mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-13 11:40:53 +08:00
BaaRai
f938ba00d9
Add a machine-checked verification state to findings, separate from the human disposition (status). A finding is verified only when a proof or verification traffic body is bound, the agent declares POE L3 or higher, and every evidence quote appears verbatim, after whitespace normalization, in one of those response bodies. - schema: poe_level, verification_status, verification_note on findings (idempotent ADD COLUMN IF NOT EXISTS, no CHECK, no backfill). - db: SetFindingVerification validates status and POE 0-4; the three fields are scanned with the finding rows and exposed in the DTO. - update_finding_report: optional poe_level and evidence_quotes. The report is always saved; verification only decides the status. Read failures give not_assessed, never unverified. - report agent guidance: declare POE and exact quotes from the bound body. Not in this change: UI badges and filters, the blocked and false_positive transitions, and the stored default report prompt for existing databases (the guidance is appended at run time).
51 lines
1.5 KiB
Go
51 lines
1.5 KiB
Go
package db
|
|
|
|
import (
|
|
"fmt"
|
|
)
|
|
|
|
// Machine-checked verification state of a finding (S1). Kept apart from
|
|
// findings.status, which is the human disposition. Values are validated here
|
|
// (server-side), not by a CHECK constraint, like the other findings columns.
|
|
const (
|
|
VerificationVerified = "verified"
|
|
VerificationUnverified = "unverified"
|
|
VerificationBlocked = "blocked"
|
|
VerificationNotAssessed = "not_assessed"
|
|
VerificationFalsePositive = "false_positive"
|
|
)
|
|
|
|
// ValidVerificationStatus reports whether s is a known verification state.
|
|
func ValidVerificationStatus(s string) bool {
|
|
switch s {
|
|
case VerificationVerified, VerificationUnverified, VerificationBlocked,
|
|
VerificationNotAssessed, VerificationFalsePositive:
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
// SetFindingVerification records the verification state, POE level and note on
|
|
// the standalone findings row. It does not touch status, report or evidence.
|
|
func (d *DB) SetFindingVerification(findingID int64, status string, poe int, note string) error {
|
|
if !ValidVerificationStatus(status) {
|
|
return fmt.Errorf("invalid verification status %q", status)
|
|
}
|
|
if poe < 0 || poe > 4 {
|
|
return fmt.Errorf("invalid POE level %d (want 0-4)", poe)
|
|
}
|
|
res, err := d.Exec(`UPDATE findings SET verification_status=$2, poe_level=$3, verification_note=$4 WHERE id=$1`,
|
|
findingID, status, poe, note)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
n, err := res.RowsAffected()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if n == 0 {
|
|
return ErrFindingNotFound
|
|
}
|
|
return nil
|
|
}
|