Security relevance consistent

The check is default-on, warning, verify stage. It walks every active KnownIssue (open / reviewed). A KI whose status is fixed or withdrawn leaves the active set, so it is never flagged. Load failure is a fail. Zero security-named KnownIssues is a pass that inspected nothing of this kind.

Proof derives "security-relevant" from cve_surface. A finding whose name is SSRF, credential exfil, or auth-override, filed with cve_surface: none (or unset) and no CVSS vector, is invisible to every security audit even though the name is a security claim. No other hop reads the naming fields for those tokens. That is the hole.

id: KI-S1
title: Unauthenticated SSRF via webhook URL
status: open
severity: medium
cve_surface: none

The haystack is id, title, risk, and defect_class, lowercased, with underscores and spaces folded to hyphens. The tokens are ssrf, exfil, credential, auth-override, idor, cross-tenant, and secret. Description is not in the haystack. A sentence that reasons the finding is not SSRF still uses the word. Matching that sentence taught authors to stop writing the assessment. On the reference corpus, 24 of 38 records the old haystack called security-named matched only in prose. The hop reads the name, not the argument.

Known issue security remediation present asks whether a security-relevant KI has a containment field. It already treats a token in the name as security-relevant. Completeness only asks containment of a high-stakes KI. Neither hop asks whether the name still has a vector and a non-none surface. KI-S1 can sit in .proof/known-issues/ named SSRF, surface none, no vector, and the other hops stay green. That is the silent security-named case.

proof known-issue edit KI-S1 --cvss CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N --set-cve-surface possible
proof audit --check security_relevance_consistent

Both signals must be present, or a reviewer-stamped security_relevance_justification must record why not. Stamped means both reviewer and rationale are non-empty. An anonymous note is not a waiver. An unparseable CVSS string is a gap, same as a missing one. Filing the KI as fixed to silence a still-open security name is not a close. Deleting the YAML also silences the hop. It destroys the finding rather than putting it on the security lens.

The teaching graph is still one active security-named KI next to an empty surface. Read the name. Then attach the signals, or stamp a waiver with a name.

proof known-issue edit KI-S1 --cvss CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N --set-cve-surface possible

The other honest exit is a reviewer-owned justification. Both fields must be non-empty:

security_relevance_justification:
  reviewer: leonid
  rationale: token match is the product name SecretStore, not a secret leak

Containment stays on known issue security remediation present. Completeness stays on known issue complete. High-severity reachability stays on high severity reproducer grade. Do not treat a FIRST CVSS explainer as this cell. Jama still authors. Proof vs Jama.

Warning severity. A counted finding does not block the audit. The hop does not fetch the tracker URL, re-run a PoC, or confirm the security claim is true. It does not grade the CVSS band against the holistic severity label. That under-label direction is a different check. It does not read description: a token that only appears in the argument never qualifies. A KI whose title is clean is out of scope even if the prose discusses SSRF. Zero security-named KnownIssues is a pass that inspected nothing of this kind. Load failure is a fail. A whitespace-only vector is empty. An unparseable vector is a gap. A justification with no reviewer is not stamped. A warning is not a waiver: proof waive is a human authorization gate. The hop does not prove the Go. We have not scored this floor against a frozen Jama pack, a GitHub advisory export, or a FIRST CVSS pack. The loss is named, not scored.

The containment hop stays on known issue security remediation present. The completeness hop stays on known issue complete. The engagement stays on software correctness audit. Jama still authors.

What is security relevance consistent? Same question. Same URL.

Is this known issue security remediation present? No. That hop is whether a security-relevant KI has a containment field. This hop is whether a security-named KI still has a vector and a non-none surface. See known issue security remediation present.

Is this known issue complete? No. That hop is whether the record has evidence and an origin. This hop is the security signals on a named finding. See known issue complete.

Is this high severity reproducer grade? No. That hop is whether a high-stakes KI has a reproducer that meets the grade. This hop does not run a PoC. See high severity reproducer grade.

Does a token in the description fire? No. The haystack is id, title, risk, and defect_class. Description is the argument, not the name.

Does a green hop prove the Go? No. The hop does not run the PoC. It does not fetch the tracker. It does not prove the function.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.