[MakerFlyFly]

Summary

• Honor explicit zero values for window_days, grace_period_days and timeout_days; only missing or null values select the existing 90/14/14 defaults.
• Correct the zero-grace example from 2026-04-15 to 2026-04-01, while preserving the existing strict calendar-day expiry boundary and label/message guards.
• Add 46 CLI regression cases (34 original cases plus 12 compatibility cases) and regenerate the magpie-security-tools copy so plugin installations receive the same repair.

Type of change

• Python package (tools/security-management) and its generated plugin source

Test plan

• Original 89-case regression suite: 8 failed, 81 passed before the repair; 89 passed after it. The review follow-up adds 12 passing cases, bringing the current state suite to 101 passed.
• CLI reproducer verifies grace periods 0/1/14, a zero window and a zero reporter timeout.
• prek run --all-files --skip workspace-pytest passes, including the link checker, Ruff, formatting, mypy, plugin synchronization and eval-prompt validation.
• prek run workspace-pytest --from-ref origin/main --to-ref HEAD --verbose passes: 114 + 758 = 872 tests across two applicable members.
• Magpie pre-first-pr-check: categories A–E pass; zero blocking or advisory categories.
• Generated plugin source matches the canonical source byte for byte.

Validation used an isolated Linux checkout with Python 3.12.12 and the locked prek 0.5.6, invoked through uv tool run --from prek==0.5.6 prek.

RFC-AI-0004 compliance

• HITL — the CLI continues to compute JSON observations; existing proposal and confirmation boundaries are preserved.
• Vendor neutrality — the repair adds no project-specific configuration.

Linked issues

Closes #25

Review follow-up

Review feedback was checked against 1fd48a4d; the follow-up commit is 89951248.

Feedback	Decision and reason
Zero values and defaults work	Accepted: existing tests confirm 0 and "0", with missing/null selecting 90/14/14.
Calendar-day boundary and guards are preserved	Accepted: strict >, announcement labels and reporter-turn guards remain covered.
Plugin copy is synchronized	Accepted: the canonical and packaged runtime source still have the same Git blob.
Validation is sufficient	Accepted, with precise CI wording: required checks on the reviewed commit passed; the CodeQL summary was NEUTRAL while the Python analysis job succeeded.
Pin non-integer input compatibility	Accepted: 24 before/after CLI calls confirm the behavior; nine new cases check JSON refusal and exit 2 for empty strings/lists/objects, and three check false-to-zero results.

The follow-up changes only the test file. It preserves the existing int() conversion policy and avoids assertions on Python-version-specific error wording.

Notes for reviewers

This Draft PR targets MakerFlyFly/magpie:main for personal human audit. Its base is upstream 30ee18c2a7d46a42ce94278beb197fa106e94763, fast-forwarded into the fork. The three changed files are the canonical helper, its CLI tests and the mandatory generated plugin copy.

Negative-value validation and issue-import's separate positive-window policy remain outside this repair.

Generative AI disclosure

Codex (gpt-6.1-sol) generated the implementation, regression tests and this PR description, and ran the recorded checks. The contributor completed review and authorized the upstream submission. The upstream issue and PR are linked below.

Upstream submission

The contributor completed review and authorized upstream submission.

• Upstream issue
• Upstream PR

The upstream branch is based on 6fafad25 and ends at 59b5bd48. Both patches match the reviewed fork commits according to git range-diff. This fork entry is retained as the audit record.