fiber_audit 0.3.0 → 0.3.1

data/lib/fiber_audit/static/rules/direct_socket.rb

@@ -4,27 +4,51 @@ require_relative 'base'
 require_relative '../../findings/evidence'
 require_relative '../../correlation/fingerprint'
 require_relative '../../findings/finding'
+require_relative '../../operation_semantics'
 require_relative '../../operation_vocabulary'
 
 module FiberAudit
   module Static
     module Rules
-      # FA1006 – Detects direct socket construction whose DNS, connection, and
-      # later I/O require scheduler cooperation. Advisory rule with :low default.
+      # FA1006: Inventory and semantic classification for direct socket constructors.
       class DirectSocket < Base
         id 'FA1006'
         severity :low
         default_confidence :high
-        description 'Direct socket paths require scheduler-aware DNS and I/O cooperation.'
+        description 'Direct socket constructors range from inventory-only allocation to endpoint setup.'
 
-        TITLE    = 'Direct socket creation'
+        TITLE = 'Direct socket construction'
         CATEGORY = :network
-
         EXACT = OperationVocabulary::FA1006_EXACT
-
-        MESSAGE = 'This socket path may require scheduler cooperation for DNS, connection, or subsequent I/O.'
-        REMEDIATION = 'Distinguish allocation from DNS/connect/I/O, then verify ' \
-                      'the active scheduler hooks and runtime progress.'
+        CATEGORY_METADATA = {
+          socket_allocation: {
+            title: 'Direct socket allocation',
+            message: 'This constructor is inventory-level socket setup without a client connection; ' \
+                     'later accept, connect, address resolution, or I/O may require scheduler cooperation.',
+            remediation: 'Treat allocation as inventory and verify scheduler-aware behavior at later ' \
+                         'accept, connect, resolution, and I/O calls.'
+          },
+          socket_resolve_connect: {
+            title: 'Direct socket endpoint setup',
+            message: 'This constructor may resolve an address and establish a network endpoint, requiring ' \
+                     'scheduler cooperation from address-resolution and I/O hooks.',
+            remediation: 'Verify address_resolve and scheduler-aware I/O hooks, and confirm runtime progress ' \
+                         'for endpoint setup.'
+          },
+          socket_local_connect: {
+            title: 'Direct local-socket connection',
+            message: 'This constructor may establish a local socket connection and wait for endpoint progress.',
+            remediation: 'Verify runtime progress for local-socket connection and move blocking setup outside ' \
+                         'the fiber-scheduled path.'
+          },
+          socket_constructor_unknown: {
+            title: 'Direct socket subclass construction',
+            message: 'This IPSocket subclass constructor has unknown allocation/connect semantics and may ' \
+                     'require scheduler cooperation.',
+            remediation: 'Inspect the subclass constructor and verify scheduler-aware resolution, connection, ' \
+                         'and I/O behavior.'
+          }
+        }.freeze
 
         class << self
           def title = TITLE
@@ -81,27 +105,39 @@ module FiberAudit
 
         def build_finding(site, const)
           operation = "#{const}.new"
-          ctx = site.execution_context || :unknown
+          profile = if EXACT.include?(const)
+                      OperationSemantics.resolve(operation)
+                    else
+                      OperationSemantics.resolve_socket_constructor(operation)
+                    end
+          metadata = CATEGORY_METADATA.fetch(profile.category)
 
           Finding.new(
             rule_id: self.class.id,
-            title: self.class.title,
+            title: metadata.fetch(:title),
             category: self.class.category,
             severity: advisory_severity(:low),
             confidence: site.confidence,
             location: site.location,
             symbol: site.enclosing_symbol,
             operation: operation,
-            execution_context: ctx,
-            message: MESSAGE,
+            execution_context: site.execution_context || :unknown,
+            message: metadata.fetch(:message),
             evidence: [
               Evidence.new(
                 source: 'static_analysis',
-                message: "Direct socket creation: #{operation}",
-                details: { receiver_constant: const, method: :new }
+                message: "Matched #{operation} (#{profile.category})",
+                details: {
+                  receiver_constant: const,
+                  method: :new,
+                  semantic: profile.category,
+                  wait_possible: profile.wait_possible,
+                  inventory_only: profile.inventory_only,
+                  scheduler_capability: profile.scheduler_capability
+                }
               )
             ],
-            remediation: REMEDIATION
+            remediation: metadata.fetch(:remediation)
           )
         end
       end

data/lib/fiber_audit/static/rules/thread_current_state.rb

@@ -9,21 +9,17 @@ require_relative '../../operation_vocabulary'
 module FiberAudit
   module Static
     module Rules
-      # FA1004: Detect thread-variable state access.
-      #
-      # Detects only thread_variable_get/set operations, not Thread.current[]
-      # index operations. Thread variables are shared across all fibers on the
-      # same thread and may leak request-local data.
+      # FA1004: Detect thread-variable state access without inferring stored data.
       class ThreadCurrentState < Base
         id 'FA1004'
-        severity :high
+        severity :medium
         confidence :high
-        description 'Thread thread variables in fiber code may be shared across fibers and leak request-local data'
+        description 'Thread-variable access may share mutable state across fibers on one thread'
 
-        TITLE = 'Thread thread variables in fiber code'
+        TITLE = 'Thread-variable access shared across fibers'
         CATEGORY = :thread_local
-        MESSAGE = 'Thread thread variables are shared across all fibers on the same thread ' \
-                  'and may leak request-local data between concurrent requests.'
+        MESSAGE = 'Thread variables are visible to fibers sharing a thread. This access may expose mutable ' \
+                  'state across concurrent work, but static analysis does not establish request-sensitive leakage.'
         REMEDIATION = 'Prefer fiber-local storage (Fiber[:key]) or framework-provided ' \
                       'request-local state over thread_variable_get/set.'
 
@@ -73,34 +69,30 @@ module FiberAudit
 
           instance_match = site.receiver_constant == 'Thread' && site.receiver_source != 'Thread'
           current_match = site.receiver_source == 'Thread.current'
-
           return unless instance_match || current_match
 
-          build_finding(site, :high, :high, operation(site))
+          build_finding(site, operation(site))
         end
 
         def operation(site)
           "Thread.#{site.method_name}"
         end
 
-        def build_finding(site, default_sev, conf, operation)
-          context = site.execution_context
-          severity = severity_for(default_sev, context)
-
+        def build_finding(site, operation)
           Finding.new(
             rule_id: self.class.id,
             title: TITLE,
             category: CATEGORY,
-            severity: severity,
-            confidence: conf,
+            severity: advisory_severity(:medium),
+            confidence: :high,
             location: site.location,
             symbol: site.enclosing_symbol,
             operation: operation,
-            execution_context: context,
+            execution_context: site.execution_context,
             message: MESSAGE,
             evidence: [Evidence.new(
               source: site.receiver_source,
-              message: "Thread thread variable access via #{site.method_name}",
+              message: "Matched thread-variable access via #{site.method_name}",
               details: { operation: operation, receiver: site.receiver_source }
             )],
             remediation: REMEDIATION

data/lib/fiber_audit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module FiberAudit
-  VERSION = '0.3.0'
+  VERSION = '0.3.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: fiber_audit
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - FiberAudit Contributors
@@ -61,6 +61,7 @@ files:
 - lib/fiber_audit/findings/finding.rb
 - lib/fiber_audit/findings/location.rb
 - lib/fiber_audit/findings/severity.rb
+- lib/fiber_audit/operation_semantics.rb
 - lib/fiber_audit/operation_vocabulary.rb
 - lib/fiber_audit/project.rb
 - lib/fiber_audit/reporters/base.rb
@@ -80,6 +81,8 @@ files:
 - lib/fiber_audit/runtime/lifecycle.rb
 - lib/fiber_audit/runtime/limits.rb
 - lib/fiber_audit/runtime/location.rb
+- lib/fiber_audit/runtime/operation_liveness_monitor.rb
+- lib/fiber_audit/runtime/operation_liveness_policy.rb
 - lib/fiber_audit/runtime/policy.rb
 - lib/fiber_audit/runtime/probes/base.rb
 - lib/fiber_audit/runtime/probes/http.rb
@@ -94,6 +97,7 @@ files:
 - lib/fiber_audit/runtime/recorder.rb
 - lib/fiber_audit/runtime/redactor.rb
 - lib/fiber_audit/runtime/sampler.rb
+- lib/fiber_audit/runtime/scheduler_evidence_classifier.rb
 - lib/fiber_audit/runtime/scheduler_observer.rb
 - lib/fiber_audit/runtime/scheduler_snapshot.rb
 - lib/fiber_audit/runtime/session.rb