corgea-cli 1.9.2__tar.gz → 1.9.3__tar.gz

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/.github/workflows/release-binaries.yml

@@ -12,6 +12,13 @@ on:
 permissions:
   contents: write
 
+env:
+  # Highest glibc a *-gnu binary may require. Linux builds are cross-linked
+  # against this floor so the artifacts do not inherit the runner's glibc.
+  GLIBC_FLOOR: "2.17"
+  ZIG_VERSION: "0.13.0"
+  CARGO_ZIGBUILD_VERSION: "0.23.0"
+
 jobs:
   native-binaries:
     name: Build and Upload Native Binaries
@@ -24,9 +31,12 @@ jobs:
           - os: ubuntu-latest
             target: x86_64-unknown-linux-musl
             binary_name: corgea
-          - os: ubuntu-24.04-arm
+          - os: ubuntu-latest
             target: aarch64-unknown-linux-gnu
             binary_name: corgea
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-musl
+            binary_name: corgea
           - os: macos-latest
             target: x86_64-apple-darwin
             binary_name: corgea
@@ -44,16 +54,68 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.ref }}
 
-      - name: Install musl tools
-        if: matrix.target == 'x86_64-unknown-linux-musl'
-        run: sudo apt-get install -y musl-tools
-
       - name: Install Rust Target
         run: rustup target add ${{ matrix.target }}
 
-      - name: Build Binary
+      - name: Install Zig
+        if: runner.os == 'Linux'
+        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
+        with:
+          version: ${{ env.ZIG_VERSION }}
+
+      - name: Install cargo-zigbuild
+        if: runner.os == 'Linux'
+        uses: taiki-e/install-action@18b1216eba7f8039b0f8d131d5473787f0edce68 # v2.85.3
+        with:
+          tool: cargo-zigbuild@${{ env.CARGO_ZIGBUILD_VERSION }}
+
+      - name: Build Binary (Linux)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          build_target="${{ matrix.target }}"
+          if [[ "$build_target" == *-gnu ]]; then
+            build_target="${build_target}.${GLIBC_FLOOR}"
+          fi
+          cargo zigbuild --release --target "$build_target"
+
+      - name: Build Binary (macOS and Windows)
+        if: runner.os != 'Linux'
         run: cargo build --release --target ${{ matrix.target }}
 
+      - name: Verify Linux Runtime Compatibility
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          scripts/check-linux-binary.sh \
+            "target/${{ matrix.target }}/release/${{ matrix.binary_name }}" \
+            "${{ matrix.target }}"
+
+      # The aarch64 artifacts are cross-built, so nothing else in CI would ever
+      # execute them. Run them under qemu to catch a binary that passes the
+      # header checks but cannot actually start.
+      - name: Smoke Test Linux Binary
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          binary="target/${{ matrix.target }}/release/${{ matrix.binary_name }}"
+
+          case "${{ matrix.target }}" in
+            aarch64-*-gnu)
+              sudo apt-get update -qq
+              sudo apt-get install -y -qq qemu-user-static libc6-arm64-cross
+              qemu-aarch64-static -L /usr/aarch64-linux-gnu "$binary" --version
+              ;;
+            aarch64-*-musl)
+              sudo apt-get update -qq
+              sudo apt-get install -y -qq qemu-user-static
+              qemu-aarch64-static "$binary" --version
+              ;;
+            *)
+              "$binary" --version
+              ;;
+          esac
+
       - name: Archive Binary (Unix)
         if: runner.os != 'Windows'
         shell: bash

corgea_cli-1.9.3/.github/workflows/sync-skills.yml

@@ -0,0 +1,166 @@
+name: Trigger AI Skills Sync on Release
+
+# Syncs on a published release rather than on merge to main: skills describe the
+# CLI users have installed, and diffing main would document unreleased commands.
+#
+# Triggered by the Native Binary Release workflow rather than release.published.
+# On the tag-first path in RELEASING.md the release is created by
+# action-gh-release using GITHUB_TOKEN, and GitHub does not start workflow runs
+# for GITHUB_TOKEN events, so release.published would never fire. Native Binary
+# Release runs on the tag push either way. npm-publish.yml uses the same pattern.
+
+on:
+  workflow_run:
+    workflows: ["Native Binary Release"]
+    types:
+      - completed
+  workflow_dispatch:
+    inputs:
+      base_tag:
+        description: "Previous release tag (for example: v1.9.0). Leave empty to resolve it automatically."
+        required: false
+        type: string
+      head_tag:
+        description: "Release tag to sync from (for example: v1.9.1)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+# Serialize runs so two releases cannot open competing pull requests. The default
+# queue holds only one pending run, which would drop the middle of three releases
+# published in quick succession.
+concurrency:
+  group: sync-skills
+  cancel-in-progress: false
+  queue: max
+
+jobs:
+  run-codex-skills-sync:
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Resolve release range
+        id: range
+        env:
+          GH_TOKEN: ${{ github.token }}
+          # For a tag push, workflow_run reports the tag name as head_branch.
+          NEW_TAG: ${{ github.event.inputs.head_tag || github.event.workflow_run.head_branch }}
+          BASE_TAG_INPUT: ${{ github.event.inputs.base_tag }}
+          SKILLS_REPO_TOKEN: ${{ secrets.DOCS_REPO_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          # Corgea/skills is public, so a missing token clones fine and only
+          # fails on the final push, after a full Codex run. Fail fast instead.
+          if [[ -z "${SKILLS_REPO_TOKEN:-}" ]]; then
+            echo "::error::DOCS_REPO_TOKEN is unset. It needs write access to Corgea/skills."
+            exit 1
+          fi
+
+          # Native Binary Release also runs on branch pushes, where head_branch
+          # is a branch name with no release. Ask the API instead of matching on
+          # the ref: tag names are inconsistent here (v1.9.1 but 1.8.8).
+          if ! RELEASE_JSON=$(gh release view "$NEW_TAG" --repo "$GITHUB_REPOSITORY" \
+                 --json publishedAt,isDraft,isPrerelease,body 2>/dev/null); then
+            RELEASE_JSON=""
+
+            if [[ "$GITHUB_EVENT_NAME" != "workflow_dispatch" ]]; then
+              echo "$NEW_TAG is not a published release (branch push?); nothing to sync."
+              echo "skip=true" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+
+            # A plain tag with no release still syncs if the caller names a base.
+            if [[ -z "$BASE_TAG_INPUT" ]]; then
+              echo "::error::No published GitHub Release found for tag $NEW_TAG, so the previous release cannot be resolved automatically. Re-run with base_tag set explicitly."
+              exit 1
+            fi
+            echo "No GitHub Release for $NEW_TAG; continuing with the base_tag given."
+          fi
+
+          # workflow_run carries no release payload, so filter drafts here.
+          # Manual dispatch names its tag deliberately and stays an override.
+          if [[ -n "$RELEASE_JSON" && "$GITHUB_EVENT_NAME" != "workflow_dispatch" ]] \
+             && [[ "$(jq -r '.isDraft' <<<"$RELEASE_JSON")" == "true" || \
+                   "$(jq -r '.isPrerelease' <<<"$RELEASE_JSON")" == "true" ]]; then
+            echo "$NEW_TAG is a draft or prerelease; nothing to sync."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ -n "$BASE_TAG_INPUT" ]]; then
+            PREV_TAG="$BASE_TAG_INPUT"
+          else
+            # Drafts report publishedAt as null, which sorts before every real
+            # timestamp and would select the newest release as the base.
+            NEW_PUBLISHED=$(jq -r '.publishedAt // ""' <<<"$RELEASE_JSON")
+            if [[ -z "$NEW_PUBLISHED" || "$NEW_PUBLISHED" == "null" ]]; then
+              echo "::error::Release $NEW_TAG has no publishedAt timestamp (draft?). Re-run with base_tag set explicitly."
+              exit 1
+            fi
+            export NEW_PUBLISHED
+
+            # Newest release published before this one. Comparing timestamps
+            # rather than just excluding NEW_TAG matters on manual dispatch: an
+            # older tag would otherwise pick a newer base and feed Codex a
+            # reversed diff, which reads as commands being removed.
+            # ISO-8601 UTC sorts lexicographically.
+            PREV_TAG=$(gh release list --repo "$GITHUB_REPOSITORY" --limit 100 \
+              --json tagName,isDraft,isPrerelease,publishedAt \
+              --jq '[.[] | select(.isDraft == false and .isPrerelease == false and .publishedAt < env.NEW_PUBLISHED)]
+                    | sort_by(.publishedAt) | reverse | .[0].tagName // ""')
+          fi
+
+          if [[ -z "$PREV_TAG" ]]; then
+            echo "No previous release to diff against; nothing to sync."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Resolve through the API so annotated tags land on their commit.
+          BASE_SHA=$(gh api "repos/$GITHUB_REPOSITORY/commits/$PREV_TAG" --jq .sha)
+          HEAD_SHA=$(gh api "repos/$GITHUB_REPOSITORY/commits/$NEW_TAG" --jq .sha)
+
+          echo "Syncing skills for $PREV_TAG ($BASE_SHA) -> $NEW_TAG ($HEAD_SHA)"
+          {
+            echo "skip=false"
+            echo "prev_tag=$PREV_TAG"
+            echo "new_tag=$NEW_TAG"
+            echo "base_sha=$BASE_SHA"
+            echo "head_sha=$HEAD_SHA"
+          } >> "$GITHUB_OUTPUT"
+
+          # Release notes are multi-line and author-supplied, so end the output
+          # with a delimiter the body will not contain.
+          if [[ -n "$RELEASE_JSON" ]]; then
+            NOTES_DELIM="NOTES_EOF_$(date +%s)$RANDOM"
+            {
+              echo "notes<<${NOTES_DELIM}"
+              jq -r '.body // ""' <<<"$RELEASE_JSON"
+              echo "${NOTES_DELIM}"
+            } >> "$GITHUB_OUTPUT"
+          fi
+
+      # No checkout on purpose: the action checks the CLI out into ./source. A
+      # checkout at the workspace root would leave the CLI's own
+      # skills/corgea/SKILL.md under Codex's working directory as a tempting
+      # wrong edit target, whose changes would then be silently discarded.
+      - name: Run AI Skills Sync
+        if: steps.range.outputs.skip == 'false'
+        uses: Corgea/internal_actions/sync-skills-action@main
+        with:
+          base_sha: ${{ steps.range.outputs.base_sha }}
+          head_sha: ${{ steps.range.outputs.head_sha }}
+          openai_api_key: ${{ secrets.OPENAI_API_KEY }}
+          # Shared bot token; the name is historical. It has write access to
+          # Corgea/skills as well as Corgea/docs, so rotating it affects the
+          # docs sync workflows too.
+          skills_repo_token: ${{ secrets.DOCS_REPO_TOKEN }}
+          skills_repo: "Corgea/skills"
+          skills_base_branch: "main"
+          release_info: |
+            Corgea CLI release ${{ steps.range.outputs.new_tag }} (previous release: ${{ steps.range.outputs.prev_tag }}).
+            Release notes:
+            ${{ steps.range.outputs.notes }}

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/.gitignore

@@ -5,6 +5,7 @@
 *.zip
 *.profraw
 node_modules/
+/vendor/
 /packages/*/vendor/
 
 .claude/

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/Cargo.lock

@@ -369,7 +369,7 @@ checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "corgea"
-version = "1.9.2"
+version = "1.9.3"
 dependencies = [
  "chrono",
  "clap",

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "corgea"
-version = "1.9.2"
+version = "1.9.3"
 edition = "2021"
 readme = "README.md"
 

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: corgea-cli
-Version: 1.9.2
+Version: 1.9.3
 Classifier: Development Status :: 5 - Production/Stable
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/README.md

@@ -20,6 +20,11 @@ pip install corgea-cli
 ### Manual Installation
 You can get the latest binaries for your OS from https://github.com/Corgea/cli/releases.
 
+On Linux, both a `-gnu` and a `-musl` binary are published for x86_64 and
+aarch64. The `-gnu` builds run on glibc 2.17 and newer; the `-musl` builds are
+fully static and have no libc requirement at all, which makes them the safer
+pick for minimal containers and CI runners.
+
 ### Setup
 Once the binary is installed, login with your token from the Corgea app.
 ```

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/RELEASING.md

@@ -69,8 +69,29 @@ Pushing an annotated `vX.Y.Z` tag to `main` fans out to three GitHub Actions wor
 ## What gets built
 
 - **PyPI wheels** (`release.yml`): Linux (x86_64, x86), Windows (x64, x86), macOS (x86_64, aarch64), plus an sdist. Asserts `manylinux2014` tags for broad Linux compatibility.
-- **Native binaries** (`release-binaries.yml`): `x86_64-unknown-linux-gnu`, `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-gnu`, `x86_64-apple-darwin`, `aarch64-apple-darwin`, `x86_64-pc-windows-msvc`.
-- **npm binary bundling** (`npm-publish.yml` → `scripts/npm/bundle-binaries.js`): downloads the GitHub Release zips and lays them out as `vendor/<target>/corgea/corgea`. At runtime `bin/corgea.js` selects the binary for the host OS/arch. npm ships 5 of the 6 targets (Linux x64 uses the musl build).
+- **Native binaries** (`release-binaries.yml`): `x86_64-unknown-linux-gnu`, `x86_64-unknown-linux-musl`, `aarch64-unknown-linux-gnu`, `aarch64-unknown-linux-musl`, `x86_64-apple-darwin`, `aarch64-apple-darwin`, `x86_64-pc-windows-msvc`.
+- **npm binary bundling** (`npm-publish.yml` → `scripts/npm/bundle-binaries.js`): downloads the GitHub Release zips and lays them out as `vendor/<target>/corgea/corgea`. At runtime `bin/corgea.js` selects the binary for the host OS/arch. npm ships 5 of the 7 targets (both Linux arches use the musl build).
+
+### Linux glibc floor
+
+Building a `*-gnu` target natively stamps the *runner's* glibc into the binary's
+ELF version-need table, and the loader then refuses to start it on any host with
+an older glibc. Every release from `v1.7.2` through `v1.9.2` shipped Linux gnu
+binaries that required `GLIBC_2.39`, so they failed on Ubuntu 22.04 (glibc 2.35)
+and older with `version 'GLIBC_2.38' not found`.
+
+All four Linux targets are therefore cross-built on `ubuntu-latest` with
+[`cargo-zigbuild`](https://github.com/rust-cross/cargo-zigbuild), pinning the gnu
+targets to the `GLIBC_FLOOR` declared in `release-binaries.yml` (currently
+`2.17`, i.e. RHEL 7 / Ubuntu 14.04 and newer). `scripts/check-linux-binary.sh`
+then re-reads each artifact and fails the build if a gnu binary exceeds the
+floor, or if a musl binary is not fully static. Run it locally with:
+
+```bash
+scripts/check-linux-binary.sh target/aarch64-unknown-linux-gnu/release/corgea aarch64-unknown-linux-gnu
+```
+
+Raising `GLIBC_FLOOR` drops support for older distros — change it deliberately.
 
 ## Release notes
 

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/bin/corgea.js

@@ -10,7 +10,7 @@ function resolveTargetTriple() {
     case "linux":
     case "android":
       if (process.arch === "x64") return "x86_64-unknown-linux-musl";
-      if (process.arch === "arm64") return "aarch64-unknown-linux-gnu";
+      if (process.arch === "arm64") return "aarch64-unknown-linux-musl";
       return null;
     case "darwin":
       if (process.arch === "x64") return "x86_64-apple-darwin";

corgea_cli-1.9.3/build_release.sh

@@ -0,0 +1,48 @@
+#!/bin/bash
+
+BUILD_OS="$(uname)"
+
+# Keep in sync with GLIBC_FLOOR in .github/workflows/release-binaries.yml. Linux
+# binaries are cross-linked against this floor so they do not pick up whatever
+# glibc the build host happens to ship.
+GLIBC_FLOOR="${GLIBC_FLOOR:-2.17}"
+
+if [ $BUILD_OS == "Darwin" ]; then
+  TARGETS=("aarch64-apple-darwin" "x86_64-apple-darwin")
+elif [ $BUILD_OS == "Linux" ]; then
+  TARGETS=("aarch64-unknown-linux-gnu" "aarch64-unknown-linux-musl" "x86_64-unknown-linux-gnu" "x86_64-unknown-linux-musl")
+
+  if ! command -v cargo-zigbuild >/dev/null 2>&1; then
+    echo "cargo-zigbuild is required to build the Linux targets."
+    echo "Install it with: cargo install cargo-zigbuild && pip install ziglang"
+    exit 1
+  fi
+else
+  echo "Are you building from a supported OS? (Darwin/Linux)"
+  exit 1
+fi
+
+for target in "${TARGETS[@]}"
+do
+    if [ $BUILD_OS == "Darwin" ]; then
+      cargo build -r --target $target || exit 1
+    else
+      build_target="$target"
+      if [[ "$target" == *-gnu ]]; then
+        build_target="${target}.${GLIBC_FLOOR}"
+      fi
+
+      cargo zigbuild -r --target "$build_target" || exit 1
+      GLIBC_FLOOR="$GLIBC_FLOOR" \
+        ./scripts/check-linux-binary.sh "target/$target/release/corgea" "$target" || exit 1
+    fi
+
+    zip_file_name="corgea-$target.zip"
+
+    # if zip_file_name exists, remove it
+    if [ -f $zip_file_name ]; then
+        rm $zip_file_name
+    fi
+
+    zip -j $zip_file_name "target/$target/release/corgea"
+done

corgea_cli-1.9.3/scripts/check-linux-binary.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+#
+# Gate on the runtime requirements of a released Linux binary.
+#
+# Linking against the build runner's glibc stamps that version into the ELF
+# version-need table, and the loader refuses the binary on any host with an
+# older glibc. Runner images move forward on their own schedule, so without
+# this check the supported floor silently follows them.
+#
+#   scripts/check-linux-binary.sh <binary> <target-triple>
+#
+# GLIBC_FLOOR (default 2.17) is the highest glibc version a *-gnu binary may
+# require. *-musl binaries must be fully static instead.
+
+set -euo pipefail
+
+binary=${1:-}
+triple=${2:-}
+floor=${GLIBC_FLOOR:-2.17}
+
+if [ -z "$binary" ] || [ -z "$triple" ]; then
+  echo "usage: $0 <binary> <target-triple>" >&2
+  exit 2
+fi
+
+if [ ! -f "$binary" ]; then
+  echo "FAIL: $binary does not exist" >&2
+  exit 1
+fi
+
+case "$triple" in
+  aarch64-*) want_machine="AArch64" ;;
+  x86_64-*) want_machine="X86-64" ;;
+  *)
+    echo "FAIL: unsupported target triple: $triple" >&2
+    exit 1
+    ;;
+esac
+
+machine=$(readelf -h "$binary" | sed -n 's/^ *Machine: *//p')
+case "$machine" in
+  *"$want_machine"*) ;;
+  *)
+    echo "FAIL: $binary is '$machine', expected $want_machine for $triple" >&2
+    exit 1
+    ;;
+esac
+
+case "$triple" in
+  *-musl)
+    if readelf -lW "$binary" | grep -q INTERP; then
+      echo "FAIL: $binary is dynamically linked; musl builds must be static" >&2
+      exit 1
+    fi
+    echo "OK: $binary ($triple) is statically linked"
+    ;;
+
+  *-gnu)
+    # A binary with no versioned glibc references is fine, but grep exits 1 on
+    # no match, so run it outside the pipeline that feeds the assignment.
+    # Requiring a digit keeps unversioned tags such as GLIBC_PRIVATE out.
+    version_info=$(readelf -V "$binary")
+    needed=$(grep -oE 'GLIBC_[0-9]+(\.[0-9]+)*' <<<"$version_info" | sed 's/^GLIBC_//' | sort -uV || true)
+
+    if [ -z "$needed" ]; then
+      echo "OK: $binary ($triple) requires no versioned glibc symbols"
+      exit 0
+    fi
+
+    highest=$(echo "$needed" | tail -1)
+    if [ "$(printf '%s\n%s\n' "$highest" "$floor" | sort -V | tail -1)" != "$floor" ]; then
+      echo "FAIL: $binary requires glibc $highest, above the $floor floor" >&2
+      echo "      versions required: $(echo "$needed" | tr '\n' ' ')" >&2
+      exit 1
+    fi
+
+    echo "OK: $binary ($triple) requires at most glibc $highest (floor $floor)"
+    ;;
+
+  *)
+    echo "FAIL: unsupported libc in target triple: $triple" >&2
+    exit 1
+    ;;
+esac

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/scripts/npm/bundle-binaries.js

@@ -7,7 +7,7 @@ const { unzipSync } = require("fflate");
 
 const TARGETS = [
   { triple: "x86_64-unknown-linux-musl", binary: "corgea" },
-  { triple: "aarch64-unknown-linux-gnu", binary: "corgea" },
+  { triple: "aarch64-unknown-linux-musl", binary: "corgea" },
   { triple: "x86_64-apple-darwin", binary: "corgea" },
   { triple: "aarch64-apple-darwin", binary: "corgea" },
   { triple: "x86_64-pc-windows-msvc", binary: "corgea.exe" },

{corgea_cli-1.9.2 → corgea_cli-1.9.3}/skills/corgea/SKILL.md

@@ -33,6 +33,8 @@ corgea scan --scan-type secrets                # Single scan type
 corgea scan --scan-type blast,policy,secrets,pii  # Multiple scan types
 corgea scan --scan-type policy --policy 1      # Specific policy ID
 corgea scan --fail-on CR                       # Exit 1 on critical issues (CR, HI, ME, LO)
+corgea scan --fail-on malicious                # Exit 1 if any dependency is classified malicious
+corgea scan --fail-on HI,malicious             # Comma-separated conditions combine
 corgea scan --fail                             # Exit 1 based on project blocking rules
 corgea scan --out-format json --out-file r.json   # Export (json, html, sarif, markdown)
 corgea scan --project-name my-service          # Override project name
@@ -40,6 +42,8 @@ corgea scan --project-name my-service          # Override project name
 
 Scan types: `blast` (base AI), `policy` (PolicyIQ), `malicious`, `secrets`, `pii`.
 
+`--fail-on` takes comma-separated conditions: severity thresholds `CR`, `HI`, `ME`, `LO` (trip at or above the level) and/or `malicious` (trips when any dependency in the scan is classified malicious). Use `malicious` to block supply-chain findings in CI across every ecosystem the scan covers, including those the `corgea npm`/`corgea pip` install gate does not.
+
 `--only-uncommitted` and `--target` are mutually exclusive. `--fail-on` and `--fail` are mutually exclusive.
 
 ### Upload — `corgea upload [report]`
@@ -51,10 +55,13 @@ corgea upload path/to/report.json              # JSON, SARIF, Coverity XML
 corgea upload path/to/report.fpr               # Fortify FPR
 corgea upload report.sarif --project-name svc  # Custom project name
 cat report.json | corgea upload                # From stdin
+corgea upload report.json --wait               # Wait for scan to complete and print results
 ```
 
 Supported: Semgrep JSON, SARIF, Checkmarx (CLI/Web/XML), Coverity, Fortify FPR.
 
+By default `upload` prints the scan page URL so you can track the results. Pass `--wait` to block until the scan completes and print the results (like `corgea scan`).
+
 ### Wait — `corgea wait [scan_id]`
 
 ```bash
@@ -129,6 +136,22 @@ Agent environments default to compact TSV; force output with `--format human|age
   Examples: `corgea deps policy init`; `corgea deps policy init --exist-ok --format quiet`
 
 Notes: `deps scan --out-format table|json|sarif` is the report/export selector; do not combine it with `deps scan --format`.
+
+### Dependency finding catalog
+
+| ID | Status | Severity | Title | Description | Remediation |
+| --- | --- | --- | --- | --- | --- |
+| `DEP001` | emitted | High | Missing lockfile | The dependency manifest has no expected lockfile, so resolution is not reproducible. | Generate and commit the ecosystem lockfile. |
+| `DEP002` | emitted | High | Stale lockfile | A manifest dependency is missing from its lockfile. | Regenerate and commit the lockfile. |
+| `DEP003` | emitted | Medium | Direct dependency uses broad range | A direct dependency uses a bounded version range. | Pin an exact version or explicitly allow the range by policy. |
+| `DEP004` | emitted | High | Wildcard or latest dependency | A direct dependency uses wildcard, latest, or another unbounded range. | Pin an exact version. |
+| `DEP005` | emitted | High | Mutable Git branch dependency | A direct dependency is sourced from a mutable Git branch reference. | Pin a commit SHA or immutable release tag. |
+| `DEP006` | emitted | High | URL/tarball dependency without checksum | A direct URL or tarball dependency has no integrity checksum. | Add an integrity checksum or pin a registry package. |
+| `DEP008` | emitted | Medium | Lockfile integrity hash missing | A lockfile entry lacks its integrity hash. | Add the integrity hash to the lockfile entry. |
+| `DEP010` | reserved | Medium | Vulnerable package advisory | Reserved for vulnerable-package/advisory findings; `corgea deps` does not emit it. | Handle this code in an advisory or install-wrapper flow, never in `corgea deps`. |
+| `DEP014` | emitted | Low | Duplicate versions of same package | More than one resolved version of a package is present. | Align or deduplicate the resolved dependency versions. |
+| `DEP019` | emitted | Medium | Unsupported lockfile | A detected lockfile format is not supported by the parser. | Use a supported lockfile or wait for parser support. |
+| `DEP021` | emitted | High | Mutable artifact version | A direct artifact version is mutable, such as a Maven SNAPSHOT. | Pin an immutable release version. |
 <!-- END GENERATED CORGEA DEPS SKILL -->
 
 ### Advisories — `corgea advisories check`
@@ -330,6 +353,7 @@ corgea inspect --issue --diff ISSUE_ID
 
 ```bash
 corgea scan --fail-on CR --out-format sarif --out-file results.sarif
+corgea scan --fail-on CR,malicious --out-format sarif --out-file results.sarif  # also block malicious dependencies
 ```
 
 ### Upload third-party reports