consolidation of some of the modules, localization fixes, product advisories work, qa work

AGENTS.md

@@ -40,19 +40,23 @@ Authoritative module design lives under:
 (Use these paths to locate code quickly; do not treat the list as exhaustive.)
 
 - Release orchestration: `src/ReleaseOrchestrator/`
-- Scanner: `src/Scanner/`
-- Authority (OAuth/OIDC): `src/Authority/`
+- Scanner: `src/Scanner/` (includes Cartographer)
+- Authority (OAuth/OIDC): `src/Authority/` (includes IssuerDirectory)
 - Policy: `src/Policy/`
-- Evidence: `src/EvidenceLocker/`, `src/Attestor/`, `src/Signer/`, `src/Provenance/`
-- Scheduling/execution: `src/Scheduler/`, `src/Orchestrator/`, `src/TaskRunner/`
-- Integrations: `src/Integrations/`
+- Evidence: `src/EvidenceLocker/`, `src/Attestor/` (includes Signer, Provenance)
+- Scheduling/execution: `src/JobEngine/` (includes Scheduler, TaskRunner, PacksRegistry)
+- Integrations: `src/Integrations/` (includes Extensions)
 - UI: `src/Web/`
-- Feeds/VEX: `src/Concelier/`, `src/Excititor/`, `src/VexLens/`, `src/VexHub/`, `src/IssuerDirectory/`
-- Reachability and graphs: `src/ReachGraph/`, `src/Graph/`, `src/Cartographer/`
+- Feeds/VEX: `src/Concelier/` (includes Feedser, Excititor), `src/VexLens/`, `src/VexHub/`
+- Reachability and graphs: `src/ReachGraph/`, `src/Graph/`
 - Ops and observability: `src/Doctor/`, `src/Notify/`, `src/Notifier/`, `src/Telemetry/`
+- Findings and risk: `src/Findings/` (includes RiskEngine, VulnExplorer)
 - Offline/air-gap: `src/AirGap/`
 - Crypto plugins: `src/Cryptography/`, `src/SmRemote/`
-- Tooling: `src/Tools/`, `src/Bench/`, `src/Sdk/`
+- Tooling: `src/Tools/` (includes Bench, Verifier, Sdk, DevPortal)
+- Binary analysis: `src/BinaryIndex/` (includes Symbols)
+- Advisory AI: `src/AdvisoryAI/` (includes OpsMemory)
+- Timeline: `src/Timeline/` (includes TimelineIndexer)
 
 ---