[PR] perf(security-issue-deduplicate): decide and render the merge as code [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1707:
URL: https://github.com/apache/magpie/pull/1707

   Layer 4a of the security-family deep split (#1672), stacked on #1705 (cve-allocate): `security-issue-deduplicate`'s rule-shaped steps move into an `issue-deduplicate` family of `tools/security-management`. Sync (4b) follows separately.
   
   ## What moves to code
   
   | Step | Command | Decides / renders |
   |---|---|---|
   | Inputs | `selector` | the kept and dropped trackers, kept first; one tracker is refused (the kept side is the user's call) |
   | 1 | `classify` | both open, one shared scope label, neither `duplicate`; the CVE rules (a CVE only on the dropped side → swap, `public` → refuse, two CVEs → the kept one at least as far along, the dropped one retracted) |
   | 2 | `fields` | both bodies' template fields through github-body-field (fail closed), the CVE JSON attachment cut off, CWE conflict, severity-propagation risk |
   | 3 | `merge-body` | the kept body rewritten field by field with `replace_field` |
   | 4 | `render-rollup-kept`, `render-rollup-dropped` | both rollup entries |
   | 5 | `proposal`, `parse-reply`, `apply-plan` | items 1–7, the reply grammar, the per-backend apply order |
   | 6 | `render-recap` | the recap |
   
   The model keeps the root-cause judgement, the headline and analysis, and a merged summary or widened version range when the trackers disagree.
   
   **The merged body** is the kept body rewritten one field at a time with github-body-field's `replace_field`, which refuses a rewrite that would change any other field. The CVE JSON attachment, a project's extra fields and every unchanged value stay byte-exact.
   
   `shared.numbered` (the numbered-proposal reply grammar) and `shared.rollup.notification_line` move out of `cve_allocate`, so both skills use one copy.
   
   `SKILL.md` becomes a router (6,312 → 6,029 tokens); every heading and golden-rule headline is unchanged. The step-1 to step-6 model suites are now pytest cases named after each former case (`tests/test_issue_deduplicate.py`). A new `step-3-merge-inputs` model suite covers what the model still writes, and passes 3/3 on a self-eval.
   
   ## Behaviour changes
   
   - Reporter-supplied CVSS vectors, scores and severity labels are removed mechanically from the appended report, and listed for the user.
   - A dropped report cannot add, end or hide a field: field-ending and machine-marker lines are escaped, an unmatched `</details>` is defused, and a body github-body-field will not decide on is refused.
   - A CVE only on the dropped side, a dropped CVE further along than the kept one, or a tracker without exactly one scope label blocks the merge.
   - When both summaries or both version ranges differ, the model's merged value is required.
   - The apply plan is refused while a blocker (a CWE conflict) is open.
   - A list with a comment (*"1,2,3,4 — skip 5 and 6 for now"*) applies the list only when the comment names other items to hold them back.
   
   Spec `security-issue-lifecycle` describes the new family.
   
   Part of #1672
   
   ## Generative AI disclosure
   
   Drafted with Claude Code (Claude Opus 5) and reviewed by the author.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] perf(security-issue-deduplicate): decide and render the merge as code [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1707:
URL: https://github.com/apache/magpie/pull/1707


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org