[21tmccauley]

Split from #300, contributed by Lucid (co-authored by Rocky Olsen). This takes the two new Inspector fetchers. The aws_ecr_image_scanning changes from #300 stay out because they have a severity-count bug on enhanced scanning (details on #300), and will follow separately.

What's added

• aws_inspector_ecr_findings (EVD-INSPECTOR-ECR-FINDINGS): evidence of active Inspector findings per ECR image, the image inventory and scan coverage. When calls fail it keeps the partial evidence (partial_failure, api_failures, collection_complete: false) and exits nonzero.
• aws_inspector_ecr_report (issue report, VULNERABILITY): builds a CSV from the same Inspector APIs for the existing paramify issues upload path, with no S3/KMS export. It is all-or-nothing: it refuses incomplete pagination, missing coverage and inventory mismatches.
• Issue-report guide: a fetcher may now build its report from a tool's API when no practical native export exists, under documented requirements (stable row identity, complete pagination, documented columns). This replaces the one-off exception from Fix enhanced ECR scanning and add Inspector findings intake #300 with a general rule. Reviewed and approved by @21tmccauley.

Tested end to end

Against a live AWS account (Inspector enabled, 5 real images, about 10k findings) and Paramify stage:

• Evidence fetcher: correct findings and coverage; partial failure verified with a least-privilege role.
• Built a CSV preset in the app from the documented columns, then went through the real uploader and API:
  • First upload: 30 created.
  • Re-upload of the same findings: 0 created, 30 updated (no duplicates). The CSV is byte-identical across runs.
  • After deleting an image: the report refused while Inspector still listed its findings, then after Inspector caught up, closing the cycle auto-closed exactly that image's 14 issues.
• The same CVE on two images stays as two issues.
• Full suite: 8,754 passed, 102 skipped. ruff and mypy pass on framework/.

Known follow-ups (not blocking)

• An INACTIVE artifact in scope (for example a Helm chart, UNSUPPORTED_MEDIA_TYPE) blocks the whole report. Expected exclusions should be recorded as gaps, not blockers.
• The evidence size grows with findings (about 47 MB for 10k findings), so it may need trimming.
• The error after an image is deleted says "changed during collection" when the cause is Inspector lag.
• Intake presets need mappings for INFORMATIONAL and UNTRIAGED severities.

🤖 Generated with Claude Code