From 5d401f9ce0a125079258fd45f4962c91d1b1feed Mon Sep 17 00:00:00 2001 From: ggn Date: Wed, 14 Oct 2026 17:09:42 -0400 Subject: [PATCH] test(routing): add 302-case legacy parity baseline Import the 302 SDK fixture cases into Traust and verify them against the checked-out legacy Python worklist code, so subsequent extraction can expose behavior changes by case name. - Preserve both SDK JSON fixtures byte for byte (93 table, 20 risk-tier, 30 event-lane and 159 primary-selection cases) - Execute legacy functions/constants using the original generators' adapter approach - Verify fixture checksums/counts and compare all 302 cases against the current legacy code - Mutation check proves a changed churn threshold is detected XWING-2216 Co-authored-by: Cursor --- tests/fixtures/routing/README.md | 84 ++++++++ tests/fixtures/routing/baseline.json | 21 ++ tests/fixtures/routing/python_decisions.json | 120 +++++++++++ tests/fixtures/routing/python_primary.json | 196 ++++++++++++++++++ tests/routing_reference.py | 200 +++++++++++++++++++ tests/test_route_parity.py | 112 +++++++++++ 6 files changed, 733 insertions(+) create mode 100644 tests/fixtures/routing/README.md create mode 100644 tests/fixtures/routing/baseline.json create mode 100644 tests/fixtures/routing/python_decisions.json create mode 100644 tests/fixtures/routing/python_primary.json create mode 100644 tests/routing_reference.py create mode 100644 tests/test_route_parity.py diff --git a/tests/fixtures/routing/README.md b/tests/fixtures/routing/README.md new file mode 100644 index 0000000..e403385 --- /dev/null +++ b/tests/fixtures/routing/README.md @@ -0,0 +1,84 @@ +# Work-routing parity baseline + +This is the legacy-baseline portion of +[XWING-2216](https://redhat.atlassian.net/browse/XWING-2216). It runs **302 named +cases against the checked-out Python worklist code**. It does not yet compare +the new `Router.route()` implementation with the legacy behavior. + +## Run + +From the repository root, after the normal `uv sync --locked` setup: + +```bash +uv run --no-sync pytest -q tests/test_route_parity.py +``` + +Tests need no sibling SDK checkout, Git history, network, external command, or +production data. The primary adapter writes temporary JSONL events and a minimal +SQLite inventory graph. Network connections and subprocesses are blocked during +the test cases. The repository's normal `tests/conftest.py` setup still applies. + +## What is preserved + +- `python_decisions.json`: 93 decision-table and 20 risk-tier cases. +- `python_primary.json`: 30 event-lane and 159 primary-selection cases, including + event precedence, consumed/unknown events, status handling, multiple decisions, + original event indexes and never-audited inventory bootstrap. + +Both files are copied byte for byte from the SDK. Their original `source` blocks +identify the Python revision and whole-file SHA-256 used to generate them; +**they have not been relabeled as outputs generated from current main**. +[baseline.json](baseline.json) records the SDK export revision, fixture checksums +and counts, plus the legacy source revision reviewed when this baseline was added. + +That reviewed source differs from the original fixture snapshot in two +threat-model reason strings (`--apply-ratings`). These cases disable threat-model +companions; all 302 expectations remain unchanged. The test adapter is derived +from `generate.py` and `generate_primary.py` in the SDK directory recorded in +the manifest. It compiles the actual checked-out legacy functions/constants and +the original `main()` block from `event_rows` up to `cc_urls`. It does not +reimplement the decision table or regenerate expected answers during tests. + +The fixture keys retain their existing SDK spelling for provenance, not as a +proposed Python API. URLs are already canonical; URL normalization is an identity +stub, and the clock is fixed to the original generator's date. IaC/threat-model +companions, fleet ordering, tripwire/refusal handling, budgets, live collectors, +scheduling and dispatch are outside this corpus. It is not full-worklist parity. + +## Reviewing drift + +The tests check fixture bytes/counts against the manifest and execute the +checked-out legacy code against all 302 saved cases. There is no source checksum +gate: unrelated edits to the monolith do not require a baseline update. The +`reviewed_legacy.revision` is historical provenance, not a required checkout. + +The threshold-mutation test demonstrates that changing `CHURN_FULL_LINES` from +8000 to 9000 disagrees with `churn-lines-8000` through the decision comparison +itself. Fixture checksums separately protect the saved expectations. The cases +cover the behaviors described above; they cannot detect every possible policy +change, so normal source review remains necessary. + +1. For a named case failure, review the source and behavior diff. Do not + regenerate expectations just to make the failure disappear. +2. For an unrelated source change, keep the fixtures and baseline manifest + unchanged. If extraction moves the adapter's required definitions or block + boundaries, update the adapter while preserving the cases. +3. For an intentional policy change, review the changed inputs/outputs and extend + coverage as needed. Generate from an explicitly pinned source and update its + provenance, fixture checksums/counts and reviewed-source record together. The + original generators can be retrieved from the SDK export revision in the + manifest. Merely updating a fixture checksum cannot hide a behavior mismatch: + the individual comparisons still run against the saved expectations. + +## Remaining work for XWING-2216 + +- Add the new-router side after the implementation in XWING-2215 is available. +- Agree how to map this corpus to the new interface: the current core `Route` + has lane, priority and reason, while these fixtures also record rule IDs, + risk helpers, bootstrap, and potentially several event decisions per input. + Do not drop fields/cases or invent a `Route.rule` to force a comparison. +- Keep failures named by case, and demonstrate old/new comparisons run offline + within the ticket's five-second target. + +There is no placeholder or skipped new-router test: a green run currently proves +only that the exported baseline matches the legacy decision paths above. diff --git a/tests/fixtures/routing/baseline.json b/tests/fixtures/routing/baseline.json new file mode 100644 index 0000000..f7ff566 --- /dev/null +++ b/tests/fixtures/routing/baseline.json @@ -0,0 +1,21 @@ +{ + "exported_from": { + "repo": "traust-security/traust-sdk", + "revision": "fd20c6a37b0ed9ecffa233d4c6773a75477a7aa5", + "path": "go/v1/routing/work/testdata" + }, + "reviewed_legacy": { + "revision": "2ad90c14300df343a790182d837b43ebc5263162", + "note": "Compared with the source revision preserved in the fixtures: only two threat-model reason strings add --apply-ratings. Threat-model companions are disabled in this corpus. All 302 inputs and expected outputs remain unchanged." + }, + "fixtures": { + "python_decisions.json": { + "sha256": "e57362322bbddd0d18d890c41c5f38551e389d6e2353be63429e7780afee11d7", + "counts": {"table": 93, "risk": 20} + }, + "python_primary.json": { + "sha256": "5c2299ae8ff21900f4c5abfa52aa48cfc9fc87f0a6d79bdf74e43a3747c82328", + "counts": {"event_lanes": 30, "primary": 159} + } + } +} diff --git a/tests/fixtures/routing/python_decisions.json b/tests/fixtures/routing/python_decisions.json new file mode 100644 index 0000000..ea71830 --- /dev/null +++ b/tests/fixtures/routing/python_decisions.json @@ -0,0 +1,120 @@ +{ + "source": {"repo": "traust-security/traust", "revision": "0f95c95f48d36509b70234d18b500c0b738e23e8", "path": "src/traust/cli/build_rescan_worklist.py", "sha256": "3e4a34ead553f1ddafacb658336fdf6c579054ee9339b003ae4eab3e848a3525"}, + "table": [ + {"name": "churn-lines-0", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "churn-lines-1", "input": {"tier": "P1", "exposure": "", "C": 1, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "churn-lines-7999", "input": {"tier": "P1", "exposure": "", "C": 7999, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "churn-lines-8000", "input": {"tier": "P1", "exposure": "", "C": 8000, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)"}}, + {"name": "churn-lines-8001", "input": {"tier": "P1", "exposure": "", "C": 8001, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)"}}, + {"name": "churn-ratio-None", "input": {"tier": "P1", "exposure": "", "C": 500, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "churn-ratio-0", "input": {"tier": "P1", "exposure": "", "C": 500, "R": 0, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "churn-ratio-0.099", "input": {"tier": "P1", "exposure": "", "C": 500, "R": 0.099, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "churn-ratio-0.1", "input": {"tier": "P1", "exposure": "", "C": 500, "R": 0.1, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)"}}, + {"name": "churn-ratio-0.101", "input": {"tier": "P1", "exposure": "", "C": 500, "R": 0.101, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)"}}, + {"name": "churn-ratio-1.2", "input": {"tier": "P1", "exposure": "", "C": 500, "R": 1.2, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)"}}, + {"name": "sensitive-P0-199", "input": {"tier": "P0", "exposure": "", "C": 500, "R": null, "S": true, "S_lines": 199, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "sensitive-P0-200", "input": {"tier": "P0", "exposure": "", "C": 500, "R": null, "S": true, "S_lines": 200, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-3", "Lane": "full-audit", "Reason": "rule-3: sensitive-identifier files changed, >=200 lines"}}, + {"name": "sensitive-P1-199", "input": {"tier": "P1", "exposure": "", "C": 500, "R": null, "S": true, "S_lines": 199, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "sensitive-P1-200", "input": {"tier": "P1", "exposure": "", "C": 500, "R": null, "S": true, "S_lines": 200, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-3", "Lane": "full-audit", "Reason": "rule-3: sensitive-identifier files changed, >=200 lines"}}, + {"name": "sensitive-P2-199", "input": {"tier": "P2", "exposure": "", "C": 500, "R": null, "S": true, "S_lines": 199, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "sensitive-P2-200", "input": {"tier": "P2", "exposure": "", "C": 500, "R": null, "S": true, "S_lines": 200, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-3", "Lane": "diff-scan", "Reason": "rule-3: sensitive-identifier files changed, >=200 lines"}}, + {"name": "sensitive-P3-199", "input": {"tier": "P3", "exposure": "", "C": 500, "R": null, "S": true, "S_lines": 199, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "sensitive-P3-200", "input": {"tier": "P3", "exposure": "", "C": 500, "R": null, "S": true, "S_lines": 200, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-3", "Lane": "diff-scan", "Reason": "rule-3: sensitive-identifier files changed, >=200 lines"}}, + {"name": "sensitive-flag-false", "input": {"tier": "P1", "exposure": "", "C": 500, "R": null, "S": false, "S_lines": 500, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "dependencies-only", "input": {"tier": "P1", "exposure": "", "C": 50, "R": null, "S": false, "S_lines": 0, "deps_only": true, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-3b", "Lane": "deps-lane", "Reason": "rule-3b: dependency manifests only (deterministic osv/impact lane)"}}, + {"name": "churn-before-sensitive", "input": {"tier": "P1", "exposure": "", "C": 9000, "R": null, "S": true, "S_lines": 300, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)"}}, + {"name": "churn-before-dependencies", "input": {"tier": "P1", "exposure": "", "C": 9000, "R": null, "S": false, "S_lines": 0, "deps_only": true, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)"}}, + {"name": "sensitive-before-dependencies", "input": {"tier": "P1", "exposure": "", "C": 300, "R": null, "S": true, "S_lines": 300, "deps_only": true, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-3", "Lane": "full-audit", "Reason": "rule-3: sensitive-identifier files changed, >=200 lines"}}, + {"name": "dependencies-before-age", "input": {"tier": "P1", "exposure": "", "C": 50, "R": null, "S": false, "S_lines": 0, "deps_only": true, "audit_age_days": 9999, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-3b", "Lane": "deps-lane", "Reason": "rule-3b: dependency manifests only (deterministic osv/impact lane)"}}, + {"name": "age-before-quarterly", "input": {"tier": "P1", "exposure": "", "C": 50, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 9999, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "quarterly-before-push-noise", "input": {"tier": "P1", "exposure": "", "C": 50, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": true, "ahead_by": 0}, "want": {"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)"}}, + {"name": "age-P0-unspecified-None", "input": {"tier": "P0", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-unspecified-180", "input": {"tier": "P0", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 180, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-unspecified-181", "input": {"tier": "P0", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 181, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P0-public-external-None", "input": {"tier": "P0", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-public-external-180", "input": {"tier": "P0", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 180, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-public-external-181", "input": {"tier": "P0", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 181, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P0-private-external-None", "input": {"tier": "P0", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-private-external-180", "input": {"tier": "P0", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 180, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-private-external-181", "input": {"tier": "P0", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 181, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P0-public-internal-None", "input": {"tier": "P0", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-public-internal-180", "input": {"tier": "P0", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 180, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-public-internal-181", "input": {"tier": "P0", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 181, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P0-private-internal-None", "input": {"tier": "P0", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-private-internal-180", "input": {"tier": "P0", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 180, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P0-private-internal-181", "input": {"tier": "P0", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 181, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P1-unspecified-None", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-unspecified-270", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 270, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-unspecified-271", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 271, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P1-public-external-None", "input": {"tier": "P1", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-public-external-180", "input": {"tier": "P1", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 180, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-public-external-181", "input": {"tier": "P1", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 181, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P1-private-external-None", "input": {"tier": "P1", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-private-external-180", "input": {"tier": "P1", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 180, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-private-external-181", "input": {"tier": "P1", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 181, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P1-public-internal-None", "input": {"tier": "P1", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-public-internal-270", "input": {"tier": "P1", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 270, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-public-internal-271", "input": {"tier": "P1", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 271, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P1-private-internal-None", "input": {"tier": "P1", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-private-internal-270", "input": {"tier": "P1", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 270, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P1-private-internal-271", "input": {"tier": "P1", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 271, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P2-unspecified-None", "input": {"tier": "P2", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-unspecified-365", "input": {"tier": "P2", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 365, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-unspecified-366", "input": {"tier": "P2", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 366, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P2-public-external-None", "input": {"tier": "P2", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-public-external-270", "input": {"tier": "P2", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 270, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-public-external-271", "input": {"tier": "P2", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 271, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P2-private-external-None", "input": {"tier": "P2", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-private-external-270", "input": {"tier": "P2", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 270, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-private-external-271", "input": {"tier": "P2", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 271, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P2-public-internal-None", "input": {"tier": "P2", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-public-internal-365", "input": {"tier": "P2", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 365, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-public-internal-366", "input": {"tier": "P2", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 366, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P2-private-internal-None", "input": {"tier": "P2", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-private-internal-365", "input": {"tier": "P2", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 365, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P2-private-internal-366", "input": {"tier": "P2", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 366, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)"}}, + {"name": "age-P3-unspecified-None", "input": {"tier": "P3", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-unspecified-9999", "input": {"tier": "P3", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 9999, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-unspecified-10000", "input": {"tier": "P3", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 10000, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-public-external-None", "input": {"tier": "P3", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-public-external-9999", "input": {"tier": "P3", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 9999, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-public-external-10000", "input": {"tier": "P3", "exposure": "public-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 10000, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-private-external-None", "input": {"tier": "P3", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-private-external-9999", "input": {"tier": "P3", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 9999, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-private-external-10000", "input": {"tier": "P3", "exposure": "private-external", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 10000, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-public-internal-None", "input": {"tier": "P3", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-public-internal-9999", "input": {"tier": "P3", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 9999, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-public-internal-10000", "input": {"tier": "P3", "exposure": "public-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 10000, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-private-internal-None", "input": {"tier": "P3", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": null, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-private-internal-9999", "input": {"tier": "P3", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 9999, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "age-P3-private-internal-10000", "input": {"tier": "P3", "exposure": "private-internal", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 10000, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "push-False-ahead-None", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "push-False-ahead-0", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": 0}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "push-False-ahead-1", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": false, "ahead_by": 1}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "push-True-ahead-None", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": true, "ahead_by": null}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}}, + {"name": "push-True-ahead-0", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": true, "ahead_by": 0}, "want": {"Rule": "rule-6", "Lane": "none", "Reason": "rule-6: pushed_at moved but 0 commits ahead (tag/branch noise)"}}, + {"name": "push-True-ahead-1", "input": {"tier": "P1", "exposure": "", "C": 0, "R": null, "S": false, "S_lines": 0, "deps_only": false, "audit_age_days": 30, "changed": true, "ahead_by": 1}, "want": {"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)"}} + ], + "risk": [ + {"name": "risk-0-archived-False-dormant-False", "input": {"LiveCriticalHigh": 0, "Archived": false, "Dormant": false}, "want": "P2"}, + {"name": "risk-0-archived-False-dormant-True", "input": {"LiveCriticalHigh": 0, "Archived": false, "Dormant": true}, "want": "P3"}, + {"name": "risk-0-archived-True-dormant-False", "input": {"LiveCriticalHigh": 0, "Archived": true, "Dormant": false}, "want": "P3"}, + {"name": "risk-0-archived-True-dormant-True", "input": {"LiveCriticalHigh": 0, "Archived": true, "Dormant": true}, "want": "P3"}, + {"name": "risk-1-archived-False-dormant-False", "input": {"LiveCriticalHigh": 1, "Archived": false, "Dormant": false}, "want": "P1"}, + {"name": "risk-1-archived-False-dormant-True", "input": {"LiveCriticalHigh": 1, "Archived": false, "Dormant": true}, "want": "P1"}, + {"name": "risk-1-archived-True-dormant-False", "input": {"LiveCriticalHigh": 1, "Archived": true, "Dormant": false}, "want": "P1"}, + {"name": "risk-1-archived-True-dormant-True", "input": {"LiveCriticalHigh": 1, "Archived": true, "Dormant": true}, "want": "P1"}, + {"name": "risk-4-archived-False-dormant-False", "input": {"LiveCriticalHigh": 4, "Archived": false, "Dormant": false}, "want": "P1"}, + {"name": "risk-4-archived-False-dormant-True", "input": {"LiveCriticalHigh": 4, "Archived": false, "Dormant": true}, "want": "P1"}, + {"name": "risk-4-archived-True-dormant-False", "input": {"LiveCriticalHigh": 4, "Archived": true, "Dormant": false}, "want": "P1"}, + {"name": "risk-4-archived-True-dormant-True", "input": {"LiveCriticalHigh": 4, "Archived": true, "Dormant": true}, "want": "P1"}, + {"name": "risk-5-archived-False-dormant-False", "input": {"LiveCriticalHigh": 5, "Archived": false, "Dormant": false}, "want": "P0"}, + {"name": "risk-5-archived-False-dormant-True", "input": {"LiveCriticalHigh": 5, "Archived": false, "Dormant": true}, "want": "P0"}, + {"name": "risk-5-archived-True-dormant-False", "input": {"LiveCriticalHigh": 5, "Archived": true, "Dormant": false}, "want": "P0"}, + {"name": "risk-5-archived-True-dormant-True", "input": {"LiveCriticalHigh": 5, "Archived": true, "Dormant": true}, "want": "P0"}, + {"name": "risk-6-archived-False-dormant-False", "input": {"LiveCriticalHigh": 6, "Archived": false, "Dormant": false}, "want": "P0"}, + {"name": "risk-6-archived-False-dormant-True", "input": {"LiveCriticalHigh": 6, "Archived": false, "Dormant": true}, "want": "P0"}, + {"name": "risk-6-archived-True-dormant-False", "input": {"LiveCriticalHigh": 6, "Archived": true, "Dormant": false}, "want": "P0"}, + {"name": "risk-6-archived-True-dormant-True", "input": {"LiveCriticalHigh": 6, "Archived": true, "Dormant": true}, "want": "P0"} + ] +} diff --git a/tests/fixtures/routing/python_primary.json b/tests/fixtures/routing/python_primary.json new file mode 100644 index 0000000..1743f21 --- /dev/null +++ b/tests/fixtures/routing/python_primary.json @@ -0,0 +1,196 @@ +{ + "source": {"repo": "traust-security/traust", "revision": "0f95c95f48d36509b70234d18b500c0b738e23e8", "path": "src/traust/cli/build_rescan_worklist.py", "sha256": "3e4a34ead553f1ddafacb658336fdf6c579054ee9339b003ae4eab3e848a3525"}, + "event_lanes": [ + {"source": "external-report", "tier": "", "lane": "full-audit+validate"}, + {"source": "external-report", "tier": "P0", "lane": "full-audit+validate"}, + {"source": "external-report", "tier": "P1", "lane": "full-audit+validate"}, + {"source": "external-report", "tier": "P2", "lane": "full-audit+validate"}, + {"source": "external-report", "tier": "P3", "lane": "full-audit+validate"}, + {"source": "methodology", "tier": "", "lane": null}, + {"source": "methodology", "tier": "P0", "lane": "full-audit"}, + {"source": "methodology", "tier": "P1", "lane": null}, + {"source": "methodology", "tier": "P2", "lane": null}, + {"source": "methodology", "tier": "P3", "lane": null}, + {"source": "cve", "tier": "", "lane": "impact-lane"}, + {"source": "cve", "tier": "P0", "lane": "impact-lane"}, + {"source": "cve", "tier": "P1", "lane": "impact-lane"}, + {"source": "cve", "tier": "P2", "lane": "impact-lane"}, + {"source": "cve", "tier": "P3", "lane": "impact-lane"}, + {"source": "release", "tier": "", "lane": "release-passthrough"}, + {"source": "release", "tier": "P0", "lane": "release-passthrough"}, + {"source": "release", "tier": "P1", "lane": "release-passthrough"}, + {"source": "release", "tier": "P2", "lane": "release-passthrough"}, + {"source": "release", "tier": "P3", "lane": "release-passthrough"}, + {"source": "unknown", "tier": "", "lane": null}, + {"source": "unknown", "tier": "P0", "lane": null}, + {"source": "unknown", "tier": "P1", "lane": null}, + {"source": "unknown", "tier": "P2", "lane": null}, + {"source": "unknown", "tier": "P3", "lane": null}, + {"source": "", "tier": "", "lane": null}, + {"source": "", "tier": "P0", "lane": null}, + {"source": "", "tier": "P1", "lane": null}, + {"source": "", "tier": "P2", "lane": null}, + {"source": "", "tier": "P3", "lane": null} + ], + "primary": [ + {"name": "event-external-report-P0-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "external-report", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "full-audit+validate", "Reason": "event:external-report", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-external-report-P0-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "external-report", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-methodology-P0-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "methodology", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "full-audit", "Reason": "event:methodology", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-methodology-P0-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "methodology", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-cve-P0-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "cve", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "impact-lane", "Reason": "event:cve", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-cve-P0-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "cve", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-release-P0-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "release", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "release-passthrough", "Reason": "event:release \u2014 passthrough: route to the branch/container/rpm audit lane, not this table", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-release-P0-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "release", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-unknown-P0-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "unknown", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-unknown-P0-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "unknown", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-empty-P0-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-empty-P0-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P0", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-external-report-P1-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "external-report", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "full-audit+validate", "Reason": "event:external-report", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-external-report-P1-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "external-report", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-methodology-P1-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "methodology", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "honored, not queued (methodology events queue P0 only; P1+ catch up via the rule-4 ceiling)"}]}}, + {"name": "event-methodology-P1-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "methodology", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-cve-P1-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "cve", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "impact-lane", "Reason": "event:cve", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-cve-P1-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "cve", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-release-P1-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "release", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "release-passthrough", "Reason": "event:release \u2014 passthrough: route to the branch/container/rpm audit lane, not this table", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-release-P1-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "release", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-unknown-P1-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "unknown", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-unknown-P1-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "unknown", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-empty-P1-consumed-False", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-empty-P1-consumed-True", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-external-report-P2-consumed-False", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "external-report", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "full-audit+validate", "Reason": "event:external-report", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-external-report-P2-consumed-True", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "external-report", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-methodology-P2-consumed-False", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "methodology", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "honored, not queued (methodology events queue P0 only; P1+ catch up via the rule-4 ceiling)"}]}}, + {"name": "event-methodology-P2-consumed-True", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "methodology", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-cve-P2-consumed-False", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "cve", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "impact-lane", "Reason": "event:cve", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-cve-P2-consumed-True", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "cve", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-release-P2-consumed-False", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "release", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "release-passthrough", "Reason": "event:release \u2014 passthrough: route to the branch/container/rpm audit lane, not this table", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-release-P2-consumed-True", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "release", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-unknown-P2-consumed-False", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "unknown", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-unknown-P2-consumed-True", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "unknown", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-empty-P2-consumed-False", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-empty-P2-consumed-True", "input": {"Audit": {"Risk": {}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-external-report-P3-consumed-False", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "external-report", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "full-audit+validate", "Reason": "event:external-report", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-external-report-P3-consumed-True", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "external-report", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-methodology-P3-consumed-False", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "methodology", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "honored, not queued (methodology events queue P0 only; P1+ catch up via the rule-4 ceiling)"}]}}, + {"name": "event-methodology-P3-consumed-True", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "methodology", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-cve-P3-consumed-False", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "cve", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "impact-lane", "Reason": "event:cve", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-cve-P3-consumed-True", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "cve", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-release-P3-consumed-False", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "release", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "release-passthrough", "Reason": "event:release \u2014 passthrough: route to the branch/container/rpm audit lane, not this table", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-release-P3-consumed-True", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "release", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-unknown-P3-consumed-False", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "unknown", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-unknown-P3-consumed-True", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "unknown", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-empty-P3-consumed-False", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "", "Consumed": false}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "event-empty-P3-consumed-True", "input": {"Audit": {"Risk": {"Dormant": true}, "Status": "ok", "AuditAgeDays": 9999}, "Inventory": {}, "Events": [{"Source": "", "Consumed": true}]}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P3", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "unaudited-external-report-inventory-None", "input": {"Inventory": null, "Events": [{"Source": "external-report"}]}, "want": {"Decisions": [], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-external-report-inventory-{}", "input": {"Inventory": {}, "Events": [{"Source": "external-report"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-internal", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-external-report-inventory-{'Designation': 'external'}", "input": {"Inventory": {"Designation": "external"}, "Events": [{"Source": "external-report"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-external", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-methodology-inventory-None", "input": {"Inventory": null, "Events": [{"Source": "methodology"}]}, "want": {"Decisions": [], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-methodology-inventory-{}", "input": {"Inventory": {}, "Events": [{"Source": "methodology"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-internal", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-methodology-inventory-{'Designation': 'external'}", "input": {"Inventory": {"Designation": "external"}, "Events": [{"Source": "methodology"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-external", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-cve-inventory-None", "input": {"Inventory": null, "Events": [{"Source": "cve"}]}, "want": {"Decisions": [], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-cve-inventory-{}", "input": {"Inventory": {}, "Events": [{"Source": "cve"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-internal", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-cve-inventory-{'Designation': 'external'}", "input": {"Inventory": {"Designation": "external"}, "Events": [{"Source": "cve"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-external", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-release-inventory-None", "input": {"Inventory": null, "Events": [{"Source": "release"}]}, "want": {"Decisions": [], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-release-inventory-{}", "input": {"Inventory": {}, "Events": [{"Source": "release"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-internal", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-release-inventory-{'Designation': 'external'}", "input": {"Inventory": {"Designation": "external"}, "Events": [{"Source": "release"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-external", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "unaudited-unknown-inventory-None", "input": {"Inventory": null, "Events": [{"Source": "unknown"}]}, "want": {"Decisions": [], "EventsHonored": []}}, + {"name": "unaudited-unknown-inventory-{}", "input": {"Inventory": {}, "Events": [{"Source": "unknown"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-internal", "Status": "never-audited", "EventIndex": null}], "EventsHonored": []}}, + {"name": "unaudited-unknown-inventory-{'Designation': 'external'}", "input": {"Inventory": {"Designation": "external"}, "Events": [{"Source": "unknown"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-external", "Status": "never-audited", "EventIndex": null}], "EventsHonored": []}}, + {"name": "unaudited-empty-inventory-None", "input": {"Inventory": null, "Events": [{"Source": ""}]}, "want": {"Decisions": [], "EventsHonored": []}}, + {"name": "unaudited-empty-inventory-{}", "input": {"Inventory": {}, "Events": [{"Source": ""}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-internal", "Status": "never-audited", "EventIndex": null}], "EventsHonored": []}}, + {"name": "unaudited-empty-inventory-{'Designation': 'external'}", "input": {"Inventory": {"Designation": "external"}, "Events": [{"Source": ""}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-external", "Status": "never-audited", "EventIndex": null}], "EventsHonored": []}}, + {"name": "bootstrap-unspecified-disabled-False", "input": {"Inventory": {"Designation": ""}, "DisableBootstrap": false, "Events": [{"Source": "release"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-internal", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "bootstrap-unspecified-disabled-True", "input": {"Inventory": {"Designation": ""}, "DisableBootstrap": true, "Events": [{"Source": "release"}]}, "want": {"Decisions": [], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "bootstrap-external-disabled-False", "input": {"Inventory": {"Designation": "external"}, "DisableBootstrap": false, "Events": [{"Source": "release"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-external", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "bootstrap-external-disabled-True", "input": {"Inventory": {"Designation": "external"}, "DisableBootstrap": true, "Events": [{"Source": "release"}]}, "want": {"Decisions": [], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "bootstrap-internal-tooling-disabled-False", "input": {"Inventory": {"Designation": "internal-tooling"}, "DisableBootstrap": false, "Events": [{"Source": "release"}]}, "want": {"Decisions": [{"Rule": "rule-1-bootstrap", "Lane": "full-audit", "Reason": "rule-1: never audited \u2014 inventory repo without a baseline; full audit + threat-model bootstrap (self-heals into change detection, the graph, and dependency watch)", "RiskTier": "P2", "Exposure": "private-internal", "Status": "never-audited", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "bootstrap-internal-tooling-disabled-True", "input": {"Inventory": {"Designation": "internal-tooling"}, "DisableBootstrap": true, "Events": [{"Source": "release"}]}, "want": {"Decisions": [], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "repo not in the HEAD code-audit population \u2014 dispatch manually"}]}}, + {"name": "empty", "input": {}, "want": {"Decisions": [], "EventsHonored": []}}, + {"name": "event-before-deferred-external-report", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "quota-deferred", "PushChanged": true}, "Events": [{"Source": "external-report"}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "full-audit+validate", "Reason": "event:external-report", "RiskTier": "P0", "Exposure": "", "Status": "quota-deferred", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-before-deferred-methodology", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "quota-deferred", "PushChanged": true}, "Events": [{"Source": "methodology"}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "full-audit", "Reason": "event:methodology", "RiskTier": "P0", "Exposure": "", "Status": "quota-deferred", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-before-deferred-cve", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "quota-deferred", "PushChanged": true}, "Events": [{"Source": "cve"}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "impact-lane", "Reason": "event:cve", "RiskTier": "P0", "Exposure": "", "Status": "quota-deferred", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "event-before-deferred-release", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 5}, "Status": "quota-deferred", "PushChanged": true}, "Events": [{"Source": "release"}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "release-passthrough", "Reason": "event:release \u2014 passthrough: route to the branch/container/rpm audit lane, not this table", "RiskTier": "P0", "Exposure": "", "Status": "quota-deferred", "EventIndex": 0}], "EventsHonored": [{"EventIndex": 0, "Queued": true, "Disposition": ""}]}}, + {"name": "multiple-events-keep-order-and-original-indexes", "input": {"Audit": {"Status": "ok"}, "Events": [{"Source": "cve", "Consumed": true}, {"Source": "unknown"}, {"Source": "external-report"}, {"Source": "methodology"}, {"Source": "cve"}, {"Source": "cve"}, {"Source": "release"}]}, "want": {"Decisions": [{"Rule": "rule-1", "Lane": "full-audit+validate", "Reason": "event:external-report", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": 2}, {"Rule": "rule-1", "Lane": "impact-lane", "Reason": "event:cve", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": 4}, {"Rule": "rule-1", "Lane": "impact-lane", "Reason": "event:cve", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": 5}, {"Rule": "rule-1", "Lane": "release-passthrough", "Reason": "event:release \u2014 passthrough: route to the branch/container/rpm audit lane, not this table", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": 6}], "EventsHonored": [{"EventIndex": 2, "Queued": true, "Disposition": ""}, {"EventIndex": 3, "Queued": false, "Disposition": "honored, not queued (methodology events queue P0 only; P1+ catch up via the rule-4 ceiling)"}, {"EventIndex": 4, "Queued": true, "Disposition": ""}, {"EventIndex": 5, "Queued": true, "Disposition": ""}, {"EventIndex": 6, "Queued": true, "Disposition": ""}]}}, + {"name": "methodology-P1-falls-through-to-churn", "input": {"Audit": {"Risk": {"LiveCriticalHigh": 1}, "Status": "ok", "PushChanged": true, "Change": {"ChangedLines": 8000}}, "Events": [{"Source": "methodology"}]}, "want": {"Decisions": [{"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": [{"EventIndex": 0, "Queued": false, "Disposition": "honored, not queued (methodology events queue P0 only; P1+ catch up via the rule-4 ceiling)"}]}}, + {"name": "status-ok-pushed-False-age-None", "input": {"Audit": {"Status": "ok", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-pushed-False-age-270", "input": {"Audit": {"Status": "ok", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-pushed-False-age-271", "input": {"Audit": {"Status": "ok", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-pushed-True-age-None", "input": {"Audit": {"Status": "ok", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}, "Change": {"CommitsAhead": 0}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-6", "Lane": "none", "Reason": "rule-6: pushed_at moved but 0 commits ahead (tag/branch noise)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-pushed-True-age-270", "input": {"Audit": {"Status": "ok", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}, "Change": {"CommitsAhead": 0}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-6", "Lane": "none", "Reason": "rule-6: pushed_at moved but 0 commits ahead (tag/branch noise)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-pushed-True-age-271", "input": {"Audit": {"Status": "ok", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}, "Change": {"CommitsAhead": 0}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-pushed-False-age-None", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P1", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-pushed-False-age-270", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P1", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-pushed-False-age-271", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P1", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-pushed-True-age-None", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P1", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-pushed-True-age-270", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P1", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-pushed-True-age-271", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P1", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-pushed-False-age-None", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "none", "Reason": "no-pinned-sha: no push signal; anchor is re-established at the next audit", "RiskTier": "P1", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-pushed-False-age-270", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "none", "Reason": "no-pinned-sha: no push signal; anchor is re-established at the next audit", "RiskTier": "P1", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-pushed-False-age-271", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "none", "Reason": "no-pinned-sha: no push signal; anchor is re-established at the next audit", "RiskTier": "P1", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-pushed-True-age-None", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "full-audit", "Reason": "no-pinned-sha: changed since audit but churn unmeasurable \u2014 full audit re-establishes the anchor (self-healing)", "RiskTier": "P1", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-pushed-True-age-270", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "full-audit", "Reason": "no-pinned-sha: changed since audit but churn unmeasurable \u2014 full audit re-establishes the anchor (self-healing)", "RiskTier": "P1", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-pushed-True-age-271", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "full-audit", "Reason": "no-pinned-sha: changed since audit but churn unmeasurable \u2014 full audit re-establishes the anchor (self-healing)", "RiskTier": "P1", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unsupported-host-pushed-False-age-None", "input": {"Audit": {"Status": "unsupported-host", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unsupported-host", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unsupported-host-pushed-False-age-270", "input": {"Audit": {"Status": "unsupported-host", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unsupported-host", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unsupported-host-pushed-False-age-271", "input": {"Audit": {"Status": "unsupported-host", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "unsupported-host", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unsupported-host-pushed-True-age-None", "input": {"Audit": {"Status": "unsupported-host", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unsupported-host", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unsupported-host-pushed-True-age-270", "input": {"Audit": {"Status": "unsupported-host", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unsupported-host", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unsupported-host-pushed-True-age-271", "input": {"Audit": {"Status": "unsupported-host", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "unsupported-host", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-repo-url-pushed-False-age-None", "input": {"Audit": {"Status": "no-repo-url", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "no-repo-url", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-repo-url-pushed-False-age-270", "input": {"Audit": {"Status": "no-repo-url", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "no-repo-url", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-repo-url-pushed-False-age-271", "input": {"Audit": {"Status": "no-repo-url", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "no-repo-url", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-repo-url-pushed-True-age-None", "input": {"Audit": {"Status": "no-repo-url", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "no-repo-url", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-repo-url-pushed-True-age-270", "input": {"Audit": {"Status": "no-repo-url", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "no-repo-url", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-repo-url-pushed-True-age-271", "input": {"Audit": {"Status": "no-repo-url", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "no-repo-url", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-credentials-pushed-False-age-None", "input": {"Audit": {"Status": "no-credentials", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "no-credentials", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-credentials-pushed-False-age-270", "input": {"Audit": {"Status": "no-credentials", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "no-credentials", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-credentials-pushed-False-age-271", "input": {"Audit": {"Status": "no-credentials", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "no-credentials", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-credentials-pushed-True-age-None", "input": {"Audit": {"Status": "no-credentials", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "no-credentials", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-credentials-pushed-True-age-270", "input": {"Audit": {"Status": "no-credentials", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "no-credentials", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-credentials-pushed-True-age-271", "input": {"Audit": {"Status": "no-credentials", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "no-credentials", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unreachable-pushed-False-age-None", "input": {"Audit": {"Status": "unreachable", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unreachable-pushed-False-age-270", "input": {"Audit": {"Status": "unreachable", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unreachable-pushed-False-age-271", "input": {"Audit": {"Status": "unreachable", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unreachable-pushed-True-age-None", "input": {"Audit": {"Status": "unreachable", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unreachable-pushed-True-age-270", "input": {"Audit": {"Status": "unreachable", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-unreachable-pushed-True-age-271", "input": {"Audit": {"Status": "unreachable", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-error-pushed-False-age-None", "input": {"Audit": {"Status": "error", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "error", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-error-pushed-False-age-270", "input": {"Audit": {"Status": "error", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "error", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-error-pushed-False-age-271", "input": {"Audit": {"Status": "error", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "error", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-error-pushed-True-age-None", "input": {"Audit": {"Status": "error", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "error", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-error-pushed-True-age-270", "input": {"Audit": {"Status": "error", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "error", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-error-pushed-True-age-271", "input": {"Audit": {"Status": "error", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "error", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ban-suspected-pushed-False-age-None", "input": {"Audit": {"Status": "ban-suspected", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "ban-suspected", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ban-suspected-pushed-False-age-270", "input": {"Audit": {"Status": "ban-suspected", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "ban-suspected", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ban-suspected-pushed-False-age-271", "input": {"Audit": {"Status": "ban-suspected", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ban-suspected", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ban-suspected-pushed-True-age-None", "input": {"Audit": {"Status": "ban-suspected", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "ban-suspected", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ban-suspected-pushed-True-age-270", "input": {"Audit": {"Status": "ban-suspected", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "ban-suspected", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ban-suspected-pushed-True-age-271", "input": {"Audit": {"Status": "ban-suspected", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "ban-suspected", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-network-skipped-pushed-False-age-None", "input": {"Audit": {"Status": "network-skipped", "PushChanged": false, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "network-skipped", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-network-skipped-pushed-False-age-270", "input": {"Audit": {"Status": "network-skipped", "PushChanged": false, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "network-skipped", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-network-skipped-pushed-False-age-271", "input": {"Audit": {"Status": "network-skipped", "PushChanged": false, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "network-skipped", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-network-skipped-pushed-True-age-None", "input": {"Audit": {"Status": "network-skipped", "PushChanged": true, "AuditAgeDays": null, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "network-skipped", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-network-skipped-pushed-True-age-270", "input": {"Audit": {"Status": "network-skipped", "PushChanged": true, "AuditAgeDays": 270, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "network-skipped", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-network-skipped-pushed-True-age-271", "input": {"Audit": {"Status": "network-skipped", "PushChanged": true, "AuditAgeDays": 271, "Risk": {"LiveCriticalHigh": 1}}, "Inventory": {}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "", "Status": "network-skipped", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-metrics-{'ChangedLines': 8000}", "input": {"Audit": {"Status": "ok", "PushChanged": true, "Change": {"ChangedLines": 8000}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-metrics-{'ChangedLines': 1000, 'CoverageChangeRatio': 0.1}", "input": {"Audit": {"Status": "ok", "PushChanged": true, "Change": {"ChangedLines": 1000, "CoverageChangeRatio": 0.1}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "rule-2", "Lane": "full-audit", "Reason": "rule-2: coverage-map churn (R>=10% or C>=8000 first-party lines)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-metrics-{'ChangedLines': 500, 'SensitiveChange': True, 'SensitiveChangedLines': 200}", "input": {"Audit": {"Status": "ok", "PushChanged": true, "Change": {"ChangedLines": 500, "SensitiveChange": true, "SensitiveChangedLines": 200}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "rule-3", "Lane": "diff-scan", "Reason": "rule-3: sensitive-identifier files changed, >=200 lines", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-metrics-{'ChangedLines': 10, 'DependenciesOnly': True}", "input": {"Audit": {"Status": "ok", "PushChanged": true, "Change": {"ChangedLines": 10, "DependenciesOnly": true}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "rule-3b", "Lane": "deps-lane", "Reason": "rule-3b: dependency manifests only (deterministic osv/impact lane)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-ok-metrics-{'ChangedLines': 1}", "input": {"Audit": {"Status": "ok", "PushChanged": true, "Change": {"ChangedLines": 1}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "rule-5", "Lane": "diff-scan-quarterly", "Reason": "rule-5: below-threshold change (accumulates for the quarterly batch)", "RiskTier": "P2", "Exposure": "", "Status": "ok", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-metrics-{'ChangedLines': 8000}", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": true, "Change": {"ChangedLines": 8000}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P2", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-metrics-{'ChangedLines': 1000, 'CoverageChangeRatio': 0.1}", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": true, "Change": {"ChangedLines": 1000, "CoverageChangeRatio": 0.1}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P2", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-metrics-{'ChangedLines': 500, 'SensitiveChange': True, 'SensitiveChangedLines': 200}", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": true, "Change": {"ChangedLines": 500, "SensitiveChange": true, "SensitiveChangedLines": 200}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P2", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-metrics-{'ChangedLines': 10, 'DependenciesOnly': True}", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": true, "Change": {"ChangedLines": 10, "DependenciesOnly": true}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P2", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-quota-deferred-metrics-{'ChangedLines': 1}", "input": {"Audit": {"Status": "quota-deferred", "PushChanged": true, "Change": {"ChangedLines": 1}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "quota-deferred", "Lane": "none", "Reason": "quota-deferred: changed, stage-2 compare deferred to the next run (API quota)", "RiskTier": "P2", "Exposure": "", "Status": "quota-deferred", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-metrics-{'ChangedLines': 8000}", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": true, "Change": {"ChangedLines": 8000}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "full-audit", "Reason": "no-pinned-sha: changed since audit but churn unmeasurable \u2014 full audit re-establishes the anchor (self-healing)", "RiskTier": "P2", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-metrics-{'ChangedLines': 1000, 'CoverageChangeRatio': 0.1}", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": true, "Change": {"ChangedLines": 1000, "CoverageChangeRatio": 0.1}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "full-audit", "Reason": "no-pinned-sha: changed since audit but churn unmeasurable \u2014 full audit re-establishes the anchor (self-healing)", "RiskTier": "P2", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-metrics-{'ChangedLines': 500, 'SensitiveChange': True, 'SensitiveChangedLines': 200}", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": true, "Change": {"ChangedLines": 500, "SensitiveChange": true, "SensitiveChangedLines": 200}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "full-audit", "Reason": "no-pinned-sha: changed since audit but churn unmeasurable \u2014 full audit re-establishes the anchor (self-healing)", "RiskTier": "P2", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-metrics-{'ChangedLines': 10, 'DependenciesOnly': True}", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": true, "Change": {"ChangedLines": 10, "DependenciesOnly": true}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "full-audit", "Reason": "no-pinned-sha: changed since audit but churn unmeasurable \u2014 full audit re-establishes the anchor (self-healing)", "RiskTier": "P2", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "status-no-pinned-sha-metrics-{'ChangedLines': 1}", "input": {"Audit": {"Status": "no-pinned-sha", "PushChanged": true, "Change": {"ChangedLines": 1}, "Risk": {}}}, "want": {"Decisions": [{"Rule": "no-pinned-sha", "Lane": "full-audit", "Reason": "no-pinned-sha: changed since audit but churn unmeasurable \u2014 full audit re-establishes the anchor (self-healing)", "RiskTier": "P2", "Exposure": "", "Status": "no-pinned-sha", "EventIndex": null}], "EventsHonored": []}}, + {"name": "exposure-unspecified-unreachable-age", "input": {"Audit": {"Status": "unreachable", "Exposure": "", "Risk": {"LiveCriticalHigh": 1}, "AuditAgeDays": 181}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "exposure-public-external-unreachable-age", "input": {"Audit": {"Status": "unreachable", "Exposure": "public-external", "Risk": {"LiveCriticalHigh": 1}, "AuditAgeDays": 181}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "public-external", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "exposure-private-external-unreachable-age", "input": {"Audit": {"Status": "unreachable", "Exposure": "private-external", "Risk": {"LiveCriticalHigh": 1}, "AuditAgeDays": 181}}, "want": {"Decisions": [{"Rule": "rule-4", "Lane": "full-audit", "Reason": "rule-4: audit age over tier ceiling (P0 180d / P1 270d / P2 365d)", "RiskTier": "P1", "Exposure": "private-external", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "exposure-public-internal-unreachable-age", "input": {"Audit": {"Status": "unreachable", "Exposure": "public-internal", "Risk": {"LiveCriticalHigh": 1}, "AuditAgeDays": 181}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "public-internal", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}}, + {"name": "exposure-private-internal-unreachable-age", "input": {"Audit": {"Status": "unreachable", "Exposure": "private-internal", "Risk": {"LiveCriticalHigh": 1}, "AuditAgeDays": 181}}, "want": {"Decisions": [{"Rule": "rule-7", "Lane": "none", "Reason": "rule-7: no qualifying change (dormant repos re-enter on push)", "RiskTier": "P1", "Exposure": "private-internal", "Status": "unreachable", "EventIndex": null}], "EventsHonored": []}} + ] +} diff --git a/tests/routing_reference.py b/tests/routing_reference.py new file mode 100644 index 0000000..5483707 --- /dev/null +++ b/tests/routing_reference.py @@ -0,0 +1,200 @@ +"""Legacy adapter for the exported work-routing corpus (not production policy). + +Adapted from generate.py and generate_primary.py at the SDK revision recorded in +fixtures/routing/baseline.json. Execute the checked-out CLI's original AST nodes; +do not duplicate its rules or import its deployment/I/O dependencies. Inputs and +outputs retain the SDK fixture shape. Only temporary event/graph files are used. +""" + +import ast +import datetime +import hashlib +import json +import sqlite3 +from pathlib import Path +from types import SimpleNamespace + +URL = "https://github.com/example/repository" +REFERENCE_NAMES = { + "CHURN_FULL_LINES", + "CHURN_FULL_RATIO", + "SENSITIVE_MIN_LINES", + "TIER_CEILING_DAYS", + "TIGHTENED_CEILING_DAYS", + "P0_MIN_LIVE", + "_rule3_lane", + "_over_ceiling", + "DECISION_TABLE", + "decide", + "risk_tier", + "EVENT_SOURCES", + "event_lane", + "load_events", + "_parse_date", + "RELEASE_REMODEL_CHANGES", + "EXPOSURE_ORDER", + "lookup_designation", + "never_audited_rows", +} + + +def verify_digest(raw: bytes, expected: str, label: str) -> None: + actual = hashlib.sha256(raw).hexdigest() + if actual != expected: + raise ValueError( + f"{label}: SHA-256 changed (expected {expected}, got {actual}). " + "Review the fixture diff before updating baseline.json; " + "see tests/fixtures/routing/README.md." + ) + + +def _assigned(node: ast.stmt, name: str) -> bool: + return isinstance(node, ast.Assign) and any( + isinstance(part, ast.Name) and part.id == name + for target in node.targets + for part in ast.walk(target) + ) + + +def load_reference(source: Path): + """Load current legacy definitions and its event/table block, without main I/O.""" + tree = ast.parse(source.read_bytes(), filename=str(source)) + selected, found = [], set() + for node in tree.body: + names = {node.name} if isinstance(node, ast.FunctionDef) else set() + if isinstance(node, ast.Assign): + names = {n.id for n in node.targets if isinstance(n, ast.Name)} + elif isinstance(node, ast.AnnAssign) and isinstance(node.target, ast.Name): + names.add(node.target.id) + if names & REFERENCE_NAMES: + selected.append(node) + found.update(names & REFERENCE_NAMES) + if found != REFERENCE_NAMES: + raise ValueError(f"missing legacy definitions: {sorted(REFERENCE_NAMES - found)}") + namespace = { + "Path": Path, + "sqlite3": sqlite3, + "json": json, + "_dt": datetime, + # This corpus supplies canonical URLs; identity normalization is not tested. + "normalize_repo_url": lambda value: value, + } + exec(compile(ast.Module(body=selected, type_ignores=[]), str(source), "exec"), namespace) + main = next(n for n in tree.body if isinstance(n, ast.FunctionDef) and n.name == "main") + starts = [i for i, n in enumerate(main.body) if _assigned(n, "event_rows")] + stops = [i for i, n in enumerate(main.body) if _assigned(n, "cc_urls")] + if len(starts) != 1 or len(stops) != 1 or starts[0] >= stops[0]: + raise ValueError("legacy event/table block moved; review the parity adapter's boundaries") + # Same anchors as the original generator: include event precedence/status + # handling, stop before additive IaC companions. No policy is rewritten here. + loops = compile( + ast.Module(body=main.body[starts[0] : stops[0]], type_ignores=[]), str(source), "exec" + ) + return namespace, loops + + +def run_primary(reference_ns, loops, supplied: dict, directory: Path) -> dict: + """Translate one fixture and execute the legacy loops/bootstrap helper. + + Translation follows the original generator, including event indexes, multiple + decisions and bootstrap. This is not a proposed single-Route SDK interface. + """ + ns = reference_ns.copy() + audit = supplied.get("Audit") + entries = [] + if audit is not None: + risk = audit.get("Risk", {}) + entry = { + "repo_key": "example/repository", + "repo_url": URL, + "live_crit_high": risk.get("LiveCriticalHigh", 0), + "archived": risk.get("Archived", False), + "dormant": risk.get("Dormant", False), + "status": audit["Status"], + "exposure": audit.get("Exposure", ""), + "audit_age_days": audit.get("AuditAgeDays"), + "changed": audit.get("PushChanged", False), + } + change = audit.get("Change") + if change is not None: + for fixture_key, entry_key in ( + ("ChangedLines", "C"), + ("SensitiveChange", "S"), + ("SensitiveChangedLines", "S_lines"), + ("DependenciesOnly", "deps_only"), + ): + entry[entry_key] = change.get( + fixture_key, + False if fixture_key in ("SensitiveChange", "DependenciesOnly") else 0, + ) + entry["ahead_by"] = change.get("CommitsAhead") + ratio = change.get("CoverageChangeRatio") + if ratio: + if not entry["C"]: + raise ValueError("positive reference ratio needs nonzero changed lines") + entry["lines_reviewed"] = entry["C"] / ratio + entries.append(entry) + + event_path = directory / "events.jsonl" + events = supplied.get("Events", []) + event_path.write_text( + "".join( + json.dumps({"repo": URL, "source": e["Source"], "consumed": e.get("Consumed", False)}) + + "\n" + for e in events + ), + encoding="utf-8", + ) + ns.update( + entries=entries, + events=ns["load_events"](event_path), + by_url={e["repo_url"]: e for e in entries}, + by_key={e["repo_key"]: e for e in entries}, + args=SimpleNamespace(no_threat_model=True), + today=datetime.date(2026, 9, 28), # Original generator's fixed clock. + ) + exec(loops, ns) + graph = directory / "graph.db" + con = sqlite3.connect(graph) + inventory = supplied.get("Inventory") + try: + con.execute("CREATE TABLE nodes (id TEXT)") + if inventory is not None: + con.execute("INSERT INTO nodes VALUES (?)", ("repo:" + URL.removeprefix("https://"),)) + con.commit() + finally: + con.close() + designation = inventory.get("Designation", "") if inventory is not None else "" + bootstrap = ( + [] + if supplied.get("DisableBootstrap", False) + else ns["never_audited_rows"]( + graph, {e["repo_url"] for e in entries}, [(URL, designation)] if designation else [] + ) + ) + kept_indexes = [ + i + for i, e in enumerate(events) + if not e.get("Consumed", False) and e["Source"] in ns["EVENT_SOURCES"] + ] + honored = [ + {"EventIndex": i, "Queued": e["queued"], "Disposition": e.get("disposition", "")} + for i, e in zip(kept_indexes, ns["events_honored"], strict=True) + ] + queued_indexes = iter(e["EventIndex"] for e in honored if e["Queued"]) + rows = ns["event_rows"] + ns["table_rows"] + bootstrap + return { + "Decisions": [ + { + "Rule": r["rule"], + "Lane": r["lane"], + "Reason": r["reason"], + "RiskTier": r["tier"], + "Exposure": r.get("exposure", ""), + "Status": r["status"], + "EventIndex": next(queued_indexes) if "event_source" in r else None, + } + for r in rows + ], + "EventsHonored": honored, + } diff --git a/tests/test_route_parity.py b/tests/test_route_parity.py new file mode 100644 index 0000000..0767e68 --- /dev/null +++ b/tests/test_route_parity.py @@ -0,0 +1,112 @@ +"""302 legacy characterization cases; new Router parity awaits XWING-2215. + +Run: uv run pytest -q tests/test_route_parity.py +See fixtures/routing/README.md for the provenance and remaining adapter work. +""" + +import json +import socket +import subprocess +from pathlib import Path + +import pytest + +from tests.routing_reference import load_reference, run_primary, verify_digest + +FIXTURES = Path(__file__).parent / "fixtures" / "routing" +BASELINE = json.loads((FIXTURES / "baseline.json").read_text(encoding="utf-8")) +DECISIONS = json.loads((FIXTURES / "python_decisions.json").read_text(encoding="utf-8")) +PRIMARY = json.loads((FIXTURES / "python_primary.json").read_text(encoding="utf-8")) +LEGACY_SOURCE = Path(__file__).resolve().parents[1] / DECISIONS["source"]["path"] + + +@pytest.fixture(scope="module") +def reference(): + return load_reference(LEGACY_SOURCE) + + +@pytest.fixture(scope="module", autouse=True) +def offline(): + def forbidden(*args, **kwargs): + pytest.fail("routing parity must not use the network or spawn processes") + + with pytest.MonkeyPatch.context() as monkeypatch: + monkeypatch.setattr(socket.socket, "connect", forbidden) + monkeypatch.setattr(socket.socket, "connect_ex", forbidden) + monkeypatch.setattr(socket, "getaddrinfo", forbidden) + monkeypatch.setattr(subprocess, "Popen", forbidden) + yield + + +@pytest.mark.parametrize("filename", BASELINE["fixtures"]) +def test_fixture_export_is_unchanged(filename): + raw = (FIXTURES / filename).read_bytes() + exported = BASELINE["fixtures"][filename] + verify_digest(raw, exported["sha256"], filename) + corpus = json.loads(raw) + assert corpus["source"] == DECISIONS["source"] + assert set(corpus) == {"source", *exported["counts"]} + for group, count in exported["counts"].items(): + assert len(corpus[group]) == count, group + names = [ + (case["source"], case["tier"]) if group == "event_lanes" else case["name"] + for case in corpus[group] + ] + assert len(names) == len(set(names)), f"duplicate case IDs in {group}" + + +@pytest.mark.parametrize("case", DECISIONS["table"], ids=lambda case: case["name"]) +def test_legacy_table(case, reference): + namespace, _ = reference + rule, lane, reason = namespace["decide"](case["input"].copy()) + assert {"Rule": rule, "Lane": lane, "Reason": reason} == case["want"] + + +@pytest.mark.parametrize("case", DECISIONS["risk"], ids=lambda case: case["name"]) +def test_legacy_risk(case, reference): + namespace, _ = reference + risk = case["input"] + assert ( + namespace["risk_tier"](risk["LiveCriticalHigh"], risk["Archived"], risk["Dormant"]) + == case["want"] + ) + + +@pytest.mark.parametrize( + "case", + PRIMARY["event_lanes"], + ids=lambda case: f"{case['source'] or 'empty'}-{case['tier'] or 'unaudited'}", +) +def test_legacy_event_lane(case, reference): + namespace, _ = reference + assert namespace["event_lane"](case["source"], case["tier"] or None) == case["lane"] + + +@pytest.mark.parametrize("case", PRIMARY["primary"], ids=lambda case: case["name"]) +def test_legacy_primary(case, reference, tmp_path): + assert run_primary(*reference, case["input"], tmp_path) == case["want"] + + +def test_cases_detect_routing_behavior_drift(tmp_path): + original = LEGACY_SOURCE.read_bytes() + changed = original.replace(b"CHURN_FULL_LINES = 8000", b"CHURN_FULL_LINES = 9000", 1) + assert changed != original + # The 8000-line boundary case detects this behavior change directly: + # the adapter executes current code, not a frozen copy or a source hash. + source = tmp_path / "changed_worklist.py" + source.write_bytes(changed) + namespace, _ = load_reference(source) + case = next(case for case in DECISIONS["table"] if case["name"] == "churn-lines-8000") + rule, lane, reason = namespace["decide"](case["input"].copy()) + assert {"Rule": rule, "Lane": lane, "Reason": reason} != case["want"] + + +def test_guard_rejects_expected_output_drift(): + changed = json.loads((FIXTURES / "python_decisions.json").read_text(encoding="utf-8")) + changed["table"][0]["want"]["Lane"] = "unreviewed-lane" + with pytest.raises(ValueError, match="Review the fixture diff"): + verify_digest( + json.dumps(changed).encode(), + BASELINE["fixtures"]["python_decisions.json"]["sha256"], + "changed fixture", + )