Reproducing each finding #542

Parent

#427

What to build

After its audit, a Security run tries to reproduce each recorded Security finding, one session at a time, in a throwaway worktree detached at the audited commit.

The reproduction Session prompt carries the finding, read from its record. It asks the session to:

1. write a proof-of-concept test from the finding's validation plan, and run it against the untouched code, with harmless payloads only, never against a deployed site or a real third-party service;
2. if the test reproduces the finding, score its severity with the skill's own likelihood-and-impact rubric, and judge whether one session can hold the fix;
3. write the test's text to a file thirdshift names;
4. end on a final line: reproduced, with the severity and the size, or not reproduced.

thirdshift writes the outcome onto the record: the severity (the advisory's severity field, or a line in a private issue's body), the reproduction notes, and the test. An unreproduced finding keeps no severity.

Acceptance criteria

• After an audit, each recorded finding gets one reproduction session, in order, each in a fresh throwaway worktree.
• The prompt carries the finding and the rules above, and the Factory skills are linked into the worktree.
• A reproduced finding's record gets its severity, the reproduction notes and the test. An unreproduced one gets the notes and no severity.
• On a private repository, the outcome is written into the finding issue's body.
• Progress lines name each reproduction and its outcome.
• A session that ends without its final line leaves the record as it was, and the run's cause says so.