[0x73746F66]

Closes #295

What

Stdlib table tests in two files.

internal/lsp/sca_engine_queries_test.go (over seedEngine from sca_test.go)

1. Engine queries: PackagesFor known/unknown path; VerdictFor for a vulnerable and a clean package, an unknown version and an empty coordinate; IsManifest; ManifestPaths sorted; IntroducedBy returns the sorted direct parents in the same directory group, nothing for a package whose only parent is transitive, a direct package, a group without a graph or an unknown directory; AnchorFor resolves through anchor.Find (1-based line) and refuses a path never parsed.
2. SourceForKind default source for an unmapped kind; severityToLSP case/space handling and the LowAsHint branch for low, info, empty and unknown severities; kindToTool for OCI, empty, mapped and custom kinds.

internal/lsp/sca_helpers_test.go
2. flattenPackages path order; buildPurls index alignment, de-duplication, empty purls never requested; countVulnerable.
3. isTransientSCAErr: nil; 429/500/wrapped 503 retryable; 400/403 terminal; NotFoundError terminal; wrapped deadline retryable; wrapped cancel terminal; transport error retryable; decode error terminal. backoffFor floor and cap.
4. CountBySeverity and DescribeCounts.

Test-only.

Verified

go test ./internal/lsp/ (new tests) and go vet ./internal/lsp/ pass; gofmt clean.

[github-actions]

Vulnetix config plan

Manager gitops:vulnetix/cli, prune off, plan hash a8bd984f1753c68b180298051dd9e2524ab644d2ebe9e4c7c811ff4126753b5f

	Object	Action	Changes
~	QualityGate/default	update (adopt)	severity: null -> "high"

0 to create, 1 to update, 0 to delete, 0 unchanged

[github-actions]

Vulnetix config plan

Manager gitops:vulnetix/cli, prune off, plan hash a8bd984f1753c68b180298051dd9e2524ab644d2ebe9e4c7c811ff4126753b5f

	Object	Action	Changes
~	QualityGate/default	update (adopt)	severity: null -> "high"

0 to create, 1 to update, 0 to delete, 0 unchanged

[0x73746F66]

Reuse review: test-only change in internal/lsp. The new tests build on the package's existing fixture (seedEngine) and the real types (scan.DepGraph, vdb.CliAPIError, protocol severities) rather than introducing local doubles or a second helper, and they exercise the production functions directly (isTransientSCAErr, backoffFor, buildPurls, CountBySeverity/DescribeCounts, severityToLSP, kindToTool). Nothing duplicates an existing Vulnetix test utility or shared package. No changes needed.

[github-actions]

Vulnetix config plan

Manager gitops:vulnetix/cli, prune off, plan hash a8bd984f1753c68b180298051dd9e2524ab644d2ebe9e4c7c811ff4126753b5f

	Object	Action	Changes
~	QualityGate/default	update (adopt)	severity: null -> "high"

0 to create, 1 to update, 0 to delete, 0 unchanged

[github-actions]

Vulnetix config plan

Manager gitops:vulnetix/cli, prune off, plan hash a8bd984f1753c68b180298051dd9e2524ab644d2ebe9e4c7c811ff4126753b5f

	Object	Action	Changes
~	QualityGate/default	update (adopt)	severity: null -> "high"

0 to create, 1 to update, 0 to delete, 0 unchanged

[github-actions]

Vulnetix config plan

Manager gitops:vulnetix/cli, prune off, plan hash a8bd984f1753c68b180298051dd9e2524ab644d2ebe9e4c7c811ff4126753b5f

	Object	Action	Changes
~	QualityGate/default	update (adopt)	severity: null -> "high"

0 to create, 1 to update, 0 to delete, 0 unchanged

[0x73746F66]

Reuse review: no reinvented Vulnetix patterns found. The change stays inside the package it covers, uses stdlib/testify helpers already used by the repo's tests, and adds no new client, auth, config-schema or shared-package duplicate (checked internal/testutils and sibling repos). Rebased onto current main locally: go vet and go test pass for every touched package. The earlier red checks (CodeQL Analyze, Install a release with verified provenance, Lockfile) were GitHub API rate-limit failures, not code failures; this will be re-run on a rebased head before merge.

[github-actions]

Vulnetix config plan

Manager gitops:vulnetix/cli, prune off, plan hash a8bd984f1753c68b180298051dd9e2524ab644d2ebe9e4c7c811ff4126753b5f

	Object	Action	Changes
~	QualityGate/default	update (adopt)	severity: null -> "high"

0 to create, 1 to update, 0 to delete, 0 unchanged