security(kubescape): a framework-load failure must fail loudly, not read as a zero-finding clean result #3024

🤖 Generated by the Agentic Engineer

Problem

When the posture scanner cannot load its framework, it aborts and persists nothing — and the surfaces that consume its output cannot tell that apart from a healthy cluster with no findings. A broken scanner and a compliant cluster read identically.

That is what made #2933 silent for days: the CI posture gate stayed green throughout, and the stored scan data simply stopped moving. Repairing the immediate cause (#3023) restores scanning, but it does not make the next occurrence visible.

This criterion is called out on #2933 as the durable half, worth more than the immediate repair.

Expected behaviour

A scan run that fails to load its framework surfaces as a failure, not as a zero-finding clean result — loudly enough that it is noticed without anyone going to look.

Direction

Worth weighing, roughly increasing cost:

1. Alert on scan staleness. The cheapest reliable signal — the stored scan data has an age, and an age past roughly one scan interval means the scanner is not working, whatever the reason. Catches framework-load failures and every other abort cause with one rule.
2. Alert on the scanner's own failure log/metric, if it exposes one. More precise about cause, but only covers the causes it knows to report.
3. Fail closed on emptiness. Any consumer treating "zero findings" as a pass should require positive evidence that a scan ran — this is the same shape as the CI gate's existing liveness problem.

Option 1 gets most of the value and is the suggested starting point. Note the platform already has an alerting path (Alertmanager runs in the kubescape namespace).

Acceptance criteria

• A framework-load failure produces a visible signal rather than a silent zero
• The signal fires on scan staleness too, so any abort cause is covered, not just this one
• Proven by exercising the failure — not by reasoning that the rule would fire
• No consumer treats an empty/zero posture result as a pass without evidence a scan actually ran

Part of #2933.