adam/orchestrator
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
This repository has been archived on 2026-08-04. You can view files and clone it, but cannot push or open issues or pull requests.
orchestrator/security-review/checkers/fixtures/plan-groomer
History
Adam Moussa 19a57408d2 feat(secrev): plan-groomer Plane-1 Phase 4 planner (report-only) 
Aggregates the OTHER Plane-1 checkers' latest reports (compliance-drift,
dependency-cve, doc-drift, confluence-doc) into one prioritized, deduped
"groomed weekly plan" written into the mode-600 report. REPORT-ONLY per
decision D3: posts NOTHING to Slack; auto-write to Notion/Jira is a later
toggle (inert --notify seam). Reuses lib/sweep_substrate.sh redact().

Offline --canary asserts the groomed-plan item count (5) against a fixture
report set, exercising latest-date selection, dedup, multi-source aggregation,
and no-data discipline (a missing source is noted, never invented as work).
shellcheck-clean (only the shared SC1091 substrate-source info, at parity with
compliance-drift/dependency-cve). PROVISIONING (auto-write toggle, systemd
wiring, coordinator registry) deferred — gated.
2026-06-18 15:51:45 -04:00
..
sample-reports feat(secrev): plan-groomer Plane-1 Phase 4 planner (report-only) 2026-06-18 15:51:45 -04:00
EXPECTED_PLAN_ITEMS feat(secrev): plan-groomer Plane-1 Phase 4 planner (report-only) 2026-06-18 15:51:45 -04:00
README.md feat(secrev): plan-groomer Plane-1 Phase 4 planner (report-only) 2026-06-18 15:51:45 -04:00

README.md

plan-groomer canary fixtures

Sample sibling-checker reports for checkers/plan-groomer.sh --canary (offline, no network/ token). The planner asserts the groomed-plan item count equals EXPECTED_PLAN_ITEMS (anti-complacency floor, design §6.4). If aggregation or dedup regresses, the count drifts and the canary FAILS (exit 3).

How the canary works

--canary points $REPORT_ROOT_BASE at sample-reports/ and writes the groomed plan into a mode-700 temp dir (so the canary writes nothing under $HOME). It reads each source checker's latest <date>/<checker>.json, normalizes every .findings[] into a plan item {repo, severity, source, title, action}, dedupes on repo|source|title, prioritizes by severity, and writes the plan into the mode-600 report.

These are plain report JSON files (no dotgit/ trick needed — plan-groomer reads sibling reports, it does not scan git checkouts).

Fixture report set

Source checker Date dir Findings Contributes to plan
compliance-drift 2026-06-10 (OLD) 1 0 — sentinel: older date MUST be skipped (latest-date selection)
compliance-drift 2026-06-17 (latest) 3 2 — two of the three are an exact duplicate (payments-dashboard / README) that must dedup to one
dependency-cve 2026-06-17 2 2 — jinja2 (high) + lodash (critical)
doc-drift 2026-06-17 1 1 — stale README arch section
confluence-doc (none) — 0 — no report present; noted in missing_sources, NEVER invented as work

Total groomed plan items = 5 (EXPECTED_PLAN_ITEMS).

This exercises four invariants in one run:

  1. latest-date selection — the 2026-06-10 sentinel must not leak into the plan.
  2. dedup — the duplicate README finding collapses to one item.
  3. multi-source aggregation — three different checkers feed one prioritized plan.
  4. no-data discipline — a missing source (confluence-doc) is noted, never fabricated.

When you add/remove a source checker, a fixture report, or a finding, update the fixture(s) and EXPECTED_PLAN_ITEMS in the same commit (the canary edit is itself caught on the next run — design §6.4).