[MakerFlyFly]

Summary

• Honor explicit zero values for window_days, grace_period_days and timeout_days; only missing or null settings use the existing 90/14/14 defaults.
• Fix the zero-grace example from 2026-04-15 to 2026-04-01, while preserving strict calendar-day expiry and the announcement/reporter-turn guards.
• Add 46 CLI regression cases and synchronize the generated magpie-security-tools source so plugin installations receive the same repair.

Type of change

• Python package (tools/security-management) and its generated plugin source

Test plan

• Reproduce the defect on upstream 6fafad25b1b1bc239c8863d09d757fa3cf71d72a; verify corrected CLI output for grace periods 0/1/14, a zero window and a zero reporter timeout.
• State suite: 101 passed, including zero/string-zero values, missing/null defaults, positive values, calendar-day boundaries, label/message guards, and 12 input-coercion cases.
• prek run --all-files --skip workspace-pytest passes, including lychee, Ruff, formatting, mypy and generated-plugin consistency.
• prek run workspace-pytest --from-ref origin/main --to-ref HEAD --verbose passes: 114 + 758 = 872 tests across two applicable members.
• Magpie pre-first-pr-check: A–E pass, zero blocking or advisory categories.
• Canonical and packaged runtime source are identical; git range-diff confirms both reviewed patches are unchanged on the new base.

Validation used an isolated Linux checkout, Python 3.12.12, uv and the locked prek 0.5.6.

RFC-AI-0004 compliance

• HITL — the CLI still computes JSON observations; existing proposal and confirmation boundaries are preserved.
• Vendor neutrality — the repair adds no project-specific configuration.

Linked issues

Closes #1910

Notes for reviewers

The settings are documented as integers. Supplied values now reach int() unless they are null: empty strings/lists/objects produce the existing JSON refusal with exit code 2, and false converts to zero. The tests pin those coercion results without depending on Python-version-specific exception wording. Negative-value validation and issue-import's separate positive-window policy are outside this repair.

Suggested labels: bug, family:tools, capability:fix, substrate:analytics.

Generative AI disclosure

Codex (gpt-6.1-sol) assisted with the implementation, regression tests and this description. The contributor reviewed the final diff, validation results and compatibility behavior, and authorized this upstream submission.

[potiuk]

Honouring an explicit 0 for grace_period_days and timeout_days is right, and the tests fail on the old code. Rather than send it back for two small points, I pushed a fixup commit (7aa8c78) to your branch:

• issue_sync/state.py (and the plugin copy): a non-positive window_days now falls back to 90. issue-import reads the same disclosure_governance.window_days and already rejects anything that isn't positive (issue_import/governance.py:88), so the reporter's receipt promises 90 days; with 0 read literally here, issue-sync would have flagged every tracker as overdue from day one. The window_days cases in test_disclosure_configured_days now expect the default (plus a -1 case), and test_zero_grace_period_preserves_day_boundary uses a 1-day window for its short-window boundary.
• tests/test_issue_sync_state.py: dropped test_issue_sync_coerces_false_day_input_to_zero. The settings are integers, and False becoming 0 is a side effect of int(), not behaviour to pin.

Please pull before pushing again.

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.

More on how Apache Magpie handles maintainer review:
Contributing guide.