An acceptance was keyed by rule, path and the sha1 of the stripped line, so two identical flagged lines in one file shared it: Experiment accepted a false positive at utils/docker/registry.py:105 and the real B310 at :78, same text, vanished from the score (2026-11-12). A row without context now accepts a finding only while no other finding of the scan shares its rule, path and text; accept --line binds a row to the sha1 of the five surrounding lines and is required when the line's text occurs more than once in the file, and refuses a --sha1 that is not that line's. Existing rows keep working on unique lines; the new test fails on master (100 percent, 2 accepted) and passes here (50, then 75 percent).
🎯 Fix: 93 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 89
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A MEDUSA finding without a line number (a Dockerfile-level rule, for example) had no fingerprint, so security.py accept could never waive it and the score stayed below 100 after review. Such a finding is now keyed by the sha1 of the whole file; any edit of the file brings it back.
🎯 Fix: 95 %
💥 Break: 2 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 93
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MEDUSA often fires several rules on one line (14 INF-SCAN rules on one tempfile line), so security.py accept now takes --rule repeatedly and appends one row per rule, same id formula, in one locked write; a single --rule works as before. The skill now allows an acceptance only once kvb-think-criticize judged the finding a false positive or by design, per the operator's order of 2026-11-05.
🎯 Fix: 96 %
💥 Break: 2 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 94
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
security.py runs medusa with HOME inside its temporary directory, since medusa creates ~/.medusa on start and the sandboxed home is read-only. security.py accept records a reviewed finding (rule, path, sha1 of the stripped line, reason) in <council root>/security-accepted.jsonl; the watch hook keeps it in ~/.local/state/agents-council/ next to the queue history, and a scan drops matching findings from the score as accepted until the line changes. Accepted so far: MEDUSA-MM-SCAN-058 x3 and MEDUSA-FTSCAN-231 x2 (false positives in tokens.py and score.py), WEB-CMDI-001 and SAST-EXEC-003 on watch.py shell=True (by design, operator config).
🎯 Fix: 93 %
💥 Break: 3 %
💸 Cost: 119 %
⏱️ Time: –
🛡️ Security: 100 %
💰 Value: ?
🏆 Score: 76
🚦 Gate: ⚠️ cost 119 % > 100: ask the operator before the commit
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
kvb-check-security gains security.py: it scans the changed files with MEDUSA, weights findings (critical -50, high -25, medium -10, low -2) and prints locations and counts only; without MEDUSA it asks for a review by hand passed as '~<n>'. kvb-check-score takes --security and --critical: the score multiplies by security/100, a critical finding blocks the commit (exit 4), security below 100 asks the operator like efficiency or speed over 100, and a 90/5 failure now lists every cause. --table and --commit-table print the values as markdown tables, shown before and after every commit.
make install installs MEDUSA with pipx unless it is on the PATH. The new kvb-think-choice skill offers open decisions as multiple choice and checkboxes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
