Finding triage

Route findings without inventing exceptions.

Locate the model fact, apply the fixed precedence, then check whether its provenance has enough authority to close.

First match wins

Canonical disposition order

KNOWN-NON-FINDING Exact, previously documented false positive
OUT-OF-MODEL: unsupported-component Affected component is explicitly outside supported scope
OUT-OF-MODEL: non-default-build Finding requires an unsupported or discouraged build
OUT-OF-MODEL: dependency-contract Root cause violates a documented dependency contract
OUT-OF-MODEL: trusted-input Finding requires control of an operand the model trusts
OUT-OF-MODEL: adversary-not-in-scope Required adversary capability is explicitly excluded
BY-DESIGN: property-disclaimed Finding concerns a property the project explicitly disclaims
VALID Finding violates a security property the project claims
VALID-HARDENING Useful defense-in-depth without a claimed-property violation
MODEL-GAP No existing disposition is licensed by the model

Interactive explainer

See how authority changes the outcome.

This illustrates the policy. Real triage must cite the exact licensing fact in the project’s model.

First matching model fact Apply the model’s precedence before selecting a route.

Provenance of the licensing fact

Triage policy

Illustrative result

MODEL-GAP

open

No existing disposition is licensed. Keep the finding open and revise the model.

## Before assigning a disposition 1. Locate the sink and affected component. 2. Identify the relevant input operand or output promise. 3. Check attacker capability, required build flags, and dependency boundaries. 4. Find the claimed or disclaimed property that actually governs the symptom. 5. Apply the precedence above and cite the licensing model section. 6. Check provenance before closing. An escalated finding keeps its identified disposition, but routes to a maintainer instead of closing. `MODEL-GAP` means the model itself needs revision; it is not a convenient fallback for difficult reports.