@orionscanner/cli 0.1.0 → 0.5.1

package/src/orion/engine/config_engine/engine.py

@@ -1,364 +0,0 @@
-"""Config validation engine for YAML, JSON, TOML, .env, .ini, .properties, Python config files."""
-import ast
-import json
-import re
-import tomllib
-from pathlib import Path
-from orion.engine.config import EngineConfig
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class Engine:
-    name = "config_engine"
-    version = "1.0.0"
-
-    REQUIRED_KEYS = {
-        "DATABASE_URL", "SECRET_KEY", "JWT_SECRET", "API_KEY",
-        "REDIS_URL", "CELERY_BROKER_URL", "POSTGRES_URL", "MYSQL_URL",
-        "MONGODB_URI", "RABBITMQ_URL", "KAFKA_BOOTSTRAP_SERVERS",
-        "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "GOOGLE_API_KEY",
-        "STRIPE_SECRET_KEY", "SENDGRID_API_KEY", "TWILIO_AUTH_TOKEN"
-    }
-
-    TYPE_HINTS = {
-        "port": int, "PORT": int, "port_number": int,
-        "debug": bool, "DEBUG": bool, "verbose": bool,
-        "hosts": list, "HOSTS": list, "servers": list, "allowed_hosts": list,
-        "timeout": (int, float), "TIMEOUT": (int, float),
-        "retries": int, "RETRIES": int, "max_retries": int,
-        "workers": int, "WORKERS": int,
-    }
-
-    PLACEHOLDER_PATTERNS = [
-        r"changeme", r"your_.*_here", r"TODO", r"FIXME", r"xxx+",
-        r"replace_me", r"insert_.*_here", r"<.*>", r"\{\{.*\}\}",
-        r"your-.*-here", r"example\.com", r"localhost", r"127\.0\.0\.1"
-    ]
-
-    SENSITIVE_KEYS = {
-        "SECRET_KEY", "JWT_SECRET", "API_KEY", "PASSWORD", "TOKEN",
-        "PRIVATE_KEY", "ACCESS_TOKEN", "REFRESH_TOKEN", "CREDENTIALS"
-    }
-
-    def __init__(self):
-        self._placeholder_regex = [re.compile(p, re.IGNORECASE) for p in self.PLACEHOLDER_PATTERNS]
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
-
-    def _is_config_file(self, filename: str, ext: str) -> bool:
-        if ext in (".yaml", ".yml", ".json", ".toml", ".env", ".ini", ".cfg", ".conf", ".properties"):
-            return True
-        if ext == ".py":
-            name = filename.lower()
-            return any(k in name for k in ("config", "settings", "conf", "env", "secret", "options"))
-        return False
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        path = ir.metadata.get("path", "unknown")
-        filename = Path(path).name.lower()
-        ext = Path(path).suffix.lower()
-
-        if not self._is_config_file(filename, ext):
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        try:
-            text = ir.content.decode("utf-8", errors="replace")
-        except Exception:
-            return EngineResult(engine=self.name, findings=[], ok=True)
-
-        findings = []
-        parsed = self._parse_config(text, filename, ext, path)
-
-        if parsed:
-            findings.extend(self._validate_config(parsed, path, filename, ext, config))
-            findings.extend(self._check_secrets_in_config(parsed, path, filename, ext))
-            findings.extend(self._check_duplicates(parsed, path, filename))
-
-        return EngineResult(engine=self.name, findings=findings, ok=True)
-
-    def _parse_config(self, text: str, filename: str, ext: str, path: str) -> dict | None:
-        try:
-            if ext in (".yaml", ".yml"):
-                import yaml
-                return yaml.safe_load(text) or {}
-            elif ext == ".json":
-                return json.loads(text) or {}
-            elif ext == ".toml":
-                return tomllib.loads(text) or {}
-            elif ext in (".env",) or filename.startswith(".env"):
-                return self._parse_env(text)
-            elif ext in (".ini", ".cfg", ".conf"):
-                return self._parse_ini(text)
-            elif ext == ".properties":
-                return self._parse_properties(text)
-            elif ext == ".py" and self._is_config_file(filename, ext):
-                return self._parse_python_config(text, path)
-        except Exception:
-            pass
-        return None
-
-    def _parse_env(self, text: str) -> dict:
-        result = {}
-        for line in text.splitlines():
-            line = line.strip()
-            if not line or line.startswith("#"):
-                continue
-            if "=" in line:
-                key, value = line.split("=", 1)
-                result[key.strip()] = value.strip().strip('"\'')
-        return result
-
-    def _parse_ini(self, text: str) -> dict:
-        import configparser
-        parser = configparser.ConfigParser()
-        parser.read_string(text)
-        result = {}
-        for section in parser.sections():
-            for key, value in parser[section].items():
-                result[f"{section}.{key}"] = value
-        return result
-
-    def _parse_properties(self, text: str) -> dict:
-        result = {}
-        for line in text.splitlines():
-            line = line.strip()
-            if not line or line.startswith("#") or line.startswith("!"):
-                continue
-            if "=" in line:
-                key, value = line.split("=", 1)
-                result[key.strip()] = value.strip()
-            elif ":" in line:
-                key, value = line.split(":", 1)
-                result[key.strip()] = value.strip()
-        return result
-
-    def _parse_python_config(self, text: str, path: str) -> dict:
-        result = {}
-        try:
-            tree = ast.parse(text, filename=path)
-            for node in ast.walk(tree):
-                if isinstance(node, ast.Assign):
-                    for target in node.targets:
-                        if isinstance(target, ast.Name) and (target.id.isupper() or "_" in target.id):
-                            value = self._extract_value(node.value)
-                            if value is not None:
-                                result[target.id] = value
-        except Exception:
-            pass
-        return result
-
-    def _extract_value(self, node: ast.AST):
-        if isinstance(node, ast.Constant):
-            return node.value
-        elif isinstance(node, ast.List):
-            return [self._extract_value(e) for e in node.elts]
-        elif isinstance(node, ast.Dict):
-            return {self._extract_value(k): self._extract_value(v) for k, v in zip(node.keys, node.values)}
-        elif isinstance(node, ast.Tuple):
-            return tuple(self._extract_value(e) for e in node.elts)
-        return None
-
-    def _validate_config(self, config: dict, path: str, filename: str, ext: str, engine_config: EngineConfig) -> list[Finding]:
-        findings = []
-        flat = self._flatten_config(config)
-
-        # Check explicitly configured required keys
-        required_keys = engine_config.toggles.get("required_config_keys", [])
-        for key in required_keys:
-            if key not in flat and key.lower() not in {k.lower() for k in flat}:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="high",
-                    title=f"Required config key missing: {key}",
-                    description=f"Expected configuration key '{key}' not found",
-                    location=path,
-                    metadata={
-                        "confidence": 0.85,
-                        "key": key,
-                        "expected_type": "str",
-                        "issue": "missing",
-                        "cwe": "CWE-256",
-                    },
-                ))
-
-        for key, value in flat.items():
-            if isinstance(value, str):
-                for pattern in self._placeholder_regex:
-                    if pattern.search(value):
-                        findings.append(Finding(
-                            engine=self.name,
-                            severity="high",
-                            title=f"Placeholder value in config: {key}",
-                            description=f"Config value appears to be a placeholder: {value[:50]}",
-                            location=path,
-                            metadata={
-                                "confidence": 0.9,
-                                "key": key,
-                                "issue": "placeholder_value",
-                                "value": value[:100],
-                                "cwe": "CWE-256",
-                            },
-                        ))
-                        break
-
-                if self._looks_like_secret(key, value) and ext not in (".env",):
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="critical",
-                        title=f"Secret in non-.env config file: {key}",
-                        description=f"Sensitive value found in {ext} file (should be in .env)",
-                        location=path,
-                        metadata={
-                            "confidence": 0.95,
-                            "key": key,
-                            "issue": "secret_in_config",
-                            "cwe": "CWE-798",
-                        },
-                    ))
-
-            expected_type = self.TYPE_HINTS.get(key)
-            if expected_type and not self._type_matches(value, expected_type):
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="medium",
-                    title=f"Config type mismatch: {key}",
-                    description=f"Expected {expected_type.__name__ if hasattr(expected_type, '__name__') else expected_type}, got {type(value).__name__}",
-                    location=path,
-                    metadata={
-                        "confidence": 0.8,
-                        "key": key,
-                        "expected_type": str(expected_type),
-                        "actual_type": type(value).__name__,
-                        "issue": "type_mismatch",
-                        "cwe": "CWE-704",
-                    },
-                ))
-
-            if key.lower() in ("url", "endpoint", "uri") and isinstance(value, str):
-                if not self._is_valid_url(value):
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="medium",
-                        title=f"Invalid URL format: {key}",
-                        description=f"Config value does not appear to be a valid URL: {value[:50]}",
-                        location=path,
-                        metadata={
-                            "confidence": 0.75,
-                            "key": key,
-                            "issue": "invalid_url",
-                            "value": value[:100],
-                        },
-                    ))
-
-            if key.lower() in ("email", "mail") and isinstance(value, str):
-                if not self._is_valid_email(value):
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="medium",
-                        title=f"Invalid email format: {key}",
-                        description=f"Config value does not appear to be a valid email: {value[:50]}",
-                        location=path,
-                        metadata={
-                            "confidence": 0.75,
-                            "key": key,
-                            "issue": "invalid_email",
-                            "value": value[:100],
-                        },
-                    ))
-
-        return findings
-
-    def _check_secrets_in_config(self, config: dict, path: str, filename: str, ext: str) -> list[Finding]:
-        findings = []
-        flat = self._flatten_config(config)
-
-        for key, value in flat.items():
-            if isinstance(value, str) and self._looks_like_secret(key, value):
-                if ext not in (".env",) or "example" in filename or "template" in filename or "sample" in filename:
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="critical" if ext not in (".env",) else "high",
-                        title=f"Potential secret in config: {key}",
-                        description=f"Value for '{key}' matches secret patterns",
-                        location=path,
-                        metadata={
-                            "confidence": 0.85,
-                            "key": key,
-                            "issue": "potential_secret",
-                            "cwe": "CWE-798",
-                        },
-                    ))
-        return findings
-
-    def _check_duplicates(self, config: dict, path: str, filename: str) -> list[Finding]:
-        findings = []
-        flat = self._flatten_config(config)
-        seen = {}
-        for key in flat:
-            lower_key = key.lower()
-            if lower_key in seen:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="medium",
-                    title=f"Duplicate config key (case-insensitive): {key}",
-                    description=f"Key '{key}' duplicates '{seen[lower_key]}' (case-insensitive)",
-                    location=path,
-                    metadata={
-                        "confidence": 0.9,
-                        "key": key,
-                        "duplicate_of": seen[lower_key],
-                        "issue": "duplicate_key",
-                    },
-                ))
-            else:
-                seen[lower_key] = key
-        return findings
-
-    def _flatten_config(self, config: dict, prefix: str = "") -> dict:
-        result = {}
-        for key, value in config.items():
-            full_key = f"{prefix}.{key}" if prefix else key
-            if isinstance(value, dict):
-                result.update(self._flatten_config(value, full_key))
-            else:
-                result[full_key] = value
-        return result
-
-    def _type_matches(self, value, expected_type) -> bool:
-        if isinstance(expected_type, tuple):
-            return isinstance(value, expected_type)
-        if expected_type == int:
-            return isinstance(value, int) and not isinstance(value, bool)
-        if expected_type == bool:
-            return isinstance(value, bool)
-        if expected_type == list:
-            return isinstance(value, list)
-        if expected_type == float:
-            return isinstance(value, (int, float))
-        return isinstance(value, expected_type)
-
-    def _looks_like_secret(self, key: str, value: str) -> bool:
-        key_upper = key.upper()
-        if any(sk in key_upper for sk in self.SENSITIVE_KEYS):
-            if len(value) >= 16 and not value.startswith("${") and not value.startswith("{{"):
-                return True
-        return False
-
-    def _is_valid_url(self, url: str) -> bool:
-        url_pattern = re.compile(
-            r'^(https?|ftp|postgres|mysql|redis|mongodb|amqp|kafka)://'
-            r'(?:(?:[A-Z0-9](?:[A-Z0-9-]{0,61}[A-Z0-9])?\.)+[A-Z]{2,6}\.?|'
-            r'localhost|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})'
-            r'(?::\d+)?'
-            r'(?:/?|[/?]\S+)$', re.IGNORECASE)
-        return bool(url_pattern.match(url))
-
-    def _is_valid_email(self, email: str) -> bool:
-        email_pattern = re.compile(r'^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$')
-        return bool(email_pattern.match(email))

package/src/orion/engine/config_validation/engine.py

@@ -1,313 +0,0 @@
-"""Orion config self-validation engine - validates EngineConfig passed to run."""
-import re
-import os
-from pathlib import Path
-from typing import Dict, List, Any, Optional
-
-from orion.engine.config import EngineConfig, ResourceLimits, NetworkPolicy
-from orion.engine.ir import OrionIR
-from orion.engine.results import EngineResult, Finding
-
-
-class ConfigValidationEngine:
-    name = "config_validation"
-    version = "1.0.0"
-
-    ALLOWED_OUTPUT_FORMATS = {"json", "sarif", "text", "html", "markdown", "csv"}
-
-    async def check_availability(self) -> bool:
-        return True
-
-    def resource_limits(self):
-        from orion.engine.config import ResourceLimits
-        return ResourceLimits(max_cpu_seconds=5, max_memory_mb=32)
-
-    def _validate_project_path(self, config: EngineConfig) -> List[Finding]:
-        findings = []
-        project_path = config.toggles.get("project_path")
-        if not project_path:
-            findings.append(Finding(
-                engine=self.name,
-                severity="error",
-                title="Missing project_path in config",
-                description="EngineConfig.toggles must contain 'project_path'",
-                location="config.toggles.project_path",
-                metadata={"rule": "missing_project_path"},
-            ))
-        else:
-            path = Path(project_path)
-            if not path.exists():
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title=f"Project path does not exist: {project_path}",
-                    description="The specified project_path does not exist on filesystem",
-                    location="config.toggles.project_path",
-                    metadata={"rule": "project_path_not_found", "path": project_path},
-                ))
-            elif not path.is_dir():
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title=f"Project path is not a directory: {project_path}",
-                    description="project_path must be a directory",
-                    location="config.toggles.project_path",
-                    metadata={"rule": "project_path_not_dir", "path": project_path},
-                ))
-        return findings
-
-    def _validate_exclude_patterns(self, config: EngineConfig) -> List[Finding]:
-        findings = []
-        exclude = config.toggles.get("exclude", [])
-        if not isinstance(exclude, list):
-            findings.append(Finding(
-                engine=self.name,
-                severity="error",
-                title="Invalid exclude configuration",
-                description="config.toggles.exclude must be a list of glob patterns",
-                location="config.toggles.exclude",
-                metadata={"rule": "exclude_not_list"},
-            ))
-            return findings
-
-        for i, pattern in enumerate(exclude):
-            if not isinstance(pattern, str):
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title=f"Exclude pattern {i} is not a string",
-                    description="All exclude patterns must be strings",
-                    location=f"config.toggles.exclude[{i}]",
-                    metadata={"rule": "exclude_pattern_not_string", "index": i},
-                ))
-                continue
-
-            # Test if pattern is valid glob
-            try:
-                # Try to compile as a test
-                Path("test").match(pattern)
-            except Exception as e:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="warning",
-                    title=f"Exclude pattern {i} may be invalid: {pattern}",
-                    description=f"Glob pattern validation failed: {e}",
-                    location=f"config.toggles.exclude[{i}]",
-                    metadata={"rule": "exclude_pattern_invalid", "index": i, "pattern": pattern, "error": str(e)},
-                ))
-        return findings
-
-    def _validate_resource_limits(self, config: EngineConfig) -> List[Finding]:
-        findings = []
-        rl = config.resource_limits or {}
-
-        # max_memory_mb
-        memory = rl.get("max_memory_mb")
-        if memory is not None:
-            if not isinstance(memory, int) or memory <= 0:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title="Invalid max_memory_mb",
-                    description="resource_limits.max_memory_mb must be a positive integer",
-                    location="config.resource_limits.max_memory_mb",
-                    metadata={"rule": "invalid_max_memory", "value": memory},
-                ))
-
-        # max_cpu_seconds
-        cpu = rl.get("max_cpu_seconds")
-        if cpu is not None:
-            if not isinstance(cpu, int) or cpu <= 0:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title="Invalid max_cpu_seconds",
-                    description="resource_limits.max_cpu_seconds must be a positive integer",
-                    location="config.resource_limits.max_cpu_seconds",
-                    metadata={"rule": "invalid_max_cpu", "value": cpu},
-                ))
-
-        # max_file_size_mb
-        file_size = rl.get("max_file_size_mb")
-        if file_size is not None:
-            if not isinstance(file_size, int) or file_size <= 0:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title="Invalid max_file_size_mb",
-                    description="resource_limits.max_file_size_mb must be a positive integer",
-                    location="config.resource_limits.max_file_size_mb",
-                    metadata={"rule": "invalid_max_file_size", "value": file_size},
-                ))
-
-        return findings
-
-    def _validate_network_policy(self, config: EngineConfig) -> List[Finding]:
-        findings = []
-        np = config.network_policy or {}
-
-        allow_outbound = np.get("allow_outbound")
-        if allow_outbound is not None and not isinstance(allow_outbound, bool):
-            findings.append(Finding(
-                engine=self.name,
-                severity="error",
-                title="Invalid network_policy.allow_outbound",
-                description="network_policy.allow_outbound must be a boolean",
-                location="config.network_policy.allow_outbound",
-                metadata={"rule": "invalid_allow_outbound", "value": allow_outbound},
-            ))
-
-        allowed_hosts = np.get("allowed_hosts", [])
-        if not isinstance(allowed_hosts, list):
-            findings.append(Finding(
-                engine=self.name,
-                severity="error",
-                title="Invalid network_policy.allowed_hosts",
-                description="network_policy.allowed_hosts must be a list",
-                location="config.network_policy.allowed_hosts",
-                metadata={"rule": "invalid_allowed_hosts_type"},
-            ))
-        else:
-            for i, host in enumerate(allowed_hosts):
-                if not isinstance(host, str):
-                    findings.append(Finding(
-                        engine=self.name,
-                        severity="error",
-                        title=f"allowed_hosts[{i}] is not a string",
-                        description="All allowed_hosts entries must be strings",
-                        location=f"config.network_policy.allowed_hosts[{i}]",
-                        metadata={"rule": "allowed_host_not_string", "index": i},
-                    ))
-
-        # Check if allow_outbound=False but allowed_hosts is not empty (contradiction)
-        if allow_outbound is False and allowed_hosts:
-            findings.append(Finding(
-                engine=self.name,
-                severity="warning",
-                title="network_policy.allow_outbound is false but allowed_hosts is not empty",
-                description="allowed_hosts will be ignored when allow_outbound is false",
-                location="config.network_policy",
-                metadata={"rule": "network_policy_contradiction"},
-            ))
-
-        return findings
-
-    def _validate_parallelism(self, config: EngineConfig) -> List[Finding]:
-        findings = []
-        parallelism = config.toggles.get("parallelism")
-        if parallelism is not None:
-            if not isinstance(parallelism, int) or parallelism <= 0:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title="Invalid parallelism",
-                    description="parallelism must be a positive integer",
-                    location="config.toggles.parallelism",
-                    metadata={"rule": "invalid_parallelism", "value": parallelism},
-                ))
-            else:
-                # Check against CPU count
-                try:
-                    cpu_count = os.cpu_count() or 1
-                    if parallelism > cpu_count * 2:
-                        findings.append(Finding(
-                            engine=self.name,
-                            severity="warning",
-                            title=f"parallelism ({parallelism}) exceeds 2x CPU count ({cpu_count})",
-                            description="High parallelism may cause resource contention",
-                            location="config.toggles.parallelism",
-                            metadata={"rule": "parallelism_high", "parallelism": parallelism, "cpu_count": cpu_count},
-                        ))
-                except Exception:
-                    pass
-        return findings
-
-    def _validate_timeout(self, config: EngineConfig) -> List[Finding]:
-        findings = []
-        timeout = config.toggles.get("timeout")
-        if timeout is not None:
-            if not isinstance(timeout, (int, float)) or timeout <= 0:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title="Invalid timeout",
-                    description="timeout must be a positive number",
-                    location="config.toggles.timeout",
-                    metadata={"rule": "invalid_timeout", "value": timeout},
-                ))
-        return findings
-
-    def _validate_output_format(self, config: EngineConfig) -> List[Finding]:
-        findings = []
-        output_format = config.toggles.get("output_format")
-        if output_format is not None:
-            if not isinstance(output_format, str):
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="error",
-                    title="Invalid output_format",
-                    description="output_format must be a string",
-                    location="config.toggles.output_format",
-                    metadata={"rule": "invalid_output_format_type"},
-                ))
-            elif output_format not in self.ALLOWED_OUTPUT_FORMATS:
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="warning",
-                    title=f"Unknown output_format: {output_format}",
-                    description=f"Allowed formats: {', '.join(sorted(self.ALLOWED_OUTPUT_FORMATS))}",
-                    location="config.toggles.output_format",
-                    metadata={"rule": "unknown_output_format", "value": output_format, "allowed": list(self.ALLOWED_OUTPUT_FORMATS)},
-                ))
-        return findings
-
-    def _validate_engine_toggles(self, config: EngineConfig) -> List[Finding]:
-        findings = []
-        # Check for unknown engine toggles
-        known_toggles = {
-            "project_path", "exclude", "parallelism", "timeout", "output_format",
-            "fail_on_severity", "include_tests", "include_generated",
-        }
-        for key in config.toggles:
-            if key not in known_toggles and not key.startswith("_"):
-                findings.append(Finding(
-                    engine=self.name,
-                    severity="warning",
-                    title=f"Unknown config toggle: {key}",
-                    description=f"Toggle '{key}' is not a recognized Orion configuration option",
-                    location=f"config.toggles.{key}",
-                    metadata={"rule": "unknown_toggle", "toggle": key},
-                ))
-        return findings
-
-    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
-        all_findings = []
-
-        # Run all validations
-        all_findings.extend(self._validate_project_path(config))
-        all_findings.extend(self._validate_exclude_patterns(config))
-        all_findings.extend(self._validate_resource_limits(config))
-        all_findings.extend(self._validate_network_policy(config))
-        all_findings.extend(self._validate_parallelism(config))
-        all_findings.extend(self._validate_timeout(config))
-        all_findings.extend(self._validate_output_format(config))
-        all_findings.extend(self._validate_engine_toggles(config))
-
-        # Count errors and warnings
-        errors = sum(1 for f in all_findings if f.severity == "error")
-        warnings = sum(1 for f in all_findings if f.severity == "warning")
-
-        return EngineResult(
-            engine=self.name,
-            findings=all_findings,
-            ok=errors == 0,
-            metrics={
-                "validations_run": 7,
-                "errors": errors,
-                "warnings": warnings,
-                "total_findings": len(all_findings),
-            },
-        )
-
-
-Engine = ConfigValidationEngine