issue-sync disclosure treats grace_period_days: 0 as the 14-day default #25

What's broken

security-management issue-sync disclosure silently replaces the documented setting grace_period_days: 0 with the 14-day default. A zero grace period consequently produces a later expected disclosure date than a one-day grace period.

Which layer

The disclosure() and staleness() helpers in tools/security-management/src/security_management/issue_sync/state.py use int(data.get(key) or default). The same implementation is distributed in the magpie-security-tools plugin.

How to reproduce

From the repository root at upstream 30ee18c2a7d46a42ce94278beb197fa106e94763:

cat > disclosure.json <<'JSON'
{"now":"2026-04-05T12:00:00Z","created_at":"2026-01-01T09:00:00Z","labels":["pr merged"],"window_days":90,"grace_period_days":0,"pre_announce_distributors":false}
JSON
uv run --frozen --project tools/security-management security-management issue-sync disclosure --input disclosure.json

Vary only grace_period_days:

All three commands exit 0. The zero case should report 2026-04-01 and grace_period_expired: true.

Expected vs actual

The security-intake template explicitly supports zero grace days. Zero should add no days to the existing created_at + window_days + grace_period_days formula. Missing or null values should retain the defaults; the existing strict age > deadline calendar-day comparison should remain unchanged.

The general overdue_for_disclosure flag remains true in this reproduction, so the ordinary overdue rollup proposal remains available. The wrong grace flag delays its promotion to a separate disclosure-overdue comment. When distributor pre-announcement is enabled, the calculated expected date is also 14 days late.

Surface area (optional)

The same falsy-value fallback occurs for window_days (default 90) and timeout_days (default 14) in these issue-sync helpers. A one-day-old team message with timeout_days: 0 incorrectly reports stale: false.

The proposed repair handles the three issue-sync defaults consistently, preserves integer coercion and synchronizes the generated plugin copy. Negative-value validation and issue-import's separate positive-window policy are outside this fix.

Environment (optional)

• Upstream main: 30ee18c2a7d46a42ce94278beb197fa106e94763.
• Independently reproduced through the CLI on Linux (Docker), Python 3.12.12 and uv.
• No matching bug report or pending fix was found in the searches for grace_period_days, issue-sync grace and timeout_days across upstream issues and PRs.

Generative AI disclosure

The original finding was supplied as AI-assisted material. Codex (gpt-6.1-sol) independently reproduced it and generated this revised report. This issue is posted to the contributor's fork for human audit; the contributor has completed review and authorized upstream submission.

Upstream submission

The contributor completed review and authorized upstream submission.

• Upstream issue
• Upstream PR

The upstream branch is based on 6fafad25 and ends at 59b5bd48. Both patches match the reviewed fork commits according to git range-diff. This fork entry is retained as the audit record.