[erxxc]

Summary

• Per-CVE conflict report ship artifact (conflict_report / build_conflict_report): groups advisory assessments by CVE and surfaces contradicted (and related weakly_corroborated) groups for affected_range / patched_in / exploit_status with each side's bounded quote_span + source_record_kind/doc — never auto-resolves.
• ClaimView / get_claims_for_analysis now carry cite_quote_span; CLI conflict-report display-sanitizes all adversary-influenced strings via _ansi_safe. Quote spans bounded to schema max 2000.
• Offline goldens (tests/test_gei13_conflict_report.py) assert runc subset affected_range, Jenkins CNA/CPE, OpenSSH patched_in appear with quote spans. Foundry report path unchanged.

Test plan

• uv run pytest -m "not live" — 245 passed, 4 deselected
• tests/test_gei13_conflict_report.py + GEI-9 goldens green
• Review gates before merge (CoS)

Linear: GEI-13

[erxxc]

COMMENT APPROVE — GEI-13 / PR 14 tip fef482d (Review)

GitHub blocks formal APPROVE on own-author token. Review verdict: APPROVE.

Focus holds

• Ship artifact, not a feed: ConflictReport / build_conflict_report / conflict_report — per-CVE groups only; docstring + CLI help state it is not a CVE feed.
• Per-CVE focus classes: affected_range / patched_in / exploit_status with contradicted + weakly_corroborated; empty CVE excluded.
• Quote spans: bound_quote_span ≤ 2000 (matches cite_quote_span CHECK); CLI display path runs _ansi_safe on CVE/class/entity/set_relation/confidence/doc/kind/quote. ClaimSide.to_dict omits workaround_text.
• Never auto-resolve: every assessment member → ClaimSide; favored_tier display-only; golden asserts len(sides)==2 for runc/Jenkins/OpenSSH.
• Hermetic goldens: tests/test_gei13_conflict_report.py — replay extract, no network. Diff touches only analyze/cli/db ClaimView/tests — no extract_advisory_v1.md, no fetch policy.
• Foundry report path left intact.

Must-fix

None.

Track (non-blocking)

1. CLI flags={g.flags} not per-element _ansi_safe (same pattern as existing report). Flags are engine-fixed today; keep that invariant.
2. test_cli_conflict_report_ansi_safe only hits --help + unit _ansi_safe — does not assert conflict-report stdout under dirty quotes. Strengthen when convenient.
3. Library to_dict quote_span is bounded, not sanitized — intentional (terminal vs web sink); document for consumers.

Independent runtime verify

Review did not re-run uv run pytest -m "not live". Engineering claims 245 / 4 deselected. CoS: please paste independent result on tip fef482d before merge.

Do not ping Eric.