@hoanghainh/komagu 2.5.0 → 2.6.1

package/operate/ai/client.py

@@ -9,9 +9,13 @@ import json
 import re
 import time
 import urllib.error
+import urllib.parse
 import urllib.request
 from typing import Any, Dict, List, Optional, Tuple
 
+# OpenAI-compatible `reasoning_effort` values; Ollama's /v1 also accepts "none" to turn thinking off (#382)
+REASONING_EFFORTS = ("none", "low", "medium", "high")
+
 
 class LLMClient:
     """Standard-library client for OpenAI-compatible /chat/completions endpoints."""
@@ -22,7 +26,12 @@ class LLMClient:
         model: str = "llama3.1",
         api_key: Optional[str] = None,
         timeout: int = 120,
+        reasoning_effort: Optional[str] = None,
     ) -> None:
+        if reasoning_effort is not None and reasoning_effort not in REASONING_EFFORTS:
+            raise ValueError(f"reasoning_effort must be one of {', '.join(REASONING_EFFORTS)}")
+        if urllib.parse.urlparse(endpoint).scheme.lower() not in ("http", "https"):
+            raise ValueError("LLM endpoint must be an http:// or https:// URL")
         raw_endpoint = endpoint.rstrip("/")
         if not raw_endpoint.endswith("/chat/completions"):
             self.endpoint = f"{raw_endpoint}/chat/completions"
@@ -31,6 +40,7 @@ class LLMClient:
         self.model = model
         self.api_key = api_key or "ollama"
         self.timeout = timeout
+        self.reasoning_effort = reasoning_effort
         # Running totals across chat() calls, read by the runner for ai-run-stats.json
         self.usage: Dict[str, float] = {"calls": 0, "prompt_tokens": 0, "completion_tokens": 0, "seconds": 0.0}
 
@@ -41,15 +51,7 @@ class LLMClient:
         max_tokens: Optional[int] = None,
     ) -> str:
         """Send a chat completion request and return the assistant response content."""
-        payload: Dict[str, Any] = {
-            "model": self.model,
-            "messages": messages,
-            "temperature": temperature,
-        }
-        if max_tokens:
-            payload["max_tokens"] = max_tokens
-
-        data = json.dumps(payload).encode("utf-8")
+        data = json.dumps(self.build_payload(messages, temperature, max_tokens)).encode("utf-8")
         headers = {
             "Content-Type": "application/json",
             "Authorization": f"Bearer {self.api_key}",
@@ -59,7 +61,8 @@ class LLMClient:
         req = urllib.request.Request(self.endpoint, data=data, headers=headers, method="POST")
         started = time.monotonic()
         try:
-            with urllib.request.urlopen(req, timeout=self.timeout) as resp:
+            # The endpoint scheme is checked to be http(s) in __init__.
+            with urllib.request.urlopen(req, timeout=self.timeout) as resp:  # nosec B310
                 body = resp.read().decode("utf-8")
                 res_json = json.loads(body)
                 self._record_usage(res_json.get("usage") or {}, time.monotonic() - started)
@@ -74,6 +77,20 @@ class LLMClient:
         except urllib.error.URLError as e:
             raise RuntimeError(f"Failed to connect to LLM endpoint at {self.endpoint}: {e.reason}") from e
 
+    def build_payload(
+        self,
+        messages: List[Dict[str, str]],
+        temperature: float = 0.1,
+        max_tokens: Optional[int] = None,
+    ) -> Dict[str, Any]:
+        """Request body for /chat/completions; `reasoning_effort` is sent only when it was set."""
+        payload: Dict[str, Any] = {"model": self.model, "messages": messages, "temperature": temperature}
+        if max_tokens:
+            payload["max_tokens"] = max_tokens
+        if self.reasoning_effort:
+            payload["reasoning_effort"] = self.reasoning_effort
+        return payload
+
     def _record_usage(self, usage: Dict[str, Any], seconds: float) -> None:
         self.usage = {
             "calls": self.usage["calls"] + 1,

package/operate/ai/runner.py

@@ -167,6 +167,7 @@ class HeadlessAIRunner:
         stats = {
             "model": getattr(self.client, "model", None),
             "endpoint": getattr(self.client, "endpoint", None),
+            "reasoning_effort": getattr(self.client, "reasoning_effort", None),
             "phases": self.phase_stats,
             "totals": self._usage(),
             "parse_failures": self.parse_failures,
@@ -300,8 +301,9 @@ Output MUST be Markdown format adhering to Komagu auth-model.md specification.
                         {"name": p.get("name", "id"), "source": p.get("source", "path")}
                         for p in c.get("id_params", [])
                     ]
-                if not id_inputs:
-                    id_inputs = [{"name": "id", "source": "path"}]
+                # No detected id input stays empty: inventing a path `id` made the BOLA auditor
+                # flag routes that take no object id (#380)
+                id_inputs = id_inputs or []
 
                 mapped_routes.append({
                     "route_id": route_id,

package/operate/cli/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "2.5.0"  # x-release-please-version
+__version__ = "2.6.1"  # x-release-please-version

package/operate/cli/commands/scan.py

@@ -161,6 +161,12 @@ Examples:
         default=120,
         help="Timeout in seconds per LLM request (default: 120)",
     )
+    parser.add_argument(
+        "--ai-reasoning-effort",
+        choices=("none", "low", "medium", "high"),
+        default=None,
+        help="Send reasoning_effort with each LLM request; 'none' turns thinking off on Ollama (default: not sent)",
+    )
     parser.set_defaults(func=execute_scan)
 
 
@@ -284,7 +290,8 @@ def execute_scan(args: argparse.Namespace) -> int:
                 step_info(msg)
 
         try:
-            client = LLMClient(endpoint=endpoint, model=model, api_key=api_key, timeout=timeout)
+            client = LLMClient(endpoint=endpoint, model=model, api_key=api_key, timeout=timeout,
+                               reasoning_effort=getattr(args, "ai_reasoning_effort", None))
             runner = HeadlessAIRunner(target_path, out_dir, client, step_callback=_scan_callback)
             runner.run()
         except Exception as e:

package/operate/cross_user_tester/runner.py

@@ -242,7 +242,10 @@ class CrossUserTestRunner:
         error_message = None
 
         try:
-            with urllib.request.urlopen(req, timeout=self.timeout) as resp:
+            if urllib.parse.urlparse(url).scheme.lower() not in ("http", "https"):
+                raise ValueError("base URL must be an http:// or https:// URL")
+            # The scheme is checked just above.
+            with urllib.request.urlopen(req, timeout=self.timeout) as resp:  # nosec B310
                 status_code = resp.status
                 raw = resp.read()
                 response_body = raw.decode("utf-8", errors="replace")[:1000]

package/operate/devsecops/sbom.py

@@ -24,6 +24,16 @@ import xml.etree.ElementTree as ET
 from typing import Any, Dict, List, Optional
 
 
+def _parse_xml_without_dtd(file_path: str) -> ET.Element:
+    """Parse a manifest from the scanned project, refusing DTDs (entity expansion)."""
+    with open(file_path, "r", encoding="utf-8", errors="replace") as handle:
+        text = handle.read()
+    if "<!DOCTYPE" in text.upper() or "<!ENTITY" in text.upper():
+        raise ValueError(f"{file_path}: XML with a DTD is not parsed")
+    # DTDs are refused above, so no entity can be declared or expanded.
+    return ET.fromstring(text)  # nosec B314
+
+
 class Component:
     """Represents a software package or component in an SBOM."""
 
@@ -195,8 +205,7 @@ class SBOMGenerator:
     def _parse_csproj(self, file_path: str) -> List[Component]:
         components = []
         try:
-            tree = ET.parse(file_path)
-            root = tree.getroot()
+            root = _parse_xml_without_dtd(file_path)
             for pkg in root.findall(".//PackageReference"):
                 name = pkg.get("Include") or pkg.get("Update")
                 version = pkg.get("Version")
@@ -213,8 +222,7 @@ class SBOMGenerator:
     def _parse_pom_xml(self, file_path: str) -> List[Component]:
         components = []
         try:
-            tree = ET.parse(file_path)
-            root = tree.getroot()
+            root = _parse_xml_without_dtd(file_path)
             ns = {"m": "http://maven.apache.org/POM/4.0.0"}
             # Search both with namespace and without
             deps = root.findall(".//m:dependency", ns) or root.findall(".//dependency")

package/operate/simulate/scenarios.py

@@ -66,6 +66,11 @@ class ScenarioResult:
         }
 
 
+def _require_http(target: str) -> None:
+    if urllib.parse.urlparse(target).scheme.lower() not in ("http", "https"):
+        raise ValueError("target must be an http:// or https:// URL")
+
+
 class BaseScenario:
     """Base class for BAS attack scenarios."""
 
@@ -101,6 +106,7 @@ class TimesCarBreachScenario(BaseScenario):
         sample_ids: Optional[List[str]] = None,
         timeout: float = 10.0,
     ) -> None:
+        _require_http(target)
         super().__init__(target, timeout)
         self.endpoint_pattern = endpoint_pattern
         self.attacker_token = attacker_token
@@ -145,7 +151,8 @@ class TimesCarBreachScenario(BaseScenario):
             response_sample = ""
 
             try:
-                with urllib.request.urlopen(req, timeout=self.timeout) as resp:
+                # self.target is checked to be http(s) in __init__.
+                with urllib.request.urlopen(req, timeout=self.timeout) as resp:  # nosec B310
                     status_code = resp.status
                     body = resp.read().decode("utf-8", errors="replace")[:200]
                     response_sample = body
@@ -218,6 +225,7 @@ class MetabaseZeroDayScenario(BaseScenario):
         target_param: str = "q",
         timeout: float = 10.0,
     ) -> None:
+        _require_http(target)
         super().__init__(target, timeout)
         self.query_path = query_path
         self.target_param = target_param
@@ -269,7 +277,8 @@ class MetabaseZeroDayScenario(BaseScenario):
             response_sample = ""
 
             try:
-                with urllib.request.urlopen(req, timeout=self.timeout) as resp:
+                # self.target is checked to be http(s) in __init__.
+                with urllib.request.urlopen(req, timeout=self.timeout) as resp:  # nosec B310
                     status_code = resp.status
                     body = resp.read().decode("utf-8", errors="replace")[:300]
                     response_sample = body

package/operate/tests/test_ai_reasoning_effort.py

@@ -0,0 +1,65 @@
+#!/usr/bin/env python3
+"""`--ai-reasoning-effort` reaches each /chat/completions request and ai-run-stats.json (#382)."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+
+from operate.ai.client import LLMClient
+from operate.ai.runner import HeadlessAIRunner
+from operate.cli.commands.scan import register_subcommand
+
+MESSAGES = [{"role": "user", "content": "audit"}]
+
+
+class TestReasoningEffortPayload(unittest.TestCase):
+    def test_not_sent_by_default(self) -> None:
+        payload = LLMClient(model="m").build_payload(MESSAGES)
+        self.assertEqual(payload, {"model": "m", "messages": MESSAGES, "temperature": 0.1})
+
+    def test_sent_when_set(self) -> None:
+        payload = LLMClient(model="m", reasoning_effort="none").build_payload(MESSAGES, max_tokens=50)
+        self.assertEqual(payload["reasoning_effort"], "none")
+        self.assertEqual(payload["max_tokens"], 50)
+
+    def test_unknown_value_is_rejected(self) -> None:
+        with self.assertRaises(ValueError):
+            LLMClient(reasoning_effort="off")
+
+
+class TestReasoningEffortCli(unittest.TestCase):
+    def parse(self, *argv: str) -> argparse.Namespace:
+        parser = argparse.ArgumentParser()
+        register_subcommand(parser.add_subparsers(dest="command"))
+        return parser.parse_args(["scan", ".", *argv])
+
+    def test_flag_is_optional(self) -> None:
+        self.assertIsNone(self.parse().ai_reasoning_effort)
+        self.assertEqual(self.parse("--ai-reasoning-effort", "none").ai_reasoning_effort, "none")
+
+    def test_flag_rejects_unknown_values(self) -> None:
+        with self.assertRaises(SystemExit):
+            self.parse("--ai-reasoning-effort", "off")
+
+
+class TestReasoningEffortStats(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = Path(tempfile.mkdtemp(prefix="komagu_effort_"))
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def test_value_is_recorded(self) -> None:
+        runner = HeadlessAIRunner(self.tmp, self.tmp / "out", LLMClient(model="m", reasoning_effort="low"))
+        (self.tmp / "out").mkdir(parents=True, exist_ok=True)
+        stats = json.loads(runner.write_run_stats().read_text(encoding="utf-8"))
+        self.assertEqual(stats["reasoning_effort"], "low")
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_ai_route_inventory.py

@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+"""Route inventory built by the headless runner from Tier 1 route batches (#380)."""
+
+from __future__ import annotations
+
+import json
+import shutil
+import tempfile
+import unittest
+from pathlib import Path
+
+from operate.ai.runner import HeadlessAIRunner
+
+
+class _NoCallClient:
+    model = "none"
+    endpoint = "test://"
+
+    def chat(self, messages, temperature=0.1):  # noqa: ANN001
+        raise AssertionError("route inventory must not call the model")
+
+
+class TestRouteInventory(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = Path(tempfile.mkdtemp(prefix="komagu_inventory_"))
+        self.out = self.tmp / "out"
+        (self.out / "batches").mkdir(parents=True)
+
+    def tearDown(self) -> None:
+        shutil.rmtree(self.tmp, ignore_errors=True)
+
+    def inventory(self, candidates: list) -> list:
+        (self.out / "batches" / "routes-001.json").write_text(json.dumps({"candidates": candidates}), encoding="utf-8")
+        HeadlessAIRunner(self.tmp, self.out, _NoCallClient()).map_routes_inventory()
+        return json.loads((self.out / "routes" / "routes-001.json").read_text(encoding="utf-8"))["routes"]
+
+    def test_route_without_id_params_gets_no_invented_id(self) -> None:
+        routes = self.inventory([{"route_id": "R-0001", "method": ["POST"], "path": "/register",
+                                  "handler": {"file": "app/Http/Controllers/AccountController.php", "line": 11},
+                                  "id_params": []}])
+        self.assertEqual(routes[0]["id_inputs"], [])
+
+    def test_detected_id_params_are_kept(self) -> None:
+        routes = self.inventory([{"route_id": "R-0001", "method": ["GET"], "path": "/orders/{id}",
+                                  "handler": {"file": "routes/web.php", "line": 3},
+                                  "id_params": [{"name": "id", "source": "path", "is_id_like": True},
+                                                {"name": "orderId", "source": "query"}]}])
+        self.assertEqual(routes[0]["id_inputs"], [{"name": "id", "source": "path"},
+                                                  {"name": "orderId", "source": "query"}])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_audit_minimum_versions.py

@@ -0,0 +1,89 @@
+#!/usr/bin/env python3
+"""`.github/scripts/audit_minimum_versions.py`: audits the lowest version each requirement allows (#390)."""
+
+from __future__ import annotations
+
+import importlib.util
+import os
+import tempfile
+import unittest
+from pathlib import Path
+from unittest import mock
+
+SCRIPT = Path(__file__).resolve().parents[2] / ".github" / "scripts" / "audit_minimum_versions.py"
+_spec = importlib.util.spec_from_file_location("audit_minimum_versions", SCRIPT)
+amv = importlib.util.module_from_spec(_spec)
+_spec.loader.exec_module(amv)
+
+
+def _report(*vulns: tuple) -> dict:
+    deps = {}
+    for name, version, vuln_id, fixes in vulns:
+        deps.setdefault((name, version), []).append({"id": vuln_id, "fix_versions": fixes})
+    return {"dependencies": [{"name": n, "version": v, "vulns": vs} for (n, v), vs in deps.items()]}
+
+
+class TestMinimumPins(unittest.TestCase):
+    def test_lower_bounds_and_exact_pins_become_pins(self) -> None:
+        text = "# comment\npyjwt>=2.15.0\ncryptography[ssh] >= 50.0.0  # note\nrequests==2.32.3\n"
+        self.assertEqual(amv.minimum_pins(text), ["pyjwt==2.15.0", "cryptography==50.0.0", "requests==2.32.3"])
+
+    def test_unversioned_and_upper_bounds_are_ignored(self) -> None:
+        self.assertEqual(amv.minimum_pins("flask\nurllib3<3\n-r other.txt\n"), [])
+
+
+class TestClassify(unittest.TestCase):
+    def test_fixable_and_unfixable_are_split_and_deduplicated(self) -> None:
+        report = _report(
+            ("pyjwt", "2.8.0", "PYSEC-1", ["2.12.0"]),
+            ("pyjwt", "2.8.0", "PYSEC-1", ["2.12.0"]),
+            ("pyjwt", "2.8.0", "PYSEC-2", []),
+        )
+        fixable, unfixable = amv.classify(report)
+        self.assertEqual(fixable, ["pyjwt 2.8.0: PYSEC-1 (fixed in 2.12.0)"])
+        self.assertEqual(unfixable, ["pyjwt 2.8.0: PYSEC-2 (no fixed version)"])
+
+
+class TestMain(unittest.TestCase):
+    def setUp(self) -> None:
+        self.tmp = tempfile.mkdtemp(prefix="komagu_amv_")
+        self.req = os.path.join(self.tmp, "requirements.txt")
+        self.summary = os.path.join(self.tmp, "summary.md")
+        with open(self.req, "w", encoding="utf-8") as handle:
+            handle.write("pyjwt>=2.8.0\n")
+
+    def _run(self, report: dict) -> int:
+        with mock.patch.object(amv, "audit", return_value=report) as audit, \
+                mock.patch("builtins.print"):
+            code = amv.main(["--summary", self.summary, self.req])
+        audit.assert_called_once_with(["pyjwt==2.8.0"])
+        return code
+
+    def test_fixable_vulnerability_at_the_minimum_fails(self) -> None:
+        self.assertEqual(self._run(_report(("pyjwt", "2.8.0", "PYSEC-1", ["2.12.0"]))), 1)
+        with open(self.summary, encoding="utf-8") as handle:
+            self.assertIn("FAIL pyjwt 2.8.0: PYSEC-1", handle.read())
+
+    def test_vulnerability_without_a_fix_is_only_reported(self) -> None:
+        self.assertEqual(self._run(_report(("pyjwt", "2.8.0", "PYSEC-2", []))), 0)
+        with open(self.summary, encoding="utf-8") as handle:
+            self.assertIn("note pyjwt 2.8.0: PYSEC-2", handle.read())
+
+    def test_clean_minimum_passes(self) -> None:
+        self.assertEqual(self._run({"dependencies": [{"name": "pyjwt", "version": "2.8.0", "vulns": []}]}), 0)
+
+
+class TestRepositoryMinimums(unittest.TestCase):
+    """Minimums raised in #390: these versions had fixable advisories."""
+
+    def test_raised_minimums(self) -> None:
+        root = SCRIPT.parents[2]
+        ekyc = amv.minimum_pins((root / "remediate/ekyc/requirements.txt").read_text(encoding="utf-8"))
+        identity = amv.minimum_pins((root / "remediate/identity/python/requirements.txt").read_text(encoding="utf-8"))
+        self.assertIn("cryptography==50.0.0", ekyc)
+        self.assertIn("cryptography==50.0.0", identity)
+        self.assertIn("pyjwt==2.15.0", identity)
+
+
+if __name__ == "__main__":
+    unittest.main()

package/operate/tests/test_cli.py

@@ -61,7 +61,7 @@ class TestKomaguCLI(unittest.TestCase):
     def test_subcommand_parser_builds_cleanly(self) -> None:
         """In-process parser must parse subcommands without throwing."""
         parser = build_parser()
-        args_scan = parser.parse_args(["scan", "/tmp", "--format", "html"])
+        args_scan = parser.parse_args(["scan", "./src", "--format", "html"])
         self.assertEqual(args_scan.subcommand, "scan")
         self.assertEqual(args_scan.format, "html")
 

package/operate/tests/test_scheme_and_xml_guards.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""Guards behind the Bandit B310 / B314 suppressions (#385).
+
+Each `# nosec` added for #385 relies on a check: outbound requests only use
+http(s) URLs, and SBOM manifests with a DTD are not parsed.
+"""
+
+from __future__ import annotations
+
+import os
+import shutil
+import tempfile
+import unittest
+
+from operate.ai.client import LLMClient
+from operate.cross_user_tester.runner import CrossUserTestRunner, TestCase
+from operate.devsecops.sbom import SBOMGenerator
+from operate.simulate.scenarios import MetabaseZeroDayScenario, TimesCarBreachScenario
+
+CSPROJ = '<Project Sdk="Microsoft.NET.Sdk"><ItemGroup><PackageReference Include="Dapper" Version="2.1.28" /></ItemGroup></Project>'
+CSPROJ_WITH_DTD = (
+    '<?xml version="1.0"?>\n<!DOCTYPE Project [<!ENTITY a "aaaaaaaaaa">]>\n'
+    '<Project Sdk="Microsoft.NET.Sdk"><ItemGroup><PackageReference Include="&a;" Version="1.0.0" /></ItemGroup></Project>'
+)
+
+
+class TestHttpOnlyUrls(unittest.TestCase):
+    def test_llm_client_accepts_http_and_https(self) -> None:
+        self.assertEqual(LLMClient("http://127.0.0.1:11434/v1").endpoint, "http://127.0.0.1:11434/v1/chat/completions")
+        self.assertEqual(LLMClient("https://llm.example/v1/chat/completions").endpoint, "https://llm.example/v1/chat/completions")
+
+    def test_llm_client_rejects_other_schemes(self) -> None:
+        for endpoint in ("file:///etc/passwd", "ftp://host/v1", "127.0.0.1:11434/v1"):
+            with self.subTest(endpoint=endpoint), self.assertRaises(ValueError):
+                LLMClient(endpoint)
+
+    def test_scenarios_reject_other_schemes(self) -> None:
+        for scenario in (TimesCarBreachScenario, MetabaseZeroDayScenario):
+            with self.subTest(scenario=scenario.__name__), self.assertRaises(ValueError):
+                scenario("file:///etc")
+
+    def test_bearer_runner_does_not_open_other_schemes(self) -> None:
+        res = CrossUserTestRunner("file://").execute_test(TestCase("t", "/etc/passwd", "GET"))
+        self.assertFalse(res.is_secure or res.is_breach)
+        self.assertEqual(res.status_code, 0)
+        self.assertIn("http", res.error_message or "")
+
+
+class TestSbomRefusesDtd(unittest.TestCase):
+    def setUp(self) -> None:
+        self.root = tempfile.mkdtemp(prefix="komagu_sbom_dtd_")
+        self.addCleanup(shutil.rmtree, self.root, True)
+
+    def _scan(self, content: str) -> list:
+        with open(os.path.join(self.root, "Service.csproj"), "w", encoding="utf-8") as handle:
+            handle.write(content)
+        return [c.name for c in SBOMGenerator(root_dir=self.root).scan()]
+
+    def test_plain_manifest_is_parsed(self) -> None:
+        self.assertIn("Dapper", self._scan(CSPROJ))
+
+    def test_manifest_with_dtd_is_skipped(self) -> None:
+        self.assertEqual(self._scan(CSPROJ_WITH_DTD), [])
+
+
+if __name__ == "__main__":
+    unittest.main()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hoanghainh/komagu",
-  "version": "2.5.0",
+  "version": "2.6.1",
   "description": "Security-First Legacy Modernization Platform CLI (LSA Kit, IAM Perimeter, Cross-User Testing)",
   "main": "remediate/authz/nodejs/src/index.js",
   "types": "remediate/authz/nodejs/src/index.d.ts",

package/remediate/authz/dotnet/src/Komagu.Security.Authorization/LoggingSecurityAuditSink.cs

@@ -5,7 +5,7 @@ using Microsoft.Extensions.Logging;
 /// <summary>
 /// Default security audit sink implementation logging structured events via ILogger.
 /// </summary>
-public sealed class LoggingSecurityAuditSink : ISecurityAuditSink
+public sealed partial class LoggingSecurityAuditSink : ISecurityAuditSink
 {
     private readonly ILogger<LoggingSecurityAuditSink> _logger;
 
@@ -18,8 +18,8 @@ public sealed class LoggingSecurityAuditSink : ISecurityAuditSink
     {
         ArgumentNullException.ThrowIfNull(auditEvent);
 
-        _logger.LogWarning(
-            "[SECURITY AUDIT] {EventName} | TraceId: {TraceId} | Actor: {ActorUserId} | Tenant: {ActorTenantId} | Target: {ResourceType}/{ResourceId} | Op: {Operation} | IP: {ClientIp} | Reason: {Reason}",
+        LogAuditEvent(
+            _logger,
             auditEvent.EventName,
             auditEvent.TraceId ?? "none",
             auditEvent.ActorUserId ?? "anonymous",
@@ -32,4 +32,20 @@ public sealed class LoggingSecurityAuditSink : ISecurityAuditSink
 
         return ValueTask.CompletedTask;
     }
+
+    [LoggerMessage(
+        EventId = 1,
+        Level = LogLevel.Warning,
+        Message = "[SECURITY AUDIT] {EventName} | TraceId: {TraceId} | Actor: {ActorUserId} | Tenant: {ActorTenantId} | Target: {ResourceType}/{ResourceId} | Op: {Operation} | IP: {ClientIp} | Reason: {Reason}")]
+    private static partial void LogAuditEvent(
+        ILogger logger,
+        string eventName,
+        string traceId,
+        string actorUserId,
+        string actorTenantId,
+        string resourceType,
+        string resourceId,
+        ResourceOperation operation,
+        string clientIp,
+        string reason);
 }

package/remediate/authz/golang/authz_test.go

@@ -1,6 +1,7 @@
 package golang
 
 import (
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -67,7 +68,7 @@ func TestAuthorizer_AttackerDeniedWith404AndAudit(t *testing.T) {
 	// Verify RequireOwnership returns ErrResourceNotFound
 	sink.Events = nil // Reset sink
 	err := auth.RequireOwnership(attackerClaims, order, OpRead)
-	if err != ErrResourceNotFound {
+	if !errors.Is(err, ErrResourceNotFound) {
 		t.Fatalf("expected ErrResourceNotFound, got: %v", err)
 	}
 
@@ -129,7 +130,9 @@ func TestAuthorizer_HTTPMiddleware(t *testing.T) {
 
 	handler := auth.Middleware(claimsExtractor, loader, OpRead)(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(http.StatusOK)
-		w.Write([]byte(`{"status":"ok"}`))
+		if _, err := w.Write([]byte(`{"status":"ok"}`)); err != nil {
+			t.Errorf("write response: %v", err)
+		}
 	}))
 
 	// 1. Owner request -> 200 OK