.nornir/README-full.md · mikronova/modgunn

Móðguðr — complete overview

The real README: the full pitch, the competitive matrix, what each engine does, and the quickstart. The repo-root README.md is the slim face (title · mashup · pointers); this chapter is the heavy detail, and it is also folded into the manual docs/manual.pdf by nornir docs book.

The nordisk supply-chain gatekeeper: a leaf Rust crate that hands any artifact a CVE / license / provenance verdict (Pass / Warn / Block) — and, with its heavy SCIP engine, diffs the behaviour of your entire dependency world between two snapshots over a time-travelling Iceberg warehouse.

Why Móðguðr — a scanner hands you today's verdict; modgunn also remembers every advisory and every world-snapshot, and tells you what changed. The rows marked NA are categories the scanners have no concept for (vs Trivy · Snyk · Dependency-Track; Grype / OSV-Scanner sit alongside Trivy):

capability	modgunn	Trivy	Snyk	Dependency-Track
Multi-ecosystem CVE / license / provenance verdict (Pass / Warn / Block)	✅	✅	✅	✅
Exploit-intel gating — KEV + EPSS thresholds + VEX suppression	✅	◐	✅	◐
Reachability-gated vulns — is the CVE actually called? (SCIP call-graph)	✅	✗	✅	✗
Whole-world behaviour-delta between snapshots — capability drift, blast-radius (PageRank), fingerprint drift, tripwires	✅	NA	NA	NA
Advisories + world-snapshots in a time-travel + CDC Iceberg warehouse, queryable by other services	✅	NA	NA	NA
Embeddable leaf crate — drop the gate (`core::Verdict`) inside another Rust app	✅	◐	✗	✗
Mature curated advisory DB + breadth of ecosystem coverage	◐	✅	✅	✅

Rows marked NA: the rival has no such category — not a missing feature, a missing concept.

What it does

Engine A — scan (the verdict). Multi-ecosystem CVE / license / provenance → core::Verdict (Pass / Warn / Block), cached by (blob_sha256, policy_version, advisory_db_rev), with KEV / EPSS / VEX exploit-intelligence gating. Lean leaf — holger's promotion gate consumes it directly.
Engine B — scip (the world-delta). A real WorldSnapshot of the resolved dep-graph + SCIP call-graph; diff() → BehaviorDelta feeds reachability-gated vulns, capability-surface drift, blast-radius (PageRank) and fingerprint-drift tripwires. Heavy (128 GB–1 TB RAM); off by default.
Warehouse seam (warehouse feature). Opens the shared skade / Iceberg catalog directly — OWNs cve_advisories / world_snapshots / behavior_deltas / tripwire_events, READs nornir's sbom_components, with CDC over skade's read_delta.
Leaf by design. holger and nornir both depend on modgunn; modgunn never depends on nornir — that is the cycle it exists to break.

Quickstart

cargo build                  # Engine A — the artifact security verdict (lean leaf)
cargo build --features scip  # + Engine B — whole-world behaviour-delta (heavy)
cargo test                   # Engine A (13 tests) + Engine B (16 tests)

Benchmarks

Numbers pending — no harness recorded yet. modgunn does not yet ship a nornir bench run modgunn harness (bench/examples/nornir-bench.rs), and no results are recorded in this workspace's warehouse (nornir bench history-show modgunn → no bench runs recorded). The natural metrics — Engine A verdict throughput (artifacts/s, cache hit vs cold) and Engine B diff() wall-time per snapshot pair — go here once a Bencher harness lands and records them. No figures are quoted until they are measured.