codna 0.2.17__tar.gz → 0.2.18__tar.gz

{codna-0.2.17 → codna-0.2.18}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.17
+Version: 0.2.18
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.17 → codna-0.2.18}/codna/__init__.py

@@ -5,4 +5,4 @@ This package is the `codna` CLI. Users never touch "algenta" directly — the en
 is an internal dependency reached over HTTP.
 """
 
-__version__ = "0.2.17"
+__version__ = "0.2.18"

{codna-0.2.17 → codna-0.2.18}/codna/agent-core/run-server.bundle.mjs

@@ -110643,7 +110643,7 @@ var init_bowser = __esm(() => {
 
 // agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client/index.js
 var require_client2 = __commonJS((exports) => {
-  var __dirname = "/opt/runner/_work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
+  var __dirname = "/home/runner/work/codna/codna/agent-core/vendor/cline/node_modules/.bun/@aws-sdk+core@3.974.15/node_modules/@aws-sdk/core/dist-cjs/submodules/client";
   var retry2 = require_retry2();
   var protocols = require_protocols();
   var lambdaInvokeStore = require_invoke_store();

{codna-0.2.17 → codna-0.2.18}/codna/ci_admission.py

@@ -33,7 +33,6 @@ import os
 import platform
 import subprocess
 import time
-import uuid
 from dataclasses import dataclass, field
 from pathlib import Path
 

{codna-0.2.17 → codna-0.2.18}/codna/evasion.py

@@ -28,6 +28,11 @@ _PATH_CATEGORIES: list[tuple[str, list[re.Pattern]]] = [
         re.compile(r"(^|/)\.snyk$"),
         re.compile(r"(^|/)trivy\.ya?ml$"),
         re.compile(r"\.qlpack\.ya?ml$"),
+        # thyn-ai/security-toolchain: gitleaks rules + path allowlist, repo-local Opengrep rule
+        # packs, and the pinned scanner versions + sha256 digests every binary is verified against.
+        re.compile(r"(^|/)\.gitleaks\.toml$"),
+        re.compile(r"(^|/)security/opengrep/"),
+        re.compile(r"(^|/)security/toolchain\.lock$"),
     ]),
     ("suppression_or_baseline", [
         re.compile(r"(^|/)\.semgrepignore$"),
@@ -36,6 +41,11 @@ _PATH_CATEGORIES: list[tuple[str, list[re.Pattern]]] = [
         re.compile(r"(^|/)\.snyk$"),
         re.compile(r"baseline.*\.sarif$"),
         re.compile(r"(^|/)\.sarif-baseline"),
+        # thyn-ai/security-toolchain: gitleaks fingerprint allowlist, osv-scanner ignore/override
+        # config, and the CI-measured `security/baseline/<tool>.txt` ratchet files.
+        re.compile(r"(^|/)\.gitleaksignore$"),
+        re.compile(r"(^|/)osv-scanner\.toml$"),
+        re.compile(r"(^|/)security/baseline/"),
     ]),
     ("ci_or_test_config", [
         re.compile(r"(^|/)\.github/workflows/"),
@@ -71,7 +81,7 @@ _LOCKFILES = {
 # No surrounding \b anchors — several directives start/end with non-word chars (#, [, :).
 _INLINE_SUPPRESSIONS = re.compile(
     r"(nosemgrep|nosem|lgtm\s*\[|#\s*nosec|NOSONAR|checkov:skip|eslint-disable"
-    r"|trivy:ignore|snyk:ignore|//\s*codeql[^\n]*\bignore)",
+    r"|trivy:ignore|snyk:ignore|gitleaks:allow|//\s*codeql[^\n]*\bignore)",
     re.IGNORECASE,
 )
 

{codna-0.2.17 → codna-0.2.18}/codna/findings.py

@@ -213,7 +213,7 @@ class NormalizedFinding:
 
 @dataclass
 class ScannerIdentity:
-    name: str  # canonical: codeql|semgrep|snyk|trivy|...
+    name: str  # canonical: codeql|semgrep|snyk|trivy|opengrep|gitleaks|osv-scanner|...
     raw_name: str
     version: str | None
     guid: str | None

{codna-0.2.17 → codna-0.2.18}/codna/memory.py

@@ -513,7 +513,7 @@ def _embedder():
 # Recall-time rerank pipeline — split into memory_rerank.py (MOD-FILESIZE 1000-line ceiling). The
 # names are re-imported here so the public import surface (`from codna.memory import ...`) and the
 # recall() call sites below are unchanged.
-from .memory_rerank import (  # noqa: F401
+from .memory_rerank import (  # noqa: E402, F401
     _is_test_symbol,
     _query_is_test_oriented,
     _semantic_rerank,

{codna-0.2.17 → codna-0.2.18}/codna/sarif.py

@@ -74,6 +74,16 @@ _SCANNER_ALIASES = {
     "snyk open source": "snyk",
     "trivy": "trivy",
     "aqua trivy": "trivy",
+    # thyn-ai/security-toolchain drivers, `tool.driver.name` exactly as each binary writes it
+    # (lower-cased by `_canon_scanner`): opengrep `--sarif-output` says "Opengrep OSS" (toolchain
+    # tests/test_gate.py:23), `gitleaks -f sarif` says "gitleaks" (report/constants.go:4),
+    # `osv-scanner --format sarif` says "osv-scanner" (internal/output/sarif.go).
+    # Opengrep is a Semgrep fork but a distinct, separately pinned tool: never fold it into semgrep
+    # (the cross-run identity check below relies on distinct canonical names).
+    "opengrep": "opengrep",
+    "opengrep oss": "opengrep",
+    "gitleaks": "gitleaks",
+    "osv-scanner": "osv-scanner",
 }
 
 
@@ -369,7 +379,8 @@ def _has_cve(rule_id: str, rule: dict, result: dict) -> bool:
 def _classify_kind(rule_id: str, rule: dict, result: dict, scanner: str) -> FindingKind:
     tags = _tags(rule, result)
     has_flows = bool(result.get("codeFlows"))
-    if tags & {"secret", "credential", "credentials", "key", "token"}:
+    # gitleaks is a secrets-only scanner and its SARIF rules carry no tags: classify by identity.
+    if scanner == "gitleaks" or tags & {"secret", "credential", "credentials", "key", "token"}:
         return FindingKind.SECRET
     if _has_cve(rule_id, rule, result) or tags & {"sca", "supply-chain", "dependency", "vulnerability"}:
         return FindingKind.SCA

{codna-0.2.17 → codna-0.2.18}/codna.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codna
-Version: 0.2.17
+Version: 0.2.18
 Summary: Local-first repo intelligence and agent fixing for Codna.
 Author: Thyn
 Maintainer: Thyn

{codna-0.2.17 → codna-0.2.18}/codna.egg-info/SOURCES.txt

@@ -194,5 +194,6 @@ tests/test_webhook_worker_feedback_dispatch.py
 tests/test_wheel_guard.py
 tests/test_wheel_smoke_script.py
 tests/test_worker.py
+tests/test_workflows.py
 tests/test_worktree.py
 tests/test_writer.py

{codna-0.2.17 → codna-0.2.18}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "codna"
-version = "0.2.17"
+version = "0.2.18"
 description = "Local-first repo intelligence and agent fixing for Codna."
 readme = "README.md"
 requires-python = ">=3.10"

{codna-0.2.17 → codna-0.2.18}/tests/test_dev_check_script.py

@@ -84,6 +84,25 @@ def test_build_cline_sdk_serializes_shared_bun_setup(monkeypatch):
     ]
 
 
+def test_lint_excludes_broken_fixture_and_vendored_memengine(monkeypatch):
+    tool = _load_script()
+    commands = []
+
+    monkeypatch.setattr(tool, "resolve_python", lambda modules: Path("/opt/lint/bin/python"))
+    monkeypatch.setattr(tool, "run", lambda command, *, cwd=tool.ROOT: commands.append(command))
+
+    tool.lint()
+
+    ruff = commands[0]
+    assert ruff[:5] == ["/opt/lint/bin/python", "-m", "ruff", "check", "cli"]
+    excludes = [ruff[i + 1] for i, arg in enumerate(ruff) if arg == "--exclude"]
+    # Both exclusions come from the script's own constants; the vendored, Telys-owned memengine
+    # is replaced wholesale at publish time and must never be linted as codna code.
+    assert excludes == [tool.BROKEN_FIXTURE, tool.VENDORED_MEMENGINE]
+    assert tool.VENDORED_MEMENGINE == "cli/memengine"
+    assert commands[1] == ["/opt/lint/bin/python", "scripts/cline_fork_guard.py"]
+
+
 def test_dev_check_lock_uses_directory_fallback_without_fcntl(tmp_path, monkeypatch):
     tool = _load_script()
     lock_path = tmp_path / "cline.lock"

codna-0.2.18/tests/test_evasion.py

@@ -0,0 +1,146 @@
+"""Anti-evasion / patch-integrity tests (A–Z test plan: G4, PI-EV-*, PI-SCA-*, PI-SCOPE-*,
+G4-HOOK-INJECT)."""
+from __future__ import annotations
+
+import posixpath
+
+import pytest
+
+from codna.evasion import _PATH_CATEGORIES, reject_evasion
+
+
+def _diff(path, added="return safe(u)"):
+    return (
+        f"diff --git a/{path} b/{path}\n"
+        f"--- a/{path}\n+++ b/{path}\n@@ -1 +1,2 @@\n context\n+{added}\n"
+    )
+
+
+def _matches(pattern, path):
+    """Mirror `_categorize`: a pattern hits on the full path OR on the basename."""
+    return bool(pattern.search(path) or pattern.search(posixpath.basename(path)))
+
+
+# thyn-ai/security-toolchain files: rule packs / pins (scanner config) and allowlists /
+# ratchet baselines (suppressions). Kept separate so the scope tests below can iterate them.
+TOOLCHAIN_PROTECTED = [
+    (".gitleaks.toml", "scanner_config_or_rulepack"),
+    ("security/opengrep/no-shell-true.yml", "scanner_config_or_rulepack"),
+    ("security/toolchain.lock", "scanner_config_or_rulepack"),
+    (".gitleaksignore", "suppression_or_baseline"),
+    ("osv-scanner.toml", "suppression_or_baseline"),
+    ("security/baseline/opengrep.txt", "suppression_or_baseline"),
+]
+
+# One oracle per forbidden path pattern in `_PATH_CATEGORIES` (asserted below, so a pattern
+# can never be added without a case that proves it fires).
+FORBIDDEN_CASES = [
+    (".semgrep.yml", "scanner_config_or_rulepack"),
+    (".semgrep/rules.yml", "scanner_config_or_rulepack"),
+    (".github/codeql/config.yml", "scanner_config_or_rulepack"),
+    ("codeql-config.yml", "scanner_config_or_rulepack"),
+    (".snyk", "scanner_config_or_rulepack"),
+    ("trivy.yaml", "scanner_config_or_rulepack"),
+    (".qlpack.yml", "scanner_config_or_rulepack"),
+    (".semgrepignore", "suppression_or_baseline"),
+    (".codeqlignore", "suppression_or_baseline"),
+    (".trivyignore", "suppression_or_baseline"),
+    ("baseline-2024.sarif", "suppression_or_baseline"),
+    (".sarif-baseline", "suppression_or_baseline"),
+    (".github/workflows/ci.yml", "ci_or_test_config"),
+    (".gitlab-ci.yml", "ci_or_test_config"),
+    ("azure-pipelines.yml", "ci_or_test_config"),
+    ("pytest.ini", "ci_or_test_config"),
+    ("tox.ini", "ci_or_test_config"),
+    ("conftest.py", "ci_or_test_config"),
+    ("jest.config.ts", "ci_or_test_config"),
+    ("codna-security.yaml", "codna_policy_or_model"),
+    (".codna/policy.yml", "codna_policy_or_model"),
+    ("codna/evidence.py", "evidence_generation"),
+    ("codna/gate.py", "evidence_generation"),
+    (".git/hooks/pre-push", "executable_hook"),
+    (".pre-commit-config.yaml", "executable_hook"),
+    ("Makefile", "executable_hook"),
+    (".husky/pre-commit", "executable_hook"),
+] + TOOLCHAIN_PROTECTED
+
+
+def test_clean_source_only_patch_allowed():
+    res = reject_evasion(_diff("src/app.py"))
+    assert res.ok is True and res.violations == []
+    assert res.changed_paths == ["src/app.py"]
+
+
+@pytest.mark.parametrize("path,reason", FORBIDDEN_CASES)
+def test_forbidden_file_categories_rejected(path, reason):
+    res = reject_evasion(_diff(path))
+    assert res.ok is False
+    assert any(v.reason_code == reason for v in res.violations), res.violations
+
+
+def test_every_forbidden_category_has_an_oracle():
+    assert {reason for reason, _ in _PATH_CATEGORIES} == {reason for _, reason in FORBIDDEN_CASES}
+
+
+def test_every_forbidden_pattern_has_an_oracle():
+    # Derived from the source of truth: every regex in `_PATH_CATEGORIES` must be hit by at least
+    # one case, whatever the module currently declares -- never a hardcoded count.
+    uncovered = [
+        (reason, pat.pattern)
+        for reason, patterns in _PATH_CATEGORIES
+        for pat in patterns
+        if not any(_matches(pat, path) for path, _ in FORBIDDEN_CASES)
+    ]
+    assert uncovered == []
+
+
+@pytest.mark.parametrize("path,reason", TOOLCHAIN_PROTECTED)
+def test_toolchain_files_rejected_at_root_nested_and_in_scope(path, reason):
+    # Categorization precedes the scope check: even a candidate whose allow-list names the very
+    # file is rejected, at the repository root and in a nested monorepo package alike.
+    for candidate in (path, f"packages/api/{path}"):
+        res = reject_evasion(_diff(candidate), allowed_paths=[candidate])
+        assert res.ok is False, candidate
+        assert [v.reason_code for v in res.violations] == [reason], res.violations
+    # Only an explicit operator authorization lets it through, and that is recorded, never silent.
+    authorized = reject_evasion(_diff(path), policy_authorized=[reason], policy_digest="sha256:pol")
+    assert authorized.ok is True
+    assert authorized.authorization_used == [f"{reason}@sha256:pol"]
+
+
+@pytest.mark.parametrize("token", [
+    "nosemgrep", "# nosec", "NOSONAR", "checkov:skip=CKV_AWS_1",
+    "eslint-disable-next-line", "trivy:ignore:AVD-AWS-0089", "snyk:ignore",
+    "lgtm[py/sql-injection]", "gitleaks:allow",
+])
+def test_inline_suppressions_rejected(token):
+    res = reject_evasion(_diff("src/app.py", added=f"x = 1  # {token}"))
+    assert res.ok is False
+    assert any(v.reason_code == "inline_suppression" for v in res.violations)
+
+
+def test_lockfile_requires_dependency_diff_verification():
+    unverified = reject_evasion(_diff("package-lock.json", added='"lodash": "4.17.21"'))
+    assert unverified.ok is False
+    assert any(v.reason_code == "lockfile_unverified" for v in unverified.violations)
+
+    verified = reject_evasion(_diff("package-lock.json"), dependency_diff_verified=True)
+    assert verified.ok is True
+
+
+def test_change_scope_enforced():
+    res = reject_evasion(_diff("infra/deploy.tf"), allowed_paths=["src/"])
+    assert res.ok is False
+    assert any(v.reason_code == "change_scope_exceeded" for v in res.violations)
+    # in-scope edit passes under the same allow-list
+    assert reject_evasion(_diff("src/app.py"), allowed_paths=["src/"]).ok is True
+
+
+def test_explicit_policy_authorization_is_recorded_not_silent():
+    res = reject_evasion(
+        _diff(".semgrep.yml"),
+        policy_authorized=["scanner_config_or_rulepack"],
+        policy_digest="sha256:pol",
+    )
+    assert res.ok is True
+    assert res.authorization_used == ["scanner_config_or_rulepack@sha256:pol"]

{codna-0.2.17 → codna-0.2.18}/tests/test_report_cli.py

@@ -12,7 +12,6 @@ Three properties matter more than any individual test:
 from __future__ import annotations
 
 import argparse
-import json
 
 import httpx
 import pytest

{codna-0.2.17 → codna-0.2.18}/tests/test_sarif.py

@@ -259,6 +259,70 @@ def test_sar37_conflicting_drivers():
     assert "codeql" in joined and "semgrep" in joined  # both surfaced
 
 
+# `tool.driver.name` exactly as each report writer emits it -> the canonical scanner name.
+DRIVER_NAMES = {
+    "CodeQL": "codeql",
+    "Semgrep OSS": "semgrep",
+    "Snyk Code": "snyk",
+    "Trivy": "trivy",
+    "Opengrep OSS": "opengrep",
+    "gitleaks": "gitleaks",
+    "osv-scanner": "osv-scanner",
+}
+
+
+@pytest.mark.parametrize("raw,canonical", sorted(DRIVER_NAMES.items()))
+def test_sar05b_emitted_driver_names_canonicalized(raw, canonical):
+    ing = ingest_sarif(json.dumps(_complete(driver=raw)))
+    assert ing.scanner.name == canonical
+    assert ing.scanner.raw_name == raw
+    assert ing.provenance_valid is True
+
+
+def test_sar05c_alias_map_is_closed_case_insensitive_and_keeps_forks_apart():
+    canonical = set(sarif._SCANNER_ALIASES.values())
+    # closed: every canonical name is also its own key, so canonicalizing twice is a no-op
+    assert all(name in sarif._SCANNER_ALIASES for name in canonical)
+    assert set(DRIVER_NAMES.values()) <= canonical
+    for raw, want in DRIVER_NAMES.items():
+        assert sarif._canon_scanner(f"  {raw.upper()} ") == want
+    # Opengrep is a Semgrep fork but a distinct, separately pinned tool
+    assert sarif._canon_scanner("Opengrep OSS") != sarif._canon_scanner("Semgrep OSS")
+    # unknown drivers pass through lower-cased rather than being guessed at
+    assert sarif._canon_scanner("  Some New Scanner ") == "some new scanner"
+    # regression floor only (codeql, semgrep, snyk, trivy, opengrep, gitleaks, osv-scanner), not an exact count
+    assert len(canonical) >= 7
+
+
+def test_sar38_mixed_opengrep_semgrep_runs_are_inconsistent():
+    doc = _doc(
+        _run(driver="Opengrep OSS", version="1.0.0", results=[_result(rule_id="a")]),
+        _run(driver="Semgrep OSS", version="1.0.0", results=[_result(rule_id="b")]),
+    )
+    ing = ingest_sarif(json.dumps(doc))
+    assert ing.provenance_valid is False
+    joined = " ".join(ing.provenance_errors)
+    assert "inconsistent scanner identity" in joined
+    assert "opengrep" in joined and "semgrep" in joined
+
+
+def test_sar39_gitleaks_untagged_rule_is_secret():
+    untagged = {"id": "aws-access-token", "properties": {}}
+    res = _result(rule_id="aws-access-token", code_flows=None)
+    # gitleaks rules carry no tags: the scanner's identity alone makes the finding a SECRET
+    gl = ingest_sarif(json.dumps(_complete(driver="gitleaks", rules=[untagged], results=[res])))
+    assert gl.findings[0].finding_kind is FindingKind.SECRET
+    # the identity rule is gitleaks-only: the same untagged rule under another driver stays UNSUPPORTED
+    og = ingest_sarif(json.dumps(_complete(driver="Opengrep OSS", rules=[untagged], results=[res])))
+    assert og.findings[0].finding_kind is FindingKind.UNSUPPORTED
+    # osv-scanner advisories classify SCA via the GHSA id (pins behaviour that predates the alias)
+    ghsa = {"id": "GHSA-abcd-efgh-ijkl", "properties": {}}
+    osv = ingest_sarif(json.dumps(_complete(
+        driver="osv-scanner", rules=[ghsa], results=[_result(rule_id="GHSA-abcd-efgh-ijkl", code_flows=None)],
+    )))
+    assert osv.findings[0].finding_kind is FindingKind.SCA
+
+
 # --------------------------------------------------------------- commit binding
 
 def test_sar09_commit_bound_from_vcp():

codna-0.2.18/tests/test_workflows.py

@@ -0,0 +1,67 @@
+"""Contracts over the repository's own GitHub Actions configuration.
+
+Every expectation is derived from the files under .github/ (job lists, workflow names), never
+from a hardcoded count, so adding a workflow cannot silently escape a rule.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parents[2]
+WORKFLOWS = ROOT / ".github" / "workflows"
+WORKFLOW_FILES = sorted(WORKFLOWS.glob("*.yml")) + sorted(WORKFLOWS.glob("*.yaml"))
+
+
+def _jobs(path: Path) -> dict:
+    doc = yaml.safe_load(path.read_text(encoding="utf-8"))
+    assert isinstance(doc, dict), path
+    return doc["jobs"]
+
+
+def test_workflows_are_present():
+    assert WORKFLOW_FILES, "no workflow files found under .github/workflows"
+
+
+@pytest.mark.parametrize("path", WORKFLOW_FILES, ids=lambda p: p.name)
+def test_no_workflow_reads_the_retired_fleet_variable(path):
+    # `fromJSON(vars.RUNNER_LABELS)` fails at workflow PARSE time (zero jobs, no logs) once the
+    # org variable is gone; every job runs on GitHub-hosted runners now.
+    assert "fromJSON(vars.RUNNER_LABELS)" not in path.read_text(encoding="utf-8")
+
+
+@pytest.mark.parametrize("path", WORKFLOW_FILES, ids=lambda p: p.name)
+def test_every_job_declares_a_timeout(path):
+    # GitHub's default is 360 minutes per job, billed on hosted runners. A job that calls a
+    # reusable workflow (`uses:`) may not set timeout-minutes itself; the callee's jobs carry it.
+    missing = [
+        job for job, spec in _jobs(path).items()
+        if "timeout-minutes" not in spec and "uses" not in spec
+    ]
+    assert missing == [], f"{path.name}: jobs without timeout-minutes: {missing}"
+
+
+def test_security_workflow_pins_the_toolchain_by_sha_with_a_version_comment():
+    text = (WORKFLOWS / "security.yml").read_text(encoding="utf-8")
+    uses = [line.strip() for line in text.splitlines() if line.strip().startswith("uses: thyn-ai/security-toolchain/")]
+    assert len(uses) == 1, uses
+    assert re.fullmatch(
+        r"uses: thyn-ai/security-toolchain/\.github/workflows/security-full\.yml@[0-9a-f]{40} # v\d+\.\d+\.\d+",
+        uses[0],
+    ), uses[0]
+
+
+def test_dependabot_leaves_the_toolchain_pin_to_propagate():
+    doc = yaml.safe_load((ROOT / ".github" / "dependabot.yml").read_text(encoding="utf-8"))
+    actions = [
+        u
+        for u in doc["updates"]
+        if u["package-ecosystem"] == "github-actions" and u.get("directory") == "/"
+    ]
+    assert actions, "no github-actions block covers .github/workflows"
+    ignored = [entry["dependency-name"] for block in actions for entry in block.get("ignore", [])]
+    # Dependabot names a reusable workflow by its full path, so only a wildcard can match it.
+    assert any(name.startswith("thyn-ai/security-toolchain") and name.endswith("*") for name in ignored), ignored

codna-0.2.17/tests/test_evasion.py

@@ -1,76 +0,0 @@
-"""Anti-evasion / patch-integrity tests (A–Z test plan: G4, PI-EV-*, PI-SCA-*, PI-SCOPE-*,
-G4-HOOK-INJECT)."""
-from __future__ import annotations
-
-import pytest
-
-from codna.evasion import reject_evasion
-
-
-def _diff(path, added="return safe(u)"):
-    return (
-        f"diff --git a/{path} b/{path}\n"
-        f"--- a/{path}\n+++ b/{path}\n@@ -1 +1,2 @@\n context\n+{added}\n"
-    )
-
-
-def test_clean_source_only_patch_allowed():
-    res = reject_evasion(_diff("src/app.py"))
-    assert res.ok is True and res.violations == []
-    assert res.changed_paths == ["src/app.py"]
-
-
-@pytest.mark.parametrize("path,reason", [
-    (".semgrep.yml", "scanner_config_or_rulepack"),
-    (".github/codeql/config.yml", "scanner_config_or_rulepack"),
-    (".semgrepignore", "suppression_or_baseline"),
-    (".github/workflows/ci.yml", "ci_or_test_config"),
-    ("pytest.ini", "ci_or_test_config"),
-    ("codna-security.yaml", "codna_policy_or_model"),
-    ("codna/evidence.py", "evidence_generation"),
-    (".git/hooks/pre-push", "executable_hook"),
-    (".pre-commit-config.yaml", "executable_hook"),
-    ("Makefile", "executable_hook"),
-])
-def test_forbidden_file_categories_rejected(path, reason):
-    res = reject_evasion(_diff(path))
-    assert res.ok is False
-    assert any(v.reason_code == reason for v in res.violations), res.violations
-
-
-@pytest.mark.parametrize("token", [
-    "nosemgrep", "# nosec", "NOSONAR", "checkov:skip=CKV_AWS_1",
-    "eslint-disable-next-line", "trivy:ignore:AVD-AWS-0089", "snyk:ignore",
-    "lgtm[py/sql-injection]",
-])
-def test_inline_suppressions_rejected(token):
-    res = reject_evasion(_diff("src/app.py", added=f"x = 1  # {token}"))
-    assert res.ok is False
-    assert any(v.reason_code == "inline_suppression" for v in res.violations)
-
-
-def test_lockfile_requires_dependency_diff_verification():
-    unverified = reject_evasion(_diff("package-lock.json", added='"lodash": "4.17.21"'))
-    assert unverified.ok is False
-    assert any(v.reason_code == "lockfile_unverified" for v in unverified.violations)
-
-    verified = reject_evasion(_diff("package-lock.json"), dependency_diff_verified=True)
-    assert verified.ok is True
-
-
-def test_change_scope_enforced():
-    res = reject_evasion(_diff("infra/deploy.tf"), allowed_paths=["src/"])
-    assert res.ok is False
-    assert any(v.reason_code == "change_scope_exceeded" for v in res.violations)
-    # in-scope edit passes under the same allow-list
-    assert reject_evasion(_diff("src/app.py"), allowed_paths=["src/"]).ok is True
-
-
-def test_explicit_policy_authorization_is_recorded_not_silent():
-    res = reject_evasion(
-        _diff(".semgrep.yml"),
-        policy_authorized=["scanner_config_or_rulepack"],
-        policy_digest="sha256:pol",
-    )
-    assert res.ok is True
-    assert res.authorization_used == ["scanner_config_or_rulepack@sha256:pol"]