@ngocsangairvds/vsaf 3.2.13 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/engine/auditor.py

@@ -1,504 +0,0 @@
-"""Async Audit Engine."""
-
-from __future__ import annotations
-
-import asyncio
-import time
-from pathlib import Path
-from typing import TYPE_CHECKING, Any
-
-from structlog import get_logger
-
-from vds_audit_orchestrator.checks.base import CheckContext, CheckResult
-from vds_audit_orchestrator.checks.registry import CheckRegistry
-from vds_audit_orchestrator.engine.checkpoint import AuditCheckpoint, save_checkpoint
-from vds_audit_orchestrator.engine.profile_scorer import ProfileAwareScorer
-from vds_audit_orchestrator.engine.scorer import Scorer, score_repository, score_section
-from vds_audit_orchestrator.logging_config import clear_audit_context, log_context, set_audit_context
-from vds_audit_orchestrator.models.enums import CheckStatus, Severity
-from vds_audit_orchestrator.models.findings import (
-    CheckFinding,
-    RepositoryAuditResult,
-    SectionResult,
-    compute_grade,  # Ensure compute_grade is correctly imported from findings
-)
-
-if TYPE_CHECKING:
-    from vds_audit_orchestrator.engine.weight_policy import AdaptiveWeightResult
-    from vds_audit_orchestrator.models.template import AuditTemplate
-    from vds_audit_orchestrator.profiles.models import ProjectProfile
-
-logger = get_logger()
-
-
-class AuditEngine:
-    """Executes audit templates against repositories."""
-
-    def __init__(self, concurrency: int = 5):
-        self.semaphore = asyncio.Semaphore(concurrency)
-
-    async def audit_repo(
-        self,
-        repo_path: Path,
-        template: AuditTemplate,
-        context_vars: dict[str, Any] | None = None,
-        dry_run: bool = False,
-        checkpoint: AuditCheckpoint | None = None,
-        checkpoint_path: Path | None = None,
-        checkpoint_enabled: bool = True,
-        scorer: Scorer | None = None,
-        use_adaptive_weights: bool = False,
-        adaptive_weights: AdaptiveWeightResult | None = None,
-        profile: ProjectProfile | None = None,
-    ) -> RepositoryAuditResult:
-        """Audit a single repository."""
-        start_time = time.perf_counter()
-        repo_name = repo_path.name
-        audit_id = str(context_vars.get("audit_id")) if context_vars else None
-        project_key = str(context_vars.get("project_key", "")) if context_vars else ""
-
-        from vds_audit_orchestrator.logging_config import audit_otel_span as trace_span
-        from vds_audit_orchestrator.observability.metrics import record_audit_duration
-
-        set_audit_context(audit_id=audit_id, repo=repo_name, phase="audit")
-        log = logger.bind(repo=repo_name)
-        if dry_run:
-            log.info("audit_dry_run_started")
-        else:
-            log.info("audit_started")
-
-        success = False
-        try:
-            with trace_span("audit.execute", {"repository": repo_name, "audit_id": audit_id}):
-                checkpoint_active = (
-                    checkpoint_enabled and checkpoint is not None and checkpoint_path is not None and not dry_run
-                )
-                checkpoint_lock = asyncio.Lock() if checkpoint_active else None
-
-                # 1. Run Checks (apply profile-based applicability)
-                tasks = []
-                all_checks = []
-                findings_map: dict[str, CheckFinding] = {}
-                if checkpoint_active and checkpoint is not None and checkpoint.partial_results:
-                    for checkpoint_key, raw_finding in checkpoint.partial_results.items():
-                        if not checkpoint_key.startswith(f"{repo_name}:"):
-                            continue
-                        check_id = checkpoint_key.split(":", 1)[1]
-                        try:
-                            findings_map[check_id] = CheckFinding.model_validate(raw_finding)
-                        except Exception as exc:
-                            logger.warning(
-                                "checkpoint_result_invalid",
-                                check_id=check_id,
-                                checkpoint_key=checkpoint_key,
-                                error=str(exc),
-                            )
-                if profile is not None:
-                    applicability_scorer = ProfileAwareScorer()
-                    for section in template.sections:
-                        applicable_checks = applicability_scorer.filter_applicable_checks(section.checks, profile)
-                        applicable_ids = {check.id for check in applicable_checks}
-                        for check in section.checks:
-                            if check.id in applicable_ids or check.id in findings_map:
-                                continue
-                            findings_map[check.id] = CheckFinding(
-                                check_id=check.id,
-                                check_name=check.name,
-                                status=CheckStatus.NOT_APPLICABLE,
-                                points_awarded=0.0,
-                                max_points=check.max_points,
-                                score_percentage=0.0,
-                                severity=check.severity,
-                                priority=check.priority,
-                                migration_effort=check.migration_effort,
-                                evidence=["Check not applicable for profile"],
-                                recommendation=check.remediation_steps,
-                                resource_links=[check.doc_link] if check.doc_link else [],
-                                execution_time_ms=0,
-                            )
-
-                for section in template.sections:
-                    for check in section.checks:
-                        all_checks.append(check)
-                        if check.id in findings_map:
-                            continue
-                        tasks.append(
-                            self._run_check_with_checkpoint(
-                                check,
-                                repo_path,
-                                context_vars or {},
-                                checkpoint=checkpoint,
-                                checkpoint_path=checkpoint_path,
-                                checkpoint_lock=checkpoint_lock,
-                                checkpoint_active=checkpoint_active,
-                                dry_run=dry_run,
-                            )
-                        )
-
-                results: list[CheckFinding] = []
-                if tasks:
-                    results = await asyncio.gather(*tasks)
-                findings_map.update({res.check_id: res for res in results})
-
-                duration = time.perf_counter() - start_time
-
-                if scorer is not None:
-                    if use_adaptive_weights:
-                        result = scorer.calculate_with_adaptive_weights(
-                            template,
-                            repo_name,
-                            findings_map,
-                            duration,
-                            profile=profile,
-                            adaptive_weights=adaptive_weights,
-                        )
-                    else:
-                        result = scorer.calculate(template, repo_name, findings_map, duration)
-
-                    if context_vars:
-                        result.project_key = str(context_vars.get("project_key", ""))
-                        repo_url = context_vars.get("repo_url")
-                        if repo_url:
-                            result.repo_url = str(repo_url)
-
-                    success = True
-                    return result
-
-                # 2. Score Sections
-                section_results: list[SectionResult] = []
-                section_scores = []
-
-                critical_issues = 0
-                high_issues = 0
-                medium_issues = 0
-                low_issues = 0
-                total_findings = 0
-
-                for section in template.sections:
-                    sec_findings: list[CheckFinding] = []
-                    for check in section.checks:
-                        if not check.enabled:
-                            sec_findings.append(
-                                CheckFinding(
-                                    check_id=check.id,
-                                    check_name=check.name,
-                                    status=CheckStatus.NOT_APPLICABLE,
-                                    points_awarded=0.0,
-                                    max_points=check.max_points,
-                                    score_percentage=0.0,
-                                    severity=check.severity,
-                                    priority=check.priority,
-                                    migration_effort=check.migration_effort,
-                                    evidence=["Check disabled"],
-                                    recommendation=check.remediation_steps,
-                                    resource_links=[check.doc_link] if check.doc_link else [],
-                                    execution_time_ms=0,
-                                    confidence=None,
-                                    tags=check.tags,
-                                    error_message=None,
-                                )
-                            )
-                            continue
-                        finding = findings_map.get(check.id)
-                        if finding is None:
-                            finding = CheckFinding(
-                                check_id=check.id,
-                                check_name=check.name,
-                                status=CheckStatus.ERROR,
-                                points_awarded=0.0,
-                                max_points=check.max_points,
-                                score_percentage=0.0,
-                                severity=check.severity,
-                                priority=check.priority,
-                                migration_effort=check.migration_effort,
-                                evidence=["No result"],
-                                recommendation=check.remediation_steps,
-                                resource_links=[check.doc_link] if check.doc_link else [],
-                                execution_time_ms=0,
-                                confidence=None,
-                                tags=check.tags,
-                                error_message="No result",
-                            )
-                        sec_findings.append(finding)
-
-                        total_findings += 1
-                        if finding.severity == Severity.CRITICAL and finding.failed:
-                            critical_issues += 1
-                        elif finding.severity == Severity.HIGH and finding.failed:
-                            high_issues += 1
-                        elif finding.severity == Severity.MEDIUM and finding.failed:
-                            medium_issues += 1
-                        elif finding.severity == Severity.LOW and finding.failed:
-                            low_issues += 1
-
-                    section_score_obj = score_section(section, sec_findings)
-                    section_scores.append(section_score_obj)
-
-                    # Convert internal SectionScore to public SectionResult
-                    section_result = SectionResult(
-                        section_id=section_score_obj.section_id,
-                        section_name=section.name,
-                        score_percentage=section_score_obj.score_percent,
-                        weighted_contribution=section_score_obj.weighted_score,
-                        status=section_score_obj.status,
-                        total_checks=section_score_obj.total_checks,
-                        passed_checks=section_score_obj.passed_checks,
-                        failed_checks=section_score_obj.failed_checks,
-                        error_checks=section_score_obj.error_checks,
-                        skipped_checks=section_score_obj.skipped_checks,
-                        na_checks=section_score_obj.na_checks,
-                        missing_findings=list(section_score_obj.missing_findings),
-                        findings=sec_findings,
-                        coverage_factor=section_score_obj.coverage_factor,
-                        confidence_factor=section_score_obj.confidence_factor,
-                        score_cap_applied=section_score_obj.score_cap_applied,
-                    )
-                    section_results.append(section_result)
-
-                repo_score = score_repository(template, section_scores)
-                overall_score = repo_score.total_score
-                grade = compute_grade(overall_score)
-
-                audit_result = RepositoryAuditResult(
-                    repo_name=repo_name,
-                    total_score=overall_score,
-                    grade=grade,
-                    sections=section_results,
-                    passed_checks=sum(1 for r in findings_map.values() if r.passed),
-                    failed_checks=sum(1 for r in findings_map.values() if r.failed),
-                    total_checks=len(findings_map),
-                    critical_issues=critical_issues,
-                    high_issues=high_issues,
-                    medium_issues=medium_issues,
-                    low_issues=low_issues,
-                    total_findings=total_findings,
-                    template_name=template.name,
-                    template_version=template.version,
-                    duration_seconds=duration,
-                    audit_metadata={"duration_seconds": duration},
-                )
-                success = True
-                return audit_result
-        finally:
-            duration = time.perf_counter() - start_time
-            record_audit_duration(
-                repository=repo_name,
-                project=project_key,
-                duration_seconds=duration,
-                success=success,
-            )
-            clear_audit_context()
-
-    async def _run_check(
-        self, check_def: Any, repo_path: Path, extra_config: dict[str, Any], dry_run: bool = False
-    ) -> CheckFinding:
-        """Run a single check with semaphore."""
-        async with self.semaphore:
-            start_time = time.perf_counter()
-            check_id = check_def.id
-            plugin_name = check_def.check_type
-            check_result: CheckResult | None = None
-            finding: CheckFinding | None = None
-
-            from vds_audit_orchestrator.logging_config import audit_otel_span as trace_span
-            from vds_audit_orchestrator.observability.metrics import record_check_duration
-
-            with log_context(check_id=check_id, phase="check"):
-                with trace_span("check.execute", {"check.id": check_id, "check.type": plugin_name}):
-                    try:
-                        if not plugin_name:
-                            duration_ms = int((time.perf_counter() - start_time) * 1000)
-                            finding = CheckFinding(
-                                check_id=check_id,
-                                check_name=check_def.name,
-                                status=CheckStatus.ERROR,
-                                points_awarded=0.0,
-                                max_points=check_def.max_points,
-                                score_percentage=0.0,
-                                severity=check_def.severity,
-                                priority=check_def.priority,
-                                migration_effort=check_def.migration_effort,
-                                evidence=["No plugin defined"],
-                                recommendation=check_def.remediation_steps,
-                                resource_links=[check_def.doc_link] if check_def.doc_link else [],
-                                execution_time_ms=duration_ms,
-                                confidence=None,
-                                tags=check_def.tags,
-                                error_message="No plugin defined",
-                            )
-                            return finding
-
-                        if dry_run:
-                            try:
-                                CheckRegistry.get_check(plugin_name)
-                                duration_ms = int((time.perf_counter() - start_time) * 1000)
-                                finding = CheckFinding(
-                                    check_id=check_id,
-                                    check_name=check_def.name,
-                                    status=CheckStatus.NOT_APPLICABLE,
-                                    points_awarded=0.0,
-                                    max_points=check_def.max_points,
-                                    score_percentage=0.0,
-                                    severity=check_def.severity,
-                                    priority=check_def.priority,
-                                    migration_effort=check_def.migration_effort,
-                                    evidence=["Dry Run: Plugin verified"],
-                                    recommendation=check_def.remediation_steps,
-                                    resource_links=[check_def.doc_link] if check_def.doc_link else [],
-                                    execution_time_ms=duration_ms,
-                                    confidence=None,
-                                    tags=check_def.tags,
-                                    error_message=None,
-                                )
-                                return finding
-                            except Exception as e:
-                                duration_ms = int((time.perf_counter() - start_time) * 1000)
-                                finding = CheckFinding(
-                                    check_id=check_id,
-                                    check_name=check_def.name,
-                                    status=CheckStatus.ERROR,
-                                    points_awarded=0.0,
-                                    max_points=check_def.max_points,
-                                    score_percentage=0.0,
-                                    severity=check_def.severity,
-                                    priority=check_def.priority,
-                                    migration_effort=check_def.migration_effort,
-                                    evidence=[f"Dry Run: Plugin load failed: {e!s}"],
-                                    recommendation=check_def.remediation_steps,
-                                    resource_links=[check_def.doc_link] if check_def.doc_link else [],
-                                    execution_time_ms=duration_ms,
-                                    confidence=None,
-                                    tags=check_def.tags,
-                                    error_message=str(e),
-                                )
-                                return finding
-
-                        check_cls = CheckRegistry.get_check(plugin_name)
-                        check_instance = check_cls()
-
-                        # Merge config: template config + override config
-                        config = check_def.check_config.copy()
-                        config.update(extra_config.get(check_id, {}))
-
-                        retries = int(config.get("retries", 2))
-                        backoff_base = float(config.get("retry_backoff_seconds", 0.5))
-                        backoff_max = float(config.get("retry_max_backoff_seconds", 4.0))
-                        retries = max(retries, 0)
-
-                        context = CheckContext(
-                            repository_name=repo_path.name,
-                            project_key=str(extra_config.get("project_key", "")),
-                            repo_path=repo_path,
-                            config=config,
-                        )
-
-                        attempts = 0
-                        while True:
-                            attempts += 1
-                            try:
-                                check_result = await check_instance.execute(context)
-                                break
-                            except Exception as e:
-                                if attempts > retries + 1:
-                                    raise
-                                backoff_seconds = min(backoff_base * (2 ** (attempts - 1)), backoff_max)
-                                logger.warning(
-                                    "check_retry",
-                                    check_id=check_id,
-                                    attempt=attempts,
-                                    retries=retries,
-                                    error=str(e),
-                                    backoff_seconds=backoff_seconds,
-                                )
-                                await asyncio.sleep(backoff_seconds)
-
-                        if check_result is None:
-                            raise RuntimeError(f"Check {check_id} failed to return a result")
-
-                        score_percentage = max(0.0, min(100.0, check_result.score_percentage))
-                        points_awarded = (score_percentage / 100.0) * check_def.max_points
-                        duration_ms = int((time.perf_counter() - start_time) * 1000)
-
-                        finding = CheckFinding(
-                            check_id=check_id,
-                            check_name=check_def.name,
-                            status=check_result.status,
-                            points_awarded=points_awarded,
-                            max_points=check_def.max_points,
-                            score_percentage=score_percentage,
-                            severity=check_def.severity,
-                            priority=check_def.priority,
-                            migration_effort=check_def.migration_effort,
-                            evidence=[f"{k}: {v}" for k, v in check_result.evidence.items()]
-                            if check_result.evidence
-                            else [],
-                            recommendation=check_result.recommendation or check_def.remediation_steps,
-                            resource_links=check_result.resource_links
-                            or ([check_def.doc_link] if check_def.doc_link else []),
-                            execution_time_ms=duration_ms,
-                            confidence=check_result.confidence,
-                            tags=list({*check_def.tags, *check_result.tags}),
-                            error_message=check_result.error_message,
-                        )
-                        return finding
-
-                    except Exception as e:
-                        logger.exception("check_failed", check_id=check_id, error=str(e))
-                        duration_ms = int((time.perf_counter() - start_time) * 1000)
-                        finding = CheckFinding(
-                            check_id=check_id,
-                            check_name=check_def.name,
-                            status=CheckStatus.ERROR,
-                            points_awarded=0.0,
-                            max_points=check_def.max_points,
-                            score_percentage=0.0,
-                            severity=check_def.severity,
-                            priority=check_def.priority,
-                            migration_effort=check_def.migration_effort,
-                            evidence=[f"System Error: {e!s}"],
-                            recommendation=check_def.remediation_steps,
-                            resource_links=[check_def.doc_link] if check_def.doc_link else [],
-                            execution_time_ms=duration_ms,
-                            confidence=None,
-                            tags=check_def.tags,
-                            error_message=str(e),
-                        )
-                        return finding
-                    finally:
-                        duration_seconds = time.perf_counter() - start_time
-                        success = finding is not None and finding.status != CheckStatus.ERROR
-                        record_check_duration(
-                            check_type=plugin_name or "unknown",
-                            duration_seconds=duration_seconds,
-                            success=success,
-                        )
-
-    async def _run_check_with_checkpoint(
-        self,
-        check_def: Any,
-        repo_path: Path,
-        extra_config: dict[str, Any],
-        *,
-        checkpoint: AuditCheckpoint | None,
-        checkpoint_path: Path | None,
-        checkpoint_lock: asyncio.Lock | None,
-        checkpoint_active: bool,
-        dry_run: bool = False,
-    ) -> CheckFinding:
-        """Run a check and persist checkpoint data when enabled."""
-        result = await self._run_check(check_def, repo_path, extra_config, dry_run=dry_run)
-
-        if not checkpoint_active or checkpoint is None or checkpoint_path is None:
-            return result
-
-        repo_name = repo_path.name
-        checkpoint_key = f"{repo_name}:{check_def.id}"
-
-        if checkpoint_lock is None:
-            checkpoint_lock = asyncio.Lock()
-
-        async with checkpoint_lock:
-            checkpoint.mark_check_completed(checkpoint_key, result.model_dump())
-            save_checkpoint(checkpoint, checkpoint_path)
-
-        return result

package/tools/vds-scripts/audit_orchestrator/src/vds_audit_orchestrator/engine/batch_evidence_cache.py

@@ -1,111 +0,0 @@
-"""Batch-scoped evidence cache for parallel row processing (FR-189).
-
-Provides chunk-ID-keyed storage with batch-scoped lifecycle and hit/miss
-counters. Designed for use within a single batch processing cycle to avoid
-redundant evidence retrieval when multiple checklist rows reference the
-same underlying evidence chunks.
-"""
-
-from __future__ import annotations
-
-import asyncio
-from dataclasses import dataclass
-from typing import Any
-
-from structlog import get_logger
-
-logger = get_logger()
-
-
-@dataclass
-class CacheStats:
-    """Hit/miss counters for evidence cache diagnostics."""
-
-    hits: int = 0
-    misses: int = 0
-
-    @property
-    def total(self) -> int:
-        return self.hits + self.misses
-
-    @property
-    def hit_rate(self) -> float:
-        return self.hits / self.total if self.total > 0 else 0.0
-
-    def to_dict(self) -> dict[str, Any]:
-        return {
-            "hits": self.hits,
-            "misses": self.misses,
-            "total": self.total,
-            "hit_rate": round(self.hit_rate, 4),
-        }
-
-
-class BatchEvidenceCache:
-    """Chunk-ID-keyed evidence cache with batch-scoped lifecycle (FR-189).
-
-    Thread-safe for asyncio concurrency via an internal lock.
-    Create one instance per batch, discard after the batch completes.
-
-    Usage::
-
-        cache = BatchEvidenceCache()
-        cached = await cache.get("chunk-abc-123")
-        if cached is None:
-            value = expensive_retrieval("chunk-abc-123")
-            await cache.put("chunk-abc-123", value)
-        # After batch:
-        logger.info("cache_stats", **cache.to_dict())
-        cache.clear()
-    """
-
-    def __init__(self) -> None:
-        self._store: dict[str, Any] = {}
-        self._stats = CacheStats()
-        self._lock = asyncio.Lock()
-
-    async def get(self, chunk_id: str) -> Any | None:
-        """Retrieve a cached value by chunk ID (async-safe)."""
-        async with self._lock:
-            if chunk_id in self._store:
-                self._stats.hits += 1
-                return self._store[chunk_id]
-            self._stats.misses += 1
-            return None
-
-    async def put(self, chunk_id: str, value: Any) -> None:
-        """Store a value by chunk ID (async-safe)."""
-        async with self._lock:
-            self._store[chunk_id] = value
-
-    def get_sync(self, chunk_id: str) -> Any | None:
-        """Retrieve a cached value (non-async, for sequential paths)."""
-        if chunk_id in self._store:
-            self._stats.hits += 1
-            return self._store[chunk_id]
-        self._stats.misses += 1
-        return None
-
-    def put_sync(self, chunk_id: str, value: Any) -> None:
-        """Store a value (non-async, for sequential paths)."""
-        self._store[chunk_id] = value
-
-    @property
-    def stats(self) -> CacheStats:
-        return self._stats
-
-    @property
-    def size(self) -> int:
-        return len(self._store)
-
-    def clear(self) -> None:
-        """Discard all cached entries and reset counters."""
-        self._store.clear()
-        self._stats = CacheStats()
-
-    def to_dict(self) -> dict[str, Any]:
-        """Return diagnostic summary suitable for structured logging."""
-        return {
-            "size": self.size,
-            **self._stats.to_dict(),
-        }