feat(scanner): bind plugin SARIF findings to the scan receipt

[seonghobae]

Current repair boundary — 2026-09-12

• base: feat/claude-plugin-catalog-bind-1099@a1bff47328ca8fe5c762e450537bdbfc692d7292
• exact head: 8850f01300e44615245e91a12bfe64c90a095a1a
• exact tree: 0b50a035dfc4510ad52179d68223b59bfba069d1
• ancestry: ordinary two-parent merge of previous feat(scanner): bind plugin SARIF findings to the scan receipt #1142 head d5df6c7… and current feat(scanner): bind marketplace catalog identity onto plugin receipts #1141 head a1bff47…; no force update
• exact-tree validation: PYTHONPATH=. python -m pytest -q tests/test_claude_plugin*.py → 110 passed; py_compile and git diff --check passed
• lifecycle: Draft / SARIF receipt delta and all parent repairs preserved / hosted exact-head Checks and independent review absent
• stacked-workflow admission remains owned by fix(ci): admit stacked PR checks without bypassing docs contracts #1096; do not create a source-neutral wake-up commit

Successor of #1141 / issue #1099. Unique remaining TDD item 15: receipt sarif_sha256 is the SHA-256 of a deterministic SARIF 2.1.0 document covering the same finding rule_ids as finding_summary. Semantic consistency requires matching IDs and counts; swapping one SARIF ruleId fails the check. An undeclared executable changes both finding_summary and sarif_sha256. Reuses findings_to_sarif. Does not Close #1099 or #1141. Does not steal G-06 #1133 or #1140 CLI unique delta. scan_result=pass is not Noema admission.

Test plan

• RED then GREEN (test(scanner): require plugin SARIF receipt binding then this commit)
• claude_plugin_sarif.py 50/50 statement coverage
• claude_plugin_detector.py 1243/1243 with existing plugin tests
• Exact-head Checks on this head
• Keep Draft until current-head gates are GREEN

Relates to #1099. Relates to #1141.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}