Update documentation of what PSRT bot does

security/psrt.rst

@@ -148,26 +148,18 @@ vulnerability, or as a security vulnerability. If the Coordinator needs
 help from core team experts in making the determination, the
 experts may be added as 'Collaborators' to the GHSA ticket.
 Accepted security vulnerabilities will be moved to the 'Draft' state in GHSA.
-Only repository admins can accept advisories; however, PSRT members may accept
-reports through the PSRT bot by prepending ``[ACCEPTED]`` to the GHSA's
-title.
 
 If the report isn't a vulnerability, coordinators close the GHSA ticket
 after optionally opening a public GitHub issue. Note that reporters often
 will not open a GitHub issue on their own, as there is no longer an incentive
-for them to do so without a CVE being assigned. Similarly to accepting,
-only repository admins can close advisories; however, PSRT members may close
-reports through the PSRT bot by prepending ``[CLOSED]`` (for regular bugs),
-``[INVALID]`` (for spam), ``[DUPLICATE]`` (for duplicates), or ``[COMPLETED]``
-(for completed tickets where an advisory has been issued) to the GHSA's title.
+for them to do so without a CVE being assigned.
 
 Remediating a vulnerability report
 ----------------------------------
 
 Once a report has been accepted as a vulnerability, the remediation
 development process begins. Coordinators move the GHSA ticket to a 'Draft'
-state using the green :guilabel:`Accept as Draft` button (repository admins)
-or the PSRT bot's ``[ACCEPTED]`` title tag. Once in this state,
+state using the green :guilabel:`Accept as Draft` button. Once in this state,
 the PSRT bot will automatically assign a CVE ID from the Python Software
 Foundation CVE Numbering Authority and create a temporary private fork.
 
@@ -288,9 +280,6 @@ if applying the patch isn't the only way to mitigate the vulnerability.
   to releasing.
 
 After an advisory email is sent, the GHSA ticket can be closed.
-As only repository admins can close advisories directly, PSRT members
-can prepend ``[COMPLETED]`` to the GHSA's title and the PSRT bot
-will close the ticket.
 
 .. _advisory template: #advisory-email
 
@@ -300,22 +289,16 @@ The PSRT bot
 ------------
 
 The :github:`PSRT bot <python/psrt-ghsa-bot>` is a GitHub App
-that automates parts of the GHSA workflow described above. GitHub only
-allows repository admins to modify security advisories, so the bot enables
-any PSRT member to move a report through the process using title tags.
-
+that automates parts of the GHSA workflow described above.
 The bot runs hourly (or by manual dispatch) and for each open GHSA ticket:
 
 * Adds the PSRT GitHub team as collaborators, giving members access to new reports.
-* Moves tickets from the 'Triage' to the 'Draft' state when the title contains
-  the ``[ACCEPTED]`` tag.
-* Closes tickets when the title contains one of the closing tags
-  (``[CLOSED]``, ``[INVALID]``, ``[DUPLICATE]``, or ``[COMPLETED]``).
-* For accepted ('Draft') tickets, creates the temporary private fork if one
+* For newly accepted ('Draft') tickets, creates the temporary private fork if one
   doesn't already exist, and reserves a CVE ID.
-
-Tags are case-insensitive and can appear anywhere in the title, though for visibility
-they are prepended.
+* Adds people who contribute to or review the private fork's pull requests to
+  the GHSA credits.
+* For other accepted ('Draft') tickets, if the associated CVE has been published
+  with a patch, closes the ticket as resolved.
 
 Handling code signing certificate reports
 -----------------------------------------