attackmap 0.1.0__py3-none-any.whl

attackmap/asset_model.py

@@ -0,0 +1,245 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+
+from .models import Asset, AssetKind, ScanResult
+
+LOW_QUALITY_SEGMENTS = ("/tests/", "/__tests__/", "/fixtures/", "/mocks/", "/examples/", "/test_", "/_test.")
+
+
+def _is_low_quality(path: str) -> bool:
+    normalized = ("/" + path.replace("\\", "/").lower() + "/")
+    return any(segment in normalized for segment in LOW_QUALITY_SEGMENTS)
+
+
+@dataclass(frozen=True)
+class _AssetRule:
+    kind: AssetKind
+    name: str
+    criticality: str
+    secret_patterns: tuple[str, ...] = ()
+    route_patterns: tuple[str, ...] = ()
+    file_patterns: tuple[str, ...] = ()
+
+
+_ASSET_RULES: tuple[_AssetRule, ...] = (
+    _AssetRule(
+        kind="session",
+        name="Authentication tokens / session material",
+        criticality="critical",
+        secret_patterns=("jwt_secret", "session_secret", "cookie_secret", "auth_secret", "refresh_secret", "signing_key"),
+        route_patterns=("/login", "/signin", "/token", "/oauth", "/session", "/refresh", "/logout"),
+        file_patterns=("auth/", "session/", "/jwt"),
+    ),
+    _AssetRule(
+        kind="credentials",
+        name="User credentials at rest",
+        criticality="critical",
+        secret_patterns=("password_pepper", "hash_secret"),
+        route_patterns=("/password", "/signup", "/register", "/reset-password", "/forgot"),
+        file_patterns=("models/user", "models/account", "entities/user", "entities/account", "user_repository", "auth/password"),
+    ),
+    _AssetRule(
+        kind="payment",
+        name="Payment / billing records",
+        criticality="critical",
+        secret_patterns=("stripe", "paypal", "braintree", "adyen", "billing_key"),
+        route_patterns=("/payment", "/checkout", "/billing", "/invoice", "/subscription", "/charge"),
+        file_patterns=("models/payment", "models/invoice", "models/order", "entities/payment", "entities/invoice", "entities/order", "billing/"),
+    ),
+    _AssetRule(
+        kind="user_pii",
+        name="User PII / profile data",
+        criticality="high",
+        route_patterns=("/users", "/user/", "/profile", "/account", "/me", "/contacts", "/address"),
+        file_patterns=("models/user", "models/profile", "models/contact", "entities/user", "entities/profile", "user_repository", "user_service"),
+    ),
+    _AssetRule(
+        kind="internal_secret",
+        name="Internal service / API secrets",
+        criticality="high",
+        secret_patterns=(
+            "api_key",
+            "private_key",
+            "webhook_secret",
+            "signing_secret",
+            "service_token",
+            "admin_token",
+            "internal_key",
+            "encryption_key",
+            "master_key",
+            "deploy_key",
+        ),
+        file_patterns=("vault/", "kms/", "/keys/"),
+    ),
+    _AssetRule(
+        kind="audit_log",
+        name="Audit / security logs",
+        criticality="medium",
+        route_patterns=("/audit", "/security/log", "/events"),
+        file_patterns=("audit/", "/audit_log", "security/log", "logs/security"),
+    ),
+    _AssetRule(
+        kind="configuration",
+        name="Security-relevant configuration",
+        criticality="medium",
+        secret_patterns=("config_signing", "feature_flag_secret"),
+        file_patterns=(".env", "config/secrets", "secrets.yml", "secrets.yaml", "config/security"),
+    ),
+)
+
+
+def _normalize(text: str) -> str:
+    return text.replace("\\", "/").lower()
+
+
+def _matches_any(haystack: str, needles: tuple[str, ...]) -> bool:
+    return any(needle in haystack for needle in needles)
+
+
+def _loc(file_path: str, line: int | None) -> str:
+    """`file:line` if line is known, else `file`."""
+    return f"{file_path}:{line}" if line is not None else file_path
+
+
+def _route_path_set(scan: ScanResult) -> set[str]:
+    return {_normalize(route.path) for route in scan.routes}
+
+
+def _route_files_for(scan: ScanResult, route_lower: str) -> list[str]:
+    return [route.file for route in scan.routes if _normalize(route.path) == route_lower]
+
+
+def _gather_asset(rule: _AssetRule, scan: ScanResult) -> Asset | None:
+    locations: set[str] = set()
+    evidence: set[str] = set()
+
+    if rule.secret_patterns:
+        for hint in scan.secret_hints:
+            if _is_low_quality(hint.file):
+                continue
+            name_lower = hint.name.lower()
+            if _matches_any(name_lower, rule.secret_patterns):
+                locations.add(hint.file)
+                evidence.add(f"secret:{hint.name} ({_loc(hint.file, hint.line)})")
+
+    if rule.route_patterns:
+        for route in scan.routes:
+            if _is_low_quality(route.file):
+                continue
+            path_lower = _normalize(route.path)
+            if _matches_any(path_lower, rule.route_patterns):
+                locations.add(route.file)
+                evidence.add(f"route:{route.method} {route.path} ({_loc(route.file, route.line)})")
+
+    if rule.file_patterns:
+        candidate_files: set[str] = set()
+        candidate_files.update(route.file for route in scan.routes)
+        candidate_files.update(hint.file for hint in scan.secret_hints)
+        candidate_files.update(hint.file for hint in scan.framework_hints)
+        candidate_files.update(hint.file for hint in scan.service_hints)
+        candidate_files.update(hint.file for hint in scan.auth_hints)
+        for file_path in candidate_files:
+            if _is_low_quality(file_path):
+                continue
+            file_lower = _normalize(file_path)
+            if _matches_any(file_lower, rule.file_patterns):
+                locations.add(file_path)
+                evidence.add(f"file:{file_path}")
+
+    if not evidence:
+        return None
+
+    asset_id = f"asset:{rule.kind}"
+    return Asset(
+        id=asset_id,
+        kind=rule.kind,
+        name=rule.name,
+        criticality=rule.criticality,  # type: ignore[arg-type]
+        locations=sorted(locations),
+        evidence=sorted(evidence)[:12],
+    )
+
+
+_SECRET_KIND_HEURISTICS: tuple[tuple[re.Pattern[str], AssetKind, str, str], ...] = (
+    (re.compile(r"jwt|session|cookie|refresh|auth_secret"), "session", "Auth/session secret", "critical"),
+    (re.compile(r"stripe|paypal|braintree|adyen"), "payment", "Payment processor secret", "critical"),
+    (re.compile(r"webhook|signing|hmac"), "internal_secret", "Webhook / signing secret", "high"),
+    (re.compile(r"api[_-]?key|service[_-]?token|admin[_-]?token|deploy[_-]?key"), "internal_secret", "API / service token", "high"),
+    (re.compile(r"private[_-]?key|encryption[_-]?key|master[_-]?key"), "internal_secret", "Cryptographic key material", "critical"),
+)
+
+
+def _secrets_as_assets(scan: ScanResult) -> list[Asset]:
+    assets: list[Asset] = []
+    seen_ids: set[str] = set()
+    for hint in scan.secret_hints:
+        if _is_low_quality(hint.file):
+            continue
+        name_lower = hint.name.lower()
+        for pattern, kind, name, criticality in _SECRET_KIND_HEURISTICS:
+            if pattern.search(name_lower):
+                asset_id = f"asset:secret:{name_lower}"
+                if asset_id in seen_ids:
+                    break
+                seen_ids.add(asset_id)
+                assets.append(
+                    Asset(
+                        id=asset_id,
+                        kind=kind,
+                        name=f"{name}: {hint.name}",
+                        criticality=criticality,  # type: ignore[arg-type]
+                        locations=[hint.file],
+                        evidence=[f"secret:{hint.name} ({_loc(hint.file, hint.line)})"],
+                    )
+                )
+                break
+    return assets
+
+
+def _business_data_fallback(scan: ScanResult, assets: list[Asset]) -> Asset | None:
+    runtime_dbs = [db for db in scan.databases if not _is_low_quality(db.file)]
+    if not runtime_dbs:
+        return None
+    sensitive_kinds = {"user_pii", "payment", "credentials", "session"}
+    if any(asset.kind in sensitive_kinds for asset in assets):
+        return None
+    files = sorted({db.file for db in runtime_dbs})[:8]
+    kinds = sorted({db.kind for db in runtime_dbs})
+    return Asset(
+        id="asset:business_data",
+        kind="business_data",
+        name="Business / operational data store",
+        criticality="medium",
+        locations=files,
+        evidence=[f"datastore:{kind}" for kind in kinds],
+    )
+
+
+def detect_assets(scan: ScanResult) -> list[Asset]:
+    """Return the inferred asset inventory for a scan, deduplicated by id."""
+    assets: list[Asset] = []
+    seen_ids: set[str] = set()
+
+    for rule in _ASSET_RULES:
+        asset = _gather_asset(rule, scan)
+        if asset is None or asset.id in seen_ids:
+            continue
+        seen_ids.add(asset.id)
+        assets.append(asset)
+
+    for asset in _secrets_as_assets(scan):
+        if asset.id in seen_ids:
+            continue
+        seen_ids.add(asset.id)
+        assets.append(asset)
+
+    fallback = _business_data_fallback(scan, assets)
+    if fallback is not None and fallback.id not in seen_ids:
+        seen_ids.add(fallback.id)
+        assets.append(fallback)
+
+    _criticality_rank = {"critical": 0, "high": 1, "medium": 2, "low": 3}
+    assets.sort(key=lambda asset: (_criticality_rank.get(asset.criticality, 9), asset.kind, asset.id))
+    return assets

attackmap/attack_taxonomy.py

@@ -0,0 +1,140 @@
+"""MITRE ATT&CK technique mapping for AttackMap insights and findings.
+
+Maps internal `InsightKind` values and finding-title keywords to relevant
+ATT&CK techniques (Enterprise matrix). Conservative by design — we only
+emit techniques where the static-analysis evidence directly motivates
+the mapping. Defenders use these to slot AttackMap output into existing
+ATT&CK-aligned detection programs.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from .models import AttackTechnique, Finding, Insight, InsightKind
+
+
+def _technique(technique_id: str, name: str, tactic: str) -> AttackTechnique:
+    return AttackTechnique(
+        technique_id=technique_id,
+        name=name,
+        tactic=tactic,
+        url=f"https://attack.mitre.org/techniques/{technique_id.replace('.', '/')}/",
+    )
+
+
+# Curated technique catalog — only techniques AttackMap actually maps to.
+T = {
+    "T1190": _technique("T1190", "Exploit Public-Facing Application", "Initial Access"),
+    "T1078": _technique("T1078", "Valid Accounts", "Defense Evasion / Persistence / Initial Access"),
+    "T1199": _technique("T1199", "Trusted Relationship", "Initial Access"),
+    "T1212": _technique("T1212", "Exploitation for Credential Access", "Credential Access"),
+    "T1552": _technique("T1552", "Unsecured Credentials", "Credential Access"),
+    "T1110": _technique("T1110", "Brute Force", "Credential Access"),
+    "T1528": _technique("T1528", "Steal Application Access Token", "Credential Access"),
+    "T1068": _technique("T1068", "Exploitation for Privilege Escalation", "Privilege Escalation"),
+    "T1098": _technique("T1098", "Account Manipulation", "Persistence / Privilege Escalation"),
+    "T1562": _technique("T1562", "Impair Defenses", "Defense Evasion"),
+    "T1565": _technique("T1565", "Data Manipulation", "Impact"),
+    "T1485": _technique("T1485", "Data Destruction", "Impact"),
+    "T1041": _technique("T1041", "Exfiltration Over C2 Channel", "Exfiltration"),
+    "T1071": _technique("T1071", "Application Layer Protocol", "Command and Control"),
+    "T1059": _technique("T1059", "Command and Scripting Interpreter", "Execution"),
+    "T1556": _technique("T1556", "Modify Authentication Process", "Defense Evasion / Persistence"),
+}
+
+
+@dataclass(frozen=True)
+class _Mapping:
+    technique_ids: tuple[str, ...]
+
+
+_INSIGHT_KIND_MAP: dict[InsightKind, _Mapping] = {
+    "shared_secret_blast_radius": _Mapping(("T1552", "T1528", "T1078")),
+    "sensitive_asset_reachability": _Mapping(("T1190", "T1041")),
+    "control_bypass": _Mapping(("T1562", "T1190")),
+    "defense_gap_in_chain": _Mapping(("T1190", "T1212")),
+    "asymmetric_protection": _Mapping(("T1190", "T1078")),
+    "trust_boundary_violation": _Mapping(("T1199", "T1190")),
+    "audit_gap": _Mapping(("T1562",)),
+    "control_strength_mismatch": _Mapping(("T1110", "T1552")),
+    "single_point_of_failure": _Mapping(("T1552", "T1528", "T1556")),
+    "stale_or_contradictory_signal": _Mapping(()),
+    "admin_action_without_auth": _Mapping(("T1078", "T1068", "T1098")),
+}
+
+
+# Title/evidence keyword fallback for findings (which don't carry a kind enum).
+_FINDING_KEYWORD_MAP: tuple[tuple[tuple[str, ...], tuple[str, ...]], ...] = (
+    (("webhook", "callback"), ("T1190", "T1199")),
+    (("admin", "manage", "privileged"), ("T1078", "T1068", "T1098")),
+    (("upload",), ("T1190", "T1059")),
+    (("auth", "login", "session"), ("T1078", "T1110", "T1556")),
+    (("secret", "token", "key"), ("T1552", "T1528")),
+    (("public route", "external"), ("T1190",)),
+    (("exfil",), ("T1041",)),
+    (("command", "rce", "exec"), ("T1059",)),
+    (("data store", "datastore", "database"), ("T1565",)),
+)
+
+
+def techniques_for_insight(insight: Insight) -> list[AttackTechnique]:
+    mapping = _INSIGHT_KIND_MAP.get(insight.kind)
+    if mapping is None:
+        return []
+    return [T[tid] for tid in mapping.technique_ids if tid in T]
+
+
+def techniques_for_finding(finding: Finding) -> list[AttackTechnique]:
+    haystack = " ".join([finding.title, *finding.evidence]).lower()
+    seen: set[str] = set()
+    matched: list[AttackTechnique] = []
+    for keywords, technique_ids in _FINDING_KEYWORD_MAP:
+        if not any(keyword in haystack for keyword in keywords):
+            continue
+        for tid in technique_ids:
+            if tid in seen or tid not in T:
+                continue
+            seen.add(tid)
+            matched.append(T[tid])
+    return matched
+
+
+def annotate_insights(insights: list[Insight]) -> list[Insight]:
+    """Return new Insight objects with `attack_techniques` populated.
+
+    Insights are immutable pydantic models, so we model_copy with an update.
+    """
+    annotated: list[Insight] = []
+    for insight in insights:
+        if insight.attack_techniques:
+            annotated.append(insight)
+            continue
+        techniques = techniques_for_insight(insight)
+        if not techniques:
+            annotated.append(insight)
+            continue
+        annotated.append(insight.model_copy(update={"attack_techniques": techniques}))
+    return annotated
+
+
+def annotate_findings(findings: list[Finding]) -> list[Finding]:
+    annotated: list[Finding] = []
+    for finding in findings:
+        if finding.attack_techniques:
+            annotated.append(finding)
+            continue
+        techniques = techniques_for_finding(finding)
+        if not techniques:
+            annotated.append(finding)
+            continue
+        annotated.append(finding.model_copy(update={"attack_techniques": techniques}))
+    return annotated
+
+
+__all__ = [
+    "techniques_for_insight",
+    "techniques_for_finding",
+    "annotate_insights",
+    "annotate_findings",
+]

attackmap/cli.py

@@ -0,0 +1,185 @@
+from __future__ import annotations
+
+import json
+from pathlib import Path
+
+import typer
+
+from .analyzer import summarize_architecture, summarize_attack_surface
+from .defensive_review import render_defensive_review
+from .analyzers import (
+    analyze_repository,
+    get_available_modules,
+    get_available_repository_modules,
+    get_analyzer_metadata,
+    resolve_run_analyzers,
+    select_requested_analyzers,
+)
+from .graph import build_graph
+from .llm_review import LlmReviewError, generate_llm_review
+from .recon_to_analysis import translate_recon
+from .report import render_console_summary, write_reports
+
+app = typer.Typer(help="AttackMap: understand your system and map your attack surface.")
+
+
+@app.command()
+def analyze(
+    path: str = typer.Argument(".", help="Path to the repository to analyze."),
+    output: str = typer.Option("reports", "--output", "-o", help="Directory for generated reports."),
+    format: str = typer.Option("all", "--format", help="Output format: all, markdown, or json."),
+    module: list[str] | None = typer.Option(
+        None,
+        "--module",
+        "-m",
+        help="Analyzer module(s) to run. Repeat to select multiple. Missing external analyzers are auto-installed from the mlaify GitHub organization.",
+    ),
+    llm: bool = typer.Option(
+        False,
+        "--llm",
+        help="Generate a narrative defensive review by calling Claude with the evidence pack. Auth resolves automatically: ANTHROPIC_API_KEY → ANTHROPIC_AUTH_TOKEN → `claude` CLI (subscription auth). Force a backend with --llm-backend.",
+    ),
+    llm_model: str | None = typer.Option(
+        None,
+        "--llm-model",
+        help="Claude model ID for --llm (defaults to claude-opus-4-7).",
+    ),
+    llm_effort: str | None = typer.Option(
+        None,
+        "--llm-effort",
+        help="Effort for --llm: low|medium|high|xhigh|max. Defaults to high.",
+    ),
+    llm_backend: str = typer.Option(
+        "auto",
+        "--llm-backend",
+        help="Which backend --llm uses: 'auto' (default) tries ANTHROPIC_API_KEY → ANTHROPIC_AUTH_TOKEN → `claude` CLI; 'api' forces the SDK; 'cli' forces the `claude` CLI (uses your `claude login` auth, e.g. Pro/Max subscription).",
+    ),
+) -> None:
+    repo_path = Path(path).resolve()
+    if not repo_path.exists():
+        raise typer.BadParameter(f"Path does not exist: {repo_path}")
+
+    selected_analyzers = None
+    if module:
+        try:
+            selected_analyzers = select_requested_analyzers(module, auto_install=True)
+        except ValueError as exc:
+            raise typer.BadParameter(str(exc)) from exc
+
+    active_analyzers = resolve_run_analyzers(repo_path, analyzers=selected_analyzers)
+    scan = analyze_repository(repo_path, analyzers=active_analyzers)
+    graph = build_graph(scan)
+    analysis = translate_recon(scan)
+    attack_surfaces = analysis.attack_surfaces
+    architecture_md = summarize_architecture(scan, graph)
+    attack_surface_md = summarize_attack_surface(scan, attack_surfaces)
+    findings = analysis.findings
+    attack_paths = analysis.attack_paths
+    defensive_review_md = render_defensive_review(scan, attack_surfaces, findings, attack_paths)
+
+    write_reports(
+        output,
+        scan,
+        architecture_md,
+        attack_surface_md,
+        defensive_review_md,
+        attack_surfaces,
+        findings,
+        attack_paths,
+        analyzer_metadata=[
+            {
+                "name": metadata.name,
+                "description": metadata.description,
+                "scope": metadata.scope,
+                "ecosystems": list(metadata.ecosystems),
+            }
+            for metadata in (get_analyzer_metadata(analyzer) for analyzer in active_analyzers)
+        ],
+    )
+    typer.echo(render_console_summary(scan, findings, attack_paths))
+    typer.echo("")
+    typer.echo(f"Reports written to: {Path(output).resolve()}")
+
+    if llm:
+        try:
+            effort_value = None
+            if llm_effort is not None:
+                if llm_effort not in {"low", "medium", "high", "xhigh", "max"}:
+                    raise typer.BadParameter(
+                        f"Invalid --llm-effort '{llm_effort}'. Use one of: low, medium, high, xhigh, max."
+                    )
+                effort_value = llm_effort  # type: ignore[assignment]
+
+            if llm_backend not in {"auto", "api", "cli"}:
+                raise typer.BadParameter(
+                    f"Invalid --llm-backend '{llm_backend}'. Use one of: auto, api, cli."
+                )
+
+            typer.echo("")
+            typer.echo(
+                f"Generating narrative review via Claude (backend={llm_backend}, may take a minute)..."
+            )
+            result = generate_llm_review(
+                scan,
+                attack_surfaces,
+                findings,
+                attack_paths,
+                model=llm_model,
+                effort=effort_value,  # type: ignore[arg-type]
+                backend=llm_backend,  # type: ignore[arg-type]
+            )
+        except LlmReviewError as exc:
+            typer.echo(f"LLM review skipped: {exc}", err=True)
+        else:
+            output_path = Path(output)
+            llm_md_path = output_path / "defensive-review-llm.md"
+            llm_md_path.write_text(result.markdown + "\n", encoding="utf-8")
+            llm_meta_path = output_path / "defensive-review-llm.meta.json"
+            llm_meta_path.write_text(
+                json.dumps(
+                    {
+                        "backend": result.backend,
+                        "model": result.model,
+                        "stop_reason": result.stop_reason,
+                        "usage": result.usage,
+                    },
+                    indent=2,
+                )
+                + "\n",
+                encoding="utf-8",
+            )
+            typer.echo(f"LLM review written to: {llm_md_path.resolve()} (backend={result.backend})")
+
+
+@app.command("modules")
+def modules() -> None:
+    available_modules = get_available_modules()
+    if not available_modules:
+        typer.echo("No analyzer modules are currently available.")
+    else:
+        typer.echo("Available analyzer modules (installed):")
+        for module_metadata in available_modules:
+            ecosystems = ", ".join(module_metadata.ecosystems) if module_metadata.ecosystems else "none"
+            typer.echo(f"- {module_metadata.name}: {module_metadata.description}")
+            typer.echo(f"  scope: {module_metadata.scope}")
+            typer.echo(f"  ecosystems: {ecosystems}")
+
+    typer.echo("")
+    typer.echo("Available module repositories (mlaify GitHub org):")
+    try:
+        repository_modules = get_available_repository_modules()
+    except ValueError as exc:
+        typer.echo(f"- Unable to fetch remote module repositories: {exc}")
+        return
+
+    if not repository_modules:
+        typer.echo("- No module repositories were discovered.")
+        return
+
+    for module in repository_modules:
+        typer.echo(f"- {module.analyzer_name} ({module.repo_name})")
+        typer.echo(f"  repo: {module.web_url}")
+
+
+if __name__ == "__main__":
+    app()

attackmap/context_pack.py

@@ -0,0 +1,82 @@
+from __future__ import annotations
+
+from .models import ScanResult
+
+SCHEMA_VERSION = "1.0.0"
+LOW_QUALITY_SEGMENTS = ["/tests/", "/__tests__/", "/fixtures/", "/mocks/", "/examples/"]
+
+
+def _infer_domain_hints(scan: ScanResult) -> dict:
+    route_values = [route.path.lower() for route in scan.routes]
+    hint_values = [hint.hint.lower() for hint in scan.auth_hints]
+    file_values = [route.file.lower() for route in scan.routes]
+    combined = " ".join([*route_values, *hint_values, *file_values])
+
+    tags: list[str] = []
+    signals: list[str] = []
+
+    if "/xrpc/" in combined or "atproto_" in combined or "com.atproto." in combined:
+        tags.append("atproto")
+        signals.append("xrpc/atproto namespace patterns observed")
+    if "app.bsky." in combined:
+        if "atproto" not in tags:
+            tags.append("atproto")
+        tags.append("bluesky")
+        signals.append("app.bsky namespace patterns observed")
+    if "laminas" in combined or "module.config.php" in combined:
+        tags.append("laminas")
+        signals.append("laminas/module config patterns observed")
+
+    if not tags:
+        tags.append("general")
+
+    return {
+        "tags": sorted(set(tags)),
+        "signals": sorted(set(signals)),
+    }
+
+
+def build_review_context_pack(
+    review_json: dict,
+    scan: ScanResult,
+    analyzer_metadata: list[dict[str, object]],
+) -> dict:
+    return {
+        "schema_version": SCHEMA_VERSION,
+        "artifact_type": "attackmap_review_context_pack",
+        "attackmap_review_json": review_json,
+        "analyzer_metadata_used": analyzer_metadata,
+        "source_quality_rules": {
+            "low_quality_path_segments": LOW_QUALITY_SEGMENTS,
+            "handling": {
+                "default": "down-rank low-quality signals in triage and prioritization",
+                "reporting": "retain low-quality signals in raw_structured_signals with explicit evidence-class labeling",
+                "operator_note": "do not treat low-quality-only evidence as strong production exposure without corroboration",
+            },
+        },
+        "output_hints": {
+            "audience": ["security engineers", "software engineers", "tech leads"],
+            "style": {
+                "tone": "defensive, concrete, non-hype",
+                "reasoning": "evidence-first and uncertainty-aware",
+                "disallowed": [
+                    "inventing findings or architecture elements",
+                    "offensive exploitation guidance",
+                ],
+            },
+            "prioritization": "focus on highest-impact, highest-confidence chains and trust-boundary issues first",
+        },
+        "domain_hints": _infer_domain_hints(scan),
+        "rag_expansion_hooks": {
+            "enabled": False,
+            "notes": "local-first context pack; retrieval slots intentionally minimal for future expansion",
+            "slots": [],
+        },
+        "limitations_meta": {
+            "analysis_mode": "heuristic",
+            "notes": [
+                "Domain tags are inferred heuristically from routes, hints, and file patterns.",
+                "Analyzer metadata reflects analyzers selected to run after detect-filtering.",
+            ],
+        },
+    }