Type
Enhancement / reporting pipeline.
Priority
P2 / Medium-High.
Tags
protocol-review, ownnet-consumer, sarif, baseline, diff-gate, review-report, obligations
Context
Own.NET should own the semantic checking for obligation/barrier protocols. OwnAudit should consume the resulting findings and turn them into adoption-friendly review artifacts: baselines, SARIF, markdown, verdicts, and new-vs-existing gates.
This mirrors the existing architecture-review direction: Own.NET emits facts/findings; OwnAudit owns baseline/diff/reporting/risk.
Proposed command surface
Sketch:
python3 -m protocol.review_cli \
--findings protocol-findings.json \
--sarif protocol-findings.sarif \
--baseline protocol-baseline.json \
--out-dir protocol/out \
--gate-level error
Outputs:
protocol/out/
protocol-review.md
protocol-findings.sarif
protocol-findings.json
protocol-baseline.json
protocol-verdict.json
protocol-summary.json
Report model
The markdown report should answer:
- What new protocol violations were introduced?
- What old/baselined violations remain visible but non-blocking?
- Which findings are deterministic/blocking vs advisory?
- What should a reviewer look at first?
- What evidence/path did Own.NET provide?
Example:
FAIL: 1 new protocol violation.
OWN201: DocumentLoading crosses OnPropertyChanged(Document)
Evidence:
IsLoaded=false at BigDocumentViewModel.cs:184
OnPropertyChanged(Document) at BigDocumentViewModel.cs:241
IsLoaded=true only at BigDocumentViewModel.cs:260
Scope
OwnAudit should not implement obligation analysis. It only consumes Own.NET output.
Acceptance criteria
- Consumes protocol findings from Own.NET JSON/SARIF.
- Maintains a protocol baseline file.
- Fails only on new non-baselined blocking findings.
- Keeps existing/baselined findings visible in the report.
- Emits SARIF and markdown.
- Produces a small machine-readable verdict for CI/007.
Non-goals
- No second checker in OwnAudit.
- No LLM-as-truth. LLM can summarize deterministic evidence later.
- No perf gates in this slice.
Why this matters
Protocol findings are useful only if they are adoption-safe in dirty legacy code. Baseline/diff is the difference between "this tool caught a regression" and "this tool screamed about ten years of archaeology and got disabled by lunch."
Type
Enhancement / reporting pipeline.
Priority
P2 / Medium-High.
Tags
protocol-review,ownnet-consumer,sarif,baseline,diff-gate,review-report,obligationsContext
Own.NET should own the semantic checking for obligation/barrier protocols. OwnAudit should consume the resulting findings and turn them into adoption-friendly review artifacts: baselines, SARIF, markdown, verdicts, and new-vs-existing gates.
This mirrors the existing architecture-review direction: Own.NET emits facts/findings; OwnAudit owns baseline/diff/reporting/risk.
Proposed command surface
Sketch:
Outputs:
Report model
The markdown report should answer:
Example:
Scope
OwnAudit should not implement obligation analysis. It only consumes Own.NET output.
Acceptance criteria
Non-goals
Why this matters
Protocol findings are useful only if they are adoption-safe in dirty legacy code. Baseline/diff is the difference between "this tool caught a regression" and "this tool screamed about ten years of archaeology and got disabled by lunch."