Skip to content

Configuration

Project profile (.provadyne.yml)

A .provadyne.yml at your repository root pins how this project is checked — committed to version control so every engineer and every CI run scans identically, with no flags to remember. It is discovered automatically by walking up from the analyzed file, so it governs everything beneath it.

Because it lives in your repo, the profile is an accumulating audit artifact: it records the organisation's guideline decisions (which standards apply, which guidelines are re-categorized) that a Safety Manager owns and signs off. It is audit-prep material, not a certification (see Tool qualification).

# .provadyne.yml — committed at the repo root
version: 1

# ASIL preset: a starting point that expands to a standard set + baseline
# guideline policy. Explicit keys below override any part of it.
profile: ASIL-D

# Override / extend the preset (all optional):
standards: [misra, cert, cwe]   # which standards to run
language: c                     # c | cpp | rust
std: c11                        # cppcheck --std
platform: unix64                # cppcheck --platform
format: sarif                   # json | sarif | html
lang: en                        # result language: en | ko | de | ja | zh
iso26262: true                  # annotate findings with ISO 26262-6 Table 6
inline_suppress: true           # honour inline provadyne-ignore[...] comments
rules: ["8.4", "8.7"]           # report only these rule ids (quote them!)
include: [inc, vendor/inc]      # extra -I header paths (merged with CLI -I)
define: [UNIT_TEST=1]           # extra -D macros
undefine: [NDEBUG]              # extra -U macros

# GRP — Guideline Re-categorization Plan (MISRA Compliance:2020 §5.4)
recategorize:
  "8.10": required              # tighten Advisory -> Required
  "20.1": disapplied            # this guideline does not apply -> drop findings
  "17.7": mandatory             # Required -> Mandatory

ASIL presets

Preset Standards Advisory guidelines
QM misra left as-is
ASIL-A misra, cwe left as-is
ASIL-B misra, cert, cwe left as-is
ASIL-C misra, cert, cwe tightened to Required (tighten_advisory: true)
ASIL-D misra, cert, cwe tightened to Required

Set tighten_advisory: false to keep an ASIL-C/D standard set without the blanket advisory→required tightening.

GRP legality

The recategorize: map follows MISRA Compliance:2020 — you may always make a guideline stricter, but the profile is rejected (loudly, at load) if you try to relax a Mandatory guideline or Disapply a Required one. Only Advisory → Disapplied may drop a guideline. Legality is checked against the MISRA rule map; CERT/CWE ids are re-categorized but not statically validated.

Quote your rule ids. An unquoted 8.10 is parsed by YAML as the number 8.1, silently corrupting the id — the loader rejects this and tells you to quote it.

Precedence & discovery

  • Precedence: an explicit CLI flag > the profile > built-in defaults. The profile only fills what you left unset.
  • Discovery: automatic walk-up from the analyzed path. Force a specific file with --profile FILE, or ignore any profile with --no-profile. Over the daemon API, use the profile / no_profile request fields.
  • A broken auto-discovered profile warns and falls back to defaults (it never bricks a scan); an explicit --profile to a broken file fails loudly.
  • When a profile applies, the scan output carries a profile block (path, preset, re-categorization count) so tools can show which policy governed.

Daemon

The daemon reads configuration from environment variables.

Variable Default Description
DAEMON_PORT 9400 HTTP listen port
DAEMON_MODE live live or mock (for testing)
ENGINE_PATH ../engine Path to Python engine directory
PYTHON_BIN python3 Python interpreter
EXTENSION_ID (none) Chrome Extension ID for CORS (set in production)
ALLOWED_ANALYZE_DIR $HOME Restricts file analysis to this directory tree

macOS (LaunchAgent)

Edit ~/Library/LaunchAgents/com.provadyne.daemon.plist and add keys to <EnvironmentVariables>:

<key>EXTENSION_ID</key>
<string>abcdefghijklmnopqrstuvwxyz012345</string>

Then reload: launchctl unload ~/Library/LaunchAgents/com.provadyne.daemon.plist && launchctl load -w ~/Library/LaunchAgents/com.provadyne.daemon.plist

LLM Configuration

Via the Extension Popup → Settings → LLM, or directly via the API:

curl -X PUT http://localhost:9400/api/v1/llm/config \
  -H "Content-Type: application/json" \
  -d '{
    "mode": "local",
    "ollama_url": "http://localhost:11434",
    "ollama_model": "codellama:13b"
  }'

Modes

Mode Privacy Requires
local Full — no network Ollama + model pulled
api Code sent to provider BYOK API key
disabled N/A Nothing

License

Licenses are .lic files issued per email address. Activate via:

  • Extension Popup → License → Activate → select .lic file, or
  • API: POST /api/v1/license/activate with the file contents

The daemon validates the license signature using an embedded public key. No phone-home required.

ALM Integration (Traceability)

Configure your ALM provider in the Extension Popup → Settings → ALM:

  • Jira: Base URL + API token
  • Codebeamer: Base URL + username + password
  • GitHub Issues: Auto-detected from PR context