# STATUS_MATRIX — Scanner Functional Verification (2026-05-29)

Real-target functional validation on the R630 test environment.
**Runner:** CT107 (Linux, dual-NIC) · **Targets:** DVWA CT108 (192.0.2.118), CT102-104 Linux (10.10.10.20-22), VM200 Windows DC (192.0.2.200), OpenVAS CT101 (192.0.2.111).
**Code under test:** Forgejo `main` `0d32a83` (clean clone on CT107).
**Mode:** `DONJON_TEST_MODE=1` — zeroes the `human_delay()` stealth-pacing sleeps (a designed test switch); **real nmap/nikto/testssl/etc. scans still execute** — results are genuine.

## Scanners — 19/19 validated against real targets

| # | Scanner | Target | Result | Findings | How verified |
|---|---|---|---|---|---|
| 1 | network | DVWA | PASS 9.1s | 2 | harness |
| 2 | vulnerability | DVWA | PASS 65.7s | 28 | harness |
| 3 | web | DVWA | PASS 341.8s | 30 | harness (nikto) |
| 4 | ssl | DVWA | PASS 8.2s | 0 (target has no TLS) | harness (testssl) |
| 5 | linux | localhost (Debian) | PASS 1.4s | 14 | harness |
| 6 | compliance | localhost | PASS 5.9s | 238 | harness |
| 7 | windows | VM200 (remote) | PASS 0.4s | 3 | harness |
| 8 | ad | VM200 (run ON Windows DC) | PASS | 5 | VM200 guest-exec |
| 9 | cloud | DVWA | PASS 1.6s | 35 | harness |
| 10 | container | local | PASS | 1 | harness |
| 11 | sbom | local dir | PASS | 1 | harness |
| 12 | credential | DVWA | PASS | 0 (nothing to find) | harness |
| 13 | asm | DVWA | PASS 1.8s | 2 | harness |
| 14 | malware | EICAR file (/tmp/malware-test) | PASS complete | 1 | standalone |
| 15 | shadow_ai | DVWA | PASS 0.7s | 7 | harness |
| 16 | adversary | localhost | PASS 1.4s | 18 | harness |
| 17 | openvas | DVWA / CT101 | PASS 0.4s | 0 | harness |
| 18 | quantum | RSA-2048 TLS :443 | PASS | 2 HIGH | standalone |
| 19 | mcp | local | PASS | 1 INFO | standalone |

## Harness end-to-end: 79 / 81 PASS (97.5%)
Scanners + dataflow (evidence store/retrieve, SARIF, compliance mapping, risk quantification) + 12 export formats + 6 compliance reports + AI analysis — all PASS. The 2 harness "FAILs" (`ad`, `malware`) were **harness mis-targeting, not scanner bugs** — both validated above against correct targets.

## Key findings / fixes
- The prior 2026-03-22 run's failures (web/ssl/linux/openvas) were **Windows-host env issues** (run on Windows: `os.geteuid` missing, nikto/testssl/openvas absent). All PASS on the proper Linux runner.
- A stealth-pacing `human_delay()` (`base.py:82`, `random.uniform(30,300)`s) stalled the first run; `DONJON_TEST_MODE=1` is the designed switch to zero it for testing.
- `ad` is **Windows-only** by design (correctly refuses on Linux: `"AD scanner requires Windows"`); validated on VM200.
- `quantum`/`ad`/`mcp` return rich result dicts but do not set a top-level `scan_status` (reads `None`) — cosmetic only; findings are produced.

## Verified count for marketing/claims
**19 scanners** ship and are functionally validated (7 community-core + 12 advanced). The site's "18" undercount (Adversary vs MCP table confusion) is wrong; correct to **19**.

## Harness coverage gaps to fix (canonical `tools/functional-test-harness.py`)
1. Add `quantum` + `mcp` to `SCANNER_MAP` (currently untested by the harness).
2. `malware` → use a file/EICAR target (currently sent an IP → skipped).
3. `ad` → map to a Windows runner / mark SKIP-not-FAIL on Linux (validated separately on VM200).
4. (optional) set `scan_status='complete'` in quantum/ad/mcp for uniform result shape.
