fix: tara closed impact/risk enums per x-FuSa spec v1.14.1 (v0.41.0) - #69
Merged
Conversation
x-FuSa spec §9.2 ("Closed enums (MUST — clarifies a gap found during
rollout)") requires impact.{safety,financial,operational,privacy} to use
critical|major|moderate|negligible — never high|medium|low, even though
that vocabulary is used for attackFeasibility — and risk to use
critical|high|medium|low. tara.go implemented neither: deriveSFOP only
ever produced high/medium/low for the SFOP axes, and deriveRisk's coarse
"worse of feasibility vs. highest impact" heuristic could only ever
produce high/medium, never critical or low, because its two inputs were
themselves drawn from the same three-value vocabulary (go-FuSa#58).
deriveSFOP now maps onto the closed critical/major/moderate/negligible
vocabulary via the new legacyImpactToSFOP: a "high" rating escalates to
"critical" for the most severe (IEC 62443 SL3) rules, "major" otherwise,
preserving genuinely distinct tiers rather than collapsing every "high"
rule onto one value regardless of actual severity. deriveRisk is
reimplemented as an actual lookup against the x-FuSa spec's own
published risk combination table (highest SFOP impact axis ×
attackFeasibility → risk, via the new riskTable) rather than a generic
heuristic, so critical and low are both reachable outcomes.
Regenerated tara.json against this repo's own CYBER findings: risk now
includes "critical" (2 threats) alongside medium/low; impact.safety
includes "critical" alongside "moderate" — neither value was reachable
before this fix.
Signed-off-by: Matt Jones <matt@jellybaby.com>
Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // convention (documented in the spec) rather than a normative external | ||
| // table — every value is taken verbatim from the spec's published table so | ||
| // cross-tool risk values stay comparable. | ||
| var riskTable = map[[2]string]string{ |
|
|
||
| // ─── x-FuSa spec §9.2 closed impact/risk enums ───────────────────────────────── | ||
|
|
||
| var closedImpactValues = map[string]bool{"critical": true, "major": true, "moderate": true, "negligible": true} |
| // ─── x-FuSa spec §9.2 closed impact/risk enums ───────────────────────────────── | ||
|
|
||
| var closedImpactValues = map[string]bool{"critical": true, "major": true, "moderate": true, "negligible": true} | ||
| var closedRiskValues = map[string]bool{"critical": true, "high": true, "medium": true, "low": true} |
|
|
||
| var closedImpactValues = map[string]bool{"critical": true, "major": true, "moderate": true, "negligible": true} | ||
| var closedRiskValues = map[string]bool{"critical": true, "high": true, "medium": true, "low": true} | ||
| var legacyVocabValues = map[string]bool{"high": true, "medium": true, "low": true} |
This was referenced Jul 28, 2026
SoundMatt
added a commit
that referenced
this pull request
Jul 28, 2026
…-forward-v2 Resolves version-bump conflicts (fusa.go, README.md, docs/tool-safety-manual.md, CHANGELOG.md) against main after #69 (tara enum vocabulary, v0.41.0) merged. Bumped this branch's own release to v0.42.0 and moved its CHANGELOG entry to the top of the file. Signed-off-by: Matt Jones <matt@jellybaby.com> Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
SoundMatt
added a commit
that referenced
this pull request
Jul 28, 2026
Resolves conflicts against main after #73 (hara, v0.42.0) merged on top of #69 (tara enum vocabulary, v0.41.0). Bumped this branch's own release to v0.43.0, reordered CHANGELOG.md entries to reflect actual merge order, and regenerated fmea.json/fmea.csv/tara.json/tara.md with the fully-merged binary so they reflect the path-relativization fix, the widened FMEA templates, and the (already-merged) closed impact/risk enums together. Signed-off-by: Matt Jones <matt@jellybaby.com> Signed-off-by: Matt Jones <47545907+SoundMatt@users.noreply.github.com>
6 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
x-FuSa spec §9.2 ("Closed enums MUST — clarifies a gap found during rollout") requires:
impact.{safety,financial,operational,privacy}:critical|major|moderate|negligible— explicitly nothigh|medium|low, even though that vocabulary is used forattackFeasibility.risk:critical|high|medium|low, derived via a stated risk combination table (highest SFOP impact ×attackFeasibility).tara.goimplemented neither:deriveSFOPonly ever producedhigh/medium/lowfor the four SFOP axes (confirmed against this repo's own 319 generated threats —critical/negligiblenever appeared), andderiveRisk's "worse of the two inputs" heuristic could only ever producehigh/mediumsince both its inputs were drawn from the same three-value vocabulary.deriveSFOPnow maps onto the closed enum via newlegacyImpactToSFOP(escalates tocriticalfor the most severe IEC 62443 SL3 rules,majorotherwise).deriveRiskis reimplemented as an actual lookup against the x-FuSa spec's own published risk combination table (riskTable), rather than a generic heuristic.Closes #58.
Test plan
go build ./...go vet ./...go test -race -count=1 ./...(88.7% total coverage)golangci-lint run ./...(0 issues)go generate ./...(no diff)tara.jsonagainst this repo's own CYBER findings —risknow includescritical(2/319 threats) alongsidemedium/low;impact.safetyincludescriticalalongsidemoderate; neither reachable before this fixTestScan_AllRules_UseClosedImpactAndRiskEnums(all 20 CYBER rules, asserts every impact/risk value is in the closed enum and the legacy vocabulary never appears, and that critical/major/moderate all genuinely occur) andTestScan_RiskCombinationTable(hand-verified lookups against the spec's table)