fix(classifiers): cut over authored finding-kind output

CHANGELOG.md

@@ -15,6 +15,15 @@ All notable changes to Traust are documented here.
   `docs/external-dependencies.md`); an install without it reports Express as
   a coverage gap instead of listing its routes. Pins traust-core development
   `92a2655`.
+
+- Preserve explicitly authored finding kind through Core's report intake, without
+  inventing validity or execution proof. PQC hardening instructions now emit
+  `kind: weakness`, not a deprecated hardening validity label; existing findings,
+  historical report bytes and replay identities remain unchanged.
+  Duplicate fingerprints within one batch retain an agreed explicit kind in
+  either input order; conflicting explicit kinds refuse the entire batch
+  before insertion, without reclassifying previously stored findings.
+
 - **OWASP LLM categories are structured again.** `llm-application-review.md`
   records a finding's OWASP LLM Top 10 category in `owasp_llm_references`
   (for example `["LLM06"]`) instead of in the description; the check number

VERSION

@@ -1 +1 @@
-0.39.0
+0.39.1

docs/report-structure.md

@@ -40,6 +40,7 @@ projections.
 | `id` | Yes | Globally-unique **scan-scoped** ID `{REPO_SLUG}-{SHORTSHA}-{NNN}`. Provenance to an exact commit; unique across the corpus. Never reuse across scans. |
 | `fingerprint` | No (script-set) | **Cross-scan identity**: `sha256(canonical repo URL \| sorted lineless location paths \| primary CWE)`. Computed by python3 -m traust.cli corpus finding-identity (`fingerprint`/`backfill`) — never authored by the model, and the only implementation: consumers read this stamp and fail closed when it is absent. Correlates the same vulnerability across re-scans; the `rebaseline` command maps a superseded report's IDs to their successors via layer `metadata.finding_aliases`. A change to the recipe is a change to `ALGO_VERSION` paired with a re-stamp migration, never a silent regeneration. |
 | `title` | Yes | Short description (≥5 chars). |
+| `kind` | No | Explicit finding classification from the installed [finding-kind vocabulary](https://github.com/traust-security/traust-contracts/blob/development/enums/v1/finding-kind.json). Use it to distinguish a vulnerability from a defense-in-depth weakness; omission remains unknown. Kind is not a validity answer or evidence grade. Core intake preserves it for a new finding without reclassifying an existing one. |
 | `severity` | Yes | `critical` \| `high` \| `medium` \| `low` \| `informational`. |
 | `cwes` | Yes | ≥1 `CWE-NNN` identifiers; the first is the primary (feeds the fingerprint). |
 | `locations` | Yes | ≥1 objects with required `path`, optional `lines`, `description`. |

docs/skills.md

@@ -196,7 +196,7 @@ Assess a repository's post-quantum TLS readiness. Use when asked whether a repo
 
 ## secure-code-audit
 
-Use when the user asks to perform a security audit, security review, vulnerability assessment, or code analysis of a GitHub repository, operator, or batch of repositories using OWASP ASVS, OWASP Kubernetes Top 10, CIS Kubernetes Benchmark, DISA STIG, SLSA, OpenSSF Scorecard, SEI CERT coding standards (Java, C/C++), or PEACH tenant-isolation frameworks. Authors canonical remediation sizes or explicit unknowns, independently evidenced blocking, and explicit roadmap priorities for Core-recorded reports.
+Use when the user asks to perform a security audit, security review, vulnerability assessment, or code analysis of a GitHub repository, operator, or batch of repositories using OWASP ASVS, OWASP Kubernetes Top 10, CIS Kubernetes Benchmark, DISA STIG, SLSA, OpenSSF Scorecard, SEI CERT coding standards (Java, C/C++), or PEACH tenant-isolation frameworks. Authors canonical remediation sizes or explicit unknowns, independently evidenced blocking, and explicit roadmap priorities for Core-recorded reports. Keeps authored finding kind separate from validity and execution proof.
 
 - **Stage:** ③ Audit
 - **Tier:** `primary`

harnessing/3-audit/secure-code-audit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: secure-code-audit
-description: Use when the user asks to perform a security audit, security review, vulnerability assessment, or code analysis of a GitHub repository, operator, or batch of repositories using OWASP ASVS, OWASP Kubernetes Top 10, CIS Kubernetes Benchmark, DISA STIG, SLSA, OpenSSF Scorecard, SEI CERT coding standards (Java, C/C++), or PEACH tenant-isolation frameworks. Authors canonical remediation sizes or explicit unknowns, independently evidenced blocking, and explicit roadmap priorities for Core-recorded reports.
+description: Use when the user asks to perform a security audit, security review, vulnerability assessment, or code analysis of a GitHub repository, operator, or batch of repositories using OWASP ASVS, OWASP Kubernetes Top 10, CIS Kubernetes Benchmark, DISA STIG, SLSA, OpenSSF Scorecard, SEI CERT coding standards (Java, C/C++), or PEACH tenant-isolation frameworks. Authors canonical remediation sizes or explicit unknowns, independently evidenced blocking, and explicit roadmap priorities for Core-recorded reports. Keeps authored finding kind separate from validity and execution proof.
 metadata:
   harness.tier: "primary"
 allowed-tools:
@@ -1388,8 +1388,9 @@ Rules of the pass:
   signatures, DES/RC4) are ordinary findings today — severity per CVSS as
   usual, plus the `classically-broken` tag. Everything else PQC-tagged is
   **not a vulnerability**: a 2035-clock RSA key exchange is `severity:
-  informational`, `validation_status: hardening` unless some *other*
-  defect applies. Never inflate severity because of the quantum timeline.
+  informational`, `kind: weakness` unless some *other* defect applies.
+  Kind does not establish validity or execution evidence. Never emit
+  `validation_status: hardening` or inflate severity because of the quantum timeline.
 - A TLS config pinning groups without an ML-KEM option is
   `pqc-blocker-config` + `insecure-workload-config` or `cryptography`
   category — file it; these are the cheapest fleet-wide fixes.

pyproject.toml

@@ -7,7 +7,7 @@ name = "traust"
 # version must equal the VERSION file — check_docs_consistency.py
 # version-sync check fails the pre-push when they drift (and fails
 # closed if this field is removed)
-version = "0.39.0"
+version = "0.39.1"
 license = "Apache-2.0"
 description = "AI agent tooling for automated security audits of Red Hat Hybrid Platforms source code"
 requires-python = ">=3.11"
@@ -41,11 +41,11 @@ dev = ["ruff>=0.6", "pytest-xdist>=3", "psycopg[binary]>=3.1"]
 # traust's traust-core pin wins over the engine's, so a core bump needs no engine PR.
 [tool.uv]
 override-dependencies = [
-  "traust-core @ git+https://github.com/traust-security/traust-core.git@92a26552e01c80e816993982753f4b5e7a0ec720",
+  "traust-core @ git+https://github.com/traust-security/traust-core.git@f1d2d7233f66f704f0957462502f6c4eb55c57c9",
 ]
 
 [tool.uv.sources]
-traust-core = { git = "https://github.com/traust-security/traust-core.git", rev = "92a26552e01c80e816993982753f4b5e7a0ec720" }
+traust-core = { git = "https://github.com/traust-security/traust-core.git", rev = "f1d2d7233f66f704f0957462502f6c4eb55c57c9" }
 traust-engine = { git = "https://github.com/traust-security/traust-engine.git", rev = "40391187c2f2428d6da2999f7cc0fd55d49a3a44" }
 
 # Multi-skill CLIs live under src/traust/; harnessing/<skill>/ for single-skill

version.args

@@ -1 +1 @@
-VERSION=0.39.0
+VERSION=0.39.1