@windyroad/risk-scorer 0.18.12 → 0.18.13-preview.1068
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/agents/pipeline.md
CHANGED
|
@@ -293,6 +293,18 @@ readiness may be listed separately as "post-release follow-ups" outside the
|
|
|
293
293
|
residual risk computation, but MUST NOT appear in a Controls list and MUST NOT
|
|
294
294
|
reduce any inherent risk score.
|
|
295
295
|
|
|
296
|
+
**Deferral is not a control.** Moving release metadata, leaving work on a
|
|
297
|
+
branch, or promising to ship it later does not remove or bound a hazard, so it
|
|
298
|
+
MUST NOT reduce the current action's residual risk. Score only the action in
|
|
299
|
+
scope; record deferred work separately rather than charging an unintegrated
|
|
300
|
+
future action to the current score.
|
|
301
|
+
|
|
302
|
+
Do not confuse deferral with genuine scope reduction. A small, complete,
|
|
303
|
+
independently releasable change can reduce accumulated risk and blast radius.
|
|
304
|
+
Prefer frequent small commits, pushes, and releases over batching. The test is
|
|
305
|
+
whether the current action is complete without the omitted work: if yes, scope
|
|
306
|
+
was reduced; if no, the hazard was merely deferred and earns no control credit.
|
|
307
|
+
|
|
296
308
|
### R009 control vocabulary — SKILL/agent-prose surfaces (P355 / RFC-012 / ADR-075)
|
|
297
309
|
|
|
298
310
|
For diffs touching `packages/*/skills/*/SKILL.md`, `packages/*/skills/*/REFERENCE.md`, or `packages/*/agents/*.md`, the **previously-irreducible R009 "no behavioural harness for the LLM-prose surface" floor is discharged** when a paired promptfoo Tier-A/B eval exists for the changed prose AND `npx promptfoo eval` passes on this commit. Credit it as a named likelihood-reducing control with the same evidence shape as behavioural bats:
|
package/package.json
CHANGED