# Exact unsent Grok prompt — EM-TEC-07

Independent enterprise metamodel review. Do not browse, invent identifiers, generate exploit instructions or claim publication readiness.

EM-TEC-07 covers Vulnerability, AffectednessAssessment, Remediation and ExploitEvidence using WM-SFT-006 plus component/package, build/release, deployment, SBOM, task, assessment, claim and cyber-incident drafts.

Assess this proposal: reuse WM-SFT-006 as the Vulnerability root. Keep source-qualified product/version/configuration affectedness inside it. Profile WM-ACT-034 as the deployed-instance Exposure Assessment root owning contextual risk, priority and remediation-status conclusions. Profile WM-ACT-006 for remediation work. Keep fix availability, build inclusion, deployment and instance verification in their respective masters. Public exploitation signals stay in WM-SFT-006. An independently managed Exploit Artifact is an identifier-unassigned candidate; exploitation observation and incident stay separate. Separate CVSS severity, EPSS, KEV, SSVC, environmental risk and local priority.

Test a conditionally affected component, a build containing the fixed version and one deployed instance still running the old reachable configuration. Reject claims that transitive dependency presence proves exploitability/incident or that a closed ticket proves remediation.

Return <=900 words with: Verdict; strongest evidence; strongest counterexample; identity/mastership; vulnerability/advisory/weakness; affectedness/exposure; severity/risk/priority; exploit evidence/incident; fix/remediation/verification; time/version; scenario; at least 10 invariants; minimum model set; blockers. Explicitly decide whether instance exposure and exploit artifact require independent identity and resolve VEX ownership.