docs: Release Lifecycle Standard v1.3 — audit finding-identifier convention (§2.8)#62
Merged
Merged
Conversation
…ention (§2.8) Two id lineages coexisted across the family (ClotoCore audits: H-NN/M-NN severity initials; the cpersona b1q audit: C## cluster numbers) and the collision produced a real severity misread during the 2.5.2a2 remediation review, alongside audit working ids leaking into code comments, test names, and registry patterns as pseudo-markers. v1.3 standardizes: severity-initial report ids (C- reserved for CRITICAL), canonical registry ids only in the tree, and canonical assignment before fix implementation. Adoption registry rows updated for both pilots. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds §2.8 to the Release Lifecycle Standard and bumps it to v1.3 (canonical home; both pilot repositories' adoption rows updated):
M-144= registry entrybug-144at MEDIUM (C-CRITICAL /H-/M-/L-; the prefix is a writing-time snapshot, the registry field stays authoritative). No per-audit numbering space exists.bug-NNN) enter the tree — code markers, test names, registry patterns (severity would go stale in code). Canonical ids are assigned at confirmation time (before fix implementation), so fix briefs, tests, registry entries, and the audit report's final version are all born canonical. Workflow-internal working ids never appear in the tree or as public report ids.Why
During the 2.5.2a2 remediation review, two naming lineages collided: ClotoCore's audits use severity initials (
H-10,M-27) while the cpersona b1q audit used cluster numbers (C07, whereC02was MEDIUM) — a cluster id was misread as CRITICAL. Separately, the remediation workflow's ephemeral cluster ids leaked into the tree as pseudo-markers (bug-C5,test_c8_*), requiring a canonicalization pass (PR #61, commit 8791499). §2.8 closes both failure modes per the standard's own §6 defect procedure.Doc-only change; no behavior.
🤖 Generated with Claude Code