From b55faf79d2f03e6692491e0ffcb6b76381783255 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=D0=94=D0=BC=D0=B8=D1=82=D1=80=D0=B8=D0=B9?= Date: Fri, 22 May 2026 17:30:16 +0300 Subject: [PATCH] tools(observer): +security category in classification-map for A8 infosec coverage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit После A8-эпика 21.05 (#68-73 ZAP/Nuclei/Ward + pdn-152fz/threat-model/security- go-live) у наблюдателя был пробел: classification-map не содержал security- категории. Реальный classifier (за май) выдаёт 10 значений (refactor/bugfix/ feature/planning/memory-sync/monitoring/other/cleanup/question/docs) — нет security. Поэтому missed-activations matcher НИКОГДА не рекомендовал A8-узлы и не мог флагнуть их пропуск. Заказчик подтвердил выбор «А — расширить». Добавлено: - "security": ["#73","#69","#68","#70","#71","#72"] — #73 security-go-live как orchestrator первый, далее CLI-инструменты #69/#68/#70, затем skill- audit #71/#72. Порядок — порядок приоритета рекомендации. Описание расширено: классификатор не имеет жёстко прописанного enum (brain-retro-analyzer.mjs:166 — это free judgment Claude'а при записи эпизода), добавление ключа в map делает его 'blessed'. Граница: "security" = задачи где ЦЕЛЬ верификация/улучшение безопасности (сканы/hardening/ аудиты/STRIDE/go-live); НЕ для bug-fix'ов в security-relevant коде (те остаются "bugfix"). Smoke: JSON валиден, vitest 9/9 passing — matcher работает с новым ключом. Связано: Pravila §16.4 (conditional rule), project_a8_infosec, A8 install- sync 21.05 push 3fc5501. Тулинг: tools/brain-retro-analyzer.mjs (читает), tools/missed-activations.mjs (matcher), tools/observer-coverage-checker.mjs (C5 surface в STATUS.md). LEFTHOOK_EXCLUDE=adr-judge: то же, что c5d360f/640ee51/8e910d02 (ReDoS). Co-Authored-By: Claude Opus 4.7 --- tools/observer-classification-map.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/observer-classification-map.json b/tools/observer-classification-map.json index c281856a..63166eb3 100644 --- a/tools/observer-classification-map.json +++ b/tools/observer-classification-map.json @@ -1,6 +1,6 @@ { "$schema_version": 1, - "description": "Mapping from observer transcript-parser task_classification values to recommended Tooling Прил.Н node IDs. Source of truth for missed-activation detection (Pravila §16.4 conditional rule). 'other' deliberately empty — no recommendation, never counts as missed. DEFERRED-узлы filtered out by .node-dormancy.json at runtime.", + "description": "Mapping from observer transcript-parser task_classification values to recommended Tooling Прил.Н node IDs. Source of truth for missed-activation detection (Pravila §16.4 conditional rule). 'other' deliberately empty — no recommendation, never counts as missed. DEFERRED-узлы filtered out by .node-dormancy.json at runtime. Classifier vocabulary is Claude's free judgment when writing the episode (no hardcoded enum) — adding a key here makes it 'blessed'. 'security' added 22.05.2026 (A8 follow-up): use when the PURPOSE of the task is verifying or improving security (scans, hardening, audits, threat modeling, go-live gates); NOT for bug-fixes that happen to be in security-relevant code (those stay 'bugfix').", "map": { "refactor": ["#11", "#12", "#43", "#64", "#65"], "bugfix": ["#18", "#34"], @@ -9,6 +9,7 @@ "memory-sync": ["#33"], "monitoring": ["#34", "#35"], "analysis": ["#25", "#39", "#53"], + "security": ["#73", "#69", "#68", "#70", "#71", "#72"], "cleanup": ["#11", "#12"], "question": ["#60"], "other": []