[potiuk]

Layer 5, the last skill of the security-family deep split (#1672), stacked on #1711: security-issue-fix's rule-shaped steps move into an issue-fix family of tools/security-management.

Step	Command	Decides / renders
Source control	flow	pull request, patch-then-commit (Subversion), or stop, from magpie-vcs fix-flow's exit and JSON
5a / 5c / 5f / 7 / 9	scrub	the forbidden-term check on every public surface — branch, title, body, commit message, newsfragment, comments
5e	backport	the backport labels for the milestone against the next main release, plus team-confirmed lines
6	parse-reply	the plan confirmation (shared.numbered)
7	review-plan	whether the adversarial reviewers run (a security skill runs them whenever one is listed), and the command
8 / 9 (Subversion)	svn-share, svn-gate	the private surfaces the patch goes to; the publication gate and the commit proposal
11	render-recap	the recap

The scrub is not a third copy of the 5c list. It runs magpie_vcs.publication.scrub — the check propose-commit already applies — through a typed wrapper, so security-management now depends on the magpie-vcs workspace member. It adds reporter names, verbatim private tracker text, and security as a word in a branch name. Exploitation detail and the "sensitive" wording stay the model's check.

SKILL.md becomes a router (7,435 → 7,331 tokens); the Step 0 checklist moved to outcomes/preflight.md behind a one-line summary of each check. The step-0-fix-flow, 5a, 5c, 5e, 5f, 6 and 11 suites become pytest cases named after each former case (tests/test_issue_fix.py), which also pins the deterministic parts of steps 7–9; the skill's model cases go from 50 to 31, and all 31 pass on a self-eval.

Behaviour changes

• A Subversion commit or new-branch command without --scrub is never shown.
• A newsfragment is never proposed by default, and one carrying security framing is flagged.
• The backport rule reads the next main release explicitly (main_version) instead of inferring it from the milestone name.

Spec security-issue-lifecycle describes the new family.

Part of #1672

Generative AI disclosure

Drafted with Claude Code (Claude Opus 5) and reviewed by the author.

🤖 Generated with Claude Code