CVSS severity consistent

The check is default-on, warning, verify stage. It walks every active KnownIssue (open / reviewed) that carries a CVSS vector which parses and yields a qualitative band. A KI whose status is fixed or withdrawn leaves the active set, so it is never flagged. Load failure is a fail. Zero CVSS-carrying KnownIssues is a pass that inspected nothing of this kind.

Every other severity-reconciliation surface in Proof is scoped to the high end. High severity reproducer grade reads severity, cve_surface, and severity_basis but never parses the vector. The severity-inflation policy only computes the over-rating direction, and only for high or critical labels. The known-issue mismatch nudge fires only for cve_surface in {likely, confirmed} and only at the two extreme corners. Downgrade the label to low, stamp severity_basis: reproducer, and the 9.8 rides along unread. That is the hole.

id: KI-C1
title: Unauthenticated SSRF via webhook URL
status: open
severity: low
severity_basis: reproducer
cvss: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This hop reads the vector directly. It is indifferent to severity_basis and cve_surface, so a reproducer stamp no longer buys silence. The label band is compared to the vector band. When the label sits strictly below the vector, the hop fires unless a reviewer stamped severity_bound.

Known issue severity prose consistent asks whether the title grade and the field name the same tier. It does not parse CVSS. Security relevance consistent asks whether a security-named KI still has a vector and a non-none surface. It does not grade the band against the label. KI-C1 can sit in .proof/known-issues/ labeled low, vector 9.8, and those hops stay green. That is the silent under-label.

proof known-issue edit KI-C1 --set-severity critical
proof audit --check cvss_severity_consistent

Raise the label to the vector band, or stamp severity_bound with a non-empty reviewer and rationale, or correct the vector if the reproducer disproved the worst-case theory. An anonymous note is not a waiver. Over-rating (a label above the vector) is owned by the inflation policy and is never flagged here. Filing the KI as fixed to silence a still-open under-label is not a close. Deleting the YAML also silences the hop. It destroys the finding rather than recording the decision.

The teaching graph is still one active KI next to an unread vector. Raise the label, or stamp why it is legitimately lower.

proof known-issue edit KI-C1 --set-severity critical

The other honest exit is a reviewer-owned bound. Both fields must be non-empty:

severity_bound:
  reviewer: leonid
  rationale: webhook needs a misconfig the product refuses

Prose grade stays on known issue severity prose consistent. Naming stays on security relevance consistent. High-severity reachability stays on high severity reproducer grade. Do not treat a FIRST CVSS explainer as this cell. Jama still authors. Proof vs Jama.

Warning severity. A counted finding does not block the audit. The hop does not fetch the tracker URL, re-run a PoC, or confirm the security claim is true. It fires only in the under-label direction. A label above the vector is owned by the inflation policy and is never flagged here. An empty vector is out of scope. An unparseable vector is skipped, not flagged. Zero CVSS-carrying KnownIssues is a pass that inspected nothing of this kind. Load failure is a fail. A severity_bound with no reviewer is not stamped. A warning is not a waiver: proof waive is a human authorization gate. The hop does not prove the Go. We have not scored this floor against a frozen Jama pack, a GitHub advisory export, or a FIRST CVSS pack. The loss is named, not scored.

The prose hop stays on known issue severity prose consistent. The naming hop stays on security relevance consistent. The engagement stays on software correctness audit. Jama still authors.

What is CVSS severity consistent? Same question. Same URL.

Is this high severity reproducer grade? No. That hop is whether a high or critical KI has a runnable witness. This hop is whether a low label still sits below its own vector. See high severity reproducer grade.

Is this known issue severity prose consistent? No. That hop is whether the title grade and the field name the same tier. This hop parses the vector. See known issue severity prose consistent.

Is this security relevance consistent? No. That hop is whether a security-named KI still has a vector and a non-none surface. This hop grades the band against the label. See security relevance consistent.

Does over-rating fire? No. A label above the vector is owned by the inflation policy. This hop never fires in that direction.

Does an unparseable vector fire? No. The hop skips a string it cannot parse. An empty vector is also out of scope.

Does a green hop prove the Go? No. The hop does not run the PoC. It does not fetch the tracker. It does not prove the function.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.