[chubirka]

Classifier plan 05 — finding_kind producer/adoption

Target development, not main. Required reviewer @smith-xyz. Keep the merge hold; no auto-merge.

Change

• Adopt Core #242 through the existing direct Core override and frozen lock; the Engine pin is intentionally unchanged.
• Replace the secure-code PQC instruction to emit hardening as a validity label with the existing kind: weakness representation; kind establishes neither validity nor execution evidence.
• Document the optional existing kind in the shared report authoring reference used by code/container/RPM producers, and regenerate the skill reference from frontmatter.
• Patch release metadata to 0.39.1; no tag or release is created.

No schema/vocabulary/database change, historical rewrite, OWASP-methodology change, new policy, or duplicate Core decision/review rule. Retains the newly merged Core-loader/grouped-ops implementation from development rather than restoring an older checkout.

Verification

• App lint/format and full suite: 2786 passed, 2 skipped, with PostgreSQL enabled.
• Actual installed/frozen App CLI against fresh SQLite and PostgreSQL stores: container/RPM authored kinds survive; omission stays unknown; no decision/evidence is invented; repeated runs keep assessment IDs; invalid hardening kind exits 2 without another assessment; original report bytes unchanged.
• Installed Core commit was checked, not a source-path override.
• Generated skill references are current; docs-consistency and content-license checks passed; release metadata check passed for 0.39.1. No release/tag was created.

This is one enum family and a complete finding-kind batch, not a claim that all classifier plan 05 acceptance is complete. Merge Core #242 first, then this adoption.

The remaining App skips are the bare operational-config template and absent universal-ctags, not skipped database coverage. PostgreSQL suite sessions use explicit UTC options.

Core dependency: f1d2d7233f66f704f0957462502f6c4eb55c57c9; Core #242 must land before this App adoption is merged. The PR is review-ready, not left as a dependency draft.

Current-development reconciliation

Retains App development through a5c5c3db49632e608a37e76151d6ae14b4737bba: grouped reporting/tool adapters and harness scripts stay on their new Core owners, with the incoming compliance assets intact. Conflicting pin/lock metadata was regenerated against the reconciled Core candidate rather than restoring old implementations. Full PostgreSQL-enabled App suite, docs/license/reference/version checks and installed container/RPM CLI smokes were rerun successfully. One documented A13 merge-only waiver covered upstream skill body command/prose changes; frontmatter and artifact wiring were retained and the generated reference was checked current. No source/test gate was bypassed.

Duplicate-fingerprint correction

Original Core #238 merged while this follow-up was being verified. Core #242 now owns the additional correction: reconcile explicitly agreed kinds per fingerprint before insertion, independent of candidate order; reject conflicting explicit kinds atomically at both check and accept; leave previously stored findings unchanged. This App head pins that exact corrected Core commit.

New permutation regressions: 20 passed across SQLite/PostgreSQL, including stored unknown/explicit classifications and no partial rows. Full corrected Core gates: 6884 unit tests passed (10 skipped), 2428 PostgreSQL cases passed (3 skipped); App full PostgreSQL-enabled suite remains 2786 passed (2 skipped). Installed container/RPM CLI on each backend passed four order/role cases and refused four conflicting order/role cases without partial records, with stable replay IDs and unchanged source bytes. Merge Core #242, then App #293; do not treat merged #238 as containing this follow-up.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chubirka

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [chubirka]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chubirka]

Development reconciliation is complete and pushed at 6d1ca71. GitHub reports this PR mergeable/clean and the needs-rebase label is gone. The Core pin is now the reconciled Core #238 head 0b9e50f6378ccc725b07dab6ded8194dd4a118eb, retaining the incoming storage-free APIs/error redaction as well as the finding-kind fix. All incoming grouped-CLI/tool/harness/compliance changes are retained. Rerun results: 2786 passed, 2 skipped with PostgreSQL enabled; lint, generated references, docs/licenses and 0.39.1 release metadata passed. Installed container/RPM CLI acceptance on both databases passed again. Review-ready, not a dependency draft; merge hold remains and auto-merge is off. Shaun reviews Core #238 first, then this adoption. This is one completed finding-kind batch of classifier plan 05, not completion of all classifier work.