Module scan 

Inventory scan over agent config / dependency manifests / secrets dotfile. Covers the L1 × V3 cell (cf. crate root §Threat surface × vector).

Pipeline

run composes the three sub-modules in order:

1. inventory::collect — walk every registered probe’s target roots plus the universal supply-chain list, hash each file with SHA-256, and (when the owning probe opts in via crate::platform::PlatformProbe::decompose_file) split noisy configs into virtual JSON-block fragments so unrelated background writes do not show as modifications.
2. snapshot::save — persist the report as <home>/snapshots/<UTC-ts>.json (cf. crate root §Runtime data root).
3. diff::compute — if a previous snapshot exists, classify the new report into added / modified / removed.

The function is idempotent under no-change: re-running run when no tracked file has changed produces a new snapshot file but an empty diff::DiffReport.

Read-only invariant

No path under inventory::collect’s target roots is ever mutated. Writes are scoped to <home>/snapshots/. Symlinks are not followed.

Modules

diff

Set-difference between two ScanReports, keyed on PathEntry::path.

inventory

Inventory enumeration: turn the fixed target-root list into hashed PathEntry rows.

snapshot

Snapshot persistence: serialize a ScanReport to <home>/snapshots/<UTC-ts>.json and load the newest snapshot back.

unknown

BlackList check: classify installed MCP server names against a crate::registry::Registry of known-good entries.

Structs

ScanOutcome

Full output of one run call: the inventory, the path of the persisted snapshot, and (if a previous snapshot existed) the diff against it.

ScanReport

One scan’s worth of inventory data, before any diffing.

Functions

diff_against_latest

Compute the diff between the current inventory and the latest snapshot without persisting a new snapshot.

run

Run a full scan: enumerate inventory, persist a snapshot, and (if a previous snapshot exists) compute a diff against it.