feat: v0.36.0 — x-FuSa spec v1.13.0/v1.14.0 schema conformance + content-quality baseline - #55
Merged
Conversation
…ent-quality baseline Brings hara/fmea/tara/safety-case/sas/sci into conformance with the x-FuSa spec's formalized §9.2/§9.3 schemas, and implements the new §1.6/§1.6.1/§1.6.2 content-quality baseline (issue #54): - hara: safetyGoals[].fssrRefs is now a required []string (was a singular optional fssrRef string); new engine rules HARA006/HARA007 catch a missing or dangling fssrRefs entry; `hara show --format json` emits the spec's hara-report envelope+completeness shape; `hara init` scaffolds empty collections instead of a dummy example hazard. - fmea: adds singular failureMode/effect/cause fields (spec-canonical) alongside the existing arrays, plus item/actionPriority/mitigations and a summary block with componentsAnalyzed/componentsInProject/ coveragePct (+ --min-coverage N). - tara: threats[] replaces entries[] as the canonical key; impact is now an SFOP object (safety/financial/operational/privacy) instead of one generic string; adds attackFeasibility/risk/treatment/location and the same summary/coveragePct shape (+ --min-coverage N). - safety-case: adds a real GSN argument graph (nodes/edges/completeness, all six GSN node types) derived from the existing evidence collection. - sas: adds checklist[]/summary; sas.md is now always written alongside sas.json regardless of which format was requested. - sci: adds artifacts[] (file/hash/version, hash sha256:-prefixed). New stubcheck package implements FUSA-STUB001 (placeholder-text deny-list, always ERROR, disposition-suppressible only) and FUSA-STUB002 (distinct-value-ratio <0.1 across >=10 entries, WARNING, advisory) as engine rules wired into `check`, plus the §1.6.2 attestation mechanism (fusa.Attestation, RFC 8785 canonical content hash) that suppresses a non-stale, independently-reviewed FUSA-STUB002. All five artifact commands gain --strict/ --require-attestation. Regenerates fmea.json/tara.json/safety-case.{json,md,mermaid} and migrates .fusa-hara.json's fssrRef strings to fssrRefs arrays. Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // Summary.AssetInventoryMethod for the file-level-granularity caveat. | ||
| // | ||
| //fusa:req REQ-TARA008 | ||
| func CountProjectFiles(root string) (int, error) { |
| } | ||
|
|
||
| func fileExists(path string) bool { | ||
| _, err := os.Stat(path) |
| func loadArtifacts(projectRoot string) []artifactScan { | ||
| var out []artifactScan | ||
|
|
||
| if _, err := os.Stat(filepath.Join(projectRoot, hara.HARAFile)); err == nil { |
| content interface{} | ||
| } | ||
|
|
||
| func loadArtifacts(projectRoot string) []artifactScan { |
| // checking against it — every fssrRef then counts as dangling, fail-safe). | ||
| // | ||
| //fusa:req REQ-HARA017 | ||
| func BuildCompleteness(h *HARA, reqIDs map[string]bool) Completeness { |
| // independently of substantive edits (§1.6.2). | ||
| // | ||
| //fusa:req REQ-ATT003 | ||
| func AttestationContentHash(content interface{}) (string, error) { |
| // unsuppressed (fail-safe). | ||
| // | ||
| //fusa:req REQ-STUB012 | ||
| func AttestationSuppresses(att *fusa.Attestation, content interface{}) bool { |
| // placeholderBracket matches bracket-wrapped instructional text such as | ||
| // "[describe asset]" — a letter immediately after '[' distinguishes this | ||
| // from e.g. Markdown link syntax or a literal array-like value. | ||
| var placeholderBracket = regexp.MustCompile(`\[[A-Za-z][^\]]*\]`) |
| var placeholderBracket = regexp.MustCompile(`\[[A-Za-z][^\]]*\]`) | ||
|
|
||
| // placeholderSubstrings is the case-insensitive deny-list (§1.6.1 rule A). | ||
| var placeholderSubstrings = []string{ |
| // line ("func Name(" or "func (recv Type) Name(", uppercase first letter). | ||
| // It is intentionally a raw text scan, not an AST parse — see | ||
| // CountProjectFunctions doc. | ||
| var exportedFuncRE = regexp.MustCompile(`^func\s+(\([^)]*\)\s+)?[A-Z]\w*\s*\(`) |
This was referenced Jul 28, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #54. Brings
hara/fmea/tara/safety-case/sas/sciinto conformance with x-FuSa spec §9.2/§9.3's formalized schemas, and implements the new §1.6/§1.6.1/§1.6.2 content-quality baseline (detection heuristics + attestation).Schema conformance
hara:.fusa-hara.jsonsafetyGoals[].fssrRefsis now a[]string(MUST, ≥1 entry), replacing the prior singularfssrRefstring. New engine rulesHARA006(missingfssrRefs) andHARA007(danglingfssrRefsid).hara show --format jsonnow emits the §9.2hara-reportenvelope +completenessblock instead of the bare input file.hara initnow scaffolds empty collections — never a dummy hazard (this is literally the bug the spec's audit found; go-FuSa'sinithad it too).fmea: adds spec-canonical singularfailureMode/effect/causefields alongside the existing arrays (kept for back-compat/CSV), plusitem/actionPriority/mitigations, and asummaryblock (componentsAnalyzed/componentsInProject/coveragePct+--min-coverage N).tara:threats[]replacesentries[]as the canonical key;impactis now an SFOP object (safety/financial/operational/privacy, ISO 21434 Clause 15.7) instead of one generic string; addsattackFeasibility/risk/treatment/location+ the samesummary/coveragePctshape.safety-case: adds a real GSN (Goal Structuring Notation v3) argument graph —nodes[]/edges[]/completeness, all six GSN node types (goal/strategy/solution/context/assumption/justification) — derived from the same evidence collectionBuildalready assembled.sas: addschecklist[]/summary;sas.mdis now always written alongsidesas.jsonregardless of which format was requested (spec: "not a replacement for it").sci: addsartifacts[](file/hash/version),hashcorrectlysha256:-prefixed.schemaVersion/kind/tool/toolVersion/language/generatedAt).hash-named field for the §2.7 prefix bug FuSaOps found in its own code — go-FuSa had none pre-existing; the newsci.Artifacts[].Hashfield issha256:-prefixed from the start.Content-quality baseline (new
stubcheckpackage)FUSA-STUB001(rule A): placeholder/template text deny-list (bracket-wrapped instructional text,"replace with","TBD", etc.) — alwaysERROR, disposition-suppressible only, never by attestation.FUSA-STUB002(rule B): a qualitative field's distinct-value ratio<0.1across≥10entries —WARNINGby default, advisory, suppressed by a valid attestation.checkengine rules across every present evidence artifact (fmea.json/.fusa-hara.json/tara.json/safety-case.json/sas.json).fusa.Attestation:status/implementationAuthor/independentReviewer/reviewedAt/contentHash),fusa.AttestationValid(independence + non-staleness, fail-safe),fusa.CanonicalizeJSON(RFC 8785). All five artifact commands gain--strict/--require-attestation.Coverage metrics
fmea/tarasummary.coveragePct+--min-coverage N, each with an honestly-documented denominator methodology (CountProjectFunctions/CountProjectFiles, independent of the artifact's own generation pass) rather than a denominator that trivially always equals the numerator.Housekeeping
.fusa-hara.json'sfssrRefstrings tofssrRefsarrays.fmea.json/tara.json/safety-case.{json,md,mermaid}with the new schemas.//fusa:reqtags in.fusa-reqs.json.Version→0.36.0,SpecVersion→1.14.0.Test plan
go build ./...go vet ./...cleangofmt -l .cleangolangci-lint run ./...— 0 issuesgo test -race -count=1 ./...— all pass, 88.6% overall coverage (≥80% gate)gofusa check --format jsonon go-FuSa's own repo — exit 0, 0 errors (self-check stays green; newFUSA-STUB002findings onfmea.json/tara.jsonareWARNING-only and don't gate without--strict)gofusa trace— exit 0, no dangling references for any new requirement