secure-code-agent 0.12.8__tar.gz → 0.12.9__tar.gz

{secure_code_agent-0.12.8/src/secure_code_agent.egg-info → secure_code_agent-0.12.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.8
+Version: 0.12.9
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -515,7 +515,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.8
+- uses: marshallguillory86/secure-code-agent@v0.12.9
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.8 → secure_code_agent-0.12.9}/README.md

@@ -467,7 +467,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.8
+- uses: marshallguillory86/secure-code-agent@v0.12.9
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.8 → secure_code_agent-0.12.9/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.12.8
+Version: 0.12.9
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT
@@ -515,7 +515,7 @@ For agents that support invokable skills, this repo ships a portable skill under
 ## GitHub Action
 
 ```yaml
-- uses: marshallguillory86/secure-code-agent@v0.12.8
+- uses: marshallguillory86/secure-code-agent@v0.12.9
   with:
     config: secure-code-agent.json
     fail-on-gate: true

{secure_code_agent-0.12.8 → secure_code_agent-0.12.9}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.12.8"
+__version__ = "0.12.9"

{secure_code_agent-0.12.8 → secure_code_agent-0.12.9}/src/secure_code_audit/triage.py

@@ -30,6 +30,7 @@ import re
 from collections.abc import Iterable
 from pathlib import Path
 
+from secure_code_audit.capabilities import AXIS_PREFIX
 from secure_code_audit.findings import Category, Confidence, Finding, Severity
 
 
@@ -75,6 +76,24 @@ LOW_PRECISION: dict[str, str] = {
 _ACCEPT_AXES = frozenset({"test tree", "documentation"})
 
 
+def _is_accepted_axis(axis: str) -> bool:
+    """Is this an axis whose findings are not patch targets?
+
+    The named pair, plus every declared capability. A declaration says the
+    finding is the project's architecture being exercised (D24) — the
+    scorer already routes it off the code condition and the report already
+    lists it as reported-not-scored. Nominating the same finding in §FIX
+    asks an agent to change the thing the operator declared.
+
+    That is what shipped. `capabilities` reached the scorer and the
+    renderer and never reached here, so one run said "no findings" in the
+    pillar and "68 to fix" in the work order — the same 68, all of them
+    `subprocess` calls in a tool whose purpose is running subprocesses
+    (D28).
+    """
+    return axis in _ACCEPT_AXES or axis.startswith(AXIS_PREFIX)
+
+
 #: Bandit quotes the offending value: `Possible hardcoded password: 'x'`.
 _QUOTED_VALUE = re.compile(r"password: '(.*)'\s*$")
 
@@ -233,7 +252,7 @@ def tier_of(finding: Finding, axis: str = "primary", root: Path | None = None) -
     genuine hardcoded key in a test fixture is still deliberate, and a
     high-confidence rule firing there does not make it a patch target.
     """
-    if axis in _ACCEPT_AXES:
+    if _is_accepted_axis(axis):
         return Tier.ACCEPT
     if finding.rule_id in LOW_PRECISION:
         # Unless the value itself gives it away.