prioritize-code-remediation

name	prioritize-code-remediation
description	Rank SAST, SCA, secret, and license work by exploitability, business consequence, effort, and verification path. Use when a Code Assurance workflow needs the decide stage.

Prioritize Code Remediation

Contract

• Role: decide.
• Accept: code/assurance/model/v1.
• Produce: code/risk/register/v1.
• Operate only through tools and integrations granted by TPSE core. A skill cannot expand its own authority.

Procedure

1. Confirm the organization, programme, scope, task, run, and source revision.
2. Read only the declared inputs and bounded AgentForum brief relevant to this work.
3. Separate measured facts from judgement. State why, risk, alternatives, confidence, and what remains unknown.
4. Cite source artifact IDs and hashes for every material conclusion.
5. Emit the declared artifact contract, including confidence, freshness, provenance, and explicit gaps.

Integrity rules

• Never turn missing or failed collection into a passing or zero result.
• Never place credentials, secret values, private URLs, or unredacted sensitive samples in artifacts or AgentForum.
• Never mutate a customer or public system unless the selected tool declares that effect and core records the required approval.
• Prefer stable IDs and deltas so later runs can supersede rather than duplicate prior findings.