Repository navigation
perf(security): decide and render triage and invalidate as code - #1686
Merged
Merged
Conversation
github-actions
Bot
added
family:security
potiuk
force-pushed
the
perf/security-2-triage
branch
from
October 17, 2026 21:09
8a30f54 to
bc97734
Compare
13 tasks done
potiuk
force-pushed
the
perf/security-2-triage
branch
from
October 17, 2026 21:35
bc97734 to
6c5027c
Compare
A new issue-triage family in tools/security-management takes the rules of security-issue-triage that are pure functions of tracker state: the selector and its gh query (CVE token, scope label and bare --retriage refused), the Step 1 stop cases and the 20-issue GraphQL batches, the four-rule pre-flight skip (the mail rule in a second pass), the Step 2.6 precedent signal, the @-mention priorities and cap, the proposal layout with its class additions, the bare-name scrub, the Step 5 reply grammar and the Step 7 recap. The shared library gains readers for existing trackers: fields (through github-body-field's normalise and extract_field, fail closed), threads (the mailing-thread field as an import path, primary thread by relay signals), dispositions (the six classes and the proposal markers) and selectors. Classification, the Security Model quote, rating precedents, choosing routing candidates and flagging injection stay with the model. SKILL.md becomes a router (7,130 -> 6,050 tokens, 534 -> 396 lines); every heading and golden-rule headline is unchanged, and the failure-modes table moved byte-for-byte to outcomes/failure-modes.md. The step-1-selector, step-5-confirm and step-7-recap suites and cases 1-2 of step-6-body-scrub become pytest cases named after each former case; step-26 keeps its model suite and gains pinned signal tests. Behaviour changes: an undeclared scope label and a range wider than 1000 issues are refused; a reply that only skips, edits or re-classifies, or that lists and skips the same item, is ambiguous and posts nothing; edited and re-classified items are re-drafted before they post (post_now); a proposal with a CVSS severity, more than 3 handles, a handle off the roster or an INFO-ONLY heading missing from canned-responses.md is refused; an UNCERTAIN proposal opens with the low-confidence line and keeps a tentative class so the pre-flight skip can read it. The issue-import-from-md renderer is reformatted (ruff format --check failed on it). Part of #1672 Generated-by: Claude Opus 5
…as code A new issue-invalidate family in tools/security-management takes the rules of security-issue-invalidate that are pure functions of tracker state: the selector (single, list or range, `invalidate proposed` with its 1000 cap and batched read), the team-consensus check, the Step 0 hard stops, the Step 2 import path and reply thread (read through github-body-field, relay threads excluded), the label change, the board queries, the Step 5d draft plan and a grep of the composed reply, the closing comment, the rollup entry, the 5f confirmation forms, the 6a-6g apply order and the recap. Mining the reasoning, choosing the canned section and writing the reply stay with the model. SKILL.md becomes a router (7,582 -> 5,875 tokens, 519 -> 408 lines); every heading and golden-rule headline is unchanged, and the hard-stop table, the import-path table, the closing-comment and rollup-entry shapes and the failure-modes table moved byte-for-byte to outcomes/ (relative links re-rooted). The step-2, 5a, 5b, 5d, 5e, 5f and 7 suites become pytest cases named after each former case; step-3 and step-4 stay model evals. Behaviour changes: only an INVALID proposal by a roster member counts for `invalidate proposed`, and its thumbs-up or acknowledgement must come from another roster member; a field github-body-field will not decide on stops the close instead of reading as empty; the closing comment says where the draft is for Maildir and forwarder drafts too; the rollup entry is refused without a Reporter-notification case, and a duplicate's line names the canonical CVE; the drafting backend falls back to claude_ai_mcp only without OAuth credentials and with no link in the body, and refuses otherwise; `email:` is ambiguous when no draft is proposed; a composed reply is checked for tracker references, the CVE-tool URL, CVSS, re-opening phrases and other ASF project names before it is drafted. Part of #1672 Generated-by: Claude Opus 5
potiuk
force-pushed
the
perf/security-2-triage
branch
from
October 18, 2026 12:59
6c5027c to
52530e0
Compare
github-actions
Bot
added
the
substrate:analytics
This was referenced Oct 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Layer 2 of the security-family deep split (#1672), stacked on #1680.
security-issue-triageandsecurity-issue-invalidatemove their deterministic rules intotools/security-management(two new CLI families over the shared library); classification, reasoning, Security-Model quotes and the choice of canned response stay with the model. Tracker bodies are read only throughgithub-body-field, the one fail-closed parser from #1680.measured_tokensmain → branchsecurity-issue-triagesecurity-issue-invalidatefields(fail-closed body reads),threads(primary-thread choice by relay signals),dispositions,selectors.Type of change
.claude/skills/<name>/) — eval fixtures updated belowtools/*/withpyproject.toml)Test plan
security-issue-triage19/19,security-issue-invalidate7/7 (one triage case errored once on a CLI exit and passed on re-run). Deterministic suites became pytest cases named after the former cases.security-managementpytest on perf(security): decide and render the five import skills as code, and read tracker fields through one normaliser #1680's rebased head;skill-surface-hashin sync without--fix;skill-token-count,check-family-plugins; all pre-commit hooksRFC-AI-0004 compliance
Linked issues
Part of #1672. Depends on #1680.
Notes for reviewers (optional)
Rebased onto #1680's new head (itself rebased onto
mainwith #1683); the token stamps moved withmain's longertracker-backendblock.Behaviour changes:
security-issue-triageis about 470 tokens over the ~5,850 target; the generated pre-flight and tracker-backend blocks are a floor.issue_import_from_md/render.py.Generative AI disclosure: prepared with Claude Code (Claude Opus 5); reviewed by the author.
🤖 Generated with Claude Code