refactor(cli): adapters, util and toolchain on traust-core's tool doors (XWING-2440)

.ratchet.json

@@ -32,9 +32,6 @@
   "src/traust/cli/groups/_registry.py": {
     "engine-internal": 1
   },
-  "src/traust/cli/groups/adapters.py": {
-    "engine-internal": 3
-  },
   "src/traust/cli/groups/metrics.py": {
     "engine-internal": 1
   },
@@ -52,16 +49,7 @@
   "src/traust/cli/groups/sweep.py": {
     "engine-internal": 4
   },
-  "src/traust/cli/groups/util.py": {
-    "engine-internal": 2
-  },
   "src/traust/cli/query_index.py": {
     "database": 1
-  },
-  "src/traust/cli/toolchain.py": {
-    "engine-internal": 1
-  },
-  "src/traust/lib/__init__.py": {
-    "engine-internal": 1
   }
 }

docs/cli-reference.md

@@ -20,7 +20,7 @@ python3 -m traust.cli check skill-alignment      # equivalent
 
 | Group | Description | Operations |
 |---|---|---|
-| `adapters` | Scanner adapters (deterministic pre-scans) | `checkov`, `config-matrix`, `crypto-audit`, `crypto-cluster`, `crypto-image`, `crypto-probe`, `crypto-source`, `fork-lag`, `gitleaks`, `govulncheck`, `grpc-guards`, `image-packages`, `image-sbom`, `joern`, `llm-app`, `opengrep`, `osv`, `priv-profile`, `route-guards`, `sanitizers`, `yara` |
+| `adapters` | Scanner adapters (deterministic pre-scans) | `checkov`, `config-matrix`, `crypto-cluster`, `crypto-image`, `crypto-source`, `fork-lag`, `gitleaks`, `govulncheck`, `grpc-guards`, `image-packages`, `image-sbom`, `joern`, `llm-app`, `opengrep`, `osv`, `priv-profile`, `route-guards`, `sanitizers`, `yara` |
 | `admin` | Operator tooling | `attest-target`, `checkpoint`, `doctor`, `query-index`, `scan-internal-refs`, `toolchain` |
 | `assessments` | The audit skills' doors on traust-core | `coverage`, `prepare`, `threats` |
 | `attack` | The pack's pinned MITRE ATT&CK release | `validate` |

docs/tooling-and-structure-files.md

@@ -80,6 +80,5 @@ The schemas below (from the installed `traust-contracts` package) are the comple
 | python3 -m traust.cli portfolio liveness | Census-owned repo liveness on traust-core (`PortfolioService.liveness`) — active/archived/unknown per registered repository from stored observations |
 | python3 -m traust.cli check skill-alignment | Pre-commit cross-skill contract gate (A-series rules) |
 | python3 -m traust.cli check skill-security | Pre-commit security-posture gate (S-series rules incl. S9 repo-config isolation) |
-| python3 -m traust.cli adapters crypto-audit | Unopinionated crypto data collector — source/image/cluster tiers emit `crypto-audit/v1` JSON |
-| python3 -m traust.cli adapters crypto-probe | Source-level crypto provider census (imported by crypto_audit.py) |
+| python3 -m traust.cli adapters crypto-source / crypto-image / crypto-cluster | Unopinionated crypto data collector on traust-core — source/image/cluster census JSON |
 | python3 -m traust.cli util elf | General-purpose ELF binary analyzer (linked libraries, byte scanning) |

harnessing/3-audit/crypto-analysis/SKILL.md

@@ -295,9 +295,8 @@ through the callers' report → ledger flow.
 ### From pqc-readiness
 
 `pqc-readiness` loads this skill for governance tracing. PQC-specific tables
-and assessment logic live in `pqc-readiness/`. pqc-readiness probes with
-python3 -m traust.cli adapters crypto-probe until its port; this skill with
-python3 -m traust.cli adapters crypto-source.
+and assessment logic live in `pqc-readiness/`. pqc-readiness and this skill
+probe with python3 -m traust.cli adapters crypto-source.
 
 ### From secure-code-audit
 

harnessing/3-audit/pqc-readiness/SKILL.md

@@ -562,7 +562,7 @@ anything uncertain `posture: unknown`.
 ## Two-layer probe model
 
 ```
-Layer 1 (census):   python3 -m traust.cli adapters crypto-probe    → CRYPTO_* facts
+Layer 1 (census):   python3 -m traust.cli adapters crypto-source   → CRYPTO_* facts
                      ↓ imported by
                     pqc_facts.py                → HP_CHAIN_* PQC facts + pqc_capable flag
 
@@ -574,8 +574,8 @@ Chain reasoning:    crypto-analysis SKILL.md    → governance chains (who owns
 
 | Tool                    | Location                                         | Purpose                                                                                                                                                                          |
 | ----------------------- | ------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `crypto_probe.py`       | python3 -m traust.cli adapters crypto-probe                        | Provider census: Go, Node, JDK, Python, Rust, .NET, Ruby, C/C++ crypto stacks, base images, RPM locks, GODEBUG, crypto-policies                                                  |
-| `crypto_audit.py`       | python3 -m traust.cli adapters crypto-audit                        | Unopinionated data collector — `cluster` tier with `--groups` provides raw TLS negotiation facts for PQC probing                                                                 |
+| `crypto-source`         | python3 -m traust.cli adapters crypto-source                       | Provider census: Go, Node, JDK, Python, Rust, .NET, Ruby, C/C++ crypto stacks, base images, RPM locks, GODEBUG, crypto-policies                                                  |
+| `crypto-cluster`        | python3 -m traust.cli adapters crypto-cluster                      | Unopinionated data collector — `cluster` tier with `--groups` provides raw TLS negotiation facts for PQC probing                                                                 |
 | `pqc_facts.py`          | `harnessing/3-audit/pqc-readiness/scripts/pqc_facts.py`          | Imports crypto*probe, maps `CRYPTO*_`→`HP*CHAIN*_`, adds PQC capability assessment via `\_pqc_capable_version()`(reads thresholds from[`notes/reference/pqc-version-matrix.yaml`](notes/reference/pqc-version-matrix.yaml)) |
 | `scan_xcrypto_usage.py` | `harnessing/3-audit/pqc-readiness/scripts/scan_xcrypto_usage.py` | golang.org/x/crypto evidence: first-party import sites, go.mod versions, optional callgraph reachability (somepath witness)                                                      |
 | `traust pqc blockers`   | traust-core `PqcService.blockers`                                | Derives each recorded report's `remediations[]` in the findings vocabulary (severity, classification, `patchable`) for `/patch` and other findings consumers                        |

harnessing/5-validate/validate-findings/SKILL.md

@@ -326,9 +326,9 @@ Build the attack graph and emit one `chain_ref` step-group per discovered path:
    `pqc_classification` and a cluster context is bound, run runtime data
    collection:
    ```bash
-   python3 -m traust.cli adapters crypto-audit cluster --context <ctx> --namespaces <ns> [--discover] [--groups "..."]
+   python3 -m traust.cli adapters crypto-cluster --context <ctx> --namespaces <ns> [--discover] [--groups "..."]
    ```
-   This emits `crypto-audit/v1` (`tier: runtime`) with raw TLS negotiation
+   This emits the runtime crypto census with raw TLS negotiation
    data, crypto-policy state, and OpenSSL/Go versions. For source and image
    tier crypto analysis, delegate to the `crypto-analysis` skill.
 

pyproject.toml

@@ -41,11 +41,11 @@ dev = ["ruff>=0.6", "pytest-xdist>=3", "psycopg[binary]>=3.1"]
 # traust's traust-core pin wins over the engine's, so a core bump needs no engine PR.
 [tool.uv]
 override-dependencies = [
-  "traust-core @ git+https://github.com/traust-security/traust-core.git@d451649605cef2a95d50f2ba22ef8df7eb1f984c",
+  "traust-core @ git+https://github.com/traust-security/traust-core.git@7adfd9f7cacb3900437bd59c685544ab6642802c",
 ]
 
 [tool.uv.sources]
-traust-core = { git = "https://github.com/traust-security/traust-core.git", rev = "d451649605cef2a95d50f2ba22ef8df7eb1f984c" }
+traust-core = { git = "https://github.com/traust-security/traust-core.git", rev = "7adfd9f7cacb3900437bd59c685544ab6642802c" }
 traust-engine = { git = "https://github.com/traust-security/traust-engine.git", rev = "6c78fae8bc69eea7d2a2fbfd95bc8991e3146913" }
 
 # Multi-skill CLIs live under src/traust/; harnessing/<skill>/ for single-skill

src/traust/cli/groups/__init__.py

@@ -42,8 +42,6 @@
         "osv": adapters.OSV,
         "yara": adapters.YARA,
         "joern": adapters.JOERN,
-        "crypto-probe": adapters.CRYPTO_PROBE,
-        "crypto-audit": adapters.CRYPTO_AUDIT,
         "crypto-source": adapters.CRYPTO_SOURCE,
         "crypto-image": adapters.CRYPTO_IMAGE,
         "crypto-cluster": adapters.CRYPTO_CLUSTER,