Synvoya · Synvoya · Aug 20, 2026 · Aug 20, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,31 @@ All notable changes to CodeInspectus are documented here. Versioning follows
 [Semantic Versioning](https://semver.org). AI-code detections and compliance mappings are
 AI-drafted and practitioner-reviewed — see the honesty notes in the [README](README.md).
 
+## [2.6.0] — 2026-08-20
+
+### Added
+- Added consent-driven first-use setup for nontechnical users. Interactive `npx codeinspectus`
+  and `codeinspectus setup` explain each external engine's coverage, license, current state, and
+  platform-specific download size before offering install-all or component selection.
+- Added `codeinspectus_setup` for MCP clients. Planning is offline; installation requires an
+  explicit `confirm_downloads=true`, writes only beneath `~/.codeinspectus`, and never changes the
+  scanned repository. Declined choices persist locally and can be cleared with `setup --reset`.
+- Added automatic, approval-gated Cosign 3.1.2 bootstrapping for Opengrep/Trivy verification.
+  Platform binaries are immutable-SHA pinned from a Sigstore-verified upstream checksum manifest,
+  removing the separate Cosign prerequisite while preserving fail-closed publisher verification.
+
+### Changed
+- Added exact release-asset byte sizes for every supported Opengrep, Gitleaks, Trivy, and Cosign
+  platform. Trivy database storage is deliberately labelled as an estimate because upstream DB
+  transfer and extracted size change independently of CodeInspectus releases.
+- Direct file scans no longer mark the project-level Supabase Edge analyzer as an unreadable
+  directory. The aggregate native engine is `5.20.0`; the 94-rule catalog is unchanged.
+- Existing healthy binaries and databases remain no-download no-ops. Scans remain offline, npm
+  installation has no executable-downloading lifecycle script, and manual `repair-engines` remains
+  available as an advanced compatibility path.
+- Package, MCP server, CLI, SDK API, MCP Registry manifest, and reference CI install versions are
+  synchronized at `2.6.0`. Export/storage schema versions remain `2.0.0`.
+
 ## [2.5.0] — 2026-08-13
 
 ### Licensing

diff --git a/NOTICE b/NOTICE
@@ -4,6 +4,7 @@ Copyright 2026 Synvoya
 This product includes software developed by Synvoya.
 
 CodeInspectus interoperates with separately licensed third-party security
-engines. Those engines are downloaded from their upstream release sources and
-are not included in the CodeInspectus npm package. See THIRD-PARTY-NOTICES.md
-for engine and runtime-dependency attribution.
+engines and the Cosign verification helper. Those executables are downloaded
+from their upstream release sources after approval and are not included in the
+CodeInspectus npm package. See THIRD-PARTY-NOTICES.md for engine, verifier, data,
+and runtime-dependency attribution.
diff --git a/README.md b/README.md
@@ -72,10 +72,11 @@ IDs** (29 JavaScript/TypeScript, 6 Flutter/Dart, 4 Android, 4 iOS, 4 React Nativ
 3 Firebase configuration, 2 GitHub Actions workflow, and 2 JavaScript baseline SAST rules), 18 Opengrep-owned
 SAST rules, and 4 custom Gitleaks rules. All 20 Opengrep YAML rules remain physically active:
 the two native-owned rules reconcile exact results and fall back to Opengrep on mismatch or
-native unavailability. Opengrep, Gitleaks, and Trivy remain installed and additive.
+native unavailability. Opengrep, Gitleaks, and Trivy are optional, managed, additive engines.
 
-> CodeInspectus downloads the official, **SHA-pinned** engine binaries only when you run the
-> explicit engine-repair command, stores them outside the npm package, and calls
+> CodeInspectus explains each engine's coverage, license, platform-specific size, and required
+> action before asking permission. After approval it downloads the official, **SHA-pinned**
+> engine binaries, stores them outside the npm package, and calls
 > them as local subprocesses. It does **not** fork them.
 
 ## Why CodeInspectus?
@@ -90,19 +91,29 @@ before shipping.
 
 ## Install
 
-**Prerequisites:** **Node.js ≥22**. Node 24 LTS is recommended. Also install
-[**cosign**](https://github.com/sigstore/cosign)
-on your `PATH` when Opengrep or Trivy binaries need installation. Signature verification is
-**fail-closed**: those binaries are never installed without publisher verification. **Gitleaks**
-verifies by checksum and needs no cosign; a DB-only Trivy refresh reuses the already SHA-verified
-local Trivy binary.
+**Prerequisite:** **Node.js ≥22**. Node 24 LTS is recommended. No separate engine or Cosign
+installation is required. CodeInspectus can bootstrap a SHA-pinned Cosign verifier inside
+`~/.codeinspectus/` after approval; signature verification remains **fail-closed**.
+On Linux, the current upstream Opengrep assets require glibc. Alpine/musl remains supported for
+native CodeInspectus rules, Gitleaks, and Trivy, but setup marks Opengrep unavailable before any
+download and reports aggregate scan coverage as partial when it is selected.
 
 ```bash
-# Register once per machine with your agent (see "Client registration"), then:
-npx codeinspectus repair-engines
+# Interactive: inspect coverage, licenses, and sizes; then approve all or choose components.
+npx codeinspectus setup
+
+# Automation after an operator has reviewed the plan:
+npx codeinspectus setup --status
+npx codeinspectus setup --all
+npx codeinspectus setup --select opengrep,gitleaks
 ```
 
-`repair-engines` first checks local state without network access. It downloads only missing,
+On a terminal, a first bare `npx codeinspectus` run opens this guided setup. MCP clients continue
+to start over piped stdio and expose `codeinspectus_setup`: agents must request a plan, show it,
+ask permission, then call install with `confirm_downloads=true`. Declined choices are saved so
+users are not repeatedly prompted; `setup --reset` clears them.
+
+Setup first checks local state without network access. It downloads only missing,
 mismatched, or newly pinned binaries, verifies them against the immutable lockfile shipped in the
 npm package, and atomically installs them under `~/.codeinspectus/`. It refreshes the offline
 Trivy vulnerability DB only when it is missing, lacks rescan provenance, or is more than seven
@@ -111,9 +122,9 @@ perform zero network I/O.**
 
 Every scan and `codeinspectus_list_rules` response includes structured `engine_setup` state:
 `ready`, `repair_required`, `db_refresh_recommended`, or `unsupported_platform`. MCP agents are
-instructed to explain non-ready state and obtain approval before running the repair command—there
-is no silent npm `postinstall` download. The older `install-engines` command remains supported as
-a compatibility alias and explicitly refreshes the Trivy DB.
+instructed to explain non-ready state and obtain approval through `codeinspectus_setup`. There is
+no silent npm `postinstall` download. `repair-engines` remains available for advanced/manual use;
+the older `install-engines` command remains a compatibility alias.
 
 If a Trivy DB was installed before 0.3.2, scan output tells your agent that CVE rescan
 tracking is not yet enabled. The agent should run `npx codeinspectus repair-engines`
@@ -281,6 +292,7 @@ useful when you want the same policy persisted explicitly in a repository.
 | Tool | Purpose |
 |------|---------|
 | `codeinspectus_scan` | Full local scan of a path (engines + AI checks). Returns CWE-keyed findings, detected technologies, exact native-pack and Pub dependency coverage, remediations, framework tags, and three-state repository evidence for supported runtime controls. |
+| `codeinspectus_setup` | Offline setup plan, saved decline choices, or approval-gated verified downloads to `~/.codeinspectus`; never writes to the target repository. |
 | `codeinspectus_rescan` | Re-scan after fixes; diffs vs a prior scan → resolved / remaining / introduced, with fresh technology and pack coverage. |
 | `codeinspectus_compliance_report` | Per-framework **code-level control coverage** (not certification). |
 | `codeinspectus_explain_finding` | Deep explanation + full remediation for one finding. |

diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md
@@ -1,6 +1,6 @@
 # Third-party notices
 
-This document records third-party software and data used by CodeInspectus 2.5.0. CodeInspectus
+This document records third-party software and data used by CodeInspectus 2.6.0. CodeInspectus
 itself is licensed under Apache-2.0; third-party components retain their own licenses.
 
 ## Separately downloaded security engines
@@ -10,6 +10,19 @@ The following executables are **not included in the CodeInspectus npm package**.
 publisher/checksum evidence and exact binary SHA-256 from `engines.lock.json`, and stores them in a
 per-user managed directory. CodeInspectus is not affiliated with or endorsed by these projects.
 
+### Cosign 3.1.2 (verification helper)
+
+- Project: <https://github.com/sigstore/cosign>
+- Exact source: <https://github.com/sigstore/cosign/tree/v3.1.2>
+- License: Apache License 2.0
+- License text: <https://github.com/sigstore/cosign/blob/v3.1.2/LICENSE>
+- Copyright: The Sigstore Authors
+
+Guided setup downloads Cosign only when Opengrep or Trivy needs publisher-signature verification
+and no usable system copy exists. Its platform binary SHA-256 is pinned from the upstream checksum
+manifest after that manifest's Sigstore bundle verified successfully. Cosign is stored separately
+under `~/.codeinspectus/bin`; it is not included in the npm package.
+
 ### Opengrep 1.23.0
 
 - Project: <https://github.com/opengrep/opengrep>

diff --git a/detection-db/osv-pub/snapshot.json b/detection-db/osv-pub/snapshot.json
@@ -2,8 +2,8 @@
   "schema_version": "1.0.0",
   "snapshot": {
     "ecosystem": "Pub",
-    "snapshot_version": "2026-08-13.28cf740b203f",
-    "checked_at": "2026-08-13T03:28:38.176Z",
+    "snapshot_version": "2026-08-20.28cf740b203f",
+    "checked_at": "2026-08-20T04:30:10.006Z",
     "latest_record_modified": "2026-07-08T06:53:12.190101301Z",
     "source_index_url": "https://storage.googleapis.com/osv-vulnerabilities/Pub/modified_id.csv",
     "source_index_sha256": "sha256:28cf740b203f097a1707dbe015e73ba76e78653c02d2b5d89af98992a3bd061a",

diff --git a/docs/CI-POLICY.md b/docs/CI-POLICY.md
@@ -38,7 +38,7 @@ written before the policy exit is returned, including exits 1 and 2, so CI can r
 
 The shipped [copyable workflow](examples/codeinspectus-security.yml) separates the explicit,
 network-permitted install/engine-repair steps from the offline scan step. Every third-party action is
-pinned to a full commit SHA. It installs the exact `codeinspectus@2.5.0` release under
+pinned to a full commit SHA. It installs the exact `codeinspectus@2.6.0` release under
 `$RUNNER_TEMP` with npm lifecycle scripts disabled; it does not run the target repository's package
 install, lifecycle scripts, build, tests, or other code. The job uses least privilege (`contents: read`,
 `security-events: write`), checks out with `persist-credentials: false`, does not reference repository

diff --git a/docs/CLI-REFERENCE.md b/docs/CLI-REFERENCE.md
@@ -92,6 +92,11 @@ destination lookup, issue submission, or network request. `issue submit` is inte
 ## Engine lifecycle and metadata
 
 ```bash
+codeinspectus setup
+codeinspectus setup --status
+codeinspectus setup --all
+codeinspectus setup --select opengrep,gitleaks,trivy
+codeinspectus setup --reset
 codeinspectus repair-engines [ENGINE]
 codeinspectus install-engines [ENGINE]
 codeinspectus verify-engines
@@ -100,8 +105,16 @@ codeinspectus --version
 codeinspectus --help
 ```
 
+Bare `codeinspectus` starts guided setup only when stdin and stdout are interactive terminals;
+piped stdio still starts the MCP server. `setup` shows exact pinned binary asset sizes and a clearly
+labelled Trivy database disk estimate before approval. `--all` and `--select` are explicit
+noninteractive approvals. Saved choices prevent repeat prompting; `--reset` removes them.
+
 `install-engines` remains a compatibility alias. `pin-engines` is maintainer-only. Normal scans
-never repair or download engines implicitly.
+never repair or download engines implicitly. No npm lifecycle script downloads executables.
+The pinned Linux Opengrep release assets require glibc. On Alpine/musl, setup blocks Opengrep
+before download while leaving native rules, Gitleaks, and Trivy available; scans report the missing
+Opengrep surface as partial coverage.
 
 ## Exit status
 

diff --git a/docs/TYPESCRIPT-SDK.md b/docs/TYPESCRIPT-SDK.md
@@ -36,7 +36,7 @@ The RC exports explicit contract names:
 - `RepositoryHistoryManifestV1`
 - `IssuePayloadV1`, `IssueAdapter`, `DestinationVisibility`
 
-`SDK_API_VERSION` is `2.5.0`. `SDK_COMPATIBILITY` records the exact schema versions understood
+`SDK_API_VERSION` is `2.6.0`. `SDK_COMPATIBILITY` records the exact schema versions understood
 by typed helpers. The V2 SDK accepts those schema versions and fails closed on another version;
 additive optional fields within a compatible schema do not break consumers. Removing or changing a
 required field, exit meaning or command semantic requires a new contract version and SDK major.

diff --git a/docs/context/verify.md b/docs/context/verify.md
@@ -111,7 +111,7 @@ Expected: all focused tests pass; manifest `1.19.0` owns exactly 72 native rule
 JavaScript/TypeScript, 6 Flutter/Dart, 4 Android, 4 iOS, 4 React Native, 2 Expo, 10 Python AI/API,
 1 Go AI, 1 Java AI, 1 C# AI, 1 PHP AI, 1 Rust AI, 1 Ruby AI, 3 Firebase configuration,
 2 GitHub Actions workflow, and 2 JavaScript baseline SAST) across sixteen packs and 45 analyzers;
-the aggregate native engine is `5.19.0`. The JavaScript/TypeScript pack is `1.9.0`; the Flutter
+the aggregate native engine is `5.20.0`. The JavaScript/TypeScript pack is `1.9.0`; the Flutter
 pack is `1.1.0`. A detected Flutter project runs the six Flutter analyzers,
 a plain Dart package reports that pack as `not_applicable`, Android/iOS project evidence activates
 only its matching platform pack, and scanner-filter exclusion reports installed packs as `not_run`

diff --git a/docs/examples/codeinspectus-security.yml b/docs/examples/codeinspectus-security.yml
@@ -32,23 +32,20 @@ jobs:
         with:
           node-version: 24
 
-      - name: Install cosign for fail-closed engine verification
-        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
-
       # Network-permitted preparation. Install the exact released scanner outside the target.
       # --ignore-scripts prevents npm lifecycle execution; no target package/build code runs.
-      - name: Install CodeInspectus 2.5.0 outside the repository
+      - name: Install CodeInspectus 2.6.0 outside the repository
         shell: bash
         run: |
           npm install \
             --ignore-scripts \
             --no-save \
             --no-package-lock \
             --prefix "$RUNNER_TEMP/codeinspectus-cli" \
-            codeinspectus@2.5.0
+            codeinspectus@2.6.0
 
-      - name: Explicitly repair verified engines and the offline vulnerability database
-        run: node "$RUNNER_TEMP/codeinspectus-cli/node_modules/codeinspectus/dist/index.js" repair-engines --refresh-db
+      - name: Explicitly approve and install verified engines and the offline vulnerability database
+        run: node "$RUNNER_TEMP/codeinspectus-cli/node_modules/codeinspectus/dist/index.js" setup --all
 
       - name: Verify installed engine hashes before scanning
         run: node "$RUNNER_TEMP/codeinspectus-cli/node_modules/codeinspectus/dist/index.js" verify-engines