Normalize SQLi MVP lifecycle and approval states

[blondres04]

Type: Narrow MVP

Decision

LLM scoring stays in the MVP, but SCORED should not be the operator-facing resting state. Scoring is a scan/stage status. After scoring, a supported SQLi finding should rest in AWAITING_APPROVAL until a human approves or rejects it.

What To Build

Normalize the lifecycle around the human-readable SQLi MVP path:

INGESTED -> TRIAGED -> AWAITING_APPROVAL -> APPROVED | REJECTED -> POC_GENERATED -> VERDICTED | REFUSED

Use scan/stage state such as SCORING while LLM scoring is actively running. Keep existing SCORED rows as compatibility pending-approval rows, but do not make SCORED the new operator-facing state.

Acceptance Criteria

• FindingState includes AWAITING_APPROVAL and REJECTED.
• New scored CWE-89 findings transition to AWAITING_APPROVAL after scoring completes.
• The scan can use SCORING while LLM scoring is active.
• Approval flows accept both AWAITING_APPROVAL and legacy SCORED rows.
• Rejecting a finding records REJECTED and prevents PoC generation/detonation.
• Static-only, out-of-scope, and non-CWE-89 deferred findings never enter AWAITING_APPROVAL by default.
• Resume behavior is clear for AWAITING_APPROVAL, legacy SCORED, APPROVED, REJECTED, and POC_GENERATED rows.

Notes

Do not remove LLM scoring. The goal is to keep the score as data and make the next human action obvious.

[blondres04]

Implemented in PR #69: #69

Status:

• Branch pushed: codex/sqli-only-mvp
• Non-Docker verification passed: pytest -m "not integration" (209 passed, 10 deselected), strict mypy, Ruff format check, Ruff lint
• Docker/manual QA is documented in shield-claw/docs/sqli-mvp-validation-checklist.md and remains to be run before release/demo acceptance because Docker Desktop was not running locally
• This issue is linked with Closes #... in PR Narrow ShieldClaw to SQLi-only MVP #69 and should auto-close when that PR merges