security(meta_analyzer): preserve high-severity static findings from LLM suppression

[AbhiramDwivedi]

Closes #59

What

meta_analyzer.apply_filter() previously kept a static finding only if the LLM echoed it back as is_vulnerability=True with confidence ≥ 0.6 — so any finding the LLM omitted or denied was silently dropped, regardless of severity.

Because the LLM's input includes attacker-controlled skill content, a prompt-injection payload could make the LLM drop a real CRITICAL/HIGH static finding, hiding it from the report (a false negative in a security gate). This affects all providers.

Fix (severity-gated floor)

• CRITICAL/HIGH static findings are always kept. If the LLM confirms one, it's enriched as before; if not, the original finding is preserved and tagged llm-unconfirmed (now surfaced in Finding.to_dict() / JSON output).
• MEDIUM/LOW keep the existing LLM false-positive filtering.
• Rationale: in a security gate, a false negative (hiding a real CRITICAL) is far worse than a false positive.

Test

New tests cover CRITICAL/HIGH preserved+tagged, MEDIUM/LOW still filtered, confirmed-CRITICAL still enriched, and the tag surfacing via to_dict().

🤖 Generated with Claude Code

[rng1995]

Review: APPROVE

This is a well-reasoned fix for a real false-negative risk: because the LLM filter operates on attacker-controlled skill content, a prompt-injection payload could make it deny/omit a genuine high-severity static finding, and the old else: continue would silently drop it. Gating CRITICAL/HIGH static findings behind a preservation floor is the right call for a security gate.

Correctness

• The new branch lives entirely inside the existing else (the "not LLM-confirmed" path) and appends its own preserved Finding before continue, so it doesn't disturb the confirmed-enrichment path below. Confirmed CRITICAL/HIGH findings still take the enrichment route (verified by test_critical_confirmed_uses_llm_enrichment).
• The llm-unconfirmed tag is de-duplicated (if "llm-unconfirmed" not in unconfirmed_tags), and the original severity/message/confidence are preserved rather than overwritten with LLM values — exactly what you want for an unvalidated-but-retained finding.
• MEDIUM/LOW continue to be filtered as before; the floor is scoped to the two severities where a missed detection is most damaging.

Security

• Closes the stated suppression bypass without opening a new one: the floor is unconditional for CRITICAL/HIGH and independent of the LLM's is_vulnerability/confidence output, so injection can no longer hide those findings. Consumers can still tell validated vs. preserved findings apart via the tag.

Tests

• Good coverage: CRITICAL denied, HIGH omitted, MEDIUM/LOW still dropped, confirmed-CRITICAL still enriched, tag de-dup, and tag surfacing through to_dict(). The assertions match the described behavior.

Minor / optional (non-blocking)

• By design this widens the report surface (legitimately LLM-dismissed high-sev statics are now retained). That's the correct trade-off here, and the llm-unconfirmed tag mitigates it — just worth ensuring downstream consumers/severity gates treat the tag meaningfully rather than double-counting.
• The floor compares f.severity against a frozenset of string literals. Worth a quick confirm that severity is the same type in production as in the tests (plain string vs. a str-based enum) so the membership check can never silently miss; the current tests construct it as a string.
• to_dict() now always emits list(self.tags); fine as long as tags is guaranteed non-None for every Finding (it appears to default to a list).

Solid, minimal, and safe. Approving.