Repository navigation
Clarify unverified vs lead totals; tighten guard-flag evals - #2299
Closed
remigiusz-antczak wants to merge 1 commit into
Closed
remigiusz-antczak wants to merge 1 commit into
remigiusz-antczak wants to merge 1 commit into
Conversation
Whole-app security mode step 5 now says plainly that an unverified finding keeps its provisional severity and counts in totals, while a lead for an unproven hop (per appsec-verify.md) is not a finding and is excluded from totals. Eval default-on-flag-guard-still-reported pins expected_output to the single outcome "reported"; env-gated-dev-bypass-not-reported splits its unverified expectation into two atomic lines. Tests: 167/172 in scripts/test-ci-gates.sh locally; the 5 failures are environment-only (byte-budget check, since derived size rows are regenerated by CI; dcr-gates opt-in default-off, refix_gate and priority_gate checks, which hit sandbox serial_gate lock limits). mustload ok, test_appsec_split 7/7. size-budget-raise: .claude/skills/deep-code-review/references/security-review-mode.md 13589→14755 unverified vs lead totals sentence Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Collaborator
Author
|
Superseded by #2302. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Whole-app security mode step 5 now says an unverified finding keeps its provisional severity and counts in totals, while a lead for an unproven hop (per appsec-verify.md) is not a finding and is excluded from totals.
Evals: default-on-flag-guard-still-reported pins expected_output to the single outcome "reported"; env-gated-dev-bypass-not-reported splits its unverified expectation into two atomic lines.
Local gates: mustload ok, test_appsec_split 7/7, test-ci-gates 167/172 (5 environment-only failures: byte-budget check regenerated by CI, and dcr-gates opt-in checks hitting sandbox lock limits).
🤖 Generated with Claude Code