Kjell Tore Guttormsen
e7833b65fc
First detector of the 'is the config OPTIMAL?' axis (vs the existing 'correct?' scanners). New orchestrated scanner family CA-OPT (count 14->15), the deterministic half of the hybrid optimization lens. CA-OPT-001 (low, Missed opportunity): a multi-step procedure in CLAUDE.md (>=6 consecutive numbered steps) that belongs in a skill. Reads recommendation + provenance from the best-practices register (BP-MECH-003). Conservative by design; the negative corpus proves null false-positives. Prose-judgment cases (lifecycle->hook, 'never'->permission) are deferred to the Chunk 2b opus analyzer. Wiring mirrors OST: orchestrator entry, humanizer (OPT->'Missed opportunity' + family), scoring (OPT->'CLAUDE.md', existing area -> no new posture row -> byte-stable), strip-helper (OST,OPT), SC-5 regenerated under hermetic HOME (additive OPT entry only). 10 new tests; suite 1045->1055, self-audit A/A, readmeCheck passed (all verified with a clean HOME). Note: the pre-existing TOK test reads the real ~/.claude (non-hermetic) -> run the suite with a clean HOME for deterministic results. Tracked as a separate follow-up. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
62 lines
2.3 KiB
JavaScript
62 lines
2.3 KiB
JavaScript
/**
|
|
* v5.6 C added the OST (Output-Style Validation) scanner — a 14th orchestrated
|
|
* scanner. The frozen v5.0.0 byte-equal baselines predate it (13 scanners), so
|
|
* this strips the additive OST scanner entry before comparison, the same way
|
|
* strip-hotspot-load-pattern.mjs handles B2's additive hotspot fields. Stripping
|
|
* (rather than re-seeding the frozen snapshots) keeps the strongest invariant:
|
|
* the ORIGINAL 13 scanners still emit byte-identical output, and the frozen
|
|
* snapshots stay free of post-v5.0.0 drift (the hotspot triple, ancestor token
|
|
* counts) that re-seeding would bake in.
|
|
*
|
|
* Removing a zero-finding scanner entry only moves `aggregate.scanners_ok`
|
|
* (OST is always status 'ok' and emits nothing on the deterministic fixture, so
|
|
* total_findings / counts / risk_score / verdict are unchanged). The strip
|
|
* decrements scanners_ok to match.
|
|
*
|
|
* Mutates in place and returns the payload for chaining inside a normalizer:
|
|
* return stripAddedScanners(stripHotspotLoadPattern(out));
|
|
*/
|
|
|
|
const ADDED_SCANNERS = new Set(['OST', 'OPT']);
|
|
|
|
function stripFromEnvelope(env) {
|
|
if (!env || typeof env !== 'object' || !Array.isArray(env.scanners)) return;
|
|
let removedOk = 0;
|
|
const kept = [];
|
|
for (const s of env.scanners) {
|
|
if (ADDED_SCANNERS.has(s.scanner)) {
|
|
if (s.status === 'ok') removedOk++;
|
|
continue;
|
|
}
|
|
kept.push(s);
|
|
}
|
|
env.scanners = kept;
|
|
if (env.aggregate && typeof env.aggregate.scanners_ok === 'number') {
|
|
env.aggregate.scanners_ok -= removedOk;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Strip added (post-v5.0.0) scanner entries from a CLI payload / envelope —
|
|
* both top-level (`scanners`) and nested (`scannerEnvelope.scanners`).
|
|
* @template T
|
|
* @param {T} payload
|
|
* @returns {T}
|
|
*/
|
|
export function stripAddedScanners(payload) {
|
|
if (!payload || typeof payload !== 'object') return payload;
|
|
stripFromEnvelope(payload);
|
|
if (payload.scannerEnvelope) stripFromEnvelope(payload.scannerEnvelope);
|
|
return payload;
|
|
}
|
|
|
|
/**
|
|
* Remove `[OST] …` per-scanner progress lines from a captured stderr scorecard,
|
|
* so a 14-scanner live run matches the frozen 13-scanner stderr snapshot.
|
|
* @param {string} text
|
|
* @returns {string}
|
|
*/
|
|
export function stripAddedScannerStderr(text) {
|
|
if (typeof text !== 'string') return text;
|
|
return text.replace(/^[ \t]*\[(OST|OPT)\][^\n]*\n/gm, '');
|
|
}
|