[containarium-ci]

For #8: [S2] Walking skeleton: page fetch → header + Retire.js uri/filename fingerprint → OSV by purl → JSO…

What and why

The platform made the commits and the branch from the files the agent handed back; it does not use the agent's own git state on the box, so anything the summary says about committing, branching or pushing describes only what the agent could do there.

The agent's summary, quoted:

Walking skeleton for slice S2 (#8). `touchstone scan` now does a real passive scan instead of
returning the S0 stub. Flow: fetch the target as TARGET; fetch each `<script src>` it references as
SUBRESOURCE (only a 2xx counts as loaded); fingerprint with Retire.js-style uri/filename signatures
(jQuery only for now) plus Server/X-Powered-By banner rules; look each component's purl up through
the existing `vuln.Source` seam, implemented by the new `vuln.OSV` (querybatch, then GET
/v1/vulns/{id}); return the report with `checked` listing every vendor request with its reason,
`requests_used` matching it, and `lookup_status` COMPLETE only when every lookup succeeded. A target
that can't be fetched gives TARGET_UNREACHABLE, not an RPC error. Tests replay recorded OSV
responses through httptest, so CI makes no live network calls. No proto change, so generated code is
unaffected.

Tools used
- go go1.27.3 linux/amd64 (`go version`), already on the box: go test, go vet, go mod tidy, gofmt
- staticcheck 2026.2.2 (0.8.2), already on the box: staticcheck ./...
- node v24.22.1 (`node --version`), already on the box: used only to print the escaped file contents
for this result
- git, already on the box: fetch, branch, commit

Installed: nothing. `go get`/`go mod tidy` pulled github.com/dlclark/regexp2 v1.11.0 and
golang.org/x/net v0.61.0 (both already listed in go.sum) into the module cache. Not run: buf (no
proto change), the web tests, and the CLI against live OSV, which this box cannot reach and which CI
must not use.

The agent's decisions, and where it departed from the issue or the design, quoted:

1. Signatures are a hand-curated jQuery-only file (internal/fingerprint/data/signatures.json), not
   the pinned Retire.js jsrepository snapshot the design assigns to S7. No pinned upstream copy is
   available here, and S2 needs only jQuery.
2. The OSV responses under internal/vuln/testdata/osv were written by hand from OSV's reply format
   for two jQuery advisories (CVE-2019-11358, CVE-2020-11022). They were not captured from
   api.osv.dev and must be re-recorded from a live capture.
3. Lookups are made one component at a time (one purl per Lookup call), so each finding maps to its
   component without changing the vuln.Source interface.
4. No pipeline merge core yet: service.Scanner orchestrates the S2 steps because there is one
   evidence tier. internal/pipeline has no new code, though the design names pipeline as the
   orchestrator.
5. OSV calls are not in the checked list. They are not vendor requests, which the design keeps on
   separate clients outside the budget; their outcome appears in sources. Read the issue's
   every-request rule as covering vendor requests.
6. Only <script src> is fetched as a subresource. <link> stylesheet and modulepreload and CSS
   @import are deferred. A script counts as loaded only on a 2xx response.
7. lookup_status is FAILED when every OSV lookup fails and PARTIAL when only some fail. cvss_base is
   left unset because OSV gives vectors rather than scores (scoring is S3), and vuln_data_as_of is
   unset.
8. Retire.js patterns use regexp2 v1.11.0 (already in go.sum) with the design's 100 ms match
   timeout. The CLI now calls api.osv.dev by default; no test does.

Changes

• cmd/touchstone/main.go — 83 lines
• go.mod — 19 lines
• internal/fingerprint/data/signatures.json — 14 lines
• internal/fingerprint/fingerprint.go — 238 lines
• internal/fingerprint/fingerprint_test.go — 138 lines
• internal/service/scanner.go — 242 lines
• internal/service/scanner_test.go — 227 lines
• internal/vuln/osv.go — 166 lines
• internal/vuln/osv_test.go — 122 lines
• internal/vuln/testdata/osv/querybatch-jquery-1.12.4.json — 16 lines
• internal/vuln/testdata/osv/vulns/GHSA-6c3j-c64m-qhgq.json — 13 lines
• internal/vuln/testdata/osv/vulns/GHSA-gxr4-xjj5-5px2.json — 13 lines

12 file(s) in all.

Acceptance, from the issue

• ✅ met `touchstone scan` against a fixture page that loads `jquery-1.12.4.min.js` reports jQuery 1.12.4 at Low confidence, with the script URL as evidence and at leas… — the agent says: Scanner test: fixture site loads jquery-1.12.4.min.js gives jQuery 1.12.4 LOW, script URL evidence, CVE-2020-11022 via recorded OSV. Not run against the compil…
• ✅ met The report's `checked` list contains every request made, with its reason; `requests_used` matches — the agent says: Test checks checked = TARGET and SUBRESOURCE with reasons and results; requests_used equals len(checked); budget-refused script is recorded.
• ✅ met OSV is called through `vuln.Source`; CI uses recorded OSV responses, no live network — the agent says: OSV goes through vuln.Source (vuln.OSV); tests replay recorded responses via httptest; no test makes a live network call.

The items are the issue's own; each status is the agent's report, which the platform has not checked.

Checks

Review this like any other change. The agent ran on the member's own machine from the text of the issue; the platform has not built or tested it. CI results appear on this pull request.

• Tests, as reported by the agent: passed

How this pull request was made

Opened by the platform from a coding agent's run on a member's box (run f3674b00). The platform made the commits from the files the agent handed back at the end of its run. Nothing is merged automatically.