Repository navigation
A Triage of an existing Security finding fails: security-finding is rejected as its category #2018
Description
This was generated by AI during triage.
What happened
A Triage run on an existing Security finding issue fails after its session has finished the analysis. Four runs failed this way on 2026-11-10 (thirdshift 0.27.2, Claude Code, two hosts, three private repositories). Each ended with:
Triage analysis retained: … : the Triage category must be a repository category label, not a triage state or another factory label
Why
On a Security finding, the session gives security-finding as the recommendation's category, since that is the issue's own label. check_publication (src/triage.rs:~389) accepts only repository category labels. security-finding is a factory label, so it is rejected and the whole publication fails.
Impact
- The analysis survives only in the Command log. One of the four had produced five specific questions for the Day shift.
- Each failure leaves the finding labelled
ready-for-humanandagent-failed. That counts toward the repository's Failure limit, so Pickup and Triage stop taking work there.
Expected
Triage of a Security finding publishes. Either security-finding counts as that issue's category, the existing category is kept, or the Triage prompt for findings names an allowed category such as bug.
Related: #1972 (a Harness refusal on a Security finding fails Triage).
Activity
JacobStephens2 commentedon Nov 11, 2026
Agent Brief
Confirmed against selected Base main at de91156 (thirdshift 0.28.1). Fix the existing-issue Triage category guidance so Security findings produce valid recommendations while preserving factory-label protections.
Diagnosis: src/triage.rs:279 explicitly classifies security-finding as a factory label. check_publication at src/triage.rs:389 rejects it before existing::publish at src/triage/existing.rs:185 can preserve an existing category. Security finding creation at src/github/advisories.rs:772 supplies security-finding and needs-triage without a repository category. src/prompt.rs:66 gives existing-issue instructions without naming available categories; the embedded Triage skill does not explicitly identify security-finding as an invalid category.
Reproduction: a scratch executable reused tests/support::Scenario with fake GitHub and Harness adapters. For an existing private finding, returning category security-finding exits 1 with the reported error, posts zero comments, and leaves security-finding, ready-for-human and agent-failed. Adding an existing enhancement category does not prevent failure. Changing only the recommended category to bug exits 0, posts one comment, preserves security-finding and preserves enhancement when present. Both categories were also exercised under --recommend-only: the invalid category fails, the valid category succeeds, and neither mutates fake GitHub state. All eight cases matched these assertions.
Recommended implementation: supply actual repository category names, filtered through the existing factory-label exclusions, to the existing-issue investigation prompt. Explicitly explain that security-finding is a factory marker and that a valid repository category is required even when publication will preserve an existing category. Use bug as guidance only when it exists in that repository. Update src/prompt.rs and skills/thirdshift-triage/SKILL.md as appropriate. Preserve the shared category validator, existing category preservation, readiness permissions and private-finding notification protections.
Acceptance: regression coverage verifies the session receives valid category guidance for a finding with no category and one with an existing category; valid recommendations publish one comment without agent-failed; --recommend-only performs no writes; Report filing still rejects factory categories; private investigation text and questionnaires remain out of email. Regenerate affected prompt artifacts using UPDATE_PROMPTS=1 cargo test prompts_page and verify with cargo test prompts_page. Check relevant manual and hand-written site wording.
Validation completed: 12 tests passed across the factory-label rejection test, tests/triage_issue.rs and tests/triage_spec_regressions.rs; two subprocess entry points were intentionally ignored. scripts/affected-tests main reported no changed files. Source files and Git history remain unchanged.