[chubirka]

Classifier plan 05 — triage-source-kind producer/adoption

Produces the approved separate shape: verified defense-in-depth gaps emit verdict: true_positive, kind: weakness, null severity and rule 13. confirmed remains the recorded decision validity, not a triage verdict. Proven exploitable findings can explicitly carry vulnerability kind; unknown kind stays omitted.

• Keeps verifier HARDENING vote labels/counters, dissent/escalation, refutation and manual review intact. Final conclusions and disjoint summary counts no longer use deprecated verdict:hardening.
• Preserves weakness backlog versus vulnerability ranking/patch selection; known kind never manufactures proof for undetermined/manual-review outcomes. Resumed legacy checkpoints are interpreted in working state only, not rewritten as history.
• Updates affected triage, patch, team-report and secure-code downstream guidance. Machine schema comes from installed Core, not a second local schema copy. New claimed-severity output uses the existing canonical vocabulary without guessing unsupported native levels.
• Adopts exact tested Core/contracts and Engine revisions. Engine prevents the new TP+weakness shape from entering vulnerability rule-mining seeds; Core enforces serialized new-report admission, independent finding kind, citation routing, summary accounting and rendering.
• 0.39.2 metadata and generated skill reference updated. No tag/release or live portfolio operation.

Verification

• Full PostgreSQL-enabled App suite: 2,660 passed, 2 skipped.
• Lint/format, generated skill reference, docs consistency, content-license guard, pre-commit alignment/security/estate gates and release.py check passed.
• Actual installed triage prepare, reporting validate, triage record, record replay and triage render commands passed on SQLite and PostgreSQL. Exact installed Core commit was checked; confirmed weakness has retained kind/null severity; unknown-proof weakness queues review without a decision; source/stored bytes and replay IDs remain unchanged. Historical triage still validates/renders but cannot authorize a genuinely new deprecated admission.
• Contracts: 1,138 passed. Engine: 453 passed, 4 skipped, 5 subtests passed, plus development release gate.
• Core changed-path regressions: 236 passed across both databases. Full Core non-integration: 7,161 passed, 1 skipped. Full Core PostgreSQL integration: 2,581 passed, 3 skipped, 1 failure at unchanged freshness-renderer (150d) assertion; the same failure reproduced on pre-triage commit a1a2853d46e5c1dacdda28b70441bc30a92c236d. It is disclosed, not hidden/waived or repaired by changing that assertion.

Required review/merge order

All new PRs target development, with Shaun review requested, merge holds and auto-merge off. Contracts → Core; Engine safeguard must land before this App adoption.

Also requires existing audit-producer PR #297: #297 . It was still OPEN when this branch was prepared; Core/contracts audit prerequisites are already merged. This PR does not replace #297 or claim its producer changes are on development. Merge/reconcile #297 before this adoption, preserving its audit-producer changes and the newer coordinated pins/release metadata here. No main push/merge, history rewrite, OWASP/rating change, lambda policy, SDK port or private importer work.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: chubirka

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [chubirka]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chubirka]

Paired classifier plan-05 triage-source-kind reviews:

• Contracts: feat(triage): separate finding kind from final verdict traust-contracts#92
• Core: fix(triage): enforce independent kind at the canonical record door traust-core#253
• Engine: fix(triage): keep weaknesses out of vulnerability mining traust-engine#118
• App: fix(triage): emit canonical verdicts with independent finding kind #300

Merge/reconcile contracts → Core; Engine safeguard must land before App adoption. Existing audit-producer App #297 (#297) must also land before #300; retain those audit changes and #300's newer coordinated pins/version metadata. All new PRs target development, with Shaun requested, merge holds and auto-merge off. No main merge, tag or release.

Verification caveat, explicitly not a green full-Core PostgreSQL claim: the candidate's full PG suite had 2,581 passed, 3 skipped and one unchanged freshness-renderer failure at tests/v1/services/test_insight_freshness.py:222 ((150d)). The same exact PostgreSQL failure reproduced on pre-triage Core a1a2853d46e5c1dacdda28b70441bc30a92c236d; SQLite passed there. No assertion, skip or production freshness code was changed to hide it. The triage-related suite passed all 236 SQLite/PostgreSQL cases, and actual installed triage CLI record/replay/render/refusal passed both databases.

[chubirka]

Updated this adoption PR in c9621c4 to pin Core 77f276f543d4d9426a2535e770a56364e8428589 in both dependency declarations and the lockfile. This closes the interrupted-record kind-loss defect identified on Core #253: traust-security/traust-core#253 (comment) .

The fix commits explicit kinds with triage admission before per-finding decisions. Four new SQLite/PostgreSQL interruption/retry regressions failed before and pass after; 311 related Core cases passed, retaining the later-kind replay checks. Actual installed CLI processes were terminated before the first verdict and after one decision on both databases; ordinary retries preserved admitted kinds, original triage/decision IDs and raw artifact bytes. Installed Core commit was verified.

App verification after this pin update: 2,660 passed, 2 skipped; lint/format, docs consistency, license checks, pre-commit gates and release.py check passed. No new release/tag, schema/history migration, main push or merge. Existing audit-producer #297 prerequisite and Shaun merge holds remain; the unrelated Core full-PG freshness caveat is unchanged.

[chubirka]

Audit-producer prerequisite #297 is now merged and incorporated here. Reconciled current development (7eab0c4) with a normal merge commit 2014208; no rebase/force-push or upstream history rewrite.

Preserved the merged audit no-answer instructions, added triage-kind guidance without restoring the retired validity table, and retained recovery-safe Core 77f276f543d4d9426a2535e770a56364e8428589 plus Engine d31a6c9f79a1a0ff1a6e978e88e6f0a10703b144. The upstream Core f1d2d7 and Engine 5bd3ae9 prerequisites are ancestors of these candidates, not dropped or downgraded. Lockfile regenerated; 0.39.2 metadata retained.

Reverification after integration: 2,661 App tests passed, 2 skipped; lint/format, generated skills reference, docs/license, pre-commit and release metadata checks passed. Real installed CLI process-crash/retry scenarios passed again at both failure boundaries on SQLite and PostgreSQL, preserving admitted kinds, existing IDs, pending-review behavior and stored bytes. Core #253 still contains the atomic admission fix and the unchanged later-kind replay coverage.

No feature PR merged or main pushed by this work; Shaun review/merge holds remain. Prior comments saying #297 was still open are superseded by this reconciliation.

[smith-xyz]

this one lgtm!