Build SynSec v0.2 multi-scanner repository security MVP - #2

Draft

cmahmud wants to merge 1133 commits into

mainfrom

feature/multi-scanner-mvp

This pull request is big! We're only showing the most recent 250 commits

Commits on Aug 24, 2026

Assert non-root-owned OCI scratch mounts
cmahmud
committed
5148f49
Expose scanner process runner contract
cmahmud
committed
4be362b
Expose OCI scanner process runner adapter
cmahmud
committed
ea429d8
Allow scanner availability through injected process runners
cmahmud
committed
b284757
Make Grype execution runner-injectable
cmahmud
committed
78ab0f0
Make Syft execution runner-injectable
cmahmud
committed
e6bfa9e
Compose OCI-isolated dependency scanner set
cmahmud
committed
eeb41ee
Export OCI-isolated dependency scanner set
cmahmud
committed
7325624
Test PostgreSQL conformance across independent replica pools
cmahmud
committed
95bc712
Test PostgreSQL shared state across reconnects
cmahmud
committed
34fc141
Fix concurrent PostgreSQL replay claim visibility
cmahmud
committed
d7464e2
Make PostgreSQL queue insertion idempotent
cmahmud
committed
db0a74d
Require idempotent PostgreSQL queue insertion
cmahmud
committed
596468f
Cover PostgreSQL queue idempotency provenance checks
cmahmud
committed
0ea006a
Add bounded request source to sink flow evidence
cmahmud
committed
2458ac0
Integrate request source flow analysis
cmahmud
committed
7b3bd1e
Export request input flow analysis
cmahmud
committed
49feec3
Test bounded request source flow evidence
cmahmud
committed
54af40e
Fail closed on ambiguous request propagation
cmahmud
committed
ca7238d
Test fail-closed request propagation boundary
cmahmud
committed
67415de
Fix request flow resolution expectation
cmahmud
committed
9483b97
Document bounded request input flow evidence
cmahmud
committed
9bd8dae
feat(repository): add bounded immutable request-input forwarding
cmahmud
committed
5df8af0
feat(repository): integrate immutable request-input forwarding
cmahmud
committed
36ecc4f
build(repository): export request-input forwarding evidence
cmahmud
committed
4a1dba8
test(repository): cover bounded request-input forwarding
cmahmud
committed
351323c
docs(repository): document bounded request-input forwarding
cmahmud
committed
73e6b68
fix(repository): correct forwarding target extraction
cmahmud
committed
c4c8a69
feat(github): add atomic runtime credential reload source
cmahmud
committed
c567e6e
feat(github): resolve App private key per token operation
cmahmud
committed
da8305f
feat(github): resolve webhook secret per request
cmahmud
committed
a0dcb5e
build(github): export runtime credential source
cmahmud
committed
283417e
test(github): cover atomic runtime credential reload
cmahmud
committed
0e5b89c
docs(github): add runtime credential reload runbook
cmahmud
committed
03909a2
Add bounded route middleware composition analysis
cmahmud
committed
334fe31
Export route middleware composition analysis
cmahmud
committed
ac6191e
Integrate route middleware composition into flow analysis
cmahmud
committed
efe809f
Test conservative route middleware composition
cmahmud
committed
dc5b1b7
Document route middleware composition evidence
cmahmud
committed
9ded4fa
Add bounded GitHub App manifest provisioning flow
cmahmud
committed
4a9dbfb
Export GitHub App provisioning helpers
cmahmud
committed
c3e188f
Test GitHub App manifest provisioning boundaries
cmahmud
committed
9d5589d
Add GitHub App manifest provisioning CLI
cmahmud
committed
0f4ed1b
Expose GitHub App provisioning CLI
cmahmud
committed
7e2960f
Test GitHub App provisioning CLI
cmahmud
committed
7ac3ae5
Document GitHub App manifest provisioning workflow
cmahmud
committed
80ae7bf
Add secret-manager handoff for App manifest conversion
cmahmud
committed
dc5ed5a
Test manifest conversion secret-manager handoff
cmahmud
committed
0b9872e
Document manifest conversion credential handoff
cmahmud
committed
9474f29

Commits on Aug 25, 2026

Resolve explicit Django URLConf function views
cmahmud
committed
dfb2c97
Integrate Django URLConf view resolution
cmahmud
committed
ed8bb12
Export Django route handler analysis
cmahmud
committed
ccc8b32
Test conservative Django URLConf view resolution
cmahmud
committed
66959ba
Document bounded Django URLConf resolution
cmahmud
committed
c0e7651
Add bounded Django URLConf include composition
cmahmud
committed
a1f6523
Integrate Django URLConf include composition
cmahmud
committed
ccf6c48
Handle empty Django include prefixes
cmahmud
committed
c98cb9e
Test bounded Django URLConf include composition
cmahmud
committed
60c2aa5
Export Django URLConf composition analysis
cmahmud
committed
bbb425c
Document bounded Django URLConf composition
cmahmud
committed
013e0c6
Preserve include provenance for empty Django prefixes
cmahmud
committed
6f91cb2
Add mounted GitHub App runtime credential source
cmahmud
committed
fb5a404
Test mounted GitHub App runtime credentials
cmahmud
committed
22bef3c
Export mounted GitHub App credential loader
cmahmud
committed
3a17021
Document mounted GitHub App credential boundary
cmahmud
committed
26c1ecc
Add bounded FastAPI route dependency analysis
cmahmud
committed
dff2dba
Export FastAPI dependency analysis
cmahmud
committed
d2f63a7
Integrate FastAPI dependency contexts into route flow
cmahmud
committed
2c811d0
Test conservative FastAPI dependency composition
cmahmud
committed
1bf2f05
Document FastAPI structural dependency evidence
cmahmud
committed
137d11a
Decouple FastAPI dependency discovery from handler resolution
cmahmud
committed
bdeec5b
Recognize FastAPI decorators independently of generic route hints
cmahmud
committed
8e011bf
Assert FastAPI dependency context independently of handler resolution
cmahmud
committed
d3a5210
feat(repository): resolve bounded FastAPI handler dependencies
cmahmud
committed
97dd169
test(repository): cover FastAPI handler dependency parameters
cmahmud
committed
5e83937
docs(repository): document FastAPI handler dependencies
cmahmud
committed
68f50ac
fix(repository): resolve FastAPI handlers independently
cmahmud
committed
fe81529
feat(github): add rolling upgrade safety gate
cmahmud
committed
d543efb
build(github): export app upgrade assessment
cmahmud
committed
43b9eb3
test(github): cover rolling upgrade safety gate
cmahmud
committed
4b49a0c
docs(github): add safe rolling upgrade procedure
cmahmud
committed
451aa11
feat(github): enforce webhook admission drain
cmahmud
committed
b76ff7a
build(github): export webhook drain controller
cmahmud
committed
dc280ec
test(github): cover enforced webhook admission drain
cmahmud
committed
312fbed
docs(github): wire enforced admission drain into upgrade flow
cmahmud
committed
5f832be
Enforce GitHub App worker admission drain
cmahmud
committed
22be88d
Wire worker admission drain into hosted runner
cmahmud
committed
80b9420
Export GitHub App worker drain controller
cmahmud
committed
c4554f9
Require closed worker admission for upgrade drain
cmahmud
committed
3b70b76
Test enforced GitHub App worker drain
cmahmud
committed
5f84b97
Test worker admission in upgrade drain gate
cmahmud
committed
b2c5a51
Document enforced worker drain orchestration
cmahmud
committed
ac0c589
Add GitHub App maintenance drain orchestration
cmahmud
committed
e97c7e9
Export GitHub App maintenance controller
cmahmud
committed
d4593de
Test GitHub App maintenance orchestration
cmahmud
committed
ba7806b
Document GitHub App service-manager maintenance boundary
cmahmud
committed
aa9e6e6
Add PostgreSQL durable lease observer
cmahmud
committed
efc182d
Export PostgreSQL durable lease observer
cmahmud
committed
e8e7321
Test PostgreSQL durable lease observation
cmahmud
committed
08158a4
Run PostgreSQL lease observer integration in CI
cmahmud
committed
3973d20
Document built-in PostgreSQL lease observer
cmahmud
committed
d38cad3
Keep maintenance polling timer live
cmahmud
committed
afa5615
Add service-manager lifecycle drain bridge
cmahmud
committed
63b3cfc
Export service lifecycle bridge
cmahmud
committed
5176f93
Test service lifecycle drain bridge
cmahmud
committed
74ebe93
Document service-manager lifecycle integration
cmahmud
committed
09b4cce
Add authenticated hosted installation ownership verification
cmahmud
committed
4a59fcd
Add PostgreSQL hosted installation ownership store
cmahmud
committed
b54e434
Export hosted installation ownership modules
cmahmud
committed
817058c
Test authenticated hosted installation ownership verification
cmahmud
committed
68e126b
Test PostgreSQL hosted installation tenant fencing
cmahmud
committed
7f4ead7
Run hosted ownership PostgreSQL integration in CI
cmahmud
committed
ce00c7a
Document hosted GitHub installation ownership boundary
cmahmud
committed
649b58e
Add fenced hosted ownership reverification protocol
cmahmud
committed
86f13f5
Persist fenced hosted ownership reverification
cmahmud
committed
058171e
Test fenced hosted ownership reverification
cmahmud
committed
7761a28
Export hosted ownership reverification
cmahmud
committed
6cd67b5
Test PostgreSQL ownership reverification fences
cmahmud
committed
300b429
Document revocation-aware hosted ownership
cmahmud
committed
054122f
Fix strict row narrowing in ownership store
cmahmud
committed
2acd4d9
Add bounded hosted ownership re-verification sweeps
cmahmud
committed
a8497ba
Test hosted ownership re-verification sweeps
cmahmud
committed
c507de2
Export hosted ownership re-verification sweeps
cmahmud
committed
95608d2
Document hosted ownership re-verification sweeps
cmahmud
committed
e16b3c0
Add machine-readable release readiness assessment
cmahmud
committed
0195788
Test release readiness fail-closed assessment
cmahmud
committed
714fab6
Wire release readiness commands
cmahmud
committed
284947f
Run release readiness assessment in CI
cmahmud
committed
67975a3
Document release readiness gate
cmahmud
committed
d9bccd4
Add fail-closed GitHub App recovery admission gate
cmahmud
committed
190088c
Test fail-closed GitHub App recovery admission
cmahmud
committed
fa78cd3
Document GitHub App recovery boundary
cmahmud
committed
3d0d1a7
Export GitHub App recovery controller
cmahmud
committed
f132e24
Add bounded request helper return-flow evidence
cmahmud
committed
d1e6047
Fix imported call shadow detection for const result bindings
cmahmud
committed
bcf651c
Add bounded request return alias flow evidence
cmahmud
committed
d677430
Export request return alias flow analysis
cmahmud
committed
ac9d4ee
Test bounded request return alias flow evidence
cmahmud
committed
74fd80c
Document bounded request return alias evidence
cmahmud
committed
5fa849c
Fix request return alias forwarding bound fixture
cmahmud
committed
9435694
Add protected GitHub App operator status boundary
cmahmud
committed
e634364
Add secret-free GitHub App host profile
cmahmud
committed
cc521bf
feat(github): add executable intake host composition
cmahmud
committed
2214f10
build(github): export intake host
cmahmud
committed
b5f2e61
feat(host): add deployable GitHub App intake executable
cmahmud
committed
a6d3ff3
build: expose GitHub App intake host executable
cmahmud
committed
202ea47
test(github): cover intake host activation boundaries
cmahmud
committed
ddf789b
docs: document deployable GitHub App intake host
cmahmud
committed
e5b7aef
Add scoped scanner adapter factory
cmahmud
committed
510e063
Add enforced OCI GitHub App worker host
cmahmud
committed
cbb1f61
Export GitHub App worker host
cmahmud
committed
708928c
Reference scanners from GitHub host package
cmahmud
committed
ac47a6f
Test enforced OCI worker host boundary
cmahmud
committed
983bfbf
Add executable GitHub App worker process
cmahmud
committed
84d5c82
Add GitHub App worker host command
cmahmud
committed
ec7ac54
Document executable OCI worker host
cmahmud
committed
cb3fd35
feat(scanners): inject process runner into Checkov
cmahmud
committed
3094c72
feat(scanners): add Checkov to enforced OCI scanner set
cmahmud
committed
96c2eed
feat(scanners): export general OCI scanner composition
cmahmud
committed
c29ea45
feat(github): allow Checkov in enforced OCI worker
cmahmud
committed
94a0d4f
test(scanners): cover Checkov injected execution runner
cmahmud
committed
9b8d13d
test(github): cover Checkov hosted OCI admission
cmahmud
committed
1b3ec1a
docs: document Checkov OCI worker support
cmahmud
committed
ac55d98
feat(repository): compose bounded FastAPI routers
cmahmud
committed
82f09ba
feat(repository): integrate FastAPI router composition
cmahmud
committed
7c79efd
fix(repository): tighten FastAPI router declaration ordering
cmahmud
committed
ca9d6b0
feat(repository): export FastAPI router composition
cmahmud
committed
219bb9d
test(repository): cover FastAPI router composition
cmahmud
committed
f7c5d82
docs: explain bounded FastAPI router composition
cmahmud
committed
02d124c
fix(repository): resolve FastAPI composed route handlers independently
cmahmud
committed
fdf5688
fix(repository): reuse bounded FastAPI handler resolution
cmahmud
committed
76a07dd
feat(repository): compose Flask blueprints conservatively
cmahmud
committed
0dfd6ad
test(repository): cover Flask blueprint composition
cmahmud
committed
12f8229
build(repository): export Flask blueprint composition
cmahmud
committed
2f99674
feat(repository): integrate Flask blueprint route analysis
cmahmud
committed
36e5cfe
test(repository): integrate Flask blueprints into route flow
cmahmud
committed
cf60367
docs(repository): document Flask blueprint composition
cmahmud
committed
9d9480e
feat(repository): compose mounted Express routers
cmahmud
committed
dbd58d1
test(repository): cover Express router composition
cmahmud
committed
92f3a72
build(repository): export Express router composition
cmahmud
committed
09c1050
feat(repository): integrate Express router composition
cmahmud
committed
76730e6
docs(repository): document Express router composition
cmahmud
committed
1267c17
test(repository): correlate mounted Express routes to sinks
cmahmud
committed
3b48009
fix(repository): export imported route handler resolver
cmahmud
committed
c61fbec
test(repository): preserve request flow across Express mounts
cmahmud
committed
2d66106
feat(repository): add bounded NestJS controller composition
cmahmud
committed
5a35fd0
feat(repository): integrate NestJS controller flow analysis
cmahmud
committed
c299151
feat(repository): export NestJS controller composition
cmahmud
committed
69c5463
test(repository): cover NestJS controller composition
cmahmud
committed
bf3bdf0
docs(repository): document NestJS structural route evidence
cmahmud
committed
b06ab3f
feat(repository): add bounded Koa router composition
cmahmud
committed
8fe5d2b
feat(repository): integrate Koa route analysis
cmahmud
committed
777bccf
chore(repository): export Koa router analysis
cmahmud
committed
e2fe101
test(repository): cover Koa router composition
cmahmud
committed
cdb98e3
docs(repository): document Koa structural evidence
cmahmud
committed
3e5eecb
test(repository): correlate Koa request sources to sinks
cmahmud
committed
797c479
test(repository): preserve bounded Koa request-flow invariant
cmahmud
committed
3efcf1b
test(repository): assert exact Koa process evidence
cmahmud
committed
f8ee071
test(repository): keep Koa correlation claims structural
cmahmud
committed
2c51af4
feat(repository): add bounded Go call graph support
cmahmud
committed
ff8cc54
feat(repository): add bounded Gin router composition
cmahmud
committed
95c31b2
feat(repository): integrate Gin route flow analysis
cmahmud
committed
7dca472
build(repository): export Gin composition
cmahmud
committed
7403003
test(repository): cover bounded Gin route composition
cmahmud
committed
281815b
test(repository): correct Gin route source line
cmahmud
committed
38d56b4
docs(repository): document Gin route composition
cmahmud
committed
49a8818
fix(repository): retain one-line Go functions
cmahmud
committed
2f0983e
fix(repository): fail closed on ambiguous Gin handlers
cmahmud
committed
10743bd
test(repository): assert Gin-specific resolution and ambiguity
cmahmud
committed
6b182a4

Commits on Aug 26, 2026

feat(repository): add bounded Gin request input flow
cmahmud
committed
b90591d
export Gin request input flow evidence
cmahmud
committed
023c06d
test(repository): cover bounded Gin request source flows
cmahmud
committed
ff62036
docs(repository): document Gin request flow boundary
cmahmud
committed
d3b9356
fix(repository): recognize unaliased Gin imports exactly
cmahmud
committed
a13aa4a
fix(repository): bind Gin source parsing to resolved Gin routes
cmahmud
committed
76c4ea1
test(repository): assert Gin flow prerequisites explicitly
cmahmud
committed
16414a0
fix(repository): preserve Gin framework identity during route dedupe
cmahmud
committed
881ffad
fix(repository): exclude Gin Query accessor from database sink evidence
cmahmud
committed
54c9498
test(repository): distinguish Gin Query source from lexical sink collision
cmahmud
committed
b122c1f
fix(repository): integrate Gin request flow into aggregate analysis
cmahmud
committed
7c9bd74
test(repository): cover aggregate Gin request flow
cmahmud
committed
c993454
docs(repository): document aggregate Gin request flow
cmahmud
committed
13764f9
feat(repository): add bounded Gin local request forwarding
cmahmud
committed
e881c93
chore(repository): export Gin request forwarding
cmahmud
committed
9207fdb
feat(repository): compose bounded Gin local forwarding
cmahmud
committed
853b5f0
test(repository): cover bounded Gin local forwarding
cmahmud
committed
7e35ed7
docs(repository): document bounded Gin local forwarding
cmahmud
committed
520d32b
feat(repository): add bounded Koa request input flow
cmahmud
committed
f0b6025
refactor(repository): preserve Koa route identity
cmahmud
committed
45df251
build(repository): export Koa request input flow
cmahmud
committed
27f6fb3
feat(repository): integrate Koa request flow analysis
cmahmud
committed
f0e3a2f
test(repository): cover Koa request input flow
cmahmud
committed
0fb1ef4
docs(repository): document Koa request flow boundary
cmahmud
committed
17132ff
fix(repository): resolve imported strict Koa handlers
cmahmud
committed
2bcd721
fix(repository): distinguish Koa response body from request input
cmahmud
committed
8aed817
docs(repository): clarify Koa request source semantics
cmahmud
committed
e6dd0ac
test(repository): reject Koa response body as request source
cmahmud
committed
7a46d48
fix(repository): reject generic database sink collisions in Koa flow
cmahmud
committed
59d772b
test(repository): validate Koa flow bounds directly
cmahmud
committed
e82fb71
feat(repository): add bounded Koa local request forwarding
cmahmud
committed
54f6e89
feat(repository): export Koa request forwarding analysis
cmahmud
committed
83a28ca
feat(repository): integrate Koa local forwarding
cmahmud
committed
d70ea39
test(repository): cover Koa local request forwarding
cmahmud
committed
4b02312
docs(repository): document bounded Koa forwarding evidence
cmahmud
committed
729f8d9
feat(ops): add bounded file-backed host secret source
cmahmud
committed
0ab2cb0
feat(ops): allow file-backed postgres credential for intake
cmahmud
committed
2bf1bfa
feat(ops): allow file-backed postgres credential for worker
cmahmud
committed
6b31711
test(ops): cover file-backed host secret boundary
cmahmud
committed
ca46156
feat(ops): add hardened intake service example
cmahmud
committed
3db315f
feat(ops): add hardened worker service example
cmahmud
committed
5d1dc32