[shipmill-romamo]

Proposes spec S-010 (docs/specs/010-cve-tracking.md), status proposed, serving G-2.

What it proposes

• cloudfall_inspect records each package's Debian source package and source version (today packages[].source is the literal "dpkg-query"), plus reboot-required and needrestart state
• A read command on the management host matches snapshots against the Debian Security Tracker and CISA KEV, with Debian version comparison, and classifies each CVE as open, fixed_not_active or not_affected, keeping first-seen history
• Declared alert policy for exploited, high-urgency and not-yet-active findings
• An apply-security-updates operation whose verify re-inspects and re-runs the match

Open before approval

• Command name, tracker JSON caching, whether the baseline installs needrestart, where findings history lives
• The tracker's JSON fields and triage marks are to be checked against a live copy

Docs only; no code changes.

🤖 Generated with Claude Code

[shipmill-romamo]

@romamo Decision needed: do you want CVE tracking (S-010) built, and if so, may shipmill settle the spec's open questions with the defaults below and ask you to approve it?

Review: CI is green, but this PR can't land as it stands:

• No issue, accepted opportunity, or accepted plan item asks for this work, so there is nothing for the spec to be approved against. The G-2 plan (Plan for G-2: Every operation has a verify step and every decision an audit entry; cloudfall why answers from the record alone #190) is still waiting on your answer and doesn't list CVE tracking
• specs.py check fails on docs/specs/010-cve-tracking.md: status: proposed (only draft, approved, built are valid), an Open questions section the template doesn't have, and an Issues line that isn't - #N: S-010-k
• The PR body has no ## Plan, so the merge gate refuses it

1. Build it (recommended): it serves G-2 (every operation has a verify step: apply-security-updates verifies by re-matching) and answers the MSP question "were we exposed to CVE X, and since when". shipmill files a feature issue for it, settles the open questions as: command cloudfall security observe; the tracker JSON cached on the management host with conditional requests, findings marked stale when it is older than 24 hours; the baseline installs needrestart, and hosts without it report restart state as unknown; findings kept in their own per-host history file, outside the decision record. It checks the tracker's JSON fields against a live copy, fixes the spec to pass specs.py check with status: approved, and asks you once more to approve the criteria. Cost: a new command, a schema change to the inspect snapshot (two required package fields), and a new catalog operation
2. Not now: shipmill closes this PR and keeps the branch, so the text can come back later, for example as an item of the G-2 plan. Cost: nothing reports open CVEs on the fleet meanwhile

Reply here with a number or your own answer; shipmill takes this up on the tick after your reply.

[shipmill-romamo]

Decision by @romamo, relayed by Claude Code

2, not now. Keep the branch and bring CVE tracking back as an item of the G-2 plan (#190), which still waits on my answer; nothing asks for this work yet and the spec does not pass specs.py check.

[shipmill-romamo]

Closing on @romamo's answer above (option 2, not now): nothing asks for CVE tracking yet, and the spec doesn't pass specs.py check.

The branch docs/spec-010-cve-tracking stays, so the text can come back as an item of the G-2 plan (#190). When it does, it needs status: draft, no Open questions section, and an Issues line in the - #N: S-010-k shape before specs.py check passes.