feat(analysis): add internal risk score model

docs/specs/risk-model-v1.md

@@ -0,0 +1,77 @@
+# AgentShield risk model v1
+
+Status: internal golden model
+
+Model identifier: `agentshield-risk-v1`
+
+This document freezes the E.1 model selected under
+[`explainable-risk-score.md`](explainable-risk-score.md). The model is
+crate-private and is not emitted by any default or opt-in output in E.1.
+Findings remain the security facts; policy verdict and process exit status
+remain the only enforcement contract.
+
+## Inputs
+
+The model receives the final effective findings for the invocation and the scan
+root used by the existing finding fingerprint. CLI baseline filtering occurs
+before assessment. Exact duplicate fingerprints contribute once; conflicting
+duplicates retain the highest contribution.
+
+## Contributions
+
+| Severity | Weight |
+|---|---:|
+| info | 0 |
+| low | 1 |
+| medium | 4 |
+| high | 10 |
+| critical | 20 |
+
+| Confidence | Multiplier |
+|---|---:|
+| low | 1 |
+| medium | 2 |
+| high | 3 |
+
+For each unique fingerprint:
+
+```text
+points = severity_weight × confidence_multiplier
+```
+
+Contributions are ordered by fingerprint and contain only the fingerprint,
+rule identifier, effective severity, confidence and points. They never copy
+source, evidence, snippets or environment data.
+
+## Aggregation
+
+Let `S` be the checked sum of contribution points and `D = S + 30`.
+All division is flooring integer division:
+
+```text
+score = (100 × S + floor(D / 2)) / D
+score = min(score, 99)
+```
+
+This rounds the saturating rational value to the nearest integer, with ties
+rounded upward. The model never emits `100`.
+
+## Identity and comparison
+
+Every assessment includes:
+
+- `model_version`, fixed to `agentshield-risk-v1`;
+- `coverage_id`, a SHA-256 identity over the coverage schema, scanner version,
+  enabled Cargo features, and sorted participating rule IDs plus default
+  severities.
+
+Assessment comparison is rejected when model or coverage identifiers differ.
+Callers must additionally ensure compatible policy, baseline and path-filter
+contexts; E.1 does not expose a comparison UI.
+
+## Known limitation and release gate
+
+Fingerprint deduplication removes exact duplicates but does not prove semantic
+independence across different rules. Golden tests validate deterministic
+mechanics, not breach probability or real-world calibration. E.2 output remains
+blocked if representative correlated findings make the ranking misleading.

src/lib.rs

@@ -25,6 +25,7 @@ pub mod error;
 pub mod ir;
 pub mod output;
 pub mod parser;
+mod risk;
 pub mod rules;
 #[cfg(feature = "runtime-guard")]
 pub mod runtime;