[containarium-ci]

For #13: [S5] Discovery: security.txt, CSAF provider metadata, /.well-known/tea record, repo links, reviewer…

This pull request does not close issue #13: not every checklist item is reported met.

What and why

The platform made the commits and the branch from the files the agent handed back; it does not use the agent's own git state on the box, so anything the summary says about committing, branching or pushing describes only what the agent could do there.

The agent's summary, quoted:

Adds S5 discovery. A new internal/discover package probes the fixed discovery paths. It parses RFC
9116 security.txt (CRLF, comments, multiple CSAF: fields). It follows CSAF provider metadata, via
ROLIE feeds it declares, to CSAF VEX documents as DECLARED requests. It records /.well-known/tea
without querying it. It extracts GitHub/GitLab repo links from the page, skipping badge, share and
site-page links. A minimal internal/sbom package reads components from CycloneDX, SPDX, OpenVEX and
CSAF VEX. The Scanner runs discovery after the page's own scripts. Components from discovered VEX
documents are High confidence with VEX evidence. A reviewer-supplied SBOM/VEX (ScanRequest.sbom_url
or sbom_document) is High confidence with SBOM_SUPPLIED evidence. The CLI gets --sbom-url and --sbom
<file>. web/ gets a scan form module with a vendor URL field, an SBOM/VEX URL field and an upload
field, plus a request builder. Existing scanner tests are updated for the four discovery probes now
in checked. Tests were not run: go and npm were not executable in this session, and the commit could
not be made either (changes are staged only).

The agent's decisions, and where it departed from the issue or the design, quoted:

1. Tests, go vet and staticcheck were NOT run (go/npm not executable here) and no commit was made
   (git commit needed approval); changes are staged on agent/issue-13. Expect CI to be the first
   compile and test run.
2. Added a minimal internal/sbom (CycloneDX, SPDX, OpenVEX, CSAF VEX component extraction) because
   S4 is not in the repo yet; it reads components only, so VEX statements are not applied to
   vulnerabilities (S4 scope).
3. CSAF VEX documents are found only via ROLIE feeds named in provider-metadata.json (max 3 feeds,
   10 documents); changes.csv and directory listings are not fetched, since the design forbids
   synthesized paths.
4. The reviewer-supplied sbom_url is fetched as a DECLARED request, so it appears in checked and
   counts against the request budget and SSRF guard; the design has no separate reason for it.
   Uploads are capped at 2 MiB.
5. Discovery runs after the page's scripts so a small budget still goes to what a browser loads;
   with a tiny budget the discovery probes show as REFUSED. Existing scanner tests were updated for
   the four new probes in checked.
6. Repo links are extracted into discover.Result.RepoLinks but not emitted in the report: ScanReport
   has no field for them and I did not change the proto (no buf available). S6 can consume them.
7. web/ has no page yet (only generated code), so I added a framework-free form module (scanForm.ts)
   with the URL and upload fields plus a request builder, not a Next.js page. It still needs
   mounting in the app.
8. Name-keyed merging (components without a purl) keeps the High-confidence version without
   recording a Conflict; the conflict logic is outside this slice.

Changes

• internal/sbom/sbom.go — 211 lines
• internal/sbom/sbom_test.go — 76 lines
• internal/discover/discover.go — 235 lines
• internal/discover/repolinks.go — 115 lines
• internal/discover/discover_test.go — 147 lines
• internal/service/scanner.go — 339 lines
• internal/service/scanner_test.go — 238 lines
• internal/service/scanner_discover_test.go — 165 lines
• cmd/touchstone/main.go — 93 lines
• cmd/touchstone/main_test.go — 208 lines
• web/src/scanForm.ts — 69 lines
• web/src/scanForm.test.ts — 35 lines

12 file(s) in all.

Acceptance, from the issue

• 🟡 partly Parses RFC 9116 security.txt (incl. multiple `CSAF:` fields), follows CSAF provider metadata to VEX documents as DECLARED requests, records `/.well-known/tea`… — the agent says: Implemented with fake-fetcher and httptest tests, but no tests could be run here.
• 🟡 partly Extracts GitHub/GitLab repo links from the page (ignoring badge/share links) — the agent says: Repo links extracted in discover.RepoLinks (badges/share ignored) but not surfaced in the report.
• 🟡 partly Reviewer-supplied SBOM/VEX by URL or upload is accepted on the CLI and in `ScanRequest`, rated High with evidence kind SBOM_SUPPLIED, and the web page (`web/`)… — the agent says: CLI flags, ScanRequest and High/SBOM_SUPPLIED done; web has form module and builder, no mounted page.

The items are the issue's own; each status is the agent's report, which the platform has not checked.

Checks

Review this like any other change. The agent ran on the member's own machine from the text of the issue; the platform has not built or tested it. CI results appear on this pull request.

• Tests, as reported by the agent: not_run

How this pull request was made

Opened by the platform from a coding agent's run on a member's box (run 365bb550). The platform made the commits from the files the agent handed back at the end of its run. Nothing is merged automatically.

[hsinatfootprintai]

Closing: conflicts with main. Re-running #13 from current main (S3 #11 is merged).