guidelines-ingestion

Guidelines Ingestion

Overview

Load remediation guidelines from up to 3 sources and merge them deterministically using section-level replacement. The result is a single, merged guidelines document per scanner that the agent follows during remediation.

Three-Layer Merge

Layer 3 (highest priority): Per-invocation overrides
         ↓ overrides
Layer 2: Org's custom guidelines file
         ↓ overrides
Layer 1 (lowest priority): Scanner module shipped defaults

Merge Algorithm (Deterministic — No LLM Judgment)

Guidelines are organized by ## heading sections.

1. Start with Layer 1 — read the scanner module's defaults/remediation-guidelines.md
2. Apply Layer 2 — read the org's custom guidelines file (path from config):
   • Same heading → fully replace Layer 1's section
   • New heading → append
   • Missing heading → keep Layer 1 as-is
3. Apply Layer 3 — inject per-invocation instructions as ## Overrides at top

Process

1. For each active scanner:
   • Read Layer 1: security-<scanner>/defaults/remediation-guidelines.md
   • Read Layer 2: path from scanners.<scanner>.guidelines in config
   • Merge using section-level replacement
   • Add Layer 3 overrides from user prompt
2. Validate merged result — check for contradictions within sections
3. Inject into agent context — merged guidelines become binding for the session