ADR-005: Platform-Only Finding Generation
Decision to move all detection/finding logic to the platform evaluator and remove connector-side detectors
Decision to move all detection/finding logic to the platform evaluator and remove connector-side detectors
Separate two axes that the product had conflated: severity (how bad is this CLASS of problem if real — a stable taxonomy kept in the backend/API) and priority (how urgently a human must act on THIS instance — evidence-gated and displayed). Posture never escalates to Critical on its own; proof is observed, resource-scoped execution. Captures the decision behind sv0-platform PRs #1400/#1401 (issues #1397–#1399) and the #1395 UI swap.
Why SecurityV0's current resource identity model cannot support deterministic path-scoped execution evidence attribution, and a proposal to introduce a first-class canonical resource_key on both entities and evidence records.
Comprehensive implementation plan synthesizing workload rename, W1 evaluator rules, risk cluster computation, exposure concept, posture summary, and full UX redesign