From the #258 bridge-contract inventory (spec/Bridge.md §9). Three smaller ambiguities, each currently documented as-is in the spec; settle Python-first if any should change before the #259 port freezes them:
- OD-4 — positional identity fallbacks. A nameless component/function defaults to
Component<gid> / Fn<loc> using the running global counter, so an unrelated earlier record shifts a later record's identity (and therefore its finding's component and dedup key). A stable fallback (per-list index, or the file stem) would decouple identity from document position.
- OD-5 — dedup is blind to evidence. BR-V7's dedup key excludes
related/flow: two findings identical in all primary fields but with different evidence slices collapse to the first. Intended for the multi-exit OWN001 collapse; unclear whether evidence-divergent duplicates can occur and, if so, which slice should win (first-wins today, by construction order).
- OD-6 — anchorless findings emit
? artifact URIs. OWN052/OBL005 use file="?", line=0; SARIF omits the region correctly but emits a literal ? as artifactLocation.uri. Consumers tolerate it today; a spec-blessed convention (omit locations, or a well-known URI) would be cleaner for code-scanning ingestion.
Per #258's rule these stay documented-as-is until decided; none blocks the spec.
Refs #258, #259.
From the #258 bridge-contract inventory (
spec/Bridge.md§9). Three smaller ambiguities, each currently documented as-is in the spec; settle Python-first if any should change before the #259 port freezes them:Component<gid>/Fn<loc>using the running global counter, so an unrelated earlier record shifts a later record's identity (and therefore its finding'scomponentand dedup key). A stable fallback (per-list index, or the file stem) would decouple identity from document position.related/flow: two findings identical in all primary fields but with different evidence slices collapse to the first. Intended for the multi-exit OWN001 collapse; unclear whether evidence-divergent duplicates can occur and, if so, which slice should win (first-wins today, by construction order).?artifact URIs. OWN052/OBL005 usefile="?",line=0; SARIF omits the region correctly but emits a literal?asartifactLocation.uri. Consumers tolerate it today; a spec-blessed convention (omitlocations, or a well-known URI) would be cleaner for code-scanning ingestion.Per #258's rule these stay documented-as-is until decided; none blocks the spec.
Refs #258, #259.