Documentation
¶
Overview ¶
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []core.PolicyResult into the structurally counts-only core.SubmissionPayload that the cloud submitter consumes. No resource identifier crosses this boundary. The wire type has no Violations slice, no map[string]any, no interface{} fields — widening it requires a code change reviewed at this seam.
The structural enforcement lives in internal/core/cloud_test.go::TestSubmissionPayload_StructurallyCountsOnly, which walks SubmissionPayload's type graph and fails the build if an identity-carrying field is added.
See docs/architecture/02-layers.md and 06-aggregation.md.
Package aggregator is L6 of the SigComply CLI and the privacy boundary: projects []PolicyResult into the structurally counts-only SubmissionPayload that the cloud submitter consumes. No resource identifier crosses this boundary. The wire type has no Violations slice, no map[string]any, no interface{} fields — widening it requires a code change reviewed at this seam.
See docs/architecture/02-layers.md and 06-aggregation.md.
Index ¶
Constants ¶
const SchemaVersion = "sigcomply.cloud.v3"
SchemaVersion is the wire-format identifier stamped on every SubmissionPayload. Bumping requires a code change to the contract (see 06-aggregation.md §Versioning the contract).
v2: adds per-policy cadence metadata (ConfiguredCadence, LastEvaluatedAt, NextDueAt, IsCarriedForward, PolicyContentHash) so the dashboard can render staleness and next-due badges without recomputing locally.
v3 (current): replaces the per-policy scalar ControlID with a Controls []ControlRef list so one check can map to controls across multiple frameworks, each ControlRef carrying framework, framework_version, control_id, and a relationship type. All fields are non-identifying scalars and pass the structural counts-only test in core/cloud_test.go.
Variables ¶
This section is empty.
Functions ¶
func Build ¶
func Build(results []core.PolicyResult, env *Environment) core.SubmissionPayload
Build produces the SubmissionPayload from a run's per-policy results. The "Message" field on each AggregatedPolicy is regenerated from counts here; the rule's violation text is never copied across.
Types ¶
type Environment ¶
type Environment struct {
Repository core.Repository
CI core.CIEnvironment
Branch string
CommitSHA string
CommitTime time.Time
CLIVersion string
RunID string
Framework string
PeriodID string
StartedAt time.Time
CompletedAt time.Time
}
Environment captures the CI-runtime metadata stamped on the payload. The CLI's orchestrator (L9) populates it from environment variables and git context before calling Build.
Source Files