Kjell Tore Guttormsen 50f60b46e2 fix(posture): NIST Govern credit for policy.json only when it is honored ... checkNISTAlignment credited Govern for a .llm-security/policy.json that merely existed. Since v8.1.0 policy-loader ignores a target's policy outside the caller's own working tree, so a foreign target (a clone, an installed package) earned governance credit for a file no scanner reads. The credit now also requires isOwnWorkingTree(projectRoot). Red first: the two foreign cases (node_modules package, target outside cwd) failed; the own-tree known-positive passed before and after. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>		2026-09-22 21:32:46 +02:00
..
e2e	test(llm-security): build poisoned fixtures at test time, never on disk	2026-09-22 13:07:38 +02:00
fixtures	test(ast-taint): materialize the ast-scan fixtures at test time	2026-09-22 14:11:27 +02:00
golden	refactor(llm-security): build the SIG ruleset from vendored commons (malware-signatures 0.1.0)	2026-08-13 21:28:14 +02:00
helpers	fix(policy): read policy.json only from the caller's own working tree	2026-09-22 20:15:17 +02:00
hooks	refactor(llm-security): build the secret table from vendored commons (secret-egress 0.3.0)	2026-08-13 21:10:14 +02:00
lib	fix(scope): node_modules and the Claude Code plugin dir are foreign	2026-09-22 21:32:40 +02:00
scanners	fix(posture): NIST Govern credit for policy.json only when it is honored	2026-09-22 21:32:46 +02:00
av-surface.test.mjs	test(ast-taint): materialize the ast-scan fixtures at test time	2026-09-22 14:11:27 +02:00