Severity inflation

The finding kind is severity_inflation. It is emitted by proof known-issue check, not by proof audit --check. Pass --fail if you want the command to reject. It walks every KnownIssue whose status is open or reviewed and whose holistic severity is high or critical. A KI whose status is fixed or withdrawn leaves the pending queue, so it is never flagged. A low or medium grade is out of scope by construction.

Every adjacent severity hop in Proof is scoped to a different direction or a different field. CVSS severity consistent fires only when the label sits below a parseable vector. It never flags over-rating. High severity reproducer grade asks whether a high or critical KI that named severity_basis: reproducer still has a resolving executed witness. It is quiet when the basis is holistic. Known issue severity prose consistent asks whether the title grade and the field name the same tier. It does not ask whether the field has a witness. Stamp critical, leave cve_surface at none, leave the vector empty, and those hops stay green. That is the hole.

id: KI-C2
title: Unauthenticated SSRF via webhook URL
status: open
severity: critical
severity_basis: holistic
cve_surface: none

This hop runs two rules. Rule A fires when every structural witness is absent: cve_surface is none, unlikely, or unset; severity_basis is neither risk nor reproducer; and no CVSS vector is recorded. Rule B fires when severity_basis is cvss and a valid vector rates two or more tiers below the holistic grade. A one-tier gap is tolerated. CVSS only scopes the security dimension, so a non-security lift of one notch is plausible. Two tiers is treated as suspect.

Four witnesses can keep Rule A quiet: cve_surface in possible / likely / confirmed; severity_basis: risk with a named non-security dimension; severity_basis: reproducer (the dedicated reproducer-grade hop owns whether the manifest resolves); or a CVSS vector. cve_surface: not_assessed is an honest mid-triage state and is never treated as a missing witness.

proof known-issue edit KI-C2 --set-severity medium
proof known-issue check --fail

Re-grade the severity, or attribute the basis to a named risk dimension, or attach an executed witness and name reproducer, or raise the surface and record a vector. Filing the KI as fixed to silence a still-open over-rate is not a close. Deleting the YAML also silences the hop. It destroys the finding rather than recording the decision.

The teaching graph is still one active KI next to a grade with no witness. Lower the label, or name the witness.

proof known-issue edit KI-C2 --set-severity medium

The other honest exits attribute a real basis:

proof known-issue edit KI-C2 --set-severity-basis risk --set-risk correctness
proof known-issue edit KI-C2 --set-cve-surface possible

Under-label stays on CVSS severity consistent. Prose grade stays on known issue severity prose consistent. High-severity reachability stays on high severity reproducer grade. Do not treat a FIRST CVSS explainer as this cell. Jama still authors. Proof vs Jama.

The hop does not fetch the tracker URL, re-run a PoC, or confirm the security claim is true. It fires only in the high/critical band. A low or medium KI cannot be inflated in this sense. cve_surface: not_assessed is quiet on purpose. A one-tier CVSS gap is quiet on purpose. A malformed vector does not fire Rule B. A risk basis is quiet even when the surface is none. A reproducer basis is quiet here; whether the manifest resolves is a different hop. Zero in-scope KnownIssues is a pass that inspected nothing of this kind. A finding is not a waiver: proof waive is a human authorization gate. The hop does not prove the Go. We have not scored this floor against a frozen Jama pack, a GitHub advisory export, or a FIRST CVSS pack. The loss is named, not scored.

The under-label hop stays on CVSS severity consistent. The prose hop stays on known issue severity prose consistent. The engagement stays on software correctness audit. Jama still authors.

What is severity inflation? Same question. Same URL.

Is this CVSS severity consistent? No. That hop is whether a label sits below a parseable vector. This hop is whether a high or critical label has a witness, or a CVSS basis two or more tiers below. See CVSS severity consistent.

Is this high severity reproducer grade? No. That hop is whether a named reproducer still resolves. This hop is quiet when the basis is reproducer. See high severity reproducer grade.

Is this known issue severity prose consistent? No. That hop is whether the title grade and the field name the same tier. This hop asks whether the field has a witness. See known issue severity prose consistent.

Does under-rating fire? No. A label below the vector is owned by CVSS severity consistent. This hop never fires in that direction.

Does a one-tier CVSS gap fire? No. Two or more tiers. A one-notch lift from a non-security dimension is tolerated.

Does not_assessed fire? No. That value means the surface has not been looked at yet. The hop does not punish mid-triage.

Does a green hop prove the Go? No. The hop does not run the PoC. It does not fetch the tracker. It does not prove the function.

Is Proof a Jama alternative for the shall? No. Jama still authors. Proof vs Jama.