stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

save checkpoint

Browse Source
This commit is contained in:
master
2026-02-14 09:11:48 +02:00
parent 9ca2de05df
commit e9aeadc040
1512 changed files with 30863 additions and 4728 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
docs/features/checked/scanner/quiet-scans-validation.md Normal file
View File

@@ -0,0 +1,39 @@
# Quiet Scans Validation (Reachability + VEX + Dedup)
## Module
Scanner
## Status
VERIFIED
## Description
Reachability gates and VEX candidate emission are tested and integrated into the SmartDiff pipeline for quieter scan results.
## Implementation Details
- **Reachability Gate Bridge**:
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/ReachabilityGateBridge.cs` - `ReachabilityGateBridge` integrates reachability gate verdicts into the SmartDiff pipeline to suppress unreachable findings
- **VEX Candidate Emission**:
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexCandidateEmitter.cs` - `VexCandidateEmitter` generates VEX candidates for findings that can be auto-resolved
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexCandidateModels.cs` - Models for VEX candidate data
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexEvidence.cs` - VEX evidence supporting auto-resolution decisions
- **SmartDiff Pipeline**:
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/SmartDiffPredicate.cs` - `SmartDiffPredicate` applies reachability and VEX filters for quieter results
- `src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/Repositories.cs` - Repository interfaces for SmartDiff detection data
## E2E Test Plan
- [ ] Scan an image with vulnerabilities in unreachable code paths and verify findings are suppressed by reachability gates
- [ ] Verify VEX candidate emission generates auto-resolution candidates for backported patches
- [ ] Verify the SmartDiff pipeline deduplicates findings that appear in both old and new scan results
- [ ] Verify the combination of reachability gates + VEX candidates + deduplication produces significantly fewer actionable findings
- [ ] Verify suppressed findings are still accessible with their suppression reason when queried explicitly
---
## Verification
| Check | Result |
|-------|--------|
| Tier 0 - Source files exist | PASS |
| Tier 1 - Build + code review | PASS |
| Tier 2 - Integration tests | PASS |
| Verified | 2026-02-13T18:10:00Z |