cerebro-finding-rule

# Cerebro Finding Rule The full design rationale lives in the "Finding Rule Design Notes" section of [AGENTS.md](../../../AGENTS.md). This skill is the working checklist. ## Decide before writing the matcher 1. Is this a durable, remediable risk state — not a raw temporal event? If the condition stops being independently actionable when the event ages out, model it as evidence or graph context instead of a finding. 2. Choose the anchor first. Source-state rules anchor on durable provider IDs turned into tenant-scoped URNs; graph-anchored rules anchor on graph entities or paths. Never fingerprint on event IDs, timestamps, run IDs, pagination IDs, or vendor alert IDs unless that vendor object is itself the durable remediable state. 3. Canonicalize provider-controlled identifiers before they enter URNs, event IDs, graph anchors, or fingerprints. Preserve raw provider IDs as attributes for investigation. ## Every durable rule needs - Explicit `Lifecycle` semantics and stable `FingerprintFields`. - `OpenAnchor` and `CloseOnEvent` that meet in the middle: the close event must produce the same anchor stored on the open finding, or the rule must not claim closeout support. - Required attributes, control refs, false-positive guidance, and a runbook. - Close paths for deprovisioned/offboarded/inactive resources unless the finding is explicitly about unsafe removal. - Positive-evidence semantics: missing or unknown upstream data is unknown, not a failing control. ## Test matrix (all of these) - Positive open; negative non-open; required attributes present. - Stable fingerprint and reopen behavior. - Remediation close; deprovision/offboard close where applicable. - A counterexample proving unrelated or contextless events do not close the finding. ## Validate - Focused package tests, then `make finding-dsl-check policy-rule-check policy-mapping-check detection-catalog-check`. - `make changed-check` for the diff-selected remainder; `make contracts-check` if contract-governed docs moved.