git.stella-ops.org/docs/features/unchecked/policy/exception-recheck-policy-system.md

Exception Recheck Policy System

Module

Policy

Status

IMPLEMENTED

Description

Auto-invalidation policies for exceptions with 9 condition types (EPSS threshold, CVSS threshold, reachability graph change, unknowns budget, new CVE in package, KEV flagging, expiry proximity, VEX status change, package version change). Actions: Warn, RequireReapproval, Revoke, Block. Environment-scoped conditions with per-condition action overrides.

Implementation Details

• RecheckPolicy: src/Policy/__Libraries/StellaOps.Policy.Exceptions/Models/RecheckPolicy.cs (sealed record)
  • PolicyId, Name, Conditions (ImmutableArray<RecheckCondition>), DefaultAction, IsActive, CreatedAt
• RecheckCondition: same file (sealed record)
  • Type (RecheckConditionType), Threshold (decimal?), EnvironmentScope (ImmutableArray<string>), Action (per-condition override, nullable), Description
• RecheckConditionType enum (9 types):
  • ReachGraphChange -- reachability graph changes (new paths discovered)
  • EPSSAbove -- EPSS score exceeds threshold
  • CVSSAbove -- CVSS score exceeds threshold
  • UnknownsAbove -- unknown budget exceeds threshold
  • NewCVEInPackage -- new CVE added to same package
  • KEVFlagged -- KEV flag set
  • ExpiryWithin -- exception nearing expiry (days before)
  • VEXStatusChange -- VEX status changes
  • PackageVersionChange -- package version changes
• RecheckAction enum: Warn (priority 1), RequireReapproval (priority 2), Revoke (priority 3), Block (priority 4)
• RecheckEvaluationService: src/Policy/__Libraries/StellaOps.Policy.Exceptions/Services/RecheckEvaluationService.cs (sealed class implements IRecheckEvaluationService)
  • EvaluateAsync(exception, context) iterates conditions, checks environment scope, evaluates each condition type
  • Returns RecheckEvaluationResult with IsTriggered, TriggeredConditions, RecommendedAction (highest priority among triggered)
  • Environment scoping: condition applies only if EnvironmentScope is empty or contains the evaluation environment
  • Per-condition action override: uses condition.Action if set, otherwise falls back to policy DefaultAction
  • Action priority ordering: Block (4) > Revoke (3) > RequireReapproval (2) > Warn (1)
• RecheckEvaluationResult: sealed record with IsTriggered, TriggeredConditions (ImmutableArray<TriggeredCondition>), RecommendedAction, EvaluatedAt, Summary
• TriggeredCondition: record with Type, Description, CurrentValue, ThresholdValue, Action
• ExceptionObject integration: src/Policy/__Libraries/StellaOps.Policy.Exceptions/Models/ExceptionObject.cs
  • RecheckPolicy? property on ExceptionObject
  • LastRecheckResult? and LastRecheckAt? for tracking last evaluation
  • IsBlockedByRecheck computed property (triggered + Block action)
  • RequiresReapproval computed property (triggered + RequireReapproval action)

E2E Test Plan

• Configure RecheckPolicy with EPSSAbove=0.80 (Block); provide context with EpssScore=0.85; verify IsTriggered=true, RecommendedAction=Block, TriggeredConditions contains EPSSAbove with CurrentValue=0.85 and ThresholdValue=0.80
• Configure RecheckPolicy with CVSSAbove=9.0 (Warn); provide context with CvssScore=8.5; verify IsTriggered=false
• Configure RecheckPolicy with KEVFlagged (Revoke); provide context with KevFlagged=true; verify IsTriggered=true, RecommendedAction=Revoke
• Configure RecheckPolicy with ExpiryWithin=7 days (Warn); exception expires in 5 days; verify triggered with CurrentValue~5 and ThresholdValue=7
• Configure RecheckPolicy with 2 conditions: EPSSAbove=0.50 (Warn) and KEVFlagged (Block); trigger both; verify RecommendedAction=Block (highest priority)
• Configure condition with EnvironmentScope=["prod"]; evaluate in "staging"; verify condition is NOT triggered
• Configure condition with EnvironmentScope=["prod"]; evaluate in "prod"; verify condition IS triggered
• Configure condition with per-condition Action=RequireReapproval overriding policy DefaultAction=Warn; verify triggered condition uses RequireReapproval
• Configure RecheckPolicy with ReachGraphChange condition; provide context with ReachGraphChanged=true; verify triggered
• Configure all 9 condition types; trigger each one individually; verify each produces correct TriggeredCondition type