[lukaszlenart]

What

Three edits to triaging-security-reports, each driven by a baseline failure observed while handling a batch of public Full Disclosure posts:

1. Notice subject and header — the subject recipe said <public id, where one exists>. For a mailing-list post agents either dropped the slot entirely or used the seclists archive path (2026/Nov/2) as if it were a date. The subject now takes the venue plus the post's own ISO publication date (Full Disclosure, 2026-10-29), or the advisory id for a scanner/CVE record; the header block is Report: <venue>, <YYYY-MM-DD>, <URL>.
2. Ticket before notice — "the hardening ticket, where one exists" let a notice go out as "tracked in the public issue tracker" with no id, to be rewritten once the ticket was filed. A ticket that is owed now exists before the notice is drafted; if none exists when the notice is requested, the deliverable is one line naming the ticket needed. A verdict that owes no change says so in one sentence.
3. Reply to the author of public posts — asked for the outcome reply to a reporter who had published and then asked about CVEs and credit, the agent explained the project's CVE policy, which decides the question the reply section reserves for the PMC. The section now says explaining the policy is answering, and gives the outcomes-only shape (verdict per post, tickets, notice to follow, security@ for new material, in a thread about the outcomes).

Plus three red flags and three rows in the mistakes table for the same three failures.

How it was tested

Three scenarios, prompts phrased as the real request ("draft the notice", "prepare what we owe on the user list", "draft the reply to the reporter"), each run once against main and once against this branch with a fresh subagent.

Scenario	Baseline (main)	With this change
Single FD post, no ticket	subject without venue or date; "tracked in the public issue tracker", no id	Full Disclosure, 2026-10-29: subject; checked Jira, named the ticket, stated it would have stopped at "ticket needed first" without one
Analysis post + PoC post	one joint notice (pass); subject without venue or date	one joint notice; both ISO dates in the subject; "No change to the framework follows"
Reply to the author of ten public posts	new thread (pass); paragraph explaining CVE policy, "a CVE with your name on it"	outcomes per post, "PMC decisions taken separately", no policy explained

Residual: the "no ticket yet → stop" branch was not exercised end to end, because the ticket for the scenario's bug was filed between writing the prompt and the run; the agent found it and said what it would have done otherwise.

Folding related posts into one notice and locating the Logging PMC's live examples both passed at baseline, so they got no new text.

Docs-only diff; security review not applicable.

🤖 Generated with Claude Code