Repository navigation
A control level above 3 drops out of the default audit with exit 0 #701
Description
ControlConfig.level has no range check, so a control with a level above 3 can drop out of the default audit with exit 0, and any FAIL it would report goes with it. darnit validate flags the level (invalid level: 4), but darnit audit doesn't run it.
On a framework with one control, tags = { level = 4 }, and a file_exists step for a file that doesn't exist:
darnit audit -f <framework>.toml -o json --no-fail <repo> on main (075556e) returns no results and exits 0.
The filter is (c.level or 0) <= level in tools/audit.py.
#597 adds a route to this. With it, [overrides.X] tags = { level = 4 } on a composed control that has a top-level level takes effect:
| total controls | FAIL | that control | |
|---|---|---|---|
| main (075556e) | 2 | 2 | reported at its own level (2), FAIL |
| main merged with #597 (0ccef6c) | 1 | 1 | absent |
No shipped framework declares a level outside 1-3.
Suggested fix: reject a level outside the valid range when the framework loads, in the validator #597 adds, so audit fails closed the way it does for a conflicting or non-integer level. Decide whether 0 and negative levels are rejected the same way.
Drafted with AI assistance (Claude), reviewed and filed by me. Measurements quoted were executed and verified.
Activity
Daniel-park10 commentedon Nov 1, 2026
Hey @mlieberman85, would love to work on this if it's still up for grabs. I was looking at the validator in
ControlConfigand the fix seems pretty straightforward. Should I wait for #597 to land first and base off that or just go ahead against main? Let me know and I'll get a PR up.