[S5] Discovery: security.txt, CSAF provider metadata, /.well-known/tea record, repo links, reviewer-supplied SBOM/VEX #13

Activity

1. hsinatfootprintai

   added

   enhancementNew feature or requestNew feature or request

   runtime:claudeWork runs under the Claude Code CLIWork runs under the Claude Code CLI

   size:MSize estimateSize estimate

   phase-2-optimizeMakes the working flow better or completeMakes the working flow better or complete

   needs-verificationCannot be proven by CI — verify against a deployed environmentCannot be proven by CI — verify against a deployed environment

   needs-decisionWaiting on a human decision — not implementable until answeredWaiting on a human decision — not implementable until answered

   and removed

   needs-decisionWaiting on a human decision — not implementable until answeredWaiting on a human decision — not implementable until answered

   on Oct 22, 2026
2. hsinatfootprintai commented on Oct 22, 2026

   

   hsinatfootprintai

   on Oct 22, 2026

   ContributorAuthor

   More actions

   Decision (Q3 on #17, default accepted by @hsinatfootprintai, 2026-10-22): this issue adds the reviewer-supplied SBOM/VEX input everywhere: CLI flags, ScanRequest.sbom_url/sbom_document, and an upload + URL field on the web page. Acceptance criterion 3 is updated. If #9 hasn't merged when this starts, build against its page component and rebase. Issue is ready.
3. hsinatfootprintai

   added

   agent:ready

   on Oct 25, 2026
4. containarium-ci commented on Oct 25, 2026

   

   containarium-ciBot

   on Oct 25, 2026

   Contributor

   More actions

   This issue was not handed to an agent because the repository's default user has no box that accepts issue runs with a signed-in agent right now. Nothing was changed. Next: open a workspace session on a box that accepts issue runs, then re-add the trigger label.

   — run 5e737080
5. hsinatfootprintai

   added

   agent:ready

   and removed

   agent:ready

   on Oct 26, 2026
6. containarium-ci commented on Oct 26, 2026

   

   containarium-ciBot

   on Oct 26, 2026

   Contributor

   More actions

   This issue was not handed to an agent because the repository's default user has no box that accepts issue runs with a signed-in agent right now. Nothing was changed. Next: open a workspace session on a box that accepts issue runs, then re-add the trigger label.

   — run a13fb610
7. hsinatfootprintai

   added

   agent:ready

   and removed

   agent:ready

   on Oct 26, 2026
8. containarium-ci

   added

   agent:runningSet by the platform: the agent run is workingSet by the platform: the agent run is working

   on Oct 26, 2026
9. containarium-ci commented on Oct 26, 2026

   

   containarium-ciBot

   on Oct 26, 2026

   Contributor

   More actions

   The agent on the box this repository sends issues to has picked this issue up. It works on its own branch and cannot push; when it finishes, the platform checks what it produced and, if that passes, opens it as a pull request for review.

   Next: reply @containarium status to check on it, or @containarium stop to cancel it.

   — run 365bb550
10. containarium-ci

    added a commit that references this issue on Oct 26, 2026

    Agent proposal: [S5] Discovery: security.txt, CSAF provider metadata,…

    ...

    163773f
11. containarium-ci

    added

    agent:doneSet by the platform: the agent run finishedSet by the platform: the agent run finished

    and removed

    agent:runningSet by the platform: the agent run is workingSet by the platform: the agent run is working

    on Oct 26, 2026
12. containarium-ci commented on Oct 26, 2026

    

    containarium-ciBot

    on Oct 26, 2026

    Contributor

    More actions

    The agent proposed a change for this issue: #30

    It was produced on a member's box and has not been built or tested by the platform. It is a pull request for a person to review; nothing is merged automatically.

    The agent's decisions, and where it departed from the issue or the design, quoted:

    1. Tests, go vet and staticcheck were NOT run (go/npm not executable here) and no commit was made
       (git commit needed approval); changes are staged on agent/issue-13. Expect CI to be the first
       compile and test run.
    2. Added a minimal internal/sbom (CycloneDX, SPDX, OpenVEX, CSAF VEX component extraction) because
       S4 is not in the repo yet; it reads components only, so VEX statements are not applied to
       vulnerabilities (S4 scope).
    3. CSAF VEX documents are found only via ROLIE feeds named in provider-metadata.json (max 3 feeds,
       10 documents); changes.csv and directory listings are not fetched, since the design forbids
       synthesized paths.
    4. The reviewer-supplied sbom_url is fetched as a DECLARED request, so it appears in checked and
       counts against the request budget and SSRF guard; the design has no separate reason for it.
       Uploads are capped at 2 MiB.
    5. Discovery runs after the page's scripts so a small budget still goes to what a browser loads;
       with a tiny budget the discovery probes show as REFUSED. Existing scanner tests were updated for
       the four new probes in checked.
    6. Repo links are extracted into discover.Result.RepoLinks but not emitted in the report: ScanReport
       has no field for them and I did not change the proto (no buf available). S6 can consume them.
    7. web/ has no page yet (only generated code), so I added a framework-free form module (scanForm.ts)
       with the URL and upload fields plus a request builder, not a Next.js page. It still needs
       mounting in the app.
    8. Name-keyed merging (components without a purl) keeps the High-confidence version without
       recording a Conflict; the conflict logic is outside this slice.
    

    — run 365bb550
13. hsinatfootprintai commented on Oct 26, 2026

    

    hsinatfootprintai

    on Oct 26, 2026

    Last edited by hsinatfootprintai

    ContributorAuthor

    More actions

    Scope decisions for S5 after reviewing PR #30 (recorded so the PR and the follow-ups agree):

    1. Repo links are deferred to S6 ([S6] Repo scan: forge latest-release resolution, tarball fetch, osv-scalibr lockfile extraction #14). Agent proposal: [S5] Discovery: security.txt, CSAF provider metadata, /.well-known/tea record, repo links, reviewer… (#13) #30 extracts the vendor's GitHub/GitLab links (internal/discover/repolinks.go) but does not report them: ScanReport has no field for them. The report field (a .proto change, regenerated outputs) is added by S6, the first consumer. Criterion 2 of this issue is delivered by S6, not by Agent proposal: [S5] Discovery: security.txt, CSAF provider metadata, /.well-known/tea record, repo links, reviewer… (#13) #30.
    2. The reviewer-supplied SBOM/VEX web fields are deferred to Web: SBOM/VEX inputs on the scan form (follow-up to S5) #32, a follow-up on the web form from feat(web): static Next.js report page and touchstone serve (#9) #28. Agent proposal: [S5] Discovery: security.txt, CSAF provider metadata, /.well-known/tea record, repo links, reviewer… (#13) #30 keeps the CLI path (--sbom, --sbom-url) and the ScanRequest fields. Its unmounted web/src/scanForm.ts (and test) should be removed from Agent proposal: [S5] Discovery: security.txt, CSAF provider metadata, /.well-known/tea record, repo links, reviewer… (#13) #30, since feat(web): static Next.js report page and touchstone serve (#9) #28 owns the page and scan-form.tsx. Criterion 3 is met for the CLI only until Web: SBOM/VEX inputs on the scan form (follow-up to S5) #32 lands.
    3. internal/sbom (added by Agent proposal: [S5] Discovery: security.txt, CSAF provider metadata, /.well-known/tea record, repo links, reviewer… (#13) #30 because S4 is absent) stays; S4 ([S4] SBOM/VEX parsers: CycloneDX, SPDX, OpenVEX, CycloneDX VEX, CSAF VEX, with VEX applied in vuln #12) reconciles with it.

    Closing: #30 should not use a closing keyword, because the PR does not meet every item. A person closes this issue when #30 merges, once #14 and #32 carry the deferred items (they do). Issues #12, #14, #15 and #32 list this issue on their Blocked by: line, and start waits for it to be closed, so it has to be closed by hand to release them. Merged agent PRs do not close their issues unless the PR carries a closing keyword.