[chubirka]

Classifier plan 05 — preserve the triage kind split in its direct consumer

The new triage shape is verdict: true_positive, kind: weakness for defense-in-depth gaps. collect_fast_track previously accepted every true_positive and fell back to the scanner's claimed severity; the actual pre-fix collector admitted an explicit weakness into vulnerability rule-mining seeds.

Exclude explicit weakness-kind triage findings from that existing collector. Explicit vulnerabilities and omitted-kind historical true positives retain existing eligibility; historical hardening stays excluded. No new mining policy, proof inference, scanner invocation, rule promotion or portfolio operation.

Verification

• Baseline real collector: explicit weakness was included; fixed real collector: excluded.
• Regression checks both retained eligible classes and excluded new/historical weakness shapes.
• Lint/format and full non-integration suite: 453 passed, 4 skipped, 5 subtests passed.
• Release gate passed against origin/development, with 0.39.5 metadata; no tag/release. The initial default gate compared against main's unrelated 0.47.0 line; the development-targeted comparison is the applicable gate and no gate logic was changed.
• Paired installed App/Core scan/triage CLI smoke passed on SQLite and PostgreSQL.

Review and scope

Targets development. Shaun review requested; do-not-merge/hold, no auto-merge. This safeguard should merge before the App activates new triage emissions; the producer PR adopts this exact Engine commit. Paired PR links follow. No unrelated reader/dashboard migration or SDK/private-importer work.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chubirka

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [chubirka]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chubirka]

Paired classifier plan-05 triage-source-kind reviews:

• Contracts: feat(triage): separate finding kind from final verdict traust-contracts#92
• Core: fix(triage): enforce independent kind at the canonical record door traust-core#253
• Engine: fix(triage): keep weaknesses out of vulnerability mining #118
• App: fix(triage): emit canonical verdicts with independent finding kind traust#300

Merge/reconcile contracts → Core; Engine safeguard must land before App adoption. Existing audit-producer App #297 (traust-security/traust#297) must also land before #300; retain those audit changes and #300's newer coordinated pins/version metadata. All new PRs target development, with Shaun requested, merge holds and auto-merge off. No main merge, tag or release.

Verification caveat, explicitly not a green full-Core PostgreSQL claim: the candidate's full PG suite had 2,581 passed, 3 skipped and one unchanged freshness-renderer failure at tests/v1/services/test_insight_freshness.py:222 ((150d)). The same exact PostgreSQL failure reproduced on pre-triage Core a1a2853d46e5c1dacdda28b70441bc30a92c236d; SQLite passed there. No assertion, skip or production freshness code was changed to hide it. The triage-related suite passed all 236 SQLite/PostgreSQL cases, and actual installed triage CLI record/replay/render/refusal passed both databases.

[chubirka]

Closing: this can't merge any more, and its intent has moved to traust-core.

• Why it can't merge: src/traust_engine/sweep/engine.py was deleted on development (engine#124, refactor(engine): ops/ only - delete the facade, locations and version shims (XWING-2440) #125) when the sweep and rule mining moved to traust-core (traust-core#256, DetectionQualityService.sweep_collect / mine_rules).
• What changed in scope: rather than keeping weaknesses out of mining, the owner decided (2026-10-28) that mining learns from confirmed weaknesses deliberately, as classes of their own. That's traust-core#270:
  • the corpus counts historical true_positive and hardening decisions as confirmed;
  • clusters split by kind;
  • weakness classes are covered only by metadata.kind: weakness rules;
  • those rules' hits become weakness-kind candidates.
• Rule-pack convention: traust#310.

🤖 Generated with Claude Code