@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/licensing/candidates/selected-runtime-coverage.json

@@ -0,0 +1,91 @@
+{
+  "schemaVersion": 1,
+  "status": "real-selected-runtime-coverage-evidence-not-release-clearance",
+  "verifiedAt": "2026-10-21",
+  "environment": {
+    "platform": "linux",
+    "containerImage": "node:22-bookworm-slim@sha256:1b3abbc0bf2421c8733f58c6fd7bbb961a960f37e05ed7369eccd1fbb0edcc84",
+    "network": "none",
+    "readOnlyRoot": true,
+    "rawSourcesPersistedToWindows": false
+  },
+  "sast": {
+    "sourceCommit": "53bf5cf6df3c51b6c02110f5a638b5e6213666cd",
+    "sourceNoticeBundleSha256": "aa6f5134dcf908f46992b7a00e7c42d5f7dcaeb45a0fad293132474159ecdd83",
+    "selectedRuleFiles": 161,
+    "opengrepVersion": "1.30.0",
+    "opengrepSha256": "35779bdd72e92129c8df2a77f0c55e8c08356801ea92591ef32108d6b28d564c",
+    "fixtureFiles": 21,
+    "findings": 19,
+    "uniqueRules": 19,
+    "uniqueLocations": 14,
+    "safeControls": 8,
+    "safeControlFindings": 0,
+    "scanProblems": 0,
+    "baselineComparison": {
+      "baselineFindings": 20,
+      "baselineLocations": 14,
+      "selectedLocations": 14,
+      "missingLocations": [],
+      "identityAliases": {
+        "react-dangerouslysetinnerhtml": "javascript_react_rule-dangerouslysetinnerhtml",
+        "disabled-cert-validation": "python_ssl_rule-req-no-certvalid",
+        "avoid-pickle": "python_deserialization_rule-pickle",
+        "subprocess-shell-true": "python_exec_rule-subprocess-popen-shell-true",
+        "dangerous-subprocess-use-audit": "python_exec_rule-subprocess-popen-shell-true"
+      },
+      "findingCountDifference": "The restricted baseline emitted two rule identities for the same subprocess-shell location. The selected runtime emits one selected identity there, while the unchanged original VSG rule also remains present. No vulnerable location or represented class was lost."
+    },
+    "receipt": {
+      "path": "2026/10/21/lattice-vsg-release-cycle-7/selected-sast-coverage.json",
+      "sha256": "1395dbb734257af0822e5be27b67ae3b09dedbe326a0d13e84591094dcb4f309",
+      "bytes": 4553
+    },
+    "harness": {
+      "path": "2026/10/21/lattice-vsg-release-cycle-7/run-selected-sast-coverage.mjs",
+      "sha256": "9439b7c8283e2fa4c65259ab9cea85e5fe9edff7e4adcea6ec4de9db0caa6c28",
+      "bytes": 7395
+    },
+    "boundedCoveragePassed": true
+  },
+  "yara": {
+    "archiveVersion": "20260927",
+    "archiveSha256": "16180800cc2f077638d2e13a33bd68609d0b6eedd1fbfdbae6d5d4a1c53f826f",
+    "inventorySha256": "4a1eb672e488b99d3381979a9eb1de4890edee79cfbcded9502683d48dbc7d54",
+    "yaraXVersion": "1.21.0",
+    "yaraXBinarySha256": "a4b6fec172c813cdfc099a4a392939cfc2c555e9e7745fb4b5ed369ab1edf93b",
+    "selectionDigest": "33aa825b1f9c843e7129f26b5b57e85d6121562cdeb577e40aef9360601585f6",
+    "holdDigest": "22150df654bf4396c085336f1c00f8d0483cdc61713a81db32a115c586ef98e2",
+    "sourceRuleBlocks": 5110,
+    "sourceBlockHashesMatched": 5110,
+    "compiledSelectedRules": 4536,
+    "excludedHeldRules": 574,
+    "droppedRules": 0,
+    "scanErrors": 0,
+    "generatedHarmlessPositiveControls": 164,
+    "expectedPositiveMatches": 138,
+    "cleanControlMatches": 0,
+    "receipt": {
+      "path": "2026/10/21/lattice-vsg-release-cycle-7/selected-yara-coverage.json",
+      "sha256": "084094cdd9e6b8aa504a946ec12c3a95d1cfcf685ac6274041bfb9af8a8f8777",
+      "bytes": 8012
+    },
+    "harness": {
+      "path": "2026/10/21/lattice-vsg-release-cycle-7/run-selected-yara-coverage.mjs",
+      "sha256": "08a69cf51ff361092c927650984f68a0a7f48db9204c9960916dcedee0cdae25",
+      "bytes": 10629
+    },
+    "boundedCoveragePassed": true
+  },
+  "coverageDecision": {
+    "status": "approved-for-protected-test-qualification",
+    "basis": "Exact selected source identities, strict real execution, retained vulnerable locations, clean controls, explicit held-rule coverage disclosure, and no restricted fallback.",
+    "publicCommercialReleaseApproved": false,
+    "checkoutApproved": false
+  },
+  "limits": [
+    "The SAST fixture is bounded to the supported initial web stack and does not prove every rule or language family.",
+    "The YARA positive matrix proves real selected-pack execution with harmless synthesized controls, not exhaustive malware-family equivalence.",
+    "This record does not establish legal clearance, source-distribution compliance, public artifact publication, checkout activation, or production deployment approval."
+  ]
+}