Analysis Coverage

Analysis coverage

Gate responses include coverage: total and unanalysed component counts, scan completion, availability of retained detail, and complete. An unfinished or archived scan, or any component without completed vulnerability lookup evidence, produces a COVERAGE / INCOMPLETE_ANALYSIS violation and exit code 1. Ignore/defer, reachability and newly introduced finding filters do not hide missing analysis. Quick Import stores a source-inspection pending marker in the fenced ingest transaction before asynchronous enrichment starts. It removes that marker after source work and successful finding persistence. Pending or failed scanners also make coverage incomplete, even if vulnerability enrichment already completed or secret gating is disabled. Interrupted imports retain this evidence; they must be retried instead of passing as a clean scan.

Component rows and detail pages expose the latest lookup time and source outcomes: RESOLVED, UNAVAILABLE, UNSUPPORTED, or NOT_CONFIGURED. A successful empty response is resolved. OSV batch IDs are hydrated through the detail endpoint with per-call deduplication and a 256-request budget; after 30 seconds no new detail request starts. An in-flight request can last until its configured HTTP timeout. Unfetched details remain unavailable. A timeout, upstream error, malformed response, or incomplete pagination is unavailable. Any unavailable source keeps coverage incomplete, even when older CVEs or a fetched timestamp remain. Successful retry replaces the outcome. Legacy cached rows without outcome metadata retain their previous completion state until normal refresh.

Coverage describes available analysis evidence, not a guarantee that every upstream database is current or that a package is safe. NVD and GitHub responses exceeding a single requested page currently fail coverage instead of silently accepting partial results.

Offline exports preserve confirmed empty results and unresolved component markers separately. Imports retain severity, CVSS vectors/scores and match confidence. An unresolved marker wins over retained findings; missing entries do not count as completed queries.

Same-version retries serialize ingestion per project. An active Quick Import source lease rejects an overlapping retry. Interrupted, failed, source-pending or AI-active results are retained under their old ID while the retry creates a new result; delayed workers therefore cannot overwrite the retry. Version lookup selects the latest attempt. Fully completed results without pending source or AI work retain the existing replacement behavior and clear previous findings. Expired canceled import workers retain their canceled job outcome while unfinished linked scans are marked failed. Java bytecode result writes finish before the scan publishes completion.

OSV fixed-version hints are shown only for one unambiguous closed package range. Multiple or open-ended affected intervals require ecosystem-specific version comparison; their hint remains empty rather than recommending an older fix.

Deployment adds the two nullable library columns in V32__vulnerability_lookup_outcomes.sql. Existing data is retained. PostgreSQL runtime validation still requires a dedicated test database; local integration verification uses H2.