feat(governance): Phase 1 — CWE policy store + project score (zero-dep)

First implementation slice of the approved harnessx-self-improving-rulesets spec
(Foundation: governance + scoring planes). Additive and zero-dependency; findings
stay byte-identical and the >=90% recall / <10% FP detection gate is unchanged.

- PolicyStore (policy/verycode.py): vendors verycode-policies CWE_Score.tsv (167
  CWEs, CRLF + trailing-space header parsed defensively); CwePolicy(severity 0-5,
  static/dynamic); load_policy, resolve_severity (severity is policy-governed,
  keyed on CWE — one CWE = one severity), assert_rules_resolve (fail-loud if an
  enabled rule's CWE is unmapped). Remap the C/C++ buffer rules CWE-120 -> CWE-121
  (CWE-120 is absent from verycode; 121 = Stack-Based Buffer Overflow, severity 5).
- ScoreModel (scoring/project_score.py): SEV_WEIGHT, REACH_MULT, finding_penalty,
  project_score (0-100 exponential decay; one sev-5 reachable -> ~43), two-condition
  gate (sev-5+reachable always fails; score<min_score fails only when blocking),
  build_score_artifact.
- Wire into _run_scan: policy_load + fail-loud policy_check stages; score stage
  writes score.json and merges a score block into the manifest (advisory-first).
- ScoreConfig (k/min_score/block_severity_reachable/blocking) in config.py.
- pyproject uv_build ships the vendored TSV in the wheel (verified).
- Tests: test_policy, test_scoring, test_score_pipeline (artifact + fail-loud).
  85 passed; ruff + mypy clean. Spec phases 1.1-2.4 checked off; spec approved.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

src/openultrasast/config.py

@@ -50,6 +50,14 @@ class StaticAnalysisConfig:
     sarif_paths: tuple[str, ...] = ()
 
 
+@dataclass(frozen=True)
+class ScoreConfig:
+    k: float = 60.0
+    min_score: int = 80
+    block_severity_reachable: int = 5
+    blocking: bool = False
+
+
 @dataclass(frozen=True)
 class ResolvedConfig:
     models: ModelConfig = ModelConfig()
@@ -58,6 +66,7 @@ class ResolvedConfig:
     dynamic: DynamicConfig = DynamicConfig()
     evidence: EvidenceConfig = EvidenceConfig()
     static_analysis: StaticAnalysisConfig = StaticAnalysisConfig()
+    score: ScoreConfig = ScoreConfig()
     runs_dir: str = ".openultrasast/runs"
 
 
@@ -74,6 +83,7 @@ def load_config(config_path: Path | None = None) -> ResolvedConfig:
         dynamic=_load_dynamic(data.get("dynamic", {})),
         evidence=_load_evidence(data.get("evidence", {})),
         static_analysis=_load_static_analysis(data.get("static_analysis", {})),
+        score=_load_score(data.get("score", {})),
         runs_dir=os.environ.get("OPENULTRASAST_RUNS_DIR", ".openultrasast/runs"),
     )
 
@@ -148,3 +158,26 @@ def _load_static_analysis(value: object) -> StaticAnalysisConfig:
     if not isinstance(paths, list):
         paths = []
     return StaticAnalysisConfig(sarif_paths=tuple(str(item) for item in paths))
+
+
+def _load_score(value: object) -> ScoreConfig:
+    data = _section(value)
+    return ScoreConfig(
+        k=_float_value(data.get("k"), 60.0),
+        min_score=_int_value(data.get("min_score"), 80),
+        block_severity_reachable=_int_value(data.get("block_severity_reachable"), 5),
+        blocking=bool(data.get("blocking", False)),
+    )
+
+
+def _float_value(value: object, default: float) -> float:
+    if isinstance(value, bool):
+        return default
+    if isinstance(value, int | float):
+        return float(value)
+    if isinstance(value, str):
+        try:
+            return float(value)
+        except ValueError:
+            return default
+    return default