Synvoya · Nov 1, 2026 · Nov 2, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -48,10 +48,11 @@ concurrency:
   group: ci-${{ github.ref }}
   cancel-in-progress: true
 
+# CI runs only in the public repo (free Actions); the private dev repo never runs it (Hibi, 2026-11-02).
 jobs:
   dco:
     name: contributor sign-off (DCO)
-    if: github.event_name == 'pull_request'
+    if: github.repository == 'Synvoya/codeinspectus' && github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
       - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -76,6 +77,7 @@ jobs:
 
   always:
     name: always-run (no engines)
+    if: github.repository == 'Synvoya/codeinspectus'
     runs-on: ubuntu-latest
     steps:
       # audit mode — logs egress for a future block-mode allowlist (CG-78); does not restrict.
@@ -112,6 +114,7 @@ jobs:
 
   node22-compatibility:
     name: minimum runtime (Node 22)
+    if: github.repository == 'Synvoya/codeinspectus'
     runs-on: ubuntu-latest
     steps:
       - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
@@ -134,6 +137,7 @@ jobs:
 
   engine:
     name: engine (linux/amd64)
+    if: github.repository == 'Synvoya/codeinspectus'
     runs-on: ubuntu-latest
     steps:
       # audit mode — logs egress for a future block-mode allowlist (CG-78); does not restrict.
@@ -182,6 +186,7 @@ jobs:
 
   runtime-portability:
     name: runtime (${{ matrix.platform }})
+    if: github.repository == 'Synvoya/codeinspectus'
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
@@ -191,7 +196,7 @@ jobs:
             platform: win32-x64
           - os: macos-15-intel
             platform: darwin-x64
-          - os: macos-14
+          - os: macos-15
             platform: darwin-arm64
           - os: ubuntu-24.04-arm
             platform: linux-arm64

diff --git a/.github/workflows/pin-engines.yml b/.github/workflows/pin-engines.yml
@@ -28,7 +28,7 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-14            # Apple Silicon
+          - os: macos-15            # Apple Silicon
             platform: darwin-arm64
           - os: macos-15-intel      # Intel
             platform: darwin-x64

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,21 @@ All notable changes to CodeInspectus are documented here. Versioning follows
 [Semantic Versioning](https://semver.org). AI-code detections and compliance mappings are
 AI-drafted and practitioner-reviewed — see the honesty notes in the [README](README.md).
 
+## [Unreleased]
+
+### Changed
+- Engine pins: Opengrep 1.23.0 → 1.33.1 and Trivy 0.71.2 → 0.76.1. Gitleaks 8.30.1 is already the
+  latest release. Trivy 0.76.1 is built with Go 1.27.3, which distrusts the compromised eMudhra
+  intermediate CA. Opengrep 1.24–1.33 change taint analysis (switch and `case` handling, Kotlin and
+  Ruby branches, Python match arms); the exact Opengrep eval corpora are unchanged.
+- Opengrep releases since v1.31.0 are signed by `rolling-release.yml` on per-release
+  `release-vX.Y.Z` branches instead of `main`. The lockfile pins the exact `release-v1.33.1`
+  identity, and verification stays fail-closed.
+
+### Upgrade note
+- Existing installs report the old Opengrep and Trivy binaries as a SHA256 mismatch and do not run
+  them. Run `npx codeinspectus repair-engines` to install the pinned versions.
+
 ## [3.3.2] — 2026-10-24
 
 ### Security

diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md
@@ -23,12 +23,12 @@ and no usable system copy exists. Its platform binary SHA-256 is pinned from the
 manifest after that manifest's Sigstore bundle verified successfully. Cosign is stored separately
 under `~/.codeinspectus/bin`; it is not included in the npm package.
 
-### Opengrep 1.23.0
+### Opengrep 1.33.1
 
 - Project: <https://github.com/opengrep/opengrep>
-- Exact source: <https://github.com/opengrep/opengrep/tree/v1.23.0>
+- Exact source: <https://github.com/opengrep/opengrep/tree/v1.33.1>
 - License: GNU Lesser General Public License 2.1
-- License text: <https://github.com/opengrep/opengrep/blob/v1.23.0/LICENSE>
+- License text: <https://github.com/opengrep/opengrep/blob/v1.33.1/LICENSE>
 - Copyright notice: Semgrep, Copyright (C) 2019-2024 Semgrep Inc., as preserved in the
   upstream `COPYRIGHT` file.
 
@@ -48,12 +48,12 @@ authored and licensed under Apache-2.0.
 CodeInspectus supplies its own configuration while enabling Gitleaks' upstream MIT-licensed default
 rules. The separately downloaded executable and its upstream rules remain Gitleaks work.
 
-### Trivy 0.71.2
+### Trivy 0.76.1
 
 - Project: <https://github.com/aquasecurity/trivy>
-- Exact source: <https://github.com/aquasecurity/trivy/tree/v0.71.2>
+- Exact source: <https://github.com/aquasecurity/trivy/tree/v0.76.1>
 - License: Apache License 2.0
-- License text: <https://github.com/aquasecurity/trivy/blob/v0.71.2/LICENSE>
+- License text: <https://github.com/aquasecurity/trivy/blob/v0.76.1/LICENSE>
 - Upstream notice: Trivy, Copyright 2019-2020 Aqua Security Software Ltd. This product includes
   software developed by Aqua Security (<https://aquasec.com>).
 

diff --git a/detection-db/manifest.json b/detection-db/manifest.json
@@ -4,9 +4,9 @@
   "date": "2026-08-13",
   "description": "CodeInspectus's curated first-party detections. Native packs cover bounded AI/framework checks plus selected reconciled SAST rules; separately downloaded external engines remain additive fallbacks and broader scanners.",
   "engine_versions": {
-    "opengrep": "1.23.0",
+    "opengrep": "1.33.1",
     "gitleaks": "8.30.1",
-    "trivy": "0.71.2",
+    "trivy": "0.76.1",
     "codeinspectus-pub": "1.0.0"
   },
   "opengrep_rulesets": [

diff --git a/docs/RULE-PROVENANCE.md b/docs/RULE-PROVENANCE.md
@@ -251,9 +251,9 @@ Versions are cited from **`engines.lock.json` (ground truth)** — *not* the PRD
 
 | Engine | Version (`engines.lock.json`) | Engine license | Engine-authored ruleset in use | Ruleset license | In npm tarball? |
 |---|---|---|---|---|---|
-| Opengrep | **1.23.0** | LGPL-2.1 (PRD §4.1 / §11) | **None.** Runs only CI's `security-baseline`; explicitly **not** `--config auto` (`src/engines/opengrep.ts`) | — | Binary: **No**. CI rules: yes (`detection-db/`) |
+| Opengrep | **1.33.1** | LGPL-2.1 (PRD §4.1 / §11) | **None.** Runs only CI's `security-baseline`; explicitly **not** `--config auto` (`src/engines/opengrep.ts`) | — | Binary: **No**. CI rules: yes (`detection-db/`) |
 | Gitleaks | **8.30.1** | MIT (CLI; PRD §4.2) | Gitleaks' **built-in default** secret rules (`[extend] useDefault = true` in `codeinspectus.toml`) | MIT (gitleaks-authored) | Binary: **No**. CI `.toml`: yes |
-| Trivy | **0.71.2** | Apache-2.0 (PRD §4.3) | Trivy built-in **vuln / misconfig / secret / license** scanners + the Trivy **vuln DB** | Apache-2.0 (engine); **DB = aggregated third-party advisory data, heterogeneous licenses** | Binary + DB: **No** (downloaded) |
+| Trivy | **0.76.1** | Apache-2.0 (PRD §4.3) | Trivy built-in **vuln / misconfig / secret / license** scanners + the Trivy **vuln DB** | Apache-2.0 (engine); **DB = aggregated third-party advisory data, heterogeneous licenses** | Binary + DB: **No** (downloaded) |
 
 The engine licenses were reconciled against the exact pinned releases for 2.5.0. Opengrep's
 LGPL-2.1 obligations must not be described as permissive; the executable stays separate and is

diff --git a/docs/context/verify.md b/docs/context/verify.md
@@ -226,7 +226,7 @@ npm run shadow:opengrep -- --require-hit \
   fixtures/opengrep-shadow-corpus/fixed
 ```
 
-Expected: Opengrep `1.23.0` is available; TP is exact 6/6, FP/fixed are 0/0, direct-file and
+Expected: Opengrep `1.33.1` is available; TP is exact 6/6, FP/fixed are 0/0, direct-file and
 project-root identities agree, metadata mismatches are empty, and no candidate loader limitation is
 present. E34 repeats the engine-backed parity contract. E35/E36 prove native-only surfaced
 provenance, SAST/AI scanner filtering, and same-path fixed/reintroduced rescan behavior while the