rail_verdict 1.4.0 → 1.8.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 220003ceaeba89b1fb2f8f7082a8a2e6f6dcdcc070005221000602524e3b7576
-  data.tar.gz: 13fb2353b109fed755c762be216060174b3a89a59bbc6e443f06d133edbf0537
+  metadata.gz: 564018ea0a8253a34b54578dc59864000267937ac5175aa437903a5afb67ece8
+  data.tar.gz: ed89e1c5d4b7610b12eca7d66eca82e268dc17297ac040107ff26f79e620ac86
 SHA512:
-  metadata.gz: 7a58b08566a039a6c32fae4a4e4154be529a2c4e0567afc2ee7ac8b24c6e944e0b0555359eb8ea532c02f6143aa4e7594cce208c41bc284243d519d704f07d62
-  data.tar.gz: a79f0ce2a5eb249cd902f60f74b41318dba4f52112004109b42d394540f9ab8aac846a0e5e8d22c1cee009d649016fbf75dc8d715a2440fb498e61b3600247ee
+  metadata.gz: b41423f2cedfac216e9997745f93d8480fc78d8b0b4b0d7274c2c4f9a32d430287b7250d0229e5c23374f91097dfe178df2164bc3f5bc9e0d1dcd0282382e378
+  data.tar.gz: efef3d68cf12a5f40788a946b086a74428b06afca0f1f68b9cad79d8dbbc8fdfe81ca0def0d8de3090d050afbee9e2e224f25be7b1f1961c5788a599c40efa34

data/README.md

@@ -35,7 +35,8 @@ Running test suites alone is not enough to answer a fundamental question:
 Existing tools produce fragmented formats and disparate semantics:
 
 - **RuboCop** reports style and lint offenses;
-- **RSpec** and **Minitest** report test outcomes and failures;
+- **Brakeman** reports Rails security vulnerabilities;
+- **RSpec** and **Minitest** report test outcomes and failures (with intelligent Rails-aware targeted test selection);
 - **SimpleCov** reports line coverage metrics;
 - **bundler-audit** reports gem dependency advisories;
 - **Git** tracks what actually changed.

data/lib/rail_verdict/analyzers/brakeman.rb

@@ -0,0 +1,309 @@
+# frozen_string_literal: true
+
+require "json"
+require "tmpdir"
+require "securerandom"
+
+require_relative "_shared"
+
+module RailVerdict
+  module Analyzers
+    class Brakeman
+      ANALYZER_ID = "brakeman"
+      SUPPORTED_VERSIONS = Gem::Requirement.new(">= 7.0", "< 9")
+
+      SEVERITY_MAP = {
+        "High" => "high",
+        "Medium" => "medium",
+        "Weak" => "low"
+      }.freeze
+
+      CONFIDENCE_MAP = {
+        "High" => "high",
+        "Medium" => "medium",
+        "Weak" => "low"
+      }.freeze
+
+      Probe = Struct.new(:status, :version, :message, keyword_init: true)
+
+      class MalformedOutput < StandardError; end
+
+      def initialize(command_resolver: nil)
+        @command_resolver = command_resolver || method(:default_command)
+      end
+
+      def probe(repository_root, runner: ProcessRunner, timeout_seconds: 15.0)
+        effective_timeout = [timeout_seconds.to_f, 5.0].min
+        command = @command_resolver.call(repository_root)
+        clean_prefix = clean_args_prefix(command.fetch(:args_prefix))
+        clean_command = command.merge(args_prefix: clean_prefix)
+        invocation = Shared.invocation_for(clean_command, ["--version"])
+        result = runner.run(
+          clean_command.fetch(:executable),
+          invocation.fetch("argv"),
+          chdir: repository_root,
+          timeout_seconds: effective_timeout
+        )
+
+        return Probe.new(status: "unavailable", message: Shared.detail_for(result)) if result.status == :spawn_failed
+        return Probe.new(status: "timed_out", message: Shared.detail_for(result)) if result.status == :timed_out
+        return Probe.new(status: "signaled", message: Shared.detail_for(result)) if result.status == :signaled
+        return Probe.new(status: "truncated", message: Shared.detail_for(result)) if Shared.truncated?(result)
+        return Probe.new(status: "unavailable", message: Shared.detail_for(result)) unless result.exit_code == 0
+
+        version = Shared.parse_semver(result.stdout)
+        return Probe.new(status: "unsupported", message: "Brakeman version could not be parsed") unless version
+        return Probe.new(status: "unsupported", version: version, message: "unsupported Brakeman version #{version}") unless SUPPORTED_VERSIONS.satisfied_by?(Gem::Version.new(version))
+
+        Probe.new(status: "succeeded", version: version)
+      rescue ArgumentError
+        Probe.new(status: "unsupported", message: "Brakeman reported an invalid version")
+      rescue KeyError, ArgumentError => error
+        Probe.new(status: "malformed", message: Shared.bounded_message(error.message))
+      end
+
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil)
+        command = @command_resolver.call(repository_root)
+        clean_prefix = clean_args_prefix(command.fetch(:args_prefix))
+        clean_command = command.merge(args_prefix: clean_prefix)
+        probe_result ||= probe(repository_root, runner: runner, timeout_seconds: timeout_seconds)
+        version_invocation = Shared.invocation_for(clean_command, ["--version"])
+
+        unless probe_result.status == "succeeded"
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: version_invocation, status: probe_result.status, message: probe_result.message, tool_version: probe_result.version), []]
+        end
+
+        output_path = File.join(Dir.tmpdir, "railverdict-brakeman-#{SecureRandom.hex(8)}.json")
+        public_invocation = Shared.invocation_for(clean_command, ["-q", "--no-pager", "-f", "json"])
+        run_argv = clean_prefix.dup.concat(["-q", "--no-pager", "-f", "json", "-o", output_path])
+
+        max_stdout = resolve_stdout_limit(configuration, repository_root, 16 * 1024 * 1024)
+        tool_version = probe_result.version
+
+        begin
+          result = runner.run(
+            clean_command.fetch(:executable),
+            run_argv,
+            chdir: repository_root,
+            timeout_seconds: timeout_seconds,
+            max_stdout_bytes: max_stdout
+          )
+
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "unavailable", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :spawn_failed
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "truncated", message: Shared.detail_for(result), tool_version: tool_version), []] if Shared.truncated?(result)
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "timed_out", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :timed_out
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "signaled", message: Shared.detail_for(result), tool_version: tool_version), []] if result.status == :signaled
+
+          unless File.file?(output_path)
+            detail = Shared.detail_for(result)
+            msg = detail.strip.empty? ? "Brakeman did not produce structured output" : detail
+            status = result.exit_code && result.exit_code != 0 ? "failed" : "malformed"
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: status, message: msg, tool_version: tool_version), []]
+          end
+
+          begin
+            bytes = File.binread(output_path)
+          rescue SystemCallError => error
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
+          end
+
+          if bytes.bytesize > max_stdout
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "truncated", message: "Brakeman output exceeds #{max_stdout} bytes", tool_version: tool_version), []]
+          end
+
+          text = bytes.dup.force_encoding(Encoding::UTF_8)
+          unless text.valid_encoding?
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "parse_failed", message: "Brakeman output is not valid UTF-8", tool_version: tool_version), []]
+          end
+
+          begin
+            document = JSON.parse(text)
+          rescue JSON::ParserError => error
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "parse_failed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
+          end
+
+          begin
+            summary, findings = normalize_document(document)
+          rescue MalformedOutput => error
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
+          end
+
+          # Process exit reconciliation:
+          # 0: Clean scan (0 warnings) or explicit no-exit-on-warn
+          # 3: Warnings reported by Brakeman (findings > 0)
+          # Any other status: execution failure
+          warnings_count = summary["security_warnings"] || 0
+          if result.exit_code == 0
+            # Clean scan or non-failing mode
+          elsif result.exit_code == 3
+            if warnings_count == 0 && findings.empty?
+              detail = Shared.detail_for(result)
+              msg = detail.strip.empty? ? "Brakeman exited with status 3 but reported 0 warnings" : detail
+              return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "failed", message: msg, tool_version: tool_version), []]
+            end
+          else
+            detail = Shared.detail_for(result)
+            msg = detail.strip.empty? ? "Brakeman exited with unexpected status #{result.exit_code}" : detail
+            return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "failed", message: msg, tool_version: tool_version), []]
+          end
+
+          analyzer_result = AnalyzerResult.new(
+            analyzer: ANALYZER_ID,
+            tool_version: tool_version,
+            invocation: public_invocation,
+            execution_status: "succeeded",
+            finding_ids: findings.map(&:id),
+            evidence_summary: summary
+          )
+          [analyzer_result, findings]
+        ensure
+          begin
+            File.unlink(output_path) if output_path && File.exist?(output_path)
+          rescue StandardError
+            nil
+          end
+        end
+      end
+
+      private
+
+      def default_command(repository_root)
+        if File.file?(File.join(repository_root, "Gemfile"))
+          { executable: "bundle", args_prefix: ["exec", "brakeman"] }
+        else
+          { executable: "brakeman", args_prefix: [] }
+        end
+      end
+
+      def clean_args_prefix(prefix)
+        cleaned = []
+        skip_next = false
+        Array(prefix).each_with_index do |arg, i|
+          if skip_next
+            skip_next = false
+            next
+          end
+          if (arg == "-f" || arg == "--format" || arg == "-o" || arg == "--output") && Array(prefix)[i + 1]
+            skip_next = true
+            next
+          elsif arg.start_with?("-f=") || arg.start_with?("--format=") || arg.start_with?("-o=") || arg.start_with?("--output=")
+            next
+          elsif arg == "-q" || arg == "--quiet" || arg == "--no-pager"
+            next
+          end
+          cleaned << arg
+        end
+        cleaned
+      end
+
+      def normalize_document(document)
+        raise MalformedOutput, "Brakeman JSON root must be an object" unless document.is_a?(Hash)
+
+        scan_info = document["scan_info"]
+        warnings = document["warnings"]
+        errors = document["errors"]
+
+        raise MalformedOutput, "Brakeman JSON is missing scan_info" unless scan_info.is_a?(Hash)
+        raise MalformedOutput, "Brakeman JSON is missing warnings array" unless warnings.is_a?(Array)
+
+        findings = []
+        warnings.each_with_index do |warning, index|
+          finding = normalize_warning(warning, index)
+          findings << finding if finding
+        end
+
+        findings = findings.uniq(&:fingerprint).sort_by(&:sort_key)
+        summary_h = build_summary(scan_info, findings.length)
+
+        [summary_h, findings]
+      end
+
+      def normalize_warning(warning, index)
+        raise MalformedOutput, "Brakeman warning #{index} must be an object" unless warning.is_a?(Hash)
+
+        check_name = warning["check_name"] || warning["warning_type"] || "warning_#{warning['warning_code'] || index}"
+        rule_id = check_name.to_s.gsub(/[^a-zA-Z0-9_-]/, "_")[0, 64]
+        rule_id = "warning_#{index}" if rule_id.empty?
+
+        raw_msg = warning["message"] || warning["warning_type"] || "security warning"
+        message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg)
+
+        confidence_str = warning["confidence"].to_s
+        confidence = CONFIDENCE_MAP.fetch(confidence_str) { "medium" }
+        severity = SEVERITY_MAP.fetch(confidence_str) { "medium" }
+
+        category = "security"
+        path = normalize_path(warning["file"] || "unknown")
+        start_line = extract_line(warning["line"])
+
+        location = { "path" => path }
+        location["start_line"] = start_line if start_line && start_line >= 1
+        location["end_line"] = location["start_line"] if location.key?("start_line")
+
+        fingerprint = Finding.fingerprint_for(
+          analyzer: ANALYZER_ID,
+          rule_id: rule_id,
+          path: path,
+          message: message
+        )
+
+        Finding.new(
+          fingerprint: fingerprint,
+          origin: "deterministic",
+          analyzer: ANALYZER_ID,
+          rule_id: rule_id,
+          category: category,
+          severity: severity,
+          confidence: confidence,
+          state: "observed",
+          evidence_ref: "native:brakeman:#{fingerprint.delete_prefix("sha256:")[0, 12]}",
+          location: location,
+          message: message
+        )
+      rescue ArgumentError => error
+        raise MalformedOutput, "Brakeman warning #{index} is malformed: #{error.message}"
+      end
+
+      def normalize_path(file)
+        return "unknown" unless file.is_a?(String) && !file.empty?
+
+        cleaned = file.delete_prefix("./").delete_prefix("/")
+        return cleaned if cleaned.match?(Finding::LOCATION_PATH_PATTERN)
+
+        "unknown"
+      end
+
+      def extract_line(line)
+        return nil if line.nil?
+        val = Integer(line) rescue nil
+        val && val >= 1 ? val : nil
+      end
+
+      def build_summary(scan_info, security_warnings_count)
+        {
+          "security_warnings" => security_warnings_count,
+          "checks_performed" => scan_info["checks_performed"].is_a?(Array) ? scan_info["checks_performed"].length : 0,
+          "duration_seconds" => Float(scan_info["duration"] || scan_info["duration_seconds"] || 0),
+          "rails_version" => scan_info["rails_version"].to_s,
+          "ruby_version" => scan_info["ruby_version"].to_s,
+          "brakeman_version" => scan_info["brakeman_version"].to_s
+        }
+      rescue ArgumentError, TypeError
+        raise MalformedOutput, "Brakeman scan_info fields have invalid types"
+      end
+
+      def resolve_stdout_limit(configuration, repository_root, default_bytes)
+        raw_limit = nil
+        if configuration
+          sel = configuration.analyzers[ANALYZER_ID] rescue nil
+          raw_limit = sel && sel["output_limit_bytes"]
+        end
+        raw_limit ||= default_bytes
+        limit = Integer(raw_limit) rescue default_bytes
+        limit = default_bytes if limit <= 0
+        max = RailVerdict::ProcessRunner::MAX_SAFE_STDOUT_BYTES
+        [[limit, max].min, 1024].max
+      end
+    end
+  end
+end

data/lib/rail_verdict/analyzers/bundler_audit.rb

@@ -147,7 +147,7 @@ module RailVerdict
         raw_msg = advisory["title"] || advisory["description"] || entry["title"] || entry["description"] || "vulnerability in #{gem_name}"
         message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg)
 
-        rule_id = "bundler_audit/advisory:#{id}"
+        rule_id = "advisory:#{id}"
         category = "dependency"
 
         path = "Gemfile.lock"

data/lib/rail_verdict/analyzers/minitest.rb

@@ -48,7 +48,7 @@ module RailVerdict
         Probe.new(status: "malformed", message: Shared.bounded_message(error.message))
       end
 
-      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil)
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil, target_files: nil, test_scope: "full", fallback_reason: nil)
         probe_result ||= probe(repository_root, runner: runner, timeout_seconds: timeout_seconds)
 
         unless probe_result.status == "succeeded"
@@ -57,13 +57,40 @@ module RailVerdict
           return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: version_invocation, status: probe_result.status, message: probe_result.message, tool_version: probe_result.version), []]
         end
 
+        target_list = Array(target_files).compact.reject(&:empty?)
+        if target_files.is_a?(Array) && target_files.empty? && test_scope == "targeted"
+          summary = {
+            "schema_version" => "1.0",
+            "runner" => "minitest #{probe_result.version}",
+            "seed" => 0,
+            "tests_total" => 0,
+            "assertions" => 0,
+            "failures" => 0,
+            "errors" => 0,
+            "skips" => 0,
+            "duration_seconds" => 0.0,
+            "test_scope" => "targeted",
+            "target_files" => [],
+            "fallback_reason" => fallback_reason
+          }.compact
+          analyzer_result = AnalyzerResult.new(
+            analyzer: ANALYZER_ID,
+            tool_version: probe_result.version,
+            invocation: Shared.invocation_for(@command_resolver.call(repository_root), ["run"]),
+            execution_status: "succeeded",
+            finding_ids: [],
+            evidence_summary: summary
+          )
+          return [analyzer_result, []]
+        end
+
         command = @command_resolver.call(repository_root)
         reporter_path = resolve_reporter_path
         unless reporter_path
           return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: Shared.invocation_for(command, ["run"]), status: "malformed", message: "installed Minitest reporter is missing", tool_version: probe_result.version), []]
         end
 
-        invocation = Shared.invocation_for(command, ["run"])
+        invocation = Shared.invocation_for(command, target_list.empty? ? ["run"] : ["run"] + target_list)
         output_path = File.join(Dir.tmpdir, "railverdict-minitest-#{SecureRandom.hex(8)}.json")
         env_reset_required = false
         previous_env = ENV["RAILVERDICT_MINITEST_OUTPUT"]
@@ -71,7 +98,7 @@ module RailVerdict
           ENV["RAILVERDICT_MINITEST_OUTPUT"] = output_path
           env_reset_required = true
           augmented_argv = invocation.fetch("argv").dup
-          augmented_argv = inject_reporter_require(augmented_argv, reporter_path)
+          augmented_argv = inject_reporter_require(augmented_argv, reporter_path, target_files: target_list)
           result = runner.run(
             command.fetch(:executable),
             augmented_argv,
@@ -89,7 +116,7 @@ module RailVerdict
           return document if document.is_a?(Array) && document.first.is_a?(AnalyzerResult)
 
           begin
-            summary, findings = normalize_document(document)
+            summary, findings = normalize_document(document, test_scope: test_scope, target_files: target_list, fallback_reason: fallback_reason)
           rescue MalformedOutput => error
             return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
           end
@@ -175,17 +202,23 @@ analyzer_result = AnalyzerResult.new(
         base
       end
 
-      def inject_reporter_require(argv, reporter_path)
+      def inject_reporter_require(argv, reporter_path, target_files: nil)
         argv = argv.dup
+        test_expr = if target_files && !target_files.empty?
+                      files_list = target_files.map { |f| File.expand_path(f) }.inspect
+                      "#{files_list}.each{|f| require f }"
+                    else
+                      "Dir['test/**/*_test.rb'].sort.each{|f| require File.expand_path(f) }"
+                    end
         if argv.include?("run")
           idx = argv.index("run")
           argv[idx] = "-r"
           argv.insert(idx + 1, reporter_path)
           argv.insert(idx + 2, "-e")
-          argv.insert(idx + 3, "Dir['test/**/*_test.rb'].sort.each{|f| require File.expand_path(f) }")
+          argv.insert(idx + 3, test_expr)
         else
           argv.concat(["-r", reporter_path])
-          argv.concat(["-e", "Dir['test/**/*_test.rb'].sort.each{|f| require File.expand_path(f) }"])
+          argv.concat(["-e", test_expr])
         end
         argv
       end
@@ -220,7 +253,7 @@ analyzer_result = AnalyzerResult.new(
         end
       end
 
-      def normalize_document(document)
+      def normalize_document(document, test_scope: "full", target_files: nil, fallback_reason: nil)
         raise MalformedOutput, "Minitest JSON root must be an object" unless document.is_a?(Hash)
 
         required = %w[schema_version runner seed tests_total assertions failures errors skips duration_seconds tests]
@@ -242,6 +275,9 @@ analyzer_result = AnalyzerResult.new(
 
         findings = findings.uniq { |f| f.fingerprint }.sort_by(&:sort_key)
         summary = build_summary(document)
+        summary["test_scope"] = test_scope if test_scope
+        summary["target_files"] = target_files if target_files && !target_files.empty?
+        summary["fallback_reason"] = fallback_reason if fallback_reason
         [summary, findings]
       end
 
@@ -260,7 +296,7 @@ analyzer_result = AnalyzerResult.new(
 
         severity = status == "errored" ? "critical" : "high"
         category = "test"
-        rule_id = "minitest/test:#{class_name}##{method_name}"
+        rule_id = "test:#{class_name}##{method_name}"
         raw_msg = test["failure_message"] || test["method_name"] || "test failed: #{method_name}"
         message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg)
 

data/lib/rail_verdict/analyzers/rspec.rb

@@ -50,7 +50,7 @@ module RailVerdict
         Probe.new(status: "malformed", message: Shared.bounded_message(error.message))
       end
 
-      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil)
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil, configuration: nil, target_files: nil, test_scope: "full", fallback_reason: nil)
         command = @command_resolver.call(repository_root)
         clean_prefix = clean_args_prefix(command.fetch(:args_prefix))
         clean_command = command.merge(args_prefix: clean_prefix)
@@ -61,9 +61,35 @@ module RailVerdict
           return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: version_invocation, status: probe_result.status, message: probe_result.message, tool_version: probe_result.version), []]
         end
 
+        if target_files.is_a?(Array) && target_files.empty? && test_scope == "targeted"
+          summary = {
+            "tests_total" => 0,
+            "duration_seconds" => 0.0,
+            "failures" => 0,
+            "errors" => 0,
+            "assertions" => 0,
+            "skips" => 0,
+            "runner" => "rspec #{probe_result.version}",
+            "test_scope" => "targeted",
+            "target_files" => [],
+            "fallback_reason" => fallback_reason
+          }.compact
+          analyzer_result = AnalyzerResult.new(
+            analyzer: ANALYZER_ID,
+            tool_version: probe_result.version,
+            invocation: Shared.invocation_for(clean_command, ["--format", "json"]),
+            execution_status: "succeeded",
+            finding_ids: [],
+            evidence_summary: summary
+          )
+          return [analyzer_result, []]
+        end
+
         output_path = File.join(Dir.tmpdir, "railverdict-rspec-#{SecureRandom.hex(8)}.json")
-        public_invocation = Shared.invocation_for(clean_command, ["--format", "json"])
-        run_argv = clean_prefix.dup.concat(["--format", "json", "--out", output_path])
+        target_list = Array(target_files).compact.reject(&:empty?)
+        public_argv = target_list.empty? ? ["--format", "json"] : target_list + ["--format", "json"]
+        public_invocation = Shared.invocation_for(clean_command, public_argv)
+        run_argv = clean_prefix.dup.concat(target_list).concat(["--format", "json", "--out", output_path])
 
         max_stdout = resolve_stdout_limit(configuration, repository_root, 16 * 1024 * 1024)
         tool_version = probe_result.version
@@ -111,7 +137,7 @@ module RailVerdict
           end
 
           begin
-            summary, findings = normalize_document(document)
+            summary, findings = normalize_document(document, test_scope: test_scope, target_files: target_list, fallback_reason: fallback_reason)
           rescue MalformedOutput => error
             return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: public_invocation, status: "malformed", message: Shared.bounded_message(error.message), tool_version: tool_version), []]
           end
@@ -184,7 +210,7 @@ module RailVerdict
         cleaned
       end
 
-      def normalize_document(document)
+      def normalize_document(document, test_scope: "full", target_files: nil, fallback_reason: nil)
         raise MalformedOutput, "RSpec JSON root must be an object" unless document.is_a?(Hash)
 
         summary = document["summary"]
@@ -203,6 +229,9 @@ module RailVerdict
         findings = findings.uniq { |f| f.fingerprint }.sort_by(&:sort_key)
         summary_h = build_summary(summary, version)
         summary_h["tests_total"] = examples.length
+        summary_h["test_scope"] = test_scope if test_scope
+        summary_h["target_files"] = target_files if target_files && !target_files.empty?
+        summary_h["fallback_reason"] = fallback_reason if fallback_reason
 
         [summary_h, findings]
       end
@@ -222,7 +251,7 @@ module RailVerdict
         raw_msg = (example["exception"] && example["exception"]["message"]) || example["full_description"] || example["description"] || nil
         message = Shared.normalize_finding_message(ANALYZER_ID, raw_msg.nil? || raw_msg.to_s.strip.empty? ? "rspec example failed" : raw_msg)
 
-        rule_id = "rspec/example:#{example[id] || id_for(example, index)}"
+        rule_id = "example:#{example[id] || id_for(example, index)}"
         path = normalize_path(example["file_path"] || example["file"] || "spec/unknown_spec.rb")
         failure_line, failure_path = failure_location(example, path)
         start_line = failure_line || example["line_number"] || extract_line(example["id"])