nordisk/facett

facett-security — crate card

Reverse-engineered (from source — verify, don't trust the name)

• One-line pitch: A software-supply-chain security-report view — verdict (Pass/Warn/Block) + a findings list (severity/package/advisory/fix) with EPSS/KEV columns + a CVE/advisory table — the UI twin of modgunn's scan output.
• Does: SecurityView renders a SecurityReport (Artifact + Findings) with a Verdict gate, a Severity-ranked findings table (id/package/advisory/fix/EPSS/KEV), severity counts + kev_count, and a severity histogram painted with facett-stat's sparkline. Deliberately generic: carries its OWN plain serializable structs (Verdict/Severity/Finding/Artifact/SecurityReport) whose shape mirrors modgunn::core 1:1 (same Ord on Verdict/Severity; Finding is a superset) so a consumer maps the two with no glue and NO modgunn dependency. FC-compliant: observable state in one serializable SecurityState (read via state); every input is a Msg; Effect is empty.
• Key deps: facett-core (Facet, theme), facett-stat (sparkline for the severity histogram), egui, serde/serde_json. Dev: egui_kittest.
• Shape: lib, ~931 lines: lib.rs (783) + tests.rs (148). Key types: Verdict, Severity, Finding, Artifact, SecurityReport, SecurityState, Msg, SecurityView.
• Observed role in the workspace: The presentation half of the modgunn security scanner (see memory: modgunn=security scanner); a consumer (nornir-viz / holger-ui) maps modgunn::core → these structs and mounts the view.

Fill in (one line each — only the human knows these)

• Primary consumer(s):
• Why it exists (vs the obvious alternative):
• Hard constraint (airgap / no-C-deps / no-FFI / pure-Rust / etc.):
• Release cadence & independence (rides a parent? own repo someday?):
• Status (production / prototype / experimental / stubbed):
• Must-NOT-change invariant:
• Biggest known gap or TODO:
• Anything a newcomer would get wrong about it: