evidence

Documentation

Index

• Constants
• type AnalysisPathStep
• type AnalysisRef
  • func NewAttestedCodeQLAnalysisRef(repositoryID, sourceRevision, indexGeneration, analyzerVersion, ... string, ...) AnalysisRef
  • func NewCodeQLAnalysisRef(repositoryID, sourceRevision, indexGeneration, analyzerVersion, ... string, ...) AnalysisRef
• type AssuranceLattice
• type AssuranceRequirement
• type ClaimRef
  • func NewClaimRef(repositoryID, claimKind, claimText string) ClaimRef
• type Confidence
• type ContradictionSearch
• type Coverage
• type DatabaseQuality
• type EvidenceRef
  • func NewAnalysisEvidenceRef(analysisRef AnalysisRef) EvidenceRef
  • func NewEvidenceRef(repositoryID, sourceRevision, indexGeneration, relativePath string, ...) EvidenceRef
  • func NewRelationshipEvidenceRef(relationshipRef RelationshipRef, evidenceType string) EvidenceRef
• type IndexState
• type InvariantResult
• type ObservationRef
  • func NewObservationRef(evidenceRef EvidenceRef, ...) ObservationRef
• type ProofBundle
  • func (bundle *ProofBundle) Validate() error
• type ProofResult
  • func EvaluateProof(bundle ProofBundle) (ProofResult, error)
• type RelationshipRef
  • func NewRelationshipRef(repositoryID, sourceRevision, indexGeneration, relationType string, ...) RelationshipRef
  • func NewRelationshipRefWithArtifact(repositoryID, sourceRevision, indexGeneration, relationType string, ...) RelationshipRef
• type SymbolRef
  • func NewSymbolRef(repositoryID, sourceRevision, relativePath, symbolKind, qualifiedName string, ...) SymbolRef

Constants

const (
	VerdictVerified     = "verified"
	VerdictContradicted = "contradicted"
	VerdictUnresolved   = "unresolved"
	VerdictBlocked      = "blocked"
)

const SchemaVersion = 1

Types

type AnalysisPathStep

type AnalysisPathStep struct {
	Position     int    `json:"position"`
	Role         string `json:"role"`
	RelativePath string `json:"relative_path"`
	StartLine    int    `json:"start_line"`
	StartColumn  int    `json:"start_column"`
	EndLine      int    `json:"end_line"`
	EndColumn    int    `json:"end_column"`
}

type AnalysisRef

type AnalysisRef struct {
	ID                      string             `json:"id"`
	SchemaVersion           int                `json:"schema_version"`
	RepositoryID            string             `json:"repository_id"`
	SourceRevision          string             `json:"source_revision"`
	IndexGeneration         string             `json:"index_generation"`
	AnalysisKind            string             `json:"analysis_kind"`
	Analyzer                string             `json:"analyzer"`
	AnalyzerVersion         string             `json:"analyzer_version"`
	ExtractorVersion        string             `json:"extractor_version"`
	Language                string             `json:"language"`
	DatabaseManifestSHA256  string             `json:"database_manifest_sha256"`
	DatabaseContentSHA256   string             `json:"database_content_sha256"`
	DatabaseQuality         DatabaseQuality    `json:"database_quality"`
	QueryPackManifestSHA256 string             `json:"query_pack_manifest_sha256"`
	QueryAttestationSHA256  string             `json:"query_attestation_sha256,omitempty"`
	SARIFSHA256             string             `json:"sarif_sha256"`
	QueryID                 string             `json:"query_id"`
	ResultIndex             int                `json:"result_index"`
	CodeFlowIndex           int                `json:"code_flow_index"`
	ThreadFlowIndex         int                `json:"thread_flow_index"`
	PathSteps               []AnalysisPathStep `json:"path_steps"`
}

func NewAttestedCodeQLAnalysisRef

func NewAttestedCodeQLAnalysisRef(
	repositoryID, sourceRevision, indexGeneration,
	analyzerVersion, extractorVersion, language,
	databaseManifestSHA256, databaseContentSHA256 string,
	databaseQuality DatabaseQuality,
	queryPackManifestSHA256, sarifSHA256, queryAttestationSHA256, queryID string,
	resultIndex, codeFlowIndex, threadFlowIndex int,
	pathSteps []AnalysisPathStep,
) AnalysisRef

NewAttestedCodeQLAnalysisRef additionally binds the operator-owned receipt that classifies the selected CodeQL query as variable-level taint analysis. An un-attested CodeQL path remains useful source evidence but cannot satisfy the variable_level_taint assurance capability.

func NewCodeQLAnalysisRef

func NewCodeQLAnalysisRef(
	repositoryID, sourceRevision, indexGeneration,
	analyzerVersion, extractorVersion, language,
	databaseManifestSHA256, databaseContentSHA256 string,
	databaseQuality DatabaseQuality,
	queryPackManifestSHA256, sarifSHA256, queryID string,
	resultIndex, codeFlowIndex, threadFlowIndex int,
	pathSteps []AnalysisPathStep,
) AnalysisRef

NewCodeQLAnalysisRef binds one selected SARIF code-flow to its analyzer, database, query pack, repository revision, and ordered path coordinates.

type AssuranceLattice

type AssuranceLattice struct {
	RequiredCapabilities             []string `json:"required_capabilities"`
	SupportingCapabilities           []string `json:"supporting_capabilities"`
	ContradictingCapabilities        []string `json:"contradicting_capabilities"`
	MissingSupportingCapabilities    []string `json:"missing_supporting_capabilities"`
	MissingContradictingCapabilities []string `json:"missing_contradicting_capabilities"`
	SatisfiedBy                      *string  `json:"satisfied_by"`
}

type AssuranceRequirement

type AssuranceRequirement struct {
	RequiredCapabilities []string `json:"required_capabilities"`
}

type ClaimRef

type ClaimRef struct {
	ID            string `json:"id"`
	SchemaVersion int    `json:"schema_version"`
	RepositoryID  string `json:"repository_id"`
	ClaimKind     string `json:"claim_kind"`
	ClaimText     string `json:"claim_text"`
}

func NewClaimRef

func NewClaimRef(repositoryID, claimKind, claimText string) ClaimRef

type Confidence

type Confidence struct {
	Band      string   `json:"band"`
	Rationale []string `json:"rationale"`
}

type ContradictionSearch

type ContradictionSearch struct {
	Performed      bool   `json:"performed"`
	Strategy       string `json:"strategy"`
	CandidateCount int    `json:"candidate_count"`
}

type Coverage

type Coverage struct {
	State      string `json:"state"`
	Examined   int    `json:"examined"`
	Expected   *int   `json:"expected"`
	Unresolved int    `json:"unresolved"`
}

type DatabaseQuality

type DatabaseQuality struct {
	Status          string `json:"status"`
	SourceFiles     int    `json:"source_files"`
	BaselineLines   int    `json:"baseline_lines"`
	ExtractorErrors int    `json:"extractor_errors"`
}

type EvidenceRef

type EvidenceRef struct {
	ID              string           `json:"id"`
	SchemaVersion   int              `json:"schema_version"`
	RepositoryID    string           `json:"repository_id"`
	SourceRevision  string           `json:"source_revision"`
	IndexGeneration string           `json:"index_generation"`
	RelativePath    string           `json:"relative_path"`
	StartLine       int              `json:"start_line"`
	EndLine         int              `json:"end_line"`
	EvidenceType    string           `json:"evidence_type"`
	SymbolRef       *SymbolRef       `json:"symbol_ref,omitempty"`
	RelationshipRef *RelationshipRef `json:"relationship_ref,omitempty"`
	AnalysisRef     *AnalysisRef     `json:"analysis_ref,omitempty"`
}

func NewAnalysisEvidenceRef

func NewAnalysisEvidenceRef(analysisRef AnalysisRef) EvidenceRef

NewAnalysisEvidenceRef anchors the evidence location to the source step of the externally analyzed path and copies the full immutable analysis record.

func NewEvidenceRef

func NewEvidenceRef(repositoryID, sourceRevision, indexGeneration, relativePath string, startLine, endLine int, evidenceType string, symbolRef *SymbolRef) EvidenceRef

func NewRelationshipEvidenceRef

func NewRelationshipEvidenceRef(relationshipRef RelationshipRef, evidenceType string) EvidenceRef

NewRelationshipEvidenceRef copies the relationship into the evidence ref so the generated evidence ID remains stable after construction.

type IndexState

type IndexState struct {
	Coherent        bool   `json:"coherent"`
	Freshness       string `json:"freshness"`
	IndexGeneration string `json:"index_generation"`
}

type InvariantResult

type InvariantResult struct {
	ID         string `json:"id"`
	Status     string `json:"status"`
	Checked    int    `json:"checked"`
	Violations int    `json:"violations"`
	Unresolved int    `json:"unresolved"`
}

type ObservationRef

type ObservationRef struct {
	ID             string      `json:"id"`
	SchemaVersion  int         `json:"schema_version"`
	EvidenceRef    EvidenceRef `json:"evidence_ref"`
	Stance         string      `json:"stance"`
	SourceEngine   string      `json:"source_engine"`
	Derivation     string      `json:"derivation"`
	ConfidenceBand string      `json:"confidence_band"`
}

func NewObservationRef

func NewObservationRef(evidenceRef EvidenceRef, stance, sourceEngine, derivation, confidenceBand string) ObservationRef

NewObservationRef copies its evidence so the observation remains bound to the exact canonical evidence contents used to derive its ID.

type ProofBundle

type ProofBundle struct {
	SchemaVersion        int                   `json:"schema_version"`
	Claim                ClaimRef              `json:"claim"`
	IndexState           IndexState            `json:"index_state"`
	AssuranceRequirement *AssuranceRequirement `json:"assurance_requirement,omitempty"`
	Observations         []ObservationRef      `json:"observations"`
	ContradictionSearch  ContradictionSearch   `json:"contradiction_search"`
	Coverage             Coverage              `json:"coverage"`
	Invariant            *InvariantResult      `json:"invariant,omitempty"`
}

func (*ProofBundle) Validate

func (bundle *ProofBundle) Validate() error

type ProofResult

type ProofResult struct {
	ProofID                     string              `json:"proof_id"`
	SchemaVersion               int                 `json:"schema_version"`
	ClaimID                     string              `json:"claim_id"`
	IndexGeneration             string              `json:"index_generation"`
	Verdict                     string              `json:"verdict"`
	SupportingObservationIDs    []string            `json:"supporting_observation_ids"`
	ContradictingObservationIDs []string            `json:"contradicting_observation_ids"`
	Blockers                    []string            `json:"blockers"`
	Caveats                     []string            `json:"caveats"`
	Confidence                  Confidence          `json:"confidence"`
	Coverage                    Coverage            `json:"coverage"`
	ContradictionSearch         ContradictionSearch `json:"contradiction_search"`
	Invariant                   *InvariantResult    `json:"invariant,omitempty"`
	AssuranceLattice            AssuranceLattice    `json:"assurance_lattice"`
}

func EvaluateProof

func EvaluateProof(bundle ProofBundle) (ProofResult, error)

EvaluateProof works from a value copy so evaluation cannot mutate caller-owned evidence.

type RelationshipRef

type RelationshipRef struct {
	ID                       string    `json:"id"`
	SchemaVersion            int       `json:"schema_version"`
	RepositoryID             string    `json:"repository_id"`
	SourceRevision           string    `json:"source_revision"`
	IndexGeneration          string    `json:"index_generation"`
	RelationType             string    `json:"relation_type"`
	SourceSymbolRef          SymbolRef `json:"source_symbol_ref"`
	TargetSymbolRef          SymbolRef `json:"target_symbol_ref"`
	ResolutionSource         string    `json:"resolution_source"`
	ResolutionArtifactSHA256 string    `json:"resolution_artifact_sha256,omitempty"`
	ConfidenceBand           string    `json:"confidence_band"`
	RuntimeObserved          bool      `json:"runtime_observed"`
	ObservationCount         int       `json:"observation_count"`
}

RelationshipRef is an immutable assertion about one graph edge in one index generation. It carries the resolver provenance that ordinary source-location evidence cannot express and can record runtime confirmation without replacing the underlying static relationship.

func NewRelationshipRef

func NewRelationshipRef(
	repositoryID, sourceRevision, indexGeneration, relationType string,
	sourceSymbolRef, targetSymbolRef SymbolRef,
	resolutionSource, confidenceBand string,
	runtimeObserved bool,
	observationCount int,
) RelationshipRef

NewRelationshipRef copies both symbol refs so later caller mutation cannot change the canonical relationship contents after its ID is derived.

func NewRelationshipRefWithArtifact

func NewRelationshipRefWithArtifact(
	repositoryID, sourceRevision, indexGeneration, relationType string,
	sourceSymbolRef, targetSymbolRef SymbolRef,
	resolutionSource, resolutionArtifactSHA256, confidenceBand string,
	runtimeObserved bool,
	observationCount int,
) RelationshipRef

NewRelationshipRefWithArtifact additionally binds the immutable analyzer artifact that produced a compiler-derived relationship. Empty artifact digests remain omitted so pre-artifact relationship vectors keep their IDs.

type SymbolRef

type SymbolRef struct {
	ID             string `json:"id"`
	SchemaVersion  int    `json:"schema_version"`
	RepositoryID   string `json:"repository_id"`
	SourceRevision string `json:"source_revision"`
	RelativePath   string `json:"relative_path"`
	SymbolKind     string `json:"symbol_kind"`
	QualifiedName  string `json:"qualified_name"`
	StartLine      int    `json:"start_line"`
	EndLine        int    `json:"end_line"`
}

func NewSymbolRef

func NewSymbolRef(repositoryID, sourceRevision, relativePath, symbolKind, qualifiedName string, startLine, endLine int) SymbolRef