Reduce source-scan false positives and separate capabilities from security warnings

[tolgaergin]

Problem and result

Source scans treated ordinary API capabilities as high security warnings and matched local helpers or static module calls incorrectly. Audit and install now show capabilities separately, with bounded source evidence. Explicit --fail-on=behavior and --fail-on=all policies retain their severities. JSON moves capabilities out of issue counts into packages[].capabilities and total_capabilities.

The frozen 1,000-package review removed 10 unsupported matches across nine packages and 12 unproven shell inferences. It added 16 valid capability detections. No critical source alerts appeared; three packages have partial coverage. Popularity is not a safety label, and final validation includes a disclosed validation-driven correction.

Validation

• Rust 1.94.0: zero-warning workspace build and Clippy; 14,347 macOS workspace tests passed, 26 skipped. Corpus helpers: 11 passed. CLI serial, targeted audit/install/JSON/policy workflows, dependency policy, and CI helpers passed.
• Seven alternating release-binary pairs: full-corpus warm scan ~1.80 s for both; median peak RSS 67.5 → 82.2 MiB. Five-package cold install with scanning 702 → 737 ms; warm 57 → 56 ms. Install performance gate passed. Cold results include lifecycle metadata network noise.
• Finding ledger: 9 received, 9 verified and fixed, 0 rejected, 0 externally blocked, 0 pending.

Full report, frozen inputs, reviewed evidence, and measurements.

Generated by OpenAI Codex (GPT-6) using the Codex agent harness.