fix: v0.48.0 — ISO 26262-3 Table 4 ASIL fix + audit remediation

.fusa-hara.json

@@ -29,7 +29,7 @@
         "severity": "S2",
         "exposure": "E4",
         "controllability": "C2",
-        "asil": "ASIL-C"
+        "asil": "ASIL-B"
       },
       "safetyGoals": [
         "SG-001"
@@ -47,7 +47,7 @@
         "severity": "S2",
         "exposure": "E3",
         "controllability": "C2",
-        "asil": "ASIL-B"
+        "asil": "ASIL-A"
       },
       "safetyGoals": [
         "SG-002"
@@ -64,7 +64,7 @@
         "severity": "S2",
         "exposure": "E3",
         "controllability": "C1",
-        "asil": "ASIL-A"
+        "asil": "QM"
       },
       "safetyGoals": [
         "SG-003"
@@ -99,7 +99,7 @@
         "severity": "S2",
         "exposure": "E3",
         "controllability": "C2",
-        "asil": "ASIL-B"
+        "asil": "ASIL-A"
       },
       "safetyGoals": [
         "SG-005"
@@ -113,7 +113,7 @@
       "hazards": [
         "H-001"
       ],
-      "asil": "ASIL-C",
+      "asil": "ASIL-B",
       "safeState": "Halt analysis and exit non-zero if rule engine cannot complete",
       "fssrRefs": [
         "REQ-LINT001",
@@ -128,7 +128,7 @@
       "hazards": [
         "H-002"
       ],
-      "asil": "ASIL-B",
+      "asil": "ASIL-A",
       "safeState": "Report configuration mismatch as ERROR finding",
       "fssrRefs": [
         "REQ-HARA006"
@@ -140,7 +140,7 @@
       "hazards": [
         "H-003"
       ],
-      "asil": "ASIL-A",
+      "asil": "QM",
       "safeState": "Exit code 1",
       "fssrRefs": [
         "REQ-CLI001",
@@ -166,7 +166,7 @@
       "hazards": [
         "H-005"
       ],
-      "asil": "ASIL-B",
+      "asil": "ASIL-A",
       "safeState": "Emit WARNING and continue",
       "fssrRefs": [
         "REQ-CONFIG001"

.fusa.json

@@ -1,11 +1,14 @@
 {
   "version": "1",
+  "configVersion": "1",
   "project": {
     "name": "go-FuSa",
     "module": "github.com/SoundMatt/go-FuSa",
     "standard": "ISO26262",
     "asil": "ASIL-B"
   },
+  "standard": "ISO26262",
+  "asil": "ASIL-B",
   "rules": {},
   "report": {
     "format": "text"

.github/workflows/ci.yml

@@ -201,7 +201,19 @@ jobs:
         run: go build -o gofusa ./cmd/gofusa
 
       - name: Run gofusa check --format sarif
-        run: ./gofusa check --format sarif --output results.sarif || true
+        run: |
+          set +e
+          ./gofusa check --format sarif --output results.sarif
+          code=$?
+          set -e
+          # Exit 0 (clean) and 1 (findings present, gate fail) are both
+          # expected and still produce a valid SARIF to upload. Any higher
+          # exit code is a crash/usage error and must fail the job so a
+          # stale or empty results.sarif is not silently uploaded.
+          if [ "$code" -gt 1 ]; then
+            echo "gofusa check failed with exit $code" >&2
+            exit "$code"
+          fi
 
       - name: Upload SARIF to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@v3

.gitignore

@@ -4,3 +4,5 @@ CLAUDE.md
 /.fusa-cache/
 /.claude/
 /cmd/gofusa/safety-case.json
+/check-report.json
+/results.sarif

CHANGELOG.md

@@ -7,6 +7,62 @@ Dates reference the merged commit timestamp.
 
 ## [Unreleased]
 
+## v0.48.0 — 2026-07-30 (fix ISO 26262-3 Table 4 ASIL determination + audit remediation)
+
+### Fixed
+- **`hara.DetermineASIL` mis-implemented ISO 26262-3:2018 Table 4** (Critical):
+  the hand-written S×E×C lookup table was wrong in 8 of 12 S2 cells and 11 of
+  12 S3 cells, always *inflating* the rating relative to the standard's
+  additive rule. Replaced with the reproducible additive model the standard
+  actually specifies: points = S(1–3) + E(1–4) + C(1–3), with ≤6 → QM, 7 → A,
+  8 → B, 9 → C, 10 → D (ASIL D reachable only at the single S3+E4+C3 cell).
+  `hara/hara_test.go`'s golden values, which had locked in the inflated
+  results, are corrected to match. As a direct consequence, this repo's own
+  dogfooded `.fusa-hara.json` re-derives all five hazards (H-001..H-005)
+  under the corrected rule — the highest ASIL among them drops from the
+  previously-claimed ASIL-C to **ASIL-B** (e.g. H-001's S2/E4/C2 rating,
+  previously miscomputed as ASIL-C, is ASIL-B under the correct additive
+  sum of 8).
+- **`qualify.computeHash` was not reproducible**: it hashed the live
+  `generatedAt` timestamp (so the "integrity" hash changed on every run of
+  identical results) and did not sort `Results` before hashing (so
+  re-ordered-but-identical results produced a different digest). The hash
+  now excludes `generatedAt` entirely, canonicalizes via
+  `fusa.CanonicalizeJSON`, and sorts `results[]` by case name first, so the
+  digest is stable for a given qualification outcome.
+- **Legacy `.fusa.json` shape**: the repo's own config had drifted to the
+  pre-`configVersion` shape (bare `"version": "1"`, standard nested only
+  under `project.standard`, uppercase `"ISO26262"` id). Normalized to the
+  current canonical shape — `configVersion` plus top-level `standard`/`asil`
+  fields alongside the legacy nested ones, for both current and older
+  config-loader code paths.
+- **Stale committed `check-report.json`**: removed a stale, plain-text
+  `check-report.json` (baked in with an absolute local filesystem path) that
+  had been committed to the repo by mistake. Added `/check-report.json` and
+  `/results.sarif` to `.gitignore` so generated reports can't be
+  re-committed by accident.
+- **CI SARIF self-scan was masked by `|| true`**: `gofusa check --format
+  sarif` failures (including genuine crashes/usage errors, not just a
+  nonzero "findings present" gate exit) were unconditionally swallowed
+  before the SARIF upload step, so a broken self-scan could never fail CI.
+  Now only exit codes 0 (clean) and 1 (findings present) are treated as
+  producing a valid SARIF to upload; anything higher fails the job.
+
+### Security
+- **`impact.changedFiles` git argument injection**: `git diff` was invoked
+  with `--from`/`--to` refs interpolated directly into the argument list
+  with no `--` pathspec separator, so a ref value beginning with `-` could
+  be interpreted by git as an option rather than a revision. Refs starting
+  with `-` are now rejected outright, and a `--` separator is always placed
+  before the revision range.
+
+### Not fixed (by design)
+- **`normalizeMessage` still omits Unicode NFC normalization** — the
+  audit's low-severity finding here is deliberately left unpatched: a
+  correct fix needs `golang.org/x/text`, and this repo's std-lib-only
+  convention (go.mod has zero dependencies) takes priority over closing this
+  one low-severity gap.
+
 ## v0.47.0 — 2026-07-28 (declare x-FuSa spec v1.15.2 conformance)
 
 ### Changed

README.md

@@ -285,7 +285,7 @@ docker build -t go-fusa .
 docker run --rm -v "$(pwd)":/project go-fusa check
 ```
 
-Published tags: `latest`, `0.47`, `0.47.0` (and matching semver for every release).
+Published tags: `latest`, `0.48`, `0.48.0` (and matching semver for every release).
 
 ## Standards coverage