<!--
  Title: Miniforge.ai
  Author: Christopher Lester (christopher@miniforge.ai)
  Copyright 2025-2026 Christopher Lester. Licensed under Apache 2.0.
-->
## Summary

Prototypes the mixed mechanical/semantic compliance pipeline from #552. Three new Polylith components:

- **`connector-sarif`** — data-foundry `SourceConnector` for SARIF v2.1.0 JSON and CSV scan output, with Malli schemas
  and JSON Schema export
- **`gate-classification`** — `Gate` protocol implementation for mixed deterministic + LLM-judgment classification with
  configurable thresholds (confidence, severity, doc-status)
- **`workflow-security-compliance`** — 5-phase pipeline (parse → trace → verify-docs → classify → generate-exclusions)
  with sample SARIF fixture, e2e test, and REPL demo script

### New files (24 files, ~4,300 lines)

**connector-sarif** (data-foundry connector)

- `interface.clj` — public API: `create-sarif-connector`, schema exports, validation
- `core.clj` — `SarifConnector` defrecord (Connector + SourceConnector protocols)
- `format.clj` — real SARIF v2.1.0 JSON parser + CSV parser with configurable column mapping
- `impl.clj` — connect/discover/extract/checkpoint implementation
- `schema.clj` — Malli schemas for config, violations, runs; JSON Schema export
- `impl_test.clj` — unit tests

**gate-classification** (Gate protocol)

- `interface.clj` — `create-classification-gate` factory
- `core.clj` — `ClassificationGate` implementing check/repair/gate-id/gate-type
- `rules.clj` — deterministic rule engine: low-confidence escalation, documented-FP auto-exclude, TP passthrough
- `core_test.clj` + `rules_test.clj` — 45 unit tests

**workflow-security-compliance** (5-phase workflow)

- `phases.clj` — all 5 phase interceptors following `workflow-compliance-scanner` patterns
- `interface.clj` — module loader
- `security-compliance-v1.0.0.edn` — workflow pipeline definition
- `demo/demo_security_compliance.clj` — REPL-driven guided demo
- `e2e_test.clj` — end-to-end pipeline smoke test
- `phases_test.clj` — unit tests per phase
- `test/fixtures/sample-scan.sarif` + `.csv` — realistic test data (shlwapi.dll!none, ntdll, CryptEncrypt scenarios)

### Design decisions

- **Phases 2 & 3 are stubs**: `:sec-trace-source` and `:sec-verify-docs` enrich violations with realistic mock data
  (`:trace/actual-api`, `:trace/call-chain`, `:verified/documented?`). Shape is correct for LLM integration; agent
  wiring is deferred.
- **Gate reads LLM-enriched fields deterministically**: confidence thresholds, doc-status checks, and severity filtering
  are all configurable. The gate never calls an LLM — it consumes upstream enrichment.
- **SARIF connector follows `connector-pipeline-output` patterns**: Malli schemas, defrecord delegation, atom-backed
  handle state.

## Test plan

- [ ] Run `clj-kondo --lint` on all new files — should pass with 0 errors
- [ ] Run unit tests: `clj -M:test -m kaocha.runner --focus-meta :connector-sarif :gate-classification
  :workflow-security-compliance`
- [ ] Run REPL demo: load `demo_security_compliance.clj`, evaluate Section 3 (full pipeline)
- [ ] Verify exclusion EDN file is written to temp dir with correct structure
- [ ] Review gate thresholds against issue #552 requirements

Closes #552

🤖 Generated with [Claude Code](https://claude.com/claude-code)
