FastTool
Start toolAll tools

SARIF 2.1.0 · FINDING DELTA · RELEASE PROOF

SARIF Finding Delta & Release Gate

Validate before and after SARIF reports, match findings without trusting scanner labels, enforce explicit release budgets, and export deterministic evidence with real SHA-256 hashes.

Reviewed 2026-07-10

Developer
Full official SARIF 2.1.0 schema + semanticsFingerprint-aware one-to-one deltaExplicit PASS / BLOCK budgetsDeterministic exports + real SHA-256

WHAT THIS TOOL DOES

A release decision another engineer can reproduce

Use it whenYou need to compare scanner output across commits, branches or builds.
You getValidation evidence, new/resolved/moved/severity deltas, budgets, visual and CI-friendly artifacts.
Verify withExact input SHA-256, per-artifact SHA-256 and a scoped receipt-core hash.

Loading SARIF Finding Delta & Release Gate…

OUTPUT CONTRACT

Deterministic bytes, explicit limits, reviewable decisions.

The same input bytes and policy produce the same JSON, CSV, Markdown, SVG, policy, annotation SARIF and receipt bytes. Wall-clock metadata is intentionally omitted and disclosed so artifacts remain reproducible.

A PASS means only that the validated candidate stayed inside the selected local policy. It is not a vulnerability scan, deploy action, security certification or proof that the release is safe.

PUBLIC METHOD · REPRODUCIBLE INPUTS

Sources, fixtures, artifacts and correction

Method: validate both reports against the final SARIF 2.1.0 schema and semantic cross-references, compute the delta independently of candidate baselineState labels, apply the selected budget, then hash deterministic artifact bytes. External property files are not fetched.

Official sources: OASIS SARIF 2.1.0 final standard, its final JSON Schema, and GitHub SARIF support.

Reproducible fixtures: baseline, passing candidate, and blocking candidate.

Inspect at least two artifacts: finding-delta JSON and release-gate SVG; CSV, Markdown, policy JSON, annotation SARIF and Receipt v1 are also exported.

QA and accountability: run sarif-finding-delta-release-gate-unit-20260710, rechecked 2026-07-13. Exact report hashes are in the quality manifest. FastTool is the accountable publisher. Report a schema, fixture, delta or hash error to [email protected].

FREE CLI + CI COMPANION · v0.1.0

Move the same deterministic gate into local development and CI

The direct release contains the browser-parity SARIF engine, exact examples, tests, SHA-256 manifest and Receipt v1. Node.js 20+ is required; verify the archive before installation.

npm install --save-dev /downloads/fasttool-evidence/v0.1.0/fasttool-evidence-cli-v0.1.0.tgz
Download CLI v0.1.0Download local CI ActionVerify SHA-256Download release receipt

Direct-download is the canonical v0.1.0 channel; npm, GitHub and Marketplace publication are not claimed.

COMPLETE THE EVIDENCE LOOP

Reproduce the finding-delta policy on bounded SARIF 2.1.0 fixtures before wiring the gate into CI.

Reproduce the benchmarkSee the controlled pass, failure and boundary evidence. Follow the rollout guideTurn the browser result into a reviewable real-world workflow. Verify receipt + artifact bytesRecompute the receipt core and compare every supplied artifact locally.