# EM-TEC-07 — Уязвимость, затронутость и устранение ## Verdict Reuse WM-SFT-006 as the vulnerability root; do not create a new vulnerability model. Split `AffectednessAssessment` in two: product/package-version affectedness stays a **contained, source-qualified assertion inside WM-SFT-006**; deployed-instance exposure becomes a **root** realised as a profile of WM-ACT-034. `Remediation` is **not a root**: fix availability is contained in WM-SFT-006, build inclusion in WM-SFT-008, deployment in WM-SFT-009, verification in WM-SFT-009's post-deployment outcome, the work in a WM-ACT-006 profile, and the per-(vulnerability, instance) remediation status is a contained assertion on the exposure root. `ExploitEvidence` splits: public exploitation *signal* is contained in WM-SFT-006; the exploit **artifact/observation** needs one identifier-unassigned new root; the realised event is WM-ACT-020 by reference. No identifiers allocated. ## Evidence WM-SFT-006 (complete spec, 159 582 bytes, sha256 3d39ea38…) already owns authority-qualified identity, aliases, CWE mappings, affected product/version/configuration assertions with justification, CVSS/EPSS/KEV/SSVC containers, fix and exposure links, supersession and purpose-bound projections. Its own boundary notes separate weakness, product, deployed-asset exposure, advisory/remediation and exploit/incident. Its adjudication accepts "affected product versus deployed exposure" as separate boundaries. WM-SFT-007, ‑008, ‑009, ‑012, WM-ACT-006, ‑020, ‑034 and WM-KNW-007 are all reviewable drafts with boundary-review or single-provider holds; none owns instance exposure, reachability or VEX status. ## Identity/mastership Vulnerability identity: authoritative source-system identifier qualified by issuing namespace (WM-SFT-006 identity_priority) — CVE is one namespace among OSV, GHSA, vendor and pre-publication local reports. Component/package identity: WM-SFT-007 (registry-of-record key, then purl). Build/release: WM-SFT-008. Deployed instance: WM-SFT-009 (never release tag, digest or environment name). Exposure assessment: its own master identifier (WM-ACT-034 identity priority), never the tuple of CVE + host. Exploit artifact: new root, its own identifier. Mastership rule: one authority per fact; no model copies another's lifecycle. ## Vulnerability/advisory/weakness Three distinct identities. Weakness class (CWE) is a recurring error pattern, mapped with classifier version, method and confidence — never identity. Advisory groups vulnerabilities, products and remedies and has its own authority; WM-SFT-006 holds it as a typed reference. Vulnerability record identity is source-qualified: aliases, upstream and related are distinct relation semantics and never license a merge. Description, product name, CWE, score, date and digest are barred from canonicalisation. ## Affectedness/exposure Layer 1 (contained in WM-SFT-006): product-status assertion with range scheme, introduced/fixed/last-affected events, **configuration constraints**, justification and source confidence. VEX-like statuses (affected, not_affected with justification code, fixed, under_investigation) attach here at product scope. Layer 2 (root, WM-ACT-034 profile): instance exposure — subject = WM-SFT-009 deployed instance, criteria bound to the pinned WM-SFT-006 revision and its version/configuration conditions, evidence = WM-SFT-012 SBOM component presence, WM-SFT-008 build contents, runtime/config observation, reachability determination. Transitive-dependency **reachability** is a criterion with its own evidence and confidence (present → loaded → reachable → reachable-under-attacker-controlled-input), not an inference from presence. SBOM completeness limits and closure "known unknowns" cap the conclusion: unscanned or unknown-completeness returns *undetermined*, never *not affected*. **Contradiction:** WM-SFT-008 assigns VEX to WM-SFT-012, while WM-SFT-012 explicitly excludes VEX and CSAF authoring. No model owns VEX status. **Contradiction:** WM-SFT-007 `f-affectedness` and `f-remediation-status` keep a local affectedness verdict, exploitability and remediation decision, duplicating WM-SFT-006 and the exposure root. Resolve: WM-SFT-006 owns source-qualified product assertions, the exposure root owns instance conclusions, WM-SFT-007 retains at most a cached verdict marked non-authoritative. ## Severity/risk/priority Generic severity = CVSS Base (+Threat) with full vector, version, assessor, scope and scoring time, in WM-SFT-006. Exploitation probability (EPSS), known exploitation (KEV) and decision priority (SSVC) are separate, non-interchangeable, time-varying signals in WM-SFT-006. **Environmental risk and remediation priority are instance-scoped** and belong to the exposure root: CVSS Environmental metrics, asset criticality, compensating controls, exposure surface. WM-SFT-006 retains only a reference to that local decision; it must not host environmental scores. ## Exploit evidence/incident Four separable things: (1) *signal* — KEV inclusion or EPSS probability, contained in WM-SFT-006, with catalogue/model version and scoring date; (2) *exploit artifact* — PoC or weaponised code with independent identity, publication state, maturity and access restriction: **no registered model owns it** → one identifier-unassigned new root, restricted-by-default, with an explicit prohibition on generating exploitation instructions; (3) *exploitation observation against our estate* — an observation referenced by the exposure root, raising exposure confidence; (4) *incident* — WM-ACT-020, requiring its own qualification and declaration decision. Signal ⇏ artifact ⇏ observation ⇏ incident. ## Fix/remediation/verification Four independently timed facts. Fix availability (fixed version, patch, commit, workaround) — WM-SFT-006 contained reference. Build inclusion — WM-SFT-008 change content and security-fix references, provable by artifact digest and SBOM. Deployment — WM-SFT-009 occurrence installing a pinned release to a target. Instance verification — WM-SFT-009 post-deployment outcome plus a re-run exposure assessment concluding *fixed*. Remediation **work** = WM-ACT-006 profile (authorisation, state, dependencies, acceptance). Closure evidence ≠ task terminal state: a Task reaching `completed` is a work fact; remediation status is an assertion on the exposure root, grounded in cited evidence. ## Time/version/scenario Distinguish disclosure/publication, modification, exploitation-observation, fix-availability, build, deployment, observation and knowledge times; all RFC 3339 with seconds and explicit offset. Every exposure conclusion is as-of and carries maximum staleness. Version conditions pin range scheme and ecosystem ordering; no cross-scheme ordering is assumed. Supersession: a new exposure assessment supersedes, never overwrites; a rejected, withdrawn or corrected WM-SFT-006 revision must mark dependent exposure assessments **stale** — no propagation mechanism exists today (gap). Privacy/access: exposure records disclose estate weakness and are deny-by-default; embargoed advisories, reporter contacts and exploit artifacts are separately restricted; WM-ACT-034's privacy gap and WM-SFT-009's actor-identifier sensitivity both apply. ## Acceptance scenario Component C 2.4.1 is *conditionally affected*: WM-SFT-006 asserts affected range < 2.4.3 **only when** feature flag F is enabled. Build B includes C 2.4.3 — WM-SFT-008 records inclusion; this alone changes nothing about exposure. Instance I1 runs the prior release with F disabled → exposure conclusion *not_affected (configuration)*, evidenced by config observation, valid until F changes. Instance I2 runs the prior release with F enabled and C reachable → *affected*; a WM-ACT-006 remediation task is raised. I2 is not yet updated: the task may be closed as "release available", but the exposure root still reports *affected* until a WM-SFT-009 deployment of B to I2 plus verification yields a superseding *fixed* conclusion. Rejected: "CVE in a transitive dependency ⇒ exploitable ⇒ incident" (presence ⇏ reachability ⇏ exploitation ⇏ qualified incident), and "closed ticket ⇒ remediated". ## Invariants 1. CVE is not the only admissible identifier. 2. Every affectedness assertion names version scheme, range and configuration conditions. 3. A closed ticket is not remediation evidence. 4. Product affectedness never implies instance exposure. 5. Absence of scan is *undetermined*, not *not affected*. 6. `not_affected` requires a justification code plus evidence. 7. Severity, exploitation probability, known exploitation and local priority are never the same measure. 8. Fix availability, build inclusion, deployment and verification are four separately evidenced facts. 9. Every conclusion is as-of, scoped and superseded rather than overwritten. 10. No cascade deletion to vulnerabilities, builds, instances, evidence or incidents. ## Minimal model set Root: WM-SFT-006 (reuse). Root: WM-ACT-034 profile — instance exposure, environmental risk, priority, remediation status. Profile: WM-ACT-006 — remediation task. New (identifier-unassigned): exploit artifact / exploitation observation. References: WM-SFT-007, WM-SFT-008, WM-SFT-009, WM-SFT-012, WM-ACT-020, WM-KNW-007 (contested reachability/attribution claims only, to avoid duplicating WM-SFT-006's assertion containers). ## Holds WM-SFT-006 is a codex-only reviewable draft with independent review waived; WM-SFT-007/‑008/‑009/‑012/WM-ACT-006/‑020/‑034/WM-KNW-007 carry boundary-review, single-provider, source-pin and relation-ledger holds. No approved outgoing relations exist for WM-SFT-006; required product/package references are unbacked by ledger rows. VEX ownership, reachability ownership, staleness propagation and WM-SFT-007 duplication are unresolved. CVE/NVD/OSV/CSAF/VEX/STIX/CWE/CVSS crosswalks and fixtures are unverified. No claim of canonical completeness, installability or publication readiness.