@hoanghainh/komagu 2.2.1 → 2.3.0

package/assess/lsa/scripts/render_report.py

@@ -17,6 +17,14 @@ from typing import Any, Dict, List
 sys.path.insert(0, str(Path(__file__).resolve().parent))
 from lsa_common import KIT_VERSION, read_json  # noqa: E402
 from trend import render_trend_html, render_trend_md  # noqa: E402
+from attack_chains import render_attack_chains_html, render_attack_chains_md  # noqa: E402
+from forecast import render_forecast_html, render_forecast_md  # noqa: E402
+
+try:
+    from operate.inventory.api_inventory import render_inventory_html, render_inventory_md  # noqa: E402
+except (ImportError, ModuleNotFoundError):
+    sys.path.insert(0, str(Path(__file__).resolve().parent.parent.parent.parent))
+    from operate.inventory.api_inventory import render_inventory_html, render_inventory_md  # noqa: E402
 
 SEV = ["critical", "high", "medium", "low", "info"]
 
@@ -68,6 +76,39 @@ def _load_trend(out: Path) -> Dict[str, Any]:
     return trend if trend.get("history") else {}
 
 
+def _load_attack_chains(out: Path) -> Dict[str, Any]:
+    """Attack chains from attack_chains.py (OUT/attack-chains.json)."""
+    path = out / "attack-chains.json"
+    if not path.is_file():
+        return {}
+    try:
+        return read_json(path) or {}
+    except (OSError, ValueError, AttributeError):
+        return {}
+
+
+def _load_forecast(out: Path) -> Dict[str, Any]:
+    """Security debt forecast from forecast.py (OUT/forecast.json)."""
+    path = out / "forecast.json"
+    if not path.is_file():
+        return {}
+    try:
+        return read_json(path) or {}
+    except (OSError, ValueError, AttributeError):
+        return {}
+
+
+def _load_inventory_diff(out: Path) -> Dict[str, Any]:
+    """API inventory diff from operate inventory (OUT/api-inventory-diff.json)."""
+    path = out / "api-inventory-diff.json"
+    if not path.is_file():
+        return {}
+    try:
+        return read_json(path) or {}
+    except (OSError, ValueError, AttributeError):
+        return {}
+
+
 def md_escape(s: str) -> str:
     return (s or "").replace("|", "\\|").replace("\n", " ")
 
@@ -130,6 +171,15 @@ def render_en(out: Path, project: str) -> str:
     trend = _load_trend(out)
     if trend:
         L += render_trend_md(trend, "en")
+    fc = _load_forecast(out)
+    if fc:
+        L += render_forecast_md(fc, "en")
+    inv = _load_inventory_diff(out)
+    if inv and inv.get("summary"):
+        L += render_inventory_md(inv, "en")
+    chains = _load_attack_chains(out)
+    if chains and chains.get("chains"):
+        L += render_attack_chains_md(chains, "en")
     L += ["## 3. Findings", "",
           "| ID | Sev | Conf | Status | Category | Endpoint | Location | Title |", "|---|---|---|---|---|---|---|---|"]
     for f in active:
@@ -223,6 +273,15 @@ def render_ja(out: Path, project: str) -> str:
     trend = _load_trend(out)
     if trend:
         L += render_trend_md(trend, "ja")
+    fc = _load_forecast(out)
+    if fc:
+        L += render_forecast_md(fc, "ja")
+    inv = _load_inventory_diff(out)
+    if inv and inv.get("summary"):
+        L += render_inventory_md(inv, "ja")
+    chains = _load_attack_chains(out)
+    if chains and chains.get("chains"):
+        L += render_attack_chains_md(chains, "ja")
     L += ["## 3. 検出事項の詳細", "",
           "| ID | 重要度 | 確信度 | ステータス | 脆弱性分類 | 対象エンドポイント | 該当箇所 | タイトル |",
           "|---|---|---|---|---|---|---|---|"]
@@ -427,6 +486,12 @@ def render_html(out: Path, project: str, default_lang: str = "en") -> str:
     )
     trend = _load_trend(out)
     trend_card = render_trend_html(trend) if trend else ""
+    fc = _load_forecast(out)
+    forecast_card = render_forecast_html(fc) if fc else ""
+    inv = _load_inventory_diff(out)
+    inv_card = render_inventory_html(inv) if inv and inv.get("summary") else ""
+    chains = _load_attack_chains(out)
+    chains_card = render_attack_chains_html(chains) if chains and chains.get("chains") else ""
 
     # Build severity legend rows
     sev_colors = {
@@ -906,6 +971,21 @@ def render_html(out: Path, project: str, default_lang: str = "en") -> str:
     font-size: 12px;
     color: #475569;
   }}
+  .chain-list-container {{ display: flex; flex-direction: column; gap: 16px; margin-top: 16px; }}
+  .chain-item-card {{ border: 1px solid var(--border); border-radius: 8px; padding: 16px; background: #fdfdfd; }}
+  .chain-item-header {{ font-size: 15px; margin-bottom: 12px; }}
+  .chain-flow-diagram {{ display: flex; flex-wrap: wrap; align-items: center; gap: 8px; margin: 12px 0; }}
+  .chain-step-node {{ background: #ffffff; border: 1px solid var(--border); border-radius: 6px; padding: 8px 12px; font-size: 12px; }}
+  .chain-step-badge {{ font-weight: 600; color: var(--accent); margin-bottom: 4px; }}
+  .chain-step-id {{ font-size: 13px; }}
+  .chain-step-loc {{ color: var(--muted); font-family: monospace; font-size: 11px; }}
+  .chain-arrow {{ font-size: 18px; color: var(--muted); font-weight: bold; }}
+  .chain-impact-desc {{ font-size: 13px; color: var(--muted); margin-top: 8px; }}
+  .forecast-stats-grid {{ display: flex; flex-wrap: wrap; gap: 16px; margin: 12px 0 18px; }}
+  .forecast-stat-box {{ background: #fdfdfd; border: 1px solid var(--border); border-radius: 8px; padding: 12px 18px; flex: 1; min-width: 140px; }}
+  .stat-lbl {{ font-size: 12px; color: var(--muted); }}
+  .stat-val {{ font-size: 20px; font-weight: 700; margin-top: 4px; }}
+  .forecast-alert {{ padding: 10px 14px; background: var(--bg); border: 1px solid var(--border); border-radius: 6px; font-size: 13px; }}
   @media print {{
     body {{ background: #fff; }}
     .btn-ctrl, .filter-bar, .btn-inspect, .btn-copy {{ display: none !important; }}
@@ -986,8 +1066,14 @@ def render_html(out: Path, project: str, default_lang: str = "en") -> str:
     </div>
   </section>
 
+  {chains_card}
+
+  {inv_card}
+
   {trend_card}
 
+  {forecast_card}
+
   <section class="card" aria-label="Interactive Findings Table">
     <h2 class="card-title" data-en="Interactive Findings Explorer" data-ja="検出事項一覧・インタラクティブ検索 (Findings Explorer)">Interactive Findings Explorer</h2>
     <div class="filter-bar">

package/assess/lsa/tests/test_attack_chains.py

@@ -0,0 +1,292 @@
+#!/usr/bin/env python3
+"""Tests for attack chain synthesis (Issue #316).
+
+Verifies:
+1. attack-chain.schema.json schema conformity.
+2. 3-step chain synthesis (Mass assignment -> BFLA -> BOLA) with breaking fix calculation.
+3. Safe / disconnected findings produce no chains.
+4. Single findings never become a chain.
+5. Rejected findings are excluded.
+6. SARIF output enrichment with attackChains property.
+
+Standard-library-only (Python 3.8+).
+"""
+from __future__ import annotations
+
+import json
+import sys
+import unittest
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+KIT = HERE.parent
+sys.path.insert(0, str(KIT / "scripts"))
+
+from attack_chains import (  # noqa: E402
+    attach_chains_to_sarif,
+    build_attack_chains,
+    profile_finding,
+    render_attack_chains_html,
+    render_attack_chains_md,
+)
+from merge_findings import load_validator  # noqa: E402
+from render_report import render_en, render_html, render_ja  # noqa: E402
+
+
+class TestAttackChains(unittest.TestCase):
+    def setUp(self) -> None:
+        self.validate_schema = load_validator("attack-chain.schema.json")
+        self.validate_finding = load_validator("finding.schema.json")
+
+    def test_schema_validates_empty_chain_doc(self) -> None:
+        doc = build_attack_chains([])
+        errors = self.validate_schema(doc)
+        self.assertEqual(errors, [], f"Schema errors: {errors}")
+        self.assertEqual(doc["summary"]["total_chains"], 0)
+
+    def test_single_finding_never_becomes_chain(self) -> None:
+        finding = {
+            "finding_id": "BOLA-001",
+            "category": "bola",
+            "subtype": "missing_ownership_check",
+            "title": "BOLA in orders",
+            "location": "Controllers/OrderController.cs:42",
+            "endpoint": "GET /api/orders/{id}",
+            "evidence": "db.Orders.Find(id)",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-639",
+            "recommendation": "Check owner",
+            "status": "confirmed",
+        }
+        doc = build_attack_chains([finding])
+        self.assertEqual(doc["summary"]["total_chains"], 0)
+        self.assertEqual(self.validate_schema(doc), [])
+
+    def test_rejected_findings_are_excluded(self) -> None:
+        f1 = {
+            "finding_id": "MASS-001",
+            "category": "mass_assignment",
+            "subtype": "whole_object_binding",
+            "title": "Mass assignment on register",
+            "location": "register.php:10",
+            "endpoint": "POST /register",
+            "evidence": "extract($_POST)",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-915",
+            "recommendation": "Use allowlist",
+            "status": "rejected",  # Rejected by verifier
+            "attack_vector": {"fields": {"role": "admin"}},
+        }
+        f2 = {
+            "finding_id": "BOLA-001",
+            "category": "bola",
+            "subtype": "missing_ownership_check",
+            "title": "BOLA in orders",
+            "location": "orders.php:20",
+            "endpoint": "GET /orders/{id}",
+            "evidence": "SELECT * FROM orders WHERE id = $id",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-639",
+            "recommendation": "Filter by user",
+            "status": "confirmed",
+        }
+        doc = build_attack_chains([f1, f2])
+        self.assertEqual(doc["summary"]["total_chains"], 0)
+
+    def test_three_step_planted_attack_chain(self) -> None:
+        """Planted 3-step chain: Mass Assignment -> BFLA -> BOLA."""
+        step1_mass = {
+            "finding_id": "MASS-001",
+            "category": "mass_assignment",
+            "subtype": "whole_object_binding",
+            "title": "Mass assignment on registration allows role escalation",
+            "location": "php-plain/register.php:4",
+            "endpoint": "POST /register",
+            "evidence": "extract($_POST) overrides $role",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-915",
+            "recommendation": "Whitelist registration fields",
+            "status": "confirmed",
+            "attack_vector": {
+                "method": "POST",
+                "path": "/register",
+                "fields": {"role": "admin", "is_admin": True},
+            },
+        }
+
+        step2_bfla = {
+            "finding_id": "BFLA-001",
+            "category": "bfla",
+            "subtype": "missing_role_check",
+            "title": "Admin tenant list accessible without role check",
+            "location": "php-plain/admin/tenants.php:12",
+            "endpoint": "GET /admin/tenants",
+            "evidence": "Checks login session but not admin role",
+            "severity": "high",
+            "confidence": "confirmed",
+            "cwe": "CWE-285",
+            "recommendation": "Add requireRole('admin') guard",
+            "status": "confirmed",
+        }
+
+        step3_bola = {
+            "finding_id": "BOLA-001",
+            "category": "bola",
+            "subtype": "missing_ownership_check",
+            "title": "Customer records readable across tenants by ID",
+            "location": "php-plain/customers.php:25",
+            "endpoint": "GET /api/customers/{id}",
+            "evidence": "SELECT * FROM customers WHERE id = ?",
+            "severity": "high",
+            "confidence": "likely",
+            "cwe": "CWE-639",
+            "recommendation": "Bind tenant_id to authenticated user",
+            "status": "likely",
+        }
+
+        doc = build_attack_chains([step1_mass, step2_bfla, step3_bola])
+        errors = self.validate_schema(doc)
+        self.assertEqual(errors, [], f"Schema validation failed: {errors}")
+
+        self.assertGreaterEqual(doc["summary"]["total_chains"], 1)
+        chain = doc["chains"][0]
+        self.assertEqual(chain["chain_id"], "chain-001")
+        self.assertEqual(chain["entry"], "anonymous")
+        self.assertEqual(chain["severity"], "critical")
+        # Confidence is weakest link (likely from step3)
+        self.assertEqual(chain["confidence"], "likely")
+
+        # Verify steps in order
+        step_ids = [s["finding_id"] for s in chain["steps"]]
+        self.assertIn("MASS-001", step_ids)
+        self.assertIn("BOLA-001", step_ids)
+
+        # Breaking fixes must include all chain findings
+        self.assertIn("MASS-001", chain["breaking_fixes"])
+        self.assertIn("BOLA-001", chain["breaking_fixes"])
+
+        # Check summary top breaking fixes
+        top_fixes = doc["summary"]["top_breaking_fixes"]
+        self.assertGreaterEqual(len(top_fixes), 1)
+        broken_counts = {tf["finding_id"]: tf["chains_broken"] for tf in top_fixes}
+        self.assertGreaterEqual(broken_counts.get("MASS-001", 0), 1)
+
+    def test_sarif_enrichment(self) -> None:
+        """Verify attach_chains_to_sarif adds properties.attackChains."""
+        sarif_mock = {
+            "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json",
+            "version": "2.1.0",
+            "runs": [
+                {
+                    "tool": {"driver": {"name": "komagu"}},
+                    "results": [
+                        {
+                            "ruleId": "BOLA-001",
+                            "message": {"text": "BOLA"},
+                            "partialFingerprints": {"komagu/v1": "kfp1:111111"},
+                        },
+                        {
+                            "ruleId": "INJ-001",
+                            "message": {"text": "Unlinked injection"},
+                        },
+                    ],
+                }
+            ],
+        }
+
+        chains_mock = {
+            "chains": [
+                {
+                    "chain_id": "chain-001",
+                    "steps": [
+                        {"finding_id": "MASS-001"},
+                        {"finding_id": "BOLA-001"},
+                    ],
+                }
+            ]
+        }
+
+        enriched = attach_chains_to_sarif(sarif_mock, chains_mock)
+        r0 = enriched["runs"][0]["results"][0]
+        self.assertEqual(r0.get("properties", {}).get("attackChains"), ["chain-001"])
+
+        r1 = enriched["runs"][0]["results"][1]
+        self.assertNotIn("attackChains", r1.get("properties", {}))
+
+    def test_markdown_and_html_rendering(self) -> None:
+        """Verify attack chains render properly in markdown (EN & JA) and HTML dashboard."""
+        mock_chains = {
+            "version": 1,
+            "generated_at": "2026-11-01T20:00:00Z",
+            "chains": [
+                {
+                    "chain_id": "chain-001",
+                    "title": "Mass Assignment → BFLA → BOLA targeting customers",
+                    "entry": "anonymous",
+                    "steps": [
+                        {
+                            "step_index": 1,
+                            "finding_id": "MASS-001",
+                            "category": "mass_assignment",
+                            "location": "register.php:4",
+                            "role_in_chain": "entry_point",
+                            "explanation": "Overwrites role to admin",
+                        },
+                        {
+                            "step_index": 2,
+                            "finding_id": "BOLA-001",
+                            "category": "bola",
+                            "location": "customers.php:25",
+                            "role_in_chain": "impact",
+                            "explanation": "Leaks other tenants",
+                        },
+                    ],
+                    "outcome": "Exfiltration of customer records",
+                    "business_impact": "Loss of customer trust and regulatory fine.",
+                    "severity": "critical",
+                    "confidence": "likely",
+                    "breaking_fixes": ["MASS-001", "BOLA-001"],
+                }
+            ],
+            "summary": {
+                "total_chains": 1,
+                "by_severity": {"critical": 1, "high": 0, "medium": 0, "low": 0},
+                "top_breaking_fixes": [
+                    {
+                        "finding_id": "MASS-001",
+                        "category": "mass_assignment",
+                        "location": "register.php:4",
+                        "chains_broken": 1,
+                    }
+                ],
+            },
+        }
+
+        # Test Markdown EN
+        md_en = "\n".join(render_attack_chains_md(mock_chains, "en"))
+        self.assertIn("Attack Chains", md_en)
+        self.assertIn("Top Breaking Fixes", md_en)
+        self.assertIn("MASS-001", md_en)
+        self.assertIn("chain-001", md_en)
+
+        # Test Markdown JA
+        md_ja = "\n".join(render_attack_chains_md(mock_chains, "ja"))
+        self.assertIn("攻撃チェーン", md_ja)
+        self.assertIn("最優先対策", md_ja)
+        self.assertIn("MASS-001", md_ja)
+        self.assertIn("chain-001", md_ja)
+
+        # Test HTML Card
+        html_card = render_attack_chains_html(mock_chains)
+        self.assertIn("Chained Attack Scenarios", html_card)
+        self.assertIn("Top Breaking Fixes", html_card)
+        self.assertIn("chain-001", html_card)
+        self.assertIn("MASS-001", html_card)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/assess/lsa/tests/test_forecast.py

@@ -0,0 +1,160 @@
+#!/usr/bin/env python3
+"""Tests for security debt forecasting (Issue #318).
+
+Verifies:
+1. forecast.schema.json schema conformity.
+2. Insufficient history detection (< 6 snapshots or < 28 days span).
+3. Converging burndown calculations (P10 <= P50 <= P90).
+4. Flat and diverging trajectory handling without false promises.
+5. Target deadline evaluation (on_track, at_risk, off_track).
+6. What-if velocity simulation.
+7. Markdown (EN & JA) and HTML card rendering.
+
+Standard-library-only (Python 3.8+).
+"""
+from __future__ import annotations
+
+import datetime
+import sys
+import unittest
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+KIT = HERE.parent
+sys.path.insert(0, str(KIT / "scripts"))
+
+from forecast import project_debt, render_forecast_html, render_forecast_md  # noqa: E402
+from merge_findings import load_validator  # noqa: E402
+
+
+class TestForecast(unittest.TestCase):
+    def setUp(self) -> None:
+        self.validate_schema = load_validator("forecast.schema.json")
+
+    def test_schema_validates_empty_and_insufficient_history(self) -> None:
+        doc = project_debt([])
+        errors = self.validate_schema(doc)
+        self.assertEqual(errors, [], f"Schema validation errors: {errors}")
+        self.assertFalse(doc["has_enough_history"])
+        self.assertIn("Requires at least", doc["reason_if_insufficient"])
+
+    def test_insufficient_snapshots_or_span(self) -> None:
+        # 4 snapshots over 10 days
+        history = [
+            {"date": "2026-09-01", "open": 20, "new": 2, "fixed": 1, "regressed": 0, "by_severity": {"critical": 5, "high": 10}},
+            {"date": "2026-09-03", "open": 19, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 4, "high": 10}},
+            {"date": "2026-09-06", "open": 18, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 3, "high": 10}},
+            {"date": "2026-09-10", "open": 16, "new": 0, "fixed": 2, "regressed": 0, "by_severity": {"critical": 2, "high": 10}},
+        ]
+        doc = project_debt(history)
+        self.assertFalse(doc["has_enough_history"])
+        for p in doc["projections"]:
+            self.assertEqual(p["status"], "insufficient_history")
+            self.assertIsNone(p["target_zero_date_p50"])
+        self.assertEqual(self.validate_schema(doc), [])
+
+    def test_converging_burndown_and_targets(self) -> None:
+        # 7 snapshots spanning 42 days, steady fix velocity
+        history = [
+            {"date": "2026-08-01", "open": 30, "new": 1, "fixed": 3, "regressed": 0, "by_severity": {"critical": 6, "high": 12}},
+            {"date": "2026-08-08", "open": 28, "new": 1, "fixed": 3, "regressed": 0, "by_severity": {"critical": 5, "high": 11}},
+            {"date": "2026-08-15", "open": 25, "new": 0, "fixed": 3, "regressed": 0, "by_severity": {"critical": 4, "high": 10}},
+            {"date": "2026-08-22", "open": 22, "new": 1, "fixed": 4, "regressed": 0, "by_severity": {"critical": 3, "high": 9}},
+            {"date": "2026-08-29", "open": 19, "new": 1, "fixed": 4, "regressed": 0, "by_severity": {"critical": 2, "high": 8}},
+            {"date": "2026-09-05", "open": 16, "new": 0, "fixed": 3, "regressed": 0, "by_severity": {"critical": 1, "high": 8}},
+            {"date": "2026-09-12", "open": 13, "new": 0, "fixed": 3, "regressed": 0, "by_severity": {"critical": 1, "high": 7}},
+        ]
+        targets = {
+            "critical": "2026-10-15",  # Generous target
+            "overall": "2026-10-01",   # Very tight target -> should be off_track
+        }
+
+        doc = project_debt(history, targets=targets, today="2026-09-12")
+        errors = self.validate_schema(doc)
+        self.assertEqual(errors, [], f"Schema validation failed: {errors}")
+        self.assertTrue(doc["has_enough_history"])
+
+        # Check rates
+        self.assertGreater(doc["rates"]["fix_rate_per_week"], 2.0)
+        self.assertLess(doc["rates"]["net_rate_per_week"], -1.0)
+
+        crit_proj = next(p for p in doc["projections"] if p["severity"] == "critical")
+        self.assertEqual(crit_proj["status"], "converging")
+        self.assertIsNotNone(crit_proj["target_zero_date_p50"])
+        # Dates must be sorted chronologically: P10 <= P50 <= P90
+        p10 = datetime.datetime.strptime(crit_proj["target_zero_date_p10"], "%Y-%m-%d")
+        p50 = datetime.datetime.strptime(crit_proj["target_zero_date_p50"], "%Y-%m-%d")
+        p90 = datetime.datetime.strptime(crit_proj["target_zero_date_p90"], "%Y-%m-%d")
+        self.assertLessEqual(p10, p50)
+        self.assertLessEqual(p50, p90)
+
+        # Critical target is generous -> on_track or at_risk
+        self.assertIn(crit_proj["target_status"], ("on_track", "at_risk"))
+
+        overall_proj = next(p for p in doc["projections"] if p["severity"] == "overall")
+        # 13 items open, net rate ~ -3/wk -> ~4 weeks (mid October). Target is Oct 1 -> off_track
+        self.assertEqual(overall_proj["target_status"], "off_track")
+
+    def test_diverging_or_flat_history(self) -> None:
+        # History where incoming defects exceed fixes
+        history = [
+            {"date": "2026-08-01", "open": 10, "new": 4, "fixed": 1, "regressed": 0, "by_severity": {"critical": 2, "high": 4}},
+            {"date": "2026-08-08", "open": 13, "new": 4, "fixed": 1, "regressed": 0, "by_severity": {"critical": 3, "high": 5}},
+            {"date": "2026-08-15", "open": 16, "new": 3, "fixed": 0, "regressed": 0, "by_severity": {"critical": 3, "high": 6}},
+            {"date": "2026-08-22", "open": 18, "new": 3, "fixed": 1, "regressed": 0, "by_severity": {"critical": 4, "high": 7}},
+            {"date": "2026-08-29", "open": 20, "new": 3, "fixed": 1, "regressed": 0, "by_severity": {"critical": 5, "high": 8}},
+            {"date": "2026-09-05", "open": 22, "new": 3, "fixed": 1, "regressed": 0, "by_severity": {"critical": 5, "high": 9}},
+            {"date": "2026-09-12", "open": 25, "new": 4, "fixed": 1, "regressed": 0, "by_severity": {"critical": 6, "high": 10}},
+        ]
+        doc = project_debt(history, targets={"overall": "2026-12-31"}, today="2026-09-12")
+        self.assertTrue(doc["has_enough_history"])
+        overall_proj = next(p for p in doc["projections"] if p["severity"] == "overall")
+        self.assertEqual(overall_proj["status"], "diverging")
+        self.assertIsNone(overall_proj["target_zero_date_p50"])
+        self.assertEqual(overall_proj["target_status"], "not_converging")
+
+    def test_what_if_scenarios(self) -> None:
+        history = [
+            {"date": "2026-08-01", "open": 20, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 4, "high": 8}},
+            {"date": "2026-08-08", "open": 19, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 4, "high": 7}},
+            {"date": "2026-08-15", "open": 18, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 3, "high": 7}},
+            {"date": "2026-08-22", "open": 17, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 3, "high": 6}},
+            {"date": "2026-08-29", "open": 16, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 2, "high": 6}},
+            {"date": "2026-09-05", "open": 15, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 2, "high": 5}},
+            {"date": "2026-09-12", "open": 14, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 1, "high": 5}},
+        ]
+        what_ifs = [
+            {"id": "add_dev", "fix_rate_delta": 3.0, "description": "Add 1 developer (+3 fixes/wk)"}
+        ]
+        doc = project_debt(history, what_if_modifiers=what_ifs, today="2026-09-12")
+        self.assertEqual(len(doc["scenarios"]), 2)
+        sc = doc["scenarios"][1]
+        self.assertEqual(sc["scenario_id"], "add_dev")
+        self.assertIn("Estimated ~", sc["projected_date_range"])
+
+    def test_markdown_and_html_rendering(self) -> None:
+        history = [
+            {"date": "2026-08-01", "open": 10, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 2, "high": 4}},
+            {"date": "2026-08-08", "open": 9, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 2, "high": 3}},
+            {"date": "2026-08-15", "open": 8, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 1, "high": 3}},
+            {"date": "2026-08-22", "open": 7, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 1, "high": 2}},
+            {"date": "2026-08-29", "open": 6, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 1, "high": 1}},
+            {"date": "2026-09-05", "open": 5, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 0, "high": 1}},
+            {"date": "2026-09-12", "open": 4, "new": 1, "fixed": 2, "regressed": 0, "by_severity": {"critical": 0, "high": 0}},
+        ]
+        doc = project_debt(history, targets={"critical": "2026-10-01"})
+        md_en = "\n".join(render_forecast_md(doc, "en"))
+        self.assertIn("Outlook & Debt Forecast", md_en)
+        self.assertIn("Arrival Rate", md_en)
+
+        md_ja = "\n".join(render_forecast_md(doc, "ja"))
+        self.assertIn("見通しとセキュリティ負債予測", md_ja)
+        self.assertIn("目標達成予測", md_ja)
+
+        html_card = render_forecast_html(doc)
+        self.assertIn("Outlook &amp; Debt Forecast", html_card)
+        self.assertIn("Arrival Rate", html_card)
+
+
+if __name__ == "__main__":
+    unittest.main()