[matthewp]

Changes

• Adds advisory triage. When someone privately reports a vulnerability (repository_advisory.reported), a sandboxed agent triages the report and Factory posts the result to a private Discord channel. GitHub's API can't comment on advisories, so maintainers read it in Discord and decide what to post. Nothing is ever said to the reporter automatically.
• The bundled skills/advisory-triage/ skill assumes a report is not a vulnerability until exploitation is shown. The agent builds a reproduction, checks the repository's other advisories for duplicates and precedent, and returns a verdict (vulnerability, not-vulnerability, duplicate, needs-information), a full assessment, a draft reporter reply, and a fix brief another agent can implement. It never fixes anything.
• Discord flow: an announcement is posted when the report arrives and a thread is started from it. The result lands in the thread (assessment, reply, and fix brief attached, reply also inline), and the announcement is edited to show the verdict. Mentions are disabled on every message. The full result is also stored in PRIVATE_REPORTS under advisories/.
• New advisories section in factory.yml, on by default; the model defaults to triage.model. The checkout reuses triage's install and build commands. Requires the DISCORD_BOT_TOKEN secret (already set) and the DISCORD_SECURITY_CHANNEL_ID variable (set in wrangler.jsonc). The GitHub App must also subscribe to the Repository advisory event.

Testing

• tests/router.test.ts: reported advisories route to advisory triage; published and invalid GHSA ids don't.
• tests/advisory-contracts.test.ts: coordinator/agent/sandbox ids, and validation of the triage result.
• tests/advisory-output.test.ts: advisory normalization and rendering, known-advisory pagination, Discord message formatting (untrusted text neutralized, limits respected), destination config, and the bundled skill.
• tests/discord-client.test.ts: JSON and multipart posts with mentions disabled, nonce dedupe, thread recovery, error surfacing, and message splitting.
• tests/config.test.ts: updated for the new advisories defaults, plus override parsing.

Docs

• README documents the capability, the advisories config, and the Discord and GitHub App setup.