potiuk · Nov 5, 2026 · Nov 5, 2026 · Nov 5, 2026
diff --git a/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md b/plugins/magpie-issue/skills/fix-workflow/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-release-management/skills/announce-draft/site-bump.md b/plugins/magpie-release-management/skills/announce-draft/site-bump.md
@@ -70,8 +70,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-release-management/skills/audit-report/audit-log-pr.md b/plugins/magpie-release-management/skills/audit-report/audit-log-pr.md
@@ -56,8 +56,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-release-management/skills/prepare/automated-signing.md b/plugins/magpie-release-management/skills/prepare/automated-signing.md
@@ -95,8 +95,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-release-management/skills/prepare/post.md b/plugins/magpie-release-management/skills/prepare/post.md
@@ -63,8 +63,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-release-management/skills/prepare/prep.md b/plugins/magpie-release-management/skills/prepare/prep.md
@@ -134,8 +134,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md b/plugins/magpie-repo-health/skills/audit-finding-fix/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/...ie-security-tools/tools/security-management/src/security_management/cve_allocate/title.py b/...ie-security-tools/tools/security-management/src/security_management/cve_allocate/title.py
@@ -59,6 +59,8 @@ def _patterns(names: Sequence[str], short: Sequence[str], prefixes: Sequence[str
     for name in short:
         leading.append(rf"^[ \t]*{re.escape(name)}{_VERSION}[ \t]*{_MARK}[ \t]*")
         trailing.append(rf"[ \t]*\({re.escape(name)}{_VERSION}\)\.?[ \t]*$")
+        # The version is required: a bare short name may be a real noun in the title.
+        trailing.append(rf"[ \t]+in[ \t]+{re.escape(name)}[ \t]+v?\d+(?:\.\d+)*(?:\.x)?[ \t]*\.?$")
     # Reporter attribution belongs in the credits field; kept end-anchored because
     # the pattern is loose enough to eat a substantive clause mid-title.
     trailing.append(r"[ \t]*\([\w.][\w. -]*[ \t]+follow-up\)\.?[ \t]*$")

diff --git a/plugins/magpie-security/skills/issue-fix/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/issue-fix/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md b/plugins/magpie-security/skills/issue-import-from-pr/SKILL.md
@@ -20,7 +20,7 @@ argument-hint: "[pr-number] [repo:owner/name]"
 capability: capability:intake
 surface_hash: sha256:26be912ca52168e5
 license: Apache-2.0
-measured_tokens: 6431
+measured_tokens: 6441
 ---
 
 <!-- Placeholder convention (see AGENTS.md#placeholder-convention-used-in-skill-files):
@@ -324,7 +324,7 @@ Step 7e's tool writes the `<details>` envelope and creates the rollup with its m
 ## Step 6 — User confirmation
 
 This skill has no upstream clone and runs in the tracker checkout.
-Review the PR with `--target pr:<number> --repo <upstream>` and an empty temporary directory as `--repo-dir` — never the tracker checkout, which the tool refuses.
+Review the PR with `--target pr:<number> --repo <upstream>` and an export of the PR's head as `--repo-dir`, made as the review procedure below describes — never the tracker checkout, which the tool refuses.
 
 **Adversarial review by other models.** Run it now, per [pre-pr-adversarial-review.md](pre-pr-adversarial-review.md).
 

diff --git a/plugins/magpie-security/skills/issue-import-from-pr/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/issue-import-from-pr/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-security/skills/issue-import-from-scan/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/issue-import-from-scan/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.

diff --git a/plugins/magpie-security/skills/issue-sync/signals-to-actions.md b/plugins/magpie-security/skills/issue-sync/signals-to-actions.md
@@ -543,7 +543,7 @@ Group them by category:
   Re-read [`status-rollup.md` — The rollup comment shape](../../../../tools/github/status-rollup.md#the-rollup-comment-shape)
   before posting, and do not indent entries for "readability".
 
-- **Remediation-developer fill-fields, release-manager hand-off and publication-ready comments** — read [`release-manager-comments.md`](release-manager-comments.md) before proposing anything when this pass proposes `pr created` → `pr merged` or `pr merged` → `fix released`, when it proposes populating the *Public advisory URL* body field, or when the tracker already carries a `remediation-developer-fill-fields`, `release-manager-handoff` or `release-manager-publication-ready` marker comment.
+- **Remediation-developer fill-fields, release-manager hand-off and publication-ready comments** — read [`release-manager-comments.md`](release-manager-comments.md) before proposing anything when this pass proposes `pr created` → `pr merged`, on any open tracker labelled `pr merged` or `fix released`, even when a gate blocks the next label, when it proposes populating the *Public advisory URL* body field, or when the tracker already carries a `remediation-developer-fill-fields`, `release-manager-handoff` or `release-manager-publication-ready` marker comment.
 
 - **Advisory-records update and security-pages reminder comment** — on a closed-`announced` tracker from the Step 1g scan, read [`post-advisory-records.md`](post-advisory-records.md) before proposing anything.
 

diff --git a/plugins/magpie-security/skills/model-prepare/pre-pr-adversarial-review.md b/plugins/magpie-security/skills/model-prepare/pre-pr-adversarial-review.md
@@ -40,8 +40,23 @@ around that through the body file.
 **Where it runs.** `--repo-dir` is a checkout of the code under review —
 the reviewers can read every file in it. Never the project's private
 tracker: the tool refuses that checkout. With `--target pr:<number>` and
-no such checkout, create an empty temporary directory first, as its own
-command, and pass its path. When the change is not a committed local
+no such checkout, export the PR's head into a new temporary directory and
+pass that: an empty directory leaves the reviewers only the diff, so they
+cannot check a claim against the surrounding code, and no findings from them
+is not a clean review. Run each line as its own command, in a throwaway
+repository so nothing lands in the current one:
+
+```bash
+git init -q <scratch>/pr-<number>
+git -C <scratch>/pr-<number> fetch --depth=1 https://github.com/<owner/name>.git pull/<number>/head
+git -C <scratch>/pr-<number> archive FETCH_HEAD -- . ':(exclude).apache-magpie-overrides/tools/vetted-ops' | tar -x -C <export-dir>
+```
+
+Keep the exclusion: the secure setup denies writes to that path wherever it
+appears, so a full export fails partway through. The exported tree reaches
+the reviewers' providers, so export only a PR that is already public.
+
+When the change is not a committed local
 branch — a helper builds it elsewhere, or the skill applies file diffs
 through the API — save the diff to a file in a temporary directory and
 review it with `--target diff:<file>`.