corgea-cli 1.9.2__tar.gz → 1.10.0__tar.gz

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/.github/workflows/release-binaries.yml

@@ -12,6 +12,13 @@ on:
 permissions:
   contents: write
 
+env:
+  # Highest glibc a *-gnu binary may require. Linux builds are cross-linked
+  # against this floor so the artifacts do not inherit the runner's glibc.
+  GLIBC_FLOOR: "2.17"
+  ZIG_VERSION: "0.13.0"
+  CARGO_ZIGBUILD_VERSION: "0.23.0"
+
 jobs:
   native-binaries:
     name: Build and Upload Native Binaries
@@ -24,9 +31,12 @@ jobs:
           - os: ubuntu-latest
             target: x86_64-unknown-linux-musl
             binary_name: corgea
-          - os: ubuntu-24.04-arm
+          - os: ubuntu-latest
             target: aarch64-unknown-linux-gnu
             binary_name: corgea
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-musl
+            binary_name: corgea
           - os: macos-latest
             target: x86_64-apple-darwin
             binary_name: corgea
@@ -44,16 +54,68 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.ref }}
 
-      - name: Install musl tools
-        if: matrix.target == 'x86_64-unknown-linux-musl'
-        run: sudo apt-get install -y musl-tools
-
       - name: Install Rust Target
         run: rustup target add ${{ matrix.target }}
 
-      - name: Build Binary
+      - name: Install Zig
+        if: runner.os == 'Linux'
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
+        with:
+          version: ${{ env.ZIG_VERSION }}
+
+      - name: Install cargo-zigbuild
+        if: runner.os == 'Linux'
+        uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68 # v2.85.3
+        with:
+          tool: cargo-zigbuild@${{ env.CARGO_ZIGBUILD_VERSION }}
+
+      - name: Build Binary (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          build_target="${{ matrix.target }}"
+          if [[ "$build_target" == *-gnu ]]; then
+            build_target="${build_target}.${GLIBC_FLOOR}"
+          fi
+          cargo zigbuild --release --target "$build_target"
+
+      - name: Build Binary (macOS and Windows)
+        if: runner.os != 'Linux'
         run: cargo build --release --target ${{ matrix.target }}
 
+      - name: Verify Linux Runtime Compatibility
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          scripts/check-linux-binary.sh \
+            "target/${{ matrix.target }}/release/${{ matrix.binary_name }}" \
+            "${{ matrix.target }}"
+
+      # The aarch64 artifacts are cross-built, so nothing else in CI would ever
+      # execute them. Run them under qemu to catch a binary that passes the
+      # header checks but cannot actually start.
+      - name: Smoke Test Linux Binary
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          binary="target/${{ matrix.target }}/release/${{ matrix.binary_name }}"
+
+          case "${{ matrix.target }}" in
+            aarch64-*-gnu)
+              sudo apt-get update -qq
+              sudo apt-get install -y -qq qemu-user-static libc6-arm64-cross
+              qemu-aarch64-static -L /usr/aarch64-linux-gnu "$binary" --version
+              ;;
+            aarch64-*-musl)
+              sudo apt-get update -qq
+              sudo apt-get install -y -qq qemu-user-static
+              qemu-aarch64-static "$binary" --version
+              ;;
+            *)
+              "$binary" --version
+              ;;
+          esac
+
       - name: Archive Binary (Unix)
         if: runner.os != 'Windows'
         shell: bash

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/.github/workflows/test.yml

@@ -4,9 +4,11 @@ on:
   push:
     branches:
       - main
-      - master
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   rust-tests:
     runs-on: ubuntu-latest

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/.gitignore

@@ -5,6 +5,7 @@
 *.zip
 *.profraw
 node_modules/
+/vendor/
 /packages/*/vendor/
 
 .claude/

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/Cargo.lock

@@ -369,7 +369,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corgea"
-version = "1.9.2"
+version = "1.10.0"
 dependencies = [
  "chrono",
  "clap",

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "corgea"
-version = "1.9.2"
+version = "1.10.0"
 edition = "2021"
 readme = "README.md"
 

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: corgea-cli
-Version: 1.9.2
+Version: 1.10.0
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/README.md

@@ -20,6 +20,11 @@ pip install corgea-cli
 ### Manual Installation
 You can get the latest binaries for your OS from https://github.com/Corgea/cli/releases.
 
+On Linux, both a `-gnu` and a `-musl` binary are published for x86_64 and
+aarch64. The `-gnu` builds run on glibc 2.17 and newer; the `-musl` builds are
+fully static and have no libc requirement at all, which makes them the safer
+pick for minimal containers and CI runners.
+
 ### Setup
 Once the binary is installed, login with your token from the Corgea app.
 ```

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/RELEASING.md

@@ -69,8 +69,29 @@ Pushing an annotated `vX.Y.Z` tag to `main` fans out to three GitHub Actions wor
 ## What gets built
 
 - **PyPI wheels** (`release.yml`): Linux (x86_64, x86), Windows (x64, x86), macOS (x86_64, aarch64), plus an sdist. Asserts `manylinux2014` tags for broad Linux compatibility.
-- **Native binaries** (`release-binaries.yml`): `x86_64-unknown-linux-gnu`, `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-gnu`, `x86_64-apple-darwin`, `aarch64-apple-darwin`, `x86_64-pc-windows-msvc`.
-- **npm binary bundling** (`npm-publish.yml` → `scripts/npm/bundle-binaries.js`): downloads the GitHub Release zips and lays them out as `vendor/<target>/corgea/corgea`. At runtime `bin/corgea.js` selects the binary for the host OS/arch. npm ships 5 of the 6 targets (Linux x64 uses the musl build).
+- **Native binaries** (`release-binaries.yml`): `x86_64-unknown-linux-gnu`, `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-gnu`, `aarch64-unknown-linux-musl`, `x86_64-apple-darwin`, `aarch64-apple-darwin`, `x86_64-pc-windows-msvc`.
+- **npm binary bundling** (`npm-publish.yml` → `scripts/npm/bundle-binaries.js`): downloads the GitHub Release zips and lays them out as `vendor/<target>/corgea/corgea`. At runtime `bin/corgea.js` selects the binary for the host OS/arch. npm ships 5 of the 7 targets (both Linux arches use the musl build).
+
+### Linux glibc floor
+
+Building a `*-gnu` target natively stamps the *runner's* glibc into the binary's
+ELF version-need table, and the loader then refuses to start it on any host with
+an older glibc. Every release from `v1.7.2` through `v1.9.2` shipped Linux gnu
+binaries that required `GLIBC_2.39`, so they failed on Ubuntu 22.04 (glibc 2.35)
+and older with `version 'GLIBC_2.38' not found`.
+
+All four Linux targets are therefore cross-built on `ubuntu-latest` with
+[`cargo-zigbuild`](https://github.com/rust-cross/cargo-zigbuild), pinning the gnu
+targets to the `GLIBC_FLOOR` declared in `release-binaries.yml` (currently
+`2.17`, i.e. RHEL 7 / Ubuntu 14.04 and newer). `scripts/check-linux-binary.sh`
+then re-reads each artifact and fails the build if a gnu binary exceeds the
+floor, or if a musl binary is not fully static. Run it locally with:
+
+```bash
+scripts/check-linux-binary.sh target/aarch64-unknown-linux-gnu/release/corgea aarch64-unknown-linux-gnu
+```
+
+Raising `GLIBC_FLOOR` drops support for older distros — change it deliberately.
 
 ## Release notes
 

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/bin/corgea.js

@@ -10,7 +10,7 @@ function resolveTargetTriple() {
     case "linux":
     case "android":
       if (process.arch === "x64") return "x86_64-unknown-linux-musl";
-      if (process.arch === "arm64") return "aarch64-unknown-linux-gnu";
+      if (process.arch === "arm64") return "aarch64-unknown-linux-musl";
       return null;
     case "darwin":
       if (process.arch === "x64") return "x86_64-apple-darwin";

corgea_cli-1.10.0/build_release.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+BUILD_OS="$(uname)"
+
+# Keep in sync with GLIBC_FLOOR in .github/workflows/release-binaries.yml. Linux
+# binaries are cross-linked against this floor so they do not pick up whatever
+# glibc the build host happens to ship.
+GLIBC_FLOOR="${GLIBC_FLOOR:-2.17}"
+
+if [ $BUILD_OS == "Darwin" ]; then
+  TARGETS=("aarch64-apple-darwin" "x86_64-apple-darwin")
+elif [ $BUILD_OS == "Linux" ]; then
+  TARGETS=("aarch64-unknown-linux-gnu" "aarch64-unknown-linux-musl" "x86_64-unknown-linux-gnu" "x86_64-unknown-linux-musl")
+
+  if ! command -v cargo-zigbuild >/dev/null 2>&1; then
+    echo "cargo-zigbuild is required to build the Linux targets."
+    echo "Install it with: cargo install cargo-zigbuild && pip install ziglang"
+    exit 1
+  fi
+else
+  echo "Are you building from a supported OS? (Darwin/Linux)"
+  exit 1
+fi
+
+for target in "${TARGETS[@]}"
+do
+    if [ $BUILD_OS == "Darwin" ]; then
+      cargo build -r --target $target || exit 1
+    else
+      build_target="$target"
+      if [[ "$target" == *-gnu ]]; then
+        build_target="${target}.${GLIBC_FLOOR}"
+      fi
+
+      cargo zigbuild -r --target "$build_target" || exit 1
+      GLIBC_FLOOR="$GLIBC_FLOOR" \
+        ./scripts/check-linux-binary.sh "target/$target/release/corgea" "$target" || exit 1
+    fi
+
+    zip_file_name="corgea-$target.zip"
+
+    # if zip_file_name exists, remove it
+    if [ -f $zip_file_name ]; then
+        rm $zip_file_name
+    fi
+
+    zip -j $zip_file_name "target/$target/release/corgea"
+done

corgea_cli-1.10.0/scripts/check-linux-binary.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+#
+# Gate on the runtime requirements of a released Linux binary.
+#
+# Linking against the build runner's glibc stamps that version into the ELF
+# version-need table, and the loader refuses the binary on any host with an
+# older glibc. Runner images move forward on their own schedule, so without
+# this check the supported floor silently follows them.
+#
+#   scripts/check-linux-binary.sh <binary> <target-triple>
+#
+# GLIBC_FLOOR (default 2.17) is the highest glibc version a *-gnu binary may
+# require. *-musl binaries must be fully static instead.
+
+set -euo pipefail
+
+binary=${1:-}
+triple=${2:-}
+floor=${GLIBC_FLOOR:-2.17}
+
+if [ -z "$binary" ] || [ -z "$triple" ]; then
+  echo "usage: $0 <binary> <target-triple>" >&2
+  exit 2
+fi
+
+if [ ! -f "$binary" ]; then
+  echo "FAIL: $binary does not exist" >&2
+  exit 1
+fi
+
+case "$triple" in
+  aarch64-*) want_machine="AArch64" ;;
+  x86_64-*) want_machine="X86-64" ;;
+  *)
+    echo "FAIL: unsupported target triple: $triple" >&2
+    exit 1
+    ;;
+esac
+
+machine=$(readelf -h "$binary" | sed -n 's/^ *Machine: *//p')
+case "$machine" in
+  *"$want_machine"*) ;;
+  *)
+    echo "FAIL: $binary is '$machine', expected $want_machine for $triple" >&2
+    exit 1
+    ;;
+esac
+
+case "$triple" in
+  *-musl)
+    if readelf -lW "$binary" | grep -q INTERP; then
+      echo "FAIL: $binary is dynamically linked; musl builds must be static" >&2
+      exit 1
+    fi
+    echo "OK: $binary ($triple) is statically linked"
+    ;;
+
+  *-gnu)
+    # A binary with no versioned glibc references is fine, but grep exits 1 on
+    # no match, so run it outside the pipeline that feeds the assignment.
+    # Requiring a digit keeps unversioned tags such as GLIBC_PRIVATE out.
+    version_info=$(readelf -V "$binary")
+    needed=$(grep -oE 'GLIBC_[0-9]+(\.[0-9]+)*' <<<"$version_info" | sed 's/^GLIBC_//' | sort -uV || true)
+
+    if [ -z "$needed" ]; then
+      echo "OK: $binary ($triple) requires no versioned glibc symbols"
+      exit 0
+    fi
+
+    highest=$(echo "$needed" | tail -1)
+    if [ "$(printf '%s\n%s\n' "$highest" "$floor" | sort -V | tail -1)" != "$floor" ]; then
+      echo "FAIL: $binary requires glibc $highest, above the $floor floor" >&2
+      echo "      versions required: $(echo "$needed" | tr '\n' ' ')" >&2
+      exit 1
+    fi
+
+    echo "OK: $binary ($triple) requires at most glibc $highest (floor $floor)"
+    ;;
+
+  *)
+    echo "FAIL: unsupported libc in target triple: $triple" >&2
+    exit 1
+    ;;
+esac

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/scripts/npm/bundle-binaries.js

@@ -7,7 +7,7 @@ const { unzipSync } = require("fflate");
 
 const TARGETS = [
   { triple: "x86_64-unknown-linux-musl", binary: "corgea" },
-  { triple: "aarch64-unknown-linux-gnu", binary: "corgea" },
+  { triple: "aarch64-unknown-linux-musl", binary: "corgea" },
   { triple: "x86_64-apple-darwin", binary: "corgea" },
   { triple: "aarch64-apple-darwin", binary: "corgea" },
   { triple: "x86_64-pc-windows-msvc", binary: "corgea.exe" },

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/skills/corgea/SKILL.md

@@ -33,14 +33,26 @@ corgea scan --scan-type secrets                # Single scan type
 corgea scan --scan-type blast,policy,secrets,pii  # Multiple scan types
 corgea scan --scan-type policy --policy 1      # Specific policy ID
 corgea scan --fail-on CR                       # Exit 1 on critical issues (CR, HI, ME, LO)
-corgea scan --fail                             # Exit 1 based on project blocking rules
+corgea scan --fail-on malicious                # Exit 1 if any dependency is classified malicious
+corgea scan --fail-on HI,malicious             # Comma-separated conditions combine
+corgea scan --block-on criticals               # Exit 1 if the scan violates the named CI blocking rules
+corgea scan --block-on criticals,malicious-deps  # Comma-separated rule slugs
+corgea scan --fail                             # Deprecated: exit 1 based on every active blocking rule
 corgea scan --out-format json --out-file r.json   # Export (json, html, sarif, markdown)
+corgea scan --sbom                             # Also write a CycloneDX SBOM to bom.json
+corgea scan --sbom sbom.cdx.json               # SBOM to a custom file
 corgea scan --project-name my-service          # Override project name
 ```
 
 Scan types: `blast` (base AI), `policy` (PolicyIQ), `malicious`, `secrets`, `pii`.
 
-`--only-uncommitted` and `--target` are mutually exclusive. `--fail-on` and `--fail` are mutually exclusive.
+`--fail-on` takes comma-separated conditions: severity thresholds `CR`, `HI`, `ME`, `LO` (trip at or above the level) and/or `malicious` (trips when any dependency in the scan is classified malicious). Use `malicious` to block supply-chain findings in CI across every ecosystem the scan covers, including those the `corgea npm`/`corgea pip` install gate does not.
+
+`--block-on` takes comma-separated blocking-rule slugs. Blocking rules are configured in the web app and each one applies either to pull requests or to CI. Only CI rules can be named by `--block-on`; a slug that is unknown, inactive, or scoped to pull requests is a hard error (exit 1) rather than a silently skipped gate. The slug is shown next to each rule in the web app and is derived from the rule name, so renaming a rule changes its slug. Name rules for the condition that trips them — `criticals`, not `no-criticals` — so that `--block-on` reads as a direct assertion rather than a double negative.
+
+`--fail` is deprecated. It evaluates every active blocking rule regardless of what it applies to; use `--block-on` to name the CI rules a pipeline should enforce.
+
+`--only-uncommitted` and `--target` are mutually exclusive. `--fail-on`, `--fail`, and `--block-on` are mutually exclusive.
 
 ### Upload — `corgea upload [report]`
 
@@ -51,10 +63,13 @@ corgea upload path/to/report.json              # JSON, SARIF, Coverity XML
 corgea upload path/to/report.fpr               # Fortify FPR
 corgea upload report.sarif --project-name svc  # Custom project name
 cat report.json | corgea upload                # From stdin
+corgea upload report.json --wait               # Wait for scan to complete and print results
 ```
 
 Supported: Semgrep JSON, SARIF, Checkmarx (CLI/Web/XML), Coverity, Fortify FPR.
 
+By default `upload` prints the scan page URL so you can track the results. Pass `--wait` to block until the scan completes and print the results (like `corgea scan`).
+
 ### Wait — `corgea wait [scan_id]`
 
 ```bash
@@ -68,6 +83,7 @@ corgea wait --scan-id SCAN_ID                  # Wait for specific scan
 corgea ls                                      # List scans
 corgea ls --issues --scan-id SCAN_ID           # Issues for a scan
 corgea ls --sca-issues                         # SCA (dependency) issues
+corgea ls --code-quality                       # Code quality issues
 corgea ls --issues --page 2 --page-size 10     # Pagination
 corgea ls --issues --scan-id SCAN_ID --json    # JSON output
 ```
@@ -76,6 +92,7 @@ corgea ls --issues --scan-id SCAN_ID --json    # JSON output
 |------|-------|-------------|
 | `--issues` | `-i` | List code/SAST issues |
 | `--sca-issues` | `-c` | List SCA issues |
+| `--code-quality` | `-q` | List code quality issues (alias `--quality`) |
 | `--scan-id` | `-s` | Filter to a scan |
 | `--page` | `-p` | Page number |
 | `--page-size` | | Items per page |
@@ -129,6 +146,22 @@ Agent environments default to compact TSV; force output with `--format human|age
   Examples: `corgea deps policy init`; `corgea deps policy init --exist-ok --format quiet`
 
 Notes: `deps scan --out-format table|json|sarif` is the report/export selector; do not combine it with `deps scan --format`.
+
+### Dependency finding catalog
+
+| ID | Status | Severity | Title | Description | Remediation |
+| --- | --- | --- | --- | --- | --- |
+| `DEP001` | emitted | High | Missing lockfile | The dependency manifest has no expected lockfile, so resolution is not reproducible. | Generate and commit the ecosystem lockfile. |
+| `DEP002` | emitted | High | Stale lockfile | A manifest dependency is missing from its lockfile. | Regenerate and commit the lockfile. |
+| `DEP003` | emitted | Medium | Direct dependency uses broad range | A direct dependency uses a bounded version range. | Pin an exact version or explicitly allow the range by policy. |
+| `DEP004` | emitted | High | Wildcard or latest dependency | A direct dependency uses wildcard, latest, or another unbounded range. | Pin an exact version. |
+| `DEP005` | emitted | High | Mutable Git branch dependency | A direct dependency is sourced from a mutable Git branch reference. | Pin a commit SHA or immutable release tag. |
+| `DEP006` | emitted | High | URL/tarball dependency without checksum | A direct URL or tarball dependency has no integrity checksum. | Add an integrity checksum or pin a registry package. |
+| `DEP008` | emitted | Medium | Lockfile integrity hash missing | A lockfile entry lacks its integrity hash. | Add the integrity hash to the lockfile entry. |
+| `DEP010` | reserved | Medium | Vulnerable package advisory | Reserved for vulnerable-package/advisory findings; `corgea deps` does not emit it. | Handle this code in an advisory or install-wrapper flow, never in `corgea deps`. |
+| `DEP014` | emitted | Low | Duplicate versions of same package | More than one resolved version of a package is present. | Align or deduplicate the resolved dependency versions. |
+| `DEP019` | emitted | Medium | Unsupported lockfile | A detected lockfile format is not supported by the parser. | Use a supported lockfile or wait for parser support. |
+| `DEP021` | emitted | High | Mutable artifact version | A direct artifact version is mutable, such as a Maven SNAPSHOT. | Pin an immutable release version. |
 <!-- END GENERATED CORGEA DEPS SKILL -->
 
 ### Advisories — `corgea advisories check`
@@ -330,6 +363,8 @@ corgea inspect --issue --diff ISSUE_ID
 
 ```bash
 corgea scan --fail-on CR --out-format sarif --out-file results.sarif
+corgea scan --fail-on CR,malicious --out-format sarif --out-file results.sarif  # also block malicious dependencies
+corgea scan --block-on criticals --out-format sarif --out-file results.sarif  # gate on a CI blocking rule from the web app
 ```
 
 ### Upload third-party reports
@@ -343,6 +378,7 @@ corgea upload report.json --project-name my-app
 ```bash
 corgea scan --out-format html --out-file report.html
 corgea scan --out-format sarif --out-file report.sarif
+corgea scan --out-format sarif --out-file report.sarif --sbom bom.json  # SARIF + CycloneDX SBOM
 ```
 
 ## Severity Levels

{corgea_cli-1.9.2 → corgea_cli-1.10.0}/src/config.rs

@@ -4,6 +4,14 @@ use std::{env, fs, io};
 
 pub const DEFAULT_VULN_API_URL: &str = "https://cve-worker-staging.corgea.workers.dev";
 
+/// Whether `DEFAULT_VULN_API_URL` is an endpoint Corgea tokens belong to.
+/// The `-staging` hostname is historical: this worker serves as the production
+/// vuln-api, so a token may be sent to it and authenticated (fail-closed)
+/// verdicts apply by default. Set to `false` if the default is ever repointed
+/// at an endpoint that customer tokens should not reach — token-send and
+/// fail-closed then both require the explicit opt-in.
+pub const DEFAULT_VULN_API_URL_IS_PRODUCTION: bool = true;
+
 #[derive(Serialize, Deserialize, Clone)]
 pub struct Config {
     pub(crate) url: String,

corgea_cli-1.10.0/src/deps/catalog.rs

@@ -0,0 +1,201 @@
+use crate::deps::model::Severity;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum FindingStatus {
+    Emitted,
+    Reserved,
+    Deprecated,
+}
+
+impl FindingStatus {
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::Emitted => "emitted",
+            Self::Reserved => "reserved",
+            Self::Deprecated => "deprecated",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FindingDefinition {
+    pub id: &'static str,
+    pub title: &'static str,
+    pub severity: Severity,
+    pub description: &'static str,
+    pub remediation: &'static str,
+    pub status: FindingStatus,
+}
+
+pub const FINDING_DEFINITIONS: &[FindingDefinition] = &[
+    FindingDefinition {
+        id: "DEP001",
+        title: "Missing lockfile",
+        severity: Severity::High,
+        description:
+            "The dependency manifest has no expected lockfile, so resolution is not reproducible.",
+        remediation: "Generate and commit the ecosystem lockfile.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP002",
+        title: "Stale lockfile",
+        severity: Severity::High,
+        description: "A manifest dependency is missing from its lockfile.",
+        remediation: "Regenerate and commit the lockfile.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP003",
+        title: "Direct dependency uses broad range",
+        severity: Severity::Medium,
+        description: "A direct dependency uses a bounded version range.",
+        remediation: "Pin an exact version or explicitly allow the range by policy.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP004",
+        title: "Wildcard or latest dependency",
+        severity: Severity::High,
+        description: "A direct dependency uses wildcard, latest, or another unbounded range.",
+        remediation: "Pin an exact version.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP005",
+        title: "Mutable Git branch dependency",
+        severity: Severity::High,
+        description: "A direct dependency is sourced from a mutable Git branch reference.",
+        remediation: "Pin a commit SHA or immutable release tag.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP006",
+        title: "URL/tarball dependency without checksum",
+        severity: Severity::High,
+        description: "A direct URL or tarball dependency has no integrity checksum.",
+        remediation: "Add an integrity checksum or pin a registry package.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP008",
+        title: "Lockfile integrity hash missing",
+        severity: Severity::Medium,
+        description: "A lockfile entry lacks its integrity hash.",
+        remediation: "Add the integrity hash to the lockfile entry.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP010",
+        title: "Vulnerable package advisory",
+        severity: Severity::Medium,
+        description:
+            "Reserved for vulnerable-package/advisory findings; `corgea deps` does not emit it.",
+        remediation:
+            "Handle this code in an advisory or install-wrapper flow, never in `corgea deps`.",
+        status: FindingStatus::Reserved,
+    },
+    FindingDefinition {
+        id: "DEP014",
+        title: "Duplicate versions of same package",
+        severity: Severity::Low,
+        description: "More than one resolved version of a package is present.",
+        remediation: "Align or deduplicate the resolved dependency versions.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP019",
+        title: "Unsupported lockfile",
+        severity: Severity::Medium,
+        description: "A detected lockfile format is not supported by the parser.",
+        remediation: "Use a supported lockfile or wait for parser support.",
+        status: FindingStatus::Emitted,
+    },
+    FindingDefinition {
+        id: "DEP021",
+        title: "Mutable artifact version",
+        severity: Severity::High,
+        description: "A direct artifact version is mutable, such as a Maven SNAPSHOT.",
+        remediation: "Pin an immutable release version.",
+        status: FindingStatus::Emitted,
+    },
+];
+
+pub fn definition(id: &str) -> Option<&'static FindingDefinition> {
+    FINDING_DEFINITIONS
+        .iter()
+        .find(|definition| definition.id == id)
+}
+
+pub fn emitted_definition(id: &str) -> Option<&'static FindingDefinition> {
+    definition(id).filter(|definition| definition.status == FindingStatus::Emitted)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{definition, emitted_definition, FindingStatus, FINDING_DEFINITIONS};
+
+    const EXPECTED_IDS: &[&str] = &[
+        "DEP001", "DEP002", "DEP003", "DEP004", "DEP005", "DEP006", "DEP008", "DEP010", "DEP014",
+        "DEP019", "DEP021",
+    ];
+    const EXPECTED_EMITTED_IDS: &[&str] = &[
+        "DEP001", "DEP002", "DEP003", "DEP004", "DEP005", "DEP006", "DEP008", "DEP014", "DEP019",
+        "DEP021",
+    ];
+
+    #[test]
+    fn definitions_have_exact_ordered_unique_ids() {
+        let ids: Vec<_> = FINDING_DEFINITIONS
+            .iter()
+            .map(|definition| definition.id)
+            .collect();
+        assert_eq!(ids, EXPECTED_IDS);
+        assert!(ids.windows(2).all(|pair| pair[0] < pair[1]));
+    }
+
+    #[test]
+    fn definitions_have_nonempty_canonical_metadata() {
+        for definition in FINDING_DEFINITIONS {
+            assert!(!definition.id.is_empty());
+            assert!(!definition.title.is_empty());
+            assert!(!definition.description.is_empty());
+            assert!(!definition.remediation.is_empty());
+        }
+    }
+
+    #[test]
+    fn general_lookup_round_trips_registered_definitions() {
+        for expected in FINDING_DEFINITIONS {
+            assert_eq!(definition(expected.id), Some(expected));
+        }
+        assert!(definition("DEP999").is_none());
+    }
+
+    #[test]
+    fn definitions_have_exact_emitted_ids() {
+        let emitted_ids: Vec<_> = FINDING_DEFINITIONS
+            .iter()
+            .filter(|definition| definition.status == FindingStatus::Emitted)
+            .map(|definition| definition.id)
+            .collect();
+        assert_eq!(emitted_ids, EXPECTED_EMITTED_IDS);
+    }
+
+    #[test]
+    fn emitted_lookup_excludes_reserved_dep010() {
+        assert_eq!(
+            definition("DEP010").unwrap().status,
+            FindingStatus::Reserved
+        );
+        assert!(emitted_definition("DEP010").is_none());
+        assert!(emitted_definition("DEP999").is_none());
+    }
+
+    #[test]
+    fn statuses_have_lowercase_strings() {
+        assert_eq!(FindingStatus::Emitted.as_str(), "emitted");
+        assert_eq!(FindingStatus::Reserved.as_str(), "reserved");
+        assert_eq!(FindingStatus::Deprecated.as_str(), "deprecated");
+    }
+}