@ngocsangairvds/vsaf 3.2.13 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/engine/scorer.py

@@ -1,1239 +0,0 @@
-"""Scoring utilities for audit results.
-
-This module implements the scoring engine for audit results (FR-004, FR-010).
-
-Key features:
-- Weighted scores at check, section, and repository levels
-- N/A status handling with exclusion from weight totals and renormalization (FR-004.09)
-- Section scoring policies: weighted_mean, maturity, compliance_gate, threshold (FR-010.01)
-- Check scoring modes: binary, threshold, ratio, range/gradient, maturity (FR-010.02)
-- Critical-check gating/score caps (FR-010.03)
-- Confidence/coverage factors from ERROR/UNKNOWN checks (FR-010.04)
-- Severity-based default weights when explicit weights missing (FR-010.07)
-- Adaptive weighting based on project profiles (FR-009)
-
-Advanced Scoring Policies (TSK-021):
-- Maturity scoring with quality_factor multiplier
-- Threshold-based check scoring with score_config
-- Range/gradient scoring with min/max boundaries and linear interpolation
-- Compliance gate with required check detection
-- Critical gate with configurable score caps
-- Confidence/coverage factors with confidence_mode (coverage/confidence/both)
-
-Phase 4: Profile-Aware Scoring (FR-011):
-- Profile-aware adaptive scoring with risk-based multipliers
-- Graduated 0-10 scoring replacing binary pass/fail
-"""
-
-from __future__ import annotations
-
-import contextlib
-from collections.abc import Iterable, Mapping, Sequence
-from dataclasses import dataclass, field
-from enum import StrEnum
-from typing import TYPE_CHECKING, Any
-
-from vds_audit_orchestrator.models.enums import CheckStatus, Severity
-from vds_audit_orchestrator.models.findings import (
-    CheckFinding,
-    RepositoryAuditResult,
-    SectionResult,
-    WeightingRationale,
-    compute_grade,
-)
-
-if TYPE_CHECKING:
-    from vds_audit_orchestrator.models.evidence import EvidenceBundle
-    from vds_audit_orchestrator.models.template import AuditCheck, AuditSection, AuditTemplate
-    from vds_audit_orchestrator.profiles.models import ProjectProfile
-
-
-class ScoreMode(StrEnum):
-    """Check scoring modes (FR-010.02, TSK-021)."""
-
-    BINARY = "binary"  # Pass=100, Fail=0
-    THRESHOLD = "threshold"  # >= threshold = 100, else 0 (with score_config)
-    RATIO = "ratio"  # Proportional score based on actual/expected
-    RANGE = "range"  # Gradient scoring based on value ranges
-    GRADIENT = "gradient"  # Alias for range
-    MATURITY = "maturity"  # Maturity level scoring (0-3 mapped to 0-100)
-
-
-# Severity-based fallback weights (FR-010.07)
-# Aligned with OpenSSF Scorecard risk weighting
-SEVERITY_FALLBACK_WEIGHTS: dict[Severity, float] = {
-    Severity.CRITICAL: 10.0,
-    Severity.HIGH: 7.5,
-    Severity.MEDIUM: 5.0,
-    Severity.LOW: 2.5,
-    Severity.INFO: 2.5,
-}
-
-# Default score caps by section tag (FR-010.03)
-DEFAULT_SECTION_CAPS: dict[str, float] = {
-    "security": 60.0,  # Security sections capped at 60% if critical check fails
-    "compliance": 0.0,  # Compliance sections fail closed (0%) if critical check fails
-}
-
-# Critical check tags that trigger score cap
-CRITICAL_TAGS = {"must", "critical", "security-critical"}
-
-
-@dataclass(frozen=True)
-class SectionScore:
-    """Internal section scoring result.
-
-    Attributes:
-        section_id: Section identifier
-        score_percent: Score as percentage (0-100)
-        weighted_score: Weighted contribution to overall score
-        status: Overall section status
-        coverage_factor: Coverage factor (1.0 = full coverage)
-        confidence_factor: Average confidence of findings
-        score_cap_applied: Score cap value if applied
-        total_checks: Total number of checks
-        passed_checks: Number of passed checks
-        failed_checks: Number of failed/partial checks
-        error_checks: Number of ERROR status checks
-        skipped_checks: Number of skipped checks
-        na_checks: Number of N/A checks
-        missing_findings: Tuple of check IDs with missing findings
-    """
-
-    section_id: str
-    score_percent: float
-    weighted_score: float
-    status: CheckStatus
-    coverage_factor: float
-    confidence_factor: float
-    total_checks: int
-    passed_checks: int
-    failed_checks: int
-    error_checks: int
-    skipped_checks: int
-    na_checks: int
-    score_cap_applied: float | None = None
-    missing_findings: tuple[str, ...] = field(default_factory=tuple)
-
-
-@dataclass(frozen=True)
-class RepositoryScore:
-    """Internal repository scoring result.
-
-    Attributes:
-        total_score: Overall score (0-100)
-        section_scores: Tuple of section scores
-    """
-
-    total_score: float
-    section_scores: tuple[SectionScore, ...]
-
-
-# ============================================================================
-# Helper Functions
-# ============================================================================
-
-
-def _is_applicable(status: CheckStatus) -> bool:
-    """Check if a finding is applicable (not N/A)."""
-    return status != CheckStatus.NOT_APPLICABLE
-
-
-def _is_error(status: CheckStatus) -> bool:
-    """Check if a finding is in ERROR state."""
-    return status == CheckStatus.ERROR
-
-
-def _is_fail(status: CheckStatus) -> bool:
-    """Check if a finding indicates failure."""
-    return status in {CheckStatus.FAILED, CheckStatus.PARTIAL, CheckStatus.ERROR}
-
-
-def _normalize_weights(weights: Mapping[str, float]) -> dict[str, float]:
-    """Normalize weights to sum to 1.0."""
-    total = sum(weights.values())
-    if total <= 0:
-        return dict.fromkeys(weights, 0.0)
-    return {key: value / total for key, value in weights.items()}
-
-
-def _severity_weight(check: AuditCheck, overrides: Mapping[Severity, float] | None) -> float:
-    """Get weight for a check based on severity."""
-    severity = check.severity if check.severity is not None else Severity.MEDIUM
-    if overrides and severity in overrides:
-        return overrides[severity]
-    return SEVERITY_FALLBACK_WEIGHTS.get(severity, SEVERITY_FALLBACK_WEIGHTS[Severity.MEDIUM])
-
-
-def _resolve_score_cap(section: AuditSection) -> float | None:
-    """Resolve score cap for a section (explicit or tag-based)."""
-    if section.score_cap is not None:
-        return section.score_cap
-    tags = {t.lower() for t in getattr(section, "tags", [])}
-    for tag, cap in DEFAULT_SECTION_CAPS.items():
-        if tag in tags:
-            return cap
-    return None
-
-
-def _collect_tags(check: AuditCheck) -> set[str]:
-    """Collect all tags from a check definition."""
-    tags = set(getattr(check, "tags", []) or [])
-    plugin_tags = None
-    if isinstance(check.score_config, dict):
-        plugin_tags = check.score_config.get("tags")
-    if plugin_tags:
-        tags.update({str(t) for t in plugin_tags})
-    return {t.lower() for t in tags}
-
-
-# ============================================================================
-# Check-Level Scoring (TSK-021: Threshold, Range, Maturity)
-# ============================================================================
-
-
-def _calculate_check_score(
-    check: AuditCheck,
-    finding: CheckFinding,
-    value: float | None = None,
-) -> float:
-    """Calculate score for a single check based on its score_mode.
-
-    Args:
-        check: The audit check definition
-        finding: The check finding result
-        value: Optional numeric value for threshold/range modes
-
-    Returns:
-        Score as percentage (0.0-100.0)
-    """
-    score_mode = check.score_mode or "binary"
-
-    # If finding already has a score, use it
-    if finding.score_percentage > 0:
-        return finding.score_percentage
-
-    # Binary mode (default)
-    if score_mode == "binary":
-        if finding.status == CheckStatus.PASSED:
-            return 100.0
-        elif finding.status == CheckStatus.PARTIAL:
-            return 50.0
-        else:
-            return 0.0
-
-    # Maturity mode: map 0-3 maturity levels to score
-    elif score_mode == "maturity":
-        maturity_level = 0
-        if isinstance(check.score_config, dict):
-            maturity_level = check.score_config.get("maturity_level", 0)
-        # Map 0-3 to 0-100: 0=0%, 1=33%, 2=67%, 3=100%
-        base_score = (maturity_level / 3.0) * 100.0
-        # Apply quality_factor if present
-        quality_factor = check.score_config.get("quality_factor") if isinstance(check.score_config, dict) else None
-        if quality_factor:
-            with contextlib.suppress(TypeError, ValueError):
-                base_score *= float(quality_factor)
-        return max(0.0, min(100.0, base_score))
-
-    # Threshold mode: score based on value thresholds
-    elif score_mode == "threshold":
-        if value is None:
-            # Fall back to status-based scoring
-            return 100.0 if finding.status == CheckStatus.PASSED else 0.0
-        # Get thresholds from score_config: [(value, score), ...]
-        thresholds = check.score_config.get("thresholds", []) if isinstance(check.score_config, dict) else []
-        if not thresholds:
-            # Single threshold mode
-            threshold = check.score_config.get("threshold", 0) if isinstance(check.score_config, dict) else 0
-            return 100.0 if value >= threshold else 0.0
-        # Graduated threshold scoring
-        for threshold_value, threshold_score in sorted(thresholds, reverse=True):
-            if value >= threshold_value:
-                return float(threshold_score)
-        return 0.0
-
-    # Range/Gradient mode: linear interpolation between thresholds
-    elif score_mode in ("range", "gradient"):
-        if value is None:
-            return 100.0 if finding.status == CheckStatus.PASSED else 0.0
-        # Get range config: {min: (value, score), max: (value, score)}
-        if not isinstance(check.score_config, dict):
-            return 100.0 if finding.status == CheckStatus.PASSED else 0.0
-
-        min_config = check.score_config.get("min", [0, 0])
-        max_config = check.score_config.get("max", [100, 100])
-
-        # Handle both tuple and list formats
-        if isinstance(min_config, (tuple, list)) and len(min_config) >= 2:
-            min_value, min_score = float(min_config[0]), float(min_config[1])
-        else:
-            min_value, min_score = 0.0, 0.0
-
-        if isinstance(max_config, (tuple, list)) and len(max_config) >= 2:
-            max_value, max_score = float(max_config[0]), float(max_config[1])
-        else:
-            max_value, max_score = 100.0, 100.0
-
-        # Clamp value to range
-        clamped_value = max(min_value, min(max_value, value))
-
-        # Linear interpolation
-        if max_value == min_value:
-            return max_score
-        ratio = (clamped_value - min_value) / (max_value - min_value)
-        score = min_score + ratio * (max_score - min_score)
-        return max(0.0, min(100.0, score))
-
-    # Ratio mode: proportional scoring
-    elif score_mode == "ratio":
-        if value is None:
-            return finding.score_percentage
-        # Get expected value from score_config
-        if isinstance(check.score_config, dict):
-            expected = check.score_config.get("expected", 1)
-            if expected > 0:
-                return max(0.0, min(100.0, (value / expected) * 100.0))
-        return finding.score_percentage
-
-    # Default to status-based
-    return 100.0 if finding.status == CheckStatus.PASSED else 0.0
-
-
-# ============================================================================
-# Section-Level Scoring (TSK-021: Maturity, Compliance Gate, Critical Gate)
-# ============================================================================
-
-
-def _score_maturity_policy(
-    section: AuditSection,
-    findings: dict[str, CheckFinding],
-    scored_weights: dict[str, float],
-    applicable_weights: dict[str, float],
-) -> float:
-    """Calculate section score using maturity aggregation policy.
-
-    Aggregates scores by practice_id/maturity_group, then averages across groups.
-    Applies optional quality_factor multiplier.
-
-    Args:
-        section: The audit section
-        findings: Mapping of check_id to CheckFinding
-        scored_weights: Mapping of check_id to score value (0-1)
-        applicable_weights: Mapping of check_id to weight
-
-    Returns:
-        Raw score (0.0-1.0)
-    """
-    group_scores: dict[str, list[tuple[float, float]]] = {}
-    quality_factors: list[float] = []
-
-    for check in section.checks:
-        finding = findings.get(check.id)
-        if finding is None or not _is_applicable(finding.status) or _is_error(finding.status):
-            continue
-
-        # Get maturity group from score_config
-        group = None
-        quality_factor = None
-        if isinstance(check.score_config, dict):
-            group = check.score_config.get("maturity_group") or check.score_config.get("practice_id")
-            quality_factor = check.score_config.get("quality_factor")
-
-        group_key = str(group) if group else check.id
-
-        # Collect quality factors
-        if quality_factor is not None:
-            with contextlib.suppress(TypeError, ValueError):
-                quality_factors.append(float(quality_factor))
-
-        # Collect group scores
-        if check.id in scored_weights:
-            group_scores.setdefault(group_key, []).append((applicable_weights[check.id], scored_weights[check.id]))
-
-    if not group_scores:
-        return 0.0
-
-    # Calculate group-level scores (weighted average within each group)
-    group_values: list[tuple[float, float]] = []
-    for entries in group_scores.values():
-        weights = {str(idx): w for idx, (w, _) in enumerate(entries)}
-        norm = _normalize_weights(weights)
-        group_score = sum(score * norm[str(idx)] for idx, (_, score) in enumerate(entries))
-        group_weight = sum(w for w, _ in entries)
-        group_values.append((group_weight, group_score))
-
-    # Average across groups (group-weighted)
-    if not group_values:
-        return 0.0
-
-    group_weights = {str(idx): w for idx, (w, _) in enumerate(group_values)}
-    group_norm = _normalize_weights(group_weights)
-    raw_score = sum(score * group_norm[str(idx)] for idx, (_, score) in enumerate(group_values))
-
-    # Apply quality factor multiplier if present
-    if quality_factors:
-        avg_quality = sum(quality_factors) / len(quality_factors)
-        raw_score = max(0.0, min(1.0, raw_score * avg_quality))
-
-    return raw_score
-
-
-def _score_compliance_gate_policy(
-    section: AuditSection,
-    findings: dict[str, CheckFinding],
-) -> tuple[bool, float | None]:
-    """Check if compliance gate should apply (required check failed).
-
-    Returns:
-        Tuple of (gate_triggered, cap_value)
-    """
-    for check in section.checks:
-        finding = findings.get(check.id)
-        status = finding.status if finding else CheckStatus.ERROR
-
-        if _is_fail(status):
-            # Check if this is a required check
-            is_required = check.required or (
-                isinstance(check.score_config, dict) and check.score_config.get("required")
-            )
-            if is_required:
-                cap_value = section.score_cap if section.score_cap is not None else 0.0
-                return True, cap_value
-
-    return False, None
-
-
-def _check_critical_gate(
-    section: AuditSection,
-    findings: dict[str, CheckFinding],
-) -> tuple[bool, float | None]:
-    """Check if critical gate should apply (critical or 'must' tag failed).
-
-    Returns:
-        Tuple of (gate_triggered, cap_value)
-    """
-    for check in section.checks:
-        finding = findings.get(check.id)
-        status = finding.status if finding else CheckStatus.ERROR
-
-        if _is_fail(status):
-            # Check severity
-            if check.severity == Severity.CRITICAL:
-                cap_value = _resolve_score_cap(section)
-                return True, cap_value
-
-            # Check critical tags
-            tags = _collect_tags(check)
-            if CRITICAL_TAGS.intersection(tags):
-                cap_value = _resolve_score_cap(section)
-                return True, cap_value
-
-    return False, None
-
-
-def _calculate_coverage_factor(
-    applicable_weights: dict[str, float],
-    error_weights: dict[str, float],
-) -> float:
-    """Calculate coverage factor based on ERROR check weights.
-
-    coverage_factor = 1 - (sum of ERROR weights / sum of applicable weights)
-
-    Args:
-        applicable_weights: All applicable check weights
-        error_weights: ERROR check weights
-
-    Returns:
-        Coverage factor (0.0-1.0)
-    """
-    total_applicable = sum(applicable_weights.values())
-    if total_applicable <= 0:
-        return 0.0
-
-    total_error = sum(error_weights.values())
-    return max(0.0, 1.0 - (total_error / total_applicable))
-
-
-def _calculate_confidence_factor(findings: Sequence[CheckFinding]) -> float:
-    """Calculate confidence factor from finding confidences.
-
-    confidence_factor = average of finding.confidence values
-
-    Args:
-        findings: List of check findings
-
-    Returns:
-        Confidence factor (0.0-1.0), defaults to 1.0 if none provided
-    """
-    confidences = [
-        getattr(finding, "confidence", 0.5) for finding in findings if getattr(finding, "confidence", None) is not None
-    ]
-
-    if not confidences:
-        return 1.0
-
-    return max(0.0, min(1.0, sum(confidences) / len(confidences)))
-
-
-def score_section(
-    section: AuditSection,
-    findings: Sequence[CheckFinding],
-    severity_weights: Mapping[Severity, float] | None = None,
-) -> SectionScore:
-    """Calculate score for a section using its scoring policy.
-
-    Args:
-        section: The audit section to score
-        findings: List of check findings for this section
-        severity_weights: Optional overrides for severity-based weights
-
-    Returns:
-        SectionScore with all scoring metadata
-    """
-    findings_by_id = {finding.check_id: finding for finding in findings}
-    missing_findings: list[str] = []
-
-    applicable_weights: dict[str, float] = {}
-    error_weights: dict[str, float] = {}
-    scored_weights: dict[str, float] = {}
-
-    total_checks = len(section.checks)
-    passed_checks = failed_checks = error_checks = skipped_checks = na_checks = 0
-
-    def status_for(check: AuditCheck) -> CheckStatus:
-        finding = findings_by_id.get(check.id)
-        return finding.status if finding is not None else CheckStatus.ERROR
-
-    # Process each check in the section
-    for check in section.checks:
-        finding = findings_by_id.get(check.id)
-        if finding is None:
-            missing_findings.append(check.id)
-            status = CheckStatus.ERROR
-            score_value = 0.0
-        else:
-            status = finding.status
-            # Calculate check score using score_mode
-            score_value = _calculate_check_score(check, finding) / 100.0
-
-        # Count status
-        if status == CheckStatus.PASSED:
-            passed_checks += 1
-        elif status == CheckStatus.FAILED:
-            failed_checks += 1
-        elif status == CheckStatus.ERROR:
-            error_checks += 1
-        elif status == CheckStatus.NOT_APPLICABLE:
-            na_checks += 1
-        elif status == CheckStatus.SKIPPED:
-            skipped_checks += 1
-        elif status == CheckStatus.PARTIAL:
-            failed_checks += 1
-
-        # Skip N/A checks
-        if not _is_applicable(status):
-            continue
-
-        # Get weight (severity fallback or explicit)
-        weight = _severity_weight(check, severity_weights) if check.weight is None else float(check.weight)
-
-        applicable_weights[check.id] = weight
-
-        if _is_error(status):
-            error_weights[check.id] = weight
-        else:
-            scored_weights[check.id] = score_value
-
-    # If no applicable checks, return N/A result
-    if not applicable_weights:
-        return SectionScore(
-            section_id=section.id,
-            score_percent=0.0,
-            weighted_score=0.0,
-            status=CheckStatus.NOT_APPLICABLE,
-            coverage_factor=0.0,
-            confidence_factor=1.0,
-            score_cap_applied=None,
-            total_checks=total_checks,
-            passed_checks=passed_checks,
-            failed_checks=failed_checks,
-            error_checks=error_checks,
-            skipped_checks=skipped_checks,
-            na_checks=na_checks,
-            missing_findings=tuple(missing_findings),
-        )
-
-    # Calculate coverage factor using raw applicable weights
-    coverage_factor = _calculate_coverage_factor(applicable_weights, error_weights)
-
-    # Normalize applicable weights (used later for scoring)
-    _normalize_weights(applicable_weights)
-
-    # If all applicable checks are ERROR, mark N/A
-    if coverage_factor <= 0.0:
-        return SectionScore(
-            section_id=section.id,
-            score_percent=0.0,
-            weighted_score=0.0,
-            status=CheckStatus.NOT_APPLICABLE,
-            coverage_factor=0.0,
-            confidence_factor=1.0,
-            score_cap_applied=None,
-            total_checks=total_checks,
-            passed_checks=passed_checks,
-            failed_checks=failed_checks,
-            error_checks=error_checks,
-            skipped_checks=skipped_checks,
-            na_checks=na_checks,
-            missing_findings=tuple(missing_findings),
-        )
-
-    # Get scoring policy
-    scoring_policy = getattr(section, "scoring_policy", "weighted_mean")
-
-    # Normalize scored weights
-    scored_weight_basis = {check_id: applicable_weights[check_id] for check_id in scored_weights}
-    normalized_scored = _normalize_weights(scored_weight_basis)
-
-    # Calculate raw score based on policy
-    if scoring_policy == "maturity":
-        raw_score = _score_maturity_policy(section, findings_by_id, scored_weights, applicable_weights)
-
-    elif scoring_policy == "threshold":
-        # Binary pass/fail based on threshold
-        threshold = getattr(section, "threshold", 80.0)
-        weighted_mean = 0.0
-        for check_id, score_value in scored_weights.items():
-            weighted_mean += score_value * normalized_scored.get(check_id, 0.0)
-        weighted_mean_percent = weighted_mean * 100.0
-        raw_score = 1.0 if weighted_mean_percent >= threshold else 0.0
-
-    else:
-        # Default: weighted_mean
-        raw_score = 0.0
-        for check_id, score_value in scored_weights.items():
-            raw_score += score_value * normalized_scored.get(check_id, 0.0)
-
-    # Calculate confidence factor
-    confidence_factor = _calculate_confidence_factor(findings)
-
-    # Apply confidence/coverage factors based on confidence_mode
-    confidence_mode = getattr(section, "confidence_mode", "coverage")
-    if confidence_mode == "confidence":
-        score_after_factors = raw_score * confidence_factor
-    elif confidence_mode == "both":
-        score_after_factors = raw_score * confidence_factor * coverage_factor
-    else:
-        score_after_factors = raw_score * coverage_factor
-
-    # Track applied caps
-    cap_applied: float | None = None
-
-    # Check compliance gate (required checks)
-    if scoring_policy == "compliance_gate":
-        gate_triggered, cap_value = _score_compliance_gate_policy(section, findings_by_id)
-        if gate_triggered:
-            cap_value = cap_value if cap_value is not None else 0.0
-            score_after_factors = min(score_after_factors, cap_value / 100.0)
-            cap_applied = cap_value
-
-    # Check critical gate (severity or tag-based)
-    critical_triggered, critical_cap = _check_critical_gate(section, findings_by_id)
-    if critical_triggered and critical_cap is not None:
-        score_after_factors = min(score_after_factors, critical_cap / 100.0)
-        cap_applied = critical_cap
-
-    # Determine section status
-    required_failed = any(
-        _is_fail(status_for(check))
-        and (check.required or (isinstance(check.score_config, dict) and check.score_config.get("required")))
-        for check in section.checks
-    )
-
-    if not applicable_weights:
-        section_status = CheckStatus.NOT_APPLICABLE
-    elif required_failed or (failed_checks and passed_checks == 0 and error_checks == 0):
-        section_status = CheckStatus.FAILED
-    elif failed_checks or error_checks:
-        section_status = CheckStatus.PARTIAL
-    else:
-        section_status = CheckStatus.PASSED
-
-    # Calculate final scores
-    score_percent = max(0.0, min(100.0, score_after_factors * 100.0))
-    weighted_score = score_percent * (section.weight / 100.0)
-
-    return SectionScore(
-        section_id=section.id,
-        score_percent=score_percent,
-        weighted_score=weighted_score,
-        status=section_status,
-        coverage_factor=coverage_factor,
-        confidence_factor=confidence_factor,
-        score_cap_applied=cap_applied,
-        total_checks=total_checks,
-        passed_checks=passed_checks,
-        failed_checks=failed_checks,
-        error_checks=error_checks,
-        skipped_checks=skipped_checks,
-        na_checks=na_checks,
-        missing_findings=tuple(missing_findings),
-    )
-
-
-def score_repository(
-    template: AuditTemplate,
-    section_scores: Iterable[SectionScore],
-) -> RepositoryScore:
-    """Calculate overall repository score from section scores.
-
-    Args:
-        template: The audit template
-        section_scores: Iterable of section scores
-
-    Returns:
-        RepositoryScore with total and recalculated section weights
-    """
-    scores_by_id = {score.section_id: score for score in section_scores}
-
-    # Filter applicable sections (not N/A)
-    applicable_sections = [
-        section
-        for section in template.sections
-        if scores_by_id.get(section.id) and scores_by_id[section.id].status != CheckStatus.NOT_APPLICABLE
-    ]
-
-    if not applicable_sections:
-        return RepositoryScore(total_score=0.0, section_scores=tuple(section_scores))
-
-    # Renormalize section weights (excluding N/A sections)
-    section_weights = {section.id: section.weight for section in applicable_sections}
-    normalized = _normalize_weights(section_weights)
-
-    total_score = 0.0
-    recomputed_scores: list[SectionScore] = []
-
-    for section in template.sections:
-        score = scores_by_id.get(section.id)
-        if not score:
-            continue
-
-        weight = normalized.get(section.id, 0.0)
-        weighted_score = score.score_percent * weight
-
-        # Create updated SectionScore with recomputed weighted_score
-        recomputed_scores.append(
-            SectionScore(
-                section_id=score.section_id,
-                score_percent=score.score_percent,
-                weighted_score=weighted_score,
-                status=score.status,
-                coverage_factor=score.coverage_factor,
-                confidence_factor=score.confidence_factor,
-                score_cap_applied=score.score_cap_applied,
-                total_checks=score.total_checks,
-                passed_checks=score.passed_checks,
-                failed_checks=score.failed_checks,
-                error_checks=score.error_checks,
-                skipped_checks=score.skipped_checks,
-                na_checks=score.na_checks,
-                missing_findings=score.missing_findings,
-            )
-        )
-
-        total_score += weighted_score
-
-    return RepositoryScore(total_score=total_score, section_scores=tuple(recomputed_scores))
-
-
-# ============================================================================
-# ScoreCalculator Class (Main API)
-# ============================================================================
-
-
-class Scorer:
-    """Calculates audit scores using the policy-aware scorer.
-
-    This class provides the main API for computing audit scores at the
-    check, section, and repository levels, with support for advanced
-    scoring policies (maturity, compliance_gate, threshold, range).
-
-    Example:
-        >>> scorer = Scorer()
-        >>> result = scorer.calculate(template, repo_name, findings, duration)
-        >>> print(f"Overall score: {result.overall_score}%")
-    """
-
-    def calculate(
-        self,
-        template: AuditTemplate,
-        repo_name: str,
-        findings: dict[str, CheckFinding],
-        duration: float,
-    ) -> RepositoryAuditResult:
-        """Calculate complete audit result for a repository.
-
-        Args:
-            template: The audit template
-            repo_name: Repository name
-            findings: Mapping of check_id to CheckFinding
-            duration: Audit duration in seconds
-
-        Returns:
-            Complete RepositoryAuditResult with all metadata
-        """
-        section_results: list[SectionResult] = []
-        section_scores: list[SectionScore] = []
-
-        critical_issues = 0
-        high_issues = 0
-        medium_issues = 0
-        low_issues = 0
-        total_findings = 0
-
-        for section in template.sections:
-            section_findings: list[CheckFinding] = []
-
-            # Collect findings for this section
-            for check in section.checks:
-                finding = findings.get(check.id)
-                if finding is None:
-                    # Create ERROR finding for missing check
-                    finding = CheckFinding(
-                        check_id=check.id,
-                        check_name=check.name or check.id,
-                        status=CheckStatus.ERROR,
-                        points_awarded=0.0,
-                        max_points=check.max_points,
-                        score_percentage=0.0,
-                        severity=check.severity,
-                        priority=check.priority,
-                        migration_effort=check.migration_effort,
-                        evidence=[],
-                        recommendation=check.remediation_steps,
-                        resource_links=[check.doc_link] if check.doc_link else [],
-                        execution_time_ms=0,
-                        confidence=None,
-                        tags=check.tags,
-                        error_message="Check not executed",
-                    )
-                section_findings.append(finding)
-
-            # Calculate section score
-            section_score = score_section(section, section_findings)
-            section_scores.append(section_score)
-
-            # Check if required checks passed
-            required_failed = any(
-                _is_fail(finding.status)
-                and (check.required or (isinstance(check.score_config, dict) and check.score_config.get("required")))
-                for check in section.checks
-                for finding in section_findings
-                if finding.check_id == check.id
-            )
-
-            # Calculate percent to target
-            target_score = section.target_score
-            percent_to_target = None
-            if target_score and target_score > 0:
-                percent_to_target = (section_score.score_percent / target_score) * 100.0
-
-            # Calculate points
-            max_points = sum(f.max_points for f in section_findings)
-            points_awarded = sum(f.points_awarded for f in section_findings)
-
-            # Create SectionResult
-            section_results.append(
-                SectionResult(
-                    section_id=section.id,
-                    section_name=section.name,
-                    weight=section.weight,
-                    score_percentage=section_score.score_percent,
-                    weighted_contribution=section_score.weighted_score,
-                    max_possible_points=max_points,
-                    points_awarded=points_awarded,
-                    findings=section_findings,
-                    coverage_factor=section_score.coverage_factor,
-                    confidence_factor=section_score.confidence_factor,
-                    score_cap_applied=section_score.score_cap_applied,
-                    total_checks=section_score.total_checks,
-                    passed_checks=section_score.passed_checks,
-                    failed_checks=section_score.failed_checks,
-                    error_checks=section_score.error_checks,
-                    skipped_checks=section_score.skipped_checks,
-                    na_checks=section_score.na_checks,
-                    missing_findings=list(section_score.missing_findings),
-                    scoring_policy=getattr(section, "scoring_policy", "weighted_mean"),
-                    target_score=target_score,
-                    percent_to_target=percent_to_target,
-                    required_checks_passed=not required_failed,
-                    metadata={"missing_findings": list(section_score.missing_findings)},
-                )
-            )
-
-            # Count issues
-            for finding in section_findings:
-                if finding.status in {CheckStatus.FAILED, CheckStatus.PARTIAL, CheckStatus.ERROR}:
-                    total_findings += 1
-                if finding.status == CheckStatus.FAILED:
-                    check_def = next((c for c in section.checks if c.id == finding.check_id), None)
-                    if check_def:
-                        if check_def.severity == Severity.CRITICAL:
-                            critical_issues += 1
-                        elif check_def.severity == Severity.HIGH:
-                            high_issues += 1
-                        elif check_def.severity == Severity.MEDIUM:
-                            medium_issues += 1
-                        elif check_def.severity == Severity.LOW:
-                            low_issues += 1
-
-        # Calculate repository-level score
-        repo_score = score_repository(template, section_scores)
-
-        # Calculate grade
-        overall_score = round(repo_score.total_score, 2)
-        total_checks = sum(r.total_checks for r in section_results)
-        passed_checks = sum(r.passed_checks for r in section_results)
-        failed_checks = sum(r.failed_checks for r in section_results)
-
-        return RepositoryAuditResult(
-            repo_name=repo_name,
-            project_key="",
-            total_score=overall_score,
-            grade=compute_grade(overall_score) if total_checks else "N/A",
-            sections=section_results,
-            total_checks=total_checks,
-            passed_checks=passed_checks,
-            failed_checks=failed_checks,
-            critical_issues=critical_issues,
-            high_issues=high_issues,
-            medium_issues=medium_issues,
-            low_issues=low_issues,
-            template_name=template.name,
-            template_version=template.version,
-            audit_metadata={"duration_seconds": duration},
-            # Summary fields
-            total_findings=total_findings,
-            duration_seconds=duration,
-        )
-
-    def calculate_with_adaptive_weights(
-        self,
-        template: AuditTemplate,
-        repo_name: str,
-        findings: dict[str, CheckFinding],
-        duration: float,
-        profile: ProjectProfile | None = None,
-        adaptive_weights: Any | None = None,
-        profile_resolution: Any | None = None,
-    ) -> RepositoryAuditResult:
-        """Calculate audit result with adaptive weighting based on project profile (FR-009).
-
-        Applies risk-based weight adjustments to section weights before scoring.
-        Weighting rationale is persisted in each SectionResult.
-
-        Args:
-            template: The audit template
-            repo_name: Repository name
-            findings: Mapping of check_id to CheckFinding
-            duration: Audit duration in seconds
-            profile: Optional project profile for adaptive weighting
-            adaptive_weights: Optional pre-computed adaptive weights result
-            profile_resolution: Optional profile resolution with provenance
-
-        Returns:
-            Complete RepositoryAuditResult with adaptive weights and rationales
-        """
-        # Apply adaptive weights if provided
-        section_weight_overrides: dict[str, float] = {}
-        weight_rationales: dict[str, WeightingRationale] = {}
-
-        if adaptive_weights is not None:
-            # Extract adjusted weights from adaptive weight result
-            section_weight_overrides = adaptive_weights.weights.copy()
-
-            # Build weighting rationales
-            for rationale in adaptive_weights.rationales:
-                weight_rationales[rationale.section_id] = WeightingRationale(
-                    section_id=rationale.section_id,
-                    section_name=rationale.section_name,
-                    original_weight=rationale.original_weight,
-                    adjusted_weight=rationale.adjusted_weight,
-                    risk_score=rationale.risk_score,
-                    multiplier_applied=rationale.multiplier_applied,
-                    factors=rationale.factors,
-                    locked=rationale.locked,
-                )
-
-        # Create a template copy with adjusted weights for scoring
-        adjusted_sections: list[AuditSection] = []
-        for section in template.sections:
-            original_weight = section.weight
-            adjusted_weight = section_weight_overrides.get(section.id, original_weight)
-
-            # Create modified section with adjusted weight
-            adjusted_sections.append(section.model_copy(update={"weight": adjusted_weight}))
-
-        # Create adjusted template
-        from vds_audit_orchestrator.models.template import AuditTemplate as AuditTemplateModel
-
-        adjusted_template = AuditTemplateModel(
-            name=template.name,
-            version=template.version,
-            sections=adjusted_sections,
-        )
-
-        # Calculate scores using adjusted template
-        section_results: list[SectionResult] = []
-        section_scores: list[SectionScore] = []
-
-        critical_issues = 0
-        high_issues = 0
-        medium_issues = 0
-        low_issues = 0
-        total_findings = 0
-
-        for section, original_section in zip(adjusted_sections, template.sections, strict=True):
-            section_findings: list[CheckFinding] = []
-
-            # Collect findings for this section
-            for check in section.checks:
-                finding = findings.get(check.id)
-                if finding is None:
-                    finding = CheckFinding(
-                        check_id=check.id,
-                        check_name=check.name or check.id,
-                        status=CheckStatus.ERROR,
-                        points_awarded=0.0,
-                        max_points=check.max_points,
-                        score_percentage=0.0,
-                        severity=check.severity,
-                        priority=check.priority,
-                        migration_effort=check.migration_effort,
-                        evidence=[],
-                        recommendation=check.remediation_steps,
-                        resource_links=[check.doc_link] if check.doc_link else [],
-                        execution_time_ms=0,
-                        confidence=None,
-                        tags=check.tags,
-                        error_message="Check not executed",
-                    )
-                section_findings.append(finding)
-
-            # Calculate section score
-            section_score = score_section(section, section_findings)
-            section_scores.append(section_score)
-
-            # Check if required checks passed
-            required_failed = any(
-                _is_fail(finding.status)
-                and (check.required or (isinstance(check.score_config, dict) and check.score_config.get("required")))
-                for check in section.checks
-                for finding in section_findings
-                if finding.check_id == check.id
-            )
-
-            # Calculate percent to target
-            target_score = section.target_score
-            percent_to_target = None
-            if target_score and target_score > 0:
-                percent_to_target = (section_score.score_percent / target_score) * 100.0
-
-            # Calculate points
-            max_points = sum(f.max_points for f in section_findings)
-            points_awarded = sum(f.points_awarded for f in section_findings)
-
-            # Get weighting rationale for this section
-            weighting_rationale = weight_rationales.get(section.id)
-
-            # Create SectionResult with weighting information
-            section_result = SectionResult(
-                section_id=section.id,
-                section_name=section.name,
-                weight=section.weight,  # Adjusted weight
-                score_percentage=section_score.score_percent,
-                weighted_contribution=section_score.weighted_score,
-                max_possible_points=max_points,
-                points_awarded=points_awarded,
-                findings=section_findings,
-                coverage_factor=section_score.coverage_factor,
-                confidence_factor=section_score.confidence_factor,
-                score_cap_applied=section_score.score_cap_applied,
-                passed_checks=section_score.passed_checks,
-                failed_checks=section_score.failed_checks,
-                scoring_policy=getattr(section, "scoring_policy", "weighted_mean"),
-                target_score=target_score,
-                percent_to_target=percent_to_target,
-                required_checks_passed=not required_failed,
-                metadata={
-                    "missing_findings": list(section_score.missing_findings),
-                    "weighting_rationale": weighting_rationale,
-                    "weight_adjusted": section.weight != original_section.weight,
-                },
-            )
-            section_results.append(section_result)
-
-            # Count issues
-            for finding in section_findings:
-                if finding.status in {CheckStatus.FAILED, CheckStatus.PARTIAL, CheckStatus.ERROR}:
-                    total_findings += 1
-                if finding.status == CheckStatus.FAILED:
-                    check_def = next((c for c in section.checks if c.id == finding.check_id), None)
-                    if check_def:
-                        if check_def.severity == Severity.CRITICAL:
-                            critical_issues += 1
-                        elif check_def.severity == Severity.HIGH:
-                            high_issues += 1
-                        elif check_def.severity == Severity.MEDIUM:
-                            medium_issues += 1
-                        elif check_def.severity == Severity.LOW:
-                            low_issues += 1
-
-        # Calculate repository-level score
-        repo_score = score_repository(adjusted_template, section_scores)
-
-        # Calculate grade
-        overall_score = round(repo_score.total_score, 2)
-        total_checks = sum(r.total_checks for r in section_results)
-        passed_checks = sum(r.passed_checks for r in section_results)
-        failed_checks = sum(r.failed_checks for r in section_results)
-
-        # Build profile info for result metadata
-        profile_info: dict[str, Any] = {}
-        adaptive_weights_info: dict[str, Any] = {}
-
-        if profile is not None:
-            profile_info = profile.to_dict()
-
-        if adaptive_weights is not None:
-            adaptive_weights_info = adaptive_weights.to_dict()
-
-        if profile_resolution is not None:
-            profile_info["resolution"] = profile_resolution.to_dict()
-
-        return RepositoryAuditResult(
-            repo_name=repo_name,
-            project_key="",
-            total_score=overall_score,
-            grade=compute_grade(overall_score) if total_checks else "N/A",
-            sections=section_results,
-            total_checks=total_checks,
-            passed_checks=passed_checks,
-            failed_checks=failed_checks,
-            critical_issues=critical_issues,
-            high_issues=high_issues,
-            medium_issues=medium_issues,
-            low_issues=low_issues,
-            template_name=template.name,
-            template_version=template.version,
-            audit_metadata={"duration_seconds": duration},
-            # Profile and weighting information (FR-009.06)
-            profile_info=profile_info,
-            adaptive_weights=adaptive_weights_info,
-            # Summary fields
-            total_findings=total_findings,
-            duration_seconds=duration,
-        )
-
-
-# ============================================================================
-# Phase 4: Profile-Aware Scoring and Gap Analysis (FR-011)
-# ============================================================================
-
-
-@dataclass
-class ScoringContext:
-    """Context for scoring calculations.
-
-    Extended for Phase 4 to support profile-aware scoring and evidence bundles.
-
-    Attributes:
-        template: Audit template with checks and sections
-        profile: Optional project profile for adaptive weighting
-        evidence_bundles: Mapping of check_id to evidence bundles
-    """
-
-    template: AuditTemplate
-    profile: ProjectProfile | None = None
-    evidence_bundles: dict[str, EvidenceBundle] = field(default_factory=dict)
-
-
-# Extend Scorer class with Phase 4 methods
-
-
-def score_check_with_profile(
-    check: AuditCheck,
-    finding: CheckFinding,
-    context: ScoringContext,
-) -> float:
-    """Score a single check with profile-aware weighting (Phase 4).
-
-    Applies profile-based multipliers to check scores for risk-adaptive
-    scoring. Higher-risk areas receive proportionally higher scores.
-
-    Args:
-        check: The audit check definition
-        finding: The check finding result
-        context: Scoring context with optional profile
-
-    Returns:
-        Adjusted score on 0-100 scale (capped at 100)
-    """
-    # Calculate base score using existing logic
-    base_score = _calculate_check_score(check, finding)
-
-    # Apply profile multipliers if available
-    if context.profile:
-        multiplier = _get_profile_multiplier(check, context.profile)
-        adjusted_score = base_score * multiplier
-        return min(adjusted_score, 100.0)
-
-    return base_score
-
-
-def _get_profile_multiplier(check: AuditCheck, profile: ProjectProfile) -> float:
-    """Get appropriate multiplier for check based on profile.
-
-    Checks for custom overrides, then applies domain/type-based multipliers.
-
-    Args:
-        check: The audit check
-        profile: Project profile
-
-    Returns:
-        Multiplier value (typically 0.75 to 1.5)
-    """
-    # Check for custom overrides in profile
-    if hasattr(profile, "weight_overrides") and profile.weight_overrides:
-        if hasattr(profile.weight_overrides, "check_multipliers") and check.id in profile.weight_overrides.check_multipliers:
-                return profile.weight_overrides.check_multipliers[check.id]
-
-        section_id = check.section_id or ""
-        if hasattr(profile.weight_overrides, "section_multipliers") and section_id in profile.weight_overrides.section_multipliers:
-                return profile.weight_overrides.section_multipliers[section_id]
-
-    # Domain and type-based multipliers
-    section = (check.section_id or "").lower()
-
-    # Security section multiplier
-    if "security" in section or "auth" in section:
-        if hasattr(profile, "get_security_multiplier"):
-            return profile.get_security_multiplier()
-        return 1.0
-
-    # API/Documentation section multiplier
-    if "api" in section or "documentation" in section or "doc" in section:
-        if hasattr(profile, "get_api_docs_multiplier"):
-            return profile.get_api_docs_multiplier()
-        return 1.0
-
-    # Database section multiplier
-    if "database" in section or "db" in section:
-        if hasattr(profile, "get_database_multiplier"):
-            return profile.get_database_multiplier()
-        # Check if project has database
-        if hasattr(profile, "features") and not profile.features.has_database:
-            return 0.0  # Not applicable
-
-    return 1.0