riskscan

Documentation

Index

• Variables
• func BuildEnvelope(report *shadow.Report, obs ConfigObservation, opts BuildOptions) (riskenvelope.RiskEnvelope, error)
• func EnvelopeJSON(envelope riskenvelope.RiskEnvelope) ([]byte, error)
• func RenderHTML(envelope riskenvelope.RiskEnvelope) ([]byte, error)
• func RenderMarkdown(envelope riskenvelope.RiskEnvelope) ([]byte, error)
• func Scan(root string, opts BuildOptions) (riskenvelope.RiskEnvelope, error)
• func ScanReceipts(root string, opts BuildOptions) (riskenvelope.RiskEnvelope, error)
• func UploadEnvelope(ctx context.Context, url string, body []byte) error
• func WriteEvidencePack(path string, envelope riskenvelope.RiskEnvelope, previews map[string][]byte) error
• type BuildOptions
• type ConfigObservation
  • func CollectConfigObservation(root string) (ConfigObservation, error)
• type EvidencePackVerification
  • func VerifyEvidencePack(packDir string) EvidencePackVerification

Variables

var ErrScanCoverageIncomplete = errors.New("risk scan coverage incomplete")

ErrScanCoverageIncomplete means the CLI-only static scan could not inspect its declared candidate/config scope. Callers must not export a partial RiskEnvelope or scan artifact.

Functions

func BuildEnvelope

func BuildEnvelope(report *shadow.Report, obs ConfigObservation, opts BuildOptions) (riskenvelope.RiskEnvelope, error)

func EnvelopeJSON

func EnvelopeJSON(envelope riskenvelope.RiskEnvelope) ([]byte, error)

func RenderHTML

func RenderHTML(envelope riskenvelope.RiskEnvelope) ([]byte, error)

func RenderMarkdown

func RenderMarkdown(envelope riskenvelope.RiskEnvelope) ([]byte, error)

func Scan

func Scan(root string, opts BuildOptions) (riskenvelope.RiskEnvelope, error)

func ScanReceipts

func ScanReceipts(root string, opts BuildOptions) (riskenvelope.RiskEnvelope, error)

ScanReceipts projects workstation observe/decision receipts into the same anonymized RiskEnvelope shape as Scan. It never exports raw receipt fields.

func UploadEnvelope

func UploadEnvelope(ctx context.Context, url string, body []byte) error

func WriteEvidencePack

func WriteEvidencePack(path string, envelope riskenvelope.RiskEnvelope, previews map[string][]byte) error

WriteEvidencePack exports a scan as a transport tar containing the current contracts.EvidencePack plus the anonymized artifacts it hashes. The tar adds no independent manifest, seal, or trust format.

Types

type BuildOptions

type BuildOptions struct {
	Root              string
	Salt              []byte
	Cohort            riskenvelope.CohortBucket
	Now               time.Time
	IncludeUserConfig bool
}

type ConfigObservation

type ConfigObservation struct {
	AgentSurface           riskenvelope.AgentSurface
	PermissionMode         riskenvelope.PermissionMode
	ManagedSettingsPresent bool
	MCPServerCount         int
	StaticConfigFilesRead  int
	// contains filtered or unexported fields
}

func CollectConfigObservation

func CollectConfigObservation(root string) (ConfigObservation, error)

type EvidencePackVerification

type EvidencePackVerification struct {
	Verified   bool     `json:"verified"`
	PackID     string   `json:"pack_id,omitempty"`
	EnvelopeID string   `json:"envelope_id,omitempty"`
	Errors     []string `json:"errors,omitempty"`
}

EvidencePackVerification reports only whether the exported local artifacts still match the current EvidencePack contract. It is not execution, authorization, provenance, or live-posture verification.

func VerifyEvidencePack

func VerifyEvidencePack(packDir string) EvidencePackVerification

VerifyEvidencePack verifies the current contract and every artifact its BundledArtifacts bind. It intentionally does not interpret an optional signature because a risk scan has no independently trusted signer here.