 Marius CiepluchandClaude Opus 4.8
|
ae365f6cb7
|
feat(governance): Phase 1 — CWE policy store + project score (zero-dep)
First implementation slice of the approved harnessx-self-improving-rulesets spec
(Foundation: governance + scoring planes). Additive and zero-dependency; findings
stay byte-identical and the >=90% recall / <10% FP detection gate is unchanged.
- PolicyStore (policy/verycode.py): vendors verycode-policies CWE_Score.tsv (167
CWEs, CRLF + trailing-space header parsed defensively); CwePolicy(severity 0-5,
static/dynamic); load_policy, resolve_severity (severity is policy-governed,
keyed on CWE — one CWE = one severity), assert_rules_resolve (fail-loud if an
enabled rule's CWE is unmapped). Remap the C/C++ buffer rules CWE-120 -> CWE-121
(CWE-120 is absent from verycode; 121 = Stack-Based Buffer Overflow, severity 5).
- ScoreModel (scoring/project_score.py): SEV_WEIGHT, REACH_MULT, finding_penalty,
project_score (0-100 exponential decay; one sev-5 reachable -> ~43), two-condition
gate (sev-5+reachable always fails; score<min_score fails only when blocking),
build_score_artifact.
- Wire into _run_scan: policy_load + fail-loud policy_check stages; score stage
writes score.json and merges a score block into the manifest (advisory-first).
- ScoreConfig (k/min_score/block_severity_reachable/blocking) in config.py.
- pyproject uv_build ships the vendored TSV in the wheel (verified).
- Tests: test_policy, test_scoring, test_score_pipeline (artifact + fail-loud).
85 passed; ruff + mypy clean. Spec phases 1.1-2.4 checked off; spec approved.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
|
2026-06-22 12:31:35 +02:00 |
|