[PR] perf(security-issue-sync): wording pass on the sibling files, with evals [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #1500:
URL: https://github.com/apache/magpie/pull/1500

   Wording pass on the sibling files of `security-issue-sync`, plus evals for the sections that had none (#1344 follow-up).
   
   ## Summary
   
   - **Wording.** `gather.md`, `signals-to-actions.md`, `apply-and-push.md`, `bulk-mode.md` and `github-advisory.md` get the style rules the maintainer approved for the `SKILL.md` files. Each line now holds one sentence, long inline rationale is cut to a clause, and rules restated from `SKILL.md`, `AGENTS.md` or the tool docs become pointers. Headings and fenced blocks are byte-identical. 235,260 → 211,177 characters, about 6k tokens less per full sync run. `next-step.md` is already tight and stays unchanged.
   - **Fixes while there:**
     - `apply-and-push.md`'s intro said six pre-push gates; Step 5b lists seven.
     - Two stale step references in `gather.md`.
     - An unescaped `|` in a `bulk-mode.md` table cell.
   - **New evals:** 23 cases in four suites pin the sections the wording pass changed that no eval covered. Expected values come from the text on `main`.
     - `step-1d-signals` (6)
     - `step-5b-push-decision` (6)
     - `step-bulk-selectors` (6)
     - `step-ghsa-access-tier` (5)
   - **Restored during review.** Writing the evals surfaced three places where the reworded text was weaker than `main`, and each is back to `main`'s wording:
     - **Cross-project callout in `gather.md`.** It is repeated there for subagents that load only that file, and the rewrite had shortened it to a pointer to `SKILL.md`.
     - **Collaborator-tier qualifier on the GHSA admin hand-off.** Without it the hand-off reads as unconditional. The model still answered correctly without it, so this restore is for clarity and no eval proves it.
     - **Lower-bound row:** "The proposal must surface both …".
   
   ## Test plan
   
   - [x] prek hooks on commit
   - [x] Full `security-issue-sync` suite before (`main`) and after: 47/48 both times. The same step-1f case-3 grader failure appears on `main`.
   - [x] The four new suites, on `main` and on this branch, all pass:
   
     | Suite | `main` | branch |
     |---|---|---|
     | 1d | 6/6 | 6/6 |
     | 5b | 6/6 | 6/6 |
     | bulk-selectors | 6/6 | 6/6 |
     | ghsa-access-tier | 5/5 | 5/5 |
   
     1d case-1 needed a test fix first. Its graded `notes` field kept failing on wording that meant the same thing ("all-versions-affected" vs "`< 3.2.2`"). The behaviour that field was checking ("show the current shape alongside the proposal") is now a strict field, and case 1 passed three runs in a row.
   
   Ambiguities found that this PR leaves alone, since they read the same on `main`:
   - **5b:** a `not-configured` session probe on a `fix released` run is told to "skip silently", while the only acceptable deferral requires an explicit blocker.
   - **bulk mode:** `dispatch-urgent` can never fire under first-match ordering.
   - **bulk mode:** it is unclear whether pre-flight skips apply to `sync CVE-…` selectors.
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] perf(security-issue-sync): wording pass on the sibling files, with evals [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #1500:
URL: https://github.com/apache/magpie/pull/1500


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org