stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

semi implemented and features implemented save checkpoint

Browse Source
This commit is contained in:
master
2026-02-08 18:00:49 +02:00
parent 04360dff63
commit 1bf6bbf395
20895 changed files with 716795 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
docs/features/unchecked/scanner/vex-auto-generation-and-auto-downgrade.md Normal file
View File

@@ -0,0 +1,32 @@
# VEX Auto-Generation and Auto-Downgrade (SmartDiff Candidates, Runtime Evidence)
## Module
Scanner
## Status
IMPLEMENTED
## Description
Emits VEX candidates (not_affected/under_investigation) from SmartDiff when vulnerable APIs absent in current version. Runtime results can support/contradict static analysis, enabling auto-downgrade of VEX posture based on runtime evidence.
## Implementation Details
- **VEX Candidate Emitter**:
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexCandidateEmitter.cs` - `VexCandidateEmitter` emitting VEX candidates (not_affected, under_investigation) when SmartDiff detects that vulnerable APIs are absent in the current version
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexCandidateModels.cs` - VEX candidate data models
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexEvidence.cs` - `VexEvidence` model linking SmartDiff evidence to VEX candidates
- **Persistence**:
- `src/Scanner/__Libraries/StellaOps.Scanner.Storage/Postgres/PostgresVexCandidateStore.cs` - `PostgresVexCandidateStore` persisting VEX candidates for review and approval
- **Delta Signature VEX**:
- `src/Scanner/__Libraries/StellaOps.Scanner.Evidence/DeltaSigVexEmitter.cs` - `DeltaSigVexEmitter` emitting VEX statements based on delta signature analysis
- **API**:
- `src/Scanner/StellaOps.Scanner.WebService/Endpoints/SmartDiffEndpoints.cs` - SmartDiff endpoints including VEX candidate retrieval
- **Tests**:
- `src/Scanner/__Tests/StellaOps.Scanner.SmartDiff.Tests/VexCandidateEmitterTests.cs` - VEX candidate emission tests
## E2E Test Plan
- [ ] Trigger SmartDiff analysis where vulnerable APIs are absent in the current version and verify a "not_affected" VEX candidate is emitted
- [ ] Verify "under_investigation" VEX candidates are emitted when SmartDiff cannot conclusively determine API absence
- [ ] Verify runtime evidence contradicting a "not_affected" VEX candidate triggers auto-downgrade to "under_investigation"
- [ ] Verify VEX candidates are persisted in PostgreSQL for review and approval workflow
- [ ] Verify `DeltaSigVexEmitter` emits VEX statements based on delta signature comparison between versions
- [ ] Verify auto-generated VEX candidates include evidence links back to the SmartDiff analysis that produced them