GAP_FINDINGS.toml

# KeyHog gap findings registry — Santh STANDARD.md tests/gap/ roadmap.
# Each entry maps to exactly one test file under crates/*/tests/gap/<id>.rs
# Status: open | fixed | waived
# Fix target: semver milestone or date
# LR2-A8: deduplicated agent-conflicting ids (was 001-019 partial merge)
# R1-A6: semantic dedup — status `dupe` + `dupe_of` pointer (OPEN 66→57; total 80→86 after LR2-A6 verifier ids)
# R2-M7: dedupe 093→040 (same test path); revert 079/080 OPEN (ci-operability gap tests absent on NFS);
#        promote 004/007/016 FIXED (LR2-A7 orchestrator split — gap oracles green on NFS)
# R3.3-F1: restored tests/FILE_GATE_MATRIX.toml (167 [[module]] rows); removed from .gitignore (LR2-A8 cli harness)
# Status: open | fixed | waived | dupe

[[finding]]
id = "KH-GAP-001"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "(cli slice): args.rs exceeds the 500-line modularity cap."
test = "crates/cli/tests/gap/args_rs_exceeds_modularity_cap.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-002"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "Contract gate: backend subcommand defines self-test failure exit 4."
test = "crates/cli/tests/gap/backend_self_test_exit_code_four_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-003"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "Contract gate: detectors subcommand defines audit failure exit 3."
test = "crates/cli/tests/gap/detectors_audit_exit_code_three_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-004"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`--exclude-paths` is documented but does not suppress scanned files."
test = "crates/cli/tests/gap/exclude_paths_flag_not_wired.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-005"
severity = "micro-flaw"
status = "dupe"
dupe_of = "KH-GAP-009"
crate = "cli"
title = "DUPE→009: Santh exit codes — 2 user error, 3 system error (subset oracle)."
test = "crates/cli/tests/gap/exit_code_system_vs_user.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-006"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "detectors.rs still hosts inline tests."
test = "crates/cli/tests/gap/inline_test_offenders_detectors_subcommand.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-007"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "orchestrator.rs still hosts inline tests."
test = "crates/cli/tests/gap/inline_test_offenders_orchestrator.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-008"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "value_parsers.rs still hosts inline tests."
test = "crates/cli/tests/gap/inline_test_offenders_value_parsers.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-009"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "main.rs defines distinct user (2) and system (3) exit codes."
test = "crates/cli/tests/gap/main_defines_user_and_system_exit_codes.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-010"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "main.rs routes SCANNER_PANICKED to EXIT_SYSTEM_ERROR."
test = "crates/cli/tests/gap/main_maps_scanner_panic_to_system_exit.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-011"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "(cli slice): `src/` must not host `#[cfg(test)]` modules."
test = "crates/cli/tests/gap/no_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-012"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "Contract gate: orchestrator_config reads KEYHOG_DETECTORS env var."
test = "crates/cli/tests/gap/orchestrator_config_honors_keyhog_detectors_env.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-013"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "Contract gate: orchestrator_config reads KEYHOG_THREADS env var."
test = "crates/cli/tests/gap/orchestrator_config_honors_keyhog_threads_env.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-014"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "Contract gate: orchestrator defines EXIT_LIVE_CREDENTIALS = 10."
test = "crates/cli/tests/gap/orchestrator_defines_live_exit_ten.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-015"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "Contract gate: orchestrator defines EXIT_SCANNER_PANIC = 11."
test = "crates/cli/tests/gap/orchestrator_defines_scanner_panic_exit_eleven.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-016"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "(cli slice): orchestrator.rs must stay under the 500-line"
test = "crates/cli/tests/gap/orchestrator_modularity_cap.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-017"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "(cli slice): scan_system.rs exceeds the 500-line modularity cap."
test = "crates/cli/tests/gap/scan_system_rs_exceeds_modularity_cap.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-018"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "Path globs with oversized segments must not match (DoS guard)."
test = "crates/core/tests/gap/allowlist_oversized_glob_segment_rejected.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-019"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "Single-element cross-detector dedup must pass through unchanged cardinality."
test = "crates/core/tests/gap/cross_detector_single_input_passthrough.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-020"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "Dedup must merge identical `(detector, credential)` pairs into one group"
test = "crates/core/tests/gap/dedup_same_credential_one_group.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-021"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "Encoding module must reject inputs above the documented byte cap."
test = "crates/core/tests/gap/encoding_rejects_oversized_input.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-022"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "lib.rs must not duplicate the Santh lint preamble block."
test = "crates/core/tests/gap/lib_rs_duplicate_lint_preamble.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-023"
severity = "micro-flaw"
status = "dupe"
dupe_of = "KH-GAP-024"
crate = "core"
title = "DUPE→024: Santh lint preamble subset (unwrap_used + todo fragments only)."
test = "crates/core/tests/gap/lint_preamble.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-024"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "Santh STANDARD.md lint preamble must be present at the top of `lib.rs`."
test = "crates/core/tests/gap/lint_preamble_present.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-025"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "legacy save() cache must not satisfy load_with_spec gate."
test = "crates/core/tests/gap/merkle_load_without_spec_invalidates_legacy_save.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-026"
severity = "bar-miss"
status = "fixed"
crate = "core"
title = "(core slice): `src/` must not host `#[cfg(test)]` modules;"
test = "crates/core/tests/gap/no_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-027"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "sarif unicode path percent encoded"
test = "crates/core/tests/gap/sarif_unicode_path_percent_encoded.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-028"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "Bar gate: `analyze_keyword_only.rs` must not be a decorative"
test = "crates/scanner/tests/gap/analyze_keyword_only_must_assert.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-029"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "compiler.rs still hosts inline alternation tests."
test = "crates/scanner/tests/gap/compiler_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-030"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "compiler_prefix.rs still hosts inline inner-literal tests."
test = "crates/scanner/tests/gap/compiler_prefix_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-031"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "uncalibrated detectors must not halve confidence on fresh install."
test = "crates/scanner/tests/gap/confidence_calibration_uncalibrated_passthrough.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-032"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "confidence/penalties.rs still hosts inline tests."
test = "crates/scanner/tests/gap/confidence_penalties_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-033"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "context/false_positive.rs still hosts inline tests."
test = "crates/scanner/tests/gap/context_false_positive_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-034"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "sequential placeholder detection must strip known prefixes first."
test = "crates/scanner/tests/gap/context_sequential_placeholder_strips_prefix.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-035"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "`async fn test_*` bodies under `#[tokio::test]` are not TestCode."
test = "crates/scanner/tests/gap/context_tokio_async_fn_test_body_is_test_code.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-036"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "decode/pipeline.rs approaches god-file territory at 463 LOC."
test = "crates/scanner/tests/gap/decode_pipeline_exceeds_modularity_cap.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-037"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "Every loaded detector id must have a contract TOML (100% by id)."
test = "crates/scanner/tests/gap/detector_contract_coverage_100pct.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-038"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "keyword-context entropy must not fire without keyword assignment line."
test = "crates/scanner/tests/gap/entropy_keyword_only_requires_keyword_line.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-039"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "entropy/keywords.rs still hosts inline identifier tests."
test = "crates/scanner/tests/gap/entropy_keywords_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-040"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "forced GPU backend must not silently scan with CPU without signal."
test = "crates/scanner/tests/gap/gpu_forced_backend_no_silent_degrade.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-041"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "When `KEYHOG_REQUIRE_GPU=1`, GPU gates must panic/fail"
test = "crates/scanner/tests/gap/gpu_require_env_fails_not_skips.rs"
fix_target = "0.6.0"
# R3.2-D: wgpu AC kernel routing restores KEYHOG_REQUIRE_GPU=1 scan on full corpus.

[[finding]]
id = "KH-GAP-042"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "GPU parity tests must not silently skip when KEYHOG_REQUIRE_GPU=1."
test = "crates/scanner/tests/gap/gpu_tests_fail_not_skip.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-043"
severity = "bar-miss"
status = "waived"
crate = "scanner"
title = "Megakernel and literal-set GPU paths must produce identical findings."
test = "crates/scanner/tests/gap/megakernel_literal_set_parity.rs"
fix_target = "0.6.0"
waiver = "crates/scanner/spec_waivers/megakernel_literal_set_parity.toml"
waiver_expires = "2026-08-01"

[[finding]]
id = "KH-GAP-044"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "A3 slice src files still contain inline #[cfg(test)] modules."
test = "crates/scanner/tests/gap/no_inline_tests_in_a3_slice.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-045"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "Inline `#[cfg(test)]` modules in `src/` violate the"
test = "crates/scanner/tests/gap/no_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-046"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "(pipeline slice): `pipeline.rs` must stay ≤500 LOC until"
test = "crates/scanner/tests/gap/pipeline_exceeds_modularity_cap.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-047"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "pipeline.rs god file (1923 LOC) concentrates hot-path allocations."
test = "crates/scanner/tests/gap/pipeline_hot_path_allocs.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-048"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "Santh STANDARD requires tests/contract/ on in-policy crates."
test = "crates/scanner/tests/gap/santh_contract_dir_exists.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-049"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "single-line Python implicit concat joins locally but does not append"
test = "crates/scanner/tests/gap/single_line_implicit_concat_not_appended.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-050"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Archive open path must skip symlinked archive files."
test = "crates/sources/tests/gap/archive_symlink_guard_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-051"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Ghidra decompiled output must be capped before parsing."
test = "crates/sources/tests/gap/binary_max_decompiled_cap_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-052"
severity = "micro-flaw"
status = "dupe"
dupe_of = "KH-GAP-053"
crate = "sources"
title = "DUPE→053: alias gate for unbounded fs::read (superseded by binary_read_is_capped)."
test = "crates/sources/tests/gap/binary_no_unbounded_fs_read.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-053"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "closed: binary strings path uses capped read, not unbounded fs::read."
test = "crates/sources/tests/gap/binary_read_is_capped.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-054"
severity = "micro-flaw"
status = "dupe"
dupe_of = "KH-GAP-053"
crate = "sources"
title = "DUPE→053: binary bounded-read gate (mmap/cap oracle; same binary/mod.rs fix)."
test = "crates/sources/tests/gap/binary_source_streaming.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-055"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Compressed stream path must cap total decompressed bytes at 4× max_file_size."
test = "crates/sources/tests/gap/compressed_extraction_4x_budget_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-056"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Compressed inputs must refuse mapping when compressed size exceeds max_file_size."
test = "crates/sources/tests/gap/compressed_input_uses_size_cap.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-057"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Docker layer unpack must enforce per-entry and cumulative tar caps."
test = "crates/sources/tests/gap/docker_tar_caps_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-058"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Archive extraction must enforce 4× max_file_size uncompressed budget."
test = "crates/sources/tests/gap/filesystem_archive_4x_budget_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-059"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Ghidra analysis subprocess must use wait_timeout kill path."
test = "crates/sources/tests/gap/ghidra_subprocess_uses_wait_timeout.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-060"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Ghidra subprocess wall clock must match shared timeouts module."
test = "crates/sources/tests/gap/ghidra_timeout_is_five_minutes.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-061"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Git blob streaming must cap single blob and total in-memory bytes."
test = "crates/sources/tests/gap/git_blob_byte_caps_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-062"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "GitHub org shallow clone budget must be centralized in timeouts.rs."
test = "crates/sources/tests/gap/git_clone_timeout_is_five_minutes.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-063"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Git ref resolution must use --end-of-options before user refs."
test = "crates/sources/tests/gap/git_rev_parse_end_of_options.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-064"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Git subprocess must refuse $PATH lookup for git binary in git/mod.rs."
test = "crates/sources/tests/gap/git_uses_resolve_safe_bin.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-065"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Git sources must canonicalize repo paths and require .git/HEAD."
test = "crates/sources/tests/gap/git_validate_repo_path_canonicalizes.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-066"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Shared HTTP builder must disable auto gzip to prevent body bombs."
test = "crates/sources/tests/gap/http_client_no_auto_gzip.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-067"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "mmap paths must re-stat after open and refuse multi-GiB TOCTOU growth."
test = "crates/sources/tests/gap/mmap_toctou_sanity_cap_in_read.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-068"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "S3 object fetch must cap downloaded bytes."
test = "crates/sources/tests/gap/s3_max_object_bytes_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-069"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Stdin source must cap piped input to prevent unbounded allocation."
test = "crates/sources/tests/gap/stdin_max_bytes_cap_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-070"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Unix file open must use O_NOFOLLOW to refuse symlink traversal."
test = "crates/sources/tests/gap/unix_open_no_follow_in_read.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-071"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Directory walker must not follow symlinks out of scan root."
test = "crates/sources/tests/gap/walker_follow_symlinks_disabled.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-072"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "Web fetch must cap raw response bytes; gzip auto-decompress disabled via http.rs."
test = "crates/sources/tests/gap/web_max_response_bytes_in_source.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-073"
severity = "bar-miss"
status = "fixed"
crate = "verifier"
title = "(verifier slice): src/ must not host #[cfg(test)] modules;"
test = "crates/verifier/tests/gap/no_inline_tests_in_src.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-081"
severity = "bar-miss"
status = "fixed"
crate = "verifier"
title = "LR2-A6 / LR1 KH-GAP-028: auth CRLF sanitize inline tests exiled from verify/auth.rs"
test = "crates/verifier/tests/unit/a6_lr2/sanitize_strips_crlf.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-082"
severity = "bar-miss"
status = "fixed"
crate = "verifier"
title = "LR2-A6 / LR1 KH-GAP-029: credential retry metadata inline tests exiled from verify/credential.rs"
test = "crates/verifier/tests/unit/a6_lr2/retry_preserves_metadata_on_exhaustion.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-083"
severity = "bar-miss"
status = "fixed"
crate = "verifier"
title = "LR2-A6 / LR1 KH-GAP-030: OOB wait_for race inline tests exiled from oob/session.rs"
test = "crates/verifier/tests/unit/a6_lr2/oob_wait_for_race_store_before_wait.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-084"
severity = "bar-miss"
status = "fixed"
crate = "verifier"
title = "LR2-A6 / LR1 KH-GAP-031: interactsh decrypt inline tests exiled from oob/client.rs"
test = "crates/verifier/tests/unit/a6_lr2/interactsh_decrypt_roundtrip.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-085"
severity = "bar-miss"
status = "fixed"
crate = "verifier"
title = "LR2-A6 / LR1 KH-GAP-032: rate limiter burst wall-clock inline test exiled from rate_limit.rs"
test = "crates/verifier/tests/unit/a6_lr2/rate_limit_burst_respects_interval.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-086"
severity = "bar-miss"
status = "fixed"
crate = "verifier"
title = "oob/client.rs exceeded 500 LOC — extracted oob/decrypt.rs"
test = "crates/verifier/tests/unit/gates/oob_client_file_size_cap.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-076"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "Positive invariant: nightly job exports every multiplier strict env var."
test = "crates/scanner/tests/gap/nightly_exports_all_strict_env_vars.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-077"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "Positive invariant: runners-nightly.yml lists all 14 contract multipliers."
test = "crates/scanner/tests/gap/nightly_matrix_has_fourteen_runner_binaries.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-091"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "`--dogfood` emits duplicate identical example_suppressed events (one per pipeline stage)."
test = "crates/cli/tests/stress/scan_dogfood_one_event_per_example.rs"
fix_target = "0.6.0"
# R3-D: dedupe dogfood events on (path, credential_redacted) in telemetry.rs.
# R3.2-D: re-verified; stress + demo-secret.env dogfood green.

[[finding]]
id = "KH-GAP-092"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "`--git-diff HEAD` compares commit SHAs only; uncommitted working-tree changes are invisible (unlike `git diff HEAD`)."
test = "crates/cli/tests/e2e/scan_git_diff_head_includes_worktree.rs"
fix_target = "0.6.0"
# R3-D: worktree mode (git diff HEAD + untracked ls-files) when base==head commit.
# R3.2-D: re-verified; e2e + temp-repo dogfood green.

[[finding]]
id = "KH-GAP-093"
severity = "micro-flaw"
status = "fixed"
dupe_of = "KH-GAP-041"
crate = "scanner"
title = "R1-D2: KEYHOG_REQUIRE_GPU=1 + --backend gpu must not silently CPU-fallback on dispatch failure."
test = "crates/cli/tests/gap/scan_require_gpu_forbids_silent_cpu_fallback.rs"
fix_target = "0.6.0"
# R3.2-D: wgpu forced onto AC kernel + subgroup coalesce off (gpu_lazy/gpu_literal_phase1).

[[finding]]
id = "KH-GAP-094"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`detectors --search` help claimed 888-strong corpus; embedded count is 891."
test = "crates/cli/tests/gap/detectors_search_help_detector_count_drift.rs"
fix_target = "0.6.0"
# R3-REV: args.rs + detectors.rs updated to 891-strong.

[[finding]]
id = "KH-GAP-095"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "README exit-code section omitted 3/4/10/11 documented in CLI `--help`."
test = "crates/cli/tests/gap/readme_exit_codes_match_cli_contract.rs"
fix_target = "0.6.0"
# R3-REV: README quickstart exit codes aligned with Cli after_help.

[[finding]]
id = "KH-GAP-096"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`scan --git-history` on a non-repository exits 0 (CI silent false-clean)."
test = "crates/cli/tests/gap/git_history_non_repo_exits_nonzero.rs"
fix_target = "0.6.0"
# R3-REV: gap oracle fails; stress test remote_source_failure_nonzero_exit.rs mirrors.
# R3.3-F3: SOURCE_ERRORS + run() bail when git-history SourceError; gap + stress green.

[[finding]]
id = "KH-GAP-097"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`--stream` progress cites line numbers beyond the scanned file length."
test = "crates/cli/tests/gap/stream_progress_line_within_file.rs"
fix_target = "0.6.0"
# R3-REV: gap oracle fails on 2-line fixture (reports :4).
# R3.3-F3: stream_line_label caps to file line count; gap + stress green.

[[finding]]
id = "KH-GAP-098"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "`docs/vyre-usage.md` claims KEYHOG_USE_MEGAKERNEL routing; engine/ never reads env."
test = "crates/scanner/tests/gap/docs_megakernel_env_claim_matches_engine.rs"
fix_target = "0.6.0"
# R3-REV: docs lie until megakernel hook lands or doc corrected.
# R3.3-F3: docs/vyre-usage.md corrected — env is no-op until engine hook; gap oracle green.

[[finding]]
id = "KH-GAP-099"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "Cli after_help described exit 3 as audit-only; main.rs uses 3 for system errors."
test = "crates/cli/tests/gap/cli_after_help_documents_system_exit_three.rs"
fix_target = "0.6.0"
# R3-REV: args.rs after_help exit table corrected.

[[finding]]
id = "KH-GAP-100"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`--progress` flag parsed but ignored; progress UI gated only on stderr TTY."
test = "crates/cli/tests/contract/progress_flag_emits_backend_line_without_tty.rs"
fix_target = "0.6.0"
# R3-TCLI: orchestrator/run.rs honors args.progress when stderr is piped.
# R3.2-D: contract + piped dogfood re-verified green.

[[finding]]
id = "KH-GAP-101"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "Adversarial engine: AKIAIOSFODNN7EXAMPLE negative twins fire in dead_corpus_evasion paths."
test = "crates/scanner/tests/adversarial/engine_cases/dead_corpus_evasion.rs"
fix_target = "0.6.0"
# R3-TADV: evasion_embedded_in_binary + evasion_reversed_strings negative twins regress.

[[finding]]
id = "KH-GAP-102"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "Adversarial engine: TESTKEY_111111… fake twins not suppressed (concat/rtl/homoglyph)."
test = "crates/scanner/tests/adversarial/engine_cases/concatenation_e2e.rs"
fix_target = "0.6.0"
# R3-TADV: split_string_concat, rtl_override, unicode_homoglyph_keyword negative twins fail.

[[finding]]
id = "KH-GAP-103"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "megakernel_waiver helper called .ok() on PathBuf (all_tests compile break)."
test = "crates/scanner/tests/support/megakernel_waiver.rs"
fix_target = "0.6.0"
# R3-TADV: parse_waiver_expiry uses waiver_path() directly (was waiver_path().ok()?).

[[finding]]
id = "KH-GAP-104"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "README/site document `hook install --no-daemon` but hook subcommand has no such flag."
test = "crates/cli/tests/gap/hook_install_no_daemon_readme_phantom_flag.rs"
fix_target = "0.6.0"
# R4-D: README + site/hooks.html; stress test hook_install_no_daemon_readme_lie.rs also red.

[[finding]]
id = "KH-GAP-105"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`daemon start` fails outside repo cwd — no embedded detector fallback unlike scan/watch."
test = "crates/cli/tests/gap/daemon_start_no_embedded_detector_fallback.rs"
fix_target = "0.6.0"
# R4-D: `keyhog daemon start` from /tmp errors on missing detectors/; scan uses embedded corpus.

[[finding]]
id = "KH-GAP-106"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`backend --patterns` default 1509 stale vs ~5769 compiled patterns in progress banner."
test = "crates/cli/tests/gap/backend_patterns_default_stale_vs_compiled.rs"
fix_target = "0.6.0"
# R4-D: routing matrix mis-simulates GPU breakeven on fresh installs.

[[finding]]
id = "KH-GAP-107"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "README/site API examples call phantom `keyhog_core::embedded_detectors()`."
test = "crates/cli/tests/gap/readme_embedded_detectors_api_phantom.rs"
fix_target = "0.6.0"
# R4-D: public API is embedded_detector_tomls() + parse; site/api.html also wrong.

[[finding]]
id = "KH-GAP-108"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "Error messages cite `keyhog detectors list` but CLI rejects `list` subcommand."
test = "crates/cli/tests/gap/detectors_list_phantom_subcommand_in_errors.rs"
fix_target = "0.6.0"
# R4-D: orchestrator_config.rs + spec/load.rs operator strings.

[[finding]]
id = "KH-GAP-109"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`keyhog watch` duplicates findings when notify fires Create+Modify for one save."
test = "crates/cli/tests/gap/watch_duplicate_findings_on_create.rs"
fix_target = "0.6.0"
# R4-D: single brandnew.txt create emitted 4 finding lines (2 detectors × 2 events).

[[finding]]
id = "KH-GAP-110"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "README quickstart `--baseline` line omits prerequisite `--create-baseline` workflow."
test = "crates/cli/tests/gap/readme_baseline_quickstart_omits_create.rs"
fix_target = "0.6.0"
# R4-D: site/baseline.html documents create-baseline; README Filter section does not.

[[finding]]
id = "KH-GAP-113"
severity = "micro-flaw"
status = "fixed"
crate = "sources"
title = "`async_client_builder` lacks `.no_gzip()/.no_brotli()/.no_deflate()`; KH-GAP-066 gate passes on blocking substring only."
test = "crates/sources/tests/gap/http_async_client_no_auto_gzip.rs"
fix_target = "0.6.0"
# R4-SRC: http.rs:137-156 async path omits body-bomb defenses present on blocking builder.
# R4.3-SRC: async_client_builder mirrors blocking decompress disable; gap oracle green.

[[finding]]
id = "KH-GAP-114"
severity = "bar-miss"
status = "fixed"
crate = "sources"
title = "Windows CI: four adversarial symlink/EACCES tests are empty `#[cfg(not(unix))]` stubs."
test = "crates/sources/tests/adversarial/archive_symlink_target_swap_attempt.rs"
fix_target = "0.6.0"
# R4-SRC: plain_file_symlink_refused, walker_symlink_escape_outside_root, permission_denied_subtree_scan_continues.
# R4.3-SRC: adversarial/support.rs shared oracles (Unix+Windows); gap oracle adversarial_windows_stubs_no_op green.

[[finding]]
id = "KH-GAP-115"
severity = "bar-miss"
status = "fixed"
crate = "sources"
title = "FILE_GATE_MATRIX marks all sources+verifier modules `adversarial=false` despite green adversarial suites."
test = "tests/FILE_GATE_MATRIX.toml"
fix_target = "0.6.0"
# R4-SRC: registry honesty vs TESTING_PROGRAM meso bar.
# R4.3-SRC: sources+verifier rows adversarial=true; gap oracle file_gate_matrix_sources_verifier_adversarial_unmarked green.

[[finding]]
id = "KH-GAP-116"
severity = "bar-miss"
status = "fixed"
crate = "sources"
title = "Seven src submodule files absent from FILE_GATE_MATRIX (167/167 claim incomplete)."
test = "tests/FILE_GATE_MATRIX.toml"
fix_target = "0.6.0"
# R4-SRC: archive.rs, compressed.rs, walk_util.rs, skip_lists.rs, read/decode.rs, github_org/redact.rs, oob/decrypt.rs.
# R4.3-SRC: +7 [[module]] rows (174 total); gap oracle file_gate_matrix_missing_submodule_rows green.

[[finding]]
id = "KH-GAP-117"
severity = "micro-flaw"
status = "fixed"
crate = "verifier"
title = "VerificationEngine HTTP client builder lacks explicit auto-decompress disable."
test = "crates/verifier/tests/gap/verifier_client_no_auto_gzip.rs"
fix_target = "0.6.0"
# R4-SRC: verify/mod.rs:197 — no .no_gzip/.no_brotli/.no_deflate unlike sources blocking policy.
# R4.3-SRC: VerificationEngine::new disables auto-decompress; gap oracle green.

[[finding]]
id = "KH-GAP-118"
severity = "bar-miss"
status = "fixed"
crate = "sources"
title = "Docker image source has gap oracle only; zero adversarial runtime tests for tar bomb/slip."
test = "crates/sources/tests/adversarial/docker_tar_aggregate_cap_enforced.rs"
fix_target = "0.6.0"
# R4-SRC: docker.rs caps documented; no runtime bomb/slip adversarial in tests/adversarial/.
# R4.3-SRC: adversarial docker_tar_aggregate_cap_enforced green with --features docker.

[[finding]]
id = "KH-GAP-119"
severity = "micro-flaw"
status = "fixed"
crate = "verifier"
title = "Verifier proxy contract tests flake under parallel `cargo test` env mutation."
test = "crates/verifier/tests/contract/proxy_https_env_is_active.rs"
fix_target = "0.6.0"
# R4-SRC: contract::proxy_* lacks fleet-wide ENV_MUTEX; 2/5 parallel runs failed on NFS.
# R4.3-SRC: contract/support.rs fs2 lock_exclusive fleet-wide mutex; 5/5 parallel proxy runs green.

[[finding]]
id = "KH-GAP-120"
severity = "micro-flaw"
status = "fixed"
crate = "verifier"
title = "DNS pinning falls back to unpinned base_client when resolve_to_addrs build fails."
test = "crates/verifier/tests/gap/dns_pin_no_unpinned_fallback.rs"
fix_target = "0.6.0"
# R4-SRC: verify/request.rs:128-132 rebinding window on pinned-client build failure.
# R4.3-SRC: pin build failure returns blocked error (no unpinned fallback); gap oracle green.

[[finding]]
id = "KH-GAP-121"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "Cross-platform cfg gates essentially absent — platform_compat.rs is decorative."
test = "crates/scanner/tests/gap/cross_platform_cfg_gates_absent.rs"
fix_target = "0.6.0"
# R4.3-SCAN-M: src/platform_compat/{mod,path,io}.rs with windows/unix cfg gates; tests/platform_compat.rs wired.

[[finding]]
id = "KH-GAP-122"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "R3.2 inline_migrated test bodies exist but are not wired in tests/unit/mod.rs."
test = "crates/scanner/tests/gap/inline_migrated_tests_not_wired.rs"
fix_target = "0.6.0"
# R4.3-SCAN-M: pub mod inline_migrated in tests/unit/mod.rs; 75 unit tests green.

[[finding]]
id = "KH-GAP-123"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "Six scanner src files exceed Santh STANDARD 500 LOC cap."
test = "crates/scanner/tests/gap/scanner_src_files_exceed_standard_500_loc.rs"
fix_target = "0.6.0"
# R4.3-SCAN-M: split scan/backend/suppression/hw_probe/gpu/compiler into submodules (all ≤500 LOC).

[[finding]]
id = "KH-GAP-124"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "pipeline/postprocess/suppression.rs exceeds 500 LOC with no file-size gate."
test = "crates/scanner/tests/gap/suppression_postprocess_exceeds_modularity_cap.rs"
fix_target = "0.6.0"
# R4.3-SCAN-M: suppression split into helpers/markers/tail/inner/b64 (max 365 LOC).

[[finding]]
id = "KH-GAP-125"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "No worst-case full-corpus CPU/SIMD/GPU parity harness beyond sample fixtures."
test = "crates/scanner/tests/gap/backend_worst_case_parity_sample_only.rs"
fix_target = "0.6.0"
# R4-SCAN: backend_parity_matrix (6 synthetic) + gpu_parity; megakernel waived (043).

[[finding]]
id = "KH-GAP-126"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "Suppression vs shape-gates lack paired FP/FN pipeline twin tests."
test = "crates/scanner/tests/gap/suppression_shape_gate_pipeline_twins_incomplete.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-127"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "Orphan contract TOML github-pat has no matching loaded detector id."
test = "crates/scanner/tests/gap/orphan_github_pat_contract.rs"
fix_target = "0.6.0"
# R4.3-SCAN-M: contract stem github-pat-fine-grained matches detector id; oracle green.

[[finding]]
id = "KH-GAP-128"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "Bulk contract multipliers lack per-detector hostile near-miss twins (top-10 only)."
test = "crates/scanner/tests/gap/adversarial_bulk_lacks_per_detector_hostile_twins.rs"
fix_target = "0.6.0"
# R4-SCAN: adversarial_explosion_runner scales format wrappers, not chunk-boundary oracles.

[[finding]]
id = "KH-GAP-129"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "context/inference.rs literal #[cfg(test)] string breaks no-inline-tests gate."
test = "crates/scanner/tests/gap/context_inference_cfg_test_string_breaks_gate.rs"
fix_target = "0.6.0"
# R4.3-SCAN-M: RUST_CFG_TEST_ATTR via concat! avoids literal; gate green.

[[finding]]
id = "KH-GAP-134"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "FILE_GATE_MATRIX CLI rows stale after R3.2 args/orchestrator split (12 missing, orchestrator.rs phantom)."
test = "crates/cli/tests/gap/file_gate_matrix_cli_split_rows_stale.rs"
fix_target = "0.6.0"
# R4.2-CLI: 42 src files in matrix; removed orchestrator.rs phantom row.

[[finding]]
id = "KH-GAP-135"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "FILE_GATE_MATRIX marks all CLI modules boundary/adversarial/e2e_linked=false."
test = "crates/cli/tests/gap/file_gate_matrix_cli_hostile_columns_unmarked.rs"
fix_target = "0.6.0"
# R4.2-CLI: CLI rows now boundary/adversarial/e2e_linked=true (42/42).

[[finding]]
id = "KH-GAP-136"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "CLI adversarial Windows stubs are assert!(true) no-ops — zero hostile coverage on Windows."
test = "crates/cli/tests/gap/adversarial_windows_stubs_no_op.rs"
fix_target = "0.6.0"
# R4-CLI: unicode/pipe/concurrent/utf8 windows_stub.rs files.

[[finding]]
id = "KH-GAP-137"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "No contract/help_documents_exit_code_four for documented backend --self-test exit 4."
test = "crates/cli/tests/gap/contract_help_missing_exit_code_four.rs"
fix_target = "0.6.0"
# R4.2-CLI: contract/help_documents_exit_code_four.rs added.

[[finding]]
id = "KH-GAP-138"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "LR2-A8 gap_mod harness: every pub mod in gap/mod.rs must have a matching gap/<name>.rs (was a brittle pub-mod count assertion)."
test = "crates/cli/tests/integration/a8_harness/gap_mod_wiring.rs"
fix_target = "0.6.0"
# R4.2-CLI: harness oracle updated to 39 pub mod entries.

[[finding]]
id = "KH-GAP-139"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "contract/scan_missing_path_stderr_nonempty is stderr-nonempty-only (assertion theater)."
test = "crates/cli/tests/gap/contract_missing_path_stderr_weak_oracle.rs"
fix_target = "0.6.0"
# R4.2-CLI: contract asserts exit 2 + actionable missing-path stderr.

[[finding]]
id = "KH-GAP-140"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "tests/property/mod.rs and tests/concurrent/mod.rs empty — STANDARD categories 3/5 absent."
test = "crates/cli/tests/gap/property_and_concurrent_categories_empty.rs"
fix_target = "0.6.0"
# R4-CLI: concurrency partially in adversarial/stress only.

[[finding]]
id = "KH-GAP-141"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "No adversarial runtime tests for daemon/hook/baseline/scan-system/watch subcommands."
test = "crates/cli/tests/gap/adversarial_missing_non_scan_subcommands.rs"
fix_target = "0.6.0"
# R4-CLI: TESTING_PROGRAM §2A macro slices; adversarial/ is scan-only today.

[[finding]]
id = "KH-GAP-142"
severity = "bar-miss"
status = "fixed"
crate = "cli"
title = "Macro e2e binaries (e2e_binary, break_it, live_verify) outside all_tests harness."
test = "crates/cli/tests/gap/macro_e2e_binaries_not_in_all_tests_harness.rs"
fix_target = "0.6.0"
# R4-CLI: primary `cargo test -p keyhog --test all_tests` under-reports macro e2e coverage.
# R5-D1: dogfood round — 8 new micro flaws 143–150 (site doc lies, SARIF URI, UX); all fixed same round.

[[finding]]
id = "KH-GAP-143"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "site/hooks.html documents phantom hook install flags (--no-daemon, --severity)."
test = "crates/cli/tests/gap/site_hooks_phantom_install_flags.rs"
fix_target = "0.6.0"
# R5-D1: KH-GAP-104 fixed README only; site/hooks.html + site/pages/hooks.html still lied.

[[finding]]
id = "KH-GAP-144"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "site/api.html documents phantom `keyhog_core::embedded_detectors()` API."
test = "crates/cli/tests/gap/site_api_embedded_detectors_phantom.rs"
fix_target = "0.6.0"
# R5-D1: KH-GAP-107 fixed README only; site/api.html + pages/api.html still lied.

[[finding]]
id = "KH-GAP-145"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "SARIF tool driver informationUri pointed at github.com/keyhog/keyhog."
test = "crates/cli/tests/gap/sarif_information_uri_santhsecurity.rs"
fix_target = "0.6.0"
# R5-D1: sarif.rs → github.com/santhsecurity/keyhog; GitHub code scanning link fix.

[[finding]]
id = "KH-GAP-146"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "load.rs warn text cited phantom `keyhog detectors list` subcommand."
test = "crates/cli/tests/gap/load_rs_phantom_detectors_list_in_warn.rs"
fix_target = "0.6.0"
# R5-D1: KH-GAP-108 oracle missed load.rs tracing path; → `keyhog detectors`.

[[finding]]
id = "KH-GAP-147"
severity = "micro-flaw"
status = "fixed"
crate = "core"
title = "`--dogfood` scan still printed \"Pass --dogfood\" when flag already active."
test = "crates/cli/tests/gap/dogfood_summary_no_pass_dogfood_when_active.rs"
fix_target = "0.6.0"
# R5-D1: TextReporter::set_dogfood_active + reporting.rs wiring.

[[finding]]
id = "KH-GAP-148"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`scan --git-history` on non-repo printed clean summary before source-error bail."
test = "crates/cli/tests/gap/git_history_non_repo_no_clean_summary.rs"
fix_target = "0.6.0"
# R5-D1: run.rs bails before report_findings when SOURCE_ERRORS && empty findings.

[[finding]]
id = "KH-GAP-149"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "README license badge/text MIT-only while workspace is MIT OR Apache-2.0."
test = "crates/cli/tests/gap/readme_license_badge_dual_spdx.rs"
fix_target = "0.6.0"
# R5-D1: KH-GAP-133 fixed Cargo.toml; README badge + License section still MIT-only.

[[finding]]
id = "KH-GAP-150"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "`keyhog scan --help` omitted EXIT CODES table present on top-level --help."
test = "crates/cli/tests/gap/scan_help_documents_exit_codes.rs"
fix_target = "0.6.0"
# R5-D1: args.rs Scan subcommand after_help mirrors root exit table.

[[finding]]
id = "KH-GAP-165"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2: `--lockdown --verify` coredump preflight masked verify incompatibility message."
test = "crates/cli/tests/stress/lockdown_verify_refused_before_preflight.rs"
fix_target = "0.6.0"
# R5-D2: reject lockdown+verify/show-secrets before apply_lockdown_protections().

[[finding]]
id = "KH-GAP-166"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2: SIGINT mid-scan must exit 130 with interrupt banner (STANDARD fleet table)."
test = "crates/cli/tests/stress/sigint_mid_scan_exits_130.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-167"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2 stress: `--git-staged` must scan indexed secrets."
test = "crates/cli/tests/stress/git_staged_secret_in_index.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-168"
severity = "micro-flaw"
status = "dupe"
dupe_of = "KH-GAP-092"
crate = "cli"
title = "R5-D2 stress mirror: `--git-diff HEAD` worktree coverage."
test = "crates/cli/tests/stress/git_diff_head_worktree_stress.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-169"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2 stress: `--git-history` must surface prior-commit secrets."
test = "crates/cli/tests/stress/git_history_committed_secret.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-170"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2 stress: symlinked files must be scanned via follow."
test = "crates/cli/tests/stress/symlink_follows_secret_target.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-171"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2 stress: permission-denied walk entries warn and scan continues."
test = "crates/cli/tests/stress/unreadable_dir_warns_scan_continues.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-172"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2 stress: piped stderr must not corrupt JSON stdout."
test = "crates/cli/tests/stress/piped_stderr_scan_json_stdout_valid.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-173"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2 stress: empty directory corpus exits 0 with JSON []."
test = "crates/cli/tests/stress/empty_corpus_json_array_exit_zero.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-174"
severity = "micro-flaw"
status = "fixed"
crate = "cli"
title = "R5-D2 stress: KEYHOG_REQUIRE_GPU=1 scan succeeds when GPU self-test passes."
test = "crates/cli/tests/stress/require_gpu_scan_when_self_test_passes.rs"
fix_target = "0.6.0"

[[finding]]
id = "KH-GAP-175"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "FILE_GATE_MATRIX scanner rows left adversarial=false despite adversarial suites."
test = "crates/scanner/tests/gap/file_gate_matrix_scanner_adversarial_unmarked.rs"
fix_target = "0.6.0"
# R5-REV-STD: all scanner [[module]] rows adversarial=true.

[[finding]]
id = "KH-GAP-176"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "FILE_GATE_MATRIX missing scanner split-module rows (scan_gpu stale)."
test = "crates/scanner/tests/gap/file_gate_matrix_scanner_missing_submodule_rows.rs"
fix_target = "0.6.0"
# R5-REV-STD: +39 rows; removed stale engine/scan_gpu.rs.

[[finding]]
id = "KH-GAP-177"
severity = "bar-miss"
status = "fixed"
crate = "core"
title = "FILE_GATE_MATRIX core rows left error/adversarial=false despite suites."
test = "crates/core/tests/gap/file_gate_matrix_core_columns_unmarked.rs"
fix_target = "0.6.0"
# R5-REV-STD: all core [[module]] rows error+adversarial=true.

[[finding]]
id = "KH-GAP-178"
severity = "bar-miss"
status = "fixed"
crate = "core"
title = "FILE_GATE_MATRIX missing core spec/source split-module rows."
test = "crates/core/tests/gap/file_gate_matrix_core_missing_submodule_rows.rs"
fix_target = "0.6.0"
# R5-REV-STD: +5 rows (spec/*, source.rs).

[[finding]]
id = "KH-GAP-179"
severity = "bar-miss"
status = "fixed"
crate = "scanner"
title = "WAIVED registry rows and meta waivers lacked dedicated expiry oracles."
test = "crates/scanner/tests/gap/waived_findings_registry_has_expiry_fields.rs"
fix_target = "0.6.0"
# R5-REV-STD: expiry oracles for 043/111/130 + registry waiver_expires field on 130.

[[finding]]
id = "KH-GAP-164"
severity = "micro-flaw"
status = "fixed"
crate = "scanner"
title = "Invalid embedded checksum still emitted findings on named npm/github-pat-fine-grained detectors."
test = "crates/scanner/tests/gap/r5_checksum_invalid_drops_named_service_match.rs"
fix_target = "0.6.0"
# R5-REV-SCAN: scan_process.rs drops ChecksumResult::Invalid for all detector paths.