v1.3.0 — Confidence & Evidence Metadata, Output Contract Stability

What's new in v1.3.0

Confidence and evidence metadata on every finding

Every Finding now carries four evidence fields populated at detection time:

Field	What it tells you
confidence	AVE-baseline confidence (0.0–1.0), adjusted through the full FP pipeline
evidence_kind	How evidence was gathered: multi_engine, tool_description_pattern, behavioral_pattern, semantic_inference, file_type_mismatch, config_schema
detection_stage	static_detection or runtime_observed
detection_layer	content, server_card, runtime, or registry_metadata

ToxicFlow also gains a confidence field — min(confidence) across all contributing findings, the weakest link in the chain.

Confidence values are seeded from 51 AveMeta records in scanner/ave_meta.py (one per AVE ID), then adjusted by FP-3 (scoring), thresholded by profile, and optionally refined by the FP-4 meta-analyzer.

Golden fixture and output contract tests

tests/fixtures/golden/malicious_scan.json is a committed snapshot of the full scan output for the malicious fixture. 25 schema contract tests lock all 18 finding fields (including the four new evidence fields), all 10 toxic flow fields, confidence values, and risk score against this snapshot. Unintended schema changes now fail CI.

confidence_band() and evidence lifecycle docs

confidence_band(score) maps a confidence score to "high" / "medium" / "low" bands aligned with the meta-analyzer window. docs/guides/evidence-lifecycle.md documents the complete confidence pipeline from AVE baseline to final Finding.confidence.

Fixed

• Suppressed noisy LiteLLM Bedrock/SageMaker WARNING lines that appeared on every test run — setLevel was called after import litellm, giving its module-level init a window to log before suppression took effect.

---

Upgrade notes

Finding gains four new fields (confidence, evidence_kind, detection_stage, detection_layer) with defaults — existing code that reads findings by name continues to work. JSON/SARIF/text output is extended.

Install:

pip install bawbel-scanner==1.3.0

Docker:
docker pull bawbel/scanner:1.3.0