[cliffhall]

Closes #2880

Rewrites the security-advisory skill's landing step to the flow v2.14.0 / 1.0.4 actually used: fixes are developed and reviewed in the advisory's private fork, then land through an ordinary public PR, with normal CI, the required DCO / build checks, the Copilot loop and no ruleset changes.

Changes

• .claude/skills/security-advisory/SKILL.md
  • Step 5 is now "Land the fix on every affected line, release, publish". "Merging from the private fork" (ruleset surgery, unchecked commits, all fork PRs merging together) is replaced by "Landing through an ordinary public PR":
    1. convert the draft card to the v2 issue (or file the v1 issue on get tools working #11, cross-linked; delete the draft for a v1-only advisory), trimming the body first, with the trade-off that title and body go public before the advisory does
    2. push the fork branch publicly as v2/fix/<N>-<slug> / v1/fix/<N>-<slug>
    3. open an ordinary PR with Closes #N and follow /pr-flow
    4. merge, close the issue, move the card to Done, and close the fork PRs unmerged
  • Step 6 shrinks to updating the already-public issues after publication.
  • Intro, the flow table, the /pr-flow note, and step 1/3/4 pointers are updated to match.
• AGENTS.md: the GHSA-draft exception now says the card becomes public tracking when the reviewed fix is ready to land, not once the advisory is published. The Incoming invariant's milestone note is updated the same way.
• .claude/skills/release/SKILL.md: the v1 merge-order pointer and the --advisory note no longer describe fork merges.
• scripts/release-notes.mjs: the header comment is updated to match (comment only).

The skill's frontmatter description is unchanged, so the listing and the eval cases are unaffected.

🤖 Generated with Claude Code

[Copilot]

🟢 Approval recommended

No active review issues remain for the security-advisory procedure updates, which change only documentation and a script header comment.

No open issues 🎉

What changed in this PR

Updates the security-advisory procedure for #2880 so privately developed fixes land through ordinary public PRs, preserving normal CI, required checks, and review without changing branch rulesets.

Changes:

• Moves public issue creation to when the reviewed fix is ready to land, with guidance to remove sensitive details before disclosure.
• Documents public PR landing, closing private-fork PRs unmerged, and releasing every affected line before advisory publication.
• Aligns repository rules and release guidance; updates only the header comment in the release-notes script.

File	Description
scripts/​release-notes.mjs	Updates the explanatory comment for advisory fixes landing through public PRs; no runtime changes.
AGENTS.md	Aligns public tracking and milestone timing with fix readiness.
.claude/​skills/​security-advisory/​SKILL.md	Replaces private-fork merging with the ordinary public PR procedure and simplifies post-publication tracking.
.claude/​skills/​release/​SKILL.md	Updates advisory release-note guidance and the v1 landing procedure.

_{Review effort: Balanced}

[cliffhall]

Copilot review loop closed: round 1 was clean (no inline comments, no headline findings, no suppressed comments), so per pr-flow 7c no further round was requested.