stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
bc4318ef971247e18c9c05f8b7838880f6584dc3
git.stella-ops.org/docs2/signals/uncertainty.md
master bc4318ef97 Add tests for SBOM generation determinism across multiple formats 
- Created `StellaOps.TestKit.Tests` project for unit tests related to determinism.
- Implemented `DeterminismManifestTests` to validate deterministic output for canonical bytes and strings, file read/write operations, and error handling for invalid schema versions.
- Added `SbomDeterminismTests` to ensure identical inputs produce consistent SBOMs across SPDX 3.0.1 and CycloneDX 1.6/1.7 formats, including parallel execution tests.
- Updated project references in `StellaOps.Integration.Determinism` to include the new determinism testing library.
2025-12-23 18:56:12 +02:00

1.7 KiB
Raw Blame History

Uncertainty and entropy

Uncertainty captures missing or untrusted evidence as first-class signals. It prevents silent false negatives and feeds risk scoring and policy gates.

Core states (examples)

  • U1: MissingSymbolResolution
  • U2: MissingPurl
  • U3: UntrustedAdvisory
  • U4: Unknown (no analysis yet)

Tiers and scoring

  • Tiers group states by entropy ranges (T1 high to T4 negligible).
  • Aggregate tier is the maximum tier across states.
  • Risk score adds tier and entropy modifiers.

Tier ranges (example)

  • T1: 0.7 to 1.0, blocks not_affected.
  • T2: 0.4 to 0.69, warns on not_affected.
  • T3: 0.1 to 0.39, allow with caveat.
  • T4: 0.0 to 0.09, no special handling.

Risk score formula (simplified)

  • meanEntropy = avg(states[].entropy)
  • entropyBoost = clamp(meanEntropy * k, 0..boostCeiling)
  • tierModifier = {T1:0.50, T2:0.25, T3:0.10, T4:0.00}[aggregateTier]
  • riskScore = clamp(baseScore * (1 + tierModifier + entropyBoost), 0..1)

Policy guidance

  • High uncertainty blocks not_affected claims.
  • Lower tiers allow decisions with caveats.
  • Remediation hints are attached to findings.

Remediation examples

  • U1: upload symbols or resolve unknowns registry.
  • U2: generate lockfile and resolve package coordinates.
  • U3: cross-reference trusted advisories.
  • U4: run initial analysis to remove unknown state.

Payload fields

  • states[] include code, name, entropy, tier, timestamp, evidence.
  • aggregateTier and riskScore recorded with computedAt timestamp.

Determinism rules

  • Stable ordering of uncertainty states.
  • UTC timestamps and fixed precision for entropy values.
  • Canonical JSON for hashing and replay.

Related references

  • docs/uncertainty/README.md
  • docs/reachability/lattice.md
  • docs/policy/dsl.md