praxis-sec 1.2.0 → 1.2.2

package/assets/praxis-architecture.svg

@@ -0,0 +1,304 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="960" height="1340" viewBox="0 0 960 1340" role="img" aria-label="Praxis AI Security Architecture and Autonomous Fix Loop Flow">
+  <defs>
+    <!-- Background Canvas Gradient -->
+    <linearGradient id="bgGrad" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#120726"/>
+      <stop offset="40%" stop-color="#090314"/>
+      <stop offset="100%" stop-color="#030108"/>
+    </linearGradient>
+
+    <!-- Ambient Top Purple Glow -->
+    <radialGradient id="topGlow" cx="50%" cy="0%" r="50%">
+      <stop offset="0%" stop-color="#8b5cf6" stop-opacity="0.32"/>
+      <stop offset="100%" stop-color="#8b5cf6" stop-opacity="0"/>
+    </radialGradient>
+
+    <!-- Card Backgrounds -->
+    <linearGradient id="cardScan" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#1f0e38"/>
+      <stop offset="100%" stop-color="#130824"/>
+    </linearGradient>
+
+    <linearGradient id="cardNorm" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#241042"/>
+      <stop offset="100%" stop-color="#140926"/>
+    </linearGradient>
+
+    <linearGradient id="cardLlm" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#2a0d4a"/>
+      <stop offset="100%" stop-color="#18072c"/>
+    </linearGradient>
+
+    <linearGradient id="cardVerify" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#0e2a22"/>
+      <stop offset="100%" stop-color="#081813"/>
+    </linearGradient>
+
+    <linearGradient id="cardHitl" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#241403"/>
+      <stop offset="100%" stop-color="#140a02"/>
+    </linearGradient>
+
+    <linearGradient id="cardSurfaces" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#082f49"/>
+      <stop offset="100%" stop-color="#04141f"/>
+    </linearGradient>
+
+    <!-- Brand Color Gradients -->
+    <linearGradient id="praxisGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#c084fc"/>
+      <stop offset="50%" stop-color="#8b5cf6"/>
+      <stop offset="100%" stop-color="#6d28d9"/>
+    </linearGradient>
+
+    <linearGradient id="emeraldGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#6ee7b7"/>
+      <stop offset="100%" stop-color="#10b981"/>
+    </linearGradient>
+
+    <linearGradient id="goldGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#fde047"/>
+      <stop offset="100%" stop-color="#f59e0b"/>
+    </linearGradient>
+
+    <linearGradient id="cyanGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#38bdf8"/>
+      <stop offset="100%" stop-color="#0284c7"/>
+    </linearGradient>
+
+    <!-- Glowing Filters -->
+    <filter id="shadow" x="-10%" y="-10%" width="120%" height="120%">
+      <feDropShadow dx="0" dy="6" stdDeviation="6" flood-color="#000000" flood-opacity="0.8"/>
+    </filter>
+    <filter id="glowPurple" x="-20%" y="-20%" width="140%" height="140%">
+      <feDropShadow dx="0" dy="0" stdDeviation="6" flood-color="#c084fc" flood-opacity="0.5"/>
+    </filter>
+    <filter id="glowGreen" x="-20%" y="-20%" width="140%" height="140%">
+      <feDropShadow dx="0" dy="0" stdDeviation="6" flood-color="#10b981" flood-opacity="0.5"/>
+    </filter>
+
+    <!-- Arrow Markers -->
+    <marker id="arrDownPurple" markerWidth="10" markerHeight="10" refX="5" refY="7" orient="auto">
+      <polygon points="0 0, 10 0, 5 8" fill="#c084fc"/>
+    </marker>
+    <marker id="arrDownCyan" markerWidth="10" markerHeight="10" refX="5" refY="7" orient="auto">
+      <polygon points="0 0, 10 0, 5 8" fill="#38bdf8"/>
+    </marker>
+    <marker id="arrDownGreen" markerWidth="10" markerHeight="10" refX="5" refY="7" orient="auto">
+      <polygon points="0 0, 10 0, 5 8" fill="#34d399"/>
+    </marker>
+    <marker id="arrDownGold" markerWidth="10" markerHeight="10" refX="5" refY="7" orient="auto">
+      <polygon points="0 0, 10 0, 5 8" fill="#f59e0b"/>
+    </marker>
+  </defs>
+
+  <!-- Base Canvas Background -->
+  <rect width="960" height="1340" fill="url(#bgGrad)"/>
+  <rect width="960" height="420" fill="url(#topGlow)"/>
+
+  <!-- ========================================================================= -->
+  <!-- HEADER &amp; LOGO                                                             -->
+  <!-- ========================================================================= -->
+  <g transform="translate(480, 48)">
+    <!-- Shield Logo Icon -->
+    <g transform="translate(-295, -26) scale(0.38)">
+      <path d="M55 0 L110 18 V62 C110 100 86 128 55 145 C24 128 0 100 0 62 V18 Z" fill="url(#praxisGrad)" stroke="#4c1d95" stroke-width="3"/>
+      <path d="M55 24 L82 40 V66 C82 92 68 110 55 120 C42 110 28 92 28 66 V40 Z" fill="#ffffff" opacity="0.95"/>
+    </g>
+    <text x="24" y="8" text-anchor="middle" font-family="'Segoe UI', -apple-system, sans-serif" font-size="32" font-weight="900" letter-spacing="0.5">
+      <tspan fill="url(#praxisGrad)">PRAXIS</tspan>
+      <tspan fill="#ffffff" font-weight="800"> | ARCHITECTURE FLOW</tspan>
+    </text>
+    <text x="0" y="38" text-anchor="middle" font-family="'Segoe UI', -apple-system, sans-serif" font-size="15" font-weight="600" fill="#e9d5ff">
+      28-Agent Parallel Audit · AST Taint · Remote Git Scanning · 4-Tier Verification · Autonomous Fix
+    </text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 1: 28-AGENT CONCURRENT STATIC &amp; AST AUDIT (y=110, h=155)             -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 110)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="155" rx="14" fill="url(#cardScan)" stroke="#7c3aed" stroke-width="2" filter="url(#glowPurple)"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="#7c3aed"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#ffffff">1</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">28-AGENT PARALLEL AUDIT &amp; AST TAINT CORE</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#2e1065" stroke="#a855f7" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="800" fill="#c084fc">DETERMINISTIC</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">28 Concurrent Agents:</tspan> Prompt Injection · MCP Abuse · Memory Poisoning · RAG · Pickles · Auth</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">AST &amp; Taint Engine:</tspan> Pure ESM Babel (JS/TS) &amp; Python CST with ScopeTree &amp; Source-to-Sink Taint</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#34d399">• <tspan font-weight="700">100% Offline &amp; Free:</tspan> 0 token cost, 125 secret &amp; code patterns, 7 cached Threat Intel feeds</text>
+    </g>
+  </g>
+
+  <!-- Connector 1 -> 2 -->
+  <g transform="translate(480, 265)">
+    <line x1="0" y1="0" x2="0" y2="35" stroke="#c084fc" stroke-width="3.5" marker-end="url(#arrDownPurple)"/>
+    <rect x="-140" y="8" width="280" height="22" rx="4" fill="#241042" stroke="#7c3aed" stroke-width="1"/>
+    <text x="0" y="24" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#e9d5ff">Raw Findings &amp; AST Taint Graphs</text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 2: ACCURACY, STANDARDS &amp; ABOM MATRIX (y=305, h=145)                  -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 305)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="145" rx="14" fill="url(#cardNorm)" stroke="#9333ea" stroke-width="2"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="#9333ea"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#ffffff">2</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">8-FRAMEWORK STANDARDS MAPPING &amp; ABOM</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#3b0764" stroke="#c084fc" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="800" fill="#e9d5ff">COMPLIANCE</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">8 Security Standards:</tspan> OWASP LLM 2025 · MITRE ATLAS · NIST AI 600-1 · EU AI Act (Art 12/14) · ISO 42001</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">CycloneDX 1.5 ABOM:</tspan> Full Agent Bill of Materials (Prompts, Tools, Models, Skills &amp; MCP Trust)</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#38bdf8">• <tspan font-weight="700">Scoring Engine:</tspan> Computes 0–100 Health Score &amp; Letter Grade (A–F) with Category Deductions</text>
+    </g>
+  </g>
+
+  <!-- Connector 2 -> 3 -->
+  <g transform="translate(480, 450)">
+    <line x1="0" y1="0" x2="0" y2="35" stroke="#38bdf8" stroke-width="3.5" marker-end="url(#arrDownCyan)"/>
+    <rect x="-140" y="8" width="280" height="22" rx="4" fill="#082230" stroke="#0284c7" stroke-width="1"/>
+    <text x="0" y="24" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#38bdf8">Deep Analysis / `praxis fix` Trigger</text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 3: COGNITIVE LLM REASONING &amp; REMEDIATION (y=490, h=155)              -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 490)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="155" rx="14" fill="url(#cardLlm)" stroke="#c084fc" stroke-width="2.2" filter="url(#glowPurple)"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="url(#praxisGrad)"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#ffffff">3</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">COGNITIVE LLM REASONING &amp; PATCH DRAFTING</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#3b0764" stroke="#c084fc" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="900" fill="#e9d5ff">AGENTIC AI</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">Multi-LLM Router:</tspan> Anthropic Claude · OpenAI · DeepSeek · Google Gemini · Local Ollama (`--local`)</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">Exploitability Triage:</tspan> Evaluates call-site reachability &amp; attack vectors to eliminate false alarms</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#34d399">• <tspan font-weight="700">Autonomous Code Fix:</tspan> Drafts contextual, multi-file code patches &amp; unit regression tests</text>
+    </g>
+  </g>
+
+  <!-- Connector 3 -> 4 -->
+  <g transform="translate(480, 645)">
+    <line x1="0" y1="0" x2="0" y2="35" stroke="#34d399" stroke-width="3.5" marker-end="url(#arrDownGreen)"/>
+    <rect x="-145" y="8" width="290" height="22" rx="4" fill="#09281a" stroke="#10b981" stroke-width="1"/>
+    <text x="0" y="24" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#34d399">Draft Diffs to Verification Oracles</text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 4: 4-TIER EXECUTABLE VERIFICATION LADDER (y=685, h=165)              -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 685)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="165" rx="14" fill="url(#cardVerify)" stroke="#10b981" stroke-width="2.2" filter="url(#glowGreen)"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="url(#emeraldGrad)"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#042316">4</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">4-TIER EXECUTABLE VERIFICATION LADDER</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#0c2b1e" stroke="#10b981" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="900" fill="#34d399">ORACLES</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#a7f3d0">• <tspan font-weight="700">Tier 1 (AST Syntax Oracle):</tspan> Validates AST node integrity before any file is touched</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#a7f3d0">• <tspan font-weight="700">Tier 2 (Build Oracle):</tspan> Executes project build (`npm run build` / `tsc`) to ensure 0 compiler errors</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#a7f3d0">• <tspan font-weight="700">Tier 3 (Test Suite Oracle):</tspan> Runs unit test suite to guarantee zero functionality regressions</text>
+      <text x="0" y="92" font-family="sans-serif" font-size="14.5" font-weight="800" fill="#34d399">• <tspan font-weight="700">Tier 4 (Re-scan Oracle):</tspan> Confirms finding resolution — <tspan font-weight="700">Auto-reverts on any oracle failure</tspan></text>
+    </g>
+  </g>
+
+  <!-- Connector 4 -> 5 -->
+  <g transform="translate(480, 850)">
+    <line x1="0" y1="0" x2="0" y2="35" stroke="#f59e0b" stroke-width="3.5" marker-end="url(#arrDownGold)"/>
+    <rect x="-140" y="8" width="280" height="22" rx="4" fill="#241403" stroke="#f59e0b" stroke-width="1"/>
+    <text x="0" y="24" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#fde047">Verified Diffs to Operator Review</text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 5: HITL APPROVAL &amp; ATOMIC APPLY (y=890, h=165)                       -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 890)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="165" rx="14" fill="url(#cardHitl)" stroke="#f59e0b" stroke-width="2.2"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="url(#goldGrad)"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#0c0701">5</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">HUMAN APPROVAL, ATOMIC APPLY &amp; REPORT SUITE</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#382006" stroke="#f59e0b" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="900" fill="#fde047">HUMAN-IN-LOOP</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#fef08a">• <tspan font-weight="700">Interactive Diff Review:</tspan> Developer inspects verified patch before any disk write</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#fef08a">• <tspan font-weight="700">Atomic Apply:</tspan> boundary + symlink checks, all-or-nothing rollback, hash-based `praxis undo`</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#38bdf8">• <tspan font-weight="700">Assessment Report:</tspan> single-file tabbed HTML — agent coverage, AST taint, ledger, trend</text>
+      <text x="0" y="92" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#34d399">• CI/CD Native: Net-new PR gating, SARIF export to GitHub Code Scanning &amp; PR annotations</text>
+    </g>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- LEFT RETURN CONDUIT (Closed Autopilot Loop: Step 5 -> Step 1)             -->
+  <!-- ========================================================================= -->
+  <path d="M 90 975 L 35 975 L 35 185 L 85 185" fill="none" stroke="#8b5cf6" stroke-width="3.5" stroke-dasharray="10 5"/>
+  <polygon points="85,185 70,175 70,195" fill="#c084fc"/>
+
+  <!-- Vertical Feedback Tag -->
+  <g transform="translate(25, 580) rotate(-90)">
+    <rect x="-160" y="-12" width="320" height="24" rx="4" fill="#1f0e38" stroke="#8b5cf6" stroke-width="1.2"/>
+    <text x="0" y="4" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#e9d5ff" letter-spacing="0.5">
+      ↻ AUTONOMOUS FIX → VERIFY LOOP
+    </text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STAGE 6 : OUTPUT SURFACES, PORTABILITY & REPRODUCIBILITY                   -->
+  <!-- ========================================================================= -->
+  <path d="M 480 1055 L 480 1087" fill="none" stroke="#38bdf8" stroke-width="3.5" marker-end="url(#arrDownCyan)"/>
+
+  <g transform="translate(90, 1095)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="165" rx="14" fill="url(#cardSurfaces)" stroke="#38bdf8" stroke-width="2.2"/>
+
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="url(#cyanGrad)"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#04141f">6</text>
+
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">OUTPUT SURFACES &amp; REPRODUCIBILITY</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#082f49" stroke="#38bdf8" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="900" fill="#7dd3fc">READ-ONLY</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#bae6fd">• <tspan font-weight="700">Web UI:</tspan> <tspan fill="#7dd3fc">`praxis web`</tspan> — Security Studio, live SSE, loopback-only, secrets redacted</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#bae6fd">• <tspan font-weight="700">Portable Rules:</tspan> <tspan fill="#7dd3fc">`praxis rules export`</tspan> — 411 pattern rules as Semgrep YAML</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#bae6fd">• <tspan font-weight="700">Code Scanning:</tspan> SARIF carries numeric <tspan fill="#7dd3fc">`security-severity`</tspan> so alerts rank properly</text>
+      <text x="0" y="92" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#34d399">• Reproducible: scan fingerprint + CI determinism gate over <tspan fill="#a7f3d0">`file::rule`</tspan> identities</text>
+    </g>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- FOOTER                                                                    -->
+  <!-- ========================================================================= -->
+  <g transform="translate(480, 1300)">
+    <text text-anchor="middle" font-family="'Segoe UI', sans-serif" font-size="13.5" font-weight="600" fill="#c084fc">
+      Node.js ≥ 18 · Pure ESM · 28 Security Agents · 4-Tier Verification Ladder · Multi-LLM Autopilot
+    </text>
+  </g>
+</svg>

package/assets/praxis-logo.svg

@@ -0,0 +1,38 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="620" height="180" viewBox="0 0 620 180" role="img" aria-label="Praxis logo">
+  <defs>
+    <!-- Base Shield Gradient (Vibrant purple to deep violet) -->
+    <linearGradient id="purpleGrad" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0%" stop-color="#c084fc"/>
+      <stop offset="55%" stop-color="#7c3aed"/>
+      <stop offset="100%" stop-color="#4c1d95"/>
+    </linearGradient>
+    <!-- Wordmark Gradient (Fuchsia to violet) -->
+    <linearGradient id="wordGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#e879f9"/>
+      <stop offset="100%" stop-color="#7c3aed"/>
+    </linearGradient>
+  </defs>
+
+  <!-- Shield icon with find-fix-verify loop and AI sparkle -->
+  <g transform="translate(24,28)">
+    <!-- Sleek outer shield path -->
+    <path d="M55 0 L110 18 V62 C110 100 86 128 55 145 C24 128 0 100 0 62 V18 Z"
+          fill="url(#purpleGrad)" stroke="#3b0764" stroke-width="2"/>
+    
+    <!-- Clockwise reload/loop arrow (the "remediation loop") -->
+    <path d="M55 35 A35 35 0 1 1 20 70 H32 A23 23 0 1 0 55 47 V60 L75 41 L55 22 V35 Z"
+          fill="#ffffff" opacity="0.95"/>
+          
+    <!-- 4-point AI sparkle star (representing autopilot / agent intelligence) -->
+    <path d="M55 52 Q55 70 73 70 Q55 70 55 88 Q55 70 37 70 Q55 70 55 52 Z"
+          fill="#ffffff" opacity="0.95"/>
+  </g>
+
+  <!-- Wordmark -->
+  <text x="160" y="86" font-family="Segoe UI, Helvetica, Arial, sans-serif"
+        font-size="56" font-weight="800" fill="url(#wordGrad)" letter-spacing="-1">Praxis</text>
+
+  <!-- Tagline under the wordmark -->
+  <text x="162" y="120" font-family="Segoe UI, Helvetica, Arial, sans-serif"
+        font-size="19" font-weight="600" fill="#6b7280" letter-spacing="0.4">Autonomous AI-Security Audit Framework</text>
+</svg>

package/cli/agents/abom-generator.js

@@ -13,7 +13,7 @@
 
 import fs from 'fs';
 import path from 'path';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 
 // Agent config files to discover (from AgentConfigScanner)
 const AGENT_CONFIG_FILES = [

package/cli/agents/agent-attestation-agent.js

@@ -287,11 +287,20 @@ export class AgentAttestationAgent extends BaseAgent {
       // This lane bypasses scanFileWithPatterns, so honour the documented
       // suppression comment here too — it was silently ignored before.
       const ruleTable = ruleTableLineMask(lines);
+      // In a package manifest every `"url"` is npm metadata — bugs, repository,
+      // homepage, funding — pointing at a human, never fetched at runtime, and
+      // npm has no `integrity` field that would pin one. Applying ASI-10 there
+      // reported a high on essentially every published package that declares
+      // `bugs.url`. The rule still applies to agent/manifest configs, which is
+      // where a remote resource is actually loaded.
+      const patterns = isPackageJson
+        ? PATTERNS.filter(p => p.rule !== 'AGENT_NO_INTEGRITY_HASH')
+        : PATTERNS;
       for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         if (ruleTable && ruleTable.has(i)) continue;
         if (this.isSuppressed(line)) continue;
-        for (const pattern of PATTERNS) {
+        for (const pattern of patterns) {
           pattern.regex.lastIndex = 0;
           if (pattern.regex.test(line)) {
             findings.push(createFinding({

package/cli/agents/agent-config-scanner.js

@@ -22,7 +22,7 @@
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
-import fg from 'fast-glob';
+import fg from '../core/glob.js';
 import { BaseAgent, createFinding } from './base-agent.js';
 
 // =============================================================================