Skip to content

Merge Comments

When the same commenter has filed the same concern across many requirements (e.g. 20 identical "logging not applicable" comments from one person), an admin can merge them into a single canonical comment without losing the originating context.

This is different from Bulk Triage:

  • Bulk triage applies one decision to many comments and gives each one its own response — every original thread stays self-contained.
  • Merge consolidates many into one: one comment becomes the survivor and carries the discussion forward; the others are marked duplicate of the survivor (not deleted) and adjudicated automatically.

When to use

  • After bulk-triaging a duplicate cluster, you want a single canonical thread to carry the conversation rather than N parallel threads.
  • A commenter has filed the same concern across multiple rules and the reply traffic should land on one comment.

How to use

Merge is admin-only. The button appears in the bulk-triage bar when an admin selects two or more comments.

  1. Select 2+ comments by the same commenter in either the table view or the by-requirement accordion (same component, same author).
  2. In the bulk-triage bar, click Merge…. The Merge Comments modal opens with a side-by-side preview of every selected comment showing rule, author, posted date, and a preview of the body.
  3. Pick the survivor. The radio button defaults to the oldest-posted comment (Zendesk convention). Pick any of the listed comments to make it the survivor instead.
  4. Click Merge to confirm.

What happens on the server

In one transaction:

  • The survivor's comment text is prepended with a marker naming the originating rule labels, for example:

    [Merged: originally posted on CNTR-00-001049, CNTR-00-001054, CNTR-00-001346]
    
    …survivor's original text…
  • Each secondary gets triage_status = duplicate and duplicate_of_review_id = survivor.id. Because duplicate is a terminal status, the adjudicated_at callback fires automatically, so the secondaries are also closed as part of the same operation.

  • Secondaries are not deleted — they remain visible on their original rules with a link back to the survivor, preserving the audit trail.

  • Audit rows on every row share the request's request_uuid, so the full merge is recoverable as one correlated group.

Permissions

Project admin only. Authors and viewers cannot see or trigger the Merge button.

Constraints

The merge is rejected (422) and no rows change if:

  • The selected comments span more than one component.
  • The selected comments are not all from the same commenter (different people having the same opinion are different feedback items — preserved separately).
  • The survivor isn't one of the selected comments.
  • Fewer than one secondary remains after de-duplicating the survivor from the duplicates list.
  • Bulk Triage — apply one decision per comment without consolidating.

Part of the MITRE Security Automation Framework (SAF)