stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
cf5b72974f923126944f4dcd47e85864ebb31a3b
git.stella-ops.org/docs/features/unchecked/excititor/vex-handling-with-formal-reasoning.md

2.3 KiB
Raw Blame History

VEX Handling with Formal Reasoning (Lattice-Based Merge)

Module

Excititor

Status

IMPLEMENTED

Description

VEX handling with a K4 trust lattice engine for deterministic merging of vendor/distro/internal VEX claims, claim score merging, conflict penalization, and disposition selection via policy-driven rules.

Implementation Details

  • Modules: src/Excititor/__Libraries/StellaOps.Excititor.Core/Lattice/, src/Excititor/__Libraries/StellaOps.Excititor.Core/TrustVector/
  • Key Classes:
    • ClaimScoreMerger (src/Excititor/__Libraries/StellaOps.Excititor.Core/Lattice/ClaimScoreMerger.cs) - merges claim scores using lattice algebra with conflict penalization
    • PolicyLatticeAdapter (src/Excititor/__Libraries/StellaOps.Excititor.Core/Lattice/PolicyLatticeAdapter.cs) - adapts K4 policy lattice for VEX claim merge
    • TrustWeightRegistry (src/Excititor/__Libraries/StellaOps.Excititor.Core/Lattice/TrustWeightRegistry.cs) - registry of per-source trust weights
    • ClaimScoreCalculator (src/Excititor/__Libraries/StellaOps.Excititor.Core/TrustVector/ClaimScoreCalculator.cs) - calculates claim scores from trust vectors
    • ClaimStrength (src/Excititor/__Libraries/StellaOps.Excititor.Core/TrustVector/ClaimStrength.cs) - claim strength model
    • VexScoreEnvelope (src/Excititor/__Libraries/StellaOps.Excititor.Core/VexScoreEnvelope.cs) - envelope wrapping scored VEX claims
    • VexConsensusResolver (src/Excititor/__Libraries/StellaOps.Excititor.Core/VexConsensusResolver.cs) - resolves consensus using lattice rules
  • Interfaces: IVexLatticeProvider, IVexConsensusPolicy
  • Source: Feature matrix scan

E2E Test Plan

  • Submit multiple VEX claims for the same vulnerability and verify ClaimScoreMerger produces a deterministic merged score using lattice algebra
  • Verify conflict penalization: conflicting claims (affected vs not_affected) reduce the merged score
  • Verify PolicyLatticeAdapter applies K4 lattice rules for disposition selection (top > bottom in lattice ordering)
  • Verify TrustWeightRegistry applies different weights to vendor, distro, and internal sources
  • Verify ClaimScoreCalculator computes scores from multi-dimensional trust vectors
  • Verify the merged result is monotonic: adding more evidence can only increase confidence, not decrease it