feat(vuln): GHAS급 vuln/SAST 품질 — code-scanning parity substrate + 인라인 티어 + report-only SLO 게이트 (자율 M1~M3)

[pureliture]

요약

ghas-quality-vuln-parity long-single-goal의 자율층 M1~M3을 TDD red-green으로 완성. vuln/SAST 탐지를 GHAS code-scanning(CodeQL) parity SLO에 맞추는 측정 harness + FP-억제 품질 머신을 synthetic fixture만으로 구축. 시크릿 서브트랙(PR #58)의 검증된 2층 구조를 1:1 전이하되, durable disposition은 vuln 고유 storage-projection 제약으로 H-track(H4)으로 분리.

자율 goal done = M3. 실 GHAS 무접촉, 커밋 산출물은 synthetic redacted only.

마일스톤 (전부 architecture gate 통과: pre/post-M2/post-M3/final, blocking 0)

• M1 (305de47): CodeScanAlertRecord(redacted leaf, store 결합 0) + compare_codescan_alerts_with_findings 매처. CWE 3등급(by-cwe > by-rule-token > unmatched), 진짜 |alert−finding|≤N(N=2) line-window, 1:1 greedy, state-aware 분모(recall=open+fixed만, precision 페널티=dismissed fp/used-in-tests 별도, won't-fix는 TP-비차단 제외). precision/recall은 core/vulnerability/evaluation.py 재사용(신규 계산 0줄) — canonical key 합성 후 evaluate_vulnerability_findings로 수렴. 적대 fixture(CWE-부재/라인드리프트/CodeQL↔Semgrep 다른 rule.id/dismissed)가 정규화·윈도·필터 누락 시 red.
• M2 (c1716e8): 인라인 싼 티어(gate.py — require_trace·suppress_rules 두 플래그 default-off gated, base_blocking 보존, blocking set에서 제거만). 기존 scan-vuln/gate default 출력 byte-identical 불변(canary 테스트 고정, emission 무접촉). 합성 코퍼스 5종(SQLi/XSS/path-traversal/command-injection/SSRF, CWE-89/79/22/78/918). 정규화 인지 평가 경로 신규 추가(기존 exact-key 경로 불변, M1과 동일 정규화+line-window 공유 = VFR8 정합).
• M3 (75550d0, 자율 done): 합성 회귀 게이트 enforce(recall≥0.99/precision≥0.90, ci/pytest로 enforce + red canary 2종으로 비공허 증명) + governance/vuln_parity_slo.py(시크릿 parity_slo.py 1:1 전이, 별도 파일). threshold yml 부재→report-only(항상 exit 0), 존재→enforce(H-track 후), 나이>임계→stale-degraded(silent staleness 금지). frozen synthetic snapshot 대비 결정적 재현, dismissed_fp_hit/won't-fix surfacing 행사.

거버넌스/슬롯 처리 (시크릿 트랙 검증 패턴)

• goal-setup bundled (0d779f9): goal_id + active_goal + CURRENT.md 동기 + spec 승격 + goal 패킷. activation 베이스라인이지 자율 변경 아님.
• autopilot-gate base = activation: acceptance check은 --base 0d779f9로 M1~M3 변경만 allowed_writes 대비 평가(green).
• claude/ CI exempt*: .github/workflows/ci.yml에서 ci/autopilot-gate가 claude/* 면제(skip→Success).
• active_goal 슬롯 유지(personal-prod): 자율 코드는 active_goal 슬롯 없이 머지. governance 3파일(autopilot_goal.yml·current.yml·CURRENT.md) 미변경 — 실 슬롯 점유 전환은 사용자 결정. governance/** 광역 미수정, allowed_writes의 governance는 governance/vuln_parity_slo.py 단일.

H-track (자율 루프 밖, stop-condition 후속 — 이 PR 범위 밖)

• H1 실 code-scanning(CodeQL) snapshot 취득 — ghas-live-fetch-or-mutation-required human-PR.
• H2 parity baseline 측정 + fixture-vs-real divergence + 목표 확정(measure-first).
• H3 parity enforce 전환(threshold yml 커밋).
• H4 vuln verdict durable disposition 배선 — storage-projection-or-schema-migration-required(VulnerabilityFinding이 durable store 미적재, set_finding_disposition은 FINDING_STATE 부재 시 ValueError). v1 자율에선 기존 throwaway JSONL 동작 유지.

parity SLO enforce 미달성, H-track 대기. 실 parity SLO 도달(measure-first v1 done)은 H1~H4 완료 후. CURRENT.md는 생성 파일(render --check 게이트)이고 current.yml은 allowed_writes 밖이라 이 노트는 PR body에 기록.

검증

• uv run pytest: 1310 passed, 4 skipped(기존 live-run guard, 무관). 무회귀(baseline 1269 → 1310, +41).
• vuln_parity_slo --check: exit 0(report-only). autopilot_gate --base 0d779f9: exit 0. public_safety --diff origin/main...HEAD 및 --path docs/workbench/specs/ghas-quality-vuln-subtrack: exit 0. render --validate/--check, rebuild_ledger_index --check, render_github_ruleset --check: 전부 통과.
• 네트워크 0, 커밋 산출물 synthetic-or-redacted-only(source: synthetic fail-closed).

🤖 Generated with Claude Code

https://claude.ai/code/session_01TwGs78e6Rb7P5BDe2ezQEh

[gemini-code-assist]

Code Review

This pull request implements the autonomous phase (M1–M3) of the GHAS code-scanning parity SLO goal (ghas-quality-vuln-parity). It introduces a redacted code-scanning alert domain model, a rule-class normalizer, a fuzzy line-window parity matcher, and an inline cheap FP-suppression tier, alongside synthetic adversarial corpus fixtures and comprehensive test suites. The review feedback focuses on enhancing robustness during JSON parsing and timestamp processing by adding defensive type validation to prevent potential TypeError or AttributeError when encountering unexpected input types.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

The extract_cwe_ids function processes values which is parsed from JSON fields (e.g., item.get("cweIds", [])). If cweIds is explicitly null or a non-iterable type in the JSON, this function will raise a TypeError. We should defensively validate that values is a list, tuple, or set before iterating over it, and handle non-string elements gracefully. Additionally, ensure robustness by adding comprehensive unit tests that cover various unexpected types, including None, numbers, booleans, lists, and dictionaries.

Suggested change

	def extract_cwe_ids(values: Iterable[str]) -> tuple[str, ...]:
	"""Normalize arbitrary CWE-bearing tokens into ``CWE-NNN`` ids (sorted, unique)."""
	found: set[str] = set()
	for value in values:
	match = _CWE_RE.search(str(value))
	if match:
	found.add(f"CWE-{int(match.group(1))}")
	return tuple(sorted(found))
	def extract_cwe_ids(values: Iterable[str] | None) -> tuple[str, ...]:
	"""Normalize arbitrary CWE-bearing tokens into CWE-NNN ids (sorted, unique)."""
	if not isinstance(values, (list, tuple, set)):
	return ()
	found: set[str] = set()
	for value in values:
	if value is None:
	continue
	match = _CWE_RE.search(str(value))
	if match:
	found.add(f"CWE-{int(match.group(1))}")
	return tuple(sorted(found))

References

1. When implementing defensive type validation for parsed JSON fields (e.g., verifying a field is a string), ensure robustness by adding comprehensive unit tests that cover various unexpected types, including None, numbers, booleans, lists, and dictionaries.

[gemini-code-assist]

If the parsed JSON data is not a dictionary (e.g., a list or primitive), calling data.get will raise an AttributeError. We should defensively validate that data is a dictionary before calling .get(). Additionally, ensure robustness by adding comprehensive unit tests that cover various unexpected types, including None, numbers, booleans, lists, and dictionaries.

    data = json.loads(Path(path).read_text(encoding="utf-8"))
    if not isinstance(data, dict):
        raise ValueError("Parsed JSON is not a dictionary")
    source = str(data.get("source", "")).strip().lower()

References

1. When implementing defensive type validation for parsed JSON fields (e.g., verifying a field is a string), ensure robustness by adding comprehensive unit tests that cover various unexpected types, including None, numbers, booleans, lists, and dictionaries.

[gemini-code-assist]

If the parsed JSON data is not a dictionary (e.g., a list or primitive), calling data.get will raise an AttributeError. We should defensively validate that data is a dictionary before calling .get(). Additionally, ensure robustness by adding comprehensive unit tests that cover various unexpected types, including None, numbers, booleans, lists, and dictionaries.

    data = json.loads(Path(path).read_text(encoding="utf-8"))
    if not isinstance(data, dict):
        raise ValueError("Parsed JSON is not a dictionary")
    source = str(data.get("source", "")).strip().lower()

References

1. When implementing defensive type validation for parsed JSON fields (e.g., verifying a field is a string), ensure robustness by adding comprehensive unit tests that cover various unexpected types, including None, numbers, booleans, lists, and dictionaries.

[gemini-code-assist]

If value is not a string (e.g., an integer, boolean, or None from parsed JSON), calling value.strip() will raise an AttributeError. We should defensively validate that value is a string before processing it. Additionally, ensure robustness by adding comprehensive unit tests that cover various unexpected types, including None, numbers, booleans, lists, and dictionaries.

Suggested change

	def _parse_timestamp(value: str) -> dt.datetime | None:
	text = value.strip()
	def _parse_timestamp(value: Any) -> dt.datetime | None:
	if not isinstance(value, str):
	return None
	text = value.strip()

References

1. When implementing defensive type validation for parsed JSON fields (e.g., verifying a field is a string), ensure robustness by adding comprehensive unit tests that cover various unexpected types, including None, numbers, booleans, lists, and dictionaries.