[GH-ISSUE #6336] [Feature] Define stable identities for correlating compatible findings across runs #3820

Open
opened 2026-10-31 00:44:23 +00:00 by bsakaguchi · 0 comments
Owner

Originally created by @jayykernel on GitHub (Oct 22, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/6336

Problem

Users comparing repeated analyses need to correlate the same logical finding across runs. Array positions, display text, and incidental output ordering are poor identifiers because they can change without the underlying finding changing.

Desired outcome

Define stable identifiers for supported finding categories so consumers can correlate compatible findings across runs.

Proposed behavior

  • Specify the identity inputs for each supported finding category.
  • Exclude presentation-only fields and unstable ordering from identity calculation.
  • Keep finding identity distinct from artifact identity and evidence-record identity.
  • Document how identities behave when relevant artifact or finding properties change.
  • Make unsupported cases explicit rather than assigning misleading identifiers.

Acceptance criteria

  • Equivalent findings in equivalent runs receive the same identifier.
  • Changes to identity-relevant properties are reflected deterministically.
  • Tests cover reordered results, missing optional metadata, and changed evidence.
  • Existing result contracts remain backward compatible or any additive field is documented.

Scope

This should begin with a small set of finding categories that have well-defined semantics. It should not promise that semantically similar findings from unrelated analyzers are identical.

Originally created by @jayykernel on GitHub (Oct 22, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/6336 ### Problem Users comparing repeated analyses need to correlate the same logical finding across runs. Array positions, display text, and incidental output ordering are poor identifiers because they can change without the underlying finding changing. ### Desired outcome Define stable identifiers for supported finding categories so consumers can correlate compatible findings across runs. ### Proposed behavior - Specify the identity inputs for each supported finding category. - Exclude presentation-only fields and unstable ordering from identity calculation. - Keep finding identity distinct from artifact identity and evidence-record identity. - Document how identities behave when relevant artifact or finding properties change. - Make unsupported cases explicit rather than assigning misleading identifiers. ### Acceptance criteria - Equivalent findings in equivalent runs receive the same identifier. - Changes to identity-relevant properties are reflected deterministically. - Tests cover reordered results, missing optional metadata, and changed evidence. - Existing result contracts remain backward compatible or any additive field is documented. ### Scope This should begin with a small set of finding categories that have well-defined semantics. It should not promise that semantically similar findings from unrelated analyzers are identical.
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#3820
No description provided.