The trust verdict has to know what was suppressed before it says USABLE

SODCOV-000 read USABLE / INFO on an estate whose only conflict had been removed
by a blanket mitigation row carrying no approver, no expiry and no control id.
The statement that exists to say how far a segregation result can be believed
was the last place in the product still capable of a false all-clear - and it
renders above the findings in HTML, PDF and PPTX, and on the console dashboard.

That gap was mine: SODCOV-000 was built two commits before MITIG and never
connected to it.

  every conflict hidden by a blanket row    before  USABLE  / INFO
                                            after   PARTIAL / HIGH

Two limits are now stated: that a clean result in those areas reflects a
suppression rather than an absence, and that the rows doing the suppressing
cannot support an audit conclusion.

DERIVED, NOT RECOMPUTED

The scanner hands the findings so far to the coverage module, so the verdict
reads MITIG-001's own conclusion instead of re-deriving suppression from the
mitigation rows. That preserves the rule set when the statement was written: a
summary that recalculates can disagree with the detail it summarises, and it
does so in front of the reader least able to tell which half to believe.

ABSENCE OF SUPPRESSION DATA IS NOT ABSENCE OF SUPPRESSION

Run without peer findings, the statement records `suppression_checked: false`
and says so in its own description rather than quietly claiming a clean verdict.
Claiming one without having looked would be the same defect one level up. The
verdict still takes the FLOOR of its measures, so suppression can only make it
worse, never better.

A GUARD I DID NOT WRITE CAUGHT THE FIRST ATTEMPT, AND ITS FIX WAS BETTER

The first version passed `dict(run_ctx, peer_findings=...)` - a hand-rolled
context variant, which is exactly the shape tests/test_run_context_is_uniform.py
was written to eliminate. Its docstring explains why that matters: when the next
field is added to run_ctx, the omissions look like modules choosing not to use it
rather than never being offered it. `peer_findings` now goes INTO run_ctx, so
every auditor still receives the same object.

Full suite green: 4480 passed. Smoke run 410 findings. Six new tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: Krishcalin

modules/ruleset_coverage.py

@@ -585,6 +585,27 @@ def detail(cid, key, default=None):
 
         limits, verdict, severity = [], "usable", self.SEVERITY_INFO
 
+        # WHAT WAS HIDDEN BEFORE THE READER GOT HERE.
+        #
+        # This verdict read USABLE / INFO on an estate whose only conflict had
+        # been removed by a blanket mitigation row carrying no approver, no
+        # expiry and no control id. The statement that exists to say how far a
+        # result can be believed was the last place in the product still capable
+        # of a false all-clear, and it was rendered above the findings in every
+        # format and on the console dashboard.
+        #
+        # Read from the peer findings rather than recomputed from the mitigation
+        # rows: MITIG-001 already decided what was suppressed, and a summary
+        # that recalculates can disagree with the detail it summarises.
+        peers = {f.get("check_id"): f
+                 for f in ((self.run_context or {}).get("peer_findings") or [])
+                 if isinstance(f, dict)}
+        suppression_checked = bool(peers)
+        hidden = ((peers.get("MITIG-001", {}).get("details") or {})
+                  .get("risks_hidden_entirely") or 0)
+        unsupportable = ((peers.get("MITIG-002", {}).get("details") or {})
+                         .get("unsupportable") or 0)
+
         # The floor, in order of how badly each one undermines the result.
         if "SODCOV-004" in seen:
             verdict = "not measured"
@@ -616,6 +637,23 @@ def detail(cid, key, default=None):
                     "the ruleset names %.0f%% of the transactions this estate "
                     "grants" % (tx * 100))
 
+        if hidden:
+            # A conflict removed from the report is not a conflict that was not
+            # there, and a verdict that cannot see the difference is worthless.
+            verdict = "partial" if verdict == "usable" else verdict
+            severity = max(severity, self.SEVERITY_HIGH, key=self._rank)
+            limits.append(
+                "%d risk(s) were removed from this report entirely by a "
+                "mitigating control (MITIG-001), so a clean result in those "
+                "areas reflects a suppression rather than an absence" % hidden)
+        if unsupportable:
+            severity = max(severity, self.SEVERITY_HIGH, key=self._rank)
+            limits.append(
+                "%d mitigating control row(s) cannot support an audit "
+                "conclusion (MITIG-002) - a blanket entry, a missing approver "
+                "or a missing expiry - yet still suppress conflicts"
+                % unsupportable)
+
         dead = detail("SODCOV-007", "rules_unfirable") or []
         if dead:
             severity = max(severity, self.SEVERITY_HIGH, key=self._rank)
@@ -662,7 +700,11 @@ def detail(cid, key, default=None):
                    "" if not limits else " Stated limits: " + "; ".join(limits) + ".",
                    "" if limits else
                    " No limit was found that would qualify it: coverage was "
-                   "measurable, bounded, and broad on every surface examined.")),
+                   "measurable, bounded, and broad on every surface examined."
+                   + ("" if suppression_checked else
+                      " NOTE: whether any conflict was suppressed by a "
+                      "mitigating control was not examined in this run, so "
+                      "this statement covers ruleset coverage only."))),
             affected_items=["limit: " + l for l in limits],
             remediation=(
                 "1. Quote the verdict, not the conflict count, when recording "
@@ -682,8 +724,13 @@ def detail(cid, key, default=None):
             details={
                 "verdict": verdict,
                 "limits": limits,
-                "derived_from": sorted(c for c in seen if c.startswith("SODCOV-")
-                                       and c != "SODCOV-000"),
+                "derived_from": sorted(
+                    [c for c in seen
+                     if c.startswith("SODCOV-") and c != "SODCOV-000"]
+                    + [c for c in peers if c.startswith("MITIG-")]),
+                # Absence of suppression data is NOT an absence of suppression.
+                "suppression_checked": suppression_checked,
+                "risks_hidden_by_mitigation": hidden,
                 "coverage_state": "complete",
             },
             scope="aggregate",

sap_scanner.py

@@ -558,6 +558,17 @@ def main():
 
     if "sodcov" in run_modules:
         print("[*] Running SoD Ruleset Coverage (what fraction of this estate the ruleset can see)...")
+        # SODCOV-000 is the one sentence on how far the SoD result can be
+        # believed, and a conflict SUPPRESSED by a mitigating control is
+        # exactly the sort of thing that qualifies it. Access risk analysis
+        # runs above and reports its suppressions as MITIG-001, so the
+        # findings so far are handed over rather than recomputed - a
+        # summary that recalculates can disagree with its own detail.
+        # Into run_ctx itself, not a hand-rolled variant beside it.
+        # tests/test_run_context_is_uniform.py exists precisely to stop the
+        # call shapes diverging again, and passing a different dict here would
+        # have reintroduced the shape it was written to eliminate.
+        run_ctx["peer_findings"] = list(all_findings)
         auditor = RulesetCoverageAuditor(data, baseline_overrides, run_ctx)
         findings = auditor.run_all_checks()
         all_findings.extend(findings)

tests/test_ruleset_coverage.py

@@ -686,3 +686,88 @@ def test_the_limits_are_ordered_worst_first():
     limits = one(RulesetCoverageAuditor(data).run_all_checks(),
                  "SODCOV-000")["details"]["limits"]
     assert "grants every transaction" in limits[0]
+
+
+# ── the verdict has to know what was hidden ────────────────────────────────
+#
+# SODCOV-000 read USABLE / INFO on an estate whose only conflict had been
+# removed by a blanket mitigation row carrying no approver, no expiry and no
+# control id. The statement that exists to say how far a result can be believed
+# was the last place in the product still capable of a false all-clear — and it
+# renders above the findings in every format and on the console dashboard.
+
+from modules.access_risk_analysis import AccessRiskAnalysisAuditor as _ARA2  # noqa: E402
+
+SUPPRESSIBLE = [{"risk_id": "ZS", "name": "vendor create vs pay",
+                 "description": "d", "risk_type": "SOD", "severity": "CRITICAL",
+                 "process": "P2P", "functions": [
+                     {"name": "A", "actions": ["FK01"], "permissions": [
+                         {"object": "F_LFA1_BUK", "field": "ACTVT",
+                          "values": ["02"]}]},
+                     {"name": "B", "actions": ["F110"], "permissions": [
+                         {"object": "F_REGU_BUK", "field": "ACTVT",
+                          "values": ["02"]}]}]}]
+
+HOLDS_IT = [row(low="FK01"), row(low="F110"),
+            row(obj="F_LFA1_BUK", field="ACTVT", low="02"),
+            row(obj="F_REGU_BUK", field="ACTVT", low="02")]
+
+
+def with_peers(mitigations=None):
+    """Run ARA first, then the coverage module over the same estate."""
+    data = {"role_auth_values": HOLDS_IT,
+            "user_roles": [{"UNAME": "U1", "AGR_NAME": "Z_ROLE"}]}
+    if mitigations is not None:
+        data["mitigating_controls"] = mitigations
+    ara = _ARA2(dict(data))
+    ara.RULESET = SUPPRESSIBLE
+    peers = ara.run_all_checks()
+    cov = RulesetCoverageAuditor(dict(data), {}, {"peer_findings": peers},
+                                 ruleset=SUPPRESSIBLE)
+    return one(cov.run_all_checks(), "SODCOV-000")
+
+
+BLANKET = [{"USER": "U1", "RISK_ID": "*", "CONTROL_ID": "", "VALID_TO": ""}]
+
+
+def test_an_unsuppressed_estate_still_reads_usable():
+    f = with_peers()
+    assert f["details"]["verdict"] == "usable"
+    assert f["details"]["suppression_checked"] is True
+
+
+def test_a_risk_hidden_by_a_mitigation_stops_the_verdict_reading_usable():
+    """THE false all-clear. A conflict removed from the report is not a
+    conflict that was not there."""
+    f = with_peers(BLANKET)
+    assert f["details"]["verdict"] == "partial"
+    assert f["severity"] == "HIGH"
+    assert f["details"]["risks_hidden_by_mitigation"] == 1
+
+
+def test_the_limit_says_a_suppression_is_not_an_absence():
+    limits = " ".join(with_peers(BLANKET)["details"]["limits"])
+    assert "reflects a suppression rather than an absence" in limits
+
+
+def test_unsupportable_rows_are_named_as_their_own_limit():
+    limits = " ".join(with_peers(BLANKET)["details"]["limits"])
+    assert "cannot support an audit conclusion" in limits
+
+
+def test_the_verdict_names_the_mitigation_checks_it_was_derived_from():
+    """Derived, not recomputed — a summary that recalculates can disagree with
+    the detail it summarises."""
+    derived = with_peers(BLANKET)["details"]["derived_from"]
+    assert "MITIG-001" in derived and "MITIG-002" in derived
+
+
+def test_without_peer_findings_it_says_suppression_was_not_examined():
+    """Absence of suppression data is NOT an absence of suppression. Claiming
+    a clean verdict without having looked would be the same defect one level
+    up."""
+    a = RulesetCoverageAuditor({"role_auth_values": HOLDS_IT},
+                               ruleset=SUPPRESSIBLE)
+    f = one(a.run_all_checks(), "SODCOV-000")
+    assert f["details"]["suppression_checked"] is False
+    assert "not examined in this run" in f["description"]