4 Commits

Include renames

Author	SHA1	Message	Date
Sharang ParnerkarandClaude Fable 5	7cd4ffdaab	feat(controls): B3 — categorize the rest of needs_tooling (architectural + RBAC) ... Closes out B's coverage of the 16 needs_tooling CRA controls: - cra-ai-2,3,4,5 (minimal attack surface, secure architecture, least-privilege, tamper protection) are design properties, not local code patterns -> marked not_code_checkable (out of static-scan scope) with reviewer notes. - cra-ai-12 (RBAC) is surface-checkable (authorization points) -> added to the grounded surface pass; note points to the gated grounded mechanism. Final CRA coverage: covered 13 | needs_tooling 8 (all grounded-covered, gated) | not_code_checkable 19. The 16 needs_tooling now fully categorized: 4 custom-semgrep (B1) + 8 grounded surface (B2/B3, gated) + 4 architectural (B3). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-07-21 14:50:50 +02:00
sharang	4ef257bfe2	feat(controls): B2 — grounded surface checks for absence-based CRA controls (#219)	2026-07-21 12:48:12 +00:00
sharang	38fedc661b	feat(controls): B1 — custom semgrep detectors for 4 CRA controls (#218)	2026-07-21 12:31:20 +00:00
sharang	c6baf72c6d	feat: control-driven SAST — LUT + grounded LLM triage over tool findings (#213)	2026-07-21 09:01:51 +00:00