Nothing today makes an agent check for an existing finding before
registering a new one, and the reporter has no duplicate or collapsing
rules. Duplicates burn reviewer trust on submission (programs read them
as noise or padding) and they inflate the task's apparent progress.
Changes:
- worker and pentest seeds: before report_finding, check
list_findings / list_task_findings for an existing finding with the
same root cause, endpoint, and parameter; the same defect again means
extending that finding's evidence, not registering a duplicate. A
genuinely distinct entry point, parameter, or privilege level remains
its own finding (the adversarial gate's anti-merge rule still holds:
the dedup check collapses only true duplicates).
- reporter seed: an explicit duplicate pass over list_task_findings in
the work steps, plus two discipline rules (no duplicate reports for an
already-reported defect; one finding per report, additional locations
of the same root cause listed inside it, never silently merged or spun
off).
- agent/finding_dedup_seed_test.go guards the markers.
BaaRai
02265524f2