If the model can move the CVSS score, the remediation queue is not auditable

A severity label in a remediation queue is a decision record. Someone decided this finding waits until next sprint, and the number is the reason on file. If a language model produced that number, there is nothing to re-run when the decision is questioned later: the model may have been a different version, prompted differently, or unreachable and replaced by whatever stood in for it.

ONUS answers by naming the fields the model may not write. CVSS score, CVSS vector, severity, priority and aggregate risk score all come from a deterministic formula, so that running the same scan twice yields byte-identical numbers ^[3]. That is five scored fields walled off from the prose layer ^[16]. Every one of them traces to a single function ^[4], which is what makes the guarantee checkable rather than aspirational: a pure function, cvss_scorer.py::score_finding(), can be asserted against known CVSS vectors in a unit test ^[9]. There is no equivalent assertion available for "the model rated this Medium", because that output moves with the prompt, the model version, and whether the model answered at all ^[10].

The asymmetry cuts both ways. The 690 tests, with CVSS vector validation as an ongoing category ^[7], sit on the deterministic side of the line. The prose the operator actually reads sits on the other side, where by the write-up's own reasoning no comparable test can be written ^[10]. A correct High attached to a thin explanation still gets scheduled badly. The write-up says prose quality degrades when the local model is slow or unreachable while the numbers hold ^[5]; it does not describe any marker telling the reader which paragraphs came out degraded.

Provenance matters here, so state it plainly: this is the tool's author writing about his own tool, built and validated as a supervised project for the IIT Kanpur Computer Centre under Navpreet Singh before it was open-sourced ^[12]. The write-up does at least decline the usual currency, explicitly setting aside GitHub stars, scan counts and a listing in OWASP's vulnerability scanning tools directory as evidence that an architecture is sound ^[13].

The surrounding machinery is ordinary enough to make the design portable: eight modules in parallel, deduplication, passive re-verification, scoring against the official CVSS v3.1 formula, then a PDF and a live dashboard ^[14]. Every scanning tool it orchestrates is open source, so licensing cost is zero ^[15]. None of that is the interesting part. The interesting part is whether the scoring path in a given pipeline is reachable from the prompt path at all. If a model can edit a scored field, every assertion about that field expires the next time the model is upgraded, and the queue built on those fields stops being a record of the target's state and becomes a record of what one checkpoint said on one day.