CipherMap Documentation

How it works: Full-screen Charmbracelet bubbletea/lipgloss TUI over your scan results: a findings list, per-rule explainer drawer (static reference text), a migration timeline estimator, diff views, and read-only remediation proposal inspection.
Why it matters: Inspection and proposal review do not modify the workspace. Production source publication, including TUI and LSP write actions, remains disabled until Gate 2 is promoted.
Access: Ctrl+E encrypted vault export requires Standalone Auditor Tier A or higher; TUI inspection remains read-only for every tier in this release.

ciphermap tui .  # read-only findings and proposal review

Python: bounded MD5/SHA-1 constructor proposals with string/comment masking and guards; a digest used as a persisted identifier is declined. Go: bounded MD5/SHA-1 call-shape proposals target SHA-256. RSA, DES, RC4, protocol, dependency, and unsupported migrations are not treated as drop-in replacements; they are declined with a stated reason.
Release boundary: --dry-run previews the candidate plan without changing source. Production publication, backup creation, verifier execution, and apply actions remain disabled until the isolated Gate 2 transaction and recovery evidence are promoted.
Access: read-only preview is Free. A Tier B licence does not unlock source writes in this release.

ciphermap fix . --dry-run   # preview only; no source writes

How it works: Serializes detected cryptographic assets into a CycloneDX 1.6 Cryptographic Bill of Materials with real cryptoProperties — algorithm identity is grounded per rule, and undetermined fields are omitted, never invented. Also emits SPDX 2.3 and OpenVEX (with honest coverage disclosure). Tier B can push the CycloneDX output to OWASP Dependency-Track. --bundle produces an auditor vault zip whose manifest carries an HMAC-SHA256 integrity tag — a symmetric tag, plainly labeled as such, keyed by your own CIPHERMAP_SIGNING_KEY (there is deliberately no default key).
Why it matters: A machine-readable CBOM is how you evidence a cryptographic inventory to auditors and downstream customers.
Access: Local CBOM/SPDX/OpenVEX generation and auditor bundles require Tier A; Dependency-Track delivery requires Tier B.

ciphermap cbom --format cyclonedx --output cbom.json

How it works: Decrypts an AES-256-GCM encrypted .enc vault archive and extracts its compliance documents.
Why it matters: Lets an analyst on an isolated network read audit results produced on the other side of the air gap.
Access: Standalone Auditor Tier A or DevSecOps Enterprise Tier B.

ciphermap import vault.enc --passphrase "<passphrase>"

How it works: Verifies the SHA-256 checksum manifest (vault.enc.sha256) against the encrypted vault package before extraction. Verification is free, so an auditor who is not a customer can still check a bundle's integrity.
Why it matters: Detects corruption or truncation after physical media transfer, before you attempt decryption.

ciphermap verify vault.enc

GitHub Actions PR Review

ciphermap ci-review runs the Tier B PR review bot for GitHub, GitLab, Azure DevOps or Bitbucket Cloud. The plain CI gate via scan --fail-on is Free. Exit-code contract: 0 clean, 1 gate tripped, 2 error — a read failure exits 2 rather than passing silently. Basic provider templates, the composite GitHub Action, and the pre-commit hook also remain Free; writing PR comments or checks is the Tier B boundary.

The workflow below describes the future signed native release. During the Free developer source preview, install.sh remains unavailable and approved users receive a separate checksum-bound source archive; this Tier B provider workflow is not activated by that build.

name: CipherMap PQC Audit
on: [pull_request]
jobs:
  pqc-audit:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
        with:
          fetch-depth: 0
      - name: Install pinned CipherMap CLI
        shell: bash
        run: |
          set -euo pipefail
          installer="$(mktemp)"
          trap 'rm -f "$installer"' EXIT
          expected='4b3d06aad504407155750da1b9995af56ac347bfa78236d950110888c501ed0c'
          curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location --max-time 60 --output "$installer" https://www.ciphermap.io/install.sh
          actual="$(sha256sum "$installer" | awk '{print $1}')"
          [ "$actual" = "$expected" ]
          bash "$installer"
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
      - run: ciphermap ci-review . --provider github --pr ${{ github.event.number }}
        env:
          GITHUB_TOKEN: ${{ github.token }}
          CIPHERMAP_LICENSE: ${{ secrets.CIPHERMAP_LICENSE }}

Prometheus Metrics

The self-hosted fleet server (ciphermap server) exports Prometheus-format metrics at /metrics — ciphermap_fleet_complete_scan_score, ciphermap_scans_processed_total, and ciphermap_repos_monitored_total. Fleet operation requires DevSecOps Enterprise Tier B. Only /healthz is public. Metrics, the console, reports, policy and management APIs require the admin token. Keep the server-only ingest signing key out of CI; mint a separate write token for each canonical repository. A repository token cannot write another repository or read fleet data. Repository badges use a separately revocable badge token.

# Operator: mint one repository-scoped CI credential
CIPHERMAP_SERVER_INGEST_KEY="$SERVER_KEY" \
  ciphermap server --mint-ingest-token acme/payments

# CI: publish only this repository's scan evidence
CIPHERMAP_SERVER_INGEST_TOKEN="$ACME_PAYMENTS_TOKEN" ciphermap sync .

# Admin/Prometheus: read fleet metrics
curl -s -H "Authorization: Bearer $CIPHERMAP_SERVER_TOKEN" \
  http://localhost:8080/metrics | grep ciphermap_fleet_complete_scan_score