Identify structurally unsupported severity claims

What the check reads

The policy runs through proof known-issue check for open or reviewed issues labeled high or critical. It reports no structural support when there is no CVSS vector, cve_surface is blank, none or unlikely, and severity_basis is neither risk nor reproducer. It separately reports a gap of two or more bands when severity_basis is cvss and the parsable vector computes below the label. One-band differences are deliberately not flagged by that comparison.

An illustrative case

Illustrative case: a record says critical and explicitly uses a CVSS basis, while its own vector computes to medium. Review the metrics and demonstrated consequence. A broader business-impact judgment may justify a different overall grade, but it should have the appropriate recorded basis and supporting argument rather than inheriting the CVSS label.

Resolve the finding

1. Inspect the finding kind and compare the label, basis, surface and vector with current evidence.
2. Correct unsupported claims or document the actual non-security risk or reproducer basis. Do not set a field merely to bypass the heuristic.
3. Run the KnownIssue checker again and retain the rationale for any regrade. Use the separate CVSS consistency check for the opposite, under-labeling direction.

proof known-issue check

Keep the conclusion bounded

This is a structural heuristic, not a complete severity assessment. An invalid vector or a field claiming a reproducer basis can escape parts of this rule and still need other checks. The command reports findings; exit behavior depends on its selected options, including whether failure enforcement is requested.

Continue with one real issue

Cvss severity consistent · High severity reproducer grade

Bring one finding, its requirement and the current evidence to scope a walkthrough of what your reviewer can establish and what still needs work.