Update triage state with issue #20 action and skip tracking

[BodenMcHale]

Summary

Update the triage state tracking file to record the latest triage session results, including a new action on issue #20 and expanded skip window tracking for multiple issues.

Key Changes

• Updated last_run timestamp from 2026-05-26T05:18:00Z to 2026-05-26T06:30:00Z
• Updated last_commit hash to reflect current state
• Added new action entry for issue [REVIEW] CSP: Content-Security-Policy-Report-Only is invisible to the analyzer — report-only deployments score 0/30 as if no CSP exists #20: verified Content-Security-Policy-Report-Only gap at src/rules.ts:42 with zero source/test coverage; posted substantive comment with fix path and priority rationale
• Expanded skipped array with 8 additional entries documenting:
  • Issues agent-escalate: Permissions-Policy rule should require camera/microphone/geolocation to award full score #4, [REVIEW] fetchHeaders: HEAD request systematically miss-grades sites that emit security headers only on GET #7: within 7-day skip window (acted on in this session)
  • Issues [REVIEW] Cross-Origin Policies: scored by presence only — unsafe-none / cross-origin get full credit #8, [REVIEW] CSP: wildcard (*) detection covers only default-src and script-src — connect-src *, form-action *, and mid-policy wildcards silently pass #16, [REVIEW] HSTS: max-age=0 (HSTS revocation) scores status 'good' due to bonus points from includeSubDomains and preload #17, [REVIEW] Referrer-Policy: no-referrer-when-downgrade classified as "strong" — awards full score for the historical browser default that leaks full URLs cross-origin #18, [REVIEW] CSP: missing form-action directive not flagged — default-src 'self' leaves form submissions unrestricted #19: within 48-hour skip window (recently commented)
  • Issue [REVIEW] Permissions-Policy tests: 4 assertions broken by merge regression — main branch CI is red #15: deprioritized in favor of [REVIEW] CSP: Content-Security-Policy-Report-Only is invisible to the analyzer — report-only deployments score 0/30 as if no CSP exists #20 (Priority 2 vs Priority 1 security bug)

Implementation Details

The triage state now maintains comprehensive tracking of:

• Recent actions taken on security and correctness issues
• Skip window enforcement to prevent duplicate triage efforts
• Priority-based decision rationale for issue selection

https://claude.ai/code/session_0197iFvKaV98wBtbcmT33mM8