uses(webapp, api).
uses(worker, queue).
uses(frontend, ui).
uses(webapp, auth).
uses(worker, openssl).
uses(frontend, css).
uses(webapp, openssl).
impacted_by(webapp, api).
impacted_by(worker, queue).
impacted_by(frontend, ui).
impacted_by(webapp, auth).
impacted_by(worker, openssl).
impacted_by(frontend, css).
impacted_by(webapp, openssl).
risk(worker, high).
risk(webapp, high).
mitigate(worker, cve_2026_0001).
mitigate(webapp, cve_2026_0001).
urgent_patch(webapp, openssl_3_0_14).
urgent_patch(worker, openssl_3_0_14).

clause(4, service(webapp), true).
clause(5, service(worker), true).
clause(6, service(frontend), true).
clause(7, critical(webapp), true).
clause(8, critical(worker), true).
clause(9, depends_on(webapp, api), true).
clause(10, depends_on(worker, queue), true).
clause(11, depends_on(frontend, ui), true).
clause(12, depends_on(api, auth), true).
clause(13, depends_on(auth, openssl), true).
clause(14, depends_on(queue, openssl), true).
clause(15, depends_on(ui, css), true).
clause(16, vulnerability(openssl, cve_2026_0001), true).
clause(17, cvss(cve_2026_0001, 9.8), true).
clause(18, fixed_by(cve_2026_0001, openssl_3_0_14), true).
clause(22,
       uses(var('Service'), var('Dependency')),
       (service(var('Service')), depends_on(var('Service'), var('Dependency')))).
clause(23,
       uses(var('Service'), var('Dependency')),
       (service(var('Service')),
        depends_on(var('Service'), var('Intermediate')),
        depends_on(var('Intermediate'), var('Dependency')))).
clause(24,
       uses(var('Service'), var('Dependency')),
       (service(var('Service')),
        depends_on(var('Service'), var('Intermediate')),
        depends_on(var('Intermediate'), var('Next')),
        depends_on(var('Next'), var('Dependency')))).
clause(25,
       impacted_by(var('Service'), var('Dependency')),
       uses(var('Service'), var('Dependency'))).
clause(26,
       exposed_to(var('Service'), var('Vulnerability')),
       (uses(var('Service'), var('Package')),
        vulnerability(var('Package'), var('Vulnerability')),
        cvss(var('Vulnerability'), var('Score')),
        var('Score') > 7.0)).
clause(27, risk(var('Service'), high), exposed_to(var('Service'), anonymous(1))).
clause(28,
       mitigate(var('Service'), var('Vulnerability')),
       exposed_to(var('Service'), var('Vulnerability'))).
clause(29,
       urgent_patch(var('Service'), var('Patch')),
       (critical(var('Service')),
        exposed_to(var('Service'), var('Vulnerability')),
        fixed_by(var('Vulnerability'), var('Patch')))).

step(uses(webapp, api),
     rule(22),
     ['Service' = webapp, 'Dependency' = api],
     [service(webapp), depends_on(webapp, api)]).
step(service(webapp), fact(4), [], []).
step(depends_on(webapp, api), fact(9), [], []).
step(uses(worker, queue),
     rule(22),
     ['Service' = worker, 'Dependency' = queue],
     [service(worker), depends_on(worker, queue)]).
step(service(worker), fact(5), [], []).
step(depends_on(worker, queue), fact(10), [], []).
step(uses(frontend, ui),
     rule(22),
     ['Service' = frontend, 'Dependency' = ui],
     [service(frontend), depends_on(frontend, ui)]).
step(service(frontend), fact(6), [], []).
step(depends_on(frontend, ui), fact(11), [], []).
step(uses(webapp, auth),
     rule(23),
     ['Service' = webapp, 'Dependency' = auth, 'Intermediate' = api],
     [service(webapp), depends_on(webapp, api), depends_on(api, auth)]).
step(depends_on(api, auth), fact(12), [], []).
step(uses(worker, openssl),
     rule(23),
     ['Service' = worker, 'Dependency' = openssl, 'Intermediate' = queue],
     [service(worker), depends_on(worker, queue), depends_on(queue, openssl)]).
step(depends_on(queue, openssl), fact(14), [], []).
step(uses(frontend, css),
     rule(23),
     ['Service' = frontend, 'Dependency' = css, 'Intermediate' = ui],
     [service(frontend), depends_on(frontend, ui), depends_on(ui, css)]).
step(depends_on(ui, css), fact(15), [], []).
step(uses(webapp, openssl),
     rule(24),
     ['Service' = webapp, 'Dependency' = openssl, 'Intermediate' = api, 'Next' = auth],
     [service(webapp),
      depends_on(webapp, api),
      depends_on(api, auth),
      depends_on(auth, openssl)]).
step(depends_on(auth, openssl), fact(13), [], []).
step(impacted_by(webapp, api),
     rule(25),
     ['Service' = webapp, 'Dependency' = api],
     [uses(webapp, api)]).
step(impacted_by(worker, queue),
     rule(25),
     ['Service' = worker, 'Dependency' = queue],
     [uses(worker, queue)]).
step(impacted_by(frontend, ui),
     rule(25),
     ['Service' = frontend, 'Dependency' = ui],
     [uses(frontend, ui)]).
step(impacted_by(webapp, auth),
     rule(25),
     ['Service' = webapp, 'Dependency' = auth],
     [uses(webapp, auth)]).
step(impacted_by(worker, openssl),
     rule(25),
     ['Service' = worker, 'Dependency' = openssl],
     [uses(worker, openssl)]).
step(impacted_by(frontend, css),
     rule(25),
     ['Service' = frontend, 'Dependency' = css],
     [uses(frontend, css)]).
step(impacted_by(webapp, openssl),
     rule(25),
     ['Service' = webapp, 'Dependency' = openssl],
     [uses(webapp, openssl)]).
step(risk(worker, high), rule(27), ['Service' = worker], [exposed_to(worker, cve_2026_0001)]).
step(exposed_to(worker, cve_2026_0001),
     rule(26),
     ['Service' = worker, 'Vulnerability' = cve_2026_0001, 'Package' = openssl, 'Score' = 9.8],
     [uses(worker, openssl),
      vulnerability(openssl, cve_2026_0001),
      cvss(cve_2026_0001, 9.8),
      9.8 > 7.0]).
step(vulnerability(openssl, cve_2026_0001), fact(16), [], []).
step(cvss(cve_2026_0001, 9.8), fact(17), [], []).
step(9.8 > 7.0, builtin, [], []).
step(risk(webapp, high), rule(27), ['Service' = webapp], [exposed_to(webapp, cve_2026_0001)]).
step(exposed_to(webapp, cve_2026_0001),
     rule(26),
     ['Service' = webapp, 'Vulnerability' = cve_2026_0001, 'Package' = openssl, 'Score' = 9.8],
     [uses(webapp, openssl),
      vulnerability(openssl, cve_2026_0001),
      cvss(cve_2026_0001, 9.8),
      9.8 > 7.0]).
step(mitigate(worker, cve_2026_0001),
     rule(28),
     ['Service' = worker, 'Vulnerability' = cve_2026_0001],
     [exposed_to(worker, cve_2026_0001)]).
step(mitigate(webapp, cve_2026_0001),
     rule(28),
     ['Service' = webapp, 'Vulnerability' = cve_2026_0001],
     [exposed_to(webapp, cve_2026_0001)]).
step(urgent_patch(webapp, openssl_3_0_14),
     rule(29),
     ['Service' = webapp, 'Patch' = openssl_3_0_14, 'Vulnerability' = cve_2026_0001],
     [critical(webapp),
      exposed_to(webapp, cve_2026_0001),
      fixed_by(cve_2026_0001, openssl_3_0_14)]).
step(critical(webapp), fact(7), [], []).
step(fixed_by(cve_2026_0001, openssl_3_0_14), fact(18), [], []).
step(urgent_patch(worker, openssl_3_0_14),
     rule(29),
     ['Service' = worker, 'Patch' = openssl_3_0_14, 'Vulnerability' = cve_2026_0001],
     [critical(worker),
      exposed_to(worker, cve_2026_0001),
      fixed_by(cve_2026_0001, openssl_3_0_14)]).
step(critical(worker), fact(8), [], []).