Repository navigation
docs: advisory pivot + first live advisory run (2026-09-18) - #15
Merged
Merged
Conversation
README, CLAUDE.md and ROADMAP still described the foundry pack as the product and schema v4/v3 as current. Bring them to the shipped state: two packs on one engine, schema v5 (advisory) current, conflict-report in the CLI, parser_role -> source_record_kind attestation, GEI-14 advisory JSON fetcher, version-set grouping. ROADMAP records the first live advisory run (real NVD API + GHSA + real model, scratch only, zero code changes): 8/8 docs, 0 errors, but the output exposes four forks for the next plan gate — CVE entities dropped (vendor required), exploit_status claims dropped (enum never listed in the prompt), cross-source entity identity never joins GHSA and NVD, and same-document branch ranges surface as contradictions. KEV catalog size and NVD cna/cpe role overlap noted as follow-ups. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Docs-only. Brings README, CLAUDE.md and ROADMAP to the shipped state (two packs on one engine; schema v5 current for the advisory pack;
conflict-reportin the CLI;parser_role→source_record_kindattestation; GEI-14 JSON fetcher; version-set grouping), and records the first live advisory run.Live run (scratch only, zero code changes)
Real NVD API + real GHSA records for CVE-2024-21626 / -23897 / -6387 / -3400, real model (
claude-opus-4-8,extract_advisory_v1). KEV left out (catalog is ~1.7 MB, one extract call).alias_collisionconflictFour forks for the next plan gate, detailed in
docs/ROADMAP.md→ Live run 2026-09-18:entity.vendorrequired; CVEs have none) → CVSS claims cascade-dropped.exploit_statusclaims dropped: the prompt never lists the enum.pkg_runcvs NVDprod_runc_cpenever group, so no NVD-vs-GHSA row appears live. G3 refused the alias union correctly; the golden corpus hand-aligned ids and hid this.disjoint→contradicted; 6 of 8 live groups are this shape.Also noted: NVD
cnavscperoles read the same response (CNA strings stampednvd_cpe), and the runc GHSA id in the GEI-11 golden is a typo (rv7p→ livevfvv).Verification
uv run pytest -m "not live": 245 passeduv run pytest --run-live: 248 passed, 1 skipped (the unconditionally skipped live fetch case intest_gei14_json_ingest.py)🤖 Generated with Claude Code