feat(gate): Phase 4 task 8 — lock the detection gate into CI

Make the >=90% recall / <10% FP detection gate a first-class, score-independent
CI step with non-regression guards.

- openultrasast.gate: canonical corpus map + DetectionMetrics/DetectionGateVerdict,
  evaluate_corpus/detection_gate (no score input — cannot be unblocked by score),
  merge_gate (ANDs the hard detection gate with the advisory-first score gate),
  within_tolerance, and a `python -m openultrasast.gate` entrypoint that exits
  non-zero on a breach. Wired as an explicit step in both the GitHub and Dagger
  pipelines.
- 8.1: pipeline tests prove a high/passing score cannot unblock a recall-breaching
  change; the gate fails below 90% recall or at/above 10% FP.
- 8.2: tests/golden/detection_baseline.json + a byte-identical baseline test for
  the default ruleset / empty ledger (44/47 = 93.62% recall, 0% FP).
- 8.3: within_tolerance band logic + a capability-gated HarnessX tolerance test.
- 8.4: zero-dependency guard — governance/scoring/benchmark planes never import
  HarnessX (sys.modules check + module-scope import scan).
- test_detection_benchmarks now sources the corpus/aggregation from the gate module.

128 passed, 3 skipped; ruff + mypy clean; detection gate PASS.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

tests/test_detection_benchmarks.py

@@ -1,79 +1,35 @@
 """Detection-quality gate for the in-scope languages.
 
-Runs quick-mode scans against the C/C++, Python, and JavaScript benchmark
-corpora and asserts the project goal: at least 90% recall of known
-vulnerabilities and under a 10% false-positive rate per language.
+Runs quick-mode scans against the C/C++, Python, JavaScript, and Java benchmark
+corpora and asserts the project goal: at least 90% recall of known vulnerabilities
+and under a 10% false-positive rate per language. The corpus map and aggregation
+live in ``openultrasast.gate`` (the same gate CI runs as a first-class step).
 """
 
-from pathlib import Path
-
 import pytest
 
-from openultrasast.benchmark import (
-    BenchmarkRun,
-    evaluate_benchmark,
-    load_benchmark_manifest,
-    resolve_benchmark_source,
+from openultrasast.gate import (
+    FALSE_POSITIVE_CEILING,
+    LANGUAGE_MANIFESTS,
+    RECALL_FLOOR,
+    detection_gate,
+    language_metrics,
 )
-from openultrasast.findings import quick_scan_findings
-from openultrasast.mapping import analyze_entry_points, attach_reachability_hints
-from openultrasast.preprocess import preprocess_repository
-from openultrasast.rank import rank_targets
-
-LANGUAGE_MANIFESTS = {
-    "c_cpp": ["c-cpp-smoke", "cpp-damn-vulnerable"],
-    "python": ["python-web-smoke", "python-vulnerable"],
-    "javascript": ["javascript-node-web-smoke", "javascript-vulnerable"],
-    "java": ["java-web-smoke", "java-spring-boot-vulnerable"],
-}
-
-RECALL_FLOOR = 0.90
-FALSE_POSITIVE_CEILING = 0.10
-
-
-def _quick_scan(target: Path):  # type: ignore[no-untyped-def]
-    _, targets = preprocess_repository(target)
-    targets = attach_reachability_hints(targets, analyze_entry_points(target, targets))
-    rankings = rank_targets(targets)
-    return quick_scan_findings(target, targets, rankings)
-
-
-def _language_metrics(manifest_names: list[str]) -> tuple[int, int, int, int]:
-    expected = matched = actual = false_positives = 0
-    for name in manifest_names:
-        manifest_path = Path(f"benchmarks/manifests/{name}.toml")
-        manifest = load_benchmark_manifest(manifest_path)
-        target = resolve_benchmark_source(manifest_path, manifest)
-        findings = _quick_scan(target)
-        run = BenchmarkRun(benchmark_run_id="gate", root=Path("/tmp/gate"), manifest=manifest)
-        result = evaluate_benchmark(run=run, mode="quick", findings=findings, scan_id=None, scan_run_dir=None)
-        metrics = result.metrics
-        expected += metrics.expected_findings_total
-        matched += metrics.matched_findings_total
-        actual += metrics.actual_findings_total
-        false_positives += metrics.false_positive_findings_total
-    return expected, matched, actual, false_positives
 
 
 @pytest.mark.parametrize("language", sorted(LANGUAGE_MANIFESTS))
 def test_language_meets_recall_and_false_positive_goal(language: str) -> None:
-    expected, matched, actual, false_positives = _language_metrics(LANGUAGE_MANIFESTS[language])
+    metrics = language_metrics(LANGUAGE_MANIFESTS[language])
 
-    recall = matched / expected
-    false_positive_rate = false_positives / actual if actual else 0.0
-
-    assert recall >= RECALL_FLOOR, f"{language} recall {recall:.2%} below {RECALL_FLOOR:.0%} ({matched}/{expected})"
-    assert false_positive_rate < FALSE_POSITIVE_CEILING, (
-        f"{language} false-positive rate {false_positive_rate:.2%} at or above {FALSE_POSITIVE_CEILING:.0%} ({false_positives}/{actual})"
+    assert metrics.recall >= RECALL_FLOOR, (
+        f"{language} recall {metrics.recall:.2%} below {RECALL_FLOOR:.0%} ({metrics.matched}/{metrics.expected})"
+    )
+    assert metrics.false_positive_rate < FALSE_POSITIVE_CEILING, (
+        f"{language} false-positive rate {metrics.false_positive_rate:.2%} at or above "
+        f"{FALSE_POSITIVE_CEILING:.0%} ({metrics.false_positives}/{metrics.actual})"
     )
 
 
 def test_overall_detection_goal_is_met() -> None:
-    totals = [_language_metrics(names) for names in LANGUAGE_MANIFESTS.values()]
-    expected = sum(t[0] for t in totals)
-    matched = sum(t[1] for t in totals)
-    actual = sum(t[2] for t in totals)
-    false_positives = sum(t[3] for t in totals)
-
-    assert matched / expected >= RECALL_FLOOR
-    assert (false_positives / actual) < FALSE_POSITIVE_CEILING
+    verdict = detection_gate({language: language_metrics(names) for language, names in LANGUAGE_MANIFESTS.items()})
+    assert verdict.passed, verdict.reasons