@complior/engine 0.9.0

package/src/domain/scanner/score-calculator.test.ts

@@ -0,0 +1,363 @@
+import { describe, it, expect } from 'vitest';
+import { calculateScore, calculateScoreDiff, getZone } from './score-calculator.js';
+import type { CheckResult } from '../../types/common.types.js';
+import type { ScoringData } from '../../data/schemas/schemas.js';
+
+// Minimal scoring data matching the real structure
+const makeScoringData = (overrides?: Partial<ScoringData>): ScoringData => ({
+  regulation_id: 'eu-ai-act',
+  total_obligations: 108,
+  critical_obligations: 37,
+  critical_obligation_ids: [
+    'eu-ai-act-OBL-002',
+    'eu-ai-act-OBL-003',
+    'eu-ai-act-OBL-005',
+    'eu-ai-act-OBL-008',
+  ],
+  critical_obligations_note: 'Critical cap at 40%',
+  weighted_categories: [
+    {
+      category: 'transparency',
+      weight: 17,
+      weight_reasoning: 'Publicly visible obligations',
+      obligations_in_category: ['eu-ai-act-OBL-007', 'eu-ai-act-OBL-015'],
+    },
+    {
+      category: 'documentation',
+      weight: 13,
+      weight_reasoning: 'Evidence for regulators',
+      obligations_in_category: ['eu-ai-act-OBL-005', 'eu-ai-act-OBL-019'],
+    },
+    {
+      category: 'technical_safeguards',
+      weight: 9,
+      weight_reasoning: 'Logging and oversight',
+      obligations_in_category: ['eu-ai-act-OBL-006', 'eu-ai-act-OBL-008'],
+    },
+    {
+      category: 'organizational',
+      weight: 9,
+      weight_reasoning: 'QMS and training',
+      obligations_in_category: ['eu-ai-act-OBL-001', 'eu-ai-act-OBL-011'],
+    },
+  ],
+  score_formula: 'weighted average',
+  score_interpretation: { for_deployers: '', for_providers: '' },
+  thresholds: {
+    red: { range: '0-49%', label: 'Critical', description: '', action: '' },
+    yellow: { range: '50-79%', label: 'Partial', description: '', action: '' },
+    green: { range: '80-100%', label: 'Compliant', description: '', action: '' },
+  },
+  minimum_for_certificate: 85,
+  certificate_additional_requirements: [],
+  score_update_triggers: [],
+  domain_specific_categories: [],
+  ...overrides,
+});
+
+// Helper: create pass check
+const pass = (checkId: string): CheckResult => ({
+  type: 'pass',
+  checkId,
+  message: `${checkId} passed`,
+});
+
+// Helper: create fail check
+const fail = (checkId: string, obligationId?: string): CheckResult => ({
+  type: 'fail',
+  checkId,
+  message: `${checkId} failed`,
+  severity: 'high',
+  ...(obligationId !== undefined ? { obligationId } : {}),
+});
+
+// Helper: create skip check
+const skip = (checkId: string): CheckResult => ({
+  type: 'skip',
+  checkId,
+  reason: `${checkId} not applicable`,
+});
+
+describe('getZone', () => {
+  it('returns red for scores 0-49', () => {
+    expect(getZone(0)).toBe('red');
+    expect(getZone(25)).toBe('red');
+    expect(getZone(49)).toBe('red');
+    expect(getZone(49.99)).toBe('red');
+  });
+
+  it('returns yellow for scores 50-79', () => {
+    expect(getZone(50)).toBe('yellow');
+    expect(getZone(65)).toBe('yellow');
+    expect(getZone(79)).toBe('yellow');
+    expect(getZone(79.99)).toBe('yellow');
+  });
+
+  it('returns green for scores 80-100', () => {
+    expect(getZone(80)).toBe('green');
+    expect(getZone(90)).toBe('green');
+    expect(getZone(100)).toBe('green');
+  });
+});
+
+describe('calculateScore', () => {
+  const scoringData = makeScoringData();
+
+  it('returns 100% green for all-pass checks', () => {
+    const checks: readonly CheckResult[] = [
+      pass('ai-disclosure'),
+      pass('content-marking'),
+      pass('interaction-logging'),
+      pass('ai-literacy'),
+      pass('gpai-transparency'),
+      pass('compliance-metadata'),
+      pass('documentation'),
+    ];
+
+    const result = calculateScore(checks, scoringData);
+
+    expect(result.totalScore).toBe(100);
+    expect(result.zone).toBe('green');
+    expect(result.criticalCapApplied).toBe(false);
+    expect(result.passedChecks).toBe(7);
+    expect(result.failedChecks).toBe(0);
+    expect(result.skippedChecks).toBe(0);
+    expect(result.totalChecks).toBe(7);
+  });
+
+  it('returns 0% red for all-fail checks', () => {
+    const checks: readonly CheckResult[] = [
+      fail('ai-disclosure'),
+      fail('content-marking'),
+      fail('interaction-logging'),
+      fail('ai-literacy'),
+      fail('gpai-transparency'),
+      fail('compliance-metadata'),
+      fail('documentation'),
+    ];
+
+    const result = calculateScore(checks, scoringData);
+
+    expect(result.totalScore).toBe(0);
+    expect(result.zone).toBe('red');
+    expect(result.passedChecks).toBe(0);
+    expect(result.failedChecks).toBe(7);
+  });
+
+  it('calculates correct weighted score for mixed pass/fail', () => {
+    // transparency: ai-disclosure pass, content-marking fail → 50%
+    // documentation: gpai-transparency pass, compliance-metadata pass, documentation pass → 100%
+    // technical_safeguards: interaction-logging fail → 0%
+    // organizational: ai-literacy pass → 100%
+    const checks: readonly CheckResult[] = [
+      pass('ai-disclosure'),
+      fail('content-marking'),
+      fail('interaction-logging'),
+      pass('ai-literacy'),
+      pass('gpai-transparency'),
+      pass('compliance-metadata'),
+      pass('documentation'),
+    ];
+
+    const result = calculateScore(checks, scoringData);
+
+    // Weighted: (50*17 + 100*13 + 0*9 + 100*9) / (17+13+9+9) = (850+1300+0+900)/48 = 3050/48 ≈ 63.54
+    expect(result.totalScore).toBeCloseTo(63.54, 1);
+    expect(result.zone).toBe('yellow');
+    expect(result.criticalCapApplied).toBe(false);
+    expect(result.categoryScores).toHaveLength(4);
+
+    const transparency = result.categoryScores.find((c) => c.category === 'transparency');
+    expect(transparency?.score).toBe(50);
+    expect(transparency?.passedCount).toBe(1);
+    expect(transparency?.obligationCount).toBe(2);
+
+    const docs = result.categoryScores.find((c) => c.category === 'documentation');
+    expect(docs?.score).toBe(100);
+  });
+
+  it('applies critical cap when critical obligation fails (by obligationId)', () => {
+    // All pass except one fail with critical obligationId
+    const checks: readonly CheckResult[] = [
+      pass('ai-disclosure'),
+      pass('content-marking'),
+      pass('interaction-logging'),
+      pass('ai-literacy'),
+      pass('gpai-transparency'),
+      pass('compliance-metadata'),
+      fail('some-check', 'eu-ai-act-OBL-002'), // critical obligation
+    ];
+
+    // 'some-check' with obligationId 'eu-ai-act-OBL-002' doesn't map to any category
+    // But the critical cap should still apply
+    const result = calculateScore(checks, scoringData);
+
+    expect(result.criticalCapApplied).toBe(true);
+    expect(result.totalScore).toBeLessThanOrEqual(40);
+    expect(result.zone).toBe('red');
+  });
+
+  it('applies critical cap when critical obligation fails (by checkId)', () => {
+    // Use scoring data where a checkId is in critical_obligation_ids
+    const customScoring = makeScoringData({
+      critical_obligation_ids: ['interaction-logging'],
+    });
+
+    const checks: readonly CheckResult[] = [
+      pass('ai-disclosure'),
+      pass('content-marking'),
+      fail('interaction-logging'), // this checkId is critical
+      pass('ai-literacy'),
+      pass('gpai-transparency'),
+      pass('compliance-metadata'),
+      pass('documentation'),
+    ];
+
+    const result = calculateScore(checks, customScoring);
+
+    expect(result.criticalCapApplied).toBe(true);
+    expect(result.totalScore).toBeLessThanOrEqual(40);
+    expect(result.zone).toBe('red');
+  });
+
+  it('returns 100% green for all-skip checks', () => {
+    const checks: readonly CheckResult[] = [
+      skip('ai-disclosure'),
+      skip('content-marking'),
+      skip('interaction-logging'),
+    ];
+
+    const result = calculateScore(checks, scoringData);
+
+    expect(result.totalScore).toBe(100);
+    expect(result.zone).toBe('green');
+    expect(result.skippedChecks).toBe(3);
+    expect(result.passedChecks).toBe(0);
+    expect(result.failedChecks).toBe(0);
+    expect(result.categoryScores).toHaveLength(0);
+  });
+
+  it('returns 100% green for empty checks', () => {
+    const result = calculateScore([], scoringData);
+
+    expect(result.totalScore).toBe(100);
+    expect(result.zone).toBe('green');
+    expect(result.totalChecks).toBe(0);
+    expect(result.categoryScores).toHaveLength(0);
+  });
+
+  it('matches checks by obligationId to category', () => {
+    // Use obligationId matching instead of checkId fallback
+    const checks: readonly CheckResult[] = [
+      fail('custom-check-1', 'eu-ai-act-OBL-007'), // transparency category
+      pass('custom-check-2'), // no mapping, excluded
+    ];
+
+    const result = calculateScore(checks, scoringData);
+
+    expect(result.categoryScores).toHaveLength(1);
+    expect(result.categoryScores[0].category).toBe('transparency');
+    expect(result.categoryScores[0].score).toBe(0);
+  });
+
+  it('includes ext-* findings in category scores', () => {
+    // ext-semgrep-complior-injection-js maps to technical_safeguards
+    const checks: readonly CheckResult[] = [
+      pass('l4-cybersecurity'),
+      fail('ext-semgrep-complior-injection-js'),
+    ];
+
+    const result = calculateScore(checks, scoringData);
+
+    const techSafeguards = result.categoryScores.find((c) => c.category === 'technical_safeguards');
+    expect(techSafeguards).toBeDefined();
+    expect(techSafeguards!.obligationCount).toBe(2);
+    expect(techSafeguards!.passedCount).toBe(1);
+    expect(techSafeguards!.score).toBe(50);
+  });
+
+  it('skips categories with no matching checks', () => {
+    // Only transparency checks
+    const checks: readonly CheckResult[] = [
+      pass('ai-disclosure'),
+      pass('content-marking'),
+    ];
+
+    const result = calculateScore(checks, scoringData);
+
+    // Only transparency should be active
+    expect(result.categoryScores).toHaveLength(1);
+    expect(result.categoryScores[0].category).toBe('transparency');
+    expect(result.totalScore).toBe(100);
+  });
+});
+
+describe('calculateScoreDiff', () => {
+  const scoringData = makeScoringData();
+
+  it('detects improvement', () => {
+    const before = calculateScore(
+      [fail('ai-disclosure'), fail('content-marking'), pass('interaction-logging')],
+      scoringData,
+    );
+    const after = calculateScore(
+      [pass('ai-disclosure'), pass('content-marking'), pass('interaction-logging')],
+      scoringData,
+    );
+
+    const diff = calculateScoreDiff(before, after);
+
+    expect(diff.before).toBe(before.totalScore);
+    expect(diff.after).toBe(after.totalScore);
+    expect(diff.delta).toBeGreaterThan(0);
+    expect(diff.improved).toContain('transparency');
+    expect(diff.degraded).toHaveLength(0);
+  });
+
+  it('detects degradation', () => {
+    const before = calculateScore(
+      [pass('ai-disclosure'), pass('content-marking'), pass('interaction-logging')],
+      scoringData,
+    );
+    const after = calculateScore(
+      [fail('ai-disclosure'), fail('content-marking'), pass('interaction-logging')],
+      scoringData,
+    );
+
+    const diff = calculateScoreDiff(before, after);
+
+    expect(diff.delta).toBeLessThan(0);
+    expect(diff.degraded).toContain('transparency');
+    expect(diff.improved).toHaveLength(0);
+  });
+
+  it('detects both improved and degraded categories', () => {
+    const before = calculateScore(
+      [pass('ai-disclosure'), pass('content-marking'), fail('interaction-logging'), pass('ai-literacy')],
+      scoringData,
+    );
+    const after = calculateScore(
+      [fail('ai-disclosure'), fail('content-marking'), pass('interaction-logging'), pass('ai-literacy')],
+      scoringData,
+    );
+
+    const diff = calculateScoreDiff(before, after);
+
+    expect(diff.improved).toContain('technical_safeguards');
+    expect(diff.degraded).toContain('transparency');
+  });
+
+  it('returns zero delta when scores are identical', () => {
+    const checks: readonly CheckResult[] = [
+      pass('ai-disclosure'),
+      pass('content-marking'),
+    ];
+    const breakdown = calculateScore(checks, scoringData);
+
+    const diff = calculateScoreDiff(breakdown, breakdown);
+
+    expect(diff.delta).toBe(0);
+    expect(diff.improved).toHaveLength(0);
+    expect(diff.degraded).toHaveLength(0);
+  });
+});

package/src/domain/scanner/score-calculator.ts

@@ -0,0 +1,189 @@
+import type { CheckResult, CategoryScore, ScoreBreakdown, ScoreDiff, ScoreZone } from '../../types/common.types.js';
+import type { ScoringData } from '../../data/schemas/schemas.js';
+import checkIdData from '../../../data/scanner/check-id-categories.json' with { type: 'json' };
+
+// CheckId → category mapping for findings without obligationId.
+// Pass results from L1/L2/L3/L4/git checks lack obligationId, so they
+// need explicit category routing to contribute to category scores.
+const CHECK_ID_TO_CATEGORY: Readonly<Record<string, string>> = checkIdData.mapping;
+
+export const getZone = (score: number): ScoreZone => {
+  if (score < 50) return 'red';
+  if (score < 80) return 'yellow';
+  return 'green';
+};
+
+const findCategoryForCheck = (
+  check: CheckResult,
+  categories: readonly { readonly category: string; readonly obligations_in_category: readonly string[] }[],
+): string | undefined => {
+  // First: match by obligationId if present (fail/skip results only — pass results use fallback map)
+  if (check.type === 'fail' && check.obligationId !== undefined) {
+    const matched = categories.find((cat) =>
+      cat.obligations_in_category.includes(check.obligationId!),
+    );
+    if (matched !== undefined) return matched.category;
+  }
+
+  // Fallback: use the checkId → category mapping
+  const mappedCategory = CHECK_ID_TO_CATEGORY[check.checkId];
+  if (mappedCategory !== undefined) {
+    const matched = categories.find((cat) => cat.category === mappedCategory);
+    if (matched !== undefined) return matched.category;
+  }
+
+  return undefined;
+};
+
+/**
+ * Calculate project-wide weighted compliance score (→ passport.project_score).
+ * Groups checks into 8 categories, applies per-category weights, and caps at 40
+ * if any critical obligation fails with high/medium severity.
+ * Contrast with complior_score: simple per-agent passed/(passed+failed)×100 ratio.
+ */
+export const calculateScore = (
+  checks: readonly CheckResult[],
+  scoringData: ScoringData,
+): ScoreBreakdown => {
+  const totalChecks = checks.length;
+  const passedChecks = checks.filter((c) => c.type === 'pass').length;
+  const failedChecks = checks.filter((c) => c.type === 'fail').length;
+  const skippedChecks = checks.filter((c) => c.type === 'skip').length;
+
+  const infoChecks = checks.filter((c) => c.type === 'info').length;
+
+  // Empty checks or all skipped/info = fully compliant (nothing applicable)
+  if (totalChecks === 0 || totalChecks === skippedChecks + infoChecks) {
+    return {
+      totalScore: 100,
+      zone: 'green',
+      categoryScores: [],
+      criticalCapApplied: false,
+      totalChecks,
+      passedChecks,
+      failedChecks,
+      skippedChecks,
+    };
+  }
+
+  // Group non-skip checks by category
+  const categoryChecksMap = new Map<string, readonly CheckResult[]>();
+
+  for (const check of checks) {
+    if (check.type === 'skip' || check.type === 'info') continue;
+
+    const category = findCategoryForCheck(check, scoringData.weighted_categories);
+    if (category === undefined) continue;
+
+    const existing = categoryChecksMap.get(category) ?? [];
+    categoryChecksMap.set(category, [...existing, check]);
+  }
+
+  // Calculate per-category scores
+  const categoryScores: CategoryScore[] = [];
+  let weightedSum = 0;
+  let activeWeightSum = 0;
+
+  for (const weightedCategory of scoringData.weighted_categories) {
+    const checksInCategory = categoryChecksMap.get(weightedCategory.category);
+
+    // Skip categories with no matching checks
+    if (checksInCategory === undefined || checksInCategory.length === 0) continue;
+
+    const passed = checksInCategory.filter((c) => c.type === 'pass').length;
+    const failed = checksInCategory.filter((c) => c.type === 'fail').length;
+    const total = passed + failed;
+
+    const categoryScore = total === 0 ? 100 : (passed / total) * 100;
+
+    categoryScores.push({
+      category: weightedCategory.category,
+      weight: weightedCategory.weight,
+      score: Math.round(categoryScore * 100) / 100,
+      obligationCount: total,
+      passedCount: passed,
+    });
+
+    weightedSum += categoryScore * weightedCategory.weight;
+    activeWeightSum += weightedCategory.weight;
+  }
+
+  // Weighted total
+  const rawScore = activeWeightSum === 0 ? 100 : weightedSum / activeWeightSum;
+
+  // Critical cap: if any critical obligation fails, cap at 40
+  // Excluded from cap trigger:
+  //   - L2 findings: measure document quality/depth, not compliance presence
+  //   - Cross-layer findings: derived/advisory heuristic checks, not direct regulatory violations
+  //   - External tool findings: belt-and-suspenders advisory checks
+  //   - Low-severity findings: missing best-practice patterns (e.g. "no data-governance pattern found")
+  //   - passport-presence: internal best-practice (passport is our concept, not regulatory)
+  const criticalIds = new Set(scoringData.critical_obligation_ids);
+  const CRITICAL_CAP_EXCLUDED = new Set(['passport-presence']);
+  const criticalCapApplied = checks.some((check) => {
+    if (check.type !== 'fail') return false;
+    // L2 findings measure doc quality, not compliance presence
+    if (check.checkId.startsWith('l2-')) return false;
+    // Cross-layer findings are derived heuristics (e.g. "logging found but no retention config")
+    if (check.checkId.startsWith('cross-')) return false;
+    // External tool findings are advisory (belt-and-suspenders) — they inform
+    // category scores but do NOT trigger the regulatory hard cap
+    if (check.checkId.startsWith('ext-')) return false;
+    // Low/info-severity findings indicate missing best practices, not active violations
+    if (check.severity === 'low' || check.severity === 'info') return false;
+    if (CRITICAL_CAP_EXCLUDED.has(check.checkId)) return false;
+    // Check both obligationId and checkId against critical list
+    if (check.obligationId !== undefined && criticalIds.has(check.obligationId)) return true;
+    return criticalIds.has(check.checkId);
+  });
+
+  const totalScore = Math.round(
+    (criticalCapApplied ? Math.min(rawScore, 40) : rawScore) * 100,
+  ) / 100;
+
+  return {
+    totalScore,
+    zone: getZone(totalScore),
+    categoryScores,
+    criticalCapApplied,
+    totalChecks,
+    passedChecks,
+    failedChecks,
+    skippedChecks,
+  };
+};
+
+export const calculateScoreDiff = (
+  before: ScoreBreakdown,
+  after: ScoreBreakdown,
+): ScoreDiff => {
+  const delta = Math.round((after.totalScore - before.totalScore) * 100) / 100;
+
+  const beforeMap = new Map(before.categoryScores.map((c) => [c.category, c.score]));
+  const afterMap = new Map(after.categoryScores.map((c) => [c.category, c.score]));
+
+  // Collect all category keys from both breakdowns
+  const allCategories = new Set([...beforeMap.keys(), ...afterMap.keys()]);
+
+  const improved: string[] = [];
+  const degraded: string[] = [];
+
+  for (const category of allCategories) {
+    const beforeScore = beforeMap.get(category) ?? 0;
+    const afterScore = afterMap.get(category) ?? 0;
+
+    if (afterScore > beforeScore) {
+      improved.push(category);
+    } else if (afterScore < beforeScore) {
+      degraded.push(category);
+    }
+  }
+
+  return {
+    before: before.totalScore,
+    after: after.totalScore,
+    delta,
+    improved,
+    degraded,
+  };
+};

package/src/domain/scanner/security-score.test.ts

@@ -0,0 +1,107 @@
+import { describe, it, expect } from 'vitest';
+import { calculateSecurityScore } from './security-score.js';
+import type { TestResultInput } from './security-score.js';
+
+describe('calculateSecurityScore', () => {
+  it('returns 0 with grade F for empty results', () => {
+    const result = calculateSecurityScore([]);
+    expect(result.score).toBe(0);
+    expect(result.grade).toBe('F');
+    expect(result.categories).toHaveLength(0);
+    expect(result.criticalCapped).toBe(false);
+  });
+
+  it('calculates 100% when all probes pass', () => {
+    const results: TestResultInput[] = [
+      { probeId: 'p1', owaspCategory: 'LLM01', categoryName: 'Prompt Injection', verdict: 'pass', severity: 'critical' },
+      { probeId: 'p2', owaspCategory: 'LLM01', categoryName: 'Prompt Injection', verdict: 'pass', severity: 'critical' },
+      { probeId: 'p3', owaspCategory: 'LLM02', categoryName: 'Sensitive Info', verdict: 'pass', severity: 'high' },
+    ];
+    const result = calculateSecurityScore(results);
+    expect(result.score).toBe(100);
+    expect(result.grade).toBe('A');
+    expect(result.criticalCapped).toBe(false);
+  });
+
+  it('calculates 0% when all probes fail', () => {
+    const results: TestResultInput[] = [
+      { probeId: 'p1', owaspCategory: 'LLM01', categoryName: 'Prompt Injection', verdict: 'fail', severity: 'critical' },
+      { probeId: 'p2', owaspCategory: 'LLM02', categoryName: 'Sensitive Info', verdict: 'fail', severity: 'high' },
+    ];
+    const result = calculateSecurityScore(results);
+    expect(result.score).toBe(0);
+    expect(result.grade).toBe('F');
+    expect(result.criticalCapped).toBe(true);
+  });
+
+  it('applies critical cap when any category has 0% pass rate', () => {
+    const results: TestResultInput[] = [
+      // LLM01: 0% (critical gap)
+      { probeId: 'p1', owaspCategory: 'LLM01', categoryName: 'Prompt Injection', verdict: 'fail', severity: 'critical' },
+      // LLM02: 100%
+      { probeId: 'p2', owaspCategory: 'LLM02', categoryName: 'Sensitive Info', verdict: 'pass', severity: 'high' },
+      { probeId: 'p3', owaspCategory: 'LLM02', categoryName: 'Sensitive Info', verdict: 'pass', severity: 'high' },
+    ];
+    const result = calculateSecurityScore(results);
+    // Average of 0 + 100 = 50, but capped at 49
+    expect(result.score).toBeLessThanOrEqual(49);
+    expect(result.criticalCapped).toBe(true);
+    expect(result.grade).toBe('D');
+  });
+
+  it('produces correct per-category scores', () => {
+    const results: TestResultInput[] = [
+      { probeId: 'p1', owaspCategory: 'LLM01', categoryName: 'Prompt Injection', verdict: 'pass', severity: 'critical' },
+      { probeId: 'p2', owaspCategory: 'LLM01', categoryName: 'Prompt Injection', verdict: 'fail', severity: 'critical' },
+      { probeId: 'p3', owaspCategory: 'LLM05', categoryName: 'Output Handling', verdict: 'pass', severity: 'high' },
+    ];
+    const result = calculateSecurityScore(results);
+    expect(result.categories).toHaveLength(2);
+
+    const llm01 = result.categories.find((c) => c.categoryId === 'LLM01');
+    expect(llm01).toBeDefined();
+    expect(llm01!.score).toBe(50); // 1/2 = 50%
+    expect(llm01!.probesPassed).toBe(1);
+    expect(llm01!.probesTotal).toBe(2);
+
+    const llm05 = result.categories.find((c) => c.categoryId === 'LLM05');
+    expect(llm05).toBeDefined();
+    expect(llm05!.score).toBe(100);
+  });
+
+  it('maps grades correctly at boundaries', () => {
+    // Helper: create results that produce exactly the desired score
+    const makeResult = (passCount: number, failCount: number): TestResultInput[] => {
+      const results: TestResultInput[] = [];
+      for (let i = 0; i < passCount; i++) {
+        results.push({ probeId: `p${i}`, owaspCategory: 'LLM01', categoryName: 'Test', verdict: 'pass', severity: 'medium' });
+      }
+      for (let i = 0; i < failCount; i++) {
+        results.push({ probeId: `f${i}`, owaspCategory: 'LLM01', categoryName: 'Test', verdict: 'fail', severity: 'medium' });
+      }
+      return results;
+    };
+
+    // 90/100 = A
+    expect(calculateSecurityScore(makeResult(9, 1)).grade).toBe('A');
+    // 75/100 = B
+    expect(calculateSecurityScore(makeResult(3, 1)).grade).toBe('B');
+    // 60/100 = C
+    expect(calculateSecurityScore(makeResult(3, 2)).grade).toBe('C');
+    // 40/100 = D
+    expect(calculateSecurityScore(makeResult(2, 3)).grade).toBe('D');
+    // 0/100 = F (but also critical capped)
+    expect(calculateSecurityScore(makeResult(0, 5)).grade).toBe('F');
+  });
+
+  it('categories are sorted by ID', () => {
+    const results: TestResultInput[] = [
+      { probeId: 'p1', owaspCategory: 'LLM09', categoryName: 'Misinformation', verdict: 'pass', severity: 'medium' },
+      { probeId: 'p2', owaspCategory: 'LLM01', categoryName: 'Prompt Injection', verdict: 'pass', severity: 'critical' },
+      { probeId: 'p3', owaspCategory: 'LLM05', categoryName: 'Output Handling', verdict: 'pass', severity: 'high' },
+    ];
+    const result = calculateSecurityScore(results);
+    const ids = result.categories.map((c) => c.categoryId);
+    expect(ids).toEqual(['LLM01', 'LLM05', 'LLM09']);
+  });
+});