checks

type BaseCheckNode struct {
	// UPPER_SNAKE_CASE identifier. Must be unique across all checks.
	Code string `json:"code"`

	// Single sentence stating the condition this check detects.
	// Must read naturally as: "This check fires when: <Description>".
	// State the observable fact only — consequences belong in Categories.
	Description string `json:"description"`

	// One sentence explaining the security or operational risk this check exists to detect.
	// Omit when the Description (and Outcomes, if present) already make the risk self-evident.
	WhyThisMatters string `json:"why_this_matters,omitempty"`

	// Risk category → sentence explaining WHY this check belongs in that category.
	// The key determines policy enforcement; the value completes the sentence
	// "This check is in the <category> category because: <value>".
	// Do NOT restate the Description — explain the consequence or risk.
	Categories map[category.RiskCategory]string `json:"categories"`

	// What each check status means for this specific check.
	// Omit when the Description already makes outcomes self-evident.
	Outcomes storage.Outcomes `json:"outcomes,omitempty"`

	// Methodology, scope limitations, or default thresholds a customer needs to
	// interpret the result correctly. Use fmt.Sprintf for threshold defaults so
	// values stay in sync with code. One caveat per entry.
	Disclaimers []string `json:"disclaimers,omitempty"`

	// Configurable decision boundaries for threshold-based checks.
	// Serialized into catalog and check output for customer visibility.
	Thresholds map[string]any `json:"thresholds,omitempty"`
}

type CheckOutputProvider interface {
	GetCheckOutput() *Output
}

type ChecksWriter func(ctx context.Context, doc storage.ChecksResult, input dag_impl.Input) error

type Output struct {
	dag_impl.BaseOutput `json:",inline"`
	Check               storage.Check `json:",inline"`
	// contains filtered or unexported fields
}