Skip to content

feat(sarif): carry each finding's declared context, additively; rewrite SPEC §6 #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Animesh-Sri-bugb merged 4 commits into from
Oct 1, 2026
Merged

feat(sarif): carry each finding's declared context, additively; rewrite SPEC §6 #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3b3a1b1
feat(sarif): carry each finding's declared context, additively
Animesh-Sri-bugb Oct 1, 2026
fea5ee9
docs(spec): rewrite SARIF section 6 to match the export
Animesh-Sri-bugb Oct 1, 2026
048131a
chore(artifacts): regenerate agent instructions and threat-model arti…
Animesh-Sri-bugb Oct 1, 2026
d920ebc
docs(contributing): state the SARIF export's compatibility rule and w…
Animesh-Sri-bugb Oct 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions .clinerules
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,
- #agent-launcher exposed to #config-tamper [medium] (src/agents/prompts.ts:10)
- #llm-client exposed to #data-exposure [low] (src/analyze/index.ts:12)
- #llm-client exposed to #prompt-injection [medium] (src/analyze/llm.ts:17)
- #sarif exposed to #data-exposure [low] (src/analyzer/sarif.ts:34)
- #sarif exposed to #data-exposure [low] (src/analyzer/sarif.ts:42)
- #codegraph exposed to #config-tamper [medium] (src/codegraph/index.ts:45)
- #codegraph exposed to #prompt-injection [medium] (src/codegraph/index.ts:49)
- #init exposed to #data-exposure [low] (src/init/index.ts:12)
Expand Down Expand Up @@ -111,7 +111,7 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,
- LLMConfig -> #llm-client via chatCompletion
- #llm-client -> LLMProvider via fetch
- LLMProvider -> #llm-client via response
- … and 171 more — `guardlink_lookup("flows into X")` for one asset, or `guardlink_graph(from: X)` for a neighbourhood
- … and 173 more — `guardlink_lookup("flows into X")` for one asset, or `guardlink_graph(from: X)` for a neighbourhood

### Features (filter with `--feature`)

Expand All @@ -120,11 +120,11 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,

### Model Stats

849 annotations, 20 assets, 16 threats, 14 controls, 125 exposures, 0 confirmed, 127 mitigations, 3 actors, 1 entitlements, 191 flows, 2 features
858 annotations, 20 assets, 16 threats, 14 controls, 127 exposures, 0 confirmed, 129 mitigations, 3 actors, 1 entitlements, 193 flows, 2 features

### Block Freshness

- `annotation_hash`: `sha256-v3:43ad313ae90e5e1a0f300c86060f958ea649cfd57cb5606357f52641404d583f`
- `annotation_hash`: `sha256-v3:a9ec60de2a3a302843cdd616ba5681d1bfdd04fa1ca9364d60c049443e0954d6`

Every MCP response carries this same hash. If it differs from the one above, this
block predates the current annotations — trust the tool, and run `guardlink sync`.
Expand Down
8 changes: 4 additions & 4 deletions .cursor/rules/guardlink.mdc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,
- #agent-launcher exposed to #config-tamper [medium] (src/agents/prompts.ts:10)
- #llm-client exposed to #data-exposure [low] (src/analyze/index.ts:12)
- #llm-client exposed to #prompt-injection [medium] (src/analyze/llm.ts:17)
- #sarif exposed to #data-exposure [low] (src/analyzer/sarif.ts:34)
- #sarif exposed to #data-exposure [low] (src/analyzer/sarif.ts:42)
- #codegraph exposed to #config-tamper [medium] (src/codegraph/index.ts:45)
- #codegraph exposed to #prompt-injection [medium] (src/codegraph/index.ts:49)
- #init exposed to #data-exposure [low] (src/init/index.ts:12)
Expand Down Expand Up @@ -116,7 +116,7 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,
- LLMConfig -> #llm-client via chatCompletion
- #llm-client -> LLMProvider via fetch
- LLMProvider -> #llm-client via response
- … and 171 more — `guardlink_lookup("flows into X")` for one asset, or `guardlink_graph(from: X)` for a neighbourhood
- … and 173 more — `guardlink_lookup("flows into X")` for one asset, or `guardlink_graph(from: X)` for a neighbourhood

### Features (filter with `--feature`)

Expand All @@ -125,11 +125,11 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,

### Model Stats

849 annotations, 20 assets, 16 threats, 14 controls, 125 exposures, 0 confirmed, 127 mitigations, 3 actors, 1 entitlements, 191 flows, 2 features
858 annotations, 20 assets, 16 threats, 14 controls, 127 exposures, 0 confirmed, 129 mitigations, 3 actors, 1 entitlements, 193 flows, 2 features

### Block Freshness

- `annotation_hash`: `sha256-v3:43ad313ae90e5e1a0f300c86060f958ea649cfd57cb5606357f52641404d583f`
- `annotation_hash`: `sha256-v3:a9ec60de2a3a302843cdd616ba5681d1bfdd04fa1ca9364d60c049443e0954d6`

Every MCP response carries this same hash. If it differs from the one above, this
block predates the current annotations — trust the tool, and run `guardlink sync`.
Expand Down
8 changes: 4 additions & 4 deletions .gemini/GEMINI.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,
- #agent-launcher exposed to #config-tamper [medium] (src/agents/prompts.ts:10)
- #llm-client exposed to #data-exposure [low] (src/analyze/index.ts:12)
- #llm-client exposed to #prompt-injection [medium] (src/analyze/llm.ts:17)
- #sarif exposed to #data-exposure [low] (src/analyzer/sarif.ts:34)
- #sarif exposed to #data-exposure [low] (src/analyzer/sarif.ts:42)
- #codegraph exposed to #config-tamper [medium] (src/codegraph/index.ts:45)
- #codegraph exposed to #prompt-injection [medium] (src/codegraph/index.ts:49)
- #init exposed to #data-exposure [low] (src/init/index.ts:12)
Expand Down Expand Up @@ -165,7 +165,7 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,
- LLMConfig -> #llm-client via chatCompletion
- #llm-client -> LLMProvider via fetch
- LLMProvider -> #llm-client via response
- … and 171 more — `guardlink_lookup("flows into X")` for one asset, or `guardlink_graph(from: X)` for a neighbourhood
- … and 173 more — `guardlink_lookup("flows into X")` for one asset, or `guardlink_graph(from: X)` for a neighbourhood

### Features (filter with `--feature`)

Expand All @@ -174,11 +174,11 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,

### Model Stats

849 annotations, 20 assets, 16 threats, 14 controls, 125 exposures, 0 confirmed, 127 mitigations, 3 actors, 1 entitlements, 191 flows, 2 features
858 annotations, 20 assets, 16 threats, 14 controls, 127 exposures, 0 confirmed, 129 mitigations, 3 actors, 1 entitlements, 193 flows, 2 features

### Block Freshness

- `annotation_hash`: `sha256-v3:43ad313ae90e5e1a0f300c86060f958ea649cfd57cb5606357f52641404d583f`
- `annotation_hash`: `sha256-v3:a9ec60de2a3a302843cdd616ba5681d1bfdd04fa1ca9364d60c049443e0954d6`

Every MCP response carries this same hash. If it differs from the one above, this
block predates the current annotations — trust the tool, and run `guardlink sync`.
Expand Down
8 changes: 4 additions & 4 deletions .github/copilot-instructions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,7 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,
- #agent-launcher exposed to #config-tamper [medium] (src/agents/prompts.ts:10)
- #llm-client exposed to #data-exposure [low] (src/analyze/index.ts:12)
- #llm-client exposed to #prompt-injection [medium] (src/analyze/llm.ts:17)
- #sarif exposed to #data-exposure [low] (src/analyzer/sarif.ts:34)
- #sarif exposed to #data-exposure [low] (src/analyzer/sarif.ts:42)
- #codegraph exposed to #config-tamper [medium] (src/codegraph/index.ts:45)
- #codegraph exposed to #prompt-injection [medium] (src/codegraph/index.ts:49)
- #init exposed to #data-exposure [low] (src/init/index.ts:12)
Expand Down Expand Up @@ -165,7 +165,7 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,
- LLMConfig -> #llm-client via chatCompletion
- #llm-client -> LLMProvider via fetch
- LLMProvider -> #llm-client via response
- … and 171 more — `guardlink_lookup("flows into X")` for one asset, or `guardlink_graph(from: X)` for a neighbourhood
- … and 173 more — `guardlink_lookup("flows into X")` for one asset, or `guardlink_graph(from: X)` for a neighbourhood

### Features (filter with `--feature`)

Expand All @@ -174,11 +174,11 @@ _Full records with descriptions and locations: `guardlink_lookup("asset <id>")`,

### Model Stats

849 annotations, 20 assets, 16 threats, 14 controls, 125 exposures, 0 confirmed, 127 mitigations, 3 actors, 1 entitlements, 191 flows, 2 features
858 annotations, 20 assets, 16 threats, 14 controls, 127 exposures, 0 confirmed, 129 mitigations, 3 actors, 1 entitlements, 193 flows, 2 features

### Block Freshness

- `annotation_hash`: `sha256-v3:43ad313ae90e5e1a0f300c86060f958ea649cfd57cb5606357f52641404d583f`
- `annotation_hash`: `sha256-v3:a9ec60de2a3a302843cdd616ba5681d1bfdd04fa1ca9364d60c049443e0954d6`

Every MCP response carries this same hash. If it differs from the one above, this
block predates the current annotations — trust the tool, and run `guardlink sync`.
Expand Down
4 changes: 2 additions & 2 deletions .guardlink/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,8 @@ accepted.

This file is generated. Run `guardlink sync` to refresh it; do not edit it by hand.

Current model: 849 annotations · 20 assets · 16 threats · 14 controls · 125 exposures · 191 flows
Content hash: `sha256-v3:43ad313ae90e5e1a0f300c86060f958ea649cfd57cb5606357f52641404d583f` — identical hash means identical model.
Current model: 858 annotations · 20 assets · 16 threats · 14 controls · 127 exposures · 193 flows
Content hash: `sha256-v3:a9ec60de2a3a302843cdd616ba5681d1bfdd04fa1ca9364d60c049443e0954d6` — identical hash means identical model.

---

Expand Down
Loading
Loading