Tie every finding to a rule ID and evidence

How to do it

Anyone can check a finding with a rule ID. The buyer can price it and the seller can fix it without a debate about what was meant. The evidence is a file and line, a request and its answer, or a screenshot. Use the severity scale the report states at the top. This is Name the principle and the fix in every finding, applied to a deal.

Examples

JavaScript example

import { readFileSync } from 'node:fs';

const FIELDS = ['ruleId', 'severity', 'evidence', 'fixDays'];
const findings = JSON.parse(readFileSync('report/findings.json', 'utf8'));
const incomplete = findings.filter(finding => FIELDS.some(field => !finding[field]));
if (incomplete.length) { console.error(incomplete.map(finding => finding.title).join('\n')); process.exit(1); }

Python example

import json, sys

FIELDS = ["ruleId", "severity", "evidence", "fixDays"]
findings = json.load(open("report/findings.json"))
incomplete = [f["title"] for f in findings if any(not f.get(field) for field in FIELDS)]
if incomplete:
    sys.exit("\n".join(incomplete))

How to check

A script reads the report's findings and fails when one lacks a rule ID, a severity, evidence or a fix estimate.

Related rules

• ARC-5 Name the principle and the fix in every finding in Clean code and architecture
• TKO-38 Never sign a review of code you have changed in Codebase takeover