secure-code-agent 0.7.0__tar.gz → 0.8.0__tar.gz

{secure_code_agent-0.7.0/src/secure_code_agent.egg-info → secure_code_agent-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.7.0
+Version: 0.8.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT

{secure_code_agent-0.7.0 → secure_code_agent-0.8.0/src/secure_code_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: secure-code-agent
-Version: 0.7.0
+Version: 0.8.0
 Summary: Deterministic security gate + bounded AI remediation prompt generator. NIST SSDF / OWASP ASVS / CWE Top 25 anchored.
 Author: Marshall Guillory
 License: MIT

{secure_code_agent-0.7.0 → secure_code_agent-0.8.0}/src/secure_code_audit/__init__.py

@@ -12,4 +12,4 @@
 #:
 #: PyPI is immutable, so 0.4.0 stays wrong. 0.5.0 is the first build whose
 #: artifacts name their own producer correctly.
-__version__ = "0.7.0"
+__version__ = "0.8.0"

{secure_code_agent-0.7.0 → secure_code_agent-0.8.0}/src/secure_code_audit/cli.py

@@ -897,7 +897,15 @@ def _under_root(root: Path, value: str) -> Path:
 def _print_summary(
     verdict, score, gate, ran, unavailable, coverage, paths, axes=(), trend=None
 ) -> None:
-    status = "PASS" if gate.passed else "FAIL"
+    # "PASS" is a claim that something was checked. With no gate configured
+    # nothing was, and saying so is the difference between a report and a
+    # false assurance.
+    if not gate.passed:
+        status = "FAIL"
+    elif gate.enforced:
+        status = "PASS"
+    else:
+        status = "NOT CONFIGURED"
     print(f"secure-code-agent  ·  score {verdict.headline()}  ·  gate {status}")
     for reason in verdict.reasons:
         print(f"  ! grade withheld: {reason}")
@@ -921,6 +929,15 @@ def _print_summary(
     if not gate.passed:
         for reason in gate.reasons:
             print(f"  ✗ {reason}")
+    elif not gate.enforced:
+        print(
+            "  ! no gate is configured, so nothing here could have failed. "
+            "This audit is a report, not a check."
+        )
+        print(
+            "    Set gates.fail_on_severity in secure-code-agent.json to make "
+            "findings block a build; read the work order either way."
+        )
     written = [
         str(p)
         for p in (

{secure_code_agent-0.7.0 → secure_code_agent-0.8.0}/src/secure_code_audit/renderers.py

@@ -51,6 +51,12 @@ def to_json(
         },
         "gate": {
             "passed": gate.passed,
+            # Which gates could actually have failed. Empty means no policy
+            # was configured, and `passed: true` then says only that nothing
+            # tripped — not that anything was checked. A consumer treating
+            # `passed` as a security signal needs to see this.
+            "configured": list(gate.configured),
+            "enforced": gate.enforced,
             "reasons": list(gate.reasons),
             "tripped": list(gate.tripped),
         },

{secure_code_agent-0.7.0 → secure_code_agent-0.8.0}/src/secure_code_audit/scoring.py

@@ -551,6 +551,26 @@ class GateResult:
     passed: bool
     reasons: tuple[str, ...]  # human-readable trip reasons
     tripped: tuple[str, ...] = field(default_factory=tuple)
+    #: Gates that could actually have failed this run. Empty means no
+    #: policy was configured, which is **not** the same as passing one.
+    #:
+    #: `passed` stays True in that case — no gate tripped, which is
+    #: accurate — but reporting it as PASS is a claim nothing checked. A
+    #: 200,000-line repository carrying SQL injection, `shell=True`,
+    #: `pickle.loads` and `eval` printed "gate PASS" out of the box, with
+    #: no configuration, because an absent gate cannot trip. The work
+    #: order listed all seven findings correctly at the same time.
+    #:
+    #: `_require_configured_gates` already refuses `--fail-on-gate` in this
+    #: situation, calling it "a green build with no security floor". This
+    #: is the same fact, carried far enough to reach the summary line a
+    #: person actually reads.
+    configured: tuple[str, ...] = field(default_factory=tuple)
+
+    @property
+    def enforced(self) -> bool:
+        """Did any gate actually stand between these findings and a pass?"""
+        return bool(self.configured)
 
 
 # Every gate, with the predicate that decides whether it can actually trip.
@@ -611,6 +631,7 @@ def evaluate_gates(
         passed=not tripped,
         reasons=tuple(reasons),
         tripped=tuple(tripped),
+        configured=active_gates(gate_config),
     )