feat(arsenal): structured parsers for source / supply-chain scanners (semgrep, trivy, grype, gitleaks)

[Pazificateur69]

Stacked on #42 (the structured-parser layer) and pairs with #40 (the arg templates that make these tools emit JSON). Until those land, this PR's diff includes #42's commit; the net-new commit here is c20c24c — please review after #42. Parsers degrade to [] when a tool isn't emitting JSON yet, so nothing misbehaves in the meantime.

What

Extends the structured-parser layer (#42) to the source / supply-chain scanners, so their output becomes gate-verifiable Findings instead of raw text (they were parserStatus: 'planned'):

tool	command (from #40)	mapping
semgrep	scan --config auto --json .	one finding/rule match · ERROR/WARNING/INFO → severity · CWE token from metadata ("CWE-78: …" → CWE-78) · refs → remediation
trivy	fs --format json .	one finding/package vuln · CVE + CweIDs · upgrade <pkg> to <fixed> remediation
grype	dir:. -o json	one finding/match · CVE + package coordinates
gitleaks	detect --report-format json --redact	one high finding/secret · see redaction note

Honesty / safety

• Same contract as feat(arsenal): parse JSON scanner output into structured, gate-verifiable findings #42: parsers are pure, dependency-free, and never throw — empty / garbled / non-JSON input yields [], never a fabricated finding. Raw stdout is always kept as the evidence of record.
• Secret redaction (defence in depth): the gitleaks adapter already runs with --redact, but the parser also routes finding details through redactString() (src/redact.ts), so a raw secret can never reach a Finding or the evidence vault. A test pins this: an AWS key present in the raw report is [redacted] in the finding.
• Broadens the severity map to fold scanner vocabularies (ERROR/WARNING, CRITICAL…NEGLIGIBLE, moderate) onto the five canonical levels.

Tests

Extends parsers.test.ts + fixtures: per-scanner field mapping (CVE/CWE/severity/remediation), the gitleaks redaction guarantee, and the end-to-end assertion that every new scanner's parsed finding passes gateLiveFinding with provenance='tool'.

Scope

SARIF-style output and secret scanners beyond gitleaks (trufflehog etc.) remain a clean follow-up.

Review standard (all green locally)

typecheck · test · doctor · verify-claims · test:no-fitting · test:no-self-fitting · test:gate · prompt:audit · smoke

[jmagly]

Reviewed — sound, and correctly stacked on #42 (net-new commit c20c24c). The added semgrep/trivy/grype/gitleaks parsers map the real schemas, severity aliases check out (semgrep ERROR→high / WARNING→medium; trivy/grype HIGH→high, asserted in tests), and the gitleaks redactString scrub genuinely works — the fixture's AKIA… key is replaced with [redacted] and the test asserts the raw key is absent. One real-world note you already call out: some scanners (ffuf, gitleaks, trivy) don't emit JSON to stdout without an output-path flag, so those parsers receive [] until the arg-template work lands — degrades safely to empty, no crash. Merge after #42.

[jmagly]

Please rebase this branch onto current main and remove the unrelated deleted files.

The parser work should be reviewed on its own, but the branch currently carries stale-base deletions of benchmark corpora, benchmark scripts, provenance docs, and tests. That makes the merge unsafe.

Suggested agent repair path:

1. Recreate/rebase from current main.
2. Keep only source/supply-chain parser code, fixtures, and parser tests.
3. Restore benchmark corpora/scripts, provenance docs, and unrelated tests.
4. Add focused malformed-output tests for each structured parser path.
5. Verify with git diff --name-status upstream/main...HEAD that the only deleted files are intentionally part of the parser change, ideally none.