Documentation
¶
Overview ¶
Package profile derives an organization's qualification disposition from an Pluto scorecard. Profiles are policy data: evaluation is a pure function that never mutates raw results and never calls a model or target.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Card ¶
type Card interface {
Dimensions() ([]qual.DimensionScore, error)
FindingCount(code eval.FindingCode) int
SeverityCount(s eval.Severity) int
}
Card is the read-only view of a scorecard that profile evaluation consumes. qual.Scorecard satisfies it once Task 12 adds FindingCount/SeverityCount; tests may substitute a fake.
type Disposition ¶
type Disposition string
Disposition is the derived release-policy outcome. There is no valid zero value.
const ( Qualified Disposition = "qualified" Restricted Disposition = "restricted" Rejected Disposition = "rejected" Unverified Disposition = "unverified" )
func (Disposition) Rank ¶
func (d Disposition) Rank() int
Rank orders the four Disposition constants worst-to-best, for callers that need a minimum-acceptability threshold -- e.g. a CLI's --require flag, which must accept anything at or above a configured floor. It returns -1 for any value that is not one of the four Disposition constants, so a caller can use a negative result to reject an unrecognized --require value.
This is a DIFFERENT axis from Evaluate's own precedence-of-derivation logic (violated > undecided > restriction-applied > default qualified), which decides which single disposition a scorecard resolves to in the first place given a profile's requirements and restrictions. Rank instead compares two already-derived Disposition values against each other; it is never consulted by Evaluate.
type Profile ¶
type Profile struct {
Name eval.Name
Revision eval.Revision
Requirements []Requirement
Restrictions []Restriction
}
Profile is a named, versioned set of mandatory requirements and optional restrictions.
type Requirement ¶
type Requirement struct {
Dimension eval.Name
MinScore *float64 // [0,100]
MinCoverage *float64 // [0,1]
FindingCode eval.FindingCode
MaxFindingCount *int
Severity eval.Severity
MaxSeverityCount *int
}
Requirement is one testable policy clause. Exactly one subject must be set: either Dimension (with MinScore and/or MinCoverage) or FindingCode (with MaxFindingCount) or Severity (with MaxSeverityCount). Nil bounds are "no constraint of that kind".
func (Requirement) Validate ¶
func (r Requirement) Validate() error
Validate rejects a requirement with no subject, more than one subject, a subject without any bound, or an out-of-range bound.
type RequirementResult ¶
type RequirementResult struct {
Requirement Requirement
Outcome Outcome
}
RequirementResult is the per-clause evidence retained in the result.
type Restriction ¶
type Restriction struct {
Description string
Requirement Requirement
}
Restriction is a non-mandatory clause: when its requirement is not met, the disposition downgrades from qualified to restricted and the description names the reduced deployment scope.
type RestrictionResult ¶
type RestrictionResult struct {
Restriction Restriction
Applied bool
}
RestrictionResult records whether a restriction applies.
type Result ¶
type Result struct {
Profile eval.Name
Revision eval.Revision
Disposition Disposition
Requirements []RequirementResult
Restrictions []RestrictionResult
}
Result is the derived disposition plus per-clause evidence. It contains no mutated scorecard data.
Source Files