merge: incorporate upstream/master (2026-04-27 release)

[joshbouncesecurity]

Summary

Incorporates the two new upstream commits from knostic/OpenAnt into the fork without rewriting any of the fork's 47 already-published commits.

Upstream commits merged:

• 3d2e058 fix: Revise description of OpenAnt for clarity (docs: update PIPELINE_MANUAL.md for generate-context CLI command #28)
• ec5213b feature: release: 2026-04-27 — KIR-0000 disclosure fidelity, auth validation, dynamic-test hardening (merge: incorporate upstream parallelization, Zig parser, and report overhaul #29)

A merge (not a rebase) was used — consistent with prior upstream incorporations (a565352, 46531ee) and avoids rewriting published history.

Conflict resolutions

• core/scanner.py — kept the fork's resume/checkpoint scaffolding around build-output; adopted upstream's repo_name/repo_url/commit_sha plumbing into build_pipeline_output and the "no API calls succeeded" warning in _print_summary.
• core/verifier.py — kept code_by_route propagation; adopted upstream's verdict-based filter for confirmed_findings.
• report/generator.py — kept the SDK port (analyze_sync); layered upstream's _splice_code_section + payload sanitization on top so the verbatim vulnerable-code block is never sent to the LLM.

Follow-ups required to keep the merge green

• core/reporter.py — auto-merge dropped import json; re-added it (used by upstream's new caller/callee dedup code).
• core/schemas.py — declared the missing resumed_steps field on ScanResult. The fork's resume code already referenced it without it being declared; upstream's new test_silent_401 exposes the latent AttributeError.
• tests/report/test_disclosure_source_fidelity.py — adapted to patch AnthropicClient instead of generator.anthropic.Anthropic, since the fork no longer imports the anthropic SDK directly.
• tests/test_silent_401.py::test_analyze_sync_raises_on_auth_error — rewrote to assert sdk_errors.AuthError propagates from _run_query_sync, matching the fork's SDK error surface (was asserting legacy anthropic.AuthenticationError).

Test plan

• pytest tests/ — 260 passed locally
• CI green on this PR
• Spot-check openant scan on a small repo to confirm build_pipeline_output accepts the new repo_url/commit_sha fields end-to-end

---

Generated by Claude Code