Add PVR triage taskflow

[anticomputer]

Taskflow for triaging Private Vulnerability Reports arriving as draft GHSAs.

Fetches the advisory, verifies the vulnerability claim against source code at the affected version (not HEAD), and writes a structured markdown triage report.

New files

• mcp_servers/pvr_ghsa.py - gh CLI-based MCP server; advisory fetch, version-to-SHA resolution, file fetch at ref, report save.
• toolboxes/pvr_ghsa.yaml - stdio wiring for pvr_ghsa
• personalities/pvr_analyst.yaml - triage analyst personality
• taskflows/pvr_triage/pvr_triage.yaml - 5-task pipeline
• configs/model_config_pvr_triage.yaml - claude-opus-4.6-1m (triage) + gpt-5-mini (extraction), temperature=1

Usage

python -m seclab_taskflow_agent \
  -t seclab_taskflows.taskflows.pvr_triage.pvr_triage \
  -g repo=owner/repo \
  -g ghsa=GHSA-xxxx-xxxx-xxxx

Requires GH_TOKEN (repo + security_events scope), AI_API_TOKEN, AI_API_ENDPOINT.

[Copilot]

Pull request overview

Adds a new “PVR triage” taskflow to triage Private Vulnerability Reports (draft repository GHSAs): fetch the advisory, verify claims against code at the affected version (not HEAD), and emit a structured markdown triage report.

Changes:

• Introduces a new pvr_ghsa MCP server (gh CLI-based) to fetch draft advisories, resolve version tags to SHAs, fetch file contents at a ref, and save a triage report.
• Adds a new 5-step pvr_triage taskflow plus a dedicated analyst personality and model configuration.
• Wires the new MCP server via a toolbox YAML.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
src/seclab_taskflows/toolboxes/pvr_ghsa.yaml	Adds toolbox wiring for the new PVR GHSA MCP server (stdio).
src/seclab_taskflows/taskflows/pvr_triage/pvr_triage.yaml	Defines the end-to-end PVR triage pipeline (fetch → verify → report → save).
src/seclab_taskflows/personalities/pvr_analyst.yaml	Adds a dedicated “PVR analyst” personality for evidence-based triage.
src/seclab_taskflows/mcp_servers/pvr_ghsa.py	Implements the gh CLI-backed MCP tools for advisory fetch/version resolution/file fetch/report save.
src/seclab_taskflows/configs/model_config_pvr_triage.yaml	Adds a taskflow-specific model mapping and temperatures.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.