<!-- nornir:class: readme -->
# Móðguðr — complete overview
> The **real** README: the full pitch, the competitive matrix, what each engine does,
> and the quickstart. The repo-root [`README.md`](../README.md) is the slim face (title ·
> mashup · pointers); this chapter is the heavy detail, and it is also folded into the
> manual [`docs/manual.pdf`](../docs/manual.pdf) by `nornir docs book`.
The nordisk supply-chain **gatekeeper**: a leaf Rust crate that hands any artifact a
CVE / license / provenance **verdict** (Pass / Warn / Block) — and, with its heavy SCIP
engine, diffs the *behaviour* of your entire dependency world between two snapshots over
a time-travelling Iceberg warehouse.
<p align="center"><em>Móðguðr guards Gjallarbrú, the bridge to Hel — she challenges everyone who tries to cross and demands to know who they are.</em></p>
**Why Móðguðr** — a scanner hands you today's verdict; modgunn also remembers every advisory
and every world-snapshot, and tells you what *changed*. The rows marked **NA** are categories
the scanners have no concept for (vs Trivy · Snyk · Dependency-Track; Grype / OSV-Scanner sit
alongside Trivy):
| capability | **modgunn** | Trivy | Snyk | Dependency-Track |
|---|:--:|:--:|:--:|:--:|
| Multi-ecosystem CVE / license / provenance **verdict** (Pass / Warn / Block) | **✅** | ✅ | ✅ | ✅ |
| Exploit-intel gating — **KEV + EPSS thresholds + VEX** suppression | **✅** | ◐ | **✅** | ◐ |
| **Reachability-gated** vulns — is the CVE actually called? (SCIP call-graph) | **✅** | ✗ | **✅** | ✗ |
| Whole-world **behaviour-delta** between snapshots — capability drift, blast-radius (PageRank), fingerprint drift, tripwires | **✅** | **NA** | **NA** | **NA** |
| Advisories **+ world-snapshots in a time-travel + CDC Iceberg warehouse**, queryable by other services | **✅** | **NA** | **NA** | **NA** |
| Embeddable **leaf crate** — drop the gate (`core::Verdict`) inside another Rust app | **✅** | ◐ | ✗ | ✗ |
| Mature curated advisory DB + breadth of ecosystem coverage | ◐ | **✅** | **✅** | **✅** |
*Rows marked **NA**: the rival has no such category — not a missing feature, a missing concept.*
## What it does
- **Engine A — `scan` (the verdict).** Multi-ecosystem CVE / license / provenance →
`core::Verdict` (Pass / Warn / Block), cached by `(blob_sha256, policy_version,
advisory_db_rev)`, with KEV / EPSS / VEX exploit-intelligence gating. Lean leaf —
holger's promotion gate consumes it directly.
- **Engine B — `scip` (the world-delta).** A real `WorldSnapshot` of the resolved
dep-graph + SCIP call-graph; `diff()` → `BehaviorDelta` feeds reachability-gated vulns,
capability-surface drift, blast-radius (PageRank) and fingerprint-drift tripwires.
Heavy (128 GB–1 TB RAM); off by default.
- **Warehouse seam (`warehouse` feature).** Opens the shared skade / Iceberg catalog
directly — OWNs `cve_advisories` / `world_snapshots` / `behavior_deltas` /
`tripwire_events`, READs nornir's `sbom_components`, with CDC over
skade's `read_delta`.
- **Leaf by design.** holger and nornir both depend on modgunn; modgunn never depends on
nornir — that is the cycle it exists to break.
## Quickstart
```sh
cargo build # Engine A — the artifact security verdict (lean leaf)
cargo build --features scip # + Engine B — whole-world behaviour-delta (heavy)
cargo test # Engine A (13 tests) + Engine B (16 tests)
```
## Benchmarks
> **Numbers pending — no harness recorded yet.** modgunn does not yet ship a
> `nornir bench run modgunn` harness (`bench/examples/nornir-bench.rs`), and no
> results are recorded in this workspace's warehouse
> (`nornir bench history-show modgunn` → *no bench runs recorded*). The natural
> metrics — Engine A verdict throughput (artifacts/s, cache hit vs cold) and
> Engine B `diff()` wall-time per snapshot pair — go here once a Bencher harness
> lands and records them. No figures are quoted until they are measured.