Package com.tnsai.quality.security.harness

Record Class ReviewFinding

java.lang.Object
java.lang.Record
com.tnsai.quality.security.harness.ReviewFinding
Record Components:
id - stable identifier; same finding across re-runs MUST produce the same id (used for de-duplication)
file - source file path, relative to the project root
startLine - 1-based start line; 0 = file-level finding
endLine - 1-based end line; >= startLine
cwe - CWE identifier (e.g. "CWE-89" for SQL injection); empty when no CWE applies
severity - Severity classification
title - one-line headline ("SQL injection in user lookup")
description - multi-line explanation of the issue
evidence - code snippet that demonstrates the issue; should be the smallest reproducer, not the full file
mitigation - optional fix suggestion ("use prepared statements")
matcher - id of the MatcherSpi that fired, or "agent:<agent-id>" if produced by an agent
agentBackend - id of the agent backend ("claude-opus-4-7"); empty for matcher-only findings
metadata - free-form extension key/values; never null
public record ReviewFinding(String id, Path file, int startLine, int endLine, String cwe, Severity severity, String title, String description, String evidence, Optional<String> mitigation, String matcher, String agentBackend, Map<String,String> metadata) extends Record
One vulnerability discovered by the code-review pipeline (TNS-291).

Findings are produced by either a static MatcherSpi (the scan stage) or a ReviewAgentSpi (the process stage). They are the canonical unit of output — exporters serialise them into SARIF / JSON / Markdown.

Since:
0.10.0 (TNS-291)

  • Constructor Details

    • ReviewFinding

      public ReviewFinding(String id, Path file, int startLine, int endLine, String cwe, Severity severity, String title, String description, String evidence, Optional<String> mitigation, String matcher, String agentBackend, Map<String,String> metadata)
      Creates an instance of a ReviewFinding record class.
      Parameters:
      id - the value for the id record component
      file - the value for the file record component
      startLine - the value for the startLine record component
      endLine - the value for the endLine record component
      cwe - the value for the cwe record component
      severity - the value for the severity record component
      title - the value for the title record component
      description - the value for the description record component
      evidence - the value for the evidence record component
      mitigation - the value for the mitigation record component
      matcher - the value for the matcher record component
      agentBackend - the value for the agentBackend record component
      metadata - the value for the metadata record component

  • Method Details

    • fromMatcher

      public static ReviewFinding fromMatcher(String id, Path file, int startLine, int endLine, String cwe, Severity severity, String title, String description, String evidence, String matcherId)
      Convenience for matcher-only (static) findings — no agent backend.

    • toString

      public final String toString()
      Returns a string representation of this record class. The representation contains the name of the class, followed by the name and value of each of the record components.
      Specified by:
      toString in class Record
      Returns:
      a string representation of this object

    • hashCode

      public final int hashCode()
      Returns a hash code value for this object. The value is derived from the hash code of each of the record components.
      Specified by:
      hashCode in class Record
      Returns:
      a hash code value for this object

    • equals

      public final boolean equals(Object o)
      Indicates whether some other object is "equal to" this one. The objects are equal if the other object is of the same class and if all the record components are equal. Reference components are compared with Objects::equals(Object,Object); primitive components are compared with '=='.
      Specified by:
      equals in class Record
      Parameters:
      o - the object with which to compare
      Returns:
      true if this object is the same as the o argument; false otherwise.

    • id

      public String id()
      Returns the value of the id record component.
      Returns:
      the value of the id record component

    • file

      public Path file()
      Returns the value of the file record component.
      Returns:
      the value of the file record component

    • startLine

      public int startLine()
      Returns the value of the startLine record component.
      Returns:
      the value of the startLine record component

    • endLine

      public int endLine()
      Returns the value of the endLine record component.
      Returns:
      the value of the endLine record component

    • cwe

      public String cwe()
      Returns the value of the cwe record component.
      Returns:
      the value of the cwe record component

    • severity

      public Severity severity()
      Returns the value of the severity record component.
      Returns:
      the value of the severity record component

    • title

      public String title()
      Returns the value of the title record component.
      Returns:
      the value of the title record component

    • description

      public String description()
      Returns the value of the description record component.
      Returns:
      the value of the description record component

    • evidence

      public String evidence()
      Returns the value of the evidence record component.
      Returns:
      the value of the evidence record component

    • mitigation

      public Optional<String> mitigation()
      Returns the value of the mitigation record component.
      Returns:
      the value of the mitigation record component

    • matcher

      public String matcher()
      Returns the value of the matcher record component.
      Returns:
      the value of the matcher record component

    • agentBackend

      public String agentBackend()
      Returns the value of the agentBackend record component.
      Returns:
      the value of the agentBackend record component

    • metadata

      public Map<String,String> metadata()
      Returns the value of the metadata record component.
      Returns:
      the value of the metadata record component