High severity reproducer grade

The check is default-on at error, verify stage. High-stakes means severity high or critical, or cve_surface of possible, likely, or confirmed. unlikely and not_assessed are out on their own. A high or critical row is still gated whatever the surface says. Withdrawn and fixed rows are ignored. Low and medium with no exploit surface are ignored.

This hop does not ask whether every KnownIssue has some evidence kind. That is known issue complete, a warning. It does not ask whether a high hazard class has a campaign YAML. That is high severity obligation without vector. A complete KI with severity_basis: cvss still fails here. Completeness is not this floor.

id: KI-H1
status: active
severity: high
severity_basis: holistic
cve_surface: possible

The suite can still be green. The row was authored. No resolving manifest ran. Zero high-stakes KnownIssues is a silent pass. That pass inspected nothing. Opt-out is skip, never pass.

proof known-issue edit KI-H1 --set-severity-basis reproducer --add-evidence-manifest tests/ki_h1_test.go:TestDeadlineCast
proof known-issue edit KI-H1 --set-tripwire-mutation "pack the deadline as int64 ticks"
proof audit --check high_severity_reproducer_grade

Attach a resolving witness, or lower the headline with a reason. Do not silence the gate so the hop goes green. A high-stakes claim with no executed witness is still a high-stakes claim.

The teaching graph is still one high-stakes KI next to one missing witness. Read the finding. Then attach a resolving manifest, or lower the grade with a reason.

proof known-issue edit KI-H1 --set-severity-basis reproducer --add-evidence-manifest tests/ki_h1_test.go:TestDeadlineCast
proof known-issue edit KI-H1 --set-tripwire-mutation "pack the deadline as int64 ticks"
proof evidence refresh
proof audit --check high_severity_reproducer_grade --verbose
proof help known-issue

Close a missing-basis finding by setting severity_basis: reproducer and attaching a path that resolves. Close a dangling-manifest finding by putting the file and the named symbol on disk. The hop does not ask whether the reproducer proves the headline versus a tripwire of a sub-fact. That remains reviewer judgment. Completeness stays on known issue complete. Campaign coverage stays on high severity obligation without vector. Do not treat a CVSS vector as an executed witness. Jama still authors. Proof vs Jama.

Error severity. Low and medium with no exploit surface are not gated. Withdrawn and fixed rows are ignored. cve_surface: unlikely and not_assessed are out on their own. Zero high-stakes KnownIssues is a pass that inspected nothing. Opt-out is project.checks.high_severity_reproducer_grade.enabled false. The hop reports skip, never pass, so a silenced check does not count toward the audit pass total. Presence plus grade plus resolvability is the floor. A tripwire of a sub-fact still resolves. The hop does not write the test. It does not run the reproducer. It does not inspect the implementation. We have not scored this floor against a frozen Jama pack, a CVSS workbook, or a Jira export. The loss is named, not scored.

The quality-floor hop stays on known issue complete. The campaign hop stays on high severity obligation without vector. The engagement stays on software correctness audit. Jama still authors.

What is high severity reproducer grade? Same question. Same URL.

Is this known issue complete? No. That hop is whether every active KI has some evidence kind. This hop is whether a high-stakes KI is graded by an executed witness. See known issue complete.

Is this high severity obligation without vector? No. That hop is whether a high hazard class has a campaign. This hop is whether a high-stakes KI ran. See high severity obligation without vector.

Is this a CVSS high? No. Ads and CVE pages own that score. A KnownIssue basis of reproducer is not that cell.

Does a missing known-issues directory fail? No. Zero high-stakes KnownIssues is a silent pass. Put a YAML there when the behavior is confirmed, then bind a resolving test before you raise it to high.

Does a high KI without a witness fail the merge? Yes. The check keeps error severity. Opt-out is skip, not pass.

Does a resolving test prove the headline? No. The hop checks presence, grade, and resolvability. Whether the witness proves the claim versus a tripwire of a sub-fact stays with the reviewer.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.