Skip to content

Move the triage routing rule into docs/TRIAGE_RULES.md - #121

Open
emmanuelgjr wants to merge 1 commit into
mainfrom
docs/triage-rules
Open

emmanuelgjr wants to merge 1 commit into
mainfrom
docs/triage-rules

Conversation

@emmanuelgjr

Copy link
Copy Markdown
Contributor

Item 6 of the batch. Please do not merge until you have read it — no other changes are in this branch.

Why move it

The routing rule was written inside evals/EXTERNAL_BENCHMARKS.md (#118). That is the wrong home: the rule governs the incident index and the close-as-noted path at least as much as the catalogue, and someone deciding what to do with an incoming CVE has no reason to look in an evals file.

What changed

  • New docs/TRIAGE_RULES.md — the rule stated once: the one-line version (data/incidents.json records real-world deployment failures, nothing else), the default and its two exceptions, how CVEs are recorded (severity transcribed, basis quoted, confirmed_by empty, weak provenance stated in the record), what happens when an item blends categories or when a rule and its example disagree, and the line between what an agent may route and what stays a human judgment.
  • evals/EXTERNAL_BENCHMARKS.md — the section is moved, not copied: what remains is a one-line pointer, so the two files cannot drift apart.
  • GOVERNANCE.md — references it from Decision-making, beside the mapping-dispute path.

Text only. No data, schema, tooling or webapp changes.

Verification

Baseline before and after, identical:

Before After
validate.js 0 errors, 88 warnings, 327 passed 0 errors, 88 warnings, 327 passed
npm run test:scripts 85/85 85/85

All four relative links in the new file resolve (docs/EVIDENCE_METHODOLOGY.md, evals/EXTERNAL_BENCHMARKS.md, GOVERNANCE.md, and the pointer back).

🤖 Generated with Claude Code

The rule for where an incoming item goes was written down inside
evals/EXTERNAL_BENCHMARKS.md, which is the wrong home: it governs the incident
index and the close-as-noted path as much as the catalogue, and a reader
deciding what to do with a CVE has no reason to look in an evals file.

docs/TRIAGE_RULES.md now states it once — the default (note and close), the two
exceptions (append as a citation to a real-world failure, catalogue a published
benchmark), how CVEs are recorded, and what an agent may decide versus what is
reserved. The evals file keeps a one-line pointer rather than a copy, so the two
cannot drift apart. GOVERNANCE.md references it from the decision-making
section, next to the mapping-dispute path.

Text only; no data, schema or tooling changes.

Baseline before and after: 0 errors, 88 warnings, 327 passed; 85/85 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant