gitgalaxy 1.0.6__tar.gz → 1.0.7__tar.gz

{gitgalaxy-1.0.6 → gitgalaxy-1.0.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitgalaxy
-Version: 1.0.6
+Version: 1.0.7
 Summary: Visualizes codebase complexity as explorable 3D galaxies.
 Author: Joe Esquibel
 License: PolyForm Noncommercial License 1.0.0
@@ -20,14 +20,24 @@ Dynamic: license-file
 [![PyPI version](https://badge.fury.io/py/gitgalaxy.svg)](https://badge.fury.io/py/gitgalaxy)
 [![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
 [![License: PolyForm Noncommercial](https://img.shields.io/badge/License-PolyForm%20Noncommercial-blue.svg)](https://polyformproject.org/licenses/noncommercial/1.0.0/)
+
+[![Engine](https://img.shields.io/badge/Engine-blAST-8A2BE2.svg)](#)
+[![Velocity](https://img.shields.io/badge/Velocity-100k+_LOC%2Fs-00C957.svg)](#)
+[![Analysis](https://img.shields.io/badge/Analysis-Code_Bioinformatics-00BFFF.svg)](#)
+[![Threat Hunting](https://img.shields.io/badge/Threat_Hunting-Behavioral-FF4500.svg)](#)
+[![Architecture](https://img.shields.io/badge/Architecture-Zero__Trust-teal.svg)](#)
+
 [![Zero Dependencies](https://img.shields.io/badge/Dependencies-0-brightgreen.svg)](https://pypi.org/project/gitgalaxy/)
 [![Airgap Ready](https://img.shields.io/badge/Security-Airgap_Ready-teal.svg)](#)
-[![Local Processing](https://img.shields.io/badge/Telemetry-100%25_Local-blueviolet.svg)](#)
-[![Hardware Accelerated](https://img.shields.io/badge/Render-WebGPU_|_WebGL2-ff69b4.svg)](#)
+
 
 Code is art. Logic is art. Systems engineering is art.
 
-GitGalaxy reveals the complexity of codebases as explorable 3D galaxies by using source code as a seed for procedural generative art. It acts as a Rosetta Stone for code complexity, allowing you to visually compare the scale and risk exposure of different projects—from Apollo 11 to the Linux Kernel—under the same set of rules. GitGalaxy visualizes the non-visual architecture of massive software repositories, translating codebases into color based non-numeric dashboard, where files are rendered as stars (for humans), low-token markdown summaries of deep tech patterns the entire code base  (for AI agents), and full audit of both Software Bill of Materials and internal file metrics (for lawyers). Code never leaves your machine, zero dependencies. Analyses based on BLAST and bioinformatic algorithms ported to coding languages. Currently handles ~40 languages and ~250 file extensions. Average scan rates at ~100,000 LOC/second, allowing for CI/CD pipeline integration. CLI based for AI-agent workflow, visualization system optional. 
+GitGalaxy is a two-part ecosystem connected by a universal JSON contract. It is designed to extract the structural DNA of massive software repositories and render their non-visual architecture into measurable, explorable 3D galaxies.
+
+**1. The blAST Engine - The galaxyscope (Backend):** A hyper-scale, language-agnostic static analysis CLI. Based on 50 years of bioinformatics and genetic sequencing algorithms, it parses code at ~100,000 LOC/second. It outputs rich JSON telemetry, SQLite databases, and low-token Markdown briefs optimized for AI-agent workflows.
+
+**2. The Observatory (Frontend):** Drop your galaxy.json into the free viewer at [GitGalaxy.io](https://gitgalaxy.io/) or use the repo's airgap_observatory, a standalone, zero-telemetry WebGPU visualizer. Both visualizers read the JSON contract and renders the entire code base as a procedural 3D galaxy where files are stars, allowing humans to visually map scale and risk exposure instantly.
 
 **Live Demo:** View 3D galaxy examples of Apollo-11, Linux, Tensorflow and more at [GitGalaxy.io](https://gitgalaxy.io/)
 
@@ -74,13 +84,17 @@ Open your web browser and go to http://localhost:8000.
 
 Drag and drop your newly generated _galaxy.json file to instantly render your architecture.
 
-## How & What Does it Measure?
+## 🧬 The blAST Paradigm: Sequencing the DNA of Software
 
-Accomplished by scanning codebases with the same tech used to scan strings of DNA when I was a scientist. By employing a BLAST-like algorithm, a taxonomic language feature map, and DNA fingerprinting algorithms, GitGalaxy brings 50-ish years of bioinformatics to code analysis. We parse our resulting DNA/code fingerprint into a series of risk exposure metrics (genotype to phenotype associations).
+Traditional computer science treats software like a rigid blueprint, using slow, language-specific Abstract Syntax Trees (ASTs) to analyze code. GitGalaxy treats code as a living, mutating organism using **blAST (Broad Lexical Abstract Syntax Tracker)**.
 
-GitGalaxy does not measure "Code Quality", which feels like a judgment, but instead measures Risk Exposure. Our measurements do not judge; they highlight. We do not assess "Bad Code"; we measure Cognitive Load Exposure—how hard it is for a human to work through the logic—because teams should be aware which files are the hardest to work on. 
+By applying the principles of biological sequence alignment to software, blAST hunts for the universal structural markers of logic across ~40 languages and ~250 file extensions. We translate this genetic code into "phenotypes"—measurable risk exposures.
 
-Risk Exposures identify general trends (this file has high API exposure) instead of providing an absolute ranking over tiny differences (this file is better than that one because it scored 6% higher in the tech debt equation). These are general guides to give engineers, managers and CTOs a visual estimate on code status. It allows a team to agree on standards and instantly see—without reading a single line of text—where their architecture might be drifting into dangerous territory.
+### Sequencing at Hyper-Scale
+By abandoning the compiler bottleneck, blAST achieves processing velocities that traditional ASTs simply cannot comprehend. In live telemetry tracking across the largest open-source ecosystems, blAST demonstrated its absolute scale:
+* **Peak Velocity:** Sequenced the 141,445 lines of the original **Apollo-11** Guidance Computer assembly code in **0.28 seconds** (an alignment rate of **513,298 LOC/s**).
+* **Massive Monoliths:** Chewed through the **3.2 million lines of OpenCV in just 11.11 seconds** (288,594 LOC/s). 
+* **Planetary Scale:** Effortlessly mapped the architectural DNA of planetary-scale repositories like **TensorFlow (7.8M LOC)**, **Kubernetes (5.5M LOC)**, and **FreeBSD (24.4M LOC)** in a fraction of the time required to compile them.
 
 ## Zero-Trust Architecture
 
@@ -90,6 +104,14 @@ Your code never leaves your machine. GitGalaxy performs 100% of its scanning and
 * **Ephemeral Memory Processing:** Repositories are unpacked into a volatile memory buffer (RAM) and are automatically purged when the browser tab is closed.
 * **Privacy-by-Design:** Even when using the web-based viewer, the data remains behind the user's firewall at all times.
 
+### The Viral Security Lens: Behavioral Threat Hunting
+Traditional security scanners rely on rigid, outdated virus signatures. blAST acts like an immune system, hunting for the *behavioral genetic markers* of a threat. By analyzing the structural density of I/O hits, execution triggers, and security bypasses, blAST is perfectly engineered to stop modern attack vectors:
+
+* **Supply-Chain Poisoning:** Instantly flags seemingly innocent setup scripts that possess an anomalous density of network I/O and dynamic execution (`eval`/`exec`).
+* **Logic Bombs & Sabotage:** Identifies code designed to destroy infrastructure by catching dense concentrations of catastrophic OS commands and raw hardware aborts.
+* **Steganography & Obfuscated Malware:** Mathematically exposes evasion techniques, flagging Unicode Smuggling (homoglyph imports) and sub-atomic custom XOR decryption loops.
+* **Credential Hemorrhaging:** Acts as a ruthless data vault scanner, isolating hardcoded cryptographic assets (`.pem`, `.pfx`, `.jks` files) buried deep within massive repositories.
+
 ## License & Copyright
 
 Copyright (c) 2026 Joe Esquibel

gitgalaxy-1.0.7/README.md

@@ -0,0 +1,104 @@
+# GitGalaxy
+
+[![PyPI version](https://badge.fury.io/py/gitgalaxy.svg)](https://badge.fury.io/py/gitgalaxy)
+[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
+[![License: PolyForm Noncommercial](https://img.shields.io/badge/License-PolyForm%20Noncommercial-blue.svg)](https://polyformproject.org/licenses/noncommercial/1.0.0/)
+
+[![Engine](https://img.shields.io/badge/Engine-blAST-8A2BE2.svg)](#)
+[![Velocity](https://img.shields.io/badge/Velocity-100k+_LOC%2Fs-00C957.svg)](#)
+[![Analysis](https://img.shields.io/badge/Analysis-Code_Bioinformatics-00BFFF.svg)](#)
+[![Threat Hunting](https://img.shields.io/badge/Threat_Hunting-Behavioral-FF4500.svg)](#)
+[![Architecture](https://img.shields.io/badge/Architecture-Zero__Trust-teal.svg)](#)
+
+[![Zero Dependencies](https://img.shields.io/badge/Dependencies-0-brightgreen.svg)](https://pypi.org/project/gitgalaxy/)
+[![Airgap Ready](https://img.shields.io/badge/Security-Airgap_Ready-teal.svg)](#)
+
+
+Code is art. Logic is art. Systems engineering is art.
+
+GitGalaxy is a two-part ecosystem connected by a universal JSON contract. It is designed to extract the structural DNA of massive software repositories and render their non-visual architecture into measurable, explorable 3D galaxies.
+
+**1. The blAST Engine - The galaxyscope (Backend):** A hyper-scale, language-agnostic static analysis CLI. Based on 50 years of bioinformatics and genetic sequencing algorithms, it parses code at ~100,000 LOC/second. It outputs rich JSON telemetry, SQLite databases, and low-token Markdown briefs optimized for AI-agent workflows.
+
+**2. The Observatory (Frontend):** Drop your galaxy.json into the free viewer at [GitGalaxy.io](https://gitgalaxy.io/) or use the repo's airgap_observatory, a standalone, zero-telemetry WebGPU visualizer. Both visualizers read the JSON contract and renders the entire code base as a procedural 3D galaxy where files are stars, allowing humans to visually map scale and risk exposure instantly.
+
+**Live Demo:** View 3D galaxy examples of Apollo-11, Linux, Tensorflow and more at [GitGalaxy.io](https://gitgalaxy.io/)
+
+> **Note:** This is a condensed version of the full documentation. For more info, please visit: [https://github.com/squid-protocol/gitgalaxy](https://github.com/squid-protocol/gitgalaxy)
+
+---
+
+## Quickstart
+
+### 1. Install
+
+```bash
+pip install gitgalaxy
+```
+
+### 2. Scan a Repository
+
+Point the GalaxyScope at any local repository or ZIP archive. The engine runs entirely on your local machine—zero data is transmitted.
+
+```bash
+galaxyscope /path/to/your/local/repo
+```
+
+### 3. View the Galaxy
+
+GitGalaxy offers two ways to visualize your 3D architecture, both built on a strict Zero-Trust Privacy Model where your code never leaves your machine.
+
+**Option A: The Web Viewer (Frictionless)**
+Simply drag and drop your generated "your_repo_galaxy.json" file (or a .zip of your raw repository) directly into GitGalaxy.io. All rendering and scanning happens entirely in your browser's local memory.
+
+**Option B: The Local Server (Enterprise & Offline)**
+For teams operating under strict compliance rules or behind corporate firewalls, GitGalaxy includes a 100% static, zero-telemetry local viewer called the Airgap Observatory.
+
+There is no backend, no database, and no external API calls. It is a completely closed-box system built on static HTML and JavaScript, you just need to spin up a basic local server to view it.
+
+Navigate into the visualizer folder and start Python's built-in static web server:
+
+```bash
+git clone https://github.com/squid-protocol/gitgalaxy.git
+cd gitgalaxy/airgap_observatory
+python3 -m http.server 8000
+```
+Open your web browser and go to http://localhost:8000.
+
+Drag and drop your newly generated _galaxy.json file to instantly render your architecture.
+
+## 🧬 The blAST Paradigm: Sequencing the DNA of Software
+
+Traditional computer science treats software like a rigid blueprint, using slow, language-specific Abstract Syntax Trees (ASTs) to analyze code. GitGalaxy treats code as a living, mutating organism using **blAST (Broad Lexical Abstract Syntax Tracker)**.
+
+By applying the principles of biological sequence alignment to software, blAST hunts for the universal structural markers of logic across ~40 languages and ~250 file extensions. We translate this genetic code into "phenotypes"—measurable risk exposures.
+
+### Sequencing at Hyper-Scale
+By abandoning the compiler bottleneck, blAST achieves processing velocities that traditional ASTs simply cannot comprehend. In live telemetry tracking across the largest open-source ecosystems, blAST demonstrated its absolute scale:
+* **Peak Velocity:** Sequenced the 141,445 lines of the original **Apollo-11** Guidance Computer assembly code in **0.28 seconds** (an alignment rate of **513,298 LOC/s**).
+* **Massive Monoliths:** Chewed through the **3.2 million lines of OpenCV in just 11.11 seconds** (288,594 LOC/s). 
+* **Planetary Scale:** Effortlessly mapped the architectural DNA of planetary-scale repositories like **TensorFlow (7.8M LOC)**, **Kubernetes (5.5M LOC)**, and **FreeBSD (24.4M LOC)** in a fraction of the time required to compile them.
+
+## Zero-Trust Architecture
+
+Your code never leaves your machine. GitGalaxy performs 100% of its scanning and vectorization locally.
+
+* **No Data Transmission:** Source code is never transmitted to any API, cloud database, or third-party service.
+* **Ephemeral Memory Processing:** Repositories are unpacked into a volatile memory buffer (RAM) and are automatically purged when the browser tab is closed.
+* **Privacy-by-Design:** Even when using the web-based viewer, the data remains behind the user's firewall at all times.
+
+### The Viral Security Lens: Behavioral Threat Hunting
+Traditional security scanners rely on rigid, outdated virus signatures. blAST acts like an immune system, hunting for the *behavioral genetic markers* of a threat. By analyzing the structural density of I/O hits, execution triggers, and security bypasses, blAST is perfectly engineered to stop modern attack vectors:
+
+* **Supply-Chain Poisoning:** Instantly flags seemingly innocent setup scripts that possess an anomalous density of network I/O and dynamic execution (`eval`/`exec`).
+* **Logic Bombs & Sabotage:** Identifies code designed to destroy infrastructure by catching dense concentrations of catastrophic OS commands and raw hardware aborts.
+* **Steganography & Obfuscated Malware:** Mathematically exposes evasion techniques, flagging Unicode Smuggling (homoglyph imports) and sub-atomic custom XOR decryption loops.
+* **Credential Hemorrhaging:** Acts as a ruthless data vault scanner, isolating hardcoded cryptographic assets (`.pem`, `.pfx`, `.jks` files) buried deep within massive repositories.
+
+## License & Copyright
+
+Copyright (c) 2026 Joe Esquibel
+
+GitGalaxy is released under the PolyForm Noncommercial License 1.0.0. It is completely free for personal use, research, experiment, testing, and hobby projects. Use by educational or charitable organizations is also permitted.
+
+Any commercial use or integration into commercial SaaS products or corporate CI/CD pipelines requires a separate commercial license. Please reach out via gitgalaxy.io to discuss commercial integration.

{gitgalaxy-1.0.6 → gitgalaxy-1.0.7}/gitgalaxy/aperture.py

@@ -104,14 +104,6 @@ class ApertureFilter:
         """
         [PHASE 0 ENTRY POINT]
         Fast path-only check to build the CensusArray (Radar Walk).
-        Now safely fetches file size to prevent the 0-Byte Dark Matter telemetry bug.
-        
-        Args:
-            file_path: The artifact's path.
-            has_intent: True if the GuideStar mapped this file in a manifest or priority list.
-            
-        Returns:
-            Tuple: (is_valid: bool, size_bytes: int, reason: str)
         """
         path_obj = Path(file_path)
         normalized_path = path_obj.as_posix()
@@ -122,20 +114,28 @@ class ApertureFilter:
         except ValueError:
             relative_path = normalized_path
 
-        # Safely fetch size before making drop decisions to ensure accurate Dark Matter telemetry
         try:
             size_bytes = path_obj.stat().st_size if path_obj.exists() else 0
         except OSError:
             size_bytes = 0
 
-        # 0. TIER 0.5: THE ABSOLUTE EXTENSION SHIELD (Impervious to Intent)
-        # Drops SVGs, 3D Models, PDFs, and PGP keys before disk I/O ever happens.
+        # ======================================================================
+        # 0.1 TIER 0.1: THE SECRETS RADAR (Highest Priority Security Check)
+        # Checks for leaked credentials, databases, and private keys.
+        # ======================================================================
+        if path_obj.name in self.config.get("SECRETS_EXACT", set()) or ext.lower() in self.config.get("SECRETS_EXTENSIONS", set()):
+            reason = f"CRITICAL LEAK (Exposed Secret / Key Detected: '{path_obj.name}')"
+            self.logger.critical(f"🛡️ SECURITY BREACH: {reason} at {relative_path}")
+            return False, size_bytes, reason
+
+        # ======================================================================
+        # 0.5 TIER 0.5: THE ABSOLUTE EXTENSION SHIELD (Impervious to Intent)
+        # ======================================================================
         if ext.lower() in self.black_hole_exts:
             reason = f"Blocked (Explicitly Blacklisted Media/Binary Extension: '{ext}')"
             self.logger.debug(f"{reason}: {relative_path}")
             return False, size_bytes, reason
 
-        # Resolve intent status against cache
         active_intent = has_intent or (normalized_path in self._intent_cache)
         if active_intent:
             self._intent_cache.add(normalized_path)
@@ -147,21 +147,17 @@ class ApertureFilter:
             return False, size_bytes, reason
 
         # --- INTENT BYPASS ---
-        # If the file has a GuideStar lock, it bypasses linguistic whitelisting entirely.
         if active_intent:
             reason = "Passed (GuideStar Intent Lock Bypassed Tier 2)"
             self.logger.debug(f"{reason}: {relative_path}")
             return True, size_bytes, reason
 
         # 2. TIER 2: THE VISIBLE SPECTRUM (Linguistic Whitelisting)
-        # Rule 2.1: Deep Space Remnants (Spec 2.3.3.B)
-        # We allow extensionless files through without intent to be evaluated by the Shebang Scanner
         if not ext:
             reason = "Passed (Extensionless -> Shebang scan required)"
             self.logger.debug(f"{reason}: {relative_path}")
             return True, size_bytes, reason
             
-        # Rule 2.2: Known Ecosystem Anchor or Whitelisted Extension
         if path_obj.name in self.ecosystem_anchors or ext.lower() in self.whitelisted_extensions:
             reason = "Passed (Ecosystem Anchor or Whitelisted Ext)"
             return True, size_bytes, reason
@@ -169,7 +165,7 @@ class ApertureFilter:
         reason = f"Blocked (Unsupported or Unrecognized Extension: '{ext}')"
         self.logger.debug(f"{reason}: {relative_path}")
         return False, size_bytes, reason
-
+    
     def is_in_scope(self, file_path: Union[str, Path], content: Optional[str] = None, has_intent: bool = False) -> FilterResult:
         """Runs the 5-tier perimeter gate to validate maintainable code matter."""
         path_obj = Path(file_path)
@@ -211,7 +207,13 @@ class ApertureFilter:
             # --- TIER 1 & 2: PATH VALIDATION ---
             is_valid, size_bytes, reason = self.evaluate_path_integrity(path_obj, has_intent=active_intent)
             if not is_valid:
-                result["band"] = self.bands.get("RADIO", "radio_noise")
+                # --- SECRETS RADAR CHECK ---
+                if reason and "CRITICAL LEAK" in reason:
+                    # Uses the new QUARANTINE band and aligned terminology
+                    result["band"] = self.bands.get("QUARANTINE", "critical_secret_leak")
+                else:
+                    result["band"] = self.bands.get("RADIO", "ignored_system_or_hidden_file")
+                    
                 result["reason"] = reason
                 result["size_bytes"] = size_bytes
                 return result

{gitgalaxy-1.0.6 → gitgalaxy-1.0.7}/gitgalaxy/audit_recorder.py

@@ -252,14 +252,117 @@ class AuditRecorder:
                 "Discovery Proof": "Logic Splicer Shielding"
             })
 
-        # 4. Final Mission Archive Packaging
+        # ==========================================================
+        # 4. FORENSIC SECURITY & VULNERABILITY AUDIT (Section 3)
+        # ==========================================================
+        sec_risk_mapping = {
+            "secrets_risk": {"label": "Secrets Risk Exposure", "threshold": 0.1},
+            "obscured_payload": {"label": "Hidden Malware Risk Exposure", "threshold": 60.0},
+            "logic_bomb": {"label": "Logic Bomb / Sabotage Risk Exposure", "threshold": 50.0},
+            "injection_surface": {"label": "Injection Surface Risk Exposure", "threshold": 65.0},
+            "memory_corruption": {"label": "Memory Corruption Risk Exposure", "threshold": 60.0}
+        }
+        
+        sec_hit_mapping = {
+            "sec_danger": "Dangerous Code Execution (Eval/Exec)",
+            "sec_safety_neg": "Security Rule Bypasses",
+            "sec_io": "Suspicious Network Connections",
+            "sec_flux": "Global Environment Tampering",
+            "sec_heat_triggers": "Scrambled / Obfuscated Code",
+            "sec_graveyard": "Shadow Logic (Hidden Code)",
+            "sec_bitwise_hits": "Sub-Atomic Decryption (Custom XOR)",
+            "sec_shadow_imports": "Steganographic Execution (Shadow Imports)",
+            "sec_homoglyphs": "Unicode Smuggling (Homoglyph Imports)"
+        }
+
+        quarantined_files = []
+        vuln_exposures = {
+            data["label"]: {
+                "Alert Threshold": f">= {data['threshold']}%", 
+                "Artifacts Flagged": 0, 
+                "Critical Files": []
+            } for key, data in sec_risk_mapping.items()
+        }
+        
+        raw_threat_hits = {
+            "_description": "The total number of times these specific malicious regex patterns were triggered across all scanned files.",
+            **{label: 0 for label in sec_hit_mapping.values()}
+        }
+
+        # Safe index lookups
+        risk_indices = {k: self.RISK_SCHEMA.index(k) for k in sec_risk_mapping.keys() if k in self.RISK_SCHEMA}
+        hit_indices = {k: self.HIT_SCHEMA.index(k) for k in sec_hit_mapping.keys() if k in self.HIT_SCHEMA}
+
+        # Sweep the stars for security anomalies
+        for star in stars:
+            path = star.get("path", "Unknown")
+            band = star.get("band", "")
+            
+            if band == "critical_secret_leak":
+                quarantined_files.append({
+                    "Path": path,
+                    "Diagnostic": star.get("telemetry", {}).get("domain_context", {}).get("warning", "CRITICAL LEAK (Exposed Secret / Key Detected)")
+                })
+                
+            risk_vector = star.get("risk_vector", [])
+            if len(risk_vector) == len(self.RISK_SCHEMA):
+                for r_key, r_idx in risk_indices.items():
+                    score = risk_vector[r_idx]
+                    mapping = sec_risk_mapping[r_key]
+                    if score >= mapping["threshold"]:
+                        label = mapping["label"]
+                        vuln_exposures[label]["Critical Files"].append({"Path": path, "Score": f"{score:.1f}%"})
+                        vuln_exposures[label]["Artifacts Flagged"] += 1
+            
+            # Aggregate the raw threat hits
+            hit_vector = star.get("hit_vector")
+            if isinstance(hit_vector, list) and len(hit_vector) == len(self.HIT_SCHEMA):
+                for h_key, h_idx in hit_indices.items():
+                    hits = hit_vector[h_idx]
+                    if hits > 0:
+                        label = sec_hit_mapping[h_key]
+                        raw_threat_hits[label] += hits
+
+        # --- THE FALSE POSITIVE FIX: Decouple Active Threats from Surface Risks ---
+        # 1. Count actual malicious regex hits (ignoring the _description string)
+        malicious_hits_total = sum(v for k, v in raw_threat_hits.items() if isinstance(v, int))
+        
+        # 2. Check for explicit malware
+        has_malware = vuln_exposures["Hidden Malware Risk Exposure"]["Artifacts Flagged"] > 0
+        has_secrets = vuln_exposures["Secrets Risk Exposure"]["Artifacts Flagged"] > 0
+
+        # 3. Tiered Status Routing
+        if quarantined_files or has_malware or has_secrets or malicious_hits_total > 0:
+            audit_status = "CRITICAL_THREATS_DETECTED"
+        elif any(v["Artifacts Flagged"] > 0 for v in vuln_exposures.values()):
+            # DOOM lands here. High architectural risk, but no active malicious intent.
+            audit_status = "ELEVATED_SURFACE_RISK" 
+        else:
+            audit_status = "SECURE"
+
+        security_audit = {
+            "Audit Status": audit_status,
+            "Scope": {
+                "Artifacts Evaluated": len(stars),
+                "Threat Signatures Monitored": len(sec_hit_mapping),
+                "Vulnerability Vectors Calculated": len(sec_risk_mapping)
+            },
+            "Exposed Secrets & Credentials (Quarantined Files)": quarantined_files,
+            "Vulnerability Exposures (Threshold Breaches)": vuln_exposures,
+            "Raw Threat Signature Hits (Total Repository Occurrences)": raw_threat_hits
+        }
+
+        # ==========================================================
+        # 5. Final Mission Archive Packaging
+        # ==========================================================
         mission_audit = {
             "Audit Protocol": "GitGalaxy v6.2.0-Audit",
             "1. Forensic Trail (Traceability)": forensic_trail,
             "2. Global Synthesis Summary": summary,
-            "3. High-Value Forensic Report": forensic_report,
-            "4. Dark Matter (Excluded Artifacts)": pretty_singularity,
-            "5. Visible Matter (Scanned Artifacts)": pretty_constellations
+            "3. Forensic Security & Vulnerability Audit": security_audit,
+            "4. High-Value Forensic Report": forensic_report,
+            "5. Dark Matter (Excluded Artifacts)": pretty_singularity,
+            "6. Visible Matter (Scanned Artifacts)": pretty_constellations
         }
 
         # --- ABSOLUTE ROUTING LOGIC ---

{gitgalaxy-1.0.6 → gitgalaxy-1.0.7}/gitgalaxy/detector.py

@@ -13,6 +13,8 @@ import hashlib
 import logging
 import time
 from typing import Dict, List, Any, TypedDict, Optional, Tuple
+from . import gitgalaxy_standards_v011 as config
+
 
 # ==============================================================================
 # GitGalaxy Phase 2.5 & 7.5: Logic Splicer & Cartographer
@@ -214,19 +216,9 @@ class LogicSplicer:
     3. Integration Modes: Labels (A), Braces (B), Indentation (C), Keywords (D), Terminators (E).
     """
 
-    # --- ADD THE SCHEMA HERE ---
-    UNIVERSAL_METRICS_SCHEMA = [
-        "branch", "linear", "args", "func_start", "class_start", "safety", 
-        "safety_neg", "danger", "io", "api", "flux", "graveyard", "doc", 
-        "test", "concurrency", "ui_framework", "closures", "globals", 
-        "decorators", "generics", "comprehensions", "scientific", "heat_triggers", 
-        "import", "ownership", "planned_debt", "fragile_debt", "private_info", 
-        "spec_exposure", "civil_war", "ssr_boundaries", "events", 
-        "dependency_injection", "macros", "pointers", "memory_alloc", 
-        "inline_asm", "telemetry", "print_hits", "cast_hits", "bailout_hits", 
-        "halt_hits", "bitwise_hits", "sync_locks", "freeze_hits", "cleanup", 
-        "encapsulation", "listeners", "test_skip", "indent_tabs", "indent_spaces"
-    ]
+    # --- DYNAMIC SCHEMA FETCH ---
+    # Directly mirrors the central registry to prevent schema drift
+    UNIVERSAL_METRICS_SCHEMA = config.RECORDING_SCHEMAS.get("SIGNAL_SCHEMA", [])
     
     HANDSHAKE_REGISTRY = [
         {"trigger": re.compile(r'<script', re.I), "end": re.compile(r'</script>', re.I), "target": "javascript", "pair": None},

{gitgalaxy-1.0.6 → gitgalaxy-1.0.7}/gitgalaxy/galaxyscope.py

@@ -34,6 +34,7 @@ from .spectral_auditor import SpectralAuditor
 from .gpu_recorder import GPURecorder
 from .audit_recorder import AuditRecorder
 from .llm_recorder import LLMRecorder
+from .security_lens import SecurityLens
 # Load Universal Laws from config
 from . import gitgalaxy_standards_v011 as scanning_config
 
@@ -111,13 +112,22 @@ def _process_file_worker(rel_path: str) -> Dict[str, Any]:
     """Processes a single file path using the worker's cached hardware modules."""
     global _worker_state
     
+    # ---> START THE CLOCK FOR THE MICRO-PROFILER <---
+    t_start = time.time()
+    
     root = _worker_state['root']
     full_path_str = str(root / rel_path) 
     
     # --- NEW: PARALLEL PHANTOM CHECK ---
     # Silently evaporates files missing on disk to prevent main-thread anomaly logging
     if not Path(full_path_str).is_file():
-        return {"rel_path": rel_path, "status": "phantom", "reason": "Phantom file (missing on disk)", "data": {}}
+        return {
+            "rel_path": rel_path, 
+            "status": "phantom", 
+            "reason": "Phantom file (missing on disk)", 
+            "data": {},
+            "processing_time": time.time() - t_start
+        }
 
     logger = _worker_state['worker_logger']
     aperture = _worker_state['filter']
@@ -139,19 +149,28 @@ def _process_file_worker(rel_path: str) -> Dict[str, Any]:
             observation["status"] = "singularity"
             observation["reason"] = reason
             observation["size_bytes"] = size_bytes 
+            observation["processing_time"] = time.time() - t_start
             return observation
             
         try:
             with open(full_path_str, 'r', encoding='utf-8', errors='ignore') as f:
                 content_buffer = f.read()
+        except FileNotFoundError:
+            # Replaces the Phantom Check! Fast, zero-overhead disk failure routing.
+            observation["status"] = "phantom"
+            observation["reason"] = "Phantom file (missing on disk)"
+            observation["processing_time"] = time.time() - t_start
+            return observation
         except Exception as e:
             observation["reason"] = f"I/O Error: {str(e)}"
+            observation["processing_time"] = time.time() - t_start
             return observation
 
         filter_res = aperture.is_in_scope(full_path_str, content=content_buffer, has_intent=has_prior)
         if not filter_res["is_in_scope"]:
             observation["status"] = "singularity"
             observation["reason"] = filter_res["reason"]
+            observation["processing_time"] = time.time() - t_start
             return observation
 
         detection_result = detector.inspect(
@@ -169,6 +188,7 @@ def _process_file_worker(rel_path: str) -> Dict[str, Any]:
             observation["status"] = "singularity"
             observation["reason"] = f"Unsupported Format (.{lang_id})" 
             observation["identity_confidence"] = detection_result.get("intensity", 0.0)
+            observation["processing_time"] = time.time() - t_start
             return observation
         
         refraction = prism.refract(content_buffer, lang_id)
@@ -218,12 +238,12 @@ def _process_file_worker(rel_path: str) -> Dict[str, Any]:
             "prior_lock": has_prior,
             "coding_loc": refraction["coding_loc"],
             "doc_loc": refraction["doc_loc"],
-            "raw_imports": raw_imports,          # <-- ADDED
-            "popularity_hits": popularity_hits   # <-- ADDED
+            "raw_imports": raw_imports,          
+            "popularity_hits": popularity_hits   
         }
         
         data_payload.update(logic_data)
-        data_payload["raw_imports"] = list(raw_imports) # <-- Cast to list!
+        data_payload["raw_imports"] = list(raw_imports) 
         data_payload["control_flow_ratio"] = logic_data.get("total_control_flow_ratio", 0.0)
         data_payload["file_impact"] = logic_data.get("sum_fxn_impact", 0.0)
 
@@ -232,6 +252,17 @@ def _process_file_worker(rel_path: str) -> Dict[str, Any]:
     except Exception as e:
         observation["status"] = "anomaly"
         observation["reason"] = f"Hardware failure: {str(e)}"
+        
+    # ---> RECORD THE FINAL TIME <---
+    total_time = time.time() - t_start
+    observation["processing_time"] = total_time
+
+    # ---> NEW: REAL-TIME SLOW FILE ALERT <---
+    if total_time > 10.0:
+        logger.warning(f"🐌 SLOW PARSE DETECTED: '{rel_path}' took {total_time:.2f} seconds.")
+
+    # ---> RECORD THE FINAL TIME <---
+    observation["processing_time"] = time.time() - t_start
 
     return observation
 
@@ -638,8 +669,13 @@ class Orchestrator:
                 if not clean_path:
                     continue
                 
+                # THE FIX: Don't turn file extensions into folders!
+                # If the string has a dot but no slash, we only replace '.' with '/' 
+                # if it is NOT a recognized file extension.
                 if "." in clean_path and "/" not in clean_path:
-                    clean_path = clean_path.replace(".", "/")
+                    ext_guess = "." + clean_path.rsplit('.', 1)[-1].lower()
+                    if ext_guess not in self.ext_tally:
+                        clean_path = clean_path.replace(".", "/")
                 
                 # Strip leading relative markers so it aligns with our suffix map
                 clean_path = clean_path.lstrip("./")
@@ -792,6 +828,52 @@ class Orchestrator:
                 "file_impact": forensic_result["file_impact"],
                 "telemetry": telemetry_payload 
             })
+            
+        # ==================================================================
+        # THE SECRETS SUPERNOVA INJECTION (Synthetic Visualization)
+        # Pull critical leaks out of Dark Matter and force them onto the map
+        # ==================================================================
+        leaks = [cand for cand in self.singularity_candidates if "CRITICAL LEAK" in cand.get("reason", "")]
+        
+        # Remove them from Dark Matter so they aren't double-counted in the summary
+        self.singularity_candidates = [cand for cand in self.singularity_candidates if "CRITICAL LEAK" not in cand.get("reason", "")]
+        
+        from .signal_processor import SignalProcessor
+        
+        for leak in leaks:
+            rel_path = leak["path"]
+            logger.critical(f"Supernova Injection: Forcing {rel_path} onto the 3D Map!")
+            
+            synthetic_star = {
+                "name": Path(rel_path).name,
+                "path": rel_path,
+                "lang_id": "plaintext", # <-- Bypasses the Spectral Auditor as Inert Matter
+                "coding_loc": 1,
+                "total_loc": 1,
+                "band": "critical_secret_leak",
+                
+                # 18-point risk vector. Index 17 is secrets_risk. Peg it to 100%.
+                "risk_vector": [0.0] * 13 + [0.0, 0.0, 0.0, 0.0, 100.0], 
+                "hit_vector": [0] * len(SignalProcessor.SIGNAL_SCHEMA),
+                
+                # ---> CARTOGRAPHER GRAVITY <---
+                # This makes the radius massive and pushes all other files away
+                "file_impact": 5000.0, 
+                
+                "telemetry": {
+                    "ownership": "Secrets Radar",
+                    "domain_context": {"warning": "CRITICAL CREDENTIAL LEAK DETECTED"},
+                    "identity_source_proof": "Aperture Security Override",
+                    "identity_lock_tier": 0
+                }
+            }
+            
+            # Manually flag the private_info hit so UI tooltips show the exact trigger
+            if "private_info" in SignalProcessor.SIGNAL_SCHEMA:
+                idx = SignalProcessor.SIGNAL_SCHEMA.index("private_info")
+                synthetic_star["hit_vector"][idx] = 1
+                
+            self.stars.append(synthetic_star)
     
     def _prepare_target(self, target_input: Union[str, Path]) -> Path:
         """Prepares the filesystem for analysis."""
@@ -929,6 +1011,7 @@ def main():
     parser.add_argument("target", help="Path to repo or ZIP")
     parser.add_argument("--output", default=None, help="Optional output filename override")
     parser.add_argument("--debug", action="store_true", help="Turn on verbose Analytical logging")
+    parser.add_argument("--paranoid", action="store_true", help="Lower security thresholds to flag more potential threats.")
     
     args = parser.parse_args()
 
@@ -977,6 +1060,16 @@ def main():
                         merged_langs[lang]['rules'].update(rules_patch)
                         logging.debug(f"   -> Patched '{lang}' geometry rules.")
 
+        # =========================================================
+        # --- NEW: SECURITY LENS INTEGRATION ---
+        # =========================================================
+        logging.info("🛡️ SECURITY LENS ACTIVE: Passively monitoring for Threat Signatures.")
+        lens = SecurityLens(parent_logger=logging.getLogger())
+        
+        # Unconditionally inject the 'sec_' prefixed observers into the registry
+        merged_langs = lens.arm_lens(merged_langs)
+        # =========================================================
+        
         # ---------------------------------------------------------
         # 3. Assemble the Final Configuration
         # ---------------------------------------------------------
@@ -986,7 +1079,8 @@ def main():
             "APERTURE_CONFIG": getattr(scanning_config, "APERTURE_CONFIG", {}),
             "PATH_MODIFIERS": getattr(scanning_config, "PATH_MODIFIERS", {}),
             "PRIORITY_WHITELIST": getattr(scanning_config, "PRIORITY_WHITELIST", []),
-            "DOCUMENTATION_LANGUAGES": getattr(scanning_config, "DOCUMENTATION_LANGUAGES", set()) 
+            "DOCUMENTATION_LANGUAGES": getattr(scanning_config, "DOCUMENTATION_LANGUAGES", set()),
+            "PARANOID_MODE": args.paranoid # ---> 2. INJECT INTO CONFIG <--- 
         }
 
         # ---------------------------------------------------------