Repository navigation
Deep Scan counts semantic aliases as new findings and resets convergence #711
Description
Summary
Deep Scan measures novelty using canonical finding identity. If a worker describes an existing actionable root issue under a new identity and the reducer accepts it separately, newFindings increases and the no-new streak resets. Later semantic consolidation is blocked because validation requires each previously accepted identity to remain present, even when all source lineage would be preserved.
The reducer needs to preserve accepted evidence while allowing a valid semantic merge to retire an earlier alias. #762 is the open focused proposal. The current identity check still requires prior canonical identities to survive.
Observed behavior and limits
In one completed scan, manual remediation-subsumption review identified a new canonical identity as an alias of an existing root issue. Its reducer cycle changed:
noNewStreak: 1 -> 0
newFindings: 1
Both identities remained canonical through every later successful reduction.
That run does not establish additional discovery work or cost caused by the alias: a genuinely new root issue appeared before saturation could otherwise have occurred. The demonstrated defect is the novelty/convergence contract.
Historical run context
The scan covered 287 files, dispatched 40 independent discovery runs, and had 32 successful serial reducer cycles. It ended at the configured discovery-run cap with a no-new streak of 4 and a threshold of 5. Those facts do not establish that the alias caused the cap to be reached.
Expected behavior
- Preserve every accepted worker observation and its provenance.
- Keep an independently retained root issue's identity stable.
- Permit a semantic reducer to consolidate earlier aliases when their complete source lineage remains attributable to one current finding.
- Do not count consolidation or additional evidence for an existing root issue as a newly discovered root issue.
- Continue counting genuinely new root issues and retaining independently reachable vulnerable instances separately.
Source lineage proves preservation, not semantic equivalence. The semantic reducer must still decide whether findings share a remediation-subsumed root issue.
Proposed regression cases
Here A [a,b] means canonical finding A owns source observations a and b.
| Previous -> current | Expected result |
|---|---|
A [a], B [b] -> A [a,b] |
Accept alias consolidation; newFindings = 0. |
A [a,b] -> A [a], C [b,c] |
Reject splitting a previously accepted source group. |
A [a], B [b] -> C [a,b,c] |
If c is evidence for the same root issue, accept; newFindings = 0. |
A [a], B [b] -> C [a,b], D [c] |
If c is a distinct root issue, accept; newFindings = 1. |
Also cover separately retained instances, legacy findings without native lineage, and reconstruction of the same streak after recovery/restart.
Suggested lineage assignment
For each prior finding with usable native provenance.sourceFindingIds, identify exactly one current finding containing its complete source-ID set. Preserve accepted details on that finding. A current finding is novel only when no prior canonical group maps to it. Legacy findings without usable lineage retain exact-identity behavior.
This permits many-to-one consolidation without making provenance a deterministic deduplication rule. Related earlier work includes #442 for evidence preservation and identity stability, and #660/#661 for post-scan grouping, which does not itself correct live convergence.
Activity
[-]Deep Scan counts semantic aliases as new findings and resets no-new convergence[/-][+]Deep Scan counts semantic aliases as new findings and resets convergence[/+]