diff-scan

Runs an Endor Labs SAST or AI SAST scan scoped to changed files only, using endorctl --diff-scope. It scans local uncommitted edits or the difference against the default branch, reports the resulting findings with severity and location, and states scan scope, upload behaviour, and any evidence gaps. It is the one Agent Kit workflow that starts a scan.