Module derive_status 

derive_status — canonical algorithm per App dispatch §4 binding contract.

Each CleanLibrary SDK (sdk-js, sdk-py, sdk-go, cleanlib-client Rust) implements this algorithm INDEPENDENTLY from the spec; the cross-SDK contract test (tests/contract.rs) verifies byte-identical (status, reason_code) across all 4 implementations on every fixture in cleanlib-contract-fixtures v1.0.0.

Precedence:

1. Substance (signals top-to-bottom; unavailable substrate falls through):

   • exploitability.exploitation_likelihood == "CRITICAL" → DENY + VERDICT_EXPLOITATION_CRITICAL
   • exploitability.in_kev AND availability.kev == "available" AND exploitability.exploit_risk_score >= 70 → DENY + VERDICT_KEV_LISTED
   • rich_data.has_obfuscation → DENY + VERDICT_OBFUSCATED
   • remediation.fix OR remediation.recommended_version present → WARN + VERDICT_HAS_REMEDIATION
   • rich_data.abandonment_score >= 0.7 → WARN + VERDICT_ABANDONED
   • rich_data.recommended_version present (under rich_data, not remediation) → ALLOW + VERDICT_RECOMMENDED_VERSION_NEWER
   • default → ALLOW + VERDICT_CLEAN

2. Freshness override: when the substance-driving signal’s availability == "degraded_stale", the substance-derived status tier is PRESERVED and the reason_code overrides to VERDICT_DEGRADED_STALE.

3. Block tie-break in remediation: fix > recommended_version

   other blocks.

Structs

DerivedStatus

Return value pair — sister of sdk-py StatusResult + sdk-go StatusResult.

Functions

derive_status

Apply the substance-precedence + freshness-override rule to a parsed VerdictEnvelopeV1. Returns (status, reason_code) pair.