repo-forensics

<!-- repo-forensics v2 | built by Alex Greenshpun | https://linkedin.com/in/alexgreensh --> # Repo Forensics v2 Deep security auditing for repositories, AI agent skills, and MCP servers. ## Highlights - **Rules-as-data** (v2.10): ~545 behavioral detection patterns live in versioned JSON rule packs (`data/rulepacks/*.json`), not compiled into source. Each rule carries a stable id, severity, confidence score, explanation, and embedded self-tests. Pack-driven scanners: secrets, SAST, skill threats, MCP security, runtime dynamism, and shared patterns. Algorithmic scanners (entropy, AST, DAST, git forensics, integrity, manifest drift, binary, lifecycle, dependencies, infra, devcontainer, post-incident, dataflow, entrypoint) remain code-driven; they do not receive feed updates. - **Signed daily rule-pack feed** (v2.10): New detection rules reach installed users without a code release. An Ed25519-signed bundle is fetched by the daily `refresh_threat_dbs.py` pipeline. Shipped packs always work offline; the feed only overlays when verified, schema-valid, and strictly newer than the last accepted version. The same signing now covers the IOC feed for symmetric trust. - **Confidence tiers + verdict levels** (v2.10): Findings carry a `confidence` score. Four verdict tiers shape output and agent routing: BLOCK (>= 0.92), WARN (>= 0.60), INFO (>= 0.30), SUPPRESSED (< 0.30 or user-suppressed). Severity still drives exit codes (0/1/2/99) unchanged. - **Separate...