fiber_audit 0.3.0 → 0.3.1

data/lib/fiber_audit/runtime/operation_liveness_monitor.rb

@@ -0,0 +1,282 @@
+# frozen_string_literal: true
+
+require_relative 'active_operations'
+require_relative 'clock'
+require_relative 'event'
+require_relative 'operation_liveness_policy'
+require_relative 'recorder'
+require_relative 'scheduler_evidence_classifier'
+
+module FiberAudit
+  module Runtime
+    class OperationLivenessMonitor
+      SOURCE = :operation_liveness_monitor
+      STOP_TIMEOUT_SECONDS = 1
+      MAX_START_EVENTS_PER_POLL = 10
+      Tracked = Data.define(:long_active_sequence, :entry)
+
+      attr_reader :policy, :recorder, :active_operations, :state
+
+      def initialize(policy:, recorder:, active_operations:, clock: Clock.new,
+                     thread_factory: ->(&block) { Thread.new(&block) })
+        validate_dependencies!(policy, recorder, active_operations, clock, thread_factory)
+        @policy = policy
+        @recorder = recorder
+        @active_operations = active_operations
+        @clock = clock
+        @thread_factory = thread_factory
+        @poll_mutex = Mutex.new
+        @wait_mutex = Mutex.new
+        @condition = ConditionVariable.new
+        @tracked = {}
+        @long_active_sequence = 0
+        @monitor_thread = nil
+        @state = policy.enabled? ? :starting : :disabled
+        @stopping = false
+        @stopped = false
+        activate!
+      end
+
+      def enabled? = policy.enabled?
+      def fail_open? = recorder.session.policy.fail_open?
+
+      def poll(now_ns: nil)
+        return state unless enabled? && state == :active
+
+        observed_now = now_ns.nil? ? @clock.monotonic_ns : Validation.integer(now_ns, 'operation liveness poll time')
+        @poll_mutex.synchronize { poll_operations(observed_now) }
+        state
+      rescue StandardError => e
+        handle_failure(e)
+        raise e unless fail_open?
+
+        :unsupported
+      end
+
+      def stop
+        return self if @stopped
+
+        @wait_mutex.synchronize do
+          @stopping = true
+          @condition.broadcast
+        end
+        stop_monitor_thread
+        now_ns = safe_monotonic_ns
+        @poll_mutex.synchronize { close_tracked(now_ns, operation_finished: false) }
+        @stopped = true
+        self
+      rescue StandardError => e
+        handle_failure(e)
+        @stopped = true
+        raise e unless fail_open?
+
+        self
+      end
+
+      private
+
+      def activate!
+        if policy.enabled?
+          start_monitor_thread
+          @state = :active
+          emit_state(:operation_liveness_active)
+        else
+          emit_state(:operation_liveness_disabled)
+        end
+      rescue StandardError => e
+        handle_failure(e)
+        raise e unless fail_open?
+      end
+
+      def validate_dependencies!(candidate_policy, candidate_recorder, operations, candidate_clock, threads)
+        unless candidate_policy.is_a?(OperationLivenessPolicy)
+          raise RuntimeContractError, 'policy must be a FiberAudit::Runtime::OperationLivenessPolicy'
+        end
+        unless candidate_recorder.is_a?(Recorder)
+          raise RuntimeContractError,
+                'recorder must be a FiberAudit::Runtime::Recorder'
+        end
+        unless operations.is_a?(ActiveOperations)
+          raise RuntimeContractError, 'active_operations must be FiberAudit::Runtime::ActiveOperations'
+        end
+        raise RuntimeContractError, 'clock must be a FiberAudit::Runtime::Clock' unless candidate_clock.is_a?(Clock)
+        raise RuntimeContractError, 'thread_factory must respond to call' unless threads.respond_to?(:call)
+      end
+
+      def poll_operations(now_ns)
+        snapshot = active_operations.snapshot_with_metadata
+        current = snapshot.entries.to_h { |entry| [entry.sequence, entry] }
+        complete_absent(current, now_ns)
+        start_overdue(snapshot, current, now_ns)
+      end
+
+      def complete_absent(current, now_ns)
+        @tracked.keys.reject { |sequence| current.key?(sequence) }.each do |sequence|
+          emit_completion(@tracked.delete(sequence), now_ns, operation_finished: true)
+        end
+      end
+
+      def start_overdue(snapshot, current, now_ns)
+        overdue = current.values.reject do |entry|
+          @tracked.key?(entry.sequence) || !long_active?(entry, now_ns)
+        end
+        bounded = overdue.first(MAX_START_EVENTS_PER_POLL)
+        batch_truncated = overdue.size > bounded.size
+        bounded.each do |entry|
+          @long_active_sequence += 1
+          tracked = Tracked.new(long_active_sequence: @long_active_sequence, entry: entry)
+          @tracked[entry.sequence] = tracked
+          emit_start(tracked, now_ns, snapshot, batch_truncated, overdue.size)
+        end
+      end
+
+      def long_active?(entry, now_ns)
+        raise RuntimeSafetyError, 'operation liveness clock moved backwards' if now_ns < entry.started_monotonic_ns
+
+        policy.long_active?(age_ns: now_ns - entry.started_monotonic_ns)
+      end
+
+      def classifier_measurements(entry)
+        SchedulerEvidenceClassifier.measurements(
+          operation: entry.operation,
+          scheduler_snapshot: entry.scheduler_snapshot
+        )
+      end
+
+      def emit_start(tracked, now_ns, snapshot, batch_truncated, candidate_count)
+        entry = tracked.entry
+        age_ns = now_ns - entry.started_monotonic_ns
+        measurements = {
+          long_active_sequence: tracked.long_active_sequence,
+          operation_sequence: entry.sequence,
+          operation_started_monotonic_ns: entry.started_monotonic_ns,
+          observed_age_ns: age_ns,
+          long_active_threshold_ns: policy.long_active_threshold_ns,
+          poll_interval_ns: policy.poll_interval_ns,
+          active_operation_total_count: snapshot.total_count,
+          active_operation_snapshot_truncated: snapshot.truncated?,
+          long_active_batch_truncated: batch_truncated,
+          long_active_candidate_count: candidate_count
+        }
+        measurements.merge!(entry.scheduler_snapshot.to_measurements) if entry.scheduler_snapshot
+        measurements.merge!(classifier_measurements(entry))
+        emit_event(kind: :operation_long_active_started, entry: entry, monotonic_ns: now_ns,
+                   duration_ns: age_ns, measurements: measurements)
+      end
+
+      def emit_completion(tracked, now_ns, operation_finished:)
+        entry = tracked.entry
+        duration_ns = [now_ns - entry.started_monotonic_ns, 0].max
+        measurements = {
+          long_active_sequence: tracked.long_active_sequence,
+          operation_sequence: entry.sequence,
+          operation_started_monotonic_ns: entry.started_monotonic_ns,
+          long_active_threshold_ns: policy.long_active_threshold_ns,
+          operation_finished: operation_finished
+        }
+        measurements.merge!(entry.scheduler_snapshot.to_measurements) if entry.scheduler_snapshot
+        measurements.merge!(classifier_measurements(entry))
+        emit_event(kind: :operation_long_active_completed, entry: entry, monotonic_ns: now_ns,
+                   duration_ns: duration_ns, measurements: measurements)
+      end
+
+      def close_tracked(now_ns, operation_finished:)
+        tracked = @tracked.values
+        @tracked.clear
+        tracked.each { |entry| emit_completion(entry, now_ns, operation_finished: operation_finished) }
+      end
+
+      def emit_state(kind)
+        emit_event(kind: kind, entry: nil, monotonic_ns: @clock.monotonic_ns,
+                   measurements: { poll_interval_ns: policy.poll_interval_ns,
+                                   long_active_threshold_ns: policy.long_active_threshold_ns })
+      end
+
+      def emit_event(kind:, entry:, monotonic_ns:, duration_ns: nil, measurements: {})
+        recorder.record_control do
+          Event.new(
+            kind: kind,
+            source: SOURCE,
+            occurred_at: @clock.wall_time,
+            monotonic_ns: monotonic_ns,
+            duration_ns: duration_ns,
+            operation: entry&.operation,
+            location: entry&.location,
+            execution_context: entry&.execution_context || :unknown,
+            thread_id: entry&.thread_id,
+            fiber_id: entry&.fiber_id,
+            measurements: measurements
+          )
+        end
+      end
+
+      def start_monitor_thread
+        thread = @thread_factory.call { monitor_loop }
+        raise RuntimeContractError, 'thread_factory must return a Thread' unless thread.is_a?(Thread)
+
+        @monitor_thread = thread
+        thread.report_on_exception = false
+        thread.abort_on_exception = !fail_open?
+        thread.name = 'fiber-audit-operation-liveness' if thread.respond_to?(:name=)
+      end
+
+      def monitor_loop
+        loop do
+          should_stop = @wait_mutex.synchronize do
+            @condition.wait(@wait_mutex, policy.poll_interval_ms.fdiv(1_000)) unless @stopping
+            @stopping
+          end
+          break if should_stop
+
+          poll
+        end
+      rescue StandardError => e
+        handle_failure(e)
+        raise e unless fail_open?
+      end
+
+      def stop_monitor_thread
+        thread = @monitor_thread
+        return unless thread && thread != Thread.current
+        return if thread.join(STOP_TIMEOUT_SECONDS)
+
+        account_internal_error
+        thread.kill
+        thread.join
+      ensure
+        @monitor_thread = nil
+      end
+
+      def handle_failure(error)
+        first_failure = @state != :unsupported
+        @state = :unsupported
+        @wait_mutex&.synchronize do
+          @stopping = true
+          @condition&.broadcast
+        end
+        account_internal_error
+        begin
+          emit_state(:operation_liveness_unsupported) if first_failure
+        rescue StandardError
+          nil
+        end
+        error
+      end
+
+      def account_internal_error
+        recorder.internal_error!
+      rescue StandardError
+        nil
+      end
+
+      def safe_monotonic_ns
+        @clock.monotonic_ns
+      rescue StandardError => e
+        account_internal_error
+        raise e unless fail_open?
+
+        recorder.session.started_monotonic_ns
+      end
+    end
+  end
+end

data/lib/fiber_audit/runtime/operation_liveness_policy.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+require_relative 'validation'
+
+module FiberAudit
+  module Runtime
+    OperationLivenessPolicy = Data.define(:enabled, :poll_interval_ms, :long_active_threshold_ms) do
+      def initialize(**values)
+        unknown = values.keys - OperationLivenessPolicy::DEFAULTS.keys
+        raise RuntimeContractError, "unknown operation liveness policy field: #{unknown.first}" unless unknown.empty?
+
+        fields = OperationLivenessPolicy::DEFAULTS.merge(values)
+        raise RuntimeContractError, 'enabled must be a Boolean' unless [true, false].include?(fields[:enabled])
+
+        limits = OperationLivenessPolicy::LIMITS.to_h do |name, range|
+          value = fields.fetch(name)
+          unless value.is_a?(Integer) && range.cover?(value)
+            raise RuntimeContractError, "#{name} must be an Integer in #{range}"
+          end
+
+          [name, value]
+        end
+        super(enabled: fields[:enabled], **limits)
+      end
+
+      def enabled? = enabled
+      def poll_interval_ns = poll_interval_ms * OperationLivenessPolicy::NANOSECONDS_PER_MILLISECOND
+      def long_active_threshold_ns = long_active_threshold_ms * OperationLivenessPolicy::NANOSECONDS_PER_MILLISECOND
+
+      def long_active?(age_ns:)
+        Validation.integer(age_ns, 'active operation age') > long_active_threshold_ns
+      end
+    end
+
+    OperationLivenessPolicy.const_set(:NANOSECONDS_PER_MILLISECOND, 1_000_000)
+    OperationLivenessPolicy.const_set(:DEFAULTS, {
+      enabled: true,
+      poll_interval_ms: 100,
+      long_active_threshold_ms: 1_000
+    }.freeze)
+    OperationLivenessPolicy.const_set(:LIMITS, {
+      poll_interval_ms: 1..60_000,
+      long_active_threshold_ms: 1..86_400_000
+    }.freeze)
+    OperationLivenessPolicy.const_set(:DISABLED, OperationLivenessPolicy.new(enabled: false))
+  end
+end

data/lib/fiber_audit/runtime/probes/base.rb

@@ -7,6 +7,7 @@ require_relative '../execution_context'
 require_relative '../rails_integration'
 require_relative '../recorder'
 require_relative '../redactor'
+require_relative '../scheduler_evidence_classifier'
 require_relative '../scheduler_snapshot'
 
 module FiberAudit
@@ -216,14 +217,12 @@ module FiberAudit
             values.merge!(generated)
           end
           values[:operation_sequence] = observation.handle&.sequence
-          # Include scheduler snapshot measurements (immutable, captured at operation start)
-          values.merge!(observation.scheduler_snapshot.to_measurements) if observation.scheduler_snapshot
-          values
+          enrich_scheduler_evidence(values, observation)
         end
 
         def emit_observation(kind, observation, monotonic_ns:, duration_ns: nil, measurements: nil)
           values = measurements || observation.measurements.merge(operation_sequence: observation.handle&.sequence)
-          values = merge_scheduler_measurements_for_emit(values.dup, observation.scheduler_snapshot)
+          values = enrich_scheduler_evidence(values.dup, observation)
           recorder.record do
             Event.new(
               kind: kind,
@@ -241,12 +240,15 @@ module FiberAudit
           end
         end
 
-        def merge_scheduler_measurements_for_emit(values, scheduler_snapshot)
-          return values unless scheduler_snapshot
-
-          scheduler_snapshot.to_measurements.each do |key, value|
-            values[key.to_sym] = value unless values.key?(key.to_sym)
-          end
+        def enrich_scheduler_evidence(values, observation)
+          snapshot = observation.scheduler_snapshot
+          values.merge!(snapshot.to_measurements) if snapshot
+          values.merge!(
+            SchedulerEvidenceClassifier.measurements(
+              operation: observation.operation,
+              scheduler_snapshot: snapshot
+            )
+          )
           values
         end
 

data/lib/fiber_audit/runtime/scheduler_evidence_classifier.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require_relative '../operation_semantics'
+require_relative 'scheduler_snapshot'
+
+module FiberAudit
+  module Runtime
+    module SchedulerEvidenceClassifier
+      module_function
+
+      def measurements(operation:, scheduler_snapshot:)
+        unless scheduler_snapshot.nil? || scheduler_snapshot.is_a?(SchedulerSnapshot)
+          raise RuntimeContractError, 'scheduler_snapshot must be a SchedulerSnapshot or nil'
+        end
+
+        profile = OperationSemantics.resolve_runtime_operation(operation)
+        capability_supported = capability_supported(profile.scheduler_capability, scheduler_snapshot)
+        {
+          operation_wait_possible: profile.wait_possible,
+          operation_inventory_only: profile.inventory_only,
+          operation_scheduler_capability_required: profile.known? ? profile.scheduler_capability_required? : nil,
+          operation_scheduler_capability_supported: capability_supported,
+          operation_scheduler_cooperation_available: cooperation_available(
+            profile,
+            scheduler_snapshot,
+            capability_supported
+          )
+        }.freeze
+      end
+
+      def capability_supported(capability, snapshot)
+        return nil if capability.nil? || snapshot.nil?
+
+        case capability
+        when :block, :kernel_sleep
+          snapshot.scheduler_present
+        when :io_select
+          snapshot.scheduler_io_select_supported
+        when :process_wait
+          snapshot.scheduler_process_wait_supported
+        when :address_resolve
+          snapshot.scheduler_address_resolve_supported
+        end
+      end
+      private_class_method :capability_supported
+
+      def cooperation_available(profile, snapshot, capability_supported)
+        return nil unless profile.wait_possible == true
+        return nil if snapshot.nil? || snapshot.scheduler_present.nil?
+        return false unless snapshot.scheduler_present
+        return nil if snapshot.fiber_blocking.nil?
+        return false if snapshot.fiber_blocking
+        return nil unless profile.scheduler_capability_required?
+
+        capability_supported
+      end
+      private_class_method :cooperation_available
+    end
+  end
+end

data/lib/fiber_audit/runtime/scheduler_snapshot.rb

@@ -19,8 +19,8 @@ module FiberAudit
         scheduler_address_resolve_supported: nil
       )
         super(
-          scheduler_present: normalize_boolean(scheduler_present, 'scheduler_present'),
-          fiber_blocking: normalize_boolean(fiber_blocking, 'fiber_blocking'),
+          scheduler_present: normalize_optional_boolean(scheduler_present, 'scheduler_present'),
+          fiber_blocking: normalize_optional_boolean(fiber_blocking, 'fiber_blocking'),
           scheduler_io_select_supported: normalize_optional_boolean(
             scheduler_io_select_supported,
             'scheduler_io_select_supported'
@@ -48,12 +48,6 @@ module FiberAudit
 
       private
 
-      def normalize_boolean(value, field)
-        raise RuntimeContractError, "#{field} must be a Boolean" unless [true, false].include?(value)
-
-        value
-      end
-
       def normalize_optional_boolean(value, field)
         return value if value.nil?
         raise RuntimeContractError, "#{field} must be a Boolean or nil" unless [true, false].include?(value)
@@ -71,17 +65,8 @@ module FiberAudit
         scheduler = Fiber.scheduler
         scheduler_present = !scheduler.nil?
 
-        # Normalize Fiber#blocking? to Boolean
-        fiber_blocking = begin
-          current_fiber = Fiber.current
-          if current_fiber.respond_to?(:blocking?)
-            !current_fiber.blocking?.nil?
-          else
-            false
-          end
-        rescue StandardError
-          false
-        end
+        current_fiber = Fiber.current
+        fiber_blocking = current_fiber.respond_to?(:blocking?) ? current_fiber.blocking? : nil
 
         # Query scheduler capabilities if present
         io_select_supported = nil
@@ -102,11 +87,8 @@ module FiberAudit
           scheduler_address_resolve_supported: address_resolve_supported
         )
       rescue StandardError
-        # Fail open: return a safe default snapshot
-        SchedulerSnapshot.new(
-          scheduler_present: false,
-          fiber_blocking: false
-        )
+        # Fail open without inventing scheduler or Fiber state.
+        SchedulerSnapshot.new(scheduler_present: nil, fiber_blocking: nil)
       end
     end
   end

data/lib/fiber_audit/runtime/watchdog.rb

@@ -6,6 +6,7 @@ require_relative 'event'
 require_relative 'heartbeat'
 require_relative 'recorder'
 require_relative 'redactor'
+require_relative 'scheduler_evidence_classifier'
 require_relative 'watchdog_policy'
 
 module FiberAudit
@@ -260,6 +261,7 @@ module FiberAudit
         start_stall(channel, snapshot, age_ns, now_ns) if policy.stalled?(age_ns: age_ns)
       end
 
+      # rubocop:disable Metrics/AbcSize
       def start_stall(channel, snapshot, age_ns, now_ns)
         @stall_sequence += 1
         channel.stall = Stall.new(
@@ -267,7 +269,8 @@ module FiberAudit
           progress_sequence: snapshot.sequence,
           began_monotonic_ns: snapshot.last_progress_ns
         )
-        operations = active_operations.snapshot(thread_id: snapshot.thread_id)
+        operation_snapshot = active_operations.snapshot_with_metadata(thread_id: snapshot.thread_id)
+        operations = operation_snapshot.entries
         frames = safe_frames(channel.thread)
         measurements = {
           stall_sequence: @stall_sequence,
@@ -276,7 +279,8 @@ module FiberAudit
           stall_threshold_ns: policy.stall_threshold_ns,
           heartbeat_interval_ns: policy.heartbeat_interval_ns,
           frame_count: frames.size,
-          active_operation_count: operations.size,
+          active_operation_count: operation_snapshot.total_count,
+          active_operation_snapshot_truncated: operation_snapshot.truncated?,
           active_operation_first_sequence: operations.first&.sequence,
           active_operation_last_sequence: operations.last&.sequence
         }
@@ -297,17 +301,16 @@ module FiberAudit
             measurements: { stall_sequence: @stall_sequence, frame_index: index }
           )
         end
-        emit_stall_operation_overlap_events(operations, now_ns, snapshot)
+        emit_stall_operation_overlap_events(operations, operation_snapshot.total_count, now_ns)
       end
+      # rubocop:enable Metrics/AbcSize
 
-      def emit_stall_operation_overlap_events(operations, now_ns, _snapshot)
+      def emit_stall_operation_overlap_events(operations, total_count, now_ns)
         return if operations.empty?
 
-        truncated = operations.size > MAX_OVERLAP_EVENTS
         bounded_operations = operations.first(MAX_OVERLAP_EVENTS)
-
+        truncated = total_count > bounded_operations.size
         bounded_operations.each do |entry|
-          overlap_measurements = build_overlap_measurements(entry, truncated, operations.size)
           emit_event(
             kind: :scheduler_stall_operation_overlap,
             monotonic_ns: now_ns,
@@ -316,7 +319,7 @@ module FiberAudit
             execution_context: entry.execution_context,
             thread_id: entry.thread_id,
             fiber_id: entry.fiber_id,
-            measurements: overlap_measurements
+            measurements: build_overlap_measurements(entry, truncated, total_count)
           )
         end
       rescue StandardError => e
@@ -334,7 +337,12 @@ module FiberAudit
         }
 
         measurements.merge!(entry.scheduler_snapshot.to_measurements) if entry.scheduler_snapshot
-
+        measurements.merge!(
+          SchedulerEvidenceClassifier.measurements(
+            operation: entry.operation,
+            scheduler_snapshot: entry.scheduler_snapshot
+          )
+        )
         measurements
       end
 

data/lib/fiber_audit/runtime.rb

@@ -3,10 +3,12 @@
 require_relative 'version'
 require_relative 'errors'
 require_relative 'operation_vocabulary'
+require_relative 'operation_semantics'
 require_relative 'execution_context'
 require_relative 'runtime/validation'
 require_relative 'runtime/policy'
 require_relative 'runtime/watchdog_policy'
+require_relative 'runtime/operation_liveness_policy'
 require_relative 'runtime/location'
 require_relative 'runtime/event'
 require_relative 'runtime/session'
@@ -23,7 +25,9 @@ require_relative 'runtime/environment'
 require_relative 'runtime/active_operations'
 require_relative 'runtime/heartbeat'
 require_relative 'runtime/scheduler_snapshot'
+require_relative 'runtime/scheduler_evidence_classifier'
 require_relative 'runtime/watchdog'
+require_relative 'runtime/operation_liveness_monitor'
 require_relative 'runtime/scheduler_observer'
 require_relative 'runtime/probes/base'
 require_relative 'runtime/probes/subprocess'

data/lib/fiber_audit/static/rules/blocking_subprocess.rb

@@ -4,6 +4,7 @@ require_relative 'base'
 require_relative '../../findings/evidence'
 require_relative '../../correlation/fingerprint'
 require_relative '../../findings/finding'
+require_relative '../../operation_semantics'
 require_relative '../../operation_vocabulary'
 
 module FiberAudit
@@ -32,31 +33,7 @@ module FiberAudit
         TARGETS = OperationVocabulary::FA1001_TARGETS
         BARE_KERNEL_METHODS = OperationVocabulary::FA1001_KERNEL_METHODS
 
-        # Per-operation semantic category
-        OPERATION_CATEGORY = {
-          # Creation (info) - spawning a new process
-          'Kernel.spawn' => :creation,
-          'Process.spawn' => :creation,
-          # Replacement (info) - replacing current process via exec
-          'Kernel.exec' => :replacement,
-          'Process.exec' => :replacement,
-          # Waiting (medium) - blocking waits for subprocess completion
-          'Kernel.system' => :waiting,
-          'Process.wait' => :waiting,
-          'Process.wait2' => :waiting,
-          'Process.waitpid' => :waiting,
-          'Process.waitpid2' => :waiting,
-          'Process.waitall' => :waiting,
-          'Process::Status.wait' => :waiting,
-          'Open3.capture2' => :waiting,
-          'Open3.capture2e' => :waiting,
-          'Open3.capture3' => :waiting,
-          'Open3.pipeline' => :waiting,
-          # Detach (info) - detaching subprocess without waiting
-          'Process.detach' => :detach,
-          # Stream (medium) - subprocess pipe/stream lifecycle
-          'IO.popen' => :stream
-        }.freeze
+        OPERATION_CATEGORY = OperationSemantics::FA1001_CATEGORIES
 
         # Per-category metadata
         CATEGORY_METADATA = {
@@ -133,7 +110,7 @@ module FiberAudit
         def build_finding(site, match)
           operation = "#{match[:constant]}.#{match[:method]}"
           context = site.execution_context || :unknown
-          category = OPERATION_CATEGORY.fetch(operation, :waiting)
+          category = OperationSemantics.resolve(operation).category
           metadata = CATEGORY_METADATA.fetch(category)
           base_severity = metadata[:severity]
           sev = advisory_severity(base_severity)