nsauditor-ai 0.2.56 → 0.2.57

package/utils/export_csv.mjs

@@ -1,6 +1,8 @@
 // utils/export_csv.mjs
 // Export scan results as CSV.
 
+import { csvTokens, PAYLOAD_KEYS } from './service_flags.mjs';
+
 /**
  * Escape a CSV field value.
  * - Wrap in double quotes if contains comma, newline, or double quote
@@ -24,30 +26,13 @@ export function escapeCsvField(value) {
 const COLUMNS = ['host', 'port', 'protocol', 'service', 'program', 'version', 'status', 'cpe', 'security_findings'];
 
 /**
- * Build a security_findings string from a service record.
- * @param {object} svc
+ * The security_findings cell for a record: the shared service-flag table's tokens (utils/service_flags.mjs, 1.3.0 (s1)),
+ * one per key that fired with its items joined by ';'. A custom SNMP community is never a finding and never printed.
+ * @param {object} record
  * @returns {string}
  */
-function buildFindings(svc) {
-  const parts = [];
-
-  if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length) {
-    parts.push(`weak_algorithms:${svc.weakAlgorithms.length}`);
-  }
-  if (svc.anonymousLogin) {
-    parts.push('anonymous_login');
-  }
-  if (svc.axfrAllowed) {
-    parts.push('axfr_allowed');
-  }
-  if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length) {
-    parts.push(`dangerous_methods:${svc.dangerousMethods.join(';')}`);
-  }
-  if (svc.community) {
-    parts.push(`default_community:${svc.community}`);
-  }
-
-  return parts.join(',');
+function buildFindings(record) {
+  return csvTokens(record).join(',');
 }
 
 /**
@@ -77,6 +62,13 @@ export function buildCsv(scanData) {
     ];
     return fields.map(escapeCsvField).join(',');
   });
+  // An adapter payload that landed in evidence (no port — a domain's DNS posture when no 53/udp service was found) gets
+  // its own row, with no port: its findings must not depend on whether an unrelated port answered.
+  for (const e of conclusion?.result?.evidence ?? []) {
+    if (!PAYLOAD_KEYS.some((k) => e?.[k] != null)) continue;
+    const payload = Object.fromEntries(PAYLOAD_KEYS.filter((k) => e[k] != null).map((k) => [k, e[k]]));
+    rows.push([host, '', '', e.from ?? '', '', '', '', '', buildFindings(payload)].map(escapeCsvField).join(','));
+  }
 
   return [header, ...rows].join('\r\n') + '\r\n';
 }

package/utils/mcp_call_digest.mjs

@@ -0,0 +1,31 @@
+// utils/mcp_call_digest.mjs
+// What binds an MCP tool response to its call_id (1.3.0 (s6)). The server logs a digest of the response BODY — the text
+// the receipt footer is appended to — and `nsauditor-ai mcp verify-call <id> --response <file>` recomputes it from the
+// text the user saved. The digest is never printed: a printed digest would replay together with the id.
+//
+// Canonicalisation is WHITESPACE-INSENSITIVE and WORD-EXACT (ruled): every whitespace run, newlines included, becomes
+// one space and the ends are trimmed. A copy that a client soft-wrapped or re-flowed still verifies; a changed word
+// does not. Stated limits: a RENDERED copy (Markdown turned into bullets and bold) is a different text and refutes —
+// copy the raw tool output; and differences inside code blocks that are whitespace only (indentation) are not seen.
+
+import { createHash } from 'node:crypto';
+
+/** The first line of the footer every tool response carries. */
+export const RECEIPT_MARKER = '── MCP call receipt ──';
+
+/** The response reduced to its words: every whitespace run becomes one space, the ends trimmed. */
+export function canonicalResponse(text) {
+  return String(text ?? '').replace(/\s+/g, ' ').trim();
+}
+
+/** SHA-256 (hex) of the canonical response body. */
+export function responseDigest(body) {
+  return createHash('sha256').update(canonicalResponse(body), 'utf8').digest('hex');
+}
+
+/** The body of a saved response: everything before the receipt footer, which is not part of what the tool produced. */
+export function bodyOf(saved) {
+  const text = String(saved ?? '');
+  const at = text.lastIndexOf(RECEIPT_MARKER);
+  return at < 0 ? text : text.slice(0, at);
+}

package/utils/net_validation.mjs

@@ -1,43 +1,93 @@
 // utils/net_validation.mjs
 // Shared IP/host validation utilities for SSRF prevention.
+//
+// 1.3.0 lane 1 A: the classifier was a set of string tests — an exact `addr === '::1'`, mapped
+// IPv4 only in dotted notation, `/^fe80:/` for fe80::/10, IPv4 only as four decimal parts — and the
+// resolver read the FIRST answer only. So `0:0:0:0:0:0:0:1`, `::ffff:7f00:1` (127.0.0.1),
+// `::ffff:a9fe:a9fe` (169.254.169.254), `febf::1`, `0x7f000001` and a name answering
+// [public, 127.0.0.1] all passed. It now classifies on net.BlockList — which compares by address
+// value, so every IPv6 spelling of one address agrees and IPv4 rules also match the IPv4-mapped
+// form — after canonicalising the input, and the resolver checks EVERY answer.
+//
+// Stated limit: NAT64 (64:ff9b::/96) addresses that embed a blocked IPv4 are not classified.
 
 import dns from 'node:dns/promises';
+import net from 'node:net';
+
+// Refused in every configuration, NSA_ALLOW_ALL_HOSTS included: loopback, unspecified,
+// link-local and the cloud metadata endpoints.
+const ALWAYS = new net.BlockList();
+ALWAYS.addSubnet('127.0.0.0', 8, 'ipv4');          // loopback
+ALWAYS.addSubnet('0.0.0.0', 8, 'ipv4');            // "this network" / unspecified
+ALWAYS.addSubnet('169.254.0.0', 16, 'ipv4');       // link-local, incl. 169.254.169.254 (AWS/GCP/Azure metadata)
+ALWAYS.addAddress('100.100.100.200', 'ipv4');      // Alibaba Cloud metadata (inside 100.64/10)
+ALWAYS.addAddress('::1', 'ipv6');                  // loopback
+ALWAYS.addAddress('::', 'ipv6');                   // unspecified
+ALWAYS.addSubnet('::', 96, 'ipv6');                // IPv4-compatible (::a.b.c.d), deprecated — BlockList misses ::127.0.0.1 without it
+ALWAYS.addSubnet('fe80::', 10, 'ipv6');            // link-local, the whole /10
+ALWAYS.addAddress('fd00:ec2::254', 'ipv6');        // AWS IMDS over IPv6 (inside fc00::/7)
+
+// Refused unless the operator allows all hosts: private and shared address space.
+const PRIVATE = new net.BlockList();
+PRIVATE.addSubnet('10.0.0.0', 8, 'ipv4');          // RFC 1918
+PRIVATE.addSubnet('172.16.0.0', 12, 'ipv4');       // RFC 1918
+PRIVATE.addSubnet('192.168.0.0', 16, 'ipv4');      // RFC 1918
+PRIVATE.addSubnet('100.64.0.0', 10, 'ipv4');       // RFC 6598 CGNAT
+PRIVATE.addSubnet('fc00::', 7, 'ipv6');            // unique local
+
+/**
+ * Canonical IP literal for `input`, or null when it is not an IP literal (a name).
+ * Strips brackets and an IPv6 zone id, then accepts what net.isIP accepts; anything else is run
+ * through the WHATWG URL parser — but only when it is shaped like a legacy IPv4 spelling (digits,
+ * hex, x, dots) — which reads those spellings (0x7f000001, 0177.0.0.1, 2130706433, 127.1) as the
+ * dotted quad an OS resolver would.
+ * @param {string} input
+ * @returns {string|null}
+ */
+export function canonicalIp(input) {
+  const s = String(input ?? '').trim().replace(/^\[|\]$/g, '').replace(/%.*$/, '');
+  if (!s) return null;
+  if (net.isIP(s)) return s;
+  // Only a legacy-IPv4-SHAPED string may reach the URL parser. Fed anything else it reads
+  // userinfo, a port or a path: '127.0.0.1@8.8.8.8' parses to host 8.8.8.8 and '126.0.0.0/7' to
+  // host 126.0.0.0 — a public literal and a public network whose /7 spans 127/8. Those are NAMES
+  // here, routed to resolution, which refuses them.
+  if (!/^[0-9a-fx.]+$/i.test(s)) return null;
+  try {
+    const host = new URL(`http://${s}`).hostname.replace(/^\[|\]$/g, '');
+    return net.isIP(host) ? host : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * How the SSRF guards treat an address.
+ *   'always'  — refused in every configuration (loopback, unspecified, link-local, metadata)
+ *   'private' — refused unless the operator allows all hosts (RFC 1918, CGNAT, unique local)
+ *   null      — a public address, or not an IP literal at all (a name: resolve it, then classify
+ *               every answer)
+ * @param {string} ip
+ * @returns {'always'|'private'|null}
+ */
+export function classifyAddress(ip) {
+  const addr = canonicalIp(ip);
+  if (!addr) return null;
+  const type = net.isIP(addr) === 6 ? 'ipv6' : 'ipv4';
+  if (ALWAYS.check(addr, type)) return 'always';
+  if (PRIVATE.check(addr, type)) return 'private';
+  return null;
+}
 
 /**
  * Check whether an IP address belongs to a blocked (internal/private) range.
- * Covers loopback, RFC 1918, RFC 6598, link-local, unspecified, and IPv6 equivalents.
+ * Covers loopback, RFC 1918, RFC 6598, link-local, unspecified, metadata and their IPv6 and
+ * IPv4-mapped equivalents, in any spelling.
  * @param {string} ip
  * @returns {boolean}
  */
 export function isBlockedIp(ip) {
-  const addr = ip.replace(/^\[|\]$/g, '').trim();
-
-  // IPv6-mapped IPv4 — extract the IPv4 part and check it
-  const mappedMatch = addr.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
-  if (mappedMatch) return isBlockedIp(mappedMatch[1]);
-
-  // IPv6 blocked addresses
-  if (addr === '::1' || addr === '::') return true;
-  if (/^fe80:/i.test(addr)) return true;                     // link-local (fe80::/10)
-  if (/^f[cd]/i.test(addr.slice(0, 2))) return true;        // fc00::/7 unique local (fc__ and fd__)
-  // IPv4-compatible loopback: ::127.0.0.1 maps to 127.0.0.1/8
-  const compatMatch = addr.match(/^::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
-  if (compatMatch) return isBlockedIp(compatMatch[1]);
-
-  // IPv4 checks
-  const parts = addr.split('.');
-  if (parts.length === 4 && parts.every((p) => /^\d{1,3}$/.test(p))) {
-    const [a, b] = parts.map(Number);
-    if (a === 127) return true;                          // 127.0.0.0/8  (loopback)
-    if (a === 10) return true;                           // 10.0.0.0/8   (RFC 1918)
-    if (a === 172 && b >= 16 && b <= 31) return true;    // 172.16.0.0/12 (RFC 1918)
-    if (a === 192 && b === 168) return true;             // 192.168.0.0/16 (RFC 1918)
-    if (a === 100 && b >= 64 && b <= 127) return true;   // 100.64.0.0/10 (RFC 6598 CGNAT)
-    if (a === 169 && b === 254) return true;             // 169.254.0.0/16 (link-local)
-    if (a === 0) return true;                            // 0.0.0.0/8
-  }
-
-  return false;
+  return classifyAddress(ip) !== null;
 }
 
 /**
@@ -52,15 +102,35 @@ export function isPrivateLike(ip) {
 }
 
 /**
- * Resolve a hostname and verify the resolved IP is not in a blocked range.
+ * Whether the operator has lifted the private-range check (NSA_ALLOW_ALL_HOSTS). Only an explicit
+ * truthy word lifts it — "0", "false", "no", "off" and "" do NOT (before 1.3.0 any non-empty value
+ * did, so "=0" and "=false" silently lifted the guard). Same convention as host_up_check.mjs.
+ * @param {Record<string,string|undefined>} [env]
+ * @returns {boolean}
+ */
+export function allowAllHosts(env = process.env) {
+  return /^(1|true|yes|on)$/i.test(String(env.NSA_ALLOW_ALL_HOSTS ?? '').trim());
+}
+
+/**
+ * Resolve a hostname and verify that NO resolved address is in a blocked range — a name whose
+ * answers include a single blocked address is refused, because a connecting client may try every
+ * answer (Node's net.connect does, with autoSelectFamily).
  * @param {string} hostname
- * @returns {Promise<string>} resolved IP address
- * @throws {Error} if hostname resolves to a blocked IP or DNS fails
+ * @param {{ allowPrivate?: boolean }} [opts] allowPrivate: admit 'private' answers (the operator's
+ *   allow-all); 'always' answers — loopback, link-local, metadata — are refused regardless
+ * @returns {Promise<string>} the first resolved address (every answer having passed)
+ * @throws {Error} if any answer is in a blocked range, or DNS fails
  */
-export async function resolveAndValidate(hostname) {
-  const { address } = await dns.lookup(hostname);
-  if (isBlockedIp(address)) {
-    throw new Error(`Host resolves to blocked IP range`);
+export async function resolveAndValidate(hostname, { allowPrivate = false } = {}) {
+  const answers = await dns.lookup(hostname, { all: true, verbatim: true });
+  const list = Array.isArray(answers) ? answers : [answers];
+  if (list.length === 0) throw new Error(`Host did not resolve`);
+  for (const { address } of list) {
+    const cls = classifyAddress(address);
+    if (cls === 'always' || (cls === 'private' && !allowPrivate)) {
+      throw new Error(`Host resolves to blocked IP range`);
+    }
   }
-  return address;
+  return list[0].address;
 }

package/utils/output_dir.mjs

@@ -116,8 +116,10 @@ export async function createHostOutDir(baseOutDir, host, { stamp = nowStamp, log
       throw e;
     }
     if (n > 1) {
-      log(`[scan] WARNING: ${path.join(baseOutDir, first)} already exists — another scan of ${host} started in the same `
-        + `second — so this scan writes to ${dir} instead. Neither run's evidence overwrites the other's.`);
+      // v77-8 (1.3.0): the directory is stamped after the plugin runs, so the collision is two runs that FINISHED in the same
+      // second — they may have started minutes apart (README: "whose plugin runs finished in the same second").
+      log(`[scan] WARNING: ${path.join(baseOutDir, first)} already exists — another scan of ${host} finished its plugin runs in `
+        + `the same second — so this scan writes to ${dir} instead. Neither run's evidence overwrites the other's.`);
     }
     return dir;
   }

package/utils/plugin_discovery.mjs

@@ -33,9 +33,11 @@ async function loadPluginsFromDir(dir, source) {
       const mod = await import(join(dir, file));
       const plugin = mod.default;
       if (plugin?.id && plugin?.name && typeof plugin?.run === 'function') {
-        // Attach conclude from named export or plugin default
+        // Attach conclude (and its authoritativePorts) from the named export or the plugin default
         const conclude = mod.conclude ?? plugin.conclude;
-        plugins.push({ ...plugin, _source: source, ...(conclude ? { conclude } : {}) });
+        const authoritativePorts = mod.authoritativePorts ?? plugin.authoritativePorts;
+        plugins.push({ ...plugin, _source: source, ...(conclude ? { conclude } : {}),
+          ...(authoritativePorts ? { authoritativePorts } : {}) });
       }
     } catch (e) {
       if (process.env.NSA_VERBOSE) {

package/utils/ports_spec.mjs

@@ -0,0 +1,46 @@
+// utils/ports_spec.mjs
+// The --ports grammar, in one place (1.3.0 lane 4, item 12): the port scanner and the webapp detector both read it, so a
+// form one accepts the other accepts too. Moved here from plugins/port_scanner.mjs, which re-exports parsePortsSpec.
+
+export function uniqInts(arr = []) {
+  return [...new Set((arr || []).map((x) => Number(x)).filter(Number.isFinite))];
+}
+
+/**
+ * Parse a CLI-style ports spec string into TCP/UDP port arrays.
+ *
+ * Accepted formats (entries comma-separated, whitespace tolerated):
+ *   "8090"                   → { tcp: [8090],          udp: [] }
+ *   "8090,9090"              → { tcp: [8090, 9090],    udp: [] }
+ *   "8090/tcp"               → { tcp: [8090],          udp: [] }
+ *   "8090/udp"               → { tcp: [],              udp: [8090] }
+ *   "8090,9090/udp"          → { tcp: [8090],          udp: [9090] }
+ *   "8090/tcp,9090/udp"      → { tcp: [8090],          udp: [9090] }
+ *
+ * Default protocol when not specified: TCP.
+ *
+ * Malformed entries (non-numeric, out-of-range 1–65535, empty, unknown
+ * protocol suffix) are silently skipped — defensive for sloppy CLI input.
+ *
+ * @param {string} spec
+ * @returns {{ tcp: number[], udp: number[] }}
+ */
+export function parsePortsSpec(spec) {
+  const out = { tcp: [], udp: [] };
+  if (typeof spec !== 'string') return out;
+  const entries = spec.split(',').map(s => s.trim()).filter(Boolean);
+  for (const entry of entries) {
+    // Reject entries with more than one '/' separator (e.g. "8090/tcp/extra")
+    const parts = entry.split('/');
+    if (parts.length > 2) continue;
+    const portStr = parts[0];
+    const proto   = (parts[1] || 'tcp').toLowerCase();
+    if (proto !== 'tcp' && proto !== 'udp') continue;
+    const port = Number(portStr);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) continue;
+    out[proto].push(port);
+  }
+  out.tcp = uniqInts(out.tcp);
+  out.udp = uniqInts(out.udp);
+  return out;
+}

package/utils/report_md.mjs

@@ -9,18 +9,25 @@
 // minimal report (header + "no services detected") rather than throwing, so callers
 // don't need to guard before invocation.
 
-const SEVERITIES = ['Critical', 'High', 'Medium', 'Low', 'Info'];
+import { conclusionFindings, conclusionNotTested, manifestNotTested, normalizeSeverity, SERVICE_FLAGS, SEVERITY_ORDER } from './service_flags.mjs';
+
+const SEVERITIES = SEVERITY_ORDER;
 
 /**
  * Escape Markdown special characters that would break table cell rendering.
  * Pipes break tables; backticks break inline code; newlines break row layout.
  */
+// Every Markdown- or HTML-active character is backslash-escaped (CommonMark allows a backslash before any
+// ASCII punctuation), so a value a NETWORK HOST chose — a hostname from mDNS or UPnP, an OS or program from a
+// banner, the summary that embeds them — renders as text: no link, image, autolink, emphasis or raw tag.
+// (1.3.0: it escaped only | and `, and the hostname and OS rows, once reachable, rendered live links,
+// remote images and <img onerror> in any renderer that allows HTML.)
+const MD_ACTIVE = /[\\`*_[\]<>!|~]/g;
 function escapeCell(value) {
   if (value == null) return '';
   return String(value)
-    .replace(/\|/g, '\\|')
-    .replace(/`/g, '\\`')
-    .replace(/[\r\n]+/g, ' ');
+    .replace(/[\r\n]+/g, ' ')
+    .replace(MD_ACTIVE, (c) => `\\${c}`);
 }
 
 /**
@@ -34,114 +41,19 @@ function cell(value) {
 }
 
 /**
- * Extract security findings from per-service fields.
- * Mirrors the per-service finding extraction used by sarif.mjs and export_csv.mjs:
- * findings are derived from service flags (anonymousLogin, weakAlgorithms, cves, etc.),
- * not from a separate findings array on the conclusion (which doesn't exist today).
+ * The security findings a conclusion carries — every one graded by the shared service-flag table
+ * (utils/service_flags.mjs, 1.3.0 (s1)), so this report, SARIF, the CSV and --fail-on count the same units.
+ * `evidence` is the conclusion's evidence list: an adapter payload that landed there (a domain's DNS posture when the
+ * scan found no 53/udp service) is graded too, targeting the host.
  *
  * @param {object[]} services
  * @param {string} host
+ * @param {object[]} [evidence]
  * @returns {Array<{ severity: string, title: string, target: string, evidence: string|null }>}
  */
-function extractFindings(services, host) {
-  const findings = [];
-
-  for (const svc of services) {
-    const target = `${host}:${svc.port}/${svc.protocol || 'tcp'}`;
-
-    if (svc.anonymousLogin === true) {
-      findings.push({
-        severity: 'Critical',
-        title: 'FTP anonymous login enabled',
-        target,
-        evidence: `${svc.service || 'ftp'} on ${target} accepts anonymous authentication.`,
-      });
-    }
-
-    if (svc.axfrAllowed === true) {
-      findings.push({
-        severity: 'Critical',
-        title: 'DNS zone transfer (AXFR) allowed',
-        target,
-        evidence: `Zone transfer permitted on ${target}; entire zone may be enumerated.`,
-      });
-    }
-
-    if (svc.community && (svc.community === 'public' || svc.community === 'private')) {
-      findings.push({
-        severity: 'High',
-        title: `SNMP default community string: ${svc.community}`,
-        target,
-        evidence: `SNMP responds to community "${svc.community}" on ${target}.`,
-      });
-    }
-
-    if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length > 0) {
-      const algos = svc.weakAlgorithms
-        .map((a) => (typeof a === 'string' ? a : a?.algorithm || a?.name || ''))
-        .filter(Boolean);
-      findings.push({
-        severity: 'Medium',
-        title: `Weak algorithm(s) supported: ${algos.join(', ')}`,
-        target,
-        evidence: null,
-      });
-    }
-
-    if (Array.isArray(svc.weakProtocols) && svc.weakProtocols.length > 0) {
-      findings.push({
-        severity: 'Medium',
-        title: `Weak protocol(s) enabled: ${svc.weakProtocols.join(', ')}`,
-        target,
-        evidence: null,
-      });
-    }
-
-    if (Array.isArray(svc.weakCiphers) && svc.weakCiphers.length > 0) {
-      findings.push({
-        severity: 'Medium',
-        title: `Weak cipher(s) supported: ${svc.weakCiphers.length} cipher(s)`,
-        target,
-        evidence: svc.weakCiphers.slice(0, 5).join(', '),
-      });
-    }
-
-    if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length > 0) {
-      findings.push({
-        severity: 'Medium',
-        title: `Dangerous HTTP method(s) allowed: ${svc.dangerousMethods.join(', ')}`,
-        target,
-        evidence: null,
-      });
-    }
-
-    const cves = svc.cves || svc.cve || [];
-    if (Array.isArray(cves)) {
-      for (const cve of cves) {
-        const cveId = typeof cve === 'string' ? cve : (cve?.id || cve?.cveId || '');
-        if (!cveId) continue;
-        const sev = (typeof cve === 'object' && cve?.severity) ? String(cve.severity) : 'High';
-        findings.push({
-          severity: normalizeSeverity(sev),
-          title: `${cveId} — ${svc.program || svc.service || 'service'}${svc.version && svc.version !== 'Unknown' ? ' ' + svc.version : ''}`,
-          target,
-          evidence: `See https://nvd.nist.gov/vuln/detail/${cveId}`,
-        });
-      }
-    }
-  }
-
-  return findings;
-}
-
-function normalizeSeverity(sev) {
-  if (!sev) return 'Info';
-  const s = String(sev).trim().toLowerCase();
-  if (s.startsWith('crit')) return 'Critical';
-  if (s.startsWith('hi'))   return 'High';
-  if (s.startsWith('med'))  return 'Medium';
-  if (s.startsWith('lo'))   return 'Low';
-  return 'Info';
+function extractFindings(services, host, evidence = []) {
+  return conclusionFindings({ services, evidence }, host)
+    .map((f) => ({ severity: f.severity, title: f.title, target: f.target, evidence: f.evidence }));
 }
 
 function severityRank(sev) {
@@ -191,8 +103,9 @@ export function buildMarkdownReport(scanData) {
   const host = scanData.host ?? '(unknown host)';
   const conclusion = scanData.conclusion ?? {};
   const services = conclusion?.result?.services ?? [];
-  const hostInfo = conclusion?.host ?? {};
-  const summaryText = conclusion?.summary ?? '';
+  // runConcluder's callers receive {id, name, result: <conclusion>}; a legacy flat shape is still read.
+  const hostInfo = conclusion?.result?.host ?? conclusion?.host ?? {};
+  const summaryText = conclusion?.result?.summary ?? conclusion?.summary ?? '';
   const toolVersion = scanData.toolVersion ?? '';
   const scanTime = scanData.scanTime instanceof Date
     ? scanData.scanTime.toISOString()
@@ -224,7 +137,7 @@ export function buildMarkdownReport(scanData) {
   }
   lines.push(`- **Services detected:** ${services.length}`);
 
-  const findings = extractFindings(services, host);
+  const findings = extractFindings(services, host, conclusion?.result?.evidence ?? conclusion?.evidence ?? []);
   if (findings.length > 0) {
     const counts = {};
     for (const sev of SEVERITIES) counts[sev] = 0;
@@ -237,17 +150,26 @@ export function buildMarkdownReport(scanData) {
   } else {
     lines.push(`- **Security findings:** 0`);
   }
-  // 1.2.0 build 3: this renderer's findings are the service-check FLAGS only — nothing on the scan path fills a service's
-  // CVEs, and Enterprise's analysis agents and exploit intelligence write elsewhere. Without this line "Security findings:
-  // 0" read as a clean verdict over a host whose CLI run carried 16 CVEs (the Gate 3-A preparation's P8).
-  // The counted list names only flags a conclusion can carry: dangerousMethods is read by extractFindings but no adapter puts
-  // it on a service record (tests/concluder_drops_honesty.test.mjs pins that), so it is named among what is NOT counted.
-  lines.push('- **Scope:** counts only these service-check flags: weak SSH algorithms, SNMP default community, weak TLS '
-    + 'protocols / ciphers, and anonymous FTP login and DNS zone transfer when the scan\'s environment enables those two '
-    + 'checks (FTP_CHECK_ANON; DNS_CHECK_AXFR with DNS_AXFR_DOMAIN — both off by default). It does not count a self-signed '
-    + 'certificate or the MCP server checks (both on the service records), nor dangerous HTTP methods, SMB null sessions or '
-    + 'the TLS-certificate, DNS-security and debug-endpoint auditors\' results (the scan\'s conclusion does not carry them); '
-    + 'it does not look up CVEs, and does not include Enterprise analysis-agent findings or exploit intelligence (a CLI scan '
+  // 1.3.0 (a4) + (s3): a check that did not run, or ran and could not complete, is said to be NOT TESTED with its reason —
+  // never "none" and never "refused". One line per check and reason, from the shared table, with every target it covers.
+  // Build 4 (Gate 3-A F-1): a host-level audit that did not run — the DNS-security audit (060) declines an IP-address
+  // target — is read from the run's MANIFEST, which both callers hand in; without one nothing is inferred from absence.
+  const notTested = new Map();
+  for (const n of [...conclusionNotTested(conclusion), ...manifestNotTested(scanData.manifest, host)]) {
+    const k = `${n.check}\u0000${n.reason}`;
+    if (!notTested.has(k)) notTested.set(k, { ...n, targets: [] });
+    notTested.get(k).targets.push(n.target);
+  }
+  for (const n of notTested.values()) {
+    lines.push(`- **${n.check} not tested:** ${n.targets.map((t) => escapeCell(t)).join(', ')} — ${escapeCell(n.reason)}`);
+  }
+  // 1.2.0 build 3: without this line "Security findings: 0" read as a clean verdict over a host whose CLI run carried 16
+  // CVEs (the Gate 3-A preparation's P8). Since 1.3.0 (s1) the counted list is DERIVED from the shared service-flag table's
+  // labels, so it names exactly what is graded — it cannot run ahead of the table or fall behind it.
+  const counted = [...new Set(SERVICE_FLAGS.map((r) => r.label).filter(Boolean))];
+  lines.push(`- **Scope:** counts only these service-check findings: ${counted.join(', ')}. `
+    + 'The opt-in checks are off by default. '
+    + 'It does not look up CVEs, and does not include Enterprise analysis-agent findings or exploit intelligence (a CLI scan '
     + 'with the Enterprise package and a Pro or Enterprise licence records CVE and agent findings in scan_finding_queue.json, '
     + 'when there are any).');
   lines.push('');
@@ -280,14 +202,16 @@ export function buildMarkdownReport(scanData) {
   lines.push(`## Findings`);
   lines.push('');
   if (findings.length === 0) {
-    lines.push('_None of the counted service-check flags fired. This is not a statement that the host has no known '
-      + 'vulnerabilities — CVE lookups, analysis-agent findings, the MCP server checks and several checks\' results are not '
-      + 'part of this count (see Scope above), and anonymous FTP login and zone transfer are tested only when enabled._');
+    lines.push('_None of the counted service checks found anything. This is not a statement that the host has no known '
+      + 'vulnerabilities — CVE lookups and analysis-agent findings are not part of this count (see Scope above), and '
+      + 'anonymous FTP login, zone transfer and the SMB null session are tested only when enabled._');
     lines.push('');
   } else {
     findings.sort((a, b) => severityRank(a.severity) - severityRank(b.severity));
     for (const f of findings) {
-      lines.push(`### [${f.severity}] ${f.title}`);
+      // The title is escaped as a WHOLE: a CVE title interpolates the service's program and version, which a host
+      // chooses (the HTTP probe's program is the raw Server header).
+      lines.push(`### [${f.severity}] ${escapeCell(f.title)}`);
       lines.push('');
       lines.push(`- **Target:** ${escapeCell(f.target)}`);
       if (f.evidence) {