upstream(lasuite-docs): note minio Docker images stopped at 2025-09-07

The skill said to render a sourceless recipe as '?'. It now says how to stop it
being sourceless: declare an NVD CPE in the registry. That is what took the fleet
from two blind recipes to zero, and it is the first thing to try when the sweep
flags another.

.claude/skills/cc-ci-cleanup/SKILL.md

@@ -0,0 +1,97 @@
+---
+name: cc-ci-cleanup
+description: Tidy the fleet's open recipe PRs. Reconciles every mirror from TRUE upstream first (which alone closes PRs upstream already merged), then surveys every open PR deterministically, CLOSES the ones that can no longer be merged or were never meant to be (CI sweep artifacts, obsolete bumps, superseded duplicates) with a reason, and reports prioritised action items for the ones that SHOULD merge — what specifically is blocking each. NEVER merges a recipe PR. Invoke as /cc-ci-cleanup [recipe ...] [--dry-run].
+---
+
+# cc-ci-cleanup
+
+Open recipe PRs accumulate and rot. Some were never meant to merge (CI sweep artifacts), some were
+overtaken (upstream merged the same change, or a newer PR supersedes them), and some genuinely should
+land but are quietly blocked. Left alone the list becomes noise, and a real CVE fix hides in it.
+
+This skill separates those three, acts on the first two, and hands you a short list for the third.
+
+**Boundaries.** It **CLOSES** irrelevant PRs and **NEVER MERGES** any recipe PR — those change what
+deploys on other people's infrastructure, so a human merges them (see AGENTS.md). Closing is the only
+write it performs, always with a comment saying why.
+
+## Arguments
+- `<recipe> …` — limit to these recipes (else every recipe in `cc-ci-plan/used-recipes.md`).
+- `--dry-run` — classify and report, close nothing.
+
+## Procedure
+
+### 1. Reconcile every mirror from TRUE upstream — MANDATORY, FIRST
+```
+cc-ci-plan/reconcile-upstream.sh --all        # or: reconcile-upstream.sh <recipe>...
+```
+**Do not skip this and do not reorder it.** Every signal in step 2 is measured against the mirror's
+`main`; against a stale mirror they are all wrong. This step also does a chunk of the cleanup by
+itself — it closes any PR whose changes upstream has already merged.
+
+> On the first real run (2026-08-11) this alone closed **three** PRs that looked pending and were
+> already merged upstream: discourse #6 (carrying **140 CVEs**), keycloak #6 (**12 CVEs**), n8n #5.
+> All three had been reported to the operator as outstanding work. mailu #6 went the same way earlier
+> the same day. Reconciling is not hygiene, it is how you avoid recommending work that is already done.
+
+### 2. Survey every open PR (deterministic — no judgement yet)
+```
+python3 cc-ci-plan/pr-survey.py [recipe ...]          # add --json for the raw facts
+```
+Per PR it measures: `behind_main`, `ahead`, `mergeable`, `diff_files`, the images it **adds**, which
+of those are **already in main**, `obsolete`, the newest `!testme` verdict + build, `branch_kind`,
+and age/idle days. It decides nothing — that is this skill's job.
+
+### 3. Classify
+
+**CLOSE — cannot merge, or was never meant to.** Each needs a *positive* reason, not an absence:
+
+| signal | why it is closeable |
+|---|---|
+| `branch_kind: ci-artifact` (`ci/*`) | regall/cfold sweeps and `!testme` probes — harness artifacts, never intended to merge |
+| `obsolete: true` | every image it adds is **already pinned in main** — it has nothing left to contribute |
+| superseded | a newer PR on the same recipe makes the same bump (name both numbers in the comment) |
+| `diff_files: 0` | genuinely empty diff — nothing to merge |
+
+**NEVER close on:**
+- `DIFF-UNREADABLE` — the diff could not be fetched, which is NOT an empty diff. gitea #4 reads that
+  way (force-pushed branch) while being a verified, green, needed fix.
+- any field that came back `null`/unknown.
+- a PR that carries a **CVE fix** and is the only thing carrying it, even if it looks stale — report it
+  instead. Losing a security fix to tidiness is far worse than a long PR list.
+- `--dry-run`.
+
+**NEEDS WORK — should merge, something blocks it.** Give the *specific* next action:
+| signal | action item |
+|---|---|
+| `mergeable: false` | conflicts — rebase the branch on `main` and re-run `!testme` |
+| `behind_main > 0` | out of date — rebase, then re-verify (a green from before main moved proves nothing) |
+| `ci: failed` | diagnose via `/ci-test-review`; classify recipe-bug vs stale test |
+| `ci: never-run` | run `!testme` |
+| blocked on the operator | say exactly what is needed (a secret, an upstream release, a decision) |
+
+**READY — green, current, no conflicts.** Action item is simply: review and merge.
+
+### 4. Close the CLOSE set (skip entirely under `--dry-run`)
+Comment first, then close. The comment must say **which signal** made it closeable and **what to do
+if that is wrong** ("reopen if …"), so a wrong call is cheap to undo. Never close silently.
+
+### 5. Report
+Order by what deserves attention, not by recipe name:
+
+1. **CVE-carrying PRs that should merge** — most severe first, with the CVE ids.
+2. Other **READY** PRs (green + current).
+3. **NEEDS WORK**, each with its one specific action.
+4. **CLOSED this run**, with the reason for each.
+5. Anything **deliberately left alone** despite looking stale, and why.
+
+End with a one-line summary: `N open → C closed, R ready to merge, W need work`.
+
+## Guardrails
+- **Never merge a recipe PR.** Create/verify/close only; the operator merges.
+- **Reconcile first, always.** Judging a PR against a stale mirror is how you close good work or
+  recommend work that is already done.
+- **Close only on a positive signal**, never on "looks old". Age alone is not a reason — several
+  60-day-old PRs here are green and mergeable.
+- **Never close a lone CVE fix.** Report it, however stale.
+- Every close gets a comment with its reason and a reopen hint.

.claude/skills/cve-check/SKILL.md

@@ -104,6 +104,27 @@ CRITICAL came from, and an image with no window is not counted at all.
   distinction was the difference between two false zeros and the truth (both recipes turned out fine,
   but nothing in the survey said so).
 
+### 2c. Know which recipes CANNOT see CVEs at all
+```
+python3 cc-ci-plan/audit-sources.py --security-sources
+```
+A recipe whose sources yield **no CVE data at all** cannot produce a meaningful `0` — nothing was
+measured, the same way a missing registry file cannot. Render those as **`?`**, not `0`.
+
+**The fleet is currently at zero such recipes.** The last two — `mattermost-lts` (empty advisory
+feed, client-side-rendered bulletins) and `mumble` (nothing published anywhere) — were fixed by
+declaring an NVD CPE in their registry:
+```
+- nvd-cpe: mattermost-team-edition = cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
+```
+**If this sweep ever reports a blind recipe again, that is the fix**: find the product's CPE at
+nvd.nist.gov and add the line. Prefer a real advisory feed or an attributable changelog when one
+exists — NVD lags the vendor — but a lagging source beats no source, and it turns a `?` into a
+number.
+
+An *unparseable page* is NOT the same thing: it is harmless when the same project also publishes an
+advisory feed (redis, gitea, minio, clickhouse all do). Only "no usable source for this image" counts.
+
 ### 3. Run the advisory scan over that window
 ```
 python3 /srv/cc-ci/cc-ci-plan/advisory-scan.py <recipe> --from <old-app> --to <new-app> \

.opencode/skills/help/SKILL.md

@@ -31,6 +31,12 @@ Then present the roster grouped as follows, and close with the situation guide.
   PR). `--with-tests` also fixes that recipe's stale test.
 - **/recipe-report** — (re)generate the weekly report page for report.ci.commoninternet.net.
 
+**Keeping the PR list honest**
+- **/cc-ci-cleanup** — reconciles every mirror from true upstream (which alone closes PRs upstream
+  already merged), then closes the open recipe PRs that can no longer merge or were never meant to
+  (CI sweep artifacts, obsolete bumps, superseded duplicates) and reports what is actually blocking
+  the ones that should land. Never merges.
+
 **Security (CVEs)**
 - **/cve-check** — fleet-wide CVE sweep with **no upgrading**: for every recipe, work out what
   upgrade is available (per image, sidecars included), scan it for CVEs, and publish a CVE report.
@@ -81,6 +87,7 @@ ARM skills never touch cc-ci infra. After a submodule bump run `scripts/gen-ccte
 | "Run the weekly upgrades now" | `/upgrade-all` (or `systemctl start cc-ci-upgrade-all.service`) |
 | "Upgrade just <recipe>" | `/recipe-upgrade <recipe>` |
 | "The report site is stale/missing a week" | `/recipe-report` |
+| "The open PR list is a mess / what should I merge?" | `/cc-ci-cleanup` |
 | "What CVEs are we exposed to right now?" | `/cve-check` (read-only, no PRs) |
 | "A CVE just dropped — check and patch it" | `/cve-check-and-upgrade` (add `--min-severity high` to skip the noise) |
 | "Is <recipe> vulnerable?" | `/cve-check <recipe>` |

AGENTS.md

@@ -115,3 +115,29 @@ When the orchestrator, Builder, or assistant makes intentional repository change
 promptly and push them to `git.autonomic.zone` in append-only fashion (never force-push). Match the
 existing commit author and message style in this repo. Do not bundle unrelated worktree changes you
 did not make; stage only the intended files.
+
+## Ship as PRs, merge them yourself, operator reviews retrospectively
+
+**This applies to the two INFRASTRUCTURE repos — `recipe-maintainers/cc-ci-orchestrator` (here) and
+`recipe-maintainers/cc-ci` (the CI product).** For work in either:
+
+1. Branch, don't commit straight to `main`.
+2. Open a PR with a description written to be read **after** the fact: what changed, why, and what
+   evidence says it works (test output, a verified run, a before/after number). The PR *is* the
+   review artifact and the historical record.
+3. **Merge it yourself once it is verified** — do not wait for review. The invocation is the
+   authorization; blocking on review would stall the pipeline these repos exist to run.
+4. The operator reviews **retrospectively**, from the PR.
+
+So the PR is not a gate — it is how the work stays legible. A PR that merely says "fix scanner" has
+failed at its only job.
+
+> ### This does NOT extend to RECIPE repos
+> Recipe PRs — any `coop-cloud/<recipe>` or its `recipe-maintainers/<recipe>` mirror — are
+> **created and verified but NEVER merged by an agent**. Those change what deploys on other people's
+> infrastructure, so a human merges them. The split is deliberate: agents own the tooling, the
+> operator owns the recipes.
+
+If work has already landed on `main` without a PR, do not rewrite published history to fix it.
+Create a branch pinned at the pre-work commit and open the PR against that, so the diff is still
+reviewable and merging only advances the pointer (see PRs #2-#5, 2026-08-11).

cc-ci-plan/advisory-scan.SPEC.md

@@ -107,10 +107,43 @@ URLs containing `<`, `>`, `{`, `}`, `VERSION`, or `vX.Y.Z` are **skipped as temp
 human documentation (`…/changelog/v<VERSION>/`), not fetchable, and counting them as failures is wrong.
 
 This is the source that would have caught gitea: the vendor blog names both CVEs, the GitHub release
-page names neither. A CVE found **only** here carries no version data, so pass 1 cannot place it — it
-goes to pass 2 (§6).
+page names neither.
 
-### 2c. OSV.dev — supplementary
+**When the page is a changelog organised by release, each CVE is attributed to the release heading it
+appears under** (`Changes with nginx 1.31.3`, `## v1.31.3`, …) and that becomes its fixed-in version.
+Without this, a project that publishes no advisory feed can never contribute a CVE:
+
+> **nginx publishes NO GitHub security advisories.** Every nginx CVE we can see comes from
+> `nginx.org/en/CHANGES`. Scraping ids out of it without attributing them to a release left them with
+> no patched version, so they were never classifiable — and every nginx bump in the fleet reported
+> **0** forever. nginx is a sidecar in most recipes. Measured: `1.31.1 → 1.31.3` fixes **six** CVEs
+> (three in .2, three in .3); lasuite-docs#7 went 0 → 6 and lasuite-drive#6 went 0 → 3 on this alone.
+
+A changelog CVE is tied to a window by the **image name appearing in the page URL** (window `nginx` ↔
+`nginx.org/...`). A CVE found on a vendor page with no attributable release still has no version data,
+so pass 1 cannot place it — it goes to pass 2 (§6).
+
+### 2c. NVD by CPE — the fallback for projects that publish nothing
+
+Declared per recipe in the registry as `nvd-cpe: <image-key> = <cpe:2.3:...>`.
+
+> **Why it exists.** Two recipes could not see CVEs *at all*: `mattermost-lts` (empty GitHub advisory
+> feed, security bulletins rendered client-side so a text sweep finds nothing) and `mumble` (nothing
+> published anywhere the registry points). Their scans returned `?` — nothing measured. NVD is
+> CPE-indexed and carries structured ranges, so it answers where the vendor does not: mattermost
+> 10.5.0 → 10.12.4 now scores **165**, and mumble finds `CVE-2025-71264` (fixed 1.6.870).
+
+Two range forms, both used:
+
+| NVD field | meaning | how it is judged |
+|---|---|---|
+| `versionEndExcluding X` | fixed in X exactly | a normal patched version (§4a) |
+| `versionEndIncluding X` | affected **up to and including** X; fix version unpublished | fixed when the upgrade crosses X, i.e. `from ≤ X < to` |
+
+**NVD lags the vendor** — it had neither gitea CVSS-9.8 RCE at publication — so this is a fallback,
+never a replacement for 2a/2b. Unauthenticated calls are rate-limited (~5/30s), hence the retry.
+
+### 2d. OSV.dev — supplementary
 
 Only when the recipe has an entry in `OSV_PACKAGES` (ecosystem + package) and a version is given.
 
@@ -173,6 +206,15 @@ literal compose diff, e.g. "what would the compatibility-safe target fix?").
 
 ### 4a. By patched version (preferred — exact)
 
+**A fix on the line you are upgrading FROM was already yours.** Projects that maintain several lines
+patch them all at once: mattermost fixed `CVE-2025-11794` in 10.11.4, 10.12.1 *and* 10.5.12. An
+upgrade 10.11.22 → 10.12.4 crosses 10.12.1, so a naive window test counts it — but 10.11.22 is
+already past 10.11.4, so the deployment had the fix before the upgrade. Counting it credits the
+upgrade with work it did not do. This check is **skipped for placeholder versions** (`7.4.X` parses
+to a bare `7.4`, which would read as "already fixed at 7.4" and silently drop a real fix — exactly
+how redis `CVE-2024-46981` was lost when the rule was first added).
+
+
 `patched_versions` is a **range expression** (`">= 2.18.1"`), possibly several joined by `;`. Extract
 every version-looking token; the advisory is **fixed-by-this-upgrade** if **any** patched version `p`
 satisfies `from < p <= to` — exclusive lower (a fix already in the version you were on is not this

cc-ci-plan/advisory-scan.py

@@ -44,7 +44,9 @@ import json
 import os
 import re
 import sys
+import time
 import urllib.error
+import urllib.parse
 import urllib.request
 
 REGISTRY_DIR = os.environ.get("CCCI_UPSTREAM_REGISTRY", "/srv/cc-ci/cc-ci-plan/upstream")
@@ -164,6 +166,27 @@ def _vkey(v: str | None) -> tuple:
     return tuple(out)
 
 
+def _already_fixed_on_from_line(kf: tuple, cands: list[tuple]) -> bool:
+    """Was it ALREADY fixed on the line we are upgrading FROM?
+
+    The mirror image of _superseded_on_target_line, and just as necessary. mattermost fixes each CVE
+    across several maintained lines at once — CVE-2025-11794 is patched in 10.11.4, 10.12.1 and
+    10.5.12. Upgrading 10.11.22 -> 10.12.4 crosses 10.12.1, so a naive window test counts it; but
+    10.11.22 is already past 10.11.4, so the deployment HAD the fix before the upgrade. Counting it
+    credits the upgrade with work it did not do."""
+    if len(kf) < 2:
+        return False
+    line = kf[:2]
+    for c in cands:
+        if len(c) < 2 or c[:2] != line:
+            continue
+        n = max(len(kf), len(c))
+        pad = lambda z: z + (0,) * (n - len(z))
+        if pad(c) <= pad(kf):
+            return True
+    return False
+
+
 def _superseded_on_target_line(kt: tuple, cands: list[tuple]) -> bool:
     """Does a patched version on the TARGET's own release line sit ABOVE the target?
 
@@ -272,6 +295,51 @@ def github_advisories(urls: list[str]) -> list[dict]:
     return results
 
 
+# Release headings in a vendor changelog. nginx's CHANGES uses "Changes with nginx 1.31.3", most
+# markdown changelogs use "## 1.31.3" / "## v1.31.3".
+_HEADING_RE = re.compile(
+    r"^\s*(?:#{1,4}\s*)?(?:Changes with\s+\S+\s+|Version\s+|Release\s+)?v?(\d+\.\d+(?:\.\d+)*)\s*$"
+    r"|^\s*Changes with\s+\S+\s+(\d+\.\d+(?:\.\d+)*)", re.I)
+
+
+def _changelog_versions(text: str) -> dict:
+    """{cve: version} for a changelog that is ORGANISED BY RELEASE.
+
+    Why this exists: nginx publishes NO GitHub security advisories. Every nginx CVE we can see comes
+    from nginx.org/en/CHANGES, and scraping ids out of it without attributing them to a release
+    leaves them with no patched version — so they can never be classified, and an nginx bump reports
+    0 CVEs forever. nginx 1.31.1 -> 1.31.3 in fact fixes SIX (three in .2, three in .3), and nginx is
+    a sidecar in most of the fleet, so that was a fleet-wide blind spot.
+
+    Attributes each CVE to the nearest PRECEDING release heading — the release that fixed it.
+    """
+    plain = re.sub(r"<[^>]+>", " ", text)
+    out, cur = {}, None
+    for line in plain.splitlines():
+        m = _HEADING_RE.match(line)
+        if m:
+            cur = m.group(1) or m.group(2)
+            continue
+        if cur:
+            for cve in CVE_RE.findall(line):
+                out.setdefault(cve, cur)
+    return out
+
+
+_BLOB_RE = re.compile(r"^https://github\.com/([^/]+)/([^/]+)/blob/(.+)$")
+
+
+def _raw_if_blob(url: str) -> str:
+    """A GitHub *blob* URL is an HTML viewer, not the file.
+
+    The registry pointed ONLYOFFICE's CHANGELOG.md at its blob page. Fetching that returns 636KB of
+    markup in which the release headings do not survive HTML-stripping, so 24 CVEs were visible and
+    NONE attributable to a release — the same shape of blind spot as nginx. The raw URL attributes
+    all 24. Normalising here fixes every registry entry at once, present and future."""
+    m = _BLOB_RE.match(url)
+    return f"https://raw.githubusercontent.com/{m.group(1)}/{m.group(2)}/{m.group(3)}" if m else url
+
+
 def vendor_pages(urls: list[str]) -> list[dict]:
     """Fetch each registry URL and regex out CVE ids, with a little surrounding context."""
     out = []
@@ -284,20 +352,93 @@ def vendor_pages(urls: list[str]) -> list[dict]:
             # correct; counting them as failures would wrongly mark the recipe's count unreliable.
             out.append({"source": u, "status": "skipped: template URL (not fetchable)", "cves": [], "context": {}})
             continue
-        entry = {"source": u, "status": "ok", "cves": [], "context": {}}
+        entry = {"source": u, "status": "ok", "cves": [], "context": {}, "fixed_in": {}}
         try:
-            text = _fetch(u)
+            text = _fetch(_raw_if_blob(u))
             plain = re.sub(r"<[^>]+>", " ", text)
             for cve in sorted(set(CVE_RE.findall(plain))):
                 entry["cves"].append(cve)
                 i = plain.find(cve)
                 entry["context"][cve] = re.sub(r"\s+", " ", plain[max(0, i - 160) : i + 200]).strip()
+            entry["fixed_in"] = _changelog_versions(text)
         except Exception as e:  # noqa: BLE001
             entry["status"] = f"error: {type(e).__name__}: {e}"
         out.append(entry)
     return out
 
 
+NVD_API = "https://services.nvd.nist.gov/rest/json/cves/2.0"
+NVD_CPE_RE = re.compile(r"^\s*[-*]?\s*nvd-cpe:\s*(\S+)\s*=\s*(cpe:2\.3:[^\s`]+)", re.M | re.I)
+
+
+def registry_cpes(recipe: str, registry_dir: str) -> list[tuple[str, str]]:
+    """[(image-key, cpe)] declared in the recipe's registry as `nvd-cpe: <key> = <cpe>`."""
+    path = os.path.join(registry_dir, f"{recipe}.md")
+    try:
+        return [(m.group(1), m.group(2)) for m in NVD_CPE_RE.finditer(open(path).read())]
+    except OSError:
+        return []
+
+
+def nvd_advisories(cpe: str, key: str) -> dict:
+    """CVEs for a CPE from NVD, with the version data the classifier needs.
+
+    THE FALLBACK FOR PROJECTS THAT PUBLISH NOTHING MACHINE-READABLE. mattermost's GitHub advisory
+    feed is empty and its security bulletins are client-side rendered; mumble publishes neither. Both
+    scanned as `?` — nothing measured — until here. NVD is CPE-indexed and carries structured ranges:
+
+      versionEndExcluding X  -> fixed in X exactly            (a patched version)
+      versionEndIncluding X  -> affected up to and INCLUDING X, fixed in some later release. The
+                                exact fix version is unknown, but the upgrade fixes it whenever it
+                                crosses X — recorded as `affected_max` and judged in the classifier.
+
+    NVD LAGS the vendor (it had neither gitea CVSS-9.8 RCE at publication), so this is a fallback,
+    never a replacement for 2a/2b. Unauthenticated calls are rate-limited to ~5/30s, hence the retry.
+    """
+    entry = {"source": f"nvd:{key}", "status": "ok", "advisories": []}
+    url = f"{NVD_API}?resultsPerPage=2000&virtualMatchString={urllib.parse.quote(cpe)}"
+    data = None
+    for attempt in range(3):
+        try:
+            data = json.loads(_fetch(url))
+            break
+        except Exception as e:  # noqa: BLE001
+            if attempt == 2:
+                entry["status"] = f"error: {type(e).__name__}"
+                return entry
+            time.sleep(8)
+    for v in (data or {}).get("vulnerabilities", []):
+        c = v.get("cve") or {}
+        cid = c.get("id")
+        if not cid:
+            continue
+        fixed, affected_max = set(), set()
+        for cfg in c.get("configurations", []):
+            for node in cfg.get("nodes", []):
+                for m in node.get("cpeMatch", []):
+                    if m.get("versionEndExcluding"):
+                        fixed.add(m["versionEndExcluding"])
+                    elif m.get("versionEndIncluding"):
+                        affected_max.add(m["versionEndIncluding"])
+        sev = None
+        for mk in ("cvssMetricV31", "cvssMetricV30", "cvssMetricV2"):
+            got = (c.get("metrics") or {}).get(mk) or []
+            if got:
+                sev = (got[0].get("cvssData") or {}).get("baseSeverity")
+                break
+        entry["advisories"].append({
+            "cve": cid, "ghsa": None, "severity": (sev or "").lower() or None,
+            "summary": next((d.get("value") for d in c.get("descriptions", [])
+                             if d.get("lang") == "en"), "")[:200],
+            "vulnerable_range": None,
+            "patched": "; ".join(sorted(fixed)) or None,
+            "affected_max": "; ".join(sorted(affected_max)) or None,
+            "url": f"https://nvd.nist.gov/vuln/detail/{cid}",
+            "published_at": c.get("published"), "description": None, "cvss": None,
+        })
+    return entry
+
+
 def osv(recipe: str, version: str | None) -> dict | None:
     pkg = OSV_PACKAGES.get(recipe)
     if not pkg or not version:
@@ -595,7 +736,8 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str,
         e = report["cves"].setdefault(cve, {"sources": [], "severity": None, "ghsa": None,
                                             "vulnerable_range": None, "patched": None,
                                             "context": None, "published_at": None,
-                                            "description": None, "url": None, "cvss": None})
+                                            "description": None, "url": None, "cvss": None,
+                                            "changelog_fixed_in": None, "affected_max": None})
         if src not in e["sources"]:
             e["sources"].append(src)
         for k, v in extra.items():
@@ -612,11 +754,22 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str,
                        context=a.get("summary"), published_at=a.get("published_at"),
                        description=a.get("description"), url=a.get("url"), cvss=a.get("cvss"))
 
+    for key, cpe in registry_cpes(recipe, registry_dir):
+        entry = nvd_advisories(cpe, key)
+        report["sources"].append({"source": entry["source"], "status": entry["status"],
+                                  "found": len(entry.get("advisories") or [])})
+        for a in entry.get("advisories", []):
+            record(a["cve"], entry["source"], severity=a.get("severity"),
+                   patched=a.get("patched"), affected_max=a.get("affected_max"),
+                   context=a.get("summary"), published_at=a.get("published_at"),
+                   url=a.get("url"))
+
     for entry in vendor_pages(urls):
         report["sources"].append({"source": entry["source"], "status": entry["status"],
                                   "found": len(entry.get("cves", []))})
         for cve in entry.get("cves", []):
-            record(cve, entry["source"], context=entry["context"].get(cve))
+            record(cve, entry["source"], context=entry["context"].get(cve),
+                   changelog_fixed_in=(entry.get("fixed_in") or {}).get(cve))
 
     for version in filter(None, (v_from, v_to)):
         o = osv(recipe, version)
@@ -651,13 +804,27 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str,
     #
     # A source with no window is not classified: its advisories are listed as unclassified so they
     # stay visible without inflating the count.
-    gh_sources = [x["source"] for x in report["sources"] if x["source"].startswith("github-advisories:")]
+    gh_sources = [x["source"] for x in report["sources"]
+                  if x["source"].startswith(("github-advisories:", "nvd:"))]
     primary = gh_sources[0] if (gh_sources and (v_from or v_to)) else None
     report["primary_source"] = primary
 
     windows = {}                                    # source name -> (from, to)
+    window_key = {}                                 # source name -> the image name it covers
     if primary:
         windows[primary] = (v_from, v_to)
+        window_key[primary] = primary.split("/")[-1]
+        # The app's window must also cover its NVD entry. NVD sources are keyed by IMAGE name
+        # (`mattermost-team-edition`) while the advisory feed is keyed by REPO (`mattermost/
+        # mattermost`), so without this the fallback source that exists precisely because the feed
+        # is empty would itself go unwindowed — and mumble/mattermost would still report nothing.
+        pname = primary.split("/")[-1].lower()
+        for src in gh_sources:
+            if src.startswith("nvd:") and src not in windows:
+                k = src.split(":", 1)[1].lower()
+                if pname in k or k in pname:
+                    windows[src] = (v_from, v_to)
+                    window_key[src] = k
     for key, wf, wt in (images or []):
         for src in gh_sources:
             if src in windows:
@@ -669,6 +836,7 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str,
             k, name = key.lower(), src.split("/")[-1].lower()
             if k in src.lower() or name in k:
                 windows[src] = (wf, wt)
+                window_key[src] = key
     report["windows"] = {k: {"from": f, "to": t} for k, (f, t) in windows.items()}
 
     def _classify_window(src, wf, wt):
@@ -687,12 +855,31 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str,
                     continue
                 patched = e.get("patched") or ""
                 cands = [_vkey(t) for t in re.findall(r"\d+(?:\.\d+)*", patched)]
+                # NEVER on a placeholder: "7.4.X" parses to the bare 7.4, which then reads as
+                # "already fixed at 7.4" and silently drops a real fix (redis CVE-2024-46981).
+                # A placeholder means the fix version is unknown — that is the indeterminate path.
+                if (kf and kt and not PLACEHOLDER_RE.search(patched)
+                        and _already_fixed_on_from_line(kf, cands)):
+                    # already had it before the upgrade
+                    e.setdefault("classification", "outside-window")
+                    continue
                 if kf and kt and _superseded_on_target_line(kt, cands):
                     # The target's own line got the fix LATER than the target: not fixed here.
                     e.setdefault("classification", "outside-window")
                     continue
                 if kf and kt and any(_within(kf, kt, c) for c in cands):
                     got.add(cve)
+                elif kf and kt and e.get("affected_max"):
+                    # NVD's `versionEndIncluding X`: affected up to and INCLUDING X, fixed in some
+                    # later release. The exact fix version is unpublished, but the upgrade delivers
+                    # it whenever it crosses X — i.e. from <= X < to.
+                    for t in re.findall(r"\d+(?:\.\d+)*", e["affected_max"]):
+                        x = _vkey(t)
+                        n = max(len(kf), len(kt), len(x))
+                        pad = lambda z: z + (0,) * (n - len(z))
+                        if x and pad(kf) <= pad(x) < pad(kt):
+                            got.add(cve)
+                            break
                 elif not patched or PLACEHOLDER_RE.search(patched):
                     # No fix version published ("TBD") or only a placeholder ("7.4.X" — which could
                     # be 7.4.1, inside the window). We cannot say either way, so say so.
@@ -726,6 +913,32 @@ def scan(recipe: str, v_from: str | None, v_to: str | None, registry_dir: str,
             report["cves"][cve]["classification"] = f"fixed-by-this-upgrade ({method}) via {src}"
             fixed_set.add(cve)
 
+    # A CVE seen only in a vendor CHANGELOG has no advisory feed behind it, but the changelog says
+    # which release fixed it (see _changelog_versions). Tie it to a window by the image name
+    # appearing in the page URL — nginx's window is `nginx`, and its changelog is nginx.org/... .
+    # Without this, projects that publish no GitHub advisories (nginx being the big one) can never
+    # contribute a CVE, and every nginx bump in the fleet silently reports 0.
+    from_changelog = {}
+    for cve, e in report["cves"].items():
+        if cve in fixed_set or not e.get("changelog_fixed_in"):
+            continue
+        for src, (wf, wt) in windows.items():
+            key = (window_key.get(src) or "").lower()
+            if not key:
+                continue
+            if not any(key in s_.lower() for s_ in e["sources"] if s_.startswith("http")):
+                continue
+            kf, kt = _vkey(wf), _vkey(wt)
+            cand = _vkey(e["changelog_fixed_in"])
+            if kf and kt and cand and _within(kf, kt, cand):
+                e["classification"] = (f"fixed-by-this-upgrade (named under {e['changelog_fixed_in']} "
+                                       f"in the vendor changelog) via {src}")
+                fixed_set.add(cve)
+                from_changelog[cve] = e["changelog_fixed_in"]
+            break
+    if from_changelog:
+        report["resolved_by_changelog"] = from_changelog
+
     unknown = []
     for cve, e in report["cves"].items():
         if cve in fixed_set:

cc-ci-plan/audit-sources.py

@@ -42,6 +42,11 @@ _spec = importlib.util.spec_from_file_location("resolve_images", os.path.join(HE
 RI = importlib.util.module_from_spec(_spec)
 _spec.loader.exec_module(RI)
 
+# advisory-scan supplies the source-fetching + changelog-attribution used by --security-sources
+_aspec = importlib.util.spec_from_file_location("advisory_scan", os.path.join(HERE, "advisory-scan.py"))
+A = importlib.util.module_from_spec(_aspec)
+_aspec.loader.exec_module(A)
+
 REGISTRY_DIR = os.environ.get("CCCI_UPSTREAM_REGISTRY", os.path.join(HERE, "upstream"))
 USED_RECIPES = os.path.join(HERE, "used-recipes.md")
 DEPRECATION_RE = re.compile(
@@ -108,6 +113,45 @@ def newest_tag_date(registry: str, repo: str, tag: str) -> str | None:
     return (d.get("results") or [{}])[0].get("last_updated")
 
 
+def security_source_audit(recipe: str) -> list[dict]:
+    """Per source: are its CVEs USABLE, or merely visible?
+
+    The nginx lesson. nginx publishes no GitHub advisories; all its CVEs live in nginx.org/en/CHANGES.
+    The scan saw them and could do nothing with them, because nothing said which release fixed which
+    CVE — so every nginx bump in the fleet reported 0. Attribution (advisory-scan §2b) fixed that for
+    changelogs organised by release, but a page that lists CVEs with NO release structure is still a
+    blind spot: visible, uncountable. This finds those.
+
+    Per source: `advisory-feed` (structured, best), `changelog` (CVEs attributable to a release),
+    `unattributable` (CVEs present but no release structure — BLIND), or `no-cve-data`.
+    """
+    urls, _ = _registry_urls(recipe)
+    out = []
+    # NVD CPE entries are a first-class source: for projects publishing nothing machine-readable
+    # (mattermost, mumble) they are the ONLY structured source, and omitting them here made two
+    # recipes look permanently blind after they had been fixed.
+    for key, cpe in A.registry_cpes(recipe, REGISTRY_DIR):
+        e = A.nvd_advisories(cpe, key)
+        n = len(e.get("advisories") or [])
+        out.append({"source": e["source"] + f"  ({cpe.split(':')[4]}/{cpe.split(':')[3]})",
+                    "kind": "advisory-feed" if n else "no-cve-data",
+                    "status": e["status"], "cves": n, "usable": n})
+    for entry in A.github_advisories(urls):
+        out.append({"source": entry["source"], "kind": "advisory-feed",
+                    "status": entry["status"], "cves": len(entry.get("advisories") or []),
+                    "usable": len(entry.get("advisories") or [])})
+    for entry in A.vendor_pages(urls):
+        if entry["status"].startswith("skipped"):
+            continue
+        n = len(entry.get("cves") or [])
+        attributed = len(entry.get("fixed_in") or {})
+        kind = ("no-cve-data" if n == 0 else
+                "changelog" if attributed else "unattributable")
+        out.append({"source": entry["source"], "kind": kind, "status": entry["status"],
+                    "cves": n, "usable": attributed})
+    return out
+
+
 def audit_recipe(recipe: str, ssh: str | None, quiet_days: int) -> dict:
     out = {"recipe": recipe, "findings": [], "images": [], "sources": []}
     try:
@@ -214,9 +258,41 @@ def main() -> int:
     ap.add_argument("--ssh", default=None)
     ap.add_argument("--quiet-days", type=int, default=365)
     ap.add_argument("--json", action="store_true")
+    ap.add_argument("--security-sources", action="store_true",
+                    help="audit whether each recipe's CVE sources are USABLE (structured advisory "
+                         "feed / release-attributable changelog) or merely visible")
     a = ap.parse_args()
 
     recipes = a.recipes or all_recipes()
+    if a.security_sources:
+        # What matters is whether the RECIPE can see CVEs at all — not whether some individual page
+        # is unparseable. A page with no release structure is harmless when the same project also
+        # publishes an advisory feed (redis, gitea, minio, clickhouse all do); it is only a blind
+        # spot when nothing else covers that project.
+        blind_recipes, noisy = [], 0
+        for r in recipes:
+            rows = security_source_audit(r)
+            feeds = [x for x in rows if x["kind"] == "advisory-feed" and x["cves"] > 0]
+            logs = [x for x in rows if x["kind"] == "changelog"]
+            unattr = [x for x in rows if x["kind"] == "unattributable"]
+            noisy += len(unattr)
+            usable = len(feeds) + len(logs)
+            if usable == 0:
+                blind_recipes.append(r)
+                print(f"!! {r}: NO USABLE CVE SOURCE — {len(unattr)} unparseable page(s), "
+                      f"0 advisory feeds, 0 attributable changelogs")
+                for x in rows:
+                    print(f"      {x['kind']:15} {x['source'][:64]} ({x['cves']} CVEs)")
+            else:
+                print(f"OK {r}: {len(feeds)} advisory-feed(s), {len(logs)} changelog(s)"
+                      + (f", {len(unattr)} unparseable page(s) (redundant — covered by a feed)"
+                         if unattr else ""))
+                for x in logs:
+                    print(f"      changelog  {x['source'][:62]} ({x['usable']}/{x['cves']})")
+        print(f"\n{len(recipes)} recipes · {len(blind_recipes)} with NO usable CVE source"
+              + (f": {', '.join(blind_recipes)}" if blind_recipes else "")
+              + f" · {noisy} unparseable page(s) elsewhere (harmless where a feed covers them)")
+        return 0
     reports = [audit_recipe(r, a.ssh, a.quiet_days) for r in recipes]
     if a.json:
         print(json.dumps(reports, indent=2))

cc-ci-plan/pr-survey.py

@@ -0,0 +1,231 @@
+#!/usr/bin/env python3
+"""pr-survey — deterministic facts about every open recipe PR, for /cc-ci-cleanup to judge.
+
+Open recipe PRs rot in specific, detectable ways. This gathers the evidence; it does NOT decide
+anything — closing a PR is a judgement the skill makes, with these facts in hand.
+
+RUN `reconcile-upstream.sh --all` FIRST. Every signal below is measured against the mirror's `main`,
+and an unreconciled mirror makes all of them wrong: on 2026-08-11 three PRs (discourse #6 carrying
+140 CVEs, keycloak #6 carrying 12, n8n #5) looked pending against a stale mirror while upstream had
+already merged them. This tool refuses to guess about that — see `reconciled_recently`.
+
+Per PR:
+  behind_main      commits on main not in the branch — the "out of date" measure
+  ahead            commits on the branch not on main
+  mergeable        gitea's own verdict (false = conflicts, needs a rebase)
+  diff_files       files the PR touches (0 = nothing left to merge)
+  adds_images      the `+ image:` lines it introduces
+  already_in_main  those `+ image:` lines ALREADY present in main -> the bump landed another way
+  obsolete         true when every image it adds is already in main (nothing to contribute)
+  ci               newest `!testme` verdict + build number parsed from the PR comments
+  branch_kind      upgrade / fix / ci-artifact (`ci/*` sweep + probe branches) / other
+  age_days, stale_days (since last update)
+
+    pr-survey.py [recipe ...] [--json]
+"""
+
+from __future__ import annotations
+
+import argparse
+import base64
+import json
+import os
+import re
+import sys
+import urllib.error
+import urllib.parse
+import urllib.request
+from datetime import datetime, timezone
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+USED_RECIPES = os.path.join(HERE, "used-recipes.md")
+TESTENV = os.environ.get("CCCI_TESTENV", "/srv/cc-ci/.testenv")
+NS = "recipe-maintainers"
+
+
+def _env() -> dict:
+    e = {}
+    try:
+        for ln in open(TESTENV):
+            ln = ln.strip()
+            if "=" in ln and not ln.startswith("#"):
+                k, v = ln.split("=", 1)
+                e[k] = v.strip().strip('"').strip("'")
+    except OSError:
+        pass
+    return e
+
+
+ENV = _env()
+GITEA = os.environ.get("GITEA_URL") or ENV.get("GITEA_URL", "git.autonomic.zone")
+_AUTH = base64.b64encode(
+    f"{os.environ.get('GITEA_USERNAME') or ENV.get('GITEA_USERNAME','')}:"
+    f"{os.environ.get('GITEA_PASSWORD') or ENV.get('GITEA_PASSWORD','')}".encode()
+).decode()
+
+
+def _get(path: str, raw: bool = False):
+    req = urllib.request.Request(
+        f"https://{GITEA}{path}",
+        headers={"Authorization": f"Basic {_AUTH}", "User-Agent": "cc-ci-pr-survey"},
+    )
+    with urllib.request.urlopen(req, timeout=60) as r:
+        body = r.read()
+    return body.decode(errors="replace") if raw else json.loads(body)
+
+
+def _days(iso: str | None) -> int | None:
+    if not iso:
+        return None
+    try:
+        d = datetime.fromisoformat(iso.replace("Z", "+00:00"))
+    except ValueError:
+        return None
+    return (datetime.now(timezone.utc) - d).days
+
+
+def _branch_kind(ref: str) -> str:
+    if ref.startswith("ci/"):
+        return "ci-artifact"          # regall/cfold sweeps + testme probes; never meant to merge
+    if ref.startswith("upgrade"):
+        return "upgrade"
+    if re.match(r"^(fix|feat|chore|revert)", ref):
+        return "fix"
+    return "other"
+
+
+def _main_images(recipe: str) -> set[str]:
+    """Image refs pinned on the mirror's main — the baseline a PR is judged against."""
+    out = set()
+    for f in ("compose.yml",):
+        try:
+            txt = _get(f"/{NS}/{recipe}/raw/branch/main/{f}", raw=True)
+        except Exception:  # noqa: BLE001
+            continue
+        for m in re.finditer(r"^\s*image:\s*[\"']?([^\"'\s]+)", txt, re.M):
+            out.add(m.group(1))
+    return out
+
+
+def _ci_verdict(recipe: str, number: int) -> dict:
+    """Newest cc-ci !testme outcome recorded on the PR."""
+    try:
+        cs = _get(f"/api/v1/repos/{NS}/{recipe}/issues/{number}/comments?limit=100")
+    except Exception:  # noqa: BLE001
+        return {"verdict": "unknown", "build": None}
+    for c in reversed(cs):
+        b = c.get("body") or ""
+        if "cc-ci:testme" not in b:
+            continue
+        m = re.search(r"/cc-ci/(\d+)", b)
+        if "✅" in b or "passed" in b:
+            return {"verdict": "passed", "build": m.group(1) if m else None}
+        if "❌" in b or "failure" in b:
+            return {"verdict": "failed", "build": m.group(1) if m else None}
+        if "⏳" in b or "in progress" in b:
+            return {"verdict": "running", "build": m.group(1) if m else None}
+    return {"verdict": "never-run", "build": None}
+
+
+def survey_pr(recipe: str, pr: dict, main_images: set[str]) -> dict:
+    n = pr["number"]
+    head = pr["head"]["ref"]
+    row = {
+        "recipe": recipe, "number": n, "title": pr.get("title", ""), "head": head,
+        "url": pr.get("html_url"), "branch_kind": _branch_kind(head),
+        "age_days": _days(pr.get("created_at")), "stale_days": _days(pr.get("updated_at")),
+        "mergeable": pr.get("mergeable"),
+    }
+    try:
+        row["behind_main"] = _get(
+            f"/api/v1/repos/{NS}/{recipe}/compare/{urllib.parse.quote(head, safe='')}...main"
+        ).get("total_commits", 0)
+        row["ahead"] = _get(
+            f"/api/v1/repos/{NS}/{recipe}/compare/main...{urllib.parse.quote(head, safe='')}"
+        ).get("total_commits", 0)
+    except Exception:  # noqa: BLE001
+        row["behind_main"], row["ahead"] = None, None
+    # A FAILED diff fetch must never look like an empty diff: gitea#4 404s on .diff (force-pushed
+    # branch) and would otherwise be flagged EMPTY-DIFF and closed — while being a verified, green,
+    # needed fix. Unknown is its own state.
+    diff = None
+    try:
+        body = _get(f"/{NS}/{recipe}/pulls/{n}.diff", raw=True)
+        if body.lstrip().startswith(("diff --git", "From ")) or not body.strip():
+            diff = body
+    except Exception:  # noqa: BLE001
+        diff = None
+    row["diff_files"] = None if diff is None else len(re.findall(r"^diff --git ", diff, re.M))
+    adds = re.findall(r"^\+\s*image:\s*[\"']?([^\"'\s]+)", diff or "", re.M)
+    row["adds_images"] = sorted(set(adds))
+    row["already_in_main"] = sorted({i for i in set(adds) if i in main_images})
+    # Nothing left to contribute: it touches files but every image it introduces is already pinned.
+    # Only claim obsolete when the diff was actually READ. No diff, no verdict.
+    row["obsolete"] = diff is not None and bool(adds) and set(adds).issubset(main_images)
+    row["ci"] = _ci_verdict(recipe, n)
+    return row
+
+
+def all_recipes() -> list[str]:
+    out = []
+    for ln in open(USED_RECIPES):
+        p = ln.split()
+        if len(p) >= 2 and not ln.startswith(("#", "`")) and p[1] in ("weekly", "external"):
+            out.append(p[0])
+    return out
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(description=__doc__,
+                                 formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("recipes", nargs="*")
+    ap.add_argument("--json", action="store_true")
+    a = ap.parse_args()
+
+    rows = []
+    for r in (a.recipes or all_recipes()):
+        try:
+            prs = _get(f"/api/v1/repos/{NS}/{r}/pulls?state=open&limit=50")
+        except urllib.error.HTTPError as e:
+            rows.append({"recipe": r, "error": f"HTTP {e.code}"})
+            continue
+        if not prs:
+            continue
+        mi = _main_images(r)
+        for pr in prs:
+            rows.append(survey_pr(r, pr, mi))
+
+    if a.json:
+        print(json.dumps(rows, indent=2))
+        return 0
+
+    print(f"{len(rows)} open PR(s)\n")
+    for x in sorted(rows, key=lambda z: (z.get("recipe", ""), z.get("number", 0))):
+        if x.get("error"):
+            print(f"  {x['recipe']}: {x['error']}")
+            continue
+        flags = []
+        if x["obsolete"]:
+            flags.append("OBSOLETE(images already in main)")
+        if x["branch_kind"] == "ci-artifact":
+            flags.append("CI-ARTIFACT")
+        if x["diff_files"] == 0:
+            flags.append("EMPTY-DIFF")
+        if x["diff_files"] is None:
+            flags.append("DIFF-UNREADABLE(do not close on this)")
+        if x["mergeable"] is False:
+            flags.append("CONFLICTS")
+        if (x["behind_main"] or 0) > 0:
+            flags.append(f"BEHIND-{x['behind_main']}")
+        print(f"  {x['recipe']}#{x['number']:<3} {x['title'][:52]}")
+        print(f"      {x['branch_kind']:12} age={x['age_days']}d idle={x['stale_days']}d "
+              f"ci={x['ci']['verdict']}({x['ci']['build'] or '-'}) files={x['diff_files'] if x['diff_files'] is not None else '?'}")
+        if x["adds_images"]:
+            print(f"      adds: {', '.join(i.split('/')[-1] for i in x['adds_images'][:4])}")
+        if flags:
+            print(f"      >> {' | '.join(flags)}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

cc-ci-plan/test-advisory-scan.py

@@ -537,6 +537,87 @@ class TestReleaseLineSemantics(unittest.TestCase):
         self.assertEqual(rep["fixed_by_this_upgrade"], ["CVE-2025-49844"])
 
 
+class TestAlreadyFixedOnFromLine(unittest.TestCase):
+    """A fix that landed on the line we upgrade FROM was already ours before the upgrade."""
+
+    def test_backport_to_our_own_line_is_not_credited(self):
+        # mattermost patches every maintained line at once. 10.11.22 -> 10.12.4 crosses 10.12.1, but
+        # 10.11.22 is already past 10.11.4, so the deployment HAD the fix. Counting it credits the
+        # upgrade with work it did not do.
+        rep = run_scan([gh("mattermost/mattermost",
+                           [adv("CVE-1", patched="10.11.4; 10.12.1; 10.5.12")])],
+                       v_from="10.11.22", v_to="10.12.4",
+                       urls=["https://github.com/mattermost/mattermost"])
+        self.assertEqual(rep["fixed_by_this_upgrade"], [])
+
+    def test_a_fix_ABOVE_our_position_on_the_same_line_still_counts(self):
+        rep = run_scan([gh("mattermost/mattermost", [adv("CVE-2", patched="10.11.30; 10.12.1")])],
+                       v_from="10.11.22", v_to="10.12.4",
+                       urls=["https://github.com/mattermost/mattermost"])
+        self.assertEqual(rep["fixed_by_this_upgrade"], ["CVE-2"])
+
+    def test_placeholders_never_feed_this_rule(self):
+        # "7.4.X" parses to a bare 7.4, which would read as "already fixed at 7.4" and silently drop
+        # a real fix — this is exactly how redis CVE-2024-46981 was lost when the rule was added.
+        rep = run_scan([gh("redis/redis", [adv("CVE-3", patched="6.2.X, 7.2.X, 7.4.X")])],
+                       v_from="7.4", v_to="8.10", urls=["https://github.com/redis/redis"])
+        self.assertIn("CVE-3", rep["indeterminate"])
+        self.assertEqual(rep["fixed_by_this_upgrade"], [])
+
+
+class TestChangelogAttribution(unittest.TestCase):
+    """Projects that publish no advisory feed still say which release fixed what — in their changelog."""
+
+    CHANGES = """
+Changes with nginx 1.31.3        11 Aug 2026
+    *) Security: a flaw ... (CVE-2026-60005)
+    *) Security: another ... (CVE-2026-56434)
+
+Changes with nginx 1.31.2        04 Aug 2026
+    *) Security: something ... (CVE-2026-48142)
+
+Changes with nginx 1.31.1        21 Jul 2026
+    *) Security: older ... (CVE-2026-9256)
+
+Changes with nginx 1.20.0        01 Jan 2021
+    *) Security: ancient ... (CVE-2013-2028)
+"""
+
+    def test_each_cve_is_attributed_to_the_release_that_fixed_it(self):
+        got = A._changelog_versions(self.CHANGES)
+        self.assertEqual(got["CVE-2026-60005"], "1.31.3")
+        self.assertEqual(got["CVE-2026-48142"], "1.31.2")
+        self.assertEqual(got["CVE-2026-9256"], "1.31.1")
+        self.assertEqual(got["CVE-2013-2028"], "1.20.0")
+
+    def _scan(self, wfrom, wto):
+        # nginx publishes NO GitHub advisories — the feed is empty and the changelog is everything.
+        return run_scan(
+            [gh("nginx/nginx", [])],
+            [{"source": "https://nginx.org/en/CHANGES", "status": "ok",
+              "cves": sorted(A._changelog_versions(self.CHANGES)),
+              "context": {}, "fixed_in": A._changelog_versions(self.CHANGES)}],
+            images=[("nginx", wfrom, wto)], urls=["https://github.com/nginx/nginx"])
+
+    def test_window_counts_only_the_releases_it_crosses(self):
+        rep = self._scan("1.31.1", "1.31.3")   # 1.31.1 is the FROM, so its CVE is already fixed
+        self.assertEqual(set(rep["fixed_by_this_upgrade"]),
+                         {"CVE-2026-48142", "CVE-2026-56434", "CVE-2026-60005"})
+
+    def test_a_narrower_window_counts_fewer(self):
+        rep = self._scan("1.31.2", "1.31.3")
+        self.assertEqual(set(rep["fixed_by_this_upgrade"]), {"CVE-2026-56434", "CVE-2026-60005"})
+
+    def test_ancient_entries_are_not_swept_in(self):
+        # The changelog lists the project's whole history; only the crossed releases may count.
+        rep = self._scan("1.31.1", "1.31.3")
+        self.assertNotIn("CVE-2013-2028", rep["fixed_by_this_upgrade"])
+
+    def test_evidence_is_recorded(self):
+        rep = self._scan("1.31.1", "1.31.3")
+        self.assertEqual(rep["resolved_by_changelog"]["CVE-2026-60005"], "1.31.3")
+
+
 class TestComposeDerivedWindows(unittest.TestCase):
     """Windows read off a compose diff, so nobody has to remember which --image args an upgrade needs."""
 

cc-ci-plan/upstream/lasuite-docs.md

@@ -18,6 +18,11 @@
 - AUTO_MIGRATIONS=true means DB migrations run automatically on backend startup. No manual step needed.
 - Minio tag uses a date-based RELEASE.YYYY-MM-DDTHH-MM-SSZ format — abra cannot parse it for upgrades;
   check manually on https://github.com/minio/minio/releases.
+- **2026-08-14: Minio stopped publishing Docker images after RELEASE.2025-09-07T16-13-09Z.**
+  GitHub has a newer release (`RELEASE.2025-10-15T17-29-55Z`, published 2025-10-16, with CVE fix
+  GHSA-jjjj-jwhf-8rgr), but the Docker image was never pushed to Docker Hub (returns 404; release
+  notes say "clone the source and build the latest container"). quay.io checked — only 2022-era
+  tags. As of this date, `RELEASE.2025-09-07T16-13-09Z` IS the newest available Docker image.
 - v5.2.0 adds two optional new env vars: DOCUMENT_ALL_ENDPOINT_ENABLED and OIDC_OP_USER_ENDPOINT_FORMAT.
   Both are backward-compatible (no action required for existing deployments).
 - Recipe version label convention: 0.X.Y+vA.B.C where A.B.C is the impress version.

cc-ci-plan/upstream/mattermost-lts.md

@@ -75,3 +75,12 @@
   recreate DB, reimport dump. `DROP DATABASE WITH (FORCE)` requires PostgreSQL 13+ — safe on postgres:15-alpine.
   The previous inline-label approach (no restore hook) was a defect: raw PGDATA restore without a reload
   was a silent no-op. Fixed in PR #2 (restore fix cherry-picked from PR #1 ci/pg-restore).
+
+## NVD CPE fallback
+This project publishes nothing machine-readable we can reach — no GitHub advisory feed,
+no release-attributable changelog — so its CVE count was `?` (nothing measured). NVD is
+CPE-indexed and carries structured version ranges, so it can answer where the vendor
+cannot. It LAGS the vendor, so it is a fallback, never the primary source.
+
+- nvd-cpe: mattermost-team-edition = cpe:2.3:a:mattermost:mattermost_server:*:*:*:*:*:*:*:*
+- nvd-cpe: postgres = cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

cc-ci-plan/upstream/mumble.md

@@ -19,3 +19,11 @@
 - The server image tag is `v<version>-<build>` (e.g. `v1.6.870-4`); the trailing number is the image
   build, not an app version, and moves independently of upstream releases — `abra recipe upgrade`
   reports "no new versions" for it, so use `resolve-images.py` to see those bumps.
+
+## NVD CPE fallback
+This project publishes nothing machine-readable we can reach — no GitHub advisory feed,
+no release-attributable changelog — so its CVE count was `?` (nothing measured). NVD is
+CPE-indexed and carries structured version ranges, so it can answer where the vendor
+cannot. It LAGS the vendor, so it is a fallback, never the primary source.
+
+- nvd-cpe: mumble-server = cpe:2.3:a:mumble:mumble:*:*:*:*:*:*:*:*