Severity Assessment

Rate how severe a finding or bug is if it is real, and emit one tier the caller acts on.

Severity is not confidence. confidence answers is this real / correct. severity answers how bad is it if it is. The two are orthogonal — a caller composes them (surface when severity clears the caller's bar for its tier AND confidence clears that bar). Never fold them into one number.

What is actually deterministic here. One thing: the path floor in Step 2 is an executable glob against the file path (a real case match), so it never depends on model judgment. The escalators (data-loss / security / concurrency shapes) are heuristic — an LLM reads the code shape. This is the honest split; do not call the escalators deterministic. It mirrors confidence's executable rule checks only for the path floor.

Contents