From 941c0e65d6d6b5dce7768dc1d58074640c4f47a6 Mon Sep 17 00:00:00 2001
From: REPPL <77722411+REPPL@users.noreply.github.com>
Date: Fri, 9 Oct 2026 10:21:23 +0100
Subject: [PATCH] chore: record the ruling on draining private security
 advisories

The product thinker ruled how private advisories are drained: a hand-run
drain recorded as an abcd lab now, a separate security-advisory drain
later, and fixes held locally that land together just before the release
that publishes the advisories. The remedy and a dated note on the issue
say so.

Refs: iss-2610090703514921
Assisted-by: Claude:claude-opus-5-5
---
 ...y-the-issue-ledger-so-security-advisories.md | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.abcd/work/issues/open/iss-2610090703514921-a-drain-reads-only-the-issue-ledger-so-security-advisories.md b/.abcd/work/issues/open/iss-2610090703514921-a-drain-reads-only-the-issue-ledger-so-security-advisories.md
index 400bbbe8d..a19677ec8 100644
--- a/.abcd/work/issues/open/iss-2610090703514921-a-drain-reads-only-the-issue-ledger-so-security-advisories.md
+++ b/.abcd/work/issues/open/iss-2610090703514921-a-drain-reads-only-the-issue-ledger-so-security-advisories.md
@@ -9,7 +9,22 @@ found_during: "2026-10-09 product thinker request after the v0.13.3 cut"
 origin: researcher-authored
 production_mode: hand-written
 found_at: "commands/drain.md"
-remedy: "Waits on the product thinker's ruling on how private advisories enter the drain's view: list them in the drain's plan from the forge without their content and always hand them back; keep a private mirror outside the public ledger that the drain reads; or file a content-free placeholder issue per advisory that the drain can route."
+remedy: "Ruled 2026-10-09 by the product thinker: private advisories get a separate security-advisory drain (for example `abcd drain --security`), distinct from the general drain, whose rule stays as it is; its design starts from a primary-source state-of-the-art check on coordinated disclosure, and its requirements are drawn from a hand-run drain recorded as an abcd lab. That hand-run drain keeps each advisory's issue out of the public ledger until its fix lands, holds the fixes on local branches, and lands them together just before the release cut that publishes the advisories."
 ---
 
 A drain reads only the issue ledger, so security advisories that others submit through the forge's private vulnerability reporting never reach it. Unpublished advisories are not named by any record, so nothing in abcd shows whether they were triaged. They cannot simply be copied into the ledger as issues, because the ledger is public and an advisory stays private until it is fixed; and even a ledger issue in the security category is handed back by the drain under its default rule.
+
+## Ruling 2026-10-09
+
+The product thinker ruled three things on 2026-10-09, after unpublished advisories on the forge were found that no record named:
+
+1. The first drain of private advisories is run by hand, outside `abcd drain`,
+   and recorded as an abcd lab: "this is an abcd lab to ensure we're on the
+   right track". The lab is lab-261009081338-7549ca2, in the user-level lab
+   store; its harvest lists the steps the hand-run drain did that a command
+   would have to do.
+2. Later, a separate security-advisory drain, distinct from the general drain
+   ("a future e.g. /abcd:drain --security or similar command"), designed after
+   a state-of-the-art check.
+3. The fixes are held on local branches and land together just before the
+   release cut that publishes the advisories.