praxis-sec 1.2.1 → 1.2.4

package/assets/praxis-architecture.svg

@@ -0,0 +1,304 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="960" height="1340" viewBox="0 0 960 1340" role="img" aria-label="Praxis AI Security Architecture and Autonomous Fix Loop Flow">
+  <defs>
+    <!-- Background Canvas Gradient -->
+    <linearGradient id="bgGrad" x1="0" y1="0" x2="0" y2="1">
+      <stop offset="0%" stop-color="#120726"/>
+      <stop offset="40%" stop-color="#090314"/>
+      <stop offset="100%" stop-color="#030108"/>
+    </linearGradient>
+
+    <!-- Ambient Top Purple Glow -->
+    <radialGradient id="topGlow" cx="50%" cy="0%" r="50%">
+      <stop offset="0%" stop-color="#8b5cf6" stop-opacity="0.32"/>
+      <stop offset="100%" stop-color="#8b5cf6" stop-opacity="0"/>
+    </radialGradient>
+
+    <!-- Card Backgrounds -->
+    <linearGradient id="cardScan" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#1f0e38"/>
+      <stop offset="100%" stop-color="#130824"/>
+    </linearGradient>
+
+    <linearGradient id="cardNorm" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#241042"/>
+      <stop offset="100%" stop-color="#140926"/>
+    </linearGradient>
+
+    <linearGradient id="cardLlm" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#2a0d4a"/>
+      <stop offset="100%" stop-color="#18072c"/>
+    </linearGradient>
+
+    <linearGradient id="cardVerify" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#0e2a22"/>
+      <stop offset="100%" stop-color="#081813"/>
+    </linearGradient>
+
+    <linearGradient id="cardHitl" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#241403"/>
+      <stop offset="100%" stop-color="#140a02"/>
+    </linearGradient>
+
+    <linearGradient id="cardSurfaces" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#082f49"/>
+      <stop offset="100%" stop-color="#04141f"/>
+    </linearGradient>
+
+    <!-- Brand Color Gradients -->
+    <linearGradient id="praxisGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#c084fc"/>
+      <stop offset="50%" stop-color="#8b5cf6"/>
+      <stop offset="100%" stop-color="#6d28d9"/>
+    </linearGradient>
+
+    <linearGradient id="emeraldGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#6ee7b7"/>
+      <stop offset="100%" stop-color="#10b981"/>
+    </linearGradient>
+
+    <linearGradient id="goldGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#fde047"/>
+      <stop offset="100%" stop-color="#f59e0b"/>
+    </linearGradient>
+
+    <linearGradient id="cyanGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#38bdf8"/>
+      <stop offset="100%" stop-color="#0284c7"/>
+    </linearGradient>
+
+    <!-- Glowing Filters -->
+    <filter id="shadow" x="-10%" y="-10%" width="120%" height="120%">
+      <feDropShadow dx="0" dy="6" stdDeviation="6" flood-color="#000000" flood-opacity="0.8"/>
+    </filter>
+    <filter id="glowPurple" x="-20%" y="-20%" width="140%" height="140%">
+      <feDropShadow dx="0" dy="0" stdDeviation="6" flood-color="#c084fc" flood-opacity="0.5"/>
+    </filter>
+    <filter id="glowGreen" x="-20%" y="-20%" width="140%" height="140%">
+      <feDropShadow dx="0" dy="0" stdDeviation="6" flood-color="#10b981" flood-opacity="0.5"/>
+    </filter>
+
+    <!-- Arrow Markers -->
+    <marker id="arrDownPurple" markerWidth="10" markerHeight="10" refX="5" refY="7" orient="auto">
+      <polygon points="0 0, 10 0, 5 8" fill="#c084fc"/>
+    </marker>
+    <marker id="arrDownCyan" markerWidth="10" markerHeight="10" refX="5" refY="7" orient="auto">
+      <polygon points="0 0, 10 0, 5 8" fill="#38bdf8"/>
+    </marker>
+    <marker id="arrDownGreen" markerWidth="10" markerHeight="10" refX="5" refY="7" orient="auto">
+      <polygon points="0 0, 10 0, 5 8" fill="#34d399"/>
+    </marker>
+    <marker id="arrDownGold" markerWidth="10" markerHeight="10" refX="5" refY="7" orient="auto">
+      <polygon points="0 0, 10 0, 5 8" fill="#f59e0b"/>
+    </marker>
+  </defs>
+
+  <!-- Base Canvas Background -->
+  <rect width="960" height="1340" fill="url(#bgGrad)"/>
+  <rect width="960" height="420" fill="url(#topGlow)"/>
+
+  <!-- ========================================================================= -->
+  <!-- HEADER &amp; LOGO                                                             -->
+  <!-- ========================================================================= -->
+  <g transform="translate(480, 48)">
+    <!-- Shield Logo Icon -->
+    <g transform="translate(-295, -26) scale(0.38)">
+      <path d="M55 0 L110 18 V62 C110 100 86 128 55 145 C24 128 0 100 0 62 V18 Z" fill="url(#praxisGrad)" stroke="#4c1d95" stroke-width="3"/>
+      <path d="M55 24 L82 40 V66 C82 92 68 110 55 120 C42 110 28 92 28 66 V40 Z" fill="#ffffff" opacity="0.95"/>
+    </g>
+    <text x="24" y="8" text-anchor="middle" font-family="'Segoe UI', -apple-system, sans-serif" font-size="32" font-weight="900" letter-spacing="0.5">
+      <tspan fill="url(#praxisGrad)">PRAXIS</tspan>
+      <tspan fill="#ffffff" font-weight="800"> | ARCHITECTURE FLOW</tspan>
+    </text>
+    <text x="0" y="38" text-anchor="middle" font-family="'Segoe UI', -apple-system, sans-serif" font-size="15" font-weight="600" fill="#e9d5ff">
+      28-Agent Parallel Audit · AST Taint · Remote Git Scanning · 4-Tier Verification · Autonomous Fix
+    </text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 1: 28-AGENT CONCURRENT STATIC &amp; AST AUDIT (y=110, h=155)             -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 110)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="155" rx="14" fill="url(#cardScan)" stroke="#7c3aed" stroke-width="2" filter="url(#glowPurple)"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="#7c3aed"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#ffffff">1</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">28-AGENT PARALLEL AUDIT &amp; AST TAINT CORE</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#2e1065" stroke="#a855f7" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="800" fill="#c084fc">DETERMINISTIC</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">28 Concurrent Agents:</tspan> Prompt Injection · MCP Abuse · Memory Poisoning · RAG · Pickles · Auth</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">AST &amp; Taint Engine:</tspan> Pure ESM Babel (JS/TS) &amp; Python CST with ScopeTree &amp; Source-to-Sink Taint</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#34d399">• <tspan font-weight="700">100% Offline &amp; Free:</tspan> 0 token cost, 125 secret &amp; code patterns, 7 cached Threat Intel feeds</text>
+    </g>
+  </g>
+
+  <!-- Connector 1 -> 2 -->
+  <g transform="translate(480, 265)">
+    <line x1="0" y1="0" x2="0" y2="35" stroke="#c084fc" stroke-width="3.5" marker-end="url(#arrDownPurple)"/>
+    <rect x="-140" y="8" width="280" height="22" rx="4" fill="#241042" stroke="#7c3aed" stroke-width="1"/>
+    <text x="0" y="24" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#e9d5ff">Raw Findings &amp; AST Taint Graphs</text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 2: ACCURACY, STANDARDS &amp; ABOM MATRIX (y=305, h=145)                  -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 305)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="145" rx="14" fill="url(#cardNorm)" stroke="#9333ea" stroke-width="2"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="#9333ea"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#ffffff">2</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">8-FRAMEWORK STANDARDS MAPPING &amp; ABOM</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#3b0764" stroke="#c084fc" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="800" fill="#e9d5ff">COMPLIANCE</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">8 Security Standards:</tspan> OWASP LLM 2025 · MITRE ATLAS · NIST AI 600-1 · EU AI Act (Art 12/14) · ISO 42001</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">CycloneDX 1.5 ABOM:</tspan> Full Agent Bill of Materials (Prompts, Tools, Models, Skills &amp; MCP Trust)</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#38bdf8">• <tspan font-weight="700">Scoring Engine:</tspan> Computes 0–100 Health Score &amp; Letter Grade (A–F) with Category Deductions</text>
+    </g>
+  </g>
+
+  <!-- Connector 2 -> 3 -->
+  <g transform="translate(480, 450)">
+    <line x1="0" y1="0" x2="0" y2="35" stroke="#38bdf8" stroke-width="3.5" marker-end="url(#arrDownCyan)"/>
+    <rect x="-140" y="8" width="280" height="22" rx="4" fill="#082230" stroke="#0284c7" stroke-width="1"/>
+    <text x="0" y="24" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#38bdf8">Deep Analysis / `praxis fix` Trigger</text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 3: COGNITIVE LLM REASONING &amp; REMEDIATION (y=490, h=155)              -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 490)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="155" rx="14" fill="url(#cardLlm)" stroke="#c084fc" stroke-width="2.2" filter="url(#glowPurple)"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="url(#praxisGrad)"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#ffffff">3</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">COGNITIVE LLM REASONING &amp; PATCH DRAFTING</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#3b0764" stroke="#c084fc" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="900" fill="#e9d5ff">AGENTIC AI</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">Multi-LLM Router:</tspan> Anthropic Claude · OpenAI · DeepSeek · Google Gemini · Local Ollama (`--local`)</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#f3e8ff">• <tspan font-weight="700">Exploitability Triage:</tspan> Evaluates call-site reachability &amp; attack vectors to eliminate false alarms</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#34d399">• <tspan font-weight="700">Autonomous Code Fix:</tspan> Drafts contextual, multi-file code patches &amp; unit regression tests</text>
+    </g>
+  </g>
+
+  <!-- Connector 3 -> 4 -->
+  <g transform="translate(480, 645)">
+    <line x1="0" y1="0" x2="0" y2="35" stroke="#34d399" stroke-width="3.5" marker-end="url(#arrDownGreen)"/>
+    <rect x="-145" y="8" width="290" height="22" rx="4" fill="#09281a" stroke="#10b981" stroke-width="1"/>
+    <text x="0" y="24" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#34d399">Draft Diffs to Verification Oracles</text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 4: 4-TIER EXECUTABLE VERIFICATION LADDER (y=685, h=165)              -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 685)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="165" rx="14" fill="url(#cardVerify)" stroke="#10b981" stroke-width="2.2" filter="url(#glowGreen)"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="url(#emeraldGrad)"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#042316">4</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">4-TIER EXECUTABLE VERIFICATION LADDER</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#0c2b1e" stroke="#10b981" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="900" fill="#34d399">ORACLES</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#a7f3d0">• <tspan font-weight="700">Tier 1 (AST Syntax Oracle):</tspan> Validates AST node integrity before any file is touched</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#a7f3d0">• <tspan font-weight="700">Tier 2 (Build Oracle):</tspan> Executes project build (`npm run build` / `tsc`) to ensure 0 compiler errors</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#a7f3d0">• <tspan font-weight="700">Tier 3 (Test Suite Oracle):</tspan> Runs unit test suite to guarantee zero functionality regressions</text>
+      <text x="0" y="92" font-family="sans-serif" font-size="14.5" font-weight="800" fill="#34d399">• <tspan font-weight="700">Tier 4 (Re-scan Oracle):</tspan> Confirms finding resolution — <tspan font-weight="700">Auto-reverts on any oracle failure</tspan></text>
+    </g>
+  </g>
+
+  <!-- Connector 4 -> 5 -->
+  <g transform="translate(480, 850)">
+    <line x1="0" y1="0" x2="0" y2="35" stroke="#f59e0b" stroke-width="3.5" marker-end="url(#arrDownGold)"/>
+    <rect x="-140" y="8" width="280" height="22" rx="4" fill="#241403" stroke="#f59e0b" stroke-width="1"/>
+    <text x="0" y="24" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#fde047">Verified Diffs to Operator Review</text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STEP 5: HITL APPROVAL &amp; ATOMIC APPLY (y=890, h=165)                       -->
+  <!-- ========================================================================= -->
+  <g transform="translate(90, 890)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="165" rx="14" fill="url(#cardHitl)" stroke="#f59e0b" stroke-width="2.2"/>
+    
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="url(#goldGrad)"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#0c0701">5</text>
+    
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">HUMAN APPROVAL, ATOMIC APPLY &amp; REPORT SUITE</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#382006" stroke="#f59e0b" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="900" fill="#fde047">HUMAN-IN-LOOP</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#fef08a">• <tspan font-weight="700">Interactive Diff Review:</tspan> Developer inspects verified patch before any disk write</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#fef08a">• <tspan font-weight="700">Atomic Apply:</tspan> boundary + symlink checks, all-or-nothing rollback, hash-based `praxis undo`</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#38bdf8">• <tspan font-weight="700">Assessment Report:</tspan> single-file tabbed HTML — agent coverage, AST taint, ledger, trend</text>
+      <text x="0" y="92" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#34d399">• CI/CD Native: Net-new PR gating, SARIF export to GitHub Code Scanning &amp; PR annotations</text>
+    </g>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- LEFT RETURN CONDUIT (Closed Autopilot Loop: Step 5 -> Step 1)             -->
+  <!-- ========================================================================= -->
+  <path d="M 90 975 L 35 975 L 35 185 L 85 185" fill="none" stroke="#8b5cf6" stroke-width="3.5" stroke-dasharray="10 5"/>
+  <polygon points="85,185 70,175 70,195" fill="#c084fc"/>
+
+  <!-- Vertical Feedback Tag -->
+  <g transform="translate(25, 580) rotate(-90)">
+    <rect x="-160" y="-12" width="320" height="24" rx="4" fill="#1f0e38" stroke="#8b5cf6" stroke-width="1.2"/>
+    <text x="0" y="4" text-anchor="middle" font-family="sans-serif" font-size="11.5" font-weight="800" fill="#e9d5ff" letter-spacing="0.5">
+      ↻ AUTONOMOUS FIX → VERIFY LOOP
+    </text>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- STAGE 6 : OUTPUT SURFACES, PORTABILITY & REPRODUCIBILITY                   -->
+  <!-- ========================================================================= -->
+  <path d="M 480 1055 L 480 1087" fill="none" stroke="#38bdf8" stroke-width="3.5" marker-end="url(#arrDownCyan)"/>
+
+  <g transform="translate(90, 1095)" filter="url(#shadow)">
+    <rect x="0" y="0" width="780" height="165" rx="14" fill="url(#cardSurfaces)" stroke="#38bdf8" stroke-width="2.2"/>
+
+    <!-- Stage Header Badge -->
+    <circle cx="28" cy="28" r="16" fill="url(#cyanGrad)"/>
+    <text x="28" y="34" text-anchor="middle" font-family="sans-serif" font-size="16" font-weight="900" fill="#04141f">6</text>
+
+    <text x="56" y="34" font-family="sans-serif" font-size="18.5" font-weight="900" fill="#ffffff">OUTPUT SURFACES &amp; REPRODUCIBILITY</text>
+    <rect x="635" y="14" width="130" height="28" rx="6" fill="#082f49" stroke="#38bdf8" stroke-width="1.2"/>
+    <text x="700" y="32" text-anchor="middle" font-family="sans-serif" font-size="12" font-weight="900" fill="#7dd3fc">READ-ONLY</text>
+
+    <!-- Sub-bullets -->
+    <g transform="translate(24, 60)">
+      <text x="0" y="16" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#bae6fd">• <tspan font-weight="700">Web UI:</tspan> <tspan fill="#7dd3fc">`praxis web`</tspan> — Security Studio, live SSE, loopback-only, secrets redacted</text>
+      <text x="0" y="42" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#bae6fd">• <tspan font-weight="700">Portable Rules:</tspan> <tspan fill="#7dd3fc">`praxis rules export`</tspan> — 411 pattern rules as Semgrep YAML</text>
+      <text x="0" y="68" font-family="sans-serif" font-size="14.5" font-weight="600" fill="#bae6fd">• <tspan font-weight="700">Code Scanning:</tspan> SARIF carries numeric <tspan fill="#7dd3fc">`security-severity`</tspan> so alerts rank properly</text>
+      <text x="0" y="92" font-family="sans-serif" font-size="14.5" font-weight="700" fill="#34d399">• Reproducible: scan fingerprint + CI determinism gate over <tspan fill="#a7f3d0">`file::rule`</tspan> identities</text>
+    </g>
+  </g>
+
+  <!-- ========================================================================= -->
+  <!-- FOOTER                                                                    -->
+  <!-- ========================================================================= -->
+  <g transform="translate(480, 1300)">
+    <text text-anchor="middle" font-family="'Segoe UI', sans-serif" font-size="13.5" font-weight="600" fill="#c084fc">
+      Node.js ≥ 18 · Pure ESM · 28 Security Agents · 4-Tier Verification Ladder · Multi-LLM Autopilot
+    </text>
+  </g>
+</svg>

package/assets/praxis-logo.svg

@@ -0,0 +1,38 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="620" height="180" viewBox="0 0 620 180" role="img" aria-label="Praxis logo">
+  <defs>
+    <!-- Base Shield Gradient (Vibrant purple to deep violet) -->
+    <linearGradient id="purpleGrad" x1="0" y1="0" x2="1" y2="1">
+      <stop offset="0%" stop-color="#c084fc"/>
+      <stop offset="55%" stop-color="#7c3aed"/>
+      <stop offset="100%" stop-color="#4c1d95"/>
+    </linearGradient>
+    <!-- Wordmark Gradient (Fuchsia to violet) -->
+    <linearGradient id="wordGrad" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%" stop-color="#e879f9"/>
+      <stop offset="100%" stop-color="#7c3aed"/>
+    </linearGradient>
+  </defs>
+
+  <!-- Shield icon with find-fix-verify loop and AI sparkle -->
+  <g transform="translate(24,28)">
+    <!-- Sleek outer shield path -->
+    <path d="M55 0 L110 18 V62 C110 100 86 128 55 145 C24 128 0 100 0 62 V18 Z"
+          fill="url(#purpleGrad)" stroke="#3b0764" stroke-width="2"/>
+    
+    <!-- Clockwise reload/loop arrow (the "remediation loop") -->
+    <path d="M55 35 A35 35 0 1 1 20 70 H32 A23 23 0 1 0 55 47 V60 L75 41 L55 22 V35 Z"
+          fill="#ffffff" opacity="0.95"/>
+          
+    <!-- 4-point AI sparkle star (representing autopilot / agent intelligence) -->
+    <path d="M55 52 Q55 70 73 70 Q55 70 55 88 Q55 70 37 70 Q55 70 55 52 Z"
+          fill="#ffffff" opacity="0.95"/>
+  </g>
+
+  <!-- Wordmark -->
+  <text x="160" y="86" font-family="Segoe UI, Helvetica, Arial, sans-serif"
+        font-size="56" font-weight="800" fill="url(#wordGrad)" letter-spacing="-1">Praxis</text>
+
+  <!-- Tagline under the wordmark -->
+  <text x="162" y="120" font-family="Segoe UI, Helvetica, Arial, sans-serif"
+        font-size="19" font-weight="600" fill="#6b7280" letter-spacing="0.4">Autonomous AI-Security Audit Framework</text>
+</svg>

package/checklists/launch-day.md

@@ -1,6 +1,6 @@
 # Launch Day Security Checklist
 
-**Complete this checklist before you go live. Each item takes under 1 minute to verify.**
+Use this checklist to plan release verification. The checks are starting points; their effort and required evidence depend on the application.
 
 ---
 
@@ -13,11 +13,11 @@
 ```bash
 curl -I https://yoursite.com/.git/config
 ```
-If you get a 200 response, your git folder is exposed.
+Inspect the response body: a 200 response alone may be a generic application page. Confirm that Git metadata is inaccessible.
 
 **Fix:** Configure your web server to deny access to `.git`:
 - Nginx: `location ~ /\.git { deny all; }`
-- Vercel/Netlify: Already blocked by default
+- Hosted platforms: verify the deployed behavior rather than assuming a default
 
 ---
 
@@ -136,7 +136,6 @@ Try accessing:
 - `/admin`
 - `/api/admin`
 - `/dashboard`
-- `/_next` (for Next.js internal routes)
 
 **Fix:**
 - Add authentication middleware to all admin routes
@@ -151,7 +150,7 @@ Try accessing:
 - [ ] **CORS configured:** Not set to `*` in production
 - [ ] **Cookies secured:** `HttpOnly`, `Secure`, `SameSite` flags set
 - [ ] **File uploads validated:** Check file types, not just extensions
-- [ ] **SQL/NoSQL injection tested:** Try `'; DROP TABLE users;--` in input fields
+- [ ] **SQL/NoSQL injection tested:** Use harmless probes in an authorized test environment and verify parameterized queries
 
 ---
 
@@ -161,8 +160,8 @@ Security is ongoing. Schedule monthly reviews:
 1. Re-run this checklist
 2. Check for dependency updates
 3. Review access logs for suspicious activity
-4. Rotate API keys quarterly
+4. Review credential exposure and rotate keys according to provider guidance and incident requirements
 
 ---
 
-**You've got this. Ship it.**
+Record the evidence, unresolved findings, and the owner of each release decision.

package/cli/agents/agent-telemetry-agent.js

@@ -24,6 +24,7 @@
 
 import fs from 'fs';
 import { BaseAgent, createFinding, ruleTableLineMask } from './base-agent.js';
+import { isDocumentedSecretExample } from '../utils/entropy.js';
 
 // =============================================================================
 // PATTERNS & REGEXES
@@ -304,6 +305,7 @@ export class AgentTelemetryAgent extends BaseAgent {
             pattern.regex.lastIndex = 0;
             let match;
             while ((match = pattern.regex.exec(lines[i])) !== null) {
+              if (isDocumentedSecretExample(pattern.rule, match[0])) continue;
               // Skip placeholder credential values (docs/examples) for the
               // generic secret-kv rule only.
               if (pattern.rule === 'AGENT_LOG_SECRET_KV' && PLACEHOLDER_VALUE.test(match[1] || '')) break;

package/cli/agents/api-fuzzer.js

@@ -88,7 +88,7 @@ export const PATTERNS = [
   {
     rule: 'API_UPLOAD_NO_TYPE_CHECK',
     title: 'API: File Upload Without Type Validation',
-    regex: /(?<!_)(?:originalname|filename)\s*(?:\)|;)/g,
+    regex: /\b(?:file|upload|uploadedFile|req\.file|request\.file)\.originalname\s*(?:\)|;)/g,
     severity: 'high',
     cwe: 'CWE-434',
     owasp: 'A04:2021',
@@ -99,7 +99,7 @@ export const PATTERNS = [
   {
     rule: 'API_PATH_IN_FILENAME',
     title: 'API: Path Traversal in File Upload',
-    regex: /path\.join\s*\([^)]*(?:originalname|filename|req\.file|req\.body)/g,
+    regex: /path\.join\s*\([^)]*(?:\b(?:req|request)\.(?:files?|body|query|params)\b|\b[\w$]+\.originalname\b)/g,
     severity: 'critical',
     cwe: 'CWE-22',
     owasp: 'A01:2021',

package/cli/agents/git-history-scanner.js

@@ -10,8 +10,10 @@
 
 import { execSync, execFileSync } from 'child_process';
 import path from 'path';
+import { createHash } from 'crypto';
 import { BaseAgent, createFinding } from './base-agent.js';
 import { SECRET_PATTERNS } from '../utils/patterns.js';
+import { isDocumentedSecretExample } from '../utils/entropy.js';
 
 // Compile a fast combined regex from all secret patterns
 const FAST_SECRET_PATTERNS = SECRET_PATTERNS.map(p => ({
@@ -28,6 +30,7 @@ export class GitHistoryScanner extends BaseAgent {
   async analyze(context) {
     const { rootPath, options } = context;
     const findings = [];
+    const seen = new Set();
 
     // Check if this is a git repository
     if (!this.isGitRepo(rootPath)) return [];
@@ -50,9 +53,8 @@ export class GitHistoryScanner extends BaseAgent {
           maxBuffer: 50 * 1024 * 1024, // 50MB buffer
           timeout: 60000, // 60s timeout
         });
-      } catch {
-        // git log failed — might be a shallow clone or no history
-        return [];
+      } catch (err) {
+        throw new Error(`Git history scan failed: ${err.message}`);
       }
 
       if (!diffOutput) return [];
@@ -88,8 +90,12 @@ export class GitHistoryScanner extends BaseAgent {
         // Check against all secret patterns
         for (const p of FAST_SECRET_PATTERNS) {
           p.pattern.lastIndex = 0;
-          const match = p.pattern.exec(addedLine);
-          if (match) {
+          let match;
+          while ((match = p.pattern.exec(addedLine)) !== null) {
+            if (isDocumentedSecretExample(p.name, match[0])) continue;
+            const key = `${p.name}:${createHash('sha256').update(match[0]).digest('hex')}`;
+            if (seen.has(key)) continue;
+            seen.add(key);
             // Check if this secret still exists in current working tree
             const stillExists = this.existsInWorkingTree(rootPath, match[0]);
 
@@ -113,18 +119,11 @@ export class GitHistoryScanner extends BaseAgent {
         }
       }
 
-      // Deduplicate by matched value (same secret in multiple commits)
-      const seen = new Set();
-      return findings.filter(f => {
-        const key = `${f.matched}:${f.title}`;
-        if (seen.has(key)) return false;
-        seen.add(key);
-        return true;
-      });
+      return findings;
 
     } catch (err) {
-      // Don't fail the entire scan if git history scan fails
-      return [];
+      // Let the orchestrator mark this scanner incomplete instead of clean.
+      throw new Error(`GitHistoryScanner incomplete: ${err.message}`, { cause: err });
     }
   }
 

package/cli/agents/html-reporter.js

@@ -33,6 +33,7 @@ import { buildScanFingerprint, fingerprintLine } from '../utils/scan-fingerprint
 import { readFixLedger, summarizeFixLedger, isReversible } from '../utils/fix-ledger.js';
 import { readScoreHistory, summarizeHistory } from '../utils/score-history.js';
 import { toolVersion } from '../core/version.js';
+import { displayPath } from '../core/paths.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PKG_VERSION = toolVersion();
@@ -44,13 +45,12 @@ export class HTMLReporter {
   }
 
   normalizePath(filePath, rootPath) {
-    if (!filePath) return '';
-    const norm = String(filePath).replace(/\\/g, '/');
-    const normRoot = rootPath ? String(rootPath).replace(/\\/g, '/') : '';
-    if (normRoot && norm.startsWith(normRoot)) {
-      return norm.slice(normRoot.length).replace(/^\/+/, '');
-    }
-    return norm.replace(/^[a-zA-Z]:\/+/, '').replace(/^.*\/Praxis\/showcase-target\//, '').replace(/^.*\/showcase-target\//, '');
+    // Paths reach the reporter already normalised by the orchestrator, so this only
+    // has to fall back for callers that build findings themselves. The strippers
+    // that used to live here leaked the username into every HTML report and
+    // truncated any real path containing a directory called `Praxis` — see
+    // cli/core/paths.js.
+    return displayPath(filePath, rootPath);
   }
 
   /**
@@ -177,6 +177,7 @@ export class HTMLReporter {
           </div>
         </div>
       </header>
+      ${scoreResult.scanComplete === false ? '<p role="alert" class="sev-badge sev-high">SCAN INCOMPLETE — score reflects only available results. Review scan errors before trusting this report.</p>' : ''}
     `;
   }
 
@@ -1122,4 +1123,4 @@ function toggleDetail(id) {
   }
 }
 
-export default HTMLReporter;
+export default HTMLReporter;