mikronova/modgunn

Móðguðr — master plan & analysis catalog (the "modgunn prompt")

This is the living driver for modgunn. Keep adding here. Referenced from workspace_nordisk/PLAN.md (§ Móðguðr). Detail on the 25 advanced world-delta analyses lives in engine-b-analyses.md; the repo rationale/decisions in nornir/.nornir/modgunn-security-scanner.md.

Móðguðr guards Gjallarbrú and demands to know who crosses. She is not a blind woman — she has an Iceberg warehouse (full history, time-travel, CDC) and a graph (SCIP call-graph + resolved dep-graph). Every analysis below is something she can actually compute from those two organs.

0. Dependency direction (locked)

        Móðguðr  (security + SCIP world-delta engine, leaf)
        /      \
   holger      nornir        ← both depend on Móðguðr; no cycle
        \
         skade  (embedded Apache Iceberg catalog + reader/writer)

• nornir → modgunn ✅ (nornir is the consumer: viz Security pane + tripwire feed)
• holger → modgunn ✅ (policy gate / promotion gate consumes core::Verdict)
• modgunn → skade ✅ (warehouse access — open the shared catalog directly)
• modgunn → nornir ❌ never (that is the cycle modgunn exists to break)

modgunn talks to the warehouse through iceberg tables, not nornir's API — it opens the same physical catalog.redb + warehouse/ in the shared nornir namespace. To avoid dependency hell, the only build-time dep this adds is skade (feature warehouse, off by default; holger's lean gate stays pure-leaf).

1. Outbreak status (what's implemented vs left)

CDC — is it complicated? Does iceberg-rust already support it?

Not complicated for modgunn — skade already did the hard part. Answer in three points:

1. iceberg-rust 0.9.1 has NO native incremental/changelog scan — only time-travel by snapshot_id. (The vendored iceberg-arrow58 fork defines the changelog record vocabulary — INSERT/DELETE/UPDATE_BEFORE/UPDATE_AFTER in metadata_columns.rs — but exposes no scan that produces it.)
2. skade reconstructs CDC itself from the manifest layer. skade::Table::read_delta(from, to) walks the snapshot lineage (parent_snapshot_id) and returns a DeltaPlan: the data files added by the window (inserts) + the equality-delete files (identity deletes), with needs_full_reload set for overwrite/position- delete commits an additive delta can't express. So inserts + identity-deletes are already true CDC.
3. modgunn just consumes it. warehouse::Warehouse::commit_seq() (poll to notice change cheaply) → table_delta(table, from) (the changed rows + new watermark). When upstream iceberg-rust ships a native changelog scan, skade swaps its internals and modgunn's API does not change. The DataFusion sql surface (skade sql feature) is the optional richer-query path.

Skade design drawing TODO: add the read_delta/DeltaPlan CDC path to skade's SVG design diagrams (the snapshot-lineage walk → added data-files + equality-deletes → DeltaPlan, with the needs_full_reload fallback edge). File under skade .nornir/ design assets next to the time-travel drawing.

2. What Móðguðr can see (her two organs + the feeds)

Every analysis emits Finding{severity, kind, subject, evidence} → folded into a core::Verdict (Pass/Warn/Block), plus a Tripwire event stream for the world-delta site.

3. THE CATALOG — every security analysis, by scale

The same world can be interrogated at very different corpus sizes. modgunn is designed to answer at every scale; what changes with scale is which methods are affordable and which signals only emerge in aggregate.

Scale ladder (axis A)

Scaling math (cost model). Per-artifact checks are O(bytes), embarrassingly parallel → the gatling all-core pool. Closure checks are O(V+E). Global graph algorithms are the expensive tier: betweenness O(V·E), PageRank O(E·iters), community detection (Louvain) ~O(E), min-cut O(V·E²) (use max-flow on the small entrypoint→sink subgraph, not the whole graph). At S3/S4 these are not recomputed per query — they are materialized into Iceberg tables and refreshed incrementally off the CDC delta (only recompute the neighborhood a read_delta touched), which is the whole reason skade's history matters.

Method families (axis B) — with the actual math

Extends the 7 families in engine-b-analyses.md. Each row: the analysis, the math/algorithm, and the smallest scale it needs.

F0 — Per-artifact static (S0).

F1 — Closure / graph-local (S1).

F2 — Structural graph algorithms (S2–S3).

F3 — Statistical & ML anomaly (S3–S4).

F4 — Provenance & integrity deltas (S0–S2).

F5 — License / legal drift (S1–S3).

F6 — Temporal / CDC (S1–S4) — where Iceberg + skade earn their keep.

F7 — Tripwires (declarative, active; any scale).

4. Compute tiers (where each runs)

• Cheap (holger gate / per-serve, online, Engine A latency budget): A1–A5, A8, A17, A24, A27, A28, A35 — set lookups + small reachability.
• Medium (per-promote / nightly): A6, A9–A12, A18–A20, A25, A30, A33, A36.
• Heavy (world-delta site, 128 GB – 1 TB RAM): A13–A16, A21–A23, A26, A29, A31, A34 — whole-graph algorithms + embeddings + full SCIP closure over the transitive world. Materialized into Iceberg, refreshed off the CDC delta (§3 scaling math).

5. First slices (when Engine B starts, post-demo)

1. ✅ WorldSnapshot capture → world_snapshots + dep_edges + scip_symbols Iceberg tables (warehouse::capture_world_snapshot, gated scip+warehouse).
2. ✅ diff() → BehaviorDelta: F1 #A8 (scip::reachability_gated_vulns) makes Engine A's CVE verdicts precise (reachable vs merely-present); sink-newly-reachable (#5) over the snapshot pair is the highest-signal delta tripwire.
3. ✅ A1 (CallGraphDeltaTripwire) + A9 (CapabilityDriftTripwire) world-delta tripwires; A13 (blast_radius, PageRank) + A22 (FingerprintDriftTripwire).
4. ✅ The full catalog is landed — the Engine-B core now carries the graph/ anomaly/supply-chain analyses plus 2 provenance analyses and the temporal two-point diff verb (25/25 catalog, see engine-b-analyses.md): diamond/multi-version (#15), chokepoint/min-cut (#14), bus-factor (#12), typosquat+dep-confusion (#8), metric-outlier z-score (#16), obfuscation/entropy (#17), release-cadence anomaly (#7), owner-cluster label-propagation community detection (#13), change-velocity release-rate bursts (#25), license-transition tracking (#19), embedding-novelty (#18), publisher/maintainer ownership-transfer anomaly (#6, MaintainerAnomalyTripwire), SBOM drift (#20, SbomDriftTripwire), policy-tripwire DSL (#21, PolicyRule), threshold-tripwire DSL (#22, ThresholdRule), honeytoken/canary (#23, honeytoken_findings), world time-travel two-point diff (#24, warehouse::world_diff), and the sealed build-provenance VERIFY + build_provenance ledger (#9/#10, provenance.rs/warehouse.rs) — plus a taint-path source→sink analysis (taint_path_findings) beyond the numbered catalog. All 25 numbered analyses now have real logic + unit tests.
5. Incremental refresh: wire the heavy materializations (#11/#15) to recompute only the neighborhood read_delta touched — TODO (CDC seam table_delta ready).

6. nornir → modgunn cutover plan (the extraction)

Status (warehouse-routed cutover — core landed, green across modgunn + nornir + holger):

• ✅ modgunn M1 — osv::parse_rustsec_md + rustsec_affected_ranges: rustsec .md import with the patched/unaffected → RangeEvent inversion, behind the off-by-default rustsec feature (lean gate stays toml-free); oracle-tested against cargo-audit's rule (incl. the aws-lc multi-branch case).
• ✅ modgunn M2 — sbom::to_cyclonedx (multi-ecosystem purl); cargo output byte-compatible with nornir's prior literal.
• ✅ nornir N1–N4 — modgunn dep on features=["warehouse","rustsec"] (skade already a nornir path-dep, so no new tree); security::import_advisory_db_into_warehouse (rustsec mirror → cve_advisories, wired into security update-db); security::verdict re-sourced from the warehouse (verdicts_with / verdicts_from_warehouse) — the all-High mapper is deleted, real severity/EPSS/KEV drives the decision, matching happens once in modgunn; to_cyclonedx delegates to modgunn::sbom.
• ✅ N5 — warehouse::Warehouse::open_read_only (lock-tolerant copied-aside snapshot, mirroring nornir's open_read_only; no skade change — skade stamps absolute file:// data paths, so a copied catalog still resolves live data). The live Mimir.SecurityScan RPC now folds a warehouse-sourced verdict (verdict::verdicts_from_warehouse, real severity/EPSS/KEV) into its JSON additively — it reads a snapshot while the server holds the catalog write lock, so no contention; the viz Security tab + CLI server-mode render the Pass/Warn/Block badge.
• ✅ N5 tail — the RPC's display vulns[] is now ALSO warehouse-sourced: when cve_advisories is populated it is derived from the same verdict scan (one in-memory match, no OSV/rustsec double-match); query_vulns + the vuln_findings cache remain only as the fallback for an un-imported warehouse (no regression). An authoritative Pass/Warn/Block decision is emitted only when populated, else omitted (no misleading PASS). Adversarially reviewed (10 agents, 0 confirmed defects). osv_query/advisory_db_query are now fallback/importer-only.

Public surface nornir consumers use today (from the security map; preserve or re-home each):

• Security DOMAIN → move into modgunn (leaf-clean): scan, query_vulns, osv_query, advisory_db_query, to_cyclonedx, scan_outcome, update_advisory_db, types SecurityReport/Component/Vuln. modgunn's OsvScanner + warehouse already cover the verdict + advisory-feed half.
• Build-orchestration → STAYS in nornir (it is nornir's build concern, not a security primitive): components/components_warehouse_first, warm*, persist_sbom, prepare_path_deps, unresolved_path_dep_siblings, materialize_path_dep_siblings, dep_clone_base — these resolve a repo's dep closure (cargo metadata, sibling-repo cloning) and feed components into modgunn.
• Seam: nornir computes Components → hands them to modgunn::scan → gets Vuln/Verdict back; persistence of vuln_findings/sbom_components is shared (either side may write via skade, single-writer coordinated).

Consumers to update (file:line): viz/security_tab.rs:32,135; bin/nornir.rs:5104–5158; bin/nornir-server.rs:1922–2317; monitor.rs:543–557; introspect/depgraph.rs:45,55; gitio.rs:757. Add to nornir/Cargo.toml: modgunn = { path = "../modgunn", features = ["warehouse"] }.

7. World survey — prior art, modgunn's edge, and what to adopt

Web survey (2026-06) of the world's software/dependency security scanning & analysis landscape, mapped onto §3's catalog. Sources at the end of this §.

7.1 The landscape, by layer

7.2 Móðguðr's edge (why she is not just another scanner)

The field is fragmented: SCA tools own the dep-graph, SAST tools own the call-graph, GUAC owns metadata-graph aggregation, Socket owns behavioral malware, and almost no one owns history. modgunn's two organs fuse these:

1. Iceberg time-travel + CDC = history almost nobody has. Point-in-time is the industry norm; modgunn historizes the whole world and diffs any two snapshots (A22 behavior-fingerprint drift, A31–A34, A33 velocity). The "5th-level jar unchanged for years that silently changed behavior" is a signal the standard stack structurally cannot emit — it keeps no per-symbol behavior history. skade's read_delta makes it cheap.
2. One engine fuses call-graph (CodeQL-grade) + dep-graph (GUAC-grade). Reachability-gated vuln (A8) — the commercial differentiator (Snyk/Endor) — is first-class, multi-ecosystem, and offline, not a 3-language add-on.
3. Airgap/offline by construction. OSV-Scanner etc. need network; modgunn's advisory DB is warehouse-resident (sealed-znippy import → cve_advisories, db_rev = the cache key). The government "knows exactly what happens to the smallest bit" posture.
4. One verdict shape A→B. Gate (Engine A) and world-delta (Engine B) both emit core::Verdict — the field needs 5+ tools stitched together for this surface.

7.3 Adopt-list (converged standards modgunn should ingest — concrete next adds)

• ✅ EPSS + KEV + VEX prioritization — DONE (scan.rs + feeds.rs): Advisory.epss/kev, Policy.kev_blocks/epss_block_threshold/vex_not_affected; KEV→Critical, EPSS≥τ→High, VEX not_affected suppression. Live feed import landed (feeds.rs): parse_epss_csv (FIRST CSV), parse_kev_json (CISA), enrich() by CVE id so the flags are populated, not just honored.
• ✅ OSV as the import format — DONE (osv.rs + versions.rs + feeds.rs): single + batch OSV/GHSA/RUSTSEC JSON → Advisory; per-ecosystem range→exact expander (versions.rs: semver/PEP440-lite/maven-lite/loose + OSV introduced/fixed/last_affected windows; osv::parse_osv_ranges + expand_advisories); OpenSSF Malicious Packages feed (feeds::parse_malicious → Critical MAL-*).
• ✅ Sigstore / SLSA verification for A3/A25/A26 — DONE (provenance.rs): Attestation + ProvenanceRequirement::evaluate (min-SLSA / trusted-signer / source-repo match → scan::Provenance + findings); attestation_delta (A25 signer/source change, appears/disappears). cosign/rekor wire-up stays dynamic-plane.
• ✅ OSSF Scorecard signals as A14/A24 features — DONE (provenance.rs): ScorecardSignals (overall, maintained?, branch-protection, signed-releases, dangerous-workflow) → advisory Findings (dangerous-workflow → High, low score / unmaintained → Medium, no branch-protection → Low). parse_scorecard ingests a raw scorecard --format json report into those signals offline (the feeds::parse_* shape: pure serde_json, pass at score>=5, Dangerous-Workflow inverted 0=found/10=clean). Warehouse-persisted via append_scorecard / load_scorecard (subject-keyed, latest-wins), and driveable from the CLI — modgunn scorecard --path <report.json> [--subject <name>] [--warehouse <root>] folds a report, prints the signals + findings, and (with --warehouse) persists them for warehouse provenance-log to read back.
• ✅ Behavior/metadata features for A23 (the malicious-package model) — feature extraction DONE (behavior.rs): [parse_npm_package] folds an npm package.json's auto-run install hooks (preinstall/install/postinstall/ prepare) into [PackageBehavior] — install-script hooks, network-in-install (dropper stage-2 fetch), # URLs, max install-script Shannon entropy (obfuscation, reusing core::shannon_entropy — the SAME metric the SCIP A17 tripwire keys on, no twin, L5), and the sensitive-API set (child_process/eval(/atob(//dev/tcp/…). [PackageBehavior::findings] ranks the feature vector into core::Findings (network-in-install → High, sensitive-API / obfuscation → Medium, install-hook → Low). Offline, no code executed — the feeds::parse_* shape. Second front-end landed: [parse_pypi_setup] reads a PyPI setup.py (Python = #2 malware ecosystem; the whole file runs at sdist install, so it is scanned in full; the install-hook signal is a cmdclass install/develop override) through the SAME extract_from_install_text folder into the SAME [PackageBehavior] — no twin. Sensitive-API table extended with Python primitives (os.system/subprocess/ marshal.loads/pickle.loads/__import__(). Third front-end landed: [parse_pyproject_toml] reads a PEP 621/517 pyproject.toml — but declarative TOML can't be whole-file-scanned (a [project] dependencies = ["urllib3"] would trip the urllib needle, a [project.urls] Homepage = "https://…" the https:// needle → a spurious network_in_install on nearly every honest project), so it is TOML- section-aware: it folds only the build/install-active sections ([build-system], a PEP 517 in-tree backend-path, a cmdclass table, a [tool.*.build.hooks…] build-hook) and skips the declarative [project] deps/URLs and the dependency-list keys (requires/dependencies/optional-dependencies) even inside an active section — through the SAME extract_from_install_text folder into the SAME [PackageBehavior], no twin. Implemented as a tiny line-scanner with no toml dependency, so the pyproject front-end stays inside the lean scan gate (the toml crate never enters the default binary — holger/static-holger purity, matching the rustsec/manifests gating). Fourth front-end landed: [parse_setup_cfg] reads a setuptools setup.cfg — declarative INI with the same false-positive hazard, so likewise section-aware: a hand-rolled INI line-scanner (tracks [section] + indent- continuation, no ini/configparser crate, same lean-gate constraint — cargo tree --no-default-features --features scan pulls 0 ini/toml) that folds only the build/install-active keys ([options] cmdclass / dependency_links, a build-active [options.entry_points] group) and skips [metadata] (incl. url/project_urls) and the declarative dep keys (install_requires/extras_require/python_requires/…) even inside [options] — through the SAME extract_from_install_text folder into the SAME [PackageBehavior], no twin. A benign declarative setup.cfg (install_requires incl. urllib3, a [metadata] url = https://…) is clean; a dependency_links payload fetch + cmdclass override is flagged High + Low install-hook. The isolation-forest / behaviour-sequence scoring model over the feature vector is the remaining dynamic-plane consumer (TODO — needs a training corpus/model store, off-laptop). Driveable from the CLI (landed): modgunn behavior --path <package.json|setup.py|pyproject.toml|setup.cfg> [--ecosystem npm|pypi|pyproject|setupcfg] [--subject <name>] [--fail-on-finding] [--warehouse <root>] folds one package, prints the vector + findings, and --fail-on-finding exits 3 so a promotion gate can block a suspicious package (tests/cli_behavior.rs). Warehouse-persisted (landed): with --warehouse the ecosystem-tagged vector + its derived verdict (worst severity + finding ids) is appended to the behavior_features table via [Warehouse::append_package_behavior] — the SAME warehouse-persist plumbing scorecard --warehouse uses (no second seam, L5) — and read back by [load_package_behaviors] / the warehouse behavior-log verb, a field-identical round-trip (mutation-verified). All behind the warehouse feature; the lean scan/default gate is untouched (cargo tree --no-default-features --features scan pulls 0 skade/arrow).

7.4 Sources

SCA comparisons (Aikido, OX, ARMO, AppSecSanta); OpenSSF (Scorecard/SLSA/Sigstore/GUAC), deps.dev API blog, GUAC docs; Semgrep & CodeQL (taint/dataflow); EPSS/KEV/SSVC/VEX (Endor Labs, Picus, FIRST EPSS); Socket H1-2025 malicious-package report; arXiv: malicious-PyPI/npm ML detection (2412.05259, 2309.02637, 2606.19063), SBOM-graph attack-chain prediction (2604.04977). (Full URLs in the survey turn; re-fetch on demand.)

8. Open decisions

• Advisory-DB sourcing in airgap: offline OSV/CVE snapshots carried in a sealed znippy → imported into cve_advisories (modgunn owns the table; db_rev is the import revision and the verdict cache-key component). → full plan: cve-warehouse-ingest.md — all major vuln DBs (OSV.dev/NVD/GHSA/KEV/EPSS/distro) → Iceberg, range-native matching, sealed-znippy import pipeline, scan-all-deps join; phases P0–P6.
• DONE — single-writer coordination. Warehouse::open_read_only (src/warehouse.rs:182) is the read-only copied-snapshot path, lock-tolerant against a live writer; covered by open_read_only_reads_while_writer_holds_the_lock (src/warehouse.rs:1681).
• DONE — tripwire rule DSL for F7. PolicyRule/PolicyTripwire (src/scip.rs:1858) is the declarative rule DSL (NoCapabilityGrowth, NoNewNativeCode, NoUnverifiedDependencyAdded, ForbidEcosystem), with a default_policy() ruleset and test coverage (policy_tripwire_fires_on_declarative_rule_breaks, src/scip.rs:2796).

9. Consolidation seam evaluation (panels / skidbladnir / jera)

Per workspace_nordisk/.nornir/consolidation-panels-maps-design.md. Recorded so a future agent does not re-litigate: modgunn's answer to the constellation seams.

• Panels / WASM-UI Panel trait — N/A. modgunn is a library + a thin offline CLI (src/main.rs): no GUI, no egui surface, no viz of its own. Its verdicts are rendered by nornir's Security pane (nornir owns the panel; modgunn owns the core::Verdict shape it draws). Nothing to port to a Panel backend here.
• Skidbladnir (service/systemd/federation) — N/A. modgunn runs no daemon and holds no socket. It is consumed in-process by holger's gate and nornir's server; those hosts own the service/systemd layer. modgunn contributes no long-lived process to unify.
• jera (job handler: process | VM | container) — candidate, NOT adopted (by design). modgunn's fleet scan fans out in-process on znippy-zoomies' gatling_for_each (scan_components, AdvisoryEngine::fleet) — a CPU-bound all-cores map over one shared read-only engine, milliseconds to low seconds even at the 1 M-artifact / 200 k-advisory bench point. That is not a process/VM/container job and must not become one: wrapping each verdict in a jera-tracked job would add scheduling + IPC overhead to the hottest loop modgunn has and regress the very hot path this repo guards (see .nornir/engine-benchmarks.md; the new modgunn.fleet_scan_indexed Loki arm now watches it). jera becomes relevant ONLY if a world-delta materialization run (S3/S4: whole-graph PageRank / community detection / embedding refresh off a read_delta, master-plan §3–4 "Heavy" tier) should become a durable, tracked, restartable batch job — those are long (minutes+), coarse-grained, and worth checkpointing, unlike the per-artifact scan. Decision: defer. Keep the in-process gatling scan as-is; revisit jera only when the heavy incremental-materialization pipeline (§5 item 5, still TODO) is built, and then only at the run granularity, never per-verdict.

10. Common-framework parity (2026-07-14) — About · 🧰 Tools · lifecycle

Reconciles §9 with the suite-wide mandate ("every app shares — and does not duplicate — lifecycle, thin/fat, an About + a Tools menu whose demos start containers via jera"). modgunn now carries its slice of the shared shell, CONSUMING the shared crates (L5). See framework-design.md / framework-guide.md.

• About — about.rs (always compiled, serde_json only): modgunn about [--json] prints the identity (name · Móðguðr · version · both engines). Lean-gate safe (holger/static-holger keep it).
• 🧰 Tools + jera demo — tools.rs (feature framework): modgunn tools / modgunn demo advisory-feed --out <dir>. The DemoAdvisoryFeed entry is a jera::container::ContainerSpec (pinned alpine, /out bind) run as a tracked jera job (run_container, feature framework-oci) → writes a demo OSV doc → warehouse import --osv → warehouse scan. This is the coarse-grained container job §9 allowed (NOT the per-verdict hot path — that stays in-process gatling). No bespoke docker, no thread::spawn.
• Lifecycle — service.rs (feature framework): modgunn service --unit renders modgunn's world-delta gatekeeper as a skidbladnir::service::ServiceSpec through the shared Lifecycle (the ONE systemd renderer + dedicated modgunn system user, AgentMode::Fat). This updates §9's "skidbladnir N/A": modgunn now declares its (future) world-delta-watcher lifecycle through the ship rather than owning none — the watcher daemon itself (ExecStart = modgunn world-delta watch) is the one deferred piece.
• Lean-gate proof. jera + skidbladnir are optional (framework = ["dep:jera", "dep:skidbladnir", "dep:anyhow"]; framework-oci = ["framework", "jera/container-oci"]). cargo tree --no-default-features --features scan → 0 jera/skidbladnir/draupnir/bollard.
• Move-to-edda candidates (copied-not-shared, noted not fixed this pass): (1) a shared About component — none exists; korp draws a bespoke egui About, so the Identity model is a facett-about/edda candidate. (2) the ToolMenu model + jobs sink() adapter — korp's tools.rs/jobs.rs and modgunn's are near-identical; target a jera::jobs::workspace_sink helper + a generic ToolMenu in an edda leaf.