mitre · aaronlippold · Jun 6, 2026 · Jun 6, 2026 · Jun 6, 2026 · Jun 6, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **Three-column triage split-pane** — triagers see a persistent rule sidebar (col-2), rule content (col-5), and comment + triage form (col-5) side by side, replacing the prev/next nav + modal workflow. Sidebar shows rules grouped with pending/total counts, search filter, and keyboard navigation. Reuses BenchmarkViewer layout pattern. (PR #731)
+- **Triage progress bar** — summary pills with clickable status filter + thin stacked bar above the comments table. Shows per-status counts (All, Pending, Accepted, Declined, etc.) with "N of M resolved (X%)" summary. Click a pill to filter; click again to reset. Works on both component and project triage pages. (PR #731)
+- **DRY triage color palette** — centralized CSS custom properties in `triage-tints.css` as single source of truth. Colors: green (Accepted), blue (Accepted with Changes — ISO 3864 mandatory-action), red (Declined), yellow (Informational), grey (Pending), purple (Withdrawn — GitHub pattern), teal (Duplicate — Linear pattern). (PR #731)
+- **ARIA landmarks + focus management** — split-pane uses `<nav>`, `role="main"`, `role="complementary"` landmarks. Skip links for keyboard users. Focus lands on content heading on entry and after Save & Next (WAI-ARIA APG content-first pattern). Sidebar is a composite widget (single Tab stop, arrow keys inside). (PR #731)
+- **InfoTooltip + InfoNotice shared components** — consistent (i) icon tooltip pattern (15 instances migrated) and inline info notice pattern (2 instances) across the app. (PR #731)
+- **2D queue navigation** — skip-start/end icons for rule-level nav, chevrons for comment-level, Browse popover panel with search + keyboard nav. (PR #731)
+- **By-rule accordion view** — collapsible groups by rule with pending/total counts, Expand All toggle, auto-expand on filter change. (PR #731)
+- **Staleness badge** — "Section updated since this comment" when rule content changed after comment was posted. (PR #731)
+- **Admin actions inline** — dropdown on triage form button row (replaces sidebar). Force-withdraw, restore, move-to-rule, hard-delete with typed-ID confirmation. (PR #731)
+
+### Changed
+
+- **Show Resolved toggle removed** — replaced by clickable progress bar pills that serve as both status indicators and filter controls. "Pending" pill replaces the default filter; "All" pill shows everything. Eliminates the state model conflict between toggle and pill filters. (PR #731)
+- Renamed "Triage Queue" to "Comments" (heading, breadcrumbs, aria labels). (PR #731)
+- Commented/All toggle moved to rule ID row as simple switch. (PR #731)
+- Locked fields now allow comments (lock prevents editing, not commenting). (PR #731)
+
+### Fixed
+
+- SRG viewer sidebar highlighted all rules instead of first selected — `SrgRuleBlueprint` was missing `identifier :id`. (PR #731)
+- Split-pane exits when filter changes — watcher now selects first available comment instead of exiting when the active comment is filtered out. (PR #731)
+- `doSave` only adjudicates on "Save & next", not "Save decision". (PR #731)
+- Factory traits `after(:build)` DB writes fixed to `before(:create)`. (PR #731)
+
 ## [v2.3.7] - 2026-05-10
 
 ### Added

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -89,7 +89,7 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
-    addressable (2.8.9)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
     aes_key_wrap (1.1.0)
     amoeba (3.3.0)
@@ -168,7 +168,7 @@ GEM
       database_cleaner-core (~> 2.0)
     database_cleaner-core (2.0.1)
     date (3.5.1)
-    devise (5.0.3)
+    devise (5.0.4)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
       railties (>= 7.0)
@@ -184,7 +184,7 @@ GEM
       dotenv (= 3.2.0)
       railties (>= 6.1)
     drb (2.2.3)
-    erb (6.0.2)
+    erb (6.0.4)
     erubi (1.13.1)
     factory_bot (6.5.6)
       activesupport (>= 6.1.0)
@@ -278,7 +278,7 @@ GEM
       tty-prompt (~> 0.17)
       tty-table (~> 0.10)
     io-console (0.8.2)
-    irb (1.17.0)
+    irb (1.18.0)
       pp (>= 0.6.0)
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
@@ -331,7 +331,7 @@ GEM
     mime-types-data (3.2025.0812)
     mini_mime (1.1.5)
     mini_portile2 (2.8.9)
-    minitest (6.0.3)
+    minitest (6.0.6)
       drb (~> 2.0)
       prism (~> 1.5)
     mitre-inspec-objects (0.3.3)
@@ -348,7 +348,7 @@ GEM
       bigdecimal (~> 3.1)
     multipart-post (2.4.1)
     mutex_m (0.3.0)
-    net-imap (0.6.3)
+    net-imap (0.6.4)
       date
       net-protocol
     net-ldap (0.20.0)
@@ -365,16 +365,16 @@ GEM
     net-ssh (7.3.0)
     netrc (0.11.0)
     nio4r (2.7.5)
-    nokogiri (1.19.2)
+    nokogiri (1.19.3)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.19.2-aarch64-linux-gnu)
+    nokogiri (1.19.3-aarch64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.2-arm64-darwin)
+    nokogiri (1.19.3-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.2-x86_64-linux-gnu)
+    nokogiri (1.19.3-x86_64-linux-gnu)
       racc (~> 1.4)
-    nokogiri (1.19.2-x86_64-linux-musl)
+    nokogiri (1.19.3-x86_64-linux-musl)
       racc (~> 1.4)
     nokogiri-happymapper (0.10.0)
       nokogiri (~> 1.5)
@@ -458,12 +458,12 @@ GEM
     psych (5.3.1)
       date
       stringio
-    public_suffix (7.0.2)
+    public_suffix (7.0.5)
     puma (7.2.0)
       nio4r (~> 2.0)
     pyu-ruby-sasl (0.0.3.3)
     racc (1.8.1)
-    rack (2.2.23)
+    rack (3.2.6)
     rack-attack (6.8.0)
       rack (>= 1.0, < 4)
     rack-oauth2 (1.21.3)
@@ -472,16 +472,17 @@ GEM
       httpclient
       json-jwt (>= 1.11.0)
       rack (>= 2.1.0)
-    rack-protection (3.2.0)
+    rack-protection (4.2.1)
       base64 (>= 0.1.0)
-      rack (~> 2.2, >= 2.2.4)
-    rack-session (1.0.2)
-      rack (< 3)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
     rack-test (2.2.0)
       rack (>= 1.3)
-    rackup (1.0.1)
-      rack (< 3)
-      webrick
+    rackup (2.3.1)
+      rack (>= 3)
     rails (8.0.5)
       actioncable (= 8.0.5)
       actionmailbox (= 8.0.5)
@@ -513,7 +514,7 @@ GEM
       tsort (>= 0.2)
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
-    rake (13.3.1)
+    rake (13.4.2)
     rake-compiler-dock (1.11.0)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
@@ -706,7 +707,6 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    webrick (1.9.2)
     websocket (1.2.11)
     websocket-driver (0.8.0)
       base64
@@ -718,7 +718,7 @@ GEM
       zeitwerk (>= 2.6)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    zeitwerk (2.7.5)
+    zeitwerk (2.8.1)
 
 PLATFORMS
   aarch64-linux
@@ -805,4 +805,4 @@ RUBY VERSION
    ruby 3.4.9p82
 
 BUNDLED WITH
-   2.7.2
+   2.6.9
diff --git a/app/blueprints/srg_rule_blueprint.rb b/app/blueprints/srg_rule_blueprint.rb
@@ -4,7 +4,7 @@
 # Used as nested data inside RuleBlueprint :editor view for the srg_rule_attributes field.
 # Excludes internal fields that the editor doesn't need (id, locked, timestamps, etc.).
 class SrgRuleBlueprint < Blueprinter::Base
-  # No identifier — this is always nested, never fetched by ID
+  identifier :id
 
   fields :rule_id, :title, :version, :rule_severity, :rule_weight,
          :ident, :ident_system, :fixtext, :fixtext_fixref, :fix_id,

diff --git a/app/controllers/components_controller.rb b/app/controllers/components_controller.rb
@@ -340,21 +340,27 @@ def settings
   def comments
     return head :not_found unless @component
 
-    result = @component.paginated_comments(
-      triage_status: params[:triage_status].presence || 'pending',
-      section: params[:section].presence,
-      rule_id: params[:rule_id].presence,
-      author_id: params[:author_id].presence,
-      query: params[:q].presence,
-      page: params[:page].presence || 1,
-      per_page: params[:per_page].presence || 25,
-      resolved: params[:resolved].presence || 'all',
-      commentable_type: params[:commentable_type].presence
-    )
-
-    inject_reactions_mine!(result[:rows])
-    response.headers['Cache-Control'] = 'no-store'
-    render json: result
+    respond_to do |format|
+      format.html { redirect_to "/components/#{@component.id}/triage" }
+      format.json do
+        result = @component.paginated_comments(
+          triage_status: params[:triage_status].presence || 'pending',
+          section: params[:section].presence,
+          rule_id: params[:rule_id].presence,
+          author_id: params[:author_id].presence,
+          query: params[:q].presence,
+          page: params[:page].presence || 1,
+          per_page: params[:per_page].presence || 25,
+          resolved: params[:resolved].presence || 'all',
+          commentable_type: params[:commentable_type].presence,
+          include_rule_content: ActiveModel::Type::Boolean.new.cast(params[:include_rule_content])
+        )
+
+        inject_reactions_mine!(result[:rows])
+        response.headers['Cache-Control'] = 'no-store'
+        render json: result
+      end
+    end
   end
 
   def based_on_same_srg

diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
@@ -113,19 +113,24 @@ def triage
   def comments
     return head :not_found unless @project
 
-    result = @project.paginated_comments(
-      triage_status: params[:triage_status].presence || 'pending',
-      section: params[:section].presence,
-      component_id: params[:component_id].presence,
-      author_id: params[:author_id].presence,
-      query: params[:q].presence,
-      page: params[:page].presence || 1,
-      per_page: params[:per_page].presence || 25,
-      resolved: params[:resolved].presence || 'all'
-    )
-    inject_reactions_mine!(result[:rows])
-    response.headers['Cache-Control'] = 'no-store'
-    render json: result
+    respond_to do |format|
+      format.html { redirect_to "/projects/#{@project.id}/triage" }
+      format.json do
+        result = @project.paginated_comments(
+          triage_status: params[:triage_status].presence || 'pending',
+          section: params[:section].presence,
+          component_id: params[:component_id].presence,
+          author_id: params[:author_id].presence,
+          query: params[:q].presence,
+          page: params[:page].presence || 1,
+          per_page: params[:per_page].presence || 25,
+          resolved: params[:resolved].presence || 'all'
+        )
+        inject_reactions_mine!(result[:rows])
+        response.headers['Cache-Control'] = 'no-store'
+        render json: result
+      end
+    end
   end
 
   def create

diff --git a/app/javascript/application.scss b/app/javascript/application.scss
@@ -1,5 +1,6 @@
 @import "bootstrap/scss/bootstrap";
 @import "bootstrap-vue/src/index.scss";
+@import "./styles/triage-tints.css";
 
 // Bootstrap Icons are included via the IconsPlugin in Vue
 // No need to import separate icon CSS files

diff --git a/app/javascript/components/components/CommentDedupBanner.vue b/app/javascript/components/components/CommentDedupBanner.vue
@@ -16,7 +16,12 @@
       </button>
     </b-alert>
     <ul v-show="expanded" :id="listId" class="list-unstyled mb-0 pl-3">
-      <li v-for="row in rows" :key="row.id" class="mb-2">
+      <li
+        v-for="row in rows"
+        :key="row.id"
+        class="mb-2 rounded px-2 py-1"
+        :class="triageBgClass(row.triage_status)"
+      >
         <div class="text-break">
           <strong>{{ row.author_name }}</strong>
           <SectionLabel v-if="row.section" :section="row.section" class="badge badge-light ml-1" />
@@ -27,7 +32,7 @@
             :duplicate-of-id="row.duplicate_of_review_id"
             class="ml-1"
           />
-          ({{ relativeTime(row.created_at) }}) — &quot;{{ row.comment }}&quot;
+          ({{ friendlyDateTime(row.created_at) }}) — &quot;{{ row.comment }}&quot;
         </div>
         <ReactionButtons
           v-if="row.reactions"
@@ -55,11 +60,13 @@ import CommentThread from "../shared/CommentThread.vue";
 import ReactionButtons from "../shared/ReactionButtons.vue";
 import AlertMixin from "../../mixins/AlertMixin.vue";
 import ReactionToggleMixin from "../../mixins/ReactionToggleMixin.vue";
+import DateFormatMixin from "../../mixins/DateFormatMixin.vue";
+import { triageBgClass } from "../../utils/triageBgClass";
 
 export default {
   name: "CommentDedupBanner",
   components: { SectionLabel, TriageStatusBadge, CommentThread, ReactionButtons },
-  mixins: [AlertMixin, ReactionToggleMixin],
+  mixins: [AlertMixin, ReactionToggleMixin, DateFormatMixin],
   props: {
     componentId: { type: [Number, String], required: true },
     ruleId: { type: [Number, String], default: null },
@@ -96,9 +103,7 @@ export default {
     componentScoped: "fetch",
   },
   methods: {
-    relativeTime(iso) {
-      return iso ? new Date(iso).toLocaleDateString() : "";
-    },
+    triageBgClass,
     async fetch() {
       try {
         // Fetch all comments at the current scope (rule-level or