microsoft/hve-core

---
description: "Phase 5 dual-format work item generation with templates and priority derivation for SSSC Planner."
applyTo: '**/.copilot-tracking/sssc-plans/**'
---

# SSSC Phase 5 — Backlog Generation

Generate actionable work items from the gap analysis in dual format (ADO + GitHub). Each work item maps a supply chain security gap to concrete adoption steps.

## Work Item Template

Each generated work item follows this structure:

```markdown
## [{Priority}] {Title}

**Scorecard Check:** {check_name} | **Risk:** {Critical|High|Medium|Low}
**Effort:** {S|M|L|XL} | **Adoption Type:** {category}
**Prerequisite:** {work_item_id or "None"}

### Description
{What needs to be done and why — include the security benefit}

### Adoption Steps
1. {Concrete step with file path or workflow reference}
2. {Next step}

### Source References
- Workflow: {repo}/path/to/workflow.yml
- Script: {repo}/path/to/script.ps1
- Documentation: {URL or path}

### Acceptance Criteria
- [ ] {Verifiable criterion}
- [ ] {Verifiable criterion}

### ADO Mapping
- Type: {Epic|Feature|User Story|Task}
- Tags: supply-chain, ossf, {scorecard-check}, {adoption-type}

### GitHub Mapping
- Labels: supply-chain, ossf, {scorecard-check}, {adoption-type}
- Milestone: {milestone}

> **Note** — The author created this content with assistance from AI. All outputs should be reviewed and validated by a qualified human reviewer before use.
> - [ ] Reviewed and validated by a qualified human reviewer
```

## Priority Derivation

Derive work item priority from the Scorecard risk level:

| Risk Level | Priority | Execution Order |
|------------|----------|-----------------|
| Critical   | P1       | First           |
| High       | P2       | Second          |
| Medium     | P3       | Third           |
| Low        | P4       | Fourth          |

Within the same priority level, order items by adoption type (reusable workflow first, new capability last).

## ADO Work Item Format

> **Note:** This work item was generated by the Security Planner AI agent. Review for accuracy and adjust before assigning to a person.

- [ ] Reviewed by a human security professional before execution

Assign sequential IDs using the format `WI-SSSC-{NNN}` (for example, WI-SSSC-001, WI-SSSC-002). This convention distinguishes SSSC work items from Security Planner items (`WI-SEC-{NNN}`). Order work items by type hierarchy: Epic, Feature, User Story, Task.

Work item hierarchy for supply chain security:

* **Epic**: Supply chain security improvement program (one per assessment)
* **Feature**: Per adoption category (reusable workflow adoption, platform configuration, etc.)
* **User Story**: Per Scorecard check or SLSA improvement step
* **Task**: Individual implementation steps for a user story

HTML template for ADO description fields:

```html
<div>
  <h3>Supply Chain Control: {title}</h3>
  <p><strong>Scorecard Check:</strong> {check_name}</p>
  <p><strong>Risk Level:</strong> {risk_level}</p>
  <p><strong>Adoption Type:</strong> {adoption_type}</p>
  <h4>Adoption Steps</h4>
  <ol>
    <li>{step_1}</li>
    <li>{step_2}</li>
  </ol>
  <h4>Acceptance Criteria</h4>
  <ul>
    <li>{criterion_1}</li>
    <li>{criterion_2}</li>
  </ul>
</div>
```

## GitHub Issue Format

> **Note:** This work item was generated by the Security Planner AI agent. Review for accuracy and adjust before assigning to a person.

- [ ] Reviewed by a human security professional before execution

Assign temporary IDs using the format `{{SSSC-TEMP-N}}`, replaced with real issue numbers on creation.

Include a YAML metadata block at the top of the issue body:

```yaml
---
scorecard_check: {check_name}
risk_level: {Critical|High|Medium|Low}
adoption_type: {category}
effort: {S|M|L|XL}
standards: [{scorecard_check}, {slsa_level}, {badge_criteria}]
---
```

Markdown template for GitHub issue body:

```markdown
## Supply Chain Control: {title}

**Scorecard Check:** {check_name}
**Risk Level:** {risk_level}
**Adoption Type:** {adoption_type}

### Adoption Steps

1. {step_1}
2. {step_2}

### Source References

- Workflow: `{repo}/path/to/workflow.yml`
- Script: `{repo}/path/to/script.ps1`

### Acceptance Criteria

- [ ] {criterion_1}
- [ ] {criterion_2}

> **Note** — The author created this content with assistance from AI. All outputs should be reviewed and validated by a qualified human reviewer before use.
> - [ ] Reviewed and validated by a qualified human reviewer
```

## Content Sanitization

Strip internal tracking paths from work item output before handoff:

1. Replace `.copilot-tracking/` paths with descriptive text (e.g., "SSSC plan artifacts").
2. Replace full file system paths with relative references.
3. Remove state JSON content or references.
4. Preserve standards references (Scorecard check names, SLSA levels, Badge criteria) in all cases.

## Three-Tier Autonomy Model

Three tiers control how work items reach the target backlog system:

* **Full autonomy**: Create work items directly via backlog manager. User pre-approves batch creation.
* **Partial autonomy** (default): Present each batch of 5-10 items for user review before creation. User can modify, skip, or approve individual items.
* **Guided autonomy**: Produce output file without invoking backlog tools. User imports items independently.

Ask the user which tier they prefer: guided, partial, or full. Default to partial autonomy on first use.

## Output

Write the neutral intermediate backlog to `.copilot-tracking/sssc-plans/{project-slug}/sssc-backlog.md`.

Update `state.json`:
* Set `phases.5-backlog.status` to `✅`
* Add `sssc-backlog.md` to `phases.5-backlog.artifacts`
* Advance `currentPhase` to `6`

> **CAUTION:** AI-generated work items require professional review before execution. Treat the backlog as a starting draft, not a final plan.