plugin-scanner 2.0.956__tar.gz → 2.0.958__tar.gz

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: plugin-scanner
-Version: 2.0.956
+Version: 2.0.958
 Summary: Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi.
 Project-URL: Homepage, https://github.com/hashgraph-online/hol-guard
 Project-URL: Repository, https://github.com/hashgraph-online/hol-guard

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "plugin-scanner"
-version = "2.0.956"
+version = "2.0.958"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/pyproject.toml.bak

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "hol-guard"
-version = "2.0.956"
+version = "2.0.958"
 description = "Protect local AI harnesses with HOL Guard and run scanner checks for Codex, Claude, Cursor, Gemini, OpenCode, and Pi."
 readme = "README.md"
 license = "Apache-2.0"

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/src/codex_plugin_scanner/guard/aibom_trust_metadata.py

@@ -73,6 +73,12 @@ def trust_resolution_from_domain(
         "specVersion": domain.spec_version,
         "trustDomain": domain.domain,
         "attestationStatus": "unsigned",
+        "evidenceSchemaVersion": "guard-aibom-local-baseline-evidence.v1",
+        "evidence": _local_baseline_evidence_payload(
+            domain,
+            captured_at=normalized_captured_at,
+            trust_components=trust_components,
+        ),
         "evidenceHash": _trust_evidence_hash(
             {
                 "capturedAt": normalized_captured_at,
@@ -604,6 +610,11 @@ def _trust_layer_from_domain(
 
     trust_components = _trust_components_from_domain(domain)
     normalized_captured_at = _normalize_inventory_datetime(captured_at)
+    evidence = _local_baseline_evidence_payload(
+        domain,
+        captured_at=normalized_captured_at,
+        trust_components=trust_components,
+    )
 
     return {
         "layerId": "local_baseline",
@@ -620,6 +631,8 @@ def _trust_layer_from_domain(
             "specVersion": domain.spec_version,
             "trustDomain": domain.domain,
             "attestationStatus": "unsigned",
+            "evidenceSchemaVersion": "guard-aibom-local-baseline-evidence.v1",
+            "evidence": evidence,
             "evidenceHash": _trust_evidence_hash(
                 {
                     "capturedAt": normalized_captured_at,
@@ -635,6 +648,36 @@ def _trust_layer_from_domain(
     }
 
 
+def _local_baseline_evidence_payload(
+    domain: TrustDomainScore,
+    *,
+    captured_at: object,
+    trust_components: list[dict[str, object]],
+) -> dict[str, object]:
+    return {
+        "source": "hol-guard-local-baseline",
+        "capturedAt": captured_at,
+        "trustDomain": domain.domain,
+        "profileId": domain.profile_id,
+        "profileVersion": domain.profile_version,
+        "specId": domain.spec_id,
+        "specVersion": domain.spec_version,
+        "componentCount": len(trust_components),
+        "components": [
+            {
+                "componentId": str(component.get("componentId", "")),
+                "confidence": component.get("confidence"),
+                "label": str(component.get("label", "")),
+                "score": component.get("score"),
+                "status": str(component.get("status", "")),
+                "summary": str(component.get("summary", "")),
+                "weight": component.get("weight"),
+            }
+            for component in trust_components
+        ],
+    }
+
+
 def _merge_trust_layers(
     existing: object,
     additions: list[dict[str, object]],

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/src/codex_plugin_scanner/guard/inventory_contract.py

@@ -454,13 +454,12 @@ def inventory_snapshot_from_detection(
     )
     symlink_findings = _symlink_findings_from_items(harness, item_tuple) if include_symlinks else ()
     sources = (*config_sources, *_cisco_inventory_sources(cisco_runs))
-    snapshot_hash = fingerprint_mapping(
-        {
-            "agent_type": harness,
-            "generated_at": generated_at,
-            "item_ids": [item.item_id for item in items],
-            "finding_ids": [finding.finding_id for finding in cisco_findings],
-        }
+    snapshot_hash = _inventory_snapshot_content_hash(
+        agent_type=harness,
+        items=item_tuple,
+        findings=(*cisco_findings, *symlink_findings),
+        sources=sources,
+        runtime_version=runtime_version,
     )
     return GuardAgentInventorySnapshot(
         snapshot_id=f"{harness}:snapshot:{snapshot_hash[:24]}",
@@ -487,6 +486,90 @@ def fingerprint_mapping(value: object) -> str:
     return fingerprint_text(encoded)
 
 
+def _inventory_snapshot_content_hash(
+    *,
+    agent_type: str,
+    items: tuple[GuardAgentInventoryItem, ...],
+    findings: tuple[GuardAgentInventoryFinding, ...],
+    sources: tuple[GuardInventorySource, ...],
+    runtime_version: str | None,
+) -> str:
+    return fingerprint_mapping(
+        {
+            "agent_type": agent_type,
+            "runtime_version": runtime_version,
+            "items": [
+                {
+                    "capability_categories": item.capability_categories,
+                    "content_hash": item.content_hash,
+                    "drift_state": item.drift_state,
+                    "item_id": item.item_id,
+                    "item_kind": item.item_kind,
+                    "metadata": _stable_snapshot_value(item.metadata),
+                    "risk_level": item.risk_level,
+                    "scanner_sources": item.scanner_sources,
+                    "security_score": item.security_score,
+                    "source_fingerprint": item.source_fingerprint,
+                }
+                for item in sorted(items, key=lambda value: (value.item_kind, value.item_id))
+            ],
+            "findings": [
+                {
+                    "artifact_id": finding.artifact_id,
+                    "check_id": finding.check_id,
+                    "confidence": finding.confidence,
+                    "evidence": _stable_snapshot_value(finding.evidence),
+                    "finding_id": finding.finding_id,
+                    "severity": finding.severity,
+                    "source": finding.source,
+                    "summary": finding.summary,
+                    "title": finding.title,
+                }
+                for finding in sorted(findings, key=lambda value: (value.source, value.finding_id))
+            ],
+            "sources": [
+                {
+                    "detail": source.detail,
+                    "source_id": source.source_id,
+                    "source_type": source.source_type,
+                    "status": source.status,
+                }
+                for source in sorted(sources, key=lambda value: (value.source_type, value.source_id))
+            ],
+        }
+    )
+
+
+def _stable_snapshot_value(value: object) -> object:
+    if isinstance(value, dict):
+        return {
+            key: _stable_snapshot_value(item)
+            for key, item in sorted(value.items(), key=lambda entry: str(entry[0]))
+            if str(key)
+            not in {
+                "attestation",
+                "attestationBindings",
+                "capturedAt",
+                "duration_ms",
+                "durationMs",
+                "elapsedMs",
+                "evidenceHash",
+                "generatedAt",
+                "lastSeenAt",
+                "observedAt",
+                "scanDurationMs",
+                "syncedAt",
+            }
+        }
+    if isinstance(value, (list, tuple)):
+        return sorted((_stable_snapshot_value(item) for item in value), key=_stable_snapshot_sort_key)
+    return value
+
+
+def _stable_snapshot_sort_key(value: object) -> str:
+    return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True)
+
+
 def inventory_item_id(agent_type: str, item_kind: str, display_name: str, semantic_text: str) -> str:
     normalized_text = _WHITESPACE_RE.sub(" ", semantic_text.strip())
     digest = fingerprint_mapping(
@@ -614,7 +697,7 @@ def _item_from_artifact(
             "artifact_id": artifact_id,
             "artifact_type": artifact_type,
             "name": name,
-            "metadata": safe_metadata,
+            "metadata": _stable_snapshot_value(safe_metadata),
         }
     )
     content_hash = _resolve_item_content_hash(safe_metadata, semantic_text)

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/src/codex_plugin_scanner/guard/runtime/runner.py

@@ -1309,6 +1309,9 @@ def sync_receipts(
 
     resolved_auth_context = auth_context if auth_context is not None else _resolve_guard_sync_auth_context(store)
     sync_url = _normalized_receipts_sync_url(_validate_guard_sync_url(_auth_context_sync_url(resolved_auth_context)))
+    local_guard_online_at = _now()
+    redaction_level = _resolve_cloud_receipt_redaction_level(store)
+    _ensure_relaxed_receipt_redaction_resync(store, level=redaction_level, synced_at=local_guard_online_at)
     prior_receipt_cursor = _receipt_sync_cursor_rowid(store)
     receipts = _receipt_sync_rows_for_upload(store, cursor_rowid=prior_receipt_cursor)
     inventory = store.list_inventory()
@@ -1324,8 +1327,6 @@ def sync_receipts(
     team_policy_pack_payload: dict[str, object] | None = None
     remote_decisions: set[PolicyDecision] = set()
     device_id, device_name = _guard_device_metadata(store)
-    redaction_level = _resolve_cloud_receipt_redaction_level(store)
-    local_guard_online_at = _now()
     sync_context = _receipt_sync_context(
         store=store,
         local_guard_online_at=local_guard_online_at,
@@ -1488,10 +1489,10 @@ def sync_receipts(
                 else None
             )
             if cloud_redaction_level and cloud_redaction_level in VALID_RECEIPT_REDACTION_LEVELS:
-                store.set_sync_payload(
-                    "cloud_receipt_redaction_level",
-                    {"level": cloud_redaction_level, "updated_at": now},
-                    now,
+                _persist_cloud_receipt_redaction_level(
+                    store,
+                    level=cloud_redaction_level,
+                    synced_at=now,
                 )
             remote_decisions.update(
                 _build_policy_bundle_decisions(
@@ -3933,17 +3934,29 @@ def _persist_receipt_sync_cursor(
     store.set_sync_payload("receipt_sync_cursor", payload, synced_at)
 
 
-def _resolve_cloud_receipt_redaction_level(store: GuardStore) -> str:
-    """Resolve the receipt redaction level for cloud sync.
+_RECEIPT_REDACTION_LEVEL_RANK: dict[str, int] = {
+    "full": 0,
+    "partial": 1,
+    "none": 2,
+}
+_RELAXED_RECEIPT_REDACTION_RESYNC_MARKER = "cloud_receipt_redaction_relaxed_resync_v1"
 
-    Priority: cloud-configured level (from policy bundle downlink) >
-    local GuardConfig.receipt_redaction_level > 'full' (safest).
-    """
+
+def _receipt_redaction_level_rank(level: str | None) -> int:
+    if level is None:
+        return _RECEIPT_REDACTION_LEVEL_RANK["full"]
+    return _RECEIPT_REDACTION_LEVEL_RANK.get(level, _RECEIPT_REDACTION_LEVEL_RANK["full"])
+
+
+def _stored_cloud_receipt_redaction_level(store: GuardStore) -> str | None:
     payload = store.get_sync_payload("cloud_receipt_redaction_level")
-    if isinstance(payload, dict):
-        level = payload.get("level")
-        if isinstance(level, str) and level in VALID_RECEIPT_REDACTION_LEVELS:
-            return level
+    if not isinstance(payload, dict):
+        return None
+    level = payload.get("level")
+    return level if isinstance(level, str) and level in VALID_RECEIPT_REDACTION_LEVELS else None
+
+
+def _local_receipt_redaction_level(store: GuardStore) -> str:
     try:
         config = load_guard_config(store.guard_home)
         if config.receipt_redaction_level in VALID_RECEIPT_REDACTION_LEVELS:
@@ -3953,6 +3966,72 @@ def _resolve_cloud_receipt_redaction_level(store: GuardStore) -> str:
     return "full"
 
 
+def _persist_cloud_receipt_redaction_level(store: GuardStore, *, level: str, synced_at: str) -> None:
+    previous_level = _stored_cloud_receipt_redaction_level(store) or _local_receipt_redaction_level(store)
+    if _receipt_redaction_level_rank(level) > _receipt_redaction_level_rank(previous_level):
+        store.set_sync_payload(
+            "receipt_sync_cursor",
+            {
+                "last_rowid": 0,
+                "synced_at": synced_at,
+                "reason": "cloud_receipt_redaction_level_relaxed",
+                "receipt_redaction_level": level,
+            },
+            synced_at,
+        )
+    store.set_sync_payload(
+        "cloud_receipt_redaction_level",
+        {"level": level, "updated_at": synced_at},
+        synced_at,
+    )
+    if _receipt_redaction_level_rank(level) > _receipt_redaction_level_rank("full"):
+        store.set_sync_payload(
+            _RELAXED_RECEIPT_REDACTION_RESYNC_MARKER,
+            {"level": level, "updated_at": synced_at},
+            synced_at,
+        )
+
+
+def _ensure_relaxed_receipt_redaction_resync(
+    store: GuardStore,
+    *,
+    level: str,
+    synced_at: str,
+) -> None:
+    if _receipt_redaction_level_rank(level) <= _receipt_redaction_level_rank("full"):
+        return
+    marker = store.get_sync_payload(_RELAXED_RECEIPT_REDACTION_RESYNC_MARKER)
+    if isinstance(marker, dict) and marker.get("level") == level:
+        return
+    store.set_sync_payload(
+        "receipt_sync_cursor",
+        {
+            "last_rowid": 0,
+            "synced_at": synced_at,
+            "reason": "cloud_receipt_redaction_level_relaxed_existing",
+            "receipt_redaction_level": level,
+        },
+        synced_at,
+    )
+    store.set_sync_payload(
+        _RELAXED_RECEIPT_REDACTION_RESYNC_MARKER,
+        {"level": level, "updated_at": synced_at},
+        synced_at,
+    )
+
+
+def _resolve_cloud_receipt_redaction_level(store: GuardStore) -> str:
+    """Resolve the receipt redaction level for cloud sync.
+
+    Priority: cloud-configured level (from policy bundle downlink) >
+    local GuardConfig.receipt_redaction_level > 'full' (safest).
+    """
+    level = _stored_cloud_receipt_redaction_level(store)
+    if level is not None:
+        return level
+    return _local_receipt_redaction_level(store)
+
+
 def _cloud_sync_command_display_part(value: str) -> str:
     return " ".join(_cloud_sync_sanitize_text(value, fallback="").split())
 

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/src/codex_plugin_scanner/version.py

@@ -1,3 +1,3 @@
 """Single source of truth for tool version."""
 
-__version__ = "2.0.956"
+__version__ = "2.0.958"

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/tests/test_guard_aibom_trust_metadata.py

@@ -30,6 +30,7 @@ from codex_plugin_scanner.guard.runtime.trust_attestation import (
     sign_trust_attestation,
     verify_trust_attestation,
 )
+from codex_plugin_scanner.models import Finding, Severity
 from codex_plugin_scanner.trust_models import TrustDomainScore
 
 
@@ -185,6 +186,111 @@ def test_inventory_snapshot_attaches_local_plugin_trust_resolution(tmp_path: Pat
     components = trust.get("trustComponents")
     assert isinstance(components, list)
     assert components
+    assert metadata.get("evidenceSchemaVersion") == "guard-aibom-local-baseline-evidence.v1"
+    evidence = metadata.get("evidence")
+    assert isinstance(evidence, dict)
+    assert evidence.get("source") == "hol-guard-local-baseline"
+    assert evidence.get("trustDomain") == "plugin"
+    assert evidence.get("componentCount") == len(components)
+    evidence_components = evidence.get("components")
+    assert isinstance(evidence_components, list)
+    assert evidence_components
+    trust_layers = plugin_item.metadata.get("trustLayers")
+    assert isinstance(trust_layers, list)
+    local_layer = next(
+        layer for layer in trust_layers if isinstance(layer, dict) and layer.get("layerType") == "local_baseline"
+    )
+    layer_metadata = local_layer.get("metadata")
+    assert isinstance(layer_metadata, dict)
+    layer_evidence = layer_metadata.get("evidence")
+    assert isinstance(layer_evidence, dict)
+    assert layer_evidence.get("source") == "hol-guard-local-baseline"
+
+
+def test_inventory_snapshot_id_uses_stable_content_hash(tmp_path: Path) -> None:
+    plugin_dir = tmp_path / "plugin"
+    _write_good_plugin(plugin_dir)
+    cisco_finding = Finding(
+        rule_id="mcp-verified-device-claim",
+        severity=Severity.LOW,
+        category="mcp",
+        title="Verified device claim",
+        description="Cisco MCP scan results.",
+        file_path=str(plugin_dir / "README.md"),
+        source="cisco-mcp-scanner",
+    )
+    first_cisco_run = CiscoInventoryRun(
+        source="cisco-mcp-scanner",
+        status="enabled",
+        message="Cisco MCP scan results.",
+        findings=(cisco_finding,),
+        duration_ms=41,
+        metadata={
+            "attestationBindings": [{"createdAt": "2026-06-10T12:00:00+00:00", "nonce": "one"}],
+            "duration_ms": 41,
+            "scanDurationMs": 41,
+        },
+    )
+    replayed_cisco_run = CiscoInventoryRun(
+        source="cisco-mcp-scanner",
+        status="enabled",
+        message="Cisco MCP scan results.",
+        findings=(cisco_finding,),
+        duration_ms=973,
+        metadata={
+            "attestationBindings": [{"createdAt": "2026-06-10T12:05:00+00:00", "nonce": "two"}],
+            "duration_ms": 973,
+            "scanDurationMs": 973,
+        },
+    )
+
+    first_snapshot = _snapshot_for_artifact(
+        artifact=GuardArtifact(
+            artifact_id="codex:project:plugin:trust-demo",
+            name="trust-demo",
+            harness="codex",
+            artifact_type="plugin",
+            source_scope="project",
+            config_path=str(plugin_dir),
+        ),
+        generated_at="2026-06-10T12:00:00+00:00",
+        home_dir=tmp_path,
+        workspace_dir=plugin_dir,
+        cisco_runs=(first_cisco_run,),
+    )
+    second_snapshot = _snapshot_for_artifact(
+        artifact=GuardArtifact(
+            artifact_id="codex:project:plugin:trust-demo",
+            name="trust-demo",
+            harness="codex",
+            artifact_type="plugin",
+            source_scope="project",
+            config_path=str(plugin_dir),
+        ),
+        generated_at="2026-06-10T12:05:00+00:00",
+        home_dir=tmp_path,
+        workspace_dir=plugin_dir,
+        cisco_runs=(replayed_cisco_run,),
+    )
+
+    assert second_snapshot.snapshot_id == first_snapshot.snapshot_id
+
+    changed_snapshot = _snapshot_for_artifact(
+        artifact=GuardArtifact(
+            artifact_id="codex:project:plugin:trust-demo-renamed",
+            name="trust-demo-renamed",
+            harness="codex",
+            artifact_type="plugin",
+            source_scope="project",
+            config_path=str(plugin_dir),
+        ),
+        generated_at="2026-06-10T12:10:00+00:00",
+        home_dir=tmp_path,
+        workspace_dir=plugin_dir,
+        cisco_runs=(replayed_cisco_run,),
+    )
+
+    assert changed_snapshot.snapshot_id != first_snapshot.snapshot_id
 
 
 def test_guard_evidence_hash_is_stable_across_key_order() -> None:

plugin_scanner-2.0.958/tests/test_guard_receipt_redaction_cursor.py

@@ -0,0 +1,150 @@
+from __future__ import annotations
+
+from codex_plugin_scanner.guard.config import update_guard_settings
+from codex_plugin_scanner.guard.runtime.runner import (
+    _RELAXED_RECEIPT_REDACTION_RESYNC_MARKER,
+    _ensure_relaxed_receipt_redaction_resync,
+    _persist_cloud_receipt_redaction_level,
+)
+from codex_plugin_scanner.guard.store import GuardStore
+
+
+def test_cloud_receipt_redaction_relaxation_resets_receipt_cursor_before_storing_level(tmp_path) -> None:
+    store = GuardStore(tmp_path)
+    writes: list[tuple[str, dict[str, object], str]] = []
+    original_set_sync_payload = store.set_sync_payload
+
+    def record_set_sync_payload(state_key: str, payload: dict[str, object], now: str) -> None:
+        writes.append((state_key, payload, now))
+        original_set_sync_payload(state_key, payload, now)
+
+    store.set_sync_payload = record_set_sync_payload  # type: ignore[method-assign]
+    original_set_sync_payload(
+        "receipt_sync_cursor",
+        {"last_rowid": 17, "synced_at": "2026-04-15T00:00:00Z"},
+        "2026-04-15T00:00:00Z",
+    )
+
+    _persist_cloud_receipt_redaction_level(
+        store,
+        level="none",
+        synced_at="2026-04-15T00:01:00Z",
+    )
+
+    assert [write[0] for write in writes] == [
+        "receipt_sync_cursor",
+        "cloud_receipt_redaction_level",
+        _RELAXED_RECEIPT_REDACTION_RESYNC_MARKER,
+    ]
+    assert store.get_sync_payload("cloud_receipt_redaction_level") == {
+        "level": "none",
+        "updated_at": "2026-04-15T00:01:00Z",
+    }
+    assert store.get_sync_payload(_RELAXED_RECEIPT_REDACTION_RESYNC_MARKER) == {
+        "level": "none",
+        "updated_at": "2026-04-15T00:01:00Z",
+    }
+    assert store.get_sync_payload("receipt_sync_cursor") == {
+        "last_rowid": 0,
+        "synced_at": "2026-04-15T00:01:00Z",
+        "reason": "cloud_receipt_redaction_level_relaxed",
+        "receipt_redaction_level": "none",
+    }
+
+
+def test_cloud_receipt_redaction_tightening_keeps_receipt_cursor(tmp_path) -> None:
+    store = GuardStore(tmp_path)
+    store.set_sync_payload(
+        "cloud_receipt_redaction_level",
+        {"level": "none", "updated_at": "2026-04-15T00:00:00Z"},
+        "2026-04-15T00:00:00Z",
+    )
+    store.set_sync_payload(
+        "receipt_sync_cursor",
+        {"last_rowid": 17, "synced_at": "2026-04-15T00:00:00Z"},
+        "2026-04-15T00:00:00Z",
+    )
+
+    _persist_cloud_receipt_redaction_level(
+        store,
+        level="full",
+        synced_at="2026-04-15T00:01:00Z",
+    )
+
+    assert store.get_sync_payload("cloud_receipt_redaction_level") == {
+        "level": "full",
+        "updated_at": "2026-04-15T00:01:00Z",
+    }
+    assert store.get_sync_payload("receipt_sync_cursor") == {
+        "last_rowid": 17,
+        "synced_at": "2026-04-15T00:00:00Z",
+    }
+
+
+def test_existing_relaxed_receipt_redaction_resets_cursor_once(tmp_path) -> None:
+    store = GuardStore(tmp_path / "guard.db")
+    store.set_sync_payload(
+        "cloud_receipt_redaction_level",
+        {"level": "none", "updated_at": "2026-04-15T00:00:00Z"},
+        "2026-04-15T00:00:00Z",
+    )
+    store.set_sync_payload(
+        "receipt_sync_cursor",
+        {"last_rowid": 42, "synced_at": "2026-04-15T00:00:00Z"},
+        "2026-04-15T00:00:00Z",
+    )
+
+    _ensure_relaxed_receipt_redaction_resync(
+        store,
+        level="none",
+        synced_at="2026-04-15T00:01:00Z",
+    )
+
+    assert store.get_sync_payload("receipt_sync_cursor") == {
+        "last_rowid": 0,
+        "synced_at": "2026-04-15T00:01:00Z",
+        "reason": "cloud_receipt_redaction_level_relaxed_existing",
+        "receipt_redaction_level": "none",
+    }
+    assert store.get_sync_payload(_RELAXED_RECEIPT_REDACTION_RESYNC_MARKER) == {
+        "level": "none",
+        "updated_at": "2026-04-15T00:01:00Z",
+    }
+
+    _ensure_relaxed_receipt_redaction_resync(
+        store,
+        level="none",
+        synced_at="2026-04-15T00:02:00Z",
+    )
+
+    assert store.get_sync_payload("receipt_sync_cursor") == {
+        "last_rowid": 0,
+        "synced_at": "2026-04-15T00:01:00Z",
+        "reason": "cloud_receipt_redaction_level_relaxed_existing",
+        "receipt_redaction_level": "none",
+    }
+
+
+def test_first_cloud_redaction_level_matches_relaxed_local_config_without_cursor_reset(tmp_path) -> None:
+    store = GuardStore(tmp_path)
+    update_guard_settings(tmp_path, {"receipt_redaction_level": "none"})
+    store.set_sync_payload(
+        "receipt_sync_cursor",
+        {"last_rowid": 17, "synced_at": "2026-04-15T00:00:00Z"},
+        "2026-04-15T00:00:00Z",
+    )
+
+    _persist_cloud_receipt_redaction_level(
+        store,
+        level="none",
+        synced_at="2026-04-15T00:01:00Z",
+    )
+
+    assert store.get_sync_payload("cloud_receipt_redaction_level") == {
+        "level": "none",
+        "updated_at": "2026-04-15T00:01:00Z",
+    }
+    assert store.get_sync_payload("receipt_sync_cursor") == {
+        "last_rowid": 17,
+        "synced_at": "2026-04-15T00:00:00Z",
+    }

{plugin_scanner-2.0.956 → plugin_scanner-2.0.958}/uv.lock

@@ -1162,7 +1162,7 @@ wheels = [
 
 [[package]]
 name = "hol-guard"
-version = "2.0.956"
+version = "2.0.958"
 source = { editable = "." }
 dependencies = [
     { name = "cisco-ai-skill-scanner", marker = "python_full_version < '3.14'" },