stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
6be4a25d178319a8f79ecea48434cff0174482d3
git.stella-ops.org/docs/features/checked/scanner/quiet-scans-validation.md
master e9aeadc040 save checkpoint
2026-02-14 09:11:48 +02:00

2.0 KiB
Raw Blame History

Quiet Scans Validation (Reachability + VEX + Dedup)

Module

Scanner

Status

VERIFIED

Description

Reachability gates and VEX candidate emission are tested and integrated into the SmartDiff pipeline for quieter scan results.

Implementation Details

  • Reachability Gate Bridge:
    • src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/ReachabilityGateBridge.cs - ReachabilityGateBridge integrates reachability gate verdicts into the SmartDiff pipeline to suppress unreachable findings
  • VEX Candidate Emission:
    • src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexCandidateEmitter.cs - VexCandidateEmitter generates VEX candidates for findings that can be auto-resolved
    • src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexCandidateModels.cs - Models for VEX candidate data
    • src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/VexEvidence.cs - VEX evidence supporting auto-resolution decisions
  • SmartDiff Pipeline:
    • src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/SmartDiffPredicate.cs - SmartDiffPredicate applies reachability and VEX filters for quieter results
    • src/Scanner/__Libraries/StellaOps.Scanner.SmartDiff/Detection/Repositories.cs - Repository interfaces for SmartDiff detection data

E2E Test Plan

  • Scan an image with vulnerabilities in unreachable code paths and verify findings are suppressed by reachability gates
  • Verify VEX candidate emission generates auto-resolution candidates for backported patches
  • Verify the SmartDiff pipeline deduplicates findings that appear in both old and new scan results
  • Verify the combination of reachability gates + VEX candidates + deduplication produces significantly fewer actionable findings
  • Verify suppressed findings are still accessible with their suppression reason when queried explicitly

Verification

Check Result
Tier 0 - Source files exist PASS
Tier 1 - Build + code review PASS
Tier 2 - Integration tests PASS
Verified 2026-02-13T18:10:00Z