Known issue security remediation present

The check is default-on, warning, verify stage. It walks every active KnownIssue (open / reviewed, plus a blank status). A KI whose status is fixed or withdrawn leaves the active set, so it is never flagged. Load failure is a fail. Zero active KnownIssues is a pass that inspected nothing.

Security-relevant is two independent limbs. Limb one: cve_surface is possible, likely, or confirmed. Limb two: the naming and classification fields match a security token. The tokens are ssrf, exfil, credential, auth-override, idor, cross-tenant, secret. The haystack is id, title, risk, and defect_class, lowercased, with underscores and spaces folded to hyphens. Description is not in the haystack. A sentence that reasons the finding is not SSRF still uses the word, and matching that sentence taught authors to stop writing the assessment. The hop reads the name, not the argument.

id: KI-S1
title: Unauthenticated SSRF via webhook URL
status: open
severity: medium
cve_surface: none

Known issue complete requires a mitigation or remediation only on a high-stakes KI: high or critical severity, or a non-none cve_surface. KI-S1 is medium, cve_surface: none, and still named SSRF. Completeness stays green. The suite can stay green. The YAML can sit in .proof/known-issues/ with a security claim and no recorded containment. That is the silent security-named case.

proof known-issue edit KI-S1 --remediation "block the webhook host allow-list"
proof audit --check known_issue_security_remediation_present

Either field clears the hop: a non-empty remediation, or a non-empty mitigation, after trim. A reviewer-stamped remediation_exemption also clears it. Stamped means both reviewer and rationale are non-empty. An anonymous note is not a waiver. A whitespace-only field is empty. Filing the KI as fixed to silence a still-open security claim is not a close. Deleting the YAML also silences the hop. It destroys the finding rather than documenting how it is held.

The teaching graph is still one active security-named KI next to an empty containment field. Read the finding. Then write how it is held, or stamp a waiver with a name.

proof known-issue edit KI-S1 --remediation "block the webhook host allow-list"
proof known-issue edit KI-S1 --mitigation "egress proxy denies non-allow-listed hosts"

The other honest exit is a reviewer-owned exemption. Both fields must be non-empty:

remediation_exemption:
  reviewer: leonid
  rationale: token match is the product name SecretStore, not a secret leak

Completeness stays on known issue complete. Review currency stays on known issues reviewed. Recheck schedule stays on known issue recheck due. Do not treat a Salesforce bulletin as this cell. Jama still authors. Proof vs Jama.

Warning severity. A counted finding does not block the audit. The hop does not fetch the tracker URL, re-run a PoC, or confirm the security claim is true. It does not parse CVSS. It does not read description: a token that only appears in the argument never qualifies. A KI whose title is clean and whose cve_surface is unset or none is out of scope even if the prose discusses SSRF. Zero active KnownIssues is a pass that inspected nothing. Load failure is a fail. A whitespace-only field is empty. An exemption with no reviewer is not stamped. A warning is not a waiver: proof waive is a human authorization gate. The hop does not prove the Go. We have not scored this floor against a frozen Jama pack, a GitHub advisory export, or a Salesforce status page. The loss is named, not scored.

The completeness hop stays on known issue complete. The review-date hop stays on known issues reviewed. The recheck hop stays on known issue recheck due. The engagement stays on software correctness audit. Jama still authors.

What is known issue security remediation present? Same question. Same URL.

Is this known issue complete? No. That hop is whether the record has evidence and an origin, and it only requires a containment field on a high-stakes KI. This hop extends that field to every security-relevant KI. See known issue complete.

Is this known issues reviewed? No. That hop is whether review_date is still current. This hop is whether a security-relevant KI has a containment field. See known issues reviewed.

Is this known issue recheck due? No. That hop is whether an upstream_report schedule has lapsed. This hop is the containment field. See known issue recheck due.

Is this a Salesforce known issue? No. Ads known issue is that status page. A hosted vendor bulletin is not this cell.

Does a missing known-issues directory fail? No. Zero active KnownIssues is a silent pass. Put a YAML there when you disclose, then write how it is held.

Does a token in the description fire? No. The haystack is id, title, risk, and defect_class. Description is the argument, not the name.

Does a green hop prove the Go? No. The hop does not run the PoC. It does not fetch the tracker. It does not prove the function.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.