stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

save checkpoint

Browse Source
This commit is contained in:
master
2026-02-11 01:32:14 +02:00
parent 5593212b41
commit cf5b72974f
2316 changed files with 68799 additions and 3808 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
src/Policy/__Libraries/StellaOps.Policy.Determinization/Scoring/DeltaIfPresentCalculator.cs
View File

@@ -238,38 +238,38 @@ public sealed class DeltaIfPresentCalculator : IDeltaIfPresentCalculator
"VEX" => original with
{
Vex = SignalState<VexClaimSummary>.Queried(
CreateHypotheticalVex(normalizedValue), now)
CreateHypotheticalVex(normalizedValue, now), now)
},
"EPSS" => original with
{
Epss = SignalState<EpssEvidence>.Queried(
CreateHypotheticalEpss(normalizedValue), now)
CreateHypotheticalEpss(normalizedValue, original.Cve, now), now)
},
"REACHABILITY" => original with
{
Reachability = SignalState<ReachabilityEvidence>.Queried(
CreateHypotheticalReachability(normalizedValue), now)
CreateHypotheticalReachability(normalizedValue, now), now)
},
"RUNTIME" => original with
{
Runtime = SignalState<RuntimeEvidence>.Queried(
CreateHypotheticalRuntime(normalizedValue), now)
CreateHypotheticalRuntime(normalizedValue, now), now)
},
"BACKPORT" => original with
{
Backport = SignalState<BackportEvidence>.Queried(
CreateHypotheticalBackport(normalizedValue), now)
CreateHypotheticalBackport(normalizedValue, now), now)
},
"SBOMLINEAGE" or "SBOM" => original with
{
Sbom = SignalState<SbomLineageEvidence>.Queried(
CreateHypotheticalSbom(normalizedValue), now)
CreateHypotheticalSbom(normalizedValue, now), now)
},
_ => original
};
}
private static VexClaimSummary CreateHypotheticalVex(double normalizedValue)
private static VexClaimSummary CreateHypotheticalVex(double normalizedValue, DateTimeOffset now)
{
// Map 0.0-1.0 to VEX status
var status = normalizedValue switch
@@ -283,23 +283,26 @@ public sealed class DeltaIfPresentCalculator : IDeltaIfPresentCalculator
return new VexClaimSummary
{
Status = status,
Source = "hypothetical",
DocumentId = "delta-if-present-simulation",
Timestamp = DateTimeOffset.UtcNow
Confidence = 0.7,
StatementCount = 1,
ComputedAt = now,
Justification = "delta-if-present-simulation"
};
}
private static EpssEvidence CreateHypotheticalEpss(double normalizedValue)
private static EpssEvidence CreateHypotheticalEpss(double normalizedValue, string cve, DateTimeOffset now)
{
return new EpssEvidence
{
Cve = cve,
Epss = normalizedValue,
Percentile = normalizedValue * 100.0,
Date = DateOnly.FromDateTime(DateTime.UtcNow)
Percentile = normalizedValue,
PublishedAt = now,
ModelVersion = "delta-if-present-simulation"
};
}
private static ReachabilityEvidence CreateHypotheticalReachability(double normalizedValue)
private static ReachabilityEvidence CreateHypotheticalReachability(double normalizedValue, DateTimeOffset now)
{
var status = normalizedValue >= 0.5
? ReachabilityStatus.Reachable
@@ -309,38 +312,47 @@ public sealed class DeltaIfPresentCalculator : IDeltaIfPresentCalculator
{
Status = status,
Confidence = 1.0 - Math.Abs(normalizedValue - 0.5) * 2,
PathCount = normalizedValue >= 0.5 ? 1 : 0,
Source = "hypothetical"
Depth = normalizedValue >= 0.5 ? 1 : null,
EntryPoint = normalizedValue >= 0.5 ? "delta-if-present-simulation" : null,
VulnerableFunction = normalizedValue >= 0.5 ? "unknown" : null,
AnalyzedAt = now,
WitnessDigest = "sha256:delta-if-present-simulation"
};
}
private static RuntimeEvidence CreateHypotheticalRuntime(double normalizedValue)
private static RuntimeEvidence CreateHypotheticalRuntime(double normalizedValue, DateTimeOffset now)
{
return new RuntimeEvidence
{
Detected = normalizedValue >= 0.5,
Source = "hypothetical",
Timestamp = DateTimeOffset.UtcNow
ObservationStart = now.AddMinutes(-30),
ObservationEnd = now,
Confidence = 1.0 - Math.Abs(normalizedValue - 0.5)
};
}
private static BackportEvidence CreateHypotheticalBackport(double normalizedValue)
private static BackportEvidence CreateHypotheticalBackport(double normalizedValue, DateTimeOffset now)
{
return new BackportEvidence
{
Detected = normalizedValue < 0.5, // Backport = lower risk
Source = "hypothetical",
Timestamp = DateTimeOffset.UtcNow
DetectedAt = now,
Confidence = 1.0 - Math.Abs(normalizedValue - 0.5)
};
}
private static SbomLineageEvidence CreateHypotheticalSbom(double normalizedValue)
private static SbomLineageEvidence CreateHypotheticalSbom(double normalizedValue, DateTimeOffset now)
{
return new SbomLineageEvidence
{
Present = true,
Depth = (int)(normalizedValue * 5),
Source = "hypothetical"
SbomDigest = "sha256:delta-if-present-simulation",
Format = "CycloneDX",
ComponentCount = Math.Max(1, (int)(normalizedValue * 100.0)),
GeneratedAt = now,
HasProvenance = normalizedValue >= 0.5,
AttestationDigest = "sha256:delta-if-present-attestation"
};
}
}

58
src/Policy/__Libraries/StellaOps.Policy.Determinization/Scoring/K4Lattice.cs Normal file
View File

@@ -0,0 +1,58 @@
namespace StellaOps.Policy.Determinization.Scoring;
/// <summary>
/// Four-valued logic states for deterministic trust aggregation.
/// </summary>
public enum K4Value
{
Unknown = 0,
True = 1,
False = 2,
Conflict = 3
}
/// <summary>
/// Minimal K4 lattice operations needed by determinization scoring.
/// </summary>
public static class K4Lattice
{
public static K4Value Join(K4Value a, K4Value b)
{
if (a == b)
{
return a;
}
if (a == K4Value.Conflict || b == K4Value.Conflict)
{
return K4Value.Conflict;
}
if (a == K4Value.Unknown)
{
return b;
}
if (b == K4Value.Unknown)
{
return a;
}
return K4Value.Conflict;
}
public static K4Value JoinAll(IEnumerable<K4Value> values)
{
var result = K4Value.Unknown;
foreach (var value in values)
{
result = Join(result, value);
if (result == K4Value.Conflict)
{
return result;
}
}
return result;
}
}

36
src/Policy/__Libraries/StellaOps.Policy.Determinization/Scoring/ScorePolicyModels.cs Normal file
View File

@@ -0,0 +1,36 @@
namespace StellaOps.Policy.Determinization.Scoring;
/// <summary>
/// Local score policy model for determinization scoring.
/// Avoids circular dependency on StellaOps.Policy while preserving deterministic defaults.
/// </summary>
public sealed record ScorePolicy
{
public required string PolicyVersion { get; init; }
public required WeightsBps WeightsBps { get; init; }
public static ScorePolicy Default => new()
{
PolicyVersion = "score.v1",
WeightsBps = WeightsBps.Default
};
}
/// <summary>
/// Weight distribution in basis points. Must sum to 10000.
/// </summary>
public sealed record WeightsBps
{
public required int BaseSeverity { get; init; }
public required int Reachability { get; init; }
public required int Evidence { get; init; }
public required int Provenance { get; init; }
public static WeightsBps Default => new()
{
BaseSeverity = 1000,
Reachability = 4500,
Evidence = 3000,
Provenance = 1500
};
}

2
src/Policy/__Libraries/StellaOps.Policy.Determinization/Scoring/ScoreV1Predicate.cs
View File

@@ -1,7 +1,5 @@
using StellaOps.Policy.Determinization.Evidence;
using StellaOps.Policy.Determinization.Models;
using StellaOps.Policy.Scoring;
using StellaOps.Policy.TrustLattice;
namespace StellaOps.Policy.Determinization.Scoring;

4
src/Policy/__Libraries/StellaOps.Policy.Determinization/Scoring/TrustScoreAlgebraFacade.cs
View File

@@ -1,8 +1,6 @@
using Microsoft.Extensions.Logging;
using StellaOps.Policy.Determinization.Evidence;
using StellaOps.Policy.Determinization.Models;
using StellaOps.Policy.Scoring;
using StellaOps.Policy.TrustLattice;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json;
@@ -176,7 +174,7 @@ public sealed class TrustScoreAlgebraFacade : ITrustScoreAlgebraFacade
{
ReachabilityStatus.Reachable => K4Value.True,
ReachabilityStatus.Unreachable => K4Value.False,
ReachabilityStatus.Unknown => K4Value.Unknown,
ReachabilityStatus.Indeterminate => K4Value.Unknown,
_ => K4Value.Unknown
});
}

4
src/Policy/__Libraries/StellaOps.Policy.Determinization/StellaOps.Policy.Determinization.csproj
View File

@@ -8,6 +8,10 @@
<LangVersion>preview</LangVersion>
</PropertyGroup>
<ItemGroup>
<InternalsVisibleTo Include="StellaOps.Policy.Determinization.Tests" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" />
<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />

6
src/Policy/__Tests/StellaOps.Policy.Determinization.Tests/Scoring/CombinedImpactCalculatorTests.cs
View File

@@ -187,11 +187,11 @@ public class CombinedImpactCalculatorTests
Reachability = SignalState<ReachabilityEvidence>.Queried(
new ReachabilityEvidence { Status = ReachabilityStatus.Reachable, AnalyzedAt = now }, now),
Runtime = SignalState<RuntimeEvidence>.Queried(
new RuntimeEvidence { Detected = true, DetectedAt = now }, now),
new RuntimeEvidence { Detected = true, Source = "tracer", ObservationStart = now.AddHours(-1), ObservationEnd = now, Confidence = 0.9 }, now),
Backport = SignalState<BackportEvidence>.Queried(
new BackportEvidence { Detected = false, AnalyzedAt = now }, now),
new BackportEvidence { Detected = false, Source = "vendor-advisory", DetectedAt = now, Confidence = 0.8 }, now),
Sbom = SignalState<SbomLineageEvidence>.Queried(
new SbomLineageEvidence { HasLineage = true, AnalyzedAt = now }, now),
new SbomLineageEvidence { SbomDigest = "sha256:abc", Format = "CycloneDX", ComponentCount = 50, GeneratedAt = now, HasProvenance = true }, now),
Cvss = SignalState<CvssEvidence>.Queried(
new CvssEvidence { Version = "3.1", BaseScore = 9.8, Severity = "CRITICAL", Source = "NVD", PublishedAt = now }, now),
SnapshotAt = now

2
src/Policy/__Tests/StellaOps.Policy.Determinization.Tests/Scoring/DeltaIfPresentCalculatorTests.cs
View File

@@ -123,7 +123,7 @@ public sealed class DeltaIfPresentCalculatorTests
gap.BestCase.AssumedValue.Should().Be(0.0);
gap.WorstCase.AssumedValue.Should().Be(1.0);
gap.MaxImpact.Should().BeGreaterOrEqualTo(0.0);
gap.MaxImpact.Should().BeGreaterThanOrEqualTo(0.0);
}
}

113
src/Policy/__Tests/StellaOps.Policy.Determinization.Tests/Scoring/TrustScoreAlgebraFacadeTests.cs
View File

@@ -4,8 +4,6 @@ using Microsoft.Extensions.Time.Testing;
using StellaOps.Policy.Determinization.Evidence;
using StellaOps.Policy.Determinization.Models;
using StellaOps.Policy.Determinization.Scoring;
using StellaOps.Policy.Scoring;
using StellaOps.Policy.TrustLattice;
namespace StellaOps.Policy.Determinization.Tests.Scoring;
@@ -20,7 +18,7 @@ public sealed class TrustScoreAlgebraFacadeTests
private TrustScoreAlgebraFacade CreateFacade()
{
var aggregator = new TrustScoreAggregator(NullLogger<TrustScoreAggregator>.Instance);
var uncertaintyCalculator = new UncertaintyScoreCalculator();
var uncertaintyCalculator = new UncertaintyScoreCalculator(NullLogger<UncertaintyScoreCalculator>.Instance);
return new TrustScoreAlgebraFacade(
aggregator,
uncertaintyCalculator,
@@ -61,10 +59,22 @@ public sealed class TrustScoreAlgebraFacadeTests
var signals = SignalSnapshot.Empty("CVE-2024-1234", "pkg:maven/test@1.0", _timeProvider.GetUtcNow())
with
{
Reachability = SignalState<ReachabilityEvidence>.Present(
new ReachabilityEvidence(ReachabilityStatus.Reachable, 0, 0, null)),
Vex = SignalState<VexClaimSummary>.Present(
new VexClaimSummary("affected", null, null, null, null, null))
Reachability = SignalState<ReachabilityEvidence>.Queried(
new ReachabilityEvidence
{
Status = ReachabilityStatus.Reachable,
Depth = 0,
AnalyzedAt = _timeProvider.GetUtcNow(),
Confidence = 1.0
}, _timeProvider.GetUtcNow()),
Vex = SignalState<VexClaimSummary>.Queried(
new VexClaimSummary
{
Status = "affected",
Confidence = 1.0,
StatementCount = 1,
ComputedAt = _timeProvider.GetUtcNow()
}, _timeProvider.GetUtcNow())
};
var request = new TrustScoreRequest
@@ -91,10 +101,22 @@ public sealed class TrustScoreAlgebraFacadeTests
var signals = SignalSnapshot.Empty("CVE-2024-1234", "pkg:maven/test@1.0", _timeProvider.GetUtcNow())
with
{
Reachability = SignalState<ReachabilityEvidence>.Present(
new ReachabilityEvidence(ReachabilityStatus.Unreachable, 0, 0, null)),
Vex = SignalState<VexClaimSummary>.Present(
new VexClaimSummary("affected", null, null, null, null, null))
Reachability = SignalState<ReachabilityEvidence>.Queried(
new ReachabilityEvidence
{
Status = ReachabilityStatus.Unreachable,
Depth = 0,
AnalyzedAt = _timeProvider.GetUtcNow(),
Confidence = 1.0
}, _timeProvider.GetUtcNow()),
Vex = SignalState<VexClaimSummary>.Queried(
new VexClaimSummary
{
Status = "affected",
Confidence = 1.0,
StatementCount = 1,
ComputedAt = _timeProvider.GetUtcNow()
}, _timeProvider.GetUtcNow())
};
var request = new TrustScoreRequest
@@ -124,10 +146,22 @@ public sealed class TrustScoreAlgebraFacadeTests
var signals = SignalSnapshot.Empty("CVE-2024-1234", "pkg:maven/test@1.0", _timeProvider.GetUtcNow())
with
{
Vex = SignalState<VexClaimSummary>.Present(
new VexClaimSummary("not_affected", null, null, null, null, null)),
Epss = SignalState<EpssEvidence>.Present(
new EpssEvidence(0.85, 0.95)) // High EPSS = True in K4
Vex = SignalState<VexClaimSummary>.Queried(
new VexClaimSummary
{
Status = "not_affected",
Confidence = 1.0,
StatementCount = 1,
ComputedAt = _timeProvider.GetUtcNow()
}, _timeProvider.GetUtcNow()),
Epss = SignalState<EpssEvidence>.Queried(
new EpssEvidence
{
Cve = "CVE-2024-1234",
Epss = 0.85,
Percentile = 0.95,
PublishedAt = _timeProvider.GetUtcNow()
}, _timeProvider.GetUtcNow()) // High EPSS = True in K4
};
var request = new TrustScoreRequest
@@ -153,12 +187,30 @@ public sealed class TrustScoreAlgebraFacadeTests
var signals = SignalSnapshot.Empty("CVE-2024-1234", "pkg:maven/test@1.0", _timeProvider.GetUtcNow())
with
{
Vex = SignalState<VexClaimSummary>.Present(
new VexClaimSummary("affected", null, null, null, null, null)),
Reachability = SignalState<ReachabilityEvidence>.Present(
new ReachabilityEvidence(ReachabilityStatus.Reachable, 0, 0, null)),
Epss = SignalState<EpssEvidence>.Present(
new EpssEvidence(0.75, 0.90))
Vex = SignalState<VexClaimSummary>.Queried(
new VexClaimSummary
{
Status = "affected",
Confidence = 1.0,
StatementCount = 1,
ComputedAt = _timeProvider.GetUtcNow()
}, _timeProvider.GetUtcNow()),
Reachability = SignalState<ReachabilityEvidence>.Queried(
new ReachabilityEvidence
{
Status = ReachabilityStatus.Reachable,
Depth = 0,
AnalyzedAt = _timeProvider.GetUtcNow(),
Confidence = 1.0
}, _timeProvider.GetUtcNow()),
Epss = SignalState<EpssEvidence>.Queried(
new EpssEvidence
{
Cve = "CVE-2024-1234",
Epss = 0.75,
Percentile = 0.90,
PublishedAt = _timeProvider.GetUtcNow()
}, _timeProvider.GetUtcNow())
};
var request = new TrustScoreRequest
@@ -308,9 +360,22 @@ public sealed class TrustScoreAlgebraFacadeTests
var signals = SignalSnapshot.Empty("CVE-2024-1234", "pkg:maven/test@1.0", _timeProvider.GetUtcNow())
with
{
Epss = SignalState<EpssEvidence>.Present(new EpssEvidence(0.35, 0.65)),
Reachability = SignalState<ReachabilityEvidence>.Present(
new ReachabilityEvidence(ReachabilityStatus.Reachable, 2, 5, null))
Epss = SignalState<EpssEvidence>.Queried(
new EpssEvidence
{
Cve = "CVE-2024-1234",
Epss = 0.35,
Percentile = 0.65,
PublishedAt = _timeProvider.GetUtcNow()
}, _timeProvider.GetUtcNow()),
Reachability = SignalState<ReachabilityEvidence>.Queried(
new ReachabilityEvidence
{
Status = ReachabilityStatus.Reachable,
Depth = 2,
AnalyzedAt = _timeProvider.GetUtcNow(),
Confidence = 1.0
}, _timeProvider.GetUtcNow())
};
var request = new TrustScoreRequest

18
src/Policy/__Tests/StellaOps.Policy.Determinization.Tests/Scoring/WeightManifest/WeightManifestLoaderTests.cs
View File

@@ -327,7 +327,7 @@ public sealed class WeightManifestLoaderTests : IDisposable
[Fact]
public void Diff_DifferentVersions_ShowsDifference()
{
var from = new WeightManifestDocument
var fromManifest = new WeightManifestDocument
{
SchemaVersion = "1.0.0",
Version = "v1",
@@ -336,9 +336,9 @@ public sealed class WeightManifestLoaderTests : IDisposable
Weights = new WeightManifestWeights()
};
var to = from with { Version = "v2" };
var to = fromManifest with { Version = "v2" };
var diff = _loader.Diff(from, to);
var diff = _loader.Diff(fromManifest, to);
Assert.True(diff.HasDifferences);
Assert.Contains(diff.Differences, d => d.Path == "version" && d.OldValue == "v1" && d.NewValue == "v2");
@@ -347,7 +347,7 @@ public sealed class WeightManifestLoaderTests : IDisposable
[Fact]
public void Diff_DifferentWeights_ShowsDifferences()
{
var from = new WeightManifestDocument
var fromManifest = new WeightManifestDocument
{
SchemaVersion = "1.0.0",
Version = "v1",
@@ -360,7 +360,7 @@ public sealed class WeightManifestLoaderTests : IDisposable
}
};
var to = from with
var to = fromManifest with
{
Version = "v2",
Weights = new WeightManifestWeights
@@ -370,7 +370,7 @@ public sealed class WeightManifestLoaderTests : IDisposable
}
};
var diff = _loader.Diff(from, to);
var diff = _loader.Diff(fromManifest, to);
Assert.True(diff.HasDifferences);
Assert.Contains(diff.Differences, d => d.Path == "weights.legacy.rch");
@@ -381,7 +381,7 @@ public sealed class WeightManifestLoaderTests : IDisposable
[Fact]
public void Diff_AddedWeight_ShowsAsNewField()
{
var from = new WeightManifestDocument
var fromManifest = new WeightManifestDocument
{
SchemaVersion = "1.0.0",
Version = "v1",
@@ -394,7 +394,7 @@ public sealed class WeightManifestLoaderTests : IDisposable
}
};
var to = from with
var to = fromManifest with
{
Version = "v2",
Weights = new WeightManifestWeights
@@ -406,7 +406,7 @@ public sealed class WeightManifestLoaderTests : IDisposable
}
};
var diff = _loader.Diff(from, to);
var diff = _loader.Diff(fromManifest, to);
Assert.True(diff.HasDifferences);
var mitDiff = diff.Differences.First(d => d.Path == "weights.legacy.mit");