[P2/foundation] Build scan-results-bridge #14

Completed delivery — 2026-10-26 UTC

The optional standalone scan-results-bridge is merged at a9bd1b7af01d2cbde8c8923da9bd96021a3adab7; all six merge-commit CI jobs passed, along with 13 local tests and five official-schema SARIF variants. Copilot hosted/CLI findings were addressed. Explicit canonical/six legacy profiles preserve unknown/not_tested, completion and conflicting observations in SARIF/NDJSON. Paths require opt-in and no uploads are performed.

Final coverage and delivery receipts. The dated reconciliation/planning text below is retained as historical context and is superseded by this completion record.

Delivery reconciliation — 2026-10-25

No scan-results-bridge repository exists in the audited security organization. SARIF/NDJSON conversion is not implemented and remains optional supporting work.

The old dependency on a separate completetech-security-rules repository is superseded by the bundled-contract policy above: consume versioned contracts embedded in the real checker repositories. Normalize schema differences explicitly before conversion; keep uncertainty/not_tested, absent source locations, deterministic fingerprints, redaction, overwrite protection and offline defaults. No vendor transport or credential collection is enabled.

Full dated audit and exact commit/CI receipts · merged reconciliation PR #20

User clarification — one repository per exploit (2026-10-23)

Each distinct exploit/advisory must ship in its own standalone repository. This issue is a planning/coordination grouping; it must not become a scanner aggregating unrelated vulnerabilities. Common parsing, evidence contracts and output code may be bundled into each checker without requiring a shared runtime. See parent issue #2 for the current repository mapping.

This is supporting infrastructure, not an exploit checker. It is deferred from the initial exploit-specific delivery and must not become a mandatory dependency of an individual checker.

Priority: P2/foundation | Proposed artifact: scan-results-bridge
Estimate from report: MVP 6–10 person-days; hardened 12–18 person-days (rough estimates, not commitments).
Parent: Security checker family roadmap

Outcome

Convert canonical checker JSON to interoperable SARIF and SIEM-friendly NDJSON without adding transport dependencies to every scanner.

Scope

• Validate schema versions and convert evidence, rule IDs, relative source locations, severity/confidence and remediation to SARIF 2.1.0 and NDJSON.
• Define stable fingerprints, tool/rule metadata and deterministic ordering; network-only assets must not get fabricated code locations.
• Keep vendor transports such as HEC/syslog optional and separate; implement path/URL/secret redaction and explicit CI policy handling.

Acceptance criteria

• Validate against the SARIF schema with synthetic source and inventory-only results, Unicode, duplicates and absent locations.
• Preserve uncertainty and not_tested exploitability; documented CI policy distinguishes findings, unknowns and operational errors.
• Default conversion is offline with no upload or credential collection; output escaping and overwrite handling are tested.
• Apply the parent roadmap's shared release gates: primary-source verification, uncertainty handling, bounded parsing, deterministic outputs, meaningful synthetic tests, privacy and documentation.
• Keep the core independently usable offline with an embedded rule snapshot; default to Python 3.10+ standard library and document any justified exception.
• Preserve local exploitability: not_tested; record actual observations separately from inference and external exploitation reports.

Dependencies and sequencing

Depends on the canonical result schema in completetech-security-rules; use synthetic fixtures while scanners mature.

This is a planning issue in the reference repository. The proposed artifact name identifies the intended destination; creating this issue does not create that repository or require implementing an unrelated scanner inside node2shell-check.

Verification plan

Use synthetic version boundaries, absent/present/ambiguous preconditions, conflicting and vendor-qualified evidence, malformed/bounded inputs and output escaping/privacy cases. No production-target scanning in CI. Verify applicable Linux/Windows/macOS behavior, CLI help and documented examples before release.

Sources to verify

Origin: user-supplied Research Report: High-Value Security Checkers to Build After Node2Shell, dated 2026-10-23. Advisory statements and thresholds above are research leads, not independently verified facts. Check the primary sources and record exact validated claims/dates before enabling any detection rule; omit unsupported claims.

• https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/sarif-support-for-code-scanning