# severity
critical
blocker
high
medium
low
nit
info

# effort
trivial
small
medium
large

# status
open
fixed
wont-fix
blocked
accepted
waived
retest-pass
retest-fail
still-open
needs-manual-verification

# code-prefix
# Finding-id prefixes the normalizer recognises. Each prefix scopes which
# downstream workflow consumes the finding. Extending this set is a framework
# PR: no project-side codes.
PEN-      # pentest findings (security workflow)
DT-       # design-test findings (design-system audit; issue #76)
HL-       # codebase-health findings (health workflow; issue #355; docs/health/<ts>.json)
MD-       # prospective module decisions (issue #80, Phase 1; .paqad/decisions/module-decisions/)
RS-       # rule-script drift findings (rules-as-scripts; issue #89; .paqad/scripts/rules/.cache/drift.json)
SM-       # site-map findings (site-map workflow; docs/site-map/<ts>.json). id is SM-<hash8>; the SM-* names below are category values.

# design-test category
# Categories used by DT-* findings. Each maps to one of the design-test skills
# or the documentation-drift cross-cut. See runtime/capabilities/coding/skills/design-test/SKILL.md.
token
component
state
a11y
responsive
motion
copy
performance
documentation-drift

# codebase-health category
# Categories used by HL-* findings. See runtime/capabilities/coding/skills/codebase-health/SKILL.md.
unused-dependency
vulnerable-dependency
deprecated-dependency
secret-leak
dead-code
duplication
stale-doc
ai-slop

# site-map category
# Categories used by SM-* findings (the finding id is a content-addressed SM-<hash8>;
# these are the `category` field values). See runtime/capabilities/coding/skills/site-map/SKILL.md.
# The SM-I18N-* and SM-FLAG-* families (addendum §2/§3) are deferred to a later phase.
SM-ADD
SM-REMOVE
SM-EDGE-STALE
SM-GUARD-DRIFT
SM-JOURNEY-BROKEN
SM-ORPHAN
SM-DEADEND
SM-EVIDENCE
SM-XREF
SM-GUARDLESS