secure-code-agent 0.12.6__tar.gz → 0.12.7__tar.gz

{secure_code_agent-0.12.6/src/secure_code_agent.egg-info → secure_code_agent-0.12.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.6
+Version: 0.12.7
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -513,7 +513,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.6
+- uses: marshallguillory86/secure-code-agent@v0.12.7
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.6 → secure_code_agent-0.12.7}/README.md

@@ -465,7 +465,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.6
+- uses: marshallguillory86/secure-code-agent@v0.12.7
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.6 → secure_code_agent-0.12.7/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.6
+Version: 0.12.7
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -513,7 +513,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.6
+- uses: marshallguillory86/secure-code-agent@v0.12.7
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.6 → secure_code_agent-0.12.7}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.6"
+__version__ = "0.12.7"

{secure_code_agent-0.12.6 → secure_code_agent-0.12.7}/src/secure_code_audit/cli.py

@@ -561,7 +561,18 @@ def _do_audit(args: argparse.Namespace) -> int:
         summarize_axis("test tree", test_findings, test_loc),
         summarize_axis("documentation", docs_findings, docs_loc or None),
         summarize_axis("dependencies", dependency_findings),
-        *(summarize_axis(name, found) for name, found in declared_axes.items()),
+        # The note is the reason the project wrote, carried verbatim. A
+        # declared axis whose page shows counts and no statement of why is a
+        # grade moved in silence — the one thing this mechanism exists not to
+        # be (D25).
+        *(
+            summarize_axis(
+                name,
+                found,
+                note=cfg.capabilities[name.removeprefix(AXIS_PREFIX)],
+            )
+            for name, found in declared_axes.items()
+        ),
     )
     # Naming an import on the command line asserts that it contributes coverage,
     # so a broken one fails the gate even if no config requires that scanner.

{secure_code_agent-0.12.6 → secure_code_agent-0.12.7}/src/secure_code_audit/renderers.py

@@ -167,7 +167,7 @@ def _axes_to_dict(axes: Iterable[AxisReport]) -> dict:
             "count": axis.count,
             "scored": False,
             "gated": axis.name == "dependencies",
-            "note": _AXIS_NOTES.get(axis.name, ""),
+            "note": _axis_note(axis),
             "per_severity_count": {s.value: n for s, n in axis.per_severity_count.items()},
             "per_category_count": {c.value: n for c, n in axis.per_category_count.items()},
             # Not repeated here: every one of these appears in the top-level
@@ -206,6 +206,17 @@ _AXIS_NOTES = {
 }
 
 
+def _axis_note(axis: AxisReport) -> str:
+    """Why this axis sits outside the score, in the report's own words.
+
+    An axis that carries its own note wins. Only a declared axis does, and
+    its note is the reason the audited project wrote in its configuration —
+    the tool cannot supply that sentence, and a declared axis printed without
+    it is a grade moved with no statement of why.
+    """
+    return axis.note or _AXIS_NOTES.get(axis.name, "")
+
+
 def write_json(
     findings: Iterable[Finding],
     score: ScoreReport,
@@ -361,7 +372,7 @@ def _axis_section(report: AxisReport | None) -> str:
             )
         )
         out.append(f"- **By severity:** {by_severity}")
-    note = _AXIS_NOTES.get(report.name)
+    note = _axis_note(report)
     if note:
         out.append(f"- {note}")
     out.append("")

{secure_code_agent-0.12.6 → secure_code_agent-0.12.7}/src/secure_code_audit/scoring.py

@@ -554,6 +554,17 @@ class AxisReport:
     #: advisories are counted against a lockfile, not a line count, so this is
     #: None for them rather than a misleading zero.
     loc: int | None = None
+    #: Why this axis sits outside the score, in the report's own words. Empty
+    #: for the fixed axes, whose notes the renderer holds because they are the
+    #: same sentence for every project.
+    #:
+    #: A declared axis is the case this field exists for. Its justification is
+    #: not a constant the tool can write: it is the reason *this* project
+    #: stated in its configuration. 0.12.6 shipped the declaration reaching the
+    #: routing and never reaching the page, so a reader saw
+    #: `## Declared: spawns_processes` with counts under it and no statement of
+    #: why — which is the disclosure the whole mechanism rests on (D25).
+    note: str = ""
 
     @property
     def count(self) -> int:
@@ -580,7 +591,12 @@ class AxisReport:
         )
 
 
-def summarize_axis(name: str, findings: Iterable[Finding], loc: int | None = None) -> AxisReport:
+def summarize_axis(
+    name: str,
+    findings: Iterable[Finding],
+    loc: int | None = None,
+    note: str = "",
+) -> AxisReport:
     """Count an axis without scoring it.
 
     Not named `test_*` anything: pytest collects any callable whose name begins
@@ -601,6 +617,7 @@ def summarize_axis(name: str, findings: Iterable[Finding], loc: int | None = Non
     return AxisReport(
         name=name,
         loc=loc,
+        note=note,
         findings=findings,
         per_severity_count=per_severity,
         per_category_count=per_category,