feat(governance): auxiliary gate parity and MCP trust tooling

Route vet/fuzz/inventory/pentest through collect_findings_gate_violations,
enrich explain_finding and compare_baselines with display-aware fields,
add embedding_secrets semantic skip row, and run validate_trust_layer in CI.

Author: hello-args

.github/workflows/test-gate.yml

@@ -46,6 +46,8 @@ jobs:
       - run: uv run python scripts/run_behavioral_regression.py --strict --json
       - run: uv run python scripts/run_behavioral_eval.py --json > behavioral-eval.json
       - run: uv run pytest -m integration tests/integration/
+      - run: uv run python scripts/validate_trust_layer.py
+        if: matrix.python-version == '3.12'
       - run: |
           uv run python - <<'PY'
           from mcts.testing.regression_harness import REGRESSION_THRESHOLD, REGRESSION_TECHNIQUES, evaluate_technique

CHANGELOG.md

@@ -39,6 +39,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **Pentest warn recommendations** — remediation text matches display severity (no false “remediate critical” on overlap)
 - **Readiness warn scoring** — `readiness_score` and `production_ready` use display severity when trust ≠ off
 - **Acceptance script lint** — `scripts/validate_trust_layer.py` passes `ruff check .` (CI blocker)
+- **Auxiliary gate parity** — vet/fuzz/inventory/readiness/pentest use `collect_findings_gate_violations()`
+- **MCP explain_finding** — trust fields, facts, and interpretation in tool output
+- **compare_baselines** — display-aware critical/high counts when trust summaries present
+- **embedding_secrets** — skip row when semantic model unavailable
 - **Validator `path_status`** — stale `evidence.path_status=proven` no longer bypasses graph checks
 - **Compliance coverage kind** — compliance meta-findings tagged `finding_kind=coverage` (excluded from security priority/bronze gates)
 - **`require_auth_env_for_sensitive`** — policy gate fails when sensitive analyzers enabled without API env vars

docs/reporting/findings-trust-phase0.md

@@ -296,7 +296,7 @@ Items 1–8 from the June 2026 deep audits are **fixed** in-tree (see table abov
 
 ### Gate scope (auxiliary commands)
 
-Full YAML + scan gate evaluation (`collect_gate_violations`) applies to **`mcts scan`**, **REST `POST /scan`**, **`mcts scan --machine-wide`**, and **`mcts inventory --scan-all`**. Other auxiliary paths (`inventory` default, `vet`, `fuzz`, `readiness`, `pentest`) merge policy for trust mode and thresholds but exit on **severity heuristics** unless documented otherwise.
+Full YAML + scan gate evaluation (`collect_gate_violations`) applies to **`mcts scan`**, **REST `POST /scan`**, **`mcts scan --machine-wide`**, and **`mcts inventory --scan-all`**. Auxiliary CLIs (`inventory` default, `vet`, `fuzz`, `readiness`, `pentest`) call **`collect_findings_gate_violations()`** for policy thresholds (`max_critical`, priority gates, etc.) plus the legacy critical/high heuristic when findings remain severe.
 
 ### Policy trust mode on auxiliary CLIs
 

src/mcts/analyzers/embedding_secrets.py

@@ -9,7 +9,7 @@
 
 from mcts.analyzers.base import BaseAnalyzer
 from mcts.analyzers.data_leakage import SECRET_PATTERNS
-from mcts.analyzers.finding_facts import build_analyzer_finding
+from mcts.analyzers.finding_facts import build_analyzer_finding, build_skip_finding
 from mcts.mcp.models import MCPServerInfo
 from mcts.reporting.models import Finding, Severity, SourceLocation
 
@@ -58,13 +58,29 @@ def __init__(self, semantic_secrets: bool = False, semantic_threshold: float = 0
 
     def analyze(self, server: MCPServerInfo) -> list[Finding]:
         findings: list[Finding] = []
+        if self.semantic_secrets:
+            _load_embedding_model()
         for tool in server.tools:
             corpus = _tool_corpus(tool)
             if _regex_credential_hit(corpus):
                 findings.append(_finding(tool, "regex_credential", 0.9))
                 continue
             if self.semantic_secrets and _semantic_credential_hit(corpus, self.semantic_threshold):
                 findings.append(_finding(tool, "semantic_credential", 0.8))
+        if self.semantic_secrets and _EMBEDDING_STATE.unavailable:
+            findings.append(
+                build_skip_finding(
+                    finding_id="embedding-secrets-semantic-skipped",
+                    analyzer="embedding_secrets",
+                    title="Semantic credential detection skipped",
+                    description=(
+                        "Semantic embedding model unavailable; only regex and phrase fallback ran."
+                    ),
+                    recommendation=(
+                        "Install sentence-transformers and model weights, or disable semantic_secrets."
+                    ),
+                )
+            )
         return findings
 
 

src/mcts/cli/main.py

@@ -212,7 +212,10 @@ def _level_exceeds(actual: str, maximum: str) -> bool:
 def _check_gates(report, config: ScanConfig) -> None:
     from mcts.governance.gate_violations import collect_gate_violations
 
-    violations = collect_gate_violations(report, config)
+    _exit_on_gate_violations(collect_gate_violations(report, config), report, config)
+
+
+def _exit_on_gate_violations(violations: list[str], report, config: ScanConfig) -> None:
     if not violations:
         return
 
@@ -248,6 +251,54 @@ def _check_gates(report, config: ScanConfig) -> None:
     raise typer.Exit(code=1)
 
 
+def _check_finding_policy_gates(
+    findings: list,
+    config: ScanConfig,
+    *,
+    target: str | None = None,
+    scan_scope: str = "repository",
+) -> None:
+    """YAML/CLI policy gates for auxiliary finding lists (no severity heuristic)."""
+    from mcts.governance.gate_violations import build_gate_scan_report, collect_findings_gate_violations
+
+    violations = collect_findings_gate_violations(
+        findings,
+        config,
+        target=target,
+        scan_scope=scan_scope,
+    )
+    if violations:
+        gate_report = build_gate_scan_report(
+            findings,
+            config,
+            target=target,
+            scan_scope=scan_scope,
+        )
+        _exit_on_gate_violations(violations, gate_report, config)
+
+
+def _check_auxiliary_finding_gates(
+    findings: list,
+    config: ScanConfig,
+    *,
+    target: str | None = None,
+    scan_scope: str = "repository",
+) -> None:
+    """Policy gates plus legacy critical/high heuristic for security-oriented CLIs."""
+    from mcts.reporting.trust_apply import finding_severity_label
+
+    _check_finding_policy_gates(
+        findings,
+        config,
+        target=target,
+        scan_scope=scan_scope,
+    )
+    if findings and any(
+        finding_severity_label(finding, config) in ("critical", "high") for finding in findings
+    ):
+        raise typer.Exit(code=1)
+
+
 @app.callback()
 def main(
     version: Annotated[
@@ -1150,7 +1201,6 @@ def inventory(
         scan_all_has_high_severity,
         write_inventory_scan_all,
     )
-    from mcts.reporting.display import effective_severity
     from mcts.reporting.trust_apply import apply_config_trust_layer
     from mcts.taxonomy.mapper import enrich_findings
 
@@ -1252,12 +1302,12 @@ def inventory(
     ReportRenderer(resolved_theme, console=console).render_saved_notice(str(output_path))
 
     combined = shadow_findings + skill_findings + toxic_findings
-    if combined and any(
-        (effective_severity(f) if inv_config.findings_trust_mode != "off" else f.severity).value
-        in ("critical", "high")
-        for f in combined
-    ):
-        raise typer.Exit(code=1)
+    _check_auxiliary_finding_gates(
+        combined,
+        inv_config,
+        target=str(inv_config.target),
+        scan_scope="inventory",
+    )
 
 
 @app.command()
@@ -1294,8 +1344,8 @@ def vet(
     import json
 
     from mcts.core.config import ScanConfig
-    from mcts.reporting.trust_apply import finding_severity_label, merge_scan_config_defaults
-    from mcts.reporting.vet_trust import apply_trust_to_vet_report, vet_severity_label
+    from mcts.reporting.trust_apply import merge_scan_config_defaults
+    from mcts.reporting.vet_trust import apply_trust_to_vet_report, vet_finding_to_finding, vet_severity_label
     from mcts.vet import run_vet
 
     try:
@@ -1334,8 +1384,13 @@ def vet(
     if not json_output:
         console.print(f"[green]Saved[/green] {output_path}")
 
-    if any(finding_severity_label(finding, config) in ("critical", "high") for finding in report.findings):
-        raise typer.Exit(code=1)
+    gate_findings = [vet_finding_to_finding(finding) for finding in report.findings]
+    _check_auxiliary_finding_gates(
+        gate_findings,
+        config,
+        target=package,
+        scan_scope="vet",
+    )
 
 
 @app.command()
@@ -1637,8 +1692,12 @@ def fuzz(
     output_path.write_text(json.dumps(payload, indent=2))
     ReportRenderer(resolved_theme, console=console).render_saved_notice(str(output_path))
 
-    if any(finding_severity_label(finding, fuzz_config) in ("critical", "high") for finding in findings):
-        raise typer.Exit(code=1)
+    _check_auxiliary_finding_gates(
+        findings,
+        fuzz_config,
+        target=target_label,
+        scan_scope="live" if (url or command) else "repository",
+    )
 
 
 def _parse_headers(header: list[str] | None) -> dict[str, str]:
@@ -1724,6 +1783,13 @@ def readiness(
     if report.tools_checked == 0:
         raise typer.Exit(code=1)
 
+    _check_finding_policy_gates(
+        report.findings,
+        config,
+        target=str(target),
+        scan_scope="readiness",
+    )
+
 
 @app.command(name="serve")
 def serve_api(
@@ -2205,6 +2271,18 @@ def _execute() -> object:
                 console.print(f"  • {item}")
         console.print(f"\n[green]Saved[/green] {output_path}")
 
+    if report.static_report:
+        from mcts.reporting.models import Finding, ScanReport
+
+        static_scan = ScanReport.model_validate(report.static_report)
+        fuzz_rows = [Finding.model_validate(row) for row in report.fuzz_findings]
+        _check_auxiliary_finding_gates(
+            static_scan.findings + fuzz_rows,
+            config,
+            target=str(target),
+            scan_scope=static_scan.scan_scope,
+        )
+
     if report.verdict in {"critical", "high"}:
         raise typer.Exit(code=1)
 

src/mcts/governance/gate_violations.py

@@ -2,11 +2,14 @@
 
 from __future__ import annotations
 
+from datetime import UTC, datetime
+
 from mcts.core.config import ScanConfig
 from mcts.governance.auth_env import evaluate_auth_env_violations
 from mcts.governance.policy import evaluate_policy, load_policy
 from mcts.governance.scan_gates import evaluate_scan_gate_violations
-from mcts.reporting.models import ScanReport
+from mcts.mcp.models import MCPServerInfo
+from mcts.reporting.models import Finding, RiskScore, ScanReport, ScanSummary, ScoreBasis
 
 
 def _policy_server_ids(report: ScanReport) -> list[str]:
@@ -35,3 +38,58 @@ def collect_gate_violations(report: ScanReport, config: ScanConfig) -> list[str]
         return violations
     violations.extend(evaluate_policy(policy=policy, servers=_policy_server_ids(report)))
     return violations
+
+
+def build_gate_scan_report(
+    findings: list[Finding],
+    config: ScanConfig,
+    *,
+    target: str | None = None,
+    scan_scope: str = "repository",
+) -> ScanReport:
+    """Minimal ScanReport for gate evaluation on auxiliary finding lists."""
+    report_target = target or str(config.target)
+    summary = ScanSummary.from_findings(findings)
+    display_summary = (
+        ScanSummary.from_display(findings, security_only=True)
+        if config.findings_trust_mode != "off"
+        else None
+    )
+    basis = ScoreBasis(
+        critical=summary.critical,
+        high=summary.high,
+        medium=summary.medium,
+        low=summary.low,
+        scorable_total=summary.total,
+        excluded_non_scorable=max(0, len(findings) - summary.total),
+    )
+    score = RiskScore(overall=100, risk_index=0, raw_risk=0, penalty=0, basis=basis)
+    return ScanReport(
+        version="0.0.0",
+        target=report_target,
+        scanned_at=datetime.now(UTC),
+        server=MCPServerInfo(name=report_target),
+        findings=findings,
+        summary=summary,
+        display_summary=display_summary,
+        findings_trust_mode=config.findings_trust_mode,
+        score=score,
+        scan_scope=scan_scope,
+    )
+
+
+def collect_findings_gate_violations(
+    findings: list[Finding],
+    config: ScanConfig,
+    *,
+    target: str | None = None,
+    scan_scope: str = "repository",
+) -> list[str]:
+    """Policy/CLI gates for vet, fuzz, inventory, and other non-Scanner entry points."""
+    report = build_gate_scan_report(
+        findings,
+        config,
+        target=target,
+        scan_scope=scan_scope,
+    )
+    return collect_gate_violations(report, config)

src/mcts/mcp_server/server.py

@@ -57,13 +57,29 @@ def explain_finding(finding_id: str, report_json: str) -> str:
         "id": match.get("id"),
         "title": match.get("title"),
         "severity": match.get("severity"),
+        "display_severity": match.get("display_severity"),
+        "impact": match.get("impact"),
+        "evidence_strength": match.get("evidence_strength"),
+        "evidence_type": match.get("evidence_type"),
+        "finding_type": match.get("finding_type"),
+        "finding_kind": match.get("finding_kind"),
+        "priority_score": match.get("priority_score"),
+        "chain_level": match.get("chain_level"),
+        "rule_stability": match.get("rule_stability"),
         "analyzer": match.get("analyzer"),
         "technique_id": match.get("technique_id"),
         "description": match.get("description"),
         "recommendation": match.get("recommendation"),
-        "evidence": match.get("evidence") or {},
         "tool": match.get("tool"),
     }
+    evidence = match.get("evidence") or {}
+    explanation["confidence_factors"] = evidence.get("confidence_factors")
+    explanation["false_positive_conditions"] = evidence.get("false_positive_conditions")
+    explanation["counterfactual_remediation"] = evidence.get("counterfactual_remediation")
+    explanation["facts"] = evidence.get("facts")
+    explanation["interpretation"] = evidence.get("interpretation")
+    explanation["runtime_validation"] = evidence.get("runtime_validation")
+    explanation["evidence"] = evidence
     return json.dumps(explanation, indent=2)
 
 
@@ -91,6 +107,9 @@ def compare_baselines(baseline_report_json: str, current_report_json: str) -> st
         delta["chain_meta_note"] = (
             "Finding deltas may include attack_chains meta-rows excluded from v2 absolute_risk."
         )
+    display_crit_delta = (current.get("display_critical") or 0) - (baseline.get("display_critical") or 0)
+    if display_crit_delta and display_crit_delta != chain_delta:
+        delta["display_critical_delta"] = display_crit_delta
     return json.dumps(delta, indent=2)
 
 
@@ -114,16 +133,38 @@ def create_server():
     return app
 
 
+def _severity_counts(payload: dict[str, Any]) -> dict[str, int]:
+    trust_mode = str(payload.get("findings_trust_mode") or "off")
+    display = payload.get("display_summary") or {}
+    template = payload.get("summary") or {}
+    use_display = trust_mode == "enforce" or (
+        trust_mode == "warn" and display.get("critical") is not None
+    )
+    active = display if use_display and display else template
+    return {
+        "critical": int(active.get("critical") or 0),
+        "high": int(active.get("high") or 0),
+    }
+
+
 def _report_summary(payload: dict[str, Any]) -> dict[str, Any]:
     score = payload.get("score") or {}
     score_v2 = payload.get("score_v2") or {}
     findings = payload.get("findings") or []
+    template = payload.get("summary") or {}
+    display = payload.get("display_summary") or {}
+    counts = _severity_counts(payload)
     summary: dict[str, Any] = {
         "overall_score": int(score.get("overall") or 0),
         "finding_count": len(findings),
         "finding_ids": sorted(str(row.get("id")) for row in findings if row.get("id")),
-        "critical": int((payload.get("summary") or {}).get("critical") or 0),
-        "high": int((payload.get("summary") or {}).get("high") or 0),
+        "critical": counts["critical"],
+        "high": counts["high"],
+        "template_critical": int(template.get("critical") or 0),
+        "template_high": int(template.get("high") or 0),
+        "display_critical": int(display.get("critical") or 0) if display else None,
+        "display_high": int(display.get("high") or 0) if display else None,
+        "findings_trust_mode": payload.get("findings_trust_mode") or "off",
         "scoring_version": payload.get("scoring_version") or "legacy",
     }
     if score_v2: