From 3f7d38de8fc6afe4893562e3336156c7a90f6586 Mon Sep 17 00:00:00 2001
From: george-keygraph <george@keygraph.io>
Date: Thu, 13 Aug 2026 15:38:20 -0700
Subject: [PATCH] docs(worker): correct stale rationale on the SARIF
 analysis-mode gate

The comment claimed analysis-only findings carry no severity. Since
v2.2.0 (#413) severity is recorded in both modes, so the technical
justification no longer holds. Record the actual remaining reason:
an analysis severity is assessed, not measured.

Comment only, no behavior change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 apps/worker/src/temporal/activities.ts | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/apps/worker/src/temporal/activities.ts b/apps/worker/src/temporal/activities.ts
index f121093..850bdbd 100644
--- a/apps/worker/src/temporal/activities.ts
+++ b/apps/worker/src/temporal/activities.ts
@@ -452,9 +452,11 @@ export async function runAuthzExploitAgent(input: ActivityInput): Promise<AgentM
 /**
  * Write report.sarif when the run is exploitative and the operator asked for it.
  *
- * Skipped entirely for analysis-only runs: those findings carry no severity, so every
- * `result.level` would be invented. Failures are logged and swallowed — the SARIF log is a
- * secondary artifact and must not fail a run whose report is already written.
+ * Skipped entirely for analysis-only runs. The original reason was that those findings carried
+ * no severity, so every `result.level` would have been invented; since severity is recorded in
+ * both modes an analysis run could now populate `level`, but it would report an assessed
+ * severity as a measured one, so the gate stays. Failures are logged and swallowed — the SARIF
+ * log is a secondary artifact and must not fail a run whose report is already written.
  */
 async function writeSarifIfEnabled(
   input: ActivityInput,