secure-code-agent 0.12.10__tar.gz → 0.12.11__tar.gz

{secure_code_agent-0.12.10/src/secure_code_agent.egg-info → secure_code_agent-0.12.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.10
+Version: 0.12.11
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -30,11 +30,11 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: PyYAML<7,>=6.0.2
 Provides-Extra: mcp
-Requires-Dist: mcp<2,>=1.0; extra == "mcp"
+Requires-Dist: mcp<3,>=1.0; extra == "mcp"
 Provides-Extra: required-scanners
 Requires-Dist: bandit==1.9.4; extra == "required-scanners"
 Requires-Dist: pip-audit==2.10.1; extra == "required-scanners"
-Requires-Dist: njsscan==1.0.0; extra == "required-scanners"
+Requires-Dist: njsscan==1.0.1; extra == "required-scanners"
 Provides-Extra: python-scanners
 Requires-Dist: secure-code-agent[required-scanners]; extra == "python-scanners"
 Requires-Dist: semgrep<2,>=1.172; extra == "python-scanners"
@@ -43,7 +43,8 @@ Provides-Extra: dev
 Requires-Dist: secure-code-agent[required-scanners]; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0; extra == "dev"
-Requires-Dist: ruff==0.16.2; extra == "dev"
+Requires-Dist: ruff==0.16.9; extra == "dev"
+Requires-Dist: markdown>=3.5; extra == "dev"
 Dynamic: license-file
 
 # secure-code-agent
@@ -454,6 +455,44 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
 
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
+## Extending the standards mapping
+
+The shipped mapping table lives in `data/standards.yaml` and covers the rules
+this project curates. Semgrep alone publishes thousands, so point
+`standards_overlay` at your own file to map or correct a rule without waiting
+for a release:
+
+```json
+{ "standards_overlay": "security/standards-overlay.yaml" }
+```
+
+```yaml
+version: 1
+entries:
+  - scanner: semgrep
+    rule_id: python.lang.security.audit.my-rule
+    canonical_cwe: CWE-22
+    owasp_top10: A01
+    asvs_section: V12.3.1
+    nist_ssdf: PW.5.1
+    short_desc: Path traversal in our request handler.
+    fix_hint: Resolve the path and contain it under the upload root.
+```
+
+An overlay entry wins over the shipped table for the fields it sets, and an
+adapter asserting its own CWE still wins over both.
+
+**An overlay cannot set `severity`, `confidence` or `category`**, and a file
+that tries is refused with the reason rather than ignored. Those three are the
+scoring inputs: an overlay that set them could move the grade, which is the
+hole [D32](docs/decisions.md) closed on the configuration side. An overlay says
+*what weakness a rule describes*; it does not say *how much it counts*. Set
+severity policy with `severity_overrides` in a config kept outside the audited
+tree.
+
+A declared overlay that cannot be read fails the run rather than being skipped,
+for the same reason a malformed `.scignore.yaml` does.
+
 ## Baseline + incremental adoption
 
 `secure-code-baseline.json` fingerprints every current finding. On the next run:
@@ -515,7 +554,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.10
+- uses: marshallguillory86/secure-code-agent@v0.12.11
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.10 → secure_code_agent-0.12.11}/README.md

@@ -406,6 +406,44 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
 
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
+## Extending the standards mapping
+
+The shipped mapping table lives in `data/standards.yaml` and covers the rules
+this project curates. Semgrep alone publishes thousands, so point
+`standards_overlay` at your own file to map or correct a rule without waiting
+for a release:
+
+```json
+{ "standards_overlay": "security/standards-overlay.yaml" }
+```
+
+```yaml
+version: 1
+entries:
+  - scanner: semgrep
+    rule_id: python.lang.security.audit.my-rule
+    canonical_cwe: CWE-22
+    owasp_top10: A01
+    asvs_section: V12.3.1
+    nist_ssdf: PW.5.1
+    short_desc: Path traversal in our request handler.
+    fix_hint: Resolve the path and contain it under the upload root.
+```
+
+An overlay entry wins over the shipped table for the fields it sets, and an
+adapter asserting its own CWE still wins over both.
+
+**An overlay cannot set `severity`, `confidence` or `category`**, and a file
+that tries is refused with the reason rather than ignored. Those three are the
+scoring inputs: an overlay that set them could move the grade, which is the
+hole [D32](docs/decisions.md) closed on the configuration side. An overlay says
+*what weakness a rule describes*; it does not say *how much it counts*. Set
+severity policy with `severity_overrides` in a config kept outside the audited
+tree.
+
+A declared overlay that cannot be read fails the run rather than being skipped,
+for the same reason a malformed `.scignore.yaml` does.
+
 ## Baseline + incremental adoption
 
 `secure-code-baseline.json` fingerprints every current finding. On the next run:
@@ -467,7 +505,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.10
+- uses: marshallguillory86/secure-code-agent@v0.12.11
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.10 → secure_code_agent-0.12.11}/pyproject.toml

@@ -53,7 +53,7 @@ dependencies = [
 # server drives it by subprocess rather than reimplementing it — so nobody
 # who only wants the gate pays for an MCP dependency.
 mcp = [
-  "mcp>=1.0,<2",
+  "mcp>=1.0,<3",
 ]
 
 # Scanners the default configuration lists in gates.require_scanners. Pinned
@@ -66,7 +66,7 @@ required-scanners = [
   # rules, so a JavaScript repository can be scanned on a host with no Node.
   # Pinned for the same reason as the rest: the floor is a claim about what
   # ran, and an unpinned ruleset makes that claim unreproducible.
-  "njsscan==1.0.0",
+  "njsscan==1.0.1",
 ]
 # The remaining Python-packaged scanners. Bounded rather than pinned because
 # they are optional; the coverage gate does not require them by default.
@@ -87,7 +87,12 @@ dev = [
   "secure-code-agent[required-scanners]",
   "pytest>=8.0",
   "pytest-cov>=4.0",
-  "ruff==0.16.2",
+  "ruff==0.16.9",
+  # Renders docs/html, the reading copy of every document in the repository.
+  # A dev dependency, not a runtime one: the audit never renders documentation,
+  # and tests/unit/test_rendered_docs.py is what keeps the committed copy
+  # current. See tools/render_docs.py.
+  "markdown>=3.5",
 ]
 
 [project.scripts]
@@ -133,14 +138,41 @@ ignore = ["E501"]  # let line-length be a soft guide; long log strings are fine
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
-addopts = "-q --strict-markers"
+# Coverage is on by default, so the declared test command — plain `pytest`,
+# which is what maintainability-agent runs — reports it and the
+# `fail_under` below actually applies. Without this the suite was
+# measurable only by whoever remembered the flags, and MA scored
+# test_effectiveness as "not measurable" on every run.
+#
+# `xml` is not decoration: a consumer reads the *artifact*, never stdout.
+# MA looks for `coverage.xml`, `coverage/lcov.info` or `lcov.info` and
+# requires it to be newer than the moment before it ran the suite, so a
+# repository cannot hand it a committed report and set its own
+# test_effectiveness. With `term` alone the number was printed for humans
+# and invisible to every tool, which is the same defect one layer down.
+# `coverage.xml` is gitignored.
+#
+# A step that is not the one measuring passes `--no-cov`;
+# tests/unit/test_one_coverage_floor.py requires every CI invocation to say
+# which it is.
+addopts = "-q --strict-markers --cov=secure_code_audit --cov-branch --cov-report=term --cov-report=xml"
+# The suite tests this checkout, never an installed copy. Without it, bare
+# `pytest` imports whichever secure_code_audit the interpreter can find, and
+# an environment holding a plain install grades code nobody is editing —
+# which is how maintainability-agent came to report a bug fixed in #59.
+pythonpath = ["src"]
 
 [tool.coverage.run]
 source = ["secure_code_audit"]
 branch = true
 
 [tool.coverage.report]
-fail_under = 85
+# The house floor. Raised 85 -> 92 once the suite could actually clear it:
+# measured 93.79% branch coverage after the test seat covered --verify-against
+# (which had no test through main() at all), the four live-config keys, and the
+# loader's fail-closed paths. Raising it while the suite sat at 90.42% would
+# have bought a red build and no tests.
+fail_under = 92
 exclude_lines = [
   "pragma: no cover",
   "if __name__ == .__main__.:",

{secure_code_agent-0.12.10 → secure_code_agent-0.12.11/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.10
+Version: 0.12.11
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -30,11 +30,11 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: PyYAML<7,>=6.0.2
 Provides-Extra: mcp
-Requires-Dist: mcp<2,>=1.0; extra == "mcp"
+Requires-Dist: mcp<3,>=1.0; extra == "mcp"
 Provides-Extra: required-scanners
 Requires-Dist: bandit==1.9.4; extra == "required-scanners"
 Requires-Dist: pip-audit==2.10.1; extra == "required-scanners"
-Requires-Dist: njsscan==1.0.0; extra == "required-scanners"
+Requires-Dist: njsscan==1.0.1; extra == "required-scanners"
 Provides-Extra: python-scanners
 Requires-Dist: secure-code-agent[required-scanners]; extra == "python-scanners"
 Requires-Dist: semgrep<2,>=1.172; extra == "python-scanners"
@@ -43,7 +43,8 @@ Provides-Extra: dev
 Requires-Dist: secure-code-agent[required-scanners]; extra == "dev"
 Requires-Dist: pytest>=8.0; extra == "dev"
 Requires-Dist: pytest-cov>=4.0; extra == "dev"
-Requires-Dist: ruff==0.16.2; extra == "dev"
+Requires-Dist: ruff==0.16.9; extra == "dev"
+Requires-Dist: markdown>=3.5; extra == "dev"
 Dynamic: license-file
 
 # secure-code-agent
@@ -454,6 +455,44 @@ for repositories whose `pyproject.toml` is their authoritative audit input.
 
 Wildcard rule (`rule_id: "*"`) requires a `file` or `paths` scope — you cannot disable a rule globally.
 
+## Extending the standards mapping
+
+The shipped mapping table lives in `data/standards.yaml` and covers the rules
+this project curates. Semgrep alone publishes thousands, so point
+`standards_overlay` at your own file to map or correct a rule without waiting
+for a release:
+
+```json
+{ "standards_overlay": "security/standards-overlay.yaml" }
+```
+
+```yaml
+version: 1
+entries:
+  - scanner: semgrep
+    rule_id: python.lang.security.audit.my-rule
+    canonical_cwe: CWE-22
+    owasp_top10: A01
+    asvs_section: V12.3.1
+    nist_ssdf: PW.5.1
+    short_desc: Path traversal in our request handler.
+    fix_hint: Resolve the path and contain it under the upload root.
+```
+
+An overlay entry wins over the shipped table for the fields it sets, and an
+adapter asserting its own CWE still wins over both.
+
+**An overlay cannot set `severity`, `confidence` or `category`**, and a file
+that tries is refused with the reason rather than ignored. Those three are the
+scoring inputs: an overlay that set them could move the grade, which is the
+hole [D32](docs/decisions.md) closed on the configuration side. An overlay says
+*what weakness a rule describes*; it does not say *how much it counts*. Set
+severity policy with `severity_overrides` in a config kept outside the audited
+tree.
+
+A declared overlay that cannot be read fails the run rather than being skipped,
+for the same reason a malformed `.scignore.yaml` does.
+
 ## Baseline + incremental adoption
 
 `secure-code-baseline.json` fingerprints every current finding. On the next run:
@@ -515,7 +554,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.10
+- uses: marshallguillory86/secure-code-agent@v0.12.11
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.10 → secure_code_agent-0.12.11}/src/secure_code_agent.egg-info/SOURCES.txt

@@ -31,7 +31,11 @@ src/secure_code_audit/suppressions.py
 src/secure_code_audit/triage.py
 src/secure_code_audit/verify.py
 src/secure_code_audit/data/semgrep-offline.yaml
+src/secure_code_audit/data/standards.yaml
 src/secure_code_audit/scanners/__init__.py
+src/secure_code_audit/scanners/_execution.py
+src/secure_code_audit/scanners/_finding_builder.py
+src/secure_code_audit/scanners/_resolution.py
 src/secure_code_audit/scanners/bandit_scanner.py
 src/secure_code_audit/scanners/base.py
 src/secure_code_audit/scanners/builtin_rules.py

{secure_code_agent-0.12.10 → secure_code_agent-0.12.11}/src/secure_code_agent.egg-info/requires.txt

@@ -4,10 +4,11 @@ PyYAML<7,>=6.0.2
 secure-code-agent[required-scanners]
 pytest>=8.0
 pytest-cov>=4.0
-ruff==0.16.2
+ruff==0.16.9
+markdown>=3.5
 
 [mcp]
-mcp<2,>=1.0
+mcp<3,>=1.0
 
 [python-scanners]
 secure-code-agent[required-scanners]
@@ -17,4 +18,4 @@ checkov<4,>=3.3
 [required-scanners]
 bandit==1.9.4
 pip-audit==2.10.1
-njsscan==1.0.0
+njsscan==1.0.1

{secure_code_agent-0.12.10 → secure_code_agent-0.12.11}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.10"
+__version__ = "0.12.11"

{secure_code_agent-0.12.10 → secure_code_agent-0.12.11}/src/secure_code_audit/cli.py

@@ -21,6 +21,7 @@ from secure_code_audit import (
     renderers,
     sarif,
     scanners,
+    standards,
     suppressions,
     triage,
 )
@@ -361,87 +362,43 @@ def _print_preflight(rows: list[dict], unselected: list[str], blocking: list[str
         print("  all required scanners resolved")
 
 
-def _do_audit(args: argparse.Namespace) -> int:
-    cfg, target, root = _prepare_audit(args)
-    _require_configured_gates(args, cfg)
-    # Before anything is resolved or written, and before any scanner runs.
-    _assert_config_writes_are_contained(cfg, root, target)
-    # Resolved before the scan so the run can recognise its own artifacts.
-    paths = _resolve_outputs(args, cfg, root)
-
-    # ----- scanners -----
-    scan = _run_scanners(args, cfg, target)
-    all_findings = scan.findings
-    ran, unavailable, executions = scan.ran, scan.unavailable, scan.executions
-
-    # ----- SARIF imports -----
-    # An imported SARIF is coverage: a scanner someone else ran on our behalf.
-    imported, imported_executions = _ingest_sarif_imports(args.sarif_import)
-    all_findings.extend(imported)
-    executions.extend(imported_executions)
-
-    # ----- one path convention, before anything reads a path -----
-    # Repository-relative from here on, whichever tool reported the finding.
-    # Suppressions, the baseline and every written output compare or publish
-    # this path, and none of them may depend on where the checkout lives.
-    scanned = target if target.is_dir() else target.parent
-    all_findings = anchor(all_findings, scanned=scanned, root=root)
-
-    # ----- scan scope, enforced once -----
-    own_artifacts = _own_artifacts(paths, cfg, root)
-    all_findings = _drop_excluded(all_findings, target, cfg, own_artifacts, root)
-
-    # ----- one weakness, one finding -----
-    # Before overrides and suppressions, so an operator writing either one
-    # sees the same finding the report will show. Bandit's B308 and B703 are
-    # the same check under two ids and shared fifty lines in Django; a report
-    # that lists a line twice is wrong about the code, and a work order built
-    # from it would ask for the same fix twice.
-    all_findings = merge_corroborating(all_findings)
-
-    # ----- overrides from config -----
-    all_findings = _apply_overrides(all_findings, cfg)
-
-    # ----- suppressions -----
-    suppression_path = _under_root(root, cfg.suppressions_file)
-    sup_rules, sup_errors = suppressions.load(suppression_path)
-    if sup_errors:
-        # Fail closed. A suppression file that exists is an explicit
-        # instruction; ignoring it silently changes which findings are
-        # reported, and "my suppressions are working" then looks exactly
-        # like "my suppressions were skipped". This bit in practice: a
-        # missing PyYAML made an entire .scignore.yaml a no-op while the
-        # run still exited 0 and reported the suppressed finding as live.
-        #
-        # Only reachable when the file is present, so repositories that
-        # do not use suppressions are unaffected.
-        for err in sup_errors:
-            sys.stderr.write(f"ERROR: {err}\n")
-        sys.stderr.write(
-            f"ERROR: {suppression_path} exists but could not be applied; refusing to "
-            "report results that silently ignore it.\n"
-        )
-        return 1
-    all_findings = suppressions.apply(all_findings, sup_rules, root)
-    all_findings.extend(
-        anchor(
-            suppressions.expired_findings(sup_rules, suppression_path),
-            scanned=scanned,
-            root=root,
-        )
-    )
-
-    # ----- severity threshold filter -----
-    threshold = Severity.from_string(args.severity_threshold)
-    all_findings = [f for f in all_findings if f.severity.rank >= threshold.rank]
+@dataclass(frozen=True)
+class _Axes:
+    """What the axis split produced, and the LOC that goes with it.
 
-    # ----- baseline -----
-    baseline_path = _under_root(root, args.baseline or cfg.outputs["baseline_path"])
-    baseline = baseline_mod.load(baseline_path)
-    baseline_state = baseline_mod.state(baseline_path)
-    all_findings = baseline_mod.mark_new(all_findings, baseline, root)
+    Seven values travelled together as seven locals inside a 346-line
+    function; a dataclass is what they were already.
+    """
 
-    # ----- scoring -----
+    primary: list[Finding]
+    test: list[Finding]
+    docs: list[Finding]
+    #: Kept whole as well as split: `declared_axes` reads it by name for the
+    #: capability axes, which are not a fixed set.
+    path_axes: dict[str, list[Finding]]
+    all_findings: list[Finding]
+    loc: int
+    test_loc: int
+    docs_loc: int
+    changed_note: str | None
+
+
+def _split_axes(
+    all_findings: list[Finding],
+    args: argparse.Namespace,
+    cfg: config_mod.Config,
+    target: Path,
+    root: Path,
+    own_artifacts: frozenset[Path],
+) -> _Axes:
+    """Partition findings by axis and measure each axis's LOC.
+
+    Lifted whole out of `_do_audit`, which was 346 lines at complexity 36
+    against configured limits of 80 and 15. The checks, their order and
+    their comments are unchanged: this is a move, not a rewrite, because a
+    rewrite of the axis split is how a repository gets graded on its test
+    fixtures and the corpus has already shown what that costs.
+    """
     # The test tree is reported, not scored. A project graded on its test
     # fixtures is graded on the wrong thing: across the calibration corpus,
     # including test directories moved the median normalized subtotal from
@@ -522,6 +479,124 @@ def _do_audit(args: argparse.Namespace) -> int:
             own_artifacts,
             cfg.docs_patterns,
         )
+
+    return _Axes(
+        primary=primary_findings,
+        test=test_findings,
+        docs=docs_findings,
+        path_axes=path_axes,
+        all_findings=all_findings,
+        loc=loc,
+        test_loc=test_loc,
+        docs_loc=docs_loc,
+        changed_note=changed_note,
+    )
+
+
+def _do_audit(args: argparse.Namespace) -> int:
+    cfg, target, root = _prepare_audit(args)
+    # Before any consumer reads them: the audited tree does not grade itself.
+    cfg = _refuse_target_policy(cfg, target)
+    _require_configured_gates(args, cfg)
+    if (failed := _install_standards_overlay(cfg, root)) is not None:
+        return failed
+    # Before anything is resolved or written, and before any scanner runs.
+    _assert_config_writes_are_contained(cfg, root, target)
+    # Resolved before the scan so the run can recognise its own artifacts.
+    paths = _resolve_outputs(args, cfg, root)
+
+    # ----- scanners -----
+    scan = _run_scanners(args, cfg, target)
+    all_findings = scan.findings
+    ran, unavailable, executions = scan.ran, scan.unavailable, scan.executions
+
+    # ----- SARIF imports -----
+    # An imported SARIF is coverage: a scanner someone else ran on our behalf.
+    imported, imported_executions = _ingest_sarif_imports(args.sarif_import)
+    all_findings.extend(imported)
+    executions.extend(imported_executions)
+
+    # ----- one path convention, before anything reads a path -----
+    # Repository-relative from here on, whichever tool reported the finding.
+    # Suppressions, the baseline and every written output compare or publish
+    # this path, and none of them may depend on where the checkout lives.
+    scanned = target if target.is_dir() else target.parent
+    all_findings = anchor(all_findings, scanned=scanned, root=root)
+
+    # ----- scan scope, enforced once -----
+    own_artifacts = _own_artifacts(paths, cfg, root)
+    all_findings = _drop_excluded(all_findings, target, cfg, own_artifacts, root)
+
+    # ----- one weakness, one finding -----
+    # Before overrides and suppressions, so an operator writing either one
+    # sees the same finding the report will show. Bandit's B308 and B703 are
+    # the same check under two ids and shared fifty lines in Django; a report
+    # that lists a line twice is wrong about the code, and a work order built
+    # from it would ask for the same fix twice.
+    all_findings = merge_corroborating(all_findings)
+
+    # ----- overrides from config -----
+    all_findings = _apply_overrides(all_findings, cfg)
+
+    # ----- suppressions -----
+    suppression_path = _under_root(root, cfg.suppressions_file)
+    sup_rules, sup_errors = suppressions.load(suppression_path)
+    if sup_errors:
+        # Fail closed. A suppression file that exists is an explicit
+        # instruction; ignoring it silently changes which findings are
+        # reported, and "my suppressions are working" then looks exactly
+        # like "my suppressions were skipped". This bit in practice: a
+        # missing PyYAML made an entire .scignore.yaml a no-op while the
+        # run still exited 0 and reported the suppressed finding as live.
+        #
+        # Only reachable when the file is present, so repositories that
+        # do not use suppressions are unaffected.
+        for err in sup_errors:
+            sys.stderr.write(f"ERROR: {err}\n")
+        sys.stderr.write(
+            f"ERROR: {suppression_path} exists but could not be applied; refusing to "
+            "report results that silently ignore it.\n"
+        )
+        return 1
+    all_findings = suppressions.apply(all_findings, sup_rules, root)
+    # Snapshot the scanner findings before the synthetic ones are appended.
+    # `unused_findings` asks whether each rule still has a subject, and a
+    # wildcard rule with `paths` would happily match the expired-suppression
+    # finding about `.scignore.yaml` itself — reporting itself as used
+    # because it matched a finding about suppressions.
+    scanner_findings = list(all_findings)
+    all_findings.extend(
+        anchor(
+            suppressions.expired_findings(sup_rules, suppression_path),
+            scanned=scanned,
+            root=root,
+        )
+    )
+    all_findings.extend(
+        anchor(
+            suppressions.unused_findings(sup_rules, scanner_findings, suppression_path, root),
+            scanned=scanned,
+            root=root,
+        )
+    )
+
+    # ----- severity threshold filter -----
+    threshold = Severity.from_string(args.severity_threshold)
+    all_findings = [f for f in all_findings if f.severity.rank >= threshold.rank]
+
+    # ----- baseline -----
+    baseline_path = _under_root(root, args.baseline or cfg.outputs["baseline_path"])
+    baseline = baseline_mod.load(baseline_path)
+    baseline_state = baseline_mod.state(baseline_path)
+    all_findings = baseline_mod.mark_new(all_findings, baseline, root)
+
+    # ----- scoring -----
+    _axes = _split_axes(all_findings, args, cfg, target, root, own_artifacts)
+    all_findings = _axes.all_findings
+    primary_findings, test_findings, docs_findings = _axes.primary, _axes.test, _axes.docs
+    path_axes = _axes.path_axes
+    loc, test_loc, docs_loc = _axes.loc, _axes.test_loc, _axes.docs_loc
+    changed_note = _axes.changed_note
     # Dependencies come off the code-condition score and onto their own axis.
     # A CVE in a pinned dependency is fixed with a version bump; an injection
     # flaw is fixed with a rewrite. Averaging them produced the largest
@@ -1070,6 +1145,78 @@ def _write_outputs(
         pillar_mod.write(pillar, paths.security_pillar)
 
 
+def _install_standards_overlay(cfg: config_mod.Config, root: Path) -> int | None:
+    """Layer the operator's standards mapping over the shipped table.
+
+    Returns an exit code when the overlay cannot be applied, else None.
+
+    Fails closed, for the same reason a malformed suppressions file does: the
+    operator named a mapping file, so running without it reports findings
+    under the standards nobody chose — unmapped where they should be mapped,
+    and no louder than a rule nobody has curated. Reachable only when the key
+    is set, so repositories that do not use an overlay are unaffected.
+    """
+    if not cfg.standards_overlay:
+        return None
+    path = _under_root(root, cfg.standards_overlay)
+    entries, errors = standards.load_overlay(path)
+    if errors:
+        for err in errors:
+            sys.stderr.write(f"ERROR: {err}\n")
+        sys.stderr.write(
+            f"ERROR: standards_overlay {path} is declared but could not be applied; "
+            "refusing to report findings mapped by a table the operator did not choose.\n"
+        )
+        return 1
+    standards.install_overlay(entries)
+    return None
+
+
+#: Config keys that move the grade, and so may not come from the audited tree.
+#: `severity_overrides` sets a finding's weight — `INFORMATIONAL` is 0.0 in
+#: `SEVERITY_WEIGHT`, so re-labelling removes a finding from the score while
+#: leaving it in the report. `category_overrides` moves it between the
+#: per-category rates, and the worst category drives the overall.
+_GRADING_KEYS = ("severity_overrides", "category_overrides")
+
+
+def _refuse_target_policy(cfg: config_mod.Config, target: Path) -> config_mod.Config:
+    """Drop grading keys supplied by the audited tree. Returns the config to use.
+
+    D29 settled that a config the tree supplies does not choose a scanner's
+    command. It said nothing about what that config may claim about the
+    findings, and these two keys were applied from any config, including one
+    discovered inside the tree, with no `--trust-target-config`.
+
+    Measured on one `subprocess` call made with `shell=True` — paraphrased
+    rather than quoted, because this repository audits its own source and
+    the verbatim expression trips `sca.python.subprocess.shell_true` here,
+    in shipped code, where it is scored: 0.00/F honestly, and
+    5.00/A+ with an in-tree `severity_overrides` mapping B602 to
+    informational. The audited party moved its own grade, which is §4
+    criterion 1 falsifiable by the one actor with a motive, and promise P3
+    from the other side — P3 refuses an input whose *removal* raises the
+    graded field, and this is one whose *addition* raises it.
+
+    Not silent, and not fatal. A repository may carry this config for its
+    own operator's use, and that operator says so with
+    `--trust-target-config` or by keeping the config outside the tree —
+    exactly the two routes that already work for a command.
+    """
+    if not config_mod.target_config_is_untrusted(cfg, target):
+        return cfg
+    ignored = [key for key in _GRADING_KEYS if getattr(cfg, key)]
+    if not ignored:
+        return cfg
+    for key in ignored:
+        sys.stderr.write(
+            f"WARNING: {key} in {cfg.source_path} is inside the audited tree and "
+            f"changes the grade, so it was ignored. Pass --trust-target-config, or "
+            f"keep the configuration outside the tree, to apply it.\n"
+        )
+    return replace(cfg, severity_overrides={}, category_overrides={})
+
+
 def _apply_overrides(findings: list[Finding], cfg: config_mod.Config) -> list[Finding]:
     """Apply config-level severity_overrides + category_overrides."""
     if not cfg.severity_overrides and not cfg.category_overrides: