truf-server/openspec/changes/retire-zero-alive-keywords/proposal.md

Why

The remaining discovery rotations still contain source/query pairs that have each completed at least 1,000 successful scans without ever producing an alive credential. Their retained pending and deferred work consumes most of the avoidable backlog even though the existing audited cold lifecycle can preserve it reversibly.

What Changes

• Retire only exact source/query pairs with at least 1,000 successful scans, zero historically alive linked credentials, and zero pending candidate checks at the evidence cutoff.
• Keep a durable rejected-query registry with the source, exact query, evidence counters, cutoff, and reason rejected_zero_alive while removing each pair from active rotation.
• Preserve dedicated source sentinel queries and evaluate the same query independently in different sources.
• Move every eligible unfenced pending or deferred target attributed to the rejected pairs into the existing audited, reversible cold state instead of deleting queue or history rows.
• Fail closed if attribution, evidence, policy identity, queue selection, or runtime quiescence changes between review and apply.

Capabilities

New Capabilities

None.

Modified Capabilities

• discovery-keyword-pruning: Add source/query-specific retirement based on substantial zero-alive evidence and retain explicit rejected-query evidence.
• target-queue-policy-holds: Apply the existing audited cold lifecycle to every reviewed source scope in the retired cohort.

Impact

The change affects app/config.yaml, query-policy validation and tests, private reviewed cold manifests, and target_queue policy events. The approved cohort contains 38 source/query pairs and 75,551 currently eligible queue rows. No target, scan, finding, credential, result, reservation, deduplication, or coverage record is deleted.