feat: add security sink detection patterns for JavaScript/TypeScript

- Introduced `sink-detect.js` with various security sink detection patterns categorized by type (e.g., command injection, SQL injection, file operations). - Implemented functions to build a lookup map for fast sink detection and to match sink calls against known patterns. - Added `package-lock.json` for dependency management.
2025-12-22 23:21:21 +02:00
parent 3ba7157b00
commit 5146204f1b
529 changed files with 73579 additions and 5985 deletions
--- a/docs/modules/policy/architecture.md
+++ b/docs/modules/policy/architecture.md
@@ -203,6 +203,150 @@ Determinism guard instrumentation wraps the evaluator, rejecting access to forbi

 All payloads are immutable and include analyzer fingerprints (`scanner.native@sha256:...`, `policyEngine@sha256:...`) so replay tooling can recompute identical digests. Determinism tests cover both the OpenVEX JSON and the DSSE payload bytes.

+
+---
+
+### 6.2 · Trust Lattice Policy Gates
+
+The Policy Engine evaluates Trust Lattice gates after claim score merging to enforce trust-based constraints on VEX verdicts.
+
+#### Gate Interface
+
+```csharp
+public interface IPolicyGate
+{
+    Task<GateResult> EvaluateAsync(
+        MergeResult mergeResult,
+        PolicyGateContext context,
+        CancellationToken ct = default);
+}
+
+public sealed record GateResult
+{
+    public required string GateName { get; init; }
+    public required bool Passed { get; init; }
+    public string? Reason { get; init; }
+    public ImmutableDictionary<string, object> Details { get; init; }
+}
+```
+
+#### Available Gates
+
+| Gate | Purpose | Configuration Key |
+|------|---------|-------------------|
+| **MinimumConfidenceGate** | Reject verdicts below confidence threshold per environment | `gates.minimumConfidence` |
+| **UnknownsBudgetGate** | Fail scan if unknowns exceed budget | `gates.unknownsBudget` |
+| **SourceQuotaGate** | Prevent single-source dominance without corroboration | `gates.sourceQuota` |
+| **ReachabilityRequirementGate** | Require reachability proof for critical CVEs | `gates.reachabilityRequirement` |
+| **EvidenceFreshnessGate** | Reject stale evidence below freshness threshold | `gates.evidenceFreshness` |
+
+#### MinimumConfidenceGate
+
+Requires minimum confidence threshold for suppression verdicts:
+
+```yaml
+gates:
+  minimumConfidence:
+    enabled: true
+    thresholds:
+      production: 0.75    # High bar for production
+      staging: 0.60       # Moderate for staging
+      development: 0.40   # Permissive for dev
+    applyToStatuses:
+      - not_affected
+      - fixed
+```
+
+- **Behavior**: `affected` status bypasses this gate (conservative default).
+- **Result**: `confidence_below_threshold` when verdict confidence < environment threshold.
+
+#### UnknownsBudgetGate
+
+Limits exposure to unknown/unscored dependencies:
+
+```yaml
+gates:
+  unknownsBudget:
+    enabled: true
+    maxUnknownCount: 5
+    maxCumulativeUncertainty: 2.0
+    escalateOnExceed: true
+```
+
+- **Behavior**: Fails when unknowns exceed count limit OR cumulative uncertainty exceeds budget.
+- **Cumulative uncertainty**: `sum(1 - ClaimScore)` across all verdicts.
+
+#### SourceQuotaGate
+
+Prevents single-source verdicts without corroboration:
+
+```yaml
+gates:
+  sourceQuota:
+    enabled: true
+    maxInfluencePercent: 60
+    corroborationDelta: 0.10
+    requireCorroboration: true
+```
+
+- **Behavior**: Fails when single source provides > 60% of verdict weight AND no second source is within delta (0.10).
+- **Rationale**: Ensures critical decisions have multi-source validation.
+
+#### ReachabilityRequirementGate
+
+Requires reachability proof for high-severity vulnerabilities:
+
+```yaml
+gates:
+  reachabilityRequirement:
+    enabled: true
+    applySeverities:
+      - critical
+      - high
+    exemptStatuses:
+      - not_affected
+    bypassReasons:
+      - component_not_present
+```
+
+- **Behavior**: Fails when CRITICAL/HIGH CVE marked `not_affected` lacks reachability proof (unless bypass reason applies).
+
+#### Gate Registry
+
+Gates are registered via DI and evaluated in sequence:
+
+```csharp
+public interface IPolicyGateRegistry
+{
+    IEnumerable<IPolicyGate> GetEnabledGates(string environment);
+    Task<GateEvaluationResult> EvaluateAllAsync(
+        MergeResult mergeResult,
+        PolicyGateContext context,
+        CancellationToken ct = default);
+}
+```
+
+#### Gate Metrics
+
+- `policy_gate_evaluations_total{gate,result}` — Count of gate evaluations by outcome
+- `policy_gate_failures_total{gate,reason}` — Count of gate failures by reason
+- `policy_gate_latency_seconds{gate}` — Gate evaluation latency histogram
+
+#### Gate Implementation Reference
+
+| Gate | Source File |
+|------|-------------|
+| MinimumConfidenceGate | `src/Policy/__Libraries/StellaOps.Policy/Gates/MinimumConfidenceGate.cs` |
+| UnknownsBudgetGate | `src/Policy/__Libraries/StellaOps.Policy/Gates/UnknownsBudgetGate.cs` |
+| SourceQuotaGate | `src/Policy/__Libraries/StellaOps.Policy/Gates/SourceQuotaGate.cs` |
+| ReachabilityRequirementGate | `src/Policy/__Libraries/StellaOps.Policy/Gates/ReachabilityRequirementGate.cs` |
+| EvidenceFreshnessGate | `src/Policy/__Libraries/StellaOps.Policy/Gates/EvidenceFreshnessGate.cs` |
+
+See `etc/policy-gates.yaml.sample` for complete gate configuration options.
+
+**Related Documentation:**
+- [Trust Lattice Specification](../excititor/trust-lattice.md)
+- [Verdict Manifest Specification](../authority/verdict-manifest.md)
 ---

 ## 7 · Security & Tenancy