Repository navigation
docs: x-FuSa spec v1.14.1 — clarify FUSA-STUB detection scope + tara impact/risk enums - #88
Merged
Merged
Conversation
…impact/risk enums Two ambiguities found by agents implementing v1.13.0/v1.14.0 conformance in java-FuSa and rust-FuSa: - Section 1.6.1 said a Rule A/B finding 'participates in check's exit code' without stating whether check itself must ingest sibling evidence artifacts, or each artifact command gates itself using the same Finding/fingerprint/disposition mechanism check also uses. FuSaOps' own implementation and java-FuSa both independently chose the latter; this makes it normative. - Section 9.2 tara's impact/risk fields had no stated closed enum, unlike attackFeasibility/treatment -- rust-FuSa's stopgap reused attackFeasibility's vocabulary rather than a value domain of its own. Adds impact.* = critical|major|moderate|negligible, risk = critical|high|medium|low, and a feasibility x impact -> risk combination table matching FuSaOps' own already-shipped tara package exactly (no FuSaOps code changes needed). Bumps SpecVersion 1.14.0 -> 1.14.1. Closes #86 and #87. Signed-off-by: SoundMatt <SoundMatt@users.noreply.github.com>
This was referenced Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #86 and #87 — two real ambiguities found by agents implementing v1.13.0/v1.14.0 conformance in java-FuSa and rust-FuSa respectively (not found in review, found by independent implementation, exactly what filing an issue rather than guessing is for).
#86 — §1.6.1 "who runs detection". The text said a Rule A/B finding "participates in
check's exit code," which reads two ways: each artifact command gates itself using the same Finding/fingerprint/disposition mechanismcheckalso uses, orcheckitself ingests sibling evidence artifacts (fmea.json,.fusa-hara.json, etc.) and folds their findings into its own output. FuSaOps' own reference implementation and java-FuSa independently converged on the former; this PR makes that the normative reading and clarifiescheck's only role here is optionally surfacing staleness (§1.6 rule 5), not re-running another command's scan.#87 — §9.2
taraimpact/riskclosed enums.attackFeasibility/treatmenthad stated closed enums;impact's four SFOP axes andriskdidn't — rust-FuSa's stopgap reusedattackFeasibility's vocabulary rather than a value domain of its own, exactly the kind of divergence this section exists to prevent. New canonical values:impact.*=critical|major|moderate|negligible(the family's own vocabulary, informed by but not verbatim-matching ISO 21434 Clause 15.3's Severe/Major/Moderate/Negligible);risk=critical|high|medium|low. New SHOULD-level feasibility × impact → risk combination table (ISO 21434 leaves risk determination organization-defined, so this is the family's own convention) — matches FuSaOps' own already-shippedtarapackage exactly, so no FuSaOps code changes were needed here, just the spec catching up to what was already correct.SpecVersionbumped1.14.0→1.14.1.Test plan
go build ./.../go vet ./...— cleango test ./...— all packages pass (doc-only + version-constant change)tara/tara.goImpact/RiskLevelenums andriskMatrix()already match the newly-formalized values/table exactly