sprints and audit work

src/Policy/__Libraries/StellaOps.Policy.Determinization/Models/ObservationState.cs

@@ -0,0 +1,44 @@
+namespace StellaOps.Policy.Determinization.Models;
+
+/// <summary>
+/// Observation state for CVE tracking, independent of VEX status.
+/// Allows a CVE to be "Affected" (VEX) but "PendingDeterminization" (observation).
+/// </summary>
+public enum ObservationState
+{
+    /// <summary>
+    /// Initial state: CVE discovered but evidence incomplete.
+    /// Triggers guardrail-based policy evaluation.
+    /// </summary>
+    PendingDeterminization = 0,
+
+    /// <summary>
+    /// Evidence sufficient for confident determination.
+    /// Normal policy evaluation applies.
+    /// </summary>
+    Determined = 1,
+
+    /// <summary>
+    /// Multiple signals conflict (K4 Conflict state).
+    /// Requires human review regardless of confidence.
+    /// </summary>
+    Disputed = 2,
+
+    /// <summary>
+    /// Evidence decayed below threshold; needs refresh.
+    /// Auto-triggered when decay > threshold.
+    /// </summary>
+    StaleRequiresRefresh = 3,
+
+    /// <summary>
+    /// Manually flagged for review.
+    /// Bypasses automatic determinization.
+    /// </summary>
+    ManualReviewRequired = 4,
+
+    /// <summary>
+    /// CVE suppressed/ignored by policy exception.
+    /// Evidence tracking continues but decisions skip.
+    /// </summary>
+    Suppressed = 5
+}