Add the assisted false-positive feedback flow - #8
Merged
Conversation
docs/feedback.md is the contract the assisted false-positive flow must implement: never automatic, one outbound channel, deterministic allowlist-built payloads, code context only through a user-authored browser form. README links it, SECURITY.md makes any outbound write beyond it an in-scope vulnerability, and the false-positive form's lens dropdown now matches the shipped dimension set. Signed-off-by: Michael Hohlios <michael@vyttle.com>
Implements the docs/feedback.md contract: - skills/reviso/feedback/build-payload.sh — deterministic payload builder. Tier-1 fields are enums or strictly patterned tokens; free text cannot enter the payload. Backstops veto secrets, high-entropy tokens, code fences, diff markers, path-shaped fields, and oversize payloads. --send posts the exact printed payload, pinned to Vyttle-LLC/reviso. Tier 2 never posts: it prints a prefilled false-positive form URL. - Step 6 / Stage 7 in the commands: feedback only when the user names a finding, payload shown before any send, gh deliberately not pre-approved. - eval/corpus/README.md documents eval-candidate issues as the intake queue. - docs/feedback.md and README updated from "planned" to shipped; CHANGELOG. Also created the false-positive / missed-finding / eval-candidate labels on the GitHub repo — the issue templates referenced them, but they didn't exist, so template labels were silently not applied. Signed-off-by: Michael Hohlios <michael@vyttle.com>
The plugin.json version field gates client updates: installed plugins only see a new version when it changes, no matter what lands on main. CHANGELOG's Unreleased section becomes the 0.2.0 release notes. Signed-off-by: Michael Hohlios <michael@vyttle.com>
Signed-off-by: Michael Hohlios <michael@vyttle.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
False-positive reports are the metric Reviso is tuned against, but filing one
means talking about your own code — high friction, and a real disclosure risk
if a tool automates it carelessly. This PR ships the assisted flow under a
written privacy contract:
docs/feedback.md— the contract. Never automatic; one outboundchannel (this repo's issue tracker); the model never composes an outbound
payload; code context only through a user-authored browser form. SECURITY.md
now lists any outbound write beyond it as an in-scope vulnerability.
skills/reviso/feedback/build-payload.sh— the deterministic builder.Tier-1 fields are enums or strictly patterned tokens (no free text
possible); backstops veto secrets, high-entropy tokens, code fences, diff
markers, path-shaped fields, and oversize payloads.
--sendposts theexact printed payload, pinned to
Vyttle-LLC/reviso. Tier 2 never posts —it prints a prefilled false-positive-form URL for the browser.
only when the user names a finding, payload shown verbatim before any
send,
ghdeliberately not pre-approved so the permission prompt is thelast gate.
eval/corpus/README.mddocumentseval-candidateissues as thecorpus intake queue; the false-positive form's lens dropdown now matches
the shipped dimension set.
plugin.jsonversion field gates client updates,so the bump is what makes this merge reach installed plugins. README now
tells users how to update.
Repo-side (already done, not in the diff): created the
false-positive,missed-finding, andeval-candidatelabels — the issue templatesreferenced them but they didn't exist, so template labels were silently
dropped.
Tested: 24-case battery over the builder — every enum rejection, every
backstop, determinism of reruns, and the long-path-doesn't-false-veto case.
All markdown lint-clean; detectors clean.
Does this change what Reviso says to people?
(The one-line feedback offer after a report is new wording, but no lens,
exclusion list, rubric, or detector changed — findings are identical.)
Checklist
git commit -s)