Decompose scan and findings modules

docs/adoption-harness-automated.md

@@ -151,7 +151,7 @@ for real Cursor runs.
 |---|---|
 | Agent ignores Shipgate on `10-agents-md` (tool-PR prompt) | Strengthen wording in `docs/target-repo-agent-snippets.md` AGENTS.md block; the renderer in `src/agents_shipgate/cli/discovery/agent_instructions/renderers/` lifts from there. |
 | Scan invoked without `--ci-mode advisory` | Make advisory the default in the snippet example; consider `init --write` defaulting workflow to advisory. |
-| Agent parses Markdown report not JSON | Add `agent_summary` excerpt to the snippet; have `src/agents_shipgate/cli/scan.py` print "Parse the JSON report at …" hint in agent mode. |
+| Agent parses Markdown report not JSON | Add `agent_summary` excerpt to the snippet; have `src/agents_shipgate/cli/scan/` print "Parse the JSON report at …" hint in agent mode. |
 | `CHANGE_ME` left in `shipgate.yaml` | CLI fix in `src/agents_shipgate/cli/_register_init.py`. Add diagnostic in `src/agents_shipgate/cli/diagnostics.py`. |
 | `agents-shipgate-reports/` committed | `init --write` patches `.gitignore` if not already covered. |
 | Auto-asserted approval / confirmation / idempotency | **Detector blocker → docs fix.** Strengthen warning in target snippets. **No manifest schema change in P0.2.** |

docs/architecture.md

@@ -126,7 +126,7 @@ report/{markdown,json,sarif}       formatters write to agents-shipgate-reports/
 packet/builder.build_packet        Release Evidence Packet (v0.6) including
                                    the evidence_matrix lens
                                      ↓
-cli/scan.py:run_scan               entry-point orchestrator. Composed of
+cli/scan/orchestrator.py:run_scan  entry-point orchestrator. Composed of
                                    nine sequential phase helpers
                                    (_prepare_scan → _load_inputs →
                                    _build_tools_and_agent →

docs/decks/architecture-overview/README.md

@@ -7,7 +7,7 @@ The deck is grounded in:
 - `docs/architecture.md`
 - `docs/trust-model.md`
 - `STABILITY.md`
-- `src/agents_shipgate/cli/scan.py`
+- `src/agents_shipgate/cli/scan/orchestrator.py`
 
 ## Files
 

docs/decks/architecture-overview/src/build.mjs

@@ -290,7 +290,7 @@ async function main() {
     "The important boundary is before checks: all inputs become tools, artifacts, warnings, and one ScanContext.",
     grid({ name: "scan-grid", width: fill, height: fill, columns: [fr(1.05), fr(0.95)], columnGap: 52 }, [
       codePanel("scan-code", [
-        "src/agents_shipgate/cli/scan.py",
+        "src/agents_shipgate/cli/scan/orchestrator.py",
         "manifest = load_manifest(config_path)",
         "loaded_sources = _load_sources(...)",
         "api_source, api_artifacts = load_openai_api_artifacts(...)",
@@ -307,7 +307,7 @@ async function main() {
         compactItem("scan-output", "Reports are generated before exit policy", "JSON/Markdown/SARIF exist even when strict mode fails.", C.green),
       ]),
     ]),
-    "Source: src/agents_shipgate/cli/scan.py",
+    "Source: src/agents_shipgate/cli/scan/orchestrator.py",
   );
 
   // 6. Checks and findings
@@ -361,7 +361,7 @@ async function main() {
           compactItem("exit-20", "20", "strict-mode gate failure", C.red),
         ])),
     ]),
-    "Source: STABILITY.md and src/agents_shipgate/cli/scan.py",
+    "Source: STABILITY.md and src/agents_shipgate/cli/scan/orchestrator.py",
   );
 
   // 8. Trust and extension

src/agents_shipgate/checks/baseline_integrity.py

@@ -8,7 +8,7 @@
 hitting the report.
 
 Unlike checks in ``BUILTIN_CHECKS``, this module is not invoked by
-``run_checks``. It is called directly from :mod:`agents_shipgate.cli.scan`
+``run_checks``. It is called directly from :mod:`agents_shipgate.cli.scan.sanitization`
 after ``apply_baseline`` because the integrity check needs the loaded
 baseline and audit log paths, not the tool context.
 

src/agents_shipgate/cli/_helpers.py

@@ -14,9 +14,9 @@
     diagnose_missing_manifest,
 )
 from agents_shipgate.cli.discovery import discover_manifest_paths
-from agents_shipgate.cli.scan import run_scan
+from agents_shipgate.cli.scan.orchestrator import run_scan
 from agents_shipgate.core.errors import AgentsShipgateError, ConfigError, InputParseError
-from agents_shipgate.core.findings import SEVERITY_ORDER
+from agents_shipgate.core.findings.constants import SEVERITY_ORDER
 
 logger = logging.getLogger(__name__)
 

src/agents_shipgate/cli/_register_baseline.py

@@ -6,7 +6,8 @@
 import typer
 
 from agents_shipgate.checks.baseline_integrity import has_hash_mismatch
-from agents_shipgate.cli.scan import _resolve_audit_log_path, run_scan
+from agents_shipgate.cli.scan.orchestrator import run_scan
+from agents_shipgate.cli.scan.path_helpers import _resolve_audit_log_path
 from agents_shipgate.config.loader import load_manifest
 from agents_shipgate.core.baseline import verify_baseline, write_baseline
 from agents_shipgate.core.errors import AgentsShipgateError, ConfigError, InputParseError

src/agents_shipgate/cli/_register_doctor.py

@@ -12,7 +12,7 @@
     top_next_actions,
 )
 from agents_shipgate.cli.discovery.placeholders import collect_placeholders
-from agents_shipgate.cli.scan import inspect_sources
+from agents_shipgate.cli.scan.inspect import inspect_sources
 from agents_shipgate.core.errors import ConfigError, InputParseError
 from agents_shipgate.core.logging import configure_logging
 from agents_shipgate.schemas.diagnostics import NextAction

src/agents_shipgate/cli/_register_scan.py

@@ -17,7 +17,7 @@
 )
 from agents_shipgate.cli.agent_mode import emit_agent_mode_error as _emit_agent_mode_error
 from agents_shipgate.cli.diagnostics import top_next_actions
-from agents_shipgate.cli.scan import run_scan
+from agents_shipgate.cli.scan.orchestrator import run_scan
 from agents_shipgate.core.errors import AgentsShipgateError, ConfigError, InputParseError
 from agents_shipgate.core.logging import configure_logging
 from agents_shipgate.schemas.diagnostics import NextAction

src/agents_shipgate/cli/fixture.py

@@ -11,7 +11,7 @@
 
 import typer
 
-from agents_shipgate.cli.scan import run_scan
+from agents_shipgate.cli.scan.orchestrator import run_scan
 from agents_shipgate.core.errors import AgentsShipgateError, ConfigError, InputParseError
 from agents_shipgate.fixtures import (
     FixtureNotFoundError,