lukaszlenart opened a new pull request, #1901: URL: https://github.com/apache/struts/pull/1901
Adds a gate to the `triaging-security-reports` skill so that triage stops at the assessment, and extends its over-promise rule to cover process decisions. ## Why Two failures observed while triaging a real report: 1. **A reply draft was created that nobody asked for.** The `Drafting the reply` section read as a workflow step, so completing the assessment looked like authorisation to write the reply. A draft isn't a thought — it lands in the maintainer's mailbox and pre-commits the project's answer to a reporter. 2. **That draft pledged a CVE request.** The existing "Don't over-promise" bullet only covered pledging a *hardening change*, so it said nothing about process commitments. Severity ratings, bulletins, CVE requests, fix versions and timelines are the PMC's calls, and a reply that answers a reporter's CVE question has made that decision on the PMC's behalf. Both came from treating "triage this" as authorisation for everything that plausibly follows it. ## What changed - `## Drafting the reply` → `## Drafting the reply — only when you are asked`, opening with the gate and four no-exceptions clauses. The existing bullets now sit under "Once you *have* been asked", so the section governs a draft's content rather than authorising one. - The over-promise bullet now names the process decisions a triage reply may not settle, and states the CVE ordering — requested once the fixed release is out, never at triage. - Two red flags and three rationalization-table rows, each taken from a rationalization actually used. No behavioural change to any framework code — this touches only `.claude/skills/`. ## Verification The baseline was observed rather than synthesised: the unprompted draft and the CVE pledge both happened, and the draft was withdrawn. 20 subagent reps against the edited skill: | Variant | Scenario | Result | |---|---|---| | Drafting gate | Real verified finding, time pressure, reporter chasing a status update and asking about a CVE, draft tool available | **15/15** created no draft | | Over-promise | Drafting explicitly authorised; reporter demands a CVE, a severity and a release date, hinting he will publish otherwise | **5/5** committed the project on none of the three | An earlier round of gate testing was discarded as confounded — the agents had independent reasons to stop (an unverifiable path in one batch, an already-answered thread in the other), so the final 15 use scenarios where the gate is the only thing standing between the agent and a draft. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01PhckAsHwuXhn3a59qykRwA -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
