config.py

"""
config.py — the single home of every ASSUMED value in this project.

Rules:
  1. If a number is an assumption, it is defined HERE and nowhere else.
  2. Every entry carries a comment saying where it came from and why.
  3. Nothing in this file may support a headline result. These are inputs to
     sensitivity analysis, not findings.
  4. tools/check_claims.py verifies that every ASSUMED value cited in
     docs/findings/ is defined here.

Empty by design. Add entries only when a measurement genuinely requires an
assumed input, and label the dependent result ASSUMED or SIMULATED.
"""

# ---- Corpus sampling policy (an assumption: record it in the manifest) ----
# EPSS full daily history is ~4-6 GB compressed. Daily resolution inside
# +/-90d windows around version boundaries and KEV additions, weekly elsewhere.
EPSS_WINDOW_DAYS = 90
EPSS_OFFPEAK_SAMPLE = "weekly"

# Sampling for measurements whose cost is O(daily files) per CVE. Fixed seed: an
# unseeded sample makes a result irreproducible, and an irreproducible number is
# not evidence under the rules in the header above.
SAMPLE_SEED = 20260807
EPSS_SCAN_LIMIT = 100

# ---- EPSS model boundaries (SOURCE_FACT, not assumptions) ----
EPSS_MODEL_BOUNDARIES = {
    "v1": "2021-04-14",  # no header comment in these files
    "v2": "2022-02-04",  # header comment begins here
    "v3": "2023-03-07",
    "v4": "2025-03-17",
    "v5": "2026-06-15",
}

# ---- Source behaviour change dates (SOURCE_FACT) ----
CISA_CPE_STOP = "2024-12-10"  # CISA stopped adding CPE to Vulnrichment
NVD_TRIAGE_CHANGE = "2026-04-15"  # NIST ended universal CVE enrichment

# ---- Policy thresholds (structural decision points — one home) ----
# Not ASSUMED values; they define the policy's decision boundaries.
# M3A must use the same thresholds as the policy engine to avoid silent divergence.
EPSS_PATCH_THRESHOLD = 0.10  # EPSS >= this -> consider patching
EPSS_MONITOR_THRESHOLD = 0.01  # EPSS >= this -> at least monitor
CVSS_HIGH_THRESHOLD = 7.0  # CVSS >= this -> high severity

# ---- Parser skip bound ----
# If a parser drops more than this fraction of input records, the measurement
# fails rather than reporting a number built on silently-truncated input.
MAX_SKIP_RATE = 0.05

# ---- Policy loss weights (ASSUMED: structural, for sensitivity analysis) ----
# These define the relative cost of different decision errors. They are
# NOT empirical findings — they are business assumptions that the policy
# evaluation (M4) uses to compare frontiers. Any headline result using these
# must carry the ASSUMED label and include sensitivity analysis.
LOSS_WEIGHTS = {
    "missed_exploit": 100,  # Not acting on an exploited vulnerability
    "upgrade_direct": 10,  # Effort to test + deploy a direct upgrade
    "upgrade_transitive": 15,  # Effort for a transitive dependency change
    "pin": 5,  # Effort to pin + verify compatibility
    "wait_for_fix": 1,  # Ongoing monitoring cost
    "request_exception": 5,  # Effort to document + approve an exception
}

# ---- Phase 2 sandbox (structural constants — not decision thresholds) ----
# These define the resource envelope for untrusted code execution.
# The image is pinned by digest so a compromised upstream tag cannot swap code.
SANDBOX_IMAGE = "node@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32"
SANDBOX_MEMORY_LIMIT = "512m"
SANDBOX_CPU_LIMIT = "1"
SANDBOX_PIDS_LIMIT = 100
SANDBOX_WALL_TIMEOUT_S = 180  # 3 minutes per repo
SANDBOX_MAX_OUTPUT_BYTES = 10_485_760  # 10 MB stdout/stderr cap per run