Loop 4: False-Positive Feedback Workflow

[sairintechnologycom]

Goal

Help developers report false positives and help maintainers tune rules safely.

Command

pkgsafe feedback create

Scope

• feedback model
• finding fingerprint
• command to generate sanitized feedback
• optional export file under .pkgsafe/feedback/
• docs explaining safe reporting
• alignment with false-positive issue template
• evidence recorded at evidence/loops/loop-04-false-positive-feedback.md

Guardrails

• No secrets in feedback artifacts
• Local-first only
• No hosted service
• Behavior analysis remains disabled by default
• Heuristic behavior is not described as sandboxing or secure containment

[sairintechnologycom]

Loop 4 validation completed on branch loop-04-false-positive-feedback.

Evidence: evidence/loops/loop-04-false-positive-feedback.md
Sample artifacts:

• evidence/loops/loop-04-scan.json
• evidence/loops/loop-04-feedback/npm-postinstall-curl-example-10059d15ee2b.json
• evidence/loops/loop-04-feedback/npm-postinstall-curl-example-10059d15ee2b.md

Summary:

• Added pkgsafe feedback create.
• Generates local false-positive feedback JSON and Markdown issue body from package scan JSON.
• Adds stable finding fingerprint based on ecosystem, package, version, decision, risk score, and sorted rule IDs.
• Includes package, ecosystem, version, rule IDs, decision, risk score, command used, sanitized finding output, user reason, lifecycle/private-registry flags, behavior analysis, and PkgSafe version.
• Reuses existing registry.RedactSecrets sanitizer.
• Updated docs and false-positive issue template with fingerprint guidance.

Validation passed:

• gofmt -w .
• go test ./internal/feedback ./cmd/pkgsafe
• go test ./...
• go test -race ./...
• go vet ./...
• make build
• sample scan JSON generation
• sample pkgsafe feedback create
• targeted secret-value scan
• malformed input validation
• issue-template YAML parse
• docs/template alignment checks
• wording guardrail check

Sample fingerprint: 10059d15ee2bdda09fc21dcd657950d59908763922c0369cce0dff7bae1a3904

No hosted service, SaaS, billing, SSO, or ecosystem promotion was introduced.