emit-sarif: document that emit-finalize strips the AI1012-mandated ruleId sub-id (and relocates it nowhere)

[michaelcfanning]

Summary

The emit-sarif skill / AI-generated-findings profile enforces AI1012 at emit-results receipt: result.ruleId MUST be CWE-<n>/<sub-id> (or the flat NOVEL-<sub-id>); a bare CWE-<n> is rejected. But emit-finalize then rewrites result.ruleId from CWE-<n>/<sub-id> back to bare CWE-<n> (and points ruleIndex at the bare descriptor), relocating the sub-id nowhere — no result.rule.id, no slugged reportingDescriptor, no property.

The producer is forced to author a sub-classifier at the door and it is silently confiscated at the exit. get-skill emit-sarif Step 5 lists finalize's actions (replay, snippets, CWE descriptor enrichment, permalink rebase, embed, validate) but never mentions this strip, and never tells producers that a sub-classifier they want to keep must be parked in a property bag.

Evidence (Sarif.Multitool 5.2.0)

emit-results with a bare id:
`
{ "appended": 0, "rejected": [ { "index": 0, "errorCode": "AI1012",
"message": "error AI1012: ... Every AI-emitted result.ruleId MUST take one of two shapes:

1. Taxonomy sub-id CWE-/ ...
2. NOVEL escape hatch NOVEL- ..." } ] }
   emit-resultswithCWE-306/anon-endpoint->{ "appended": 1, "rejected": [] }`.

After emit-finalize (real two-run Argus log), runs[1].results[0]:

• ruleId = "CWE-306" (sub-id gone), ruleIndex -> bare CWE-306 descriptor
• rule = null; no tool-driver descriptor whose id contains /
• the only durable carrier of the sub-classification is the producer's own argus/antipatternId property.

Ask

1. Document in emit-sarif Step 5 (and docs/ai/generating-sarif.md) that emit-finalize canonicalizes result.ruleId to the base CWE and does not retain the AI1012 sub-id on the result.
2. Add explicit guidance: if you need the sub-classifier to survive finalize, store it in a tool-namespaced property (e.g. myscanner/subId); result.ruleId is not a durable place for it.

References

• Skill: emit-sarif @ 8c1dc61
• Consumer: Argus (AI security analyzer, GHAZDO target)
• Related: emit-finalize: replay multiple staged event logs into one ordered multi-run SARIF (cross-run pointer stability) #3051

[michaelcfanning]

emit-sarif / emit-finalize skill-gap set (companions to #3051):

• emit-sarif: document that emit-finalize strips the AI1012-mandated ruleId sub-id (and relocates it nowhere) #3061 — finalize strips the AI1012 sub-id, undocumented (this issue)
• emit-finalize: provide a way to preserve the AI1012 ruleId sub-id for GHAZDO (strip is GHAS-only canonicalization) #3062 — feature: preserve the sub-id for GHAZDO (strip is GHAS-only)
• emit-sarif: skill validates Sarif;AI only; GHAzDO ingestion checks (GHAzDO1014/1019/1020) are documented only in publish-to-ghazdo #3063 — emit-sarif validates Sarif;AI only; GHAzDO checks hidden in publish-to-ghazdo
• emit-sarif: document the TF_BUILD -> GHAZDO publishability coupling (local runs cannot be published) #3064 — document the TF_BUILD → GHAZDO publishability coupling