Security Assurance

A local governed assessment of supplied finding snapshots. The security:assess read tool normalizes, deduplicates, evaluates consumer policy and returns an inspectable report. It does not run scanners, dereference locations, validate vulnerability claims, or write to providers. Every finding remains UNVALIDATED. A policy pass is not a security certification.

The ESM package exports assessSecurity, SecurityConfigSchema and SecurityInputSchema; the assessment subpath exposes the assessment function. The build bundles the assessment handler and its dependencies into one artifact for the kernel sandbox, which exposes only the verified handler file. The bundled zod 4.6.1 upstream MIT notice and provenance ship in THIRD_PARTY_NOTICES.txt, with the first-party LICENSE, in the package and the CLI bundled copy. The bundled host explicitly registers trusted-host-adapter:security-assurance. The installed runtime supplies canonical pack_config; caller input and metadata cannot set policy. No pack-specific CLI command is declared.

Installation and dispatch

Install the licensed CLI using the licence setup guide, initialize a workspace, then use the supported pack and configuration commands:

pnpm exec pack-install --help
pnpm exec pack-install --id security-assurance --source builtin --version 1.0.7
pnpm exec config-set --help
pnpm exec config-set --key security_assurance.severity_threshold --value high
pnpm exec config-set --key security_assurance.accepted_rules --json-value '["RULE-1"]'
pnpm exec config-get --key security_assurance.severity_threshold
pnpm exec config-unset --key security_assurance.accepted_rules

Run each command’s help before first use. Repository scripts expose the same commands as pnpm pack:install and pnpm config:set/get/unset. Always configure through these commands; the pack pin and consumer settings have separate owners.

A host binds a claimed task/run/session and dispatches security:assess through its governed tool interface, for example caller.executeToolWithReceipt('security:assess', input, selector). Enroll network posture off in the complete workspace security and selected lanes roots through config-set --json-value, preserving existing scopes and deny rules, and declare it on the persisted task. All four workspace/lane/task/tool scope sets must have a nonempty intersection; an empty set denies execution. The installed host resolves the pinned CLI bundle, freezes canonical workspace configuration, and passes it to the subprocess worker. Reports and execution receipts are separate evidence. The pack adds no standalone assessment CLI command. See the tool reference and consumer configuration guide.

Consumer policy

Configure security_assurance with supported config:set, config:get and config:unset commands after pack:install --id security-assurance --source builtin --version 1.0.7. The shipped strict schema accepts only:

Key	Default	Meaning
severity_threshold	high	low, medium, high or critical; block at or above it
accepted_rules	[]	Exact rule exceptions; retain evidence as unvalidated and accepted
max_findings	1000	Occurrences across all sources before dedupe, from 1 to 10000
max_bytes	1048576	UTF-8 bytes of serialized input before parsing, from 1 to 4194304

Effective defaults and sorted unique exceptions are returned with a SHA-256 configuration digest. Unknown settings and invalid bounds are refused.

Supplied input

{
  "sources": [
    {
      "source_id": "snapshot-a",
      "format": "normalized",
      "data": {
        "findings": [
          {
            "rule_id": "RULE-1",
            "severity": "high",
            "message": "Supplied finding",
            "location": { "uri": "src/example.ts", "start_line": 7 }
          }
        ]
      }
    }
  ]
}

Source IDs are unique, 1–128 characters, start with an ASCII letter or digit and then contain letters, digits, dot, underscore, colon or hyphen. At most 64 sources are accepted. Every object in the supported payload is strict.

Normalized findings require rule_id (1–128 characters), severity, and message (1–8192 characters). Optional location has uri (1–2048 characters) and optional start_line, start_column, end_line, end_column positive safe integers. Coordinates require a start line. End line cannot precede start line; an end column on the same line cannot precede start column (default 1). URI-only locations are accepted. Locations are inert supplied text.

For format: sarif, the documented SARIF 2.1.0 subset requires version: 2.1.0, runs[], tool.driver.name and optional driver version, and results[] with ruleId, explicit level (error → high, warning → medium, note → low), message.text, optional absent/fail kind and optional GUID-valued guid. At most one direct location is supported per result: physicalLocation with artifactLocation.uri and optional region using required startLine and optional startColumn, endLine, endColumn, with the same forward-range rules. The official SARIF $schema URI is optional. Descriptor-derived levels, externalized properties, other kinds, multiple locations, and unknown fields are refused clearly. This is a supported subset, not full SARIF conformance.

Evidence

Reports retain original source IDs and SHA-256 digests of each supplied data serialized with JSON.stringify; source key order therefore matters to its digest. Findings deduplicate only when rule, severity, message and supported location match. Every occurrence retains source-local index or SARIF run/result, GUID and tool provenance. Findings and origins have deterministic ordering. Recommendations ask the reader to review the cited evidence before selecting remediation; they do not invent vulnerability-specific fixes.

The manifest rejects malformed outer envelopes and unknown root fields before dispatch with INVALID_INPUT. It preserves raw source snapshots and their key order for the handler. Malformed snapshot content returns SECURITY_INPUT_INVALID, budget overflow returns SECURITY_INPUT_LIMIT, and invalid canonical policy returns SECURITY_CONFIG_INVALID. Empty findings explicitly disclaim certification.

Billing and marketplace charging remain future, unvalidated capabilities.