@vigolium/piolium 0.0.1

package/skills/zeroize-audit/tools/mcp/apply_confidence_gates.py

@@ -0,0 +1,113 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.11"
+# dependencies = []
+# ///
+"""
+Apply strict confidence gates to zeroize-audit findings.
+"""
+
+import argparse
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+ADVANCED_MCP_CATEGORIES = {
+    "SECRET_COPY",
+    "MISSING_ON_ERROR_PATH",
+    "NOT_DOMINATING_EXITS",
+}
+
+ASM_REQUIRED_CATEGORIES = {
+    "STACK_RETENTION",
+    "REGISTER_SPILL",
+}
+
+
+def _has_compiler_evidence(finding: dict[str, Any]) -> bool:
+    ce = finding.get("compiler_evidence")
+    if not isinstance(ce, dict):
+        return False
+    return any(ce.get(key) for key in ("o0", "o2", "diff_summary"))
+
+
+def _has_marker(text: str, marker: str) -> bool:
+    return marker in text.lower()
+
+
+def apply_gates(
+    report: dict[str, Any],
+    mcp_available: bool,
+    require_mcp_for_advanced: bool,
+) -> dict[str, Any]:
+    findings: list[dict[str, Any]] = report.get("findings", [])
+
+    for finding in findings:
+        category = finding.get("category")
+        evidence = (finding.get("evidence") or "").lower()
+
+        if category in {"OPTIMIZED_AWAY_ZEROIZE"} and not _has_compiler_evidence(finding):
+            finding["needs_review"] = True
+            finding["evidence"] = (
+                finding.get("evidence", "")
+                + " [gated: missing IR/ASM evidence for optimized-away claim]"
+            ).strip()
+
+        if category in ASM_REQUIRED_CATEGORIES and not _has_marker(evidence, "asm"):
+            finding["needs_review"] = True
+            finding["evidence"] = (
+                finding.get("evidence", "") + " [gated: missing assembly evidence]"
+            ).strip()
+
+        if require_mcp_for_advanced and not mcp_available and category in ADVANCED_MCP_CATEGORIES:
+            finding["needs_review"] = True
+            finding["evidence"] = (
+                finding.get("evidence", "")
+                + " [gated: MCP unavailable for advanced semantic finding]"
+            ).strip()
+
+    summary = report.get("summary", {})
+    if isinstance(summary, dict):
+        summary["issues_found"] = len(findings)
+
+    return report
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="Apply zeroize-audit confidence gates")
+    parser.add_argument("--input", required=True, help="Input output.json path")
+    parser.add_argument("--out", required=True, help="Output path")
+    parser.add_argument(
+        "--mcp-available",
+        action="store_true",
+        help="Set when MCP semantic evidence is available",
+    )
+    parser.add_argument(
+        "--require-mcp-for-advanced",
+        action="store_true",
+        help="Downgrade advanced findings when MCP is unavailable",
+    )
+    args = parser.parse_args()
+
+    report = json.loads(Path(args.input).read_text())
+    if not isinstance(report, dict):
+        print(
+            f"Error: expected JSON object in {args.input}, got {type(report).__name__}",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+    updated = apply_gates(
+        report=report,
+        mcp_available=args.mcp_available,
+        require_mcp_for_advanced=args.require_mcp_for_advanced,
+    )
+
+    out_path = Path(args.out)
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    out_path.write_text(json.dumps(updated, indent=2) + "\n")
+    print(f"OK: wrote gated report to {out_path}")
+
+
+if __name__ == "__main__":
+    main()

package/skills/zeroize-audit/tools/mcp/check_mcp.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Probe for Serena MCP server availability.
+#
+# Usage:
+#   check_mcp.sh
+#   check_mcp.sh --compile-db compile_commands.json
+
+usage() {
+  echo "Usage: $0 [--compile-db compile_commands.json]" >&2
+}
+
+COMPILE_DB=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --compile-db)
+      COMPILE_DB="$2"
+      shift 2
+      ;;
+    *)
+      echo "Unknown arg: $1" >&2
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+missing=()
+if ! command -v "uvx" >/dev/null 2>&1; then
+  missing+=("uvx")
+fi
+
+compile_db_status="not_checked"
+if [[ -n "$COMPILE_DB" ]]; then
+  if [[ -f "$COMPILE_DB" ]]; then
+    compile_db_status="present"
+  else
+    compile_db_status="missing"
+  fi
+fi
+
+if [[ ${#missing[@]} -eq 0 ]]; then
+  cat <<EOF
+{
+  "mcp_available": true,
+  "mcp_server": "serena",
+  "uvx_present": true,
+  "compile_db_status": "${compile_db_status}",
+  "missing_tools": []
+}
+EOF
+  exit 0
+fi
+
+missing_json=$(printf '"%s",' "${missing[@]}" | sed 's/,$//')
+
+cat <<EOF
+{
+  "mcp_available": false,
+  "mcp_server": "serena",
+  "compile_db_status": "${compile_db_status}",
+  "missing_tools": [${missing_json}],
+  "message": "Serena MCP server unavailable (uvx not found); advanced findings must be downgraded to needs_review."
+}
+EOF
+exit 1

package/skills/zeroize-audit/tools/mcp/normalize_mcp_evidence.py

@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+# /// script
+# requires-python = ">=3.11"
+# dependencies = []
+# ///
+"""
+Normalize Serena MCP semantic-analysis output into consistent evidence records.
+
+Serena returns structured results with file, line, symbol, and kind fields.
+This normalizer produces a consistent schema consumed by the zeroize-audit
+confidence gating and evidence scoring pipeline.
+"""
+
+import argparse
+import json
+import sys
+from collections import Counter
+from pathlib import Path
+from typing import Any
+
+
+def _load_payload(input_path: str) -> Any:
+    if input_path:
+        try:
+            return json.loads(Path(input_path).read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError) as e:
+            print(f"Error reading {input_path}: {e}", file=sys.stderr)
+            sys.exit(1)
+    if sys.stdin.isatty():
+        print("Error: no --input specified and stdin is a terminal", file=sys.stderr)
+        sys.exit(2)
+    try:
+        return json.load(sys.stdin)
+    except json.JSONDecodeError as e:
+        print(f"Error: invalid JSON on stdin: {e}", file=sys.stderr)
+        sys.exit(1)
+
+
+def _as_results(payload: Any) -> list[dict[str, Any]]:
+    if isinstance(payload, list):
+        return [item for item in payload if isinstance(item, dict)]
+    if isinstance(payload, dict):
+        if isinstance(payload.get("results"), list):
+            return [item for item in payload["results"] if isinstance(item, dict)]
+        return [payload]
+    return []
+
+
+def _normalize_item(result: dict[str, Any], item: dict[str, Any]) -> dict[str, Any]:
+    file_path = item.get("file") or item.get("uri") or result.get("target") or ""
+    line = item.get("line")
+    if isinstance(line, str) and line.isdigit():
+        line = int(line)
+
+    symbol = item.get("symbol") or item.get("name") or result.get("query") or ""
+    kind = item.get("kind") or result.get("tool") or "mcp_result"
+    detail = item.get("detail") or item.get("snippet") or ""
+
+    confidence = item.get("confidence") if item.get("confidence") is not None else "medium"
+
+    return {
+        "file": file_path,
+        "line": line,
+        "symbol": symbol,
+        "kind": kind,
+        "detail": detail,
+        "source": result.get("tool", "mcp"),
+        "confidence": confidence,
+        "metadata": {
+            "query": result.get("query"),
+            "target": result.get("target"),
+            "raw_item": item,
+        },
+    }
+
+
+def normalize(payload: Any) -> dict[str, Any]:
+    results = _as_results(payload)
+    normalized: list[dict[str, Any]] = []
+    tools = Counter()
+    kinds = Counter()
+
+    for result in results:
+        tool_name = result.get("tool", "mcp")
+        tools[tool_name] += 1
+
+        items = result.get("items")
+        if not isinstance(items, list):
+            items = [result]
+
+        for raw_item in items:
+            if not isinstance(raw_item, dict):
+                continue
+            entry = _normalize_item(result, raw_item)
+            normalized.append(entry)
+            kinds[entry["kind"]] += 1
+
+    return {
+        "mcp_available": len(normalized) > 0,
+        "evidence_count": len(normalized),
+        "evidence": normalized,
+        "coverage": {
+            "by_tool": dict(tools),
+            "by_kind": dict(kinds),
+        },
+    }
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(description="Normalize MCP evidence JSON")
+    parser.add_argument("--input", help="Input JSON file path; defaults to stdin")
+    parser.add_argument("--out", required=True, help="Output JSON path")
+    args = parser.parse_args()
+
+    payload = _load_payload(args.input)
+    output = normalize(payload)
+
+    out_path = Path(args.out)
+    out_path.parent.mkdir(parents=True, exist_ok=True)
+    out_path.write_text(json.dumps(output, indent=2) + "\n", encoding="utf-8")
+    print(f"OK: wrote normalized MCP evidence to {out_path}")
+
+
+if __name__ == "__main__":
+    main()