Review-driven fixes, hardening, docs + risk-based prioritization (KEV/EPSS) - #4

Summary

A review-driven improvement pass over Ravelin: a multi-agent code review surfaced correctness bugs and hardening gaps, I fixed the high-value ones, then added the biggest maturity feature — risk-based prioritization (CISA KEV + FIRST EPSS → risk-adjusted SLA). Also ships the STRIDE threat model and architecture docs that were promised but missing.

Build is clean; the unit suite grows 76 → 107, all green. Integration/E2E tiers (which need Docker/real SQL) run in CI.

The branch is organized into three commits — fixes, docs, and the feature — grouped below.

🐛 Correctness & hardening (fix: commit)

• Critical — empty-scan mass-resolve: an empty or errored scan (structurally-valid but zero findings) no longer auto-resolves every open finding and reports a false 100% compliance. An empty scan is now "no new information"; genuinely-fixed findings still resolve when they drop out of a non-empty scan.
• Case-insensitive dedup: identity matching now uses OrdinalIgnoreCase to match Azure SQL's collation, fixing duplicate-INSERT 500s (e.g. Newtonsoft.Json vs newtonsoft.json; NuGet ids are case-insensitive).
• Concurrent-ingest safety: IngestionService retries on the dedup unique-index collision so two overlapping scans reconcile instead of returning a 500 (a rowversion concurrency token is added alongside).
• CSV formula injection: exported, untrusted scan fields beginning with = + - @ are neutralized so they can't execute in an auditor's spreadsheet.
• Client auth: an expired/revoked token (401) now clears state and redirects to login instead of surfacing a raw error string; the login page guards returnUrl against open redirects.
• JWT fail-closed (in the feature commit's Program.cs): removed the all-zeros signing-key fallback — Production refuses to start without a ≥32-byte key; dev/test use an explicit dev key. Tightened ClockSkew to 30s.
• RBAC integration tests: a new authorization-matrix test suite (Viewer/Analyst/Admin/anonymous across admin, triage, SLA, and read endpoints) + a role-seeding/JWT fixture helper — the biggest coverage gap for a security tool.
• Read-path scaling (feature commit's RavelinEndpoints.cs): AsNoTracking + SQL-side breach filtering + additive (non-breaking) pagination on the hot read queries.

📄 Docs (docs: commit)

• docs/THREAT-MODEL.md — full STRIDE model: Mermaid DFD, trust boundaries, each threat mapped to its in-code mitigation, and an honest residual-risks section.
• docs/architecture.md — Mermaid system diagram + walkthrough.
• README — fixed stale drift (Key Vault is live, not "roadmap"; accurate stage table) and added a live-demo/API-docs section and a "What's inside" feature list.

✨ Risk-based prioritization (feat: commit)

Severity/CVSS alone is a weak triage signal — real programs prioritize by exploitation in the wild.

• Enrichment: findings are enriched with CISA KEV (actively exploited) and FIRST EPSS (exploitation probability) via the public feeds. Runs as part of the hourly SLA re-evaluation and on demand (POST /api/admin/enrich). Config-gated and inert by default (VulnIntel:Enabled) — no external calls locally; feed outages are swallowed.
• Risk-adjusted SLA: a KEV finding gets a 14-day deadline, EPSS ≥ 0.5 gets 30 days — tighten-only (never extends a Critical's 7 days). Bonus: an exploited Unknown-severity finding now gets tracked instead of escaping SLA.
• Prioritization: findings sort KEV-first, then severity, then EPSS; a "⚠ Exploited" / "Likely exploited" badge + EPSS% shows on each finding; the dashboard gains an "Actively exploited" count.
• New surface: GET /api/risk-policy, POST /api/admin/enrich, new Finding columns (+ migration), enriched DTOs, KEV/EPSS in CSV export.
• Tests: risk ranking, risk-adjusted SLA math, CVE extraction, and KEV/EPSS JSON parsing.

Deploy / activation

VulnIntel__Enabled=true is added to the Container App (Terraform). To activate live: terraform apply → deploy (migrations apply on boot) → trigger POST /api/admin/enrich or wait for the hourly re-eval → the dashboard's "Actively exploited" count and finding badges populate.

Verification

• dotnet build clean; dotnet test unit tier 107 passing.
• Ran the real host locally and smoke-tested: boots cleanly with all changes, new endpoints published in OpenAPI and correctly auth-gated (401), security headers intact. Full data-flow needs SQL (no Docker locally) → covered by CI integration/E2E tiers.

Notes for the reviewer

• The feat: commit's Program.cs / RavelinEndpoints.cs also carry the JWT fail-closed and read-path scaling changes, because those hardening edits share files with the feature (called out above and in the commit body).
• Follow-ups not in this PR: the infra fixes from the review (tfstate lockdown, deploy health gate, CI identity least-privilege, managed-identity SQL auth) need terraform apply against live Azure; a TimeProvider refactor for deterministic time-tests; typed results for richer OpenAPI schemas.