fix(sec-core): expose skill ledger verdicts

[1570005763]

Description

Skill Ledger show events currently keep verdicts only under the latest and active
objects, so SQLite cannot index one canonical verdict and Dashboard rows without
details cannot display key fields. This change projects command-specific Skill Ledger
states into details.result.verdict without changing CLI results, then exposes optional
verdict, command, and skill_name fields on Dashboard API rows. Dashboard consumers
prefer those top-level fields when details are omitted and classify tampered as risk
and drifted as warning. Batch init, scan, and check commands use the most severe
child result, while historical records, SQLite schema, and telemetry remain unchanged.

Related Issue

no-issue: internal security observability compatibility requirement has no public GitHub issue

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional change)
• Performance improvement
• CI/CD or build changes

Scope

• cosh (copilot-shell)
• cosh-ng (cosh-ng)
• sec-core (agent-sec-core)
• skill (os-skills)
• sight (agentsight)
• tokenless (tokenless)
• ckpt (ws-ckpt)
• memory (agent-memory)
• anolisa (anolisa-cli)
• skillfs (SkillFS)
• Multiple / Project-wide

Checklist

• I have read the Contributing Guide
• My code follows the project's code style
• I have added tests that prove my fix is effective or that my feature works
• I have updated the documentation accordingly
• For cosh: Lint passes, type check passes, and tests pass
• For cosh-ng: cargo clippy --all-targets -- -D warnings and cargo fmt --check pass
• For sec-core (Rust): cargo clippy -- -D warnings and cargo fmt --check pass
• For sec-core (Python): Ruff format and pytest pass
• For skill: Skill directory structure is valid and shell scripts pass syntax check
• For sight: cargo clippy -- -D warnings and cargo fmt --check pass
• For tokenless: cargo clippy -- -D warnings and cargo fmt --check pass
• For memory (Linux only): cargo clippy --all-targets -- -D warnings, cargo fmt --check, and cargo test pass
• For anolisa: cargo clippy --all-targets --locked -- -D warnings, cargo fmt --all --check, and cargo test --locked pass
• For skillfs: cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, and cargo test --workspace pass
• Lock files are up to date (package-lock.json / Cargo.lock)

Testing

cd src/agent-sec-core
make python-code-pretty
uv run --project agent-sec-cli pytest \
  tests/unit-test/security_middleware/backends/test_skill_ledger_backend.py \
  tests/unit-test/security_events/ \
  tests/unit-test/daemon/test_security_query_handler.py \
  tests/unit-test/telemetry/ \
  tests/integration-test/skill-ledger/test_skill_ledger_integration.py -q

cd ../agentsight/dashboard
npm test -- src/test/securityUtils.test.ts src/test/SecurityObservabilityPage.test.tsx
npm run typecheck
npm run build:embed

cd ../../..
git diff --check upstream/main...HEAD

Result: 442 backend tests and 14 targeted Dashboard tests passed. Dashboard typecheck
and the production embed build also passed.

Additional Notes

• Existing records with a null verdict are intentionally not reprojected.
• status, audit, export, list-scanners, and init-keys intentionally do not
  project a canonical verdict; status --verbose preserves child statuses only.
• No SQLite schema version or SLS telemetry changes are included.
• The full Dashboard suite retains 13 unrelated failures in AgentHealthSidebar,
  App, and TokenSavingsPage; the identical failures reproduce on upstream/main.

[qoderai]

本次审查范围内未发现需要修改的问题。

---

🤖 Generated by Qoder • View workflow run