CVE automation framing - the goal is zero humans, assume tokens are free to test feasibility, and redesign the flow rather than swap human boxes for automation boxes

Situation

In the 10/29 Nathan 1:1 Nathan said CVE automation is moving too slowly and he will push it at next week onsite, using a 1,000-PRs-a-week, remove-the-humans thought experiment. Peter set the frame his org works from: (1) redesign the whole flow, not replace each human step with an automation step - removing humans changes the flow and leaves about a tenth of the cases as error paths for people; (2) assume tokens and machine time are free for the exercise - if zero-human is unreachable even then, stop; if reachable, then discuss cost; (3) parallel attempts in front of a trusted gate are fine, losers aborted. He called it one of his hot-button issues.

Reasoning

Kernel releases alone consume more than one FTE and the CVE volume is rising, so incremental automation will not keep pace; the target must be zero-touch. Removing cost from the first pass separates is-it-possible from is-it-affordable, so ambitious designs are not killed early on cost guesses that will be stale in months. Nathan owns the program; Peter supplies the framing that binds how the onsite plans.

Additional Context

Confirmed by Peter.

Observed Evidence

If we can not get there, that tells us something. We do not need to spend more time on it. But if we can get there when they are free, now we can have some conversations about what we do when they are not quite free.

Confidence Breakdown

Reasoning Depth Analysis