SARIF Editor Integration
coding-ethos editor diagnostics should consume the same SARIF emitted by
hooks, managed lint capture, CI, and MCP. Editors must not implement a second
policy engine or reinterpret policy configuration.
Contract
The editor-facing flow is:
- Run
bin/coding-ethos-run policy-lint --sarifwith the same file scope the editor wants to display. - Parse SARIF
runs[].results[]for diagnostics. - Use
ruleId,locations[],level, andmessage.textfor editor markers. - Use
properties.policy_id,properties.skill_id,properties.ethos_ids, andproperties.advicefor hover text and quick links. - Use
properties.coding_ethos_group_idto group duplicate findings from multiple tools. - Use MCP
sarif_remediation_advicefor focused repair guidance when the user or agent opens a finding.
The editor integration should prefer changed-file or open-file scopes. Whole repository scans belong in CI or explicit audit commands because editor feedback should be fast and local.
Required Behavior
- Never read or edit
coding_ethos.yml, generated tool configs, hook runtime files, or.code-ethos/tool-config-hashes.jsonto manufacture editor diagnostics. - Never map pathless policy context to a fake editor location.
- Preserve repository-relative paths from SARIF artifact URIs.
- Keep SARIF fingerprints and
coding_ethos_group_idintact so editor, CI, and MCP views refer to the same finding. - Use MCP
policy_explain,skill_lookup, andsarif_remediation_advicefor explanation and remediation instead of embedding separate guidance rules in editor code.
Minimal Adapter Shape
An editor adapter only needs three operations:
lintOpenFiles(files): run managed SARIF lint for the supplied files.diagnosticsFromSarif(sarif): convert SARIF results into editor markers.remediate(resultIndex, sarif): call MCPsarif_remediation_advicewith the same SARIF payload and selected result index.
All richer behavior, including risk summaries, trend analysis, policy authoring feedback, and skill lookup, should be routed through MCP.