoveryResult.discovery.status === 'complete');
+            const evidence = {
+                schemaVersion: 1, completeness: complete ? 'complete' : hasExecuted ? 'partial' : 'none',
+                requestedFiles: filesToScan.length, requestedPaths: filesToScan, duplicateInputs: 0,
+                files: fileEvidence, engines,
+                limitations: [...new Set([...limitations, ...engines.flatMap(engine => [...engine.limitations, ...engine.errors]),
+                        ...(discoveryResult?.discovery.issues.map(issue => `${issue.path}: ${issue.reason}`) ?? [])])],
+                ...(discoveryResult ? { discovery: discoveryResult.discovery } : {}),
+            };
+            const deepAnalysisPerformed = Boolean(sastResult?.evidence?.engines.some(engine => engine.id === 'patterns' && (engine.status === 'completed' || engine.status === 'partial') &&
+                (engine.analyzedFiles ?? 0) > 0));
             // Combine results from all scan sources - SAST, DAST, and cross-language patterns
             const crossLangSeverityCounts = {
                 critical: crossLangVulns.filter(v => v.severity === 'critical').length,
@@ -224,7 +313,9 @@ export function registerSecurityHandlers(ctx) {
                 description: v.description,
             }));
             // Generate recommendations based on findings
-            const recommendations = generateSecurityRecommendations(allVulns);
+            const recommendations = allVulns.length === 0 && evidence.completeness !== 'complete'
+                ? ['No findings reported; requested analysis is incomplete or unverified. Inspect execution receipts.']
+                : generateSecurityRecommendations(allVulns);
             return ok({
                 vulnerabilities: allVulns.length,
                 critical: summary.critical,
@@ -233,33 +324,24 @@ export function registerSecurityHandlers(ctx) {
                 low: summary.low,
                 informational: summary.informational,
                 topVulnerabilities,
+                findings: allVulns,
                 recommendations,
                 scanTypes: {
                     sast: payload.sast !== false,
                     dast: payload.dast || false,
                 },
-                filesScanned: filesToScan.length,
-                jstsFilesScanned: jstsFiles.length,
-                otherFilesScanned: otherFiles.length,
-                coverage: sastResult?.coverage,
-                // #569 (companion note): "zero findings" from a scan that ran no
-                // language-specific analysis is not evidence of absence, and combined
-                // with a coverage number it reads as "this code is clean and covered".
-                // Say plainly which depth of analysis actually ran.
-                deepAnalysisPerformed: jstsFiles.length > 0,
-                analysisDepth: jstsFiles.length > 0
-                    ? (otherFiles.length > 0 ? 'full-sast-on-js-ts; pattern-matching-on-other-languages' : 'full-sast')
-                    : 'pattern-matching-only',
-                ...(jstsFiles.length === 0 ? {
-                    note: otherFiles.length > 0
-                        ? 'NO LANGUAGE-SPECIFIC ANALYSIS RAN. Only cross-language pattern matching ' +
-                            '(secrets, CORS, eval/exec) was applied to these files — full SAST is ' +
-                            'implemented for JS/TS only. A zero-finding result here means "nothing ' +
-                            'matched a generic pattern", NOT "no vulnerabilities". Run a ' +
-                            'language-specific tool (cargo audit / clippy, bandit, gosec, semgrep) ' +
-                            'for real coverage of this codebase.'
-                        : 'No source files were analyzed.',
-                } : {}),
+                status: evidence.completeness === 'complete' ? 'completed' : evidence.completeness === 'partial' ? 'partial' : 'unavailable',
+                evidence,
+                limitations: evidence.limitations,
+                filesScanned: analyzedPaths.size,
+                jstsFilesScanned: jstsFiles.filter(file => analyzedPaths.has(file)).length,
+                otherFilesScanned: otherFiles.filter(file => analyzedPaths.has(file)).length,
+                ...(sastResult?.evidence ? { coverage: sastResult.coverage } : {}),
+                deepAnalysisPerformed,
+                analysisDepth: deepAnalysisPerformed
+                    ? (otherFiles.length > 0 ? 'sast-patterns-on-js-ts; generic-patterns-on-other-languages' : 'sast-patterns')
+                    : genericAnalyzed > 0 ? 'pattern-matching-only' : 'none',
+                ...(!deepAnalysisPerformed ? { note: 'No verified language-specific SAST ran. Generic pattern matches and partial findings do not establish that the target is free of vulnerabilities.' } : {}),
             });
         }
         catch (error) {
@@ -267,4 +349,18 @@ export function registerSecurityHandlers(ctx) {
         }
     });
 }
+function failedEngine(id, scope, error) {
+    const reason = id === 'sast' && error instanceof Error && error.message.startsWith('No valid rule sets found:')
+        ? 'No valid rule sets configured.' : `${id} execution failed (${safeErrorCode(error)}).`;
+    return { id, requested: true, required: true, status: 'failed', scope,
+        ruleCoverage: 'unknown', errors: [reason], limitations: [] };
+}
+function safeErrorCode(error) {
+    const code = error?.code;
+    return typeof code === 'string' && /^[A-Z0-9_]{1,32}$/.test(code) ? code : 'UNKNOWN';
+}
+function unverifiedEngine(id, scope) {
+    return { id, requested: true, required: true, status: 'unverified', scope,
+        ruleCoverage: 'unknown', errors: [], limitations: [`${id} returned no execution receipt; coverage is unverified.`] };
+}
 //# sourceMappingURL=security-handlers.js.map