@blamejs/exceptd-skills 0.13.3 → 0.13.5

package/data/playbooks/ai-discovered-cve-triage.json

@@ -0,0 +1,1146 @@
+{
+  "_meta": {
+    "id": "ai-discovered-cve-triage",
+    "version": "1.0.0",
+    "last_threat_review": "2026-05-18",
+    "threat_currency_score": 95,
+    "changelog": [
+      {
+        "version": "1.0.0",
+        "date": "2026-05-18",
+        "summary": "Initial seven-phase AI-discovered CVE operational-triage playbook. Distinct from `ai-api` (AI as attack surface) and from existing ai-c2 detection (AI as command-and-control channel): ai-discovered-cve-triage covers the OPERATOR-SIDE response when a CVE is published with an AI-discovery attribution. Walks the AI-discovery claim verification process (Big Sleep / depthfirst / Zellic AI-agentic / Xint / GTIG), the elevated weaponization-velocity expectation (the same AI tooling that found the bug shortens exploit-development cycles), the AI-discovery RWEP factor consequence (+15 to RWEP under the canonical formula), and the framework-coverage gap — none of NIST 800-53 / ISO 27001 / NIS2 / DORA / EU CRA / SOC 2 require AI-discovery to be a tracked input to vulnerability management. Anchors on CVE-2026-31431 (Copy Fail, Theori + Xint), CVE-2026-46300 (Fragnesia, Zellic AI-agentic), CVE-2026-42945 (NGINX Rift, depthfirst — first publicly-attributed AI-discovered nginx CVE), the GTIG 41% of 2025 zero-days statistic, and Hard Rule #7 from AGENTS.md (AI as current reality, not 'emerging'). Cross-walks to framework for compliance-gap surfacing and to kernel for AI-discovered LPE-class follow-through.",
+        "cves_added": [
+          "CVE-2026-31431",
+          "CVE-2026-46300",
+          "CVE-2026-42945"
+        ],
+        "framework_gaps_updated": [
+          "nist-800-53-RA-5-ai-discovery-input",
+          "nist-800-53-SI-5-ai-discovery-feed",
+          "iso-27001-2022-A.5.7-ai-threat-intelligence",
+          "nis2-art21-2c-ai-discovery-cadence",
+          "dora-art10-ai-discovery-tpp-feeds",
+          "eu-cra-art14-ai-discovery-disclosure",
+          "soc2-CC7.1-ai-discovery-anomaly"
+        ]
+      }
+    ],
+    "owner": "@blamejs/platform-security",
+    "air_gap_mode": false,
+    "scope": "cross-cutting",
+    "preconditions": [
+      {
+        "id": "vulnerability-feed-readable",
+        "description": "Agent must be able to read the operator's vulnerability-management feed: NVD ingest, CISA KEV ingest, GHSA / OSV feeds, vendor advisories, organisation-internal vulnerability tracker (Jira, ServiceNow VR, Snyk export). Without this, AI-discovered CVE arrival cannot be correlated to assets in scope.",
+        "check": "agent_has_vulnerability_feed_access == true",
+        "on_fail": "halt"
+      },
+      {
+        "id": "asset-inventory-readable",
+        "description": "Agent must be able to query the operator's asset inventory to determine whether the AI-discovered CVE applies. A CVE-arrival without an asset-applicability map degrades to noise.",
+        "check": "agent_has_cmdb_api_token == true OR agent_has_filesystem_read == true",
+        "on_fail": "halt"
+      }
+    ],
+    "mutex": [],
+    "feeds_into": [
+      {
+        "playbook_id": "framework",
+        "condition": "analyze.compliance_theater_check.verdict == 'theater'"
+      },
+      {
+        "playbook_id": "kernel",
+        "condition": "finding.cve_class == 'kernel-lpe'"
+      },
+      {
+        "playbook_id": "sbom",
+        "condition": "finding.cve_class == 'supply-chain' OR finding.affects_dependency_tree == true"
+      },
+      {
+        "playbook_id": "runtime",
+        "condition": "finding.cve_class == 'webapp-rce' OR finding.cve_class == 'kernel-lpe' OR finding.requires_runtime_indicators == true"
+      }
+    ]
+  },
+  "domain": {
+    "name": "AI-discovered CVE operational triage",
+    "attack_class": "ai-attack-surface",
+    "atlas_refs": [
+      "AML.T0017",
+      "AML.T0040"
+    ],
+    "attack_refs": [
+      "T1068",
+      "T1190",
+      "T1059",
+      "T1588.006"
+    ],
+    "cve_refs": [
+      "CVE-2026-31431",
+      "CVE-2026-46300",
+      "CVE-2026-42945"
+    ],
+    "cwe_refs": [
+      "CWE-20",
+      "CWE-94",
+      "CWE-200",
+      "CWE-269",
+      "CWE-787"
+    ],
+    "d3fend_refs": [
+      "D3-CA",
+      "D3-IOPR",
+      "D3-FAPA"
+    ],
+    "frameworks_in_scope": [
+      "nist-800-53",
+      "nist-csf-2",
+      "iso-27001-2022",
+      "soc2",
+      "nis2",
+      "dora",
+      "eu-cra",
+      "uk-caf",
+      "au-ism",
+      "cmmc"
+    ]
+  },
+  "phases": {
+    "govern": {
+      "jurisdiction_obligations": [
+        {
+          "jurisdiction": "EU",
+          "regulation": "NIS2 Art.23",
+          "obligation": "notify_regulator",
+          "window_hours": 24,
+          "clock_starts": "detect_confirmed",
+          "evidence_required": [
+            "ai_discovery_attribution_evidence",
+            "affected_asset_inventory",
+            "remediation_eta"
+          ]
+        },
+        {
+          "jurisdiction": "EU",
+          "regulation": "DORA Art.19",
+          "obligation": "notify_regulator",
+          "window_hours": 4,
+          "clock_starts": "detect_confirmed",
+          "evidence_required": [
+            "ict_critical_function_impact",
+            "containment_record"
+          ]
+        },
+        {
+          "jurisdiction": "EU",
+          "regulation": "EU CRA Art.14",
+          "obligation": "notify_regulator",
+          "window_hours": 24,
+          "clock_starts": "detect_confirmed",
+          "evidence_required": [
+            "actively_exploited_assessment",
+            "user_notification_draft"
+          ]
+        },
+        {
+          "jurisdiction": "US-Federal",
+          "regulation": "CIRCIA (proposed; CISA reporting)",
+          "obligation": "notify_regulator",
+          "window_hours": 72,
+          "clock_starts": "analyze_complete",
+          "evidence_required": [
+            "covered_cyber_incident_assessment",
+            "ai_discovery_attribution"
+          ]
+        },
+        {
+          "jurisdiction": "US-Federal",
+          "regulation": "SEC Item 1.05 (8-K)",
+          "obligation": "notify_regulator",
+          "window_hours": 96,
+          "clock_starts": "analyze_complete",
+          "evidence_required": [
+            "material_impact_determination",
+            "incident_description"
+          ]
+        },
+        {
+          "jurisdiction": "AU",
+          "regulation": "APRA CPS 234",
+          "obligation": "notify_regulator",
+          "window_hours": 72,
+          "clock_starts": "validate_complete",
+          "evidence_required": [
+            "materiality_assessment",
+            "remediation_completed_evidence"
+          ]
+        },
+        {
+          "jurisdiction": "UK",
+          "regulation": "NCSC CAF B5 (Resilient Networks) + ICO Art.33",
+          "obligation": "notify_regulator",
+          "window_hours": 72,
+          "clock_starts": "detect_confirmed",
+          "evidence_required": [
+            "incident_assessment",
+            "containment_record"
+          ]
+        }
+      ],
+      "theater_fingerprints": [
+        {
+          "pattern_id": "cvss-only-triage-for-ai-discovered",
+          "claim": "Our patch-management SLA is calibrated to CVSS, so a CVSS 7.8 AI-discovered CVE is processed under the standard 30-day window.",
+          "fast_detection_test": "Read the operator's vulnerability-management policy. Confirm it has a separate triage tier for AI-discovered CVEs that recognises (a) the same AI tooling that found the bug shortens exploit-development cycles, (b) AI-discovered CVEs accumulate to KEV listing faster than the historical mean (Copy Fail KEV-listed within 7 weeks of disclosure), (c) RWEP for AI-discovered CVEs is +15 above the non-AI baseline under the canonical scoring formula. If the policy treats AI-discovered identically to non-AI, the policy is theater — operationally the population behaves differently.",
+          "implicated_controls": [
+            "nist-800-53-RA-5",
+            "nist-800-53-SI-2",
+            "iso-27001-2022-A.8.8"
+          ]
+        },
+        {
+          "pattern_id": "ai-discovery-attribution-unverified",
+          "claim": "The CVE was reported as AI-discovered, so we are tracking it accordingly.",
+          "fast_detection_test": "Pull the source attribution. AI-discovery claims fall into bands: (a) AI tool found AND publicly attributed (e.g. depthfirst for nginx-rift, Theori + Xint for Copy Fail) — confidently AI-discovered, (b) AI-assisted (human researcher + AI tool, e.g. Zellic's AI-agentic platform for Fragnesia, Bowling + tool) — confirm via the secondary source, (c) AI-claimed without independent corroboration — treat as unverified, decline the +15 RWEP factor. Theater is calling all three the same. Verify before applying the factor.",
+          "implicated_controls": [
+            "nist-800-53-SI-5",
+            "iso-27001-2022-A.5.7"
+          ]
+        },
+        {
+          "pattern_id": "no-ai-discovery-feed",
+          "claim": "Our vulnerability-intel feed covers NVD + KEV + GHSA — we have AI-discovered CVE coverage.",
+          "fast_detection_test": "NVD and KEV record CVE metadata but do not flag AI-discovery attribution as a structured field. The operator must independently track AI-discovery sources (Theori writeups, depthfirst disclosures, Zellic publications, Google Project Zero AI program, GTIG zero-day annual report). If the operator's feed pipeline does not enumerate any of those sources, the operator is structurally blind to the AI-discovery signal regardless of NVD/KEV coverage.",
+          "implicated_controls": [
+            "nist-800-53-SI-5",
+            "iso-27001-2022-A.5.7",
+            "nis2-art21-2c"
+          ]
+        },
+        {
+          "pattern_id": "kev-as-only-escalation-signal",
+          "claim": "We escalate when CISA KEV lists the CVE — that is our active-exploitation signal.",
+          "fast_detection_test": "KEV-list lag is operationally significant. Copy Fail was disclosed 2026-04-29 and KEV-listed 2026-05-01; many AI-discovered CVEs accumulate to KEV within 1-7 weeks. Waiting for KEV abandons the 1-7 week window where AI-accelerated exploit-development closes against operator-side patch-deployment. The escalation must combine AI-discovery + public PoC + the RWEP-derived SLA, not KEV alone.",
+          "implicated_controls": [
+            "nist-800-53-SI-2",
+            "nist-800-53-RA-7",
+            "iso-27001-2022-A.8.8"
+          ]
+        }
+      ],
+      "framework_context": {
+        "gap_summary": "No compliance framework in scope as of 2026-05 requires AI-discovery to be a tracked input to vulnerability management. NIST 800-53 RA-5 (Vulnerability Scanning) defines scan cadence and severity-based triage but treats discovery-mechanism as an undifferentiated property — an AI-discovered CVE is processed identically to a manually-discovered one. SI-5 (Security Alerts, Advisories, and Directives) names feed sources without anchoring AI-discovery vendor feeds (Theori, depthfirst, Zellic, GTIG). ISO 27001 A.5.7 (Threat intelligence) describes feed collection without naming AI-discovery as a discrimination axis. NIS2 Art.21(2)(c) names vulnerability handling as essential measure without algorithm specifics. DORA Art.10 (ICT-related Incident Management) covers incident classification but not the AI-discovery-derived weaponization-velocity prediction. EU CRA Art.14 (Coordinated vulnerability disclosure) covers manufacturer disclosure obligations but not consumer-side triage acceleration. SOC 2 CC7.1 (System operation monitoring) covers anomaly detection without anchoring AI-discovered CVE intel as a discrete control. The result: an organisation can be fully NIST/ISO/NIS2/DORA/SOC 2 compliant while running 30-day patch SLAs against a population of CVEs whose AI-accelerated weaponization tempo makes 30 days an exploitation window, not a security window. Hard Rule #7 of AGENTS.md (AI as current reality, not 'emerging') sets the project's normative position: 41% of 2025 zero-days had AI involvement per GTIG; treating discovery-mechanism as undifferentiated mis-prices the operational risk.",
+        "lag_score": 540,
+        "per_framework_gaps": [
+          {
+            "framework": "nist-800-53",
+            "control_id": "RA-5 — Vulnerability Scanning",
+            "designed_for": "Scheduled vulnerability scanning + severity-based remediation tracking.",
+            "insufficient_because": "Treats discovery-mechanism as undifferentiated. No control text requires AI-discovery to be tracked as a triage input. A vulnerability-management programme can satisfy RA-5 with quarterly scanning + 30-day SLA against a CVE that the originating AI tool can re-target faster than the SLA window."
+          },
+          {
+            "framework": "nist-800-53",
+            "control_id": "RA-7 — Risk Response",
+            "designed_for": "Risk-response selection: accept, transfer, mitigate, avoid.",
+            "insufficient_because": "Risk-response decisions calibrated to CVSS-equivalent severity without AI-discovery weaponization-velocity input under-weight the response urgency. RA-7 names risk assessment but not the operational signal that AI-discovery shortens exploit cycles."
+          },
+          {
+            "framework": "nist-800-53",
+            "control_id": "SI-2 — Flaw Remediation",
+            "designed_for": "Flaw remediation 'within organization-defined timeframes'.",
+            "insufficient_because": "Organisation-defined timeframes are typically 30 days for critical without acknowledging AI-discovery class. An AI-discovered RCE with public PoC has been weaponised before the typical 30-day window completes; SI-2 timeframe definitions don't enforce the right time-bound."
+          },
+          {
+            "framework": "nist-800-53",
+            "control_id": "SI-5 — Security Alerts, Advisories, and Directives",
+            "designed_for": "Receive and act on advisories from authoritative sources.",
+            "insufficient_because": "Names CISA, US-CERT, vendor advisories. Does not require subscription to AI-discovery vendor feeds (Theori, depthfirst, Zellic, GTIG annual reports). Operators relying only on the named sources are blind to the AI-discovery attribution that elevates RWEP."
+          },
+          {
+            "framework": "iso-27001-2022",
+            "control_id": "A.5.7 — Threat intelligence",
+            "designed_for": "Collection + analysis of threat-intelligence feeds.",
+            "insufficient_because": "Describes feed collection without naming AI-discovery as a discrimination axis. Compliant feed coverage can omit every AI-discovery source and still satisfy A.5.7."
+          },
+          {
+            "framework": "iso-27001-2022",
+            "control_id": "A.8.8 — Management of technical vulnerabilities",
+            "designed_for": "Identification, evaluation, treatment of technical vulnerabilities.",
+            "insufficient_because": "'Appropriate timescales' undefined and AI-discovery not surfaced as a treatment input. Standard 30-day interpretation is unsafe for deterministic AI-discovered RCE/LPE with public PoC."
+          },
+          {
+            "framework": "nis2",
+            "control_id": "Art.21(2)(c) — Vulnerability handling and disclosure",
+            "designed_for": "Vulnerability handling as essential cybersecurity measure.",
+            "insufficient_because": "Process-only; no algorithm specifics. AI-discovery weaponization-velocity is not a recognised triage input. Essential entities can satisfy Art.21(2)(c) with a documented process that ignores AI-discovery signal."
+          },
+          {
+            "framework": "dora",
+            "control_id": "Art.10 — ICT-related Incident Management",
+            "designed_for": "Incident classification + reporting for financial entities.",
+            "insufficient_because": "Classification thresholds inherit CVSS-equivalent severity. No AI-discovery uplift. Financial-entity-side weaponization tempo against AI-discovered CVEs is unaddressed."
+          },
+          {
+            "framework": "eu-cra",
+            "control_id": "Art.14 — Coordinated vulnerability disclosure",
+            "designed_for": "Manufacturer obligation to disclose actively-exploited vulnerabilities.",
+            "insufficient_because": "Covers manufacturer disclosure. Consumer-side: a product operator's triage of an AI-discovered CVE in a third-party dependency is unaddressed by Art.14; the consumer inherits the manufacturer's lag without an operational signal."
+          },
+          {
+            "framework": "soc2",
+            "control_id": "CC7.1 — System operation monitoring",
+            "designed_for": "Anomaly detection + alerting on system events.",
+            "insufficient_because": "Does not anchor AI-discovered CVE intel as a discrete control. A CC7.1 trust-services-criteria report can pass without AI-discovery feed coverage."
+          },
+          {
+            "framework": "uk-caf",
+            "control_id": "B4 — System security",
+            "designed_for": "NCSC CAF outcome that systems are protected from compromise.",
+            "insufficient_because": "Outcome-based. AI-discovery weaponization-velocity not named as a B4 input. A vulnerability-management programme that doesn't subscribe to any AI-discovery source can still be assessed as 'achieving' the outcome."
+          },
+          {
+            "framework": "au-ism",
+            "control_id": "ISM-1493 — Vulnerability management",
+            "designed_for": "Identification + remediation of vulnerabilities in line with Essential 8 ML2/ML3.",
+            "insufficient_because": "Patch-application ladder anchors on advisory date + severity. AI-discovery cycle compression not addressed. ML3 48h SLA still long for a deterministic AI-discovered RCE with public PoC."
+          }
+        ]
+      },
+      "skill_preload": [
+        "ai-attack-surface",
+        "exploit-scoring",
+        "framework-gap-analysis",
+        "compliance-theater",
+        "policy-exception-gen",
+        "threat-model-currency",
+        "ai-risk-management"
+      ]
+    },
+    "direct": {
+      "threat_context": "AI-discovered CVE landscape mid-2026 is operational reality, not emerging. GTIG annual zero-day report (early 2026) records 41% of 2025 zero-days carrying AI involvement: AI tools found the bug, AI tools assisted weaponization, or both. Anchor cases for the current cycle: CVE-2026-31431 (Copy Fail) — Linux kernel page-cache CoW LPE, discovered by Theori using Xint Code AI scanner against the Linux crypto/ subsystem with one operator prompt, disclosed 2026-04-29, KEV-listed 2026-05-01 (3 days), 30-day patch SLA insufficient for a CISA KEV + deterministic + 732-byte public exploit. CVE-2026-46300 (Fragnesia) — Linux kernel XFRM ESP-in-TCP page-cache corruption, AI-assisted discovery by William Bowling using Zellic.io AI-agentic platform, deterministic LPE with module-unload mitigation available, disclosed 2026-05-13; rwep 35 today with explicit notes that score jumps to 55+ on KEV listing + 65+ on confirmed exploitation. CVE-2026-42945 (NGINX Rift) — first publicly-attributed AI-discovered nginx CVE, depthfirst autonomous-analysis discovered heap-buffer-overflow in nginx_http_rewrite_module within 6 hours of scan time, vulnerable code present since nginx 0.6.27 (18 years); operator-side live mitigation = replace unnamed PCRE captures with named captures, no nginx restart. The cycle reads: AI tool finds long-standing bug → public attribution → public PoC within hours-to-days → KEV listing within days-to-weeks → exploitation tempo matches AI-discovery tempo. Operator-side: triage must apply RWEP +15 ai_factor at disclosure (not at KEV listing), source corroborate the AI-discovery claim (Theori writeup mirrored at xint.io, depthfirst github, Zellic publications, GTIG report), and tighten the SLA against the original SI-2 / A.8.8 / Art.21(2)(c) clock by treating AI-discovered as a 'KEV-pending' class. The AI-asymmetry is structural: a vulnerability researcher with an AI tool produces both a finder and a weaponiser; the operator with no AI-discovery feed processes both as a single CVE event lagging the disclosure clock.",
+      "rwep_threshold": {
+        "escalate": 75,
+        "monitor": 50,
+        "close": 30
+      },
+      "framework_lag_declaration": "NIST 800-53 RA-5 + RA-7 + SI-2 + SI-5, ISO 27001 A.5.7 + A.8.8, NIS2 Art.21(2)(c), DORA Art.10, EU CRA Art.14, SOC 2 CC7.1, UK CAF B4, AU ISM-1493 are all structurally insufficient for AI-discovered CVE triage. None require AI-discovery to be a tracked input to vulnerability management. None require subscription to AI-discovery vendor feeds (Theori, depthfirst, Zellic, GTIG). None require SLA tightening for the AI-discovered class. The framework cadence is ~540 days behind the operational AI-discovery wave (FIPS-style AI auditing landed mid-2024; 41% AI-zero-day attribution landed early 2026). Compensating controls (AI-discovery feed subscription + AI-discovery RWEP factor enforcement + tightened SLA tier for AI-discovered class + AI-attribution verification process) must close the gap before SLA-only compliance can be accepted. None of the frameworks in scope require any of those four controls.",
+      "skill_chain": [
+        {
+          "skill": "ai-attack-surface",
+          "purpose": "Apply the AI-attack-surface taxonomy to the discovery event: was the AI a finder, an assistant, or a weaponiser? Surface which AI-tooling families are in operational use against this CVE class.",
+          "required": true
+        },
+        {
+          "skill": "exploit-scoring",
+          "purpose": "Apply RWEP scoring with the +15 ai_factor enforced; cross-walk against CVSS to surface the framework-SLA underweighting.",
+          "required": true
+        },
+        {
+          "skill": "threat-model-currency",
+          "purpose": "Confirm the CVE catalog entry carries last_updated within the recency window; refuse stale-intel triage per Hard Rule #1.",
+          "required": true
+        },
+        {
+          "skill": "framework-gap-analysis",
+          "purpose": "Map the AI-discovery signal against the eleven framework controls listed above; surface which framework would have flagged the underweighting and which would not.",
+          "required": true
+        },
+        {
+          "skill": "compliance-theater",
+          "purpose": "Run the four theater tests in govern.theater_fingerprints; emit verdict per pattern.",
+          "required": true
+        },
+        {
+          "skill": "ai-risk-management",
+          "purpose": "Apply NIST AI RMF mapping where the AI-discovery class touches the operator's own AI / ML deployments; surface model-supply-chain implications.",
+          "skip_if": "operator_ai_estate_empty == true",
+          "required": false
+        },
+        {
+          "skill": "policy-exception-gen",
+          "purpose": "Generate auditor-ready exception language for assets that cannot reach the AI-discovered-tier SLA within the cycle.",
+          "skip_if": "close.exception_generation.trigger_condition == false",
+          "required": false
+        }
+      ],
+      "token_budget": {
+        "estimated_total": 19500,
+        "breakdown": {
+          "govern": 2800,
+          "direct": 1700,
+          "look": 2200,
+          "detect": 2800,
+          "analyze": 4200,
+          "validate": 3500,
+          "close": 2300
+        }
+      }
+    },
+    "look": {
+      "artifacts": [
+        {
+          "id": "ai-discovery-source-feeds",
+          "type": "api_response",
+          "source": "Subscribe + fetch from the operator's configured AI-discovery vendor feeds: Theori writeups (https://xint.io/blog/, https://theori.io/research/), depthfirst disclosures (https://github.com/depthfirstdisclosures), Zellic publications (https://zellic.io/blog), Google Project Zero AI (https://googleprojectzero.blogspot.com/), GTIG annual + monthly zero-day reports, Microsoft Security Research AI-discovery flags, Sysdig research blog, BleepingComputer + The Register AI-discovery coverage.",
+          "description": "Discovery-attribution evidence per CVE. Cross-correlated against NVD + KEV to enrich CVE catalog with ai_discovered flag + discovery_attribution_note.",
+          "required": true,
+          "air_gap_alternative": "If network unreachable, fall back to locally cached vendor PDFs + the operator's offline ai-discovery archive (mirrored vendor writeups, GitHub repository clones). Mark live discovery-feed state as inventory_gap=feeds_unreachable."
+        },
+        {
+          "id": "cve-catalog-ai-flagged-entries",
+          "type": "config_file",
+          "source": "Read data/cve-catalog.json + the operator's organisation-internal CVE store (Snyk export, Wiz CNAPP CVE list, GitHub Dependabot alerts). Filter for entries where ai_discovered == true OR ai_assisted_weaponization == true. Capture per-entry: cve_id, ai_discovery_notes, discovery_attribution_note, rwep_score, rwep_factors.ai_factor.",
+          "description": "Operator-side AI-discovered CVE inventory. Validates that ai_factor +15 is applied per Hard Rule #7 across every flagged entry.",
+          "required": true,
+          "air_gap_alternative": "Local cve-catalog.json + cached enterprise CVE store."
+        },
+        {
+          "id": "vulnerability-management-policy",
+          "type": "config_file",
+          "source": "Read the operator's vulnerability-management policy + SLA matrix: typical paths are policy/vulnerability-management.md, GRC platform export (Archer, ServiceNow VR), security-handbook. Capture per-severity SLA windows + escalation thresholds + per-class overrides (KEV, AI-discovered if present).",
+          "description": "Policy artefact that the triage process binds to. Used to detect the cvss-only-triage-for-ai-discovered theater.",
+          "required": true,
+          "air_gap_alternative": "Local policy filesystem walk."
+        },
+        {
+          "id": "asset-applicability-map",
+          "type": "config_file",
+          "source": "Cross-reference data/cve-catalog.json affected + affected_versions per AI-discovered entry against the operator's CMDB / package inventory. Sample: for CVE-2026-31431 + CVE-2026-46300 (Linux kernel LPE), query host inventory for kernel >= 4.14 + kernel < 6.8.10. For CVE-2026-42945 (nginx), query nginx deployment list + version pin.",
+          "description": "Per-AI-discovered-CVE asset applicability. Bounds the triage scope.",
+          "required": true,
+          "air_gap_alternative": "Local CMDB + filesystem package query (rpm -qa, dpkg -l, etc.)."
+        },
+        {
+          "id": "feed-currency-attestation",
+          "type": "audit_trail",
+          "source": "Check the operator's vulnerability-feed pipeline for AI-discovery source coverage: are Theori / depthfirst / Zellic / GTIG / Project Zero AI named as configured sources? When did each source last update the pipeline? A pipeline that names NVD + KEV only is structurally incomplete for AI-discovered class.",
+          "description": "Audit trail showing AI-discovery feed coverage + last-update timestamps.",
+          "required": true
+        },
+        {
+          "id": "patch-deployment-tempo",
+          "type": "audit_trail",
+          "source": "Historical patch-deployment-time metric per CVE severity, per AI-discovered flag. Sample: for the trailing 90 days, what was median time-to-deploy for critical AI-discovered vs critical non-AI? If the tempos are identical, the operator is processing both populations the same despite the operational asymmetry.",
+          "description": "Operator-side tempo metric. Used to surface whether AI-discovery is currently treated as a discrete class in deployment cadence.",
+          "required": false
+        },
+        {
+          "id": "ai-discovery-verification-archive",
+          "type": "config_file",
+          "source": "Per-AI-discovered-CVE attribution verification record: source URLs cited in the CVE catalog discovery_attribution_note, secondary corroboration (e.g. The Hacker News + Help Net Security cross-citation for Fragnesia), classification (band A — confidently AI-discovered, band B — AI-assisted, band C — claimed-unverified).",
+          "description": "Verification archive that supports applying the +15 ai_factor only when attribution clears band A or B.",
+          "required": false
+        }
+      ],
+      "collection_scope": {
+        "time_window": "rolling_90d_plus_current_cve_arrival",
+        "asset_scope": "operator_full_asset_estate_intersected_with_ai_discovered_cve_applicability",
+        "depth": "deep",
+        "sampling": "complete coverage of operator-internal CVE store; sample 5% of asset estate for applicability validation per CVE. Re-collect on every AI-discovered CVE arrival, every quarterly GTIG report, every vendor publishing cadence."
+      },
+      "environment_assumptions": [
+        {
+          "assumption": "operator's vulnerability-management feed pipeline is operational",
+          "if_false": "Halt with feed_pipeline_required — AI-discovered CVE triage is moot without the ingestion layer."
+        },
+        {
+          "assumption": "CMDB / asset inventory queries return current data",
+          "if_false": "Per-CVE applicability cannot be bounded; mark asset-applicability-map as inventory_gap=cmdb_stale and downgrade overall confidence to medium."
+        },
+        {
+          "assumption": "data/cve-catalog.json is reachable",
+          "if_false": "Halt — the catalog is the canonical AI-discovery flag store."
+        },
+        {
+          "assumption": "AI-discovery vendor sources are reachable OR locally cached",
+          "if_false": "Run in cached-only mode and mark live verification as inventory_gap=feeds_unreachable; do not refuse triage on currently-active critical CVEs because the verification source happens to be unreachable."
+        }
+      ],
+      "fallback_if_unavailable": [
+        {
+          "artifact_id": "ai-discovery-source-feeds",
+          "fallback_action": "use_compensating_artifact",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "cve-catalog-ai-flagged-entries",
+          "fallback_action": "escalate_to_human",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "vulnerability-management-policy",
+          "fallback_action": "escalate_to_human",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "asset-applicability-map",
+          "fallback_action": "use_compensating_artifact",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "feed-currency-attestation",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "low"
+        }
+      ]
+    },
+    "detect": {
+      "indicators": [
+        {
+          "id": "ai-discovered-cve-applicable",
+          "type": "log_pattern",
+          "value": "Within the cve-catalog-ai-flagged-entries artefact: any entry with ai_discovered == true OR ai_assisted_weaponization == true AND the asset-applicability-map shows at least one operator asset in scope of the CVE's affected_versions.",
+          "description": "Operator has an asset in scope of an AI-discovered CVE. Primary trigger for the playbook's downstream phases.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "cve_ref": "CVE-2026-31431",
+          "false_positive_checks_required": [
+            "Confirm the asset-applicability-map covers the CVE's actual exploitation precondition. A Linux kernel CVE applies to kernel-resident hosts; a container running a different kernel is not in scope. Verify by cross-referencing the kernel version actually loaded (uname -r) rather than the package-manager kernel version.",
+            "Confirm the asset is reachable to the threat model in scope. An asset in an isolated dev environment with no external network has lower exposure than the same asset in production."
+          ]
+        },
+        {
+          "id": "ai-discovery-attribution-band-c-unverified",
+          "type": "log_pattern",
+          "value": "Within the ai-discovery-verification-archive: an entry classified as band-C (claimed-AI-discovered without secondary corroboration) AND the cve-catalog entry sets ai_discovered == true with rwep_factors.ai_factor == 15.",
+          "description": "RWEP +15 ai_factor applied without verified attribution. Operator may be over-prioritising; decline the factor until corroborated.",
+          "confidence": "high",
+          "deterministic": false,
+          "false_positive_checks_required": [
+            "Confirm secondary corroboration genuinely absent. Sometimes attribution lives in a vendor blog the operator's feed pipeline hasn't ingested yet; check the catalog's verification_sources URL list before flagging the entry as band C.",
+            "If the catalog entry is recently added (< 30 days), allow a grace window for corroboration to land — flag as band-C-pending rather than band-C-final."
+          ]
+        },
+        {
+          "id": "ai-discovery-feed-coverage-incomplete",
+          "type": "behavioral_signal",
+          "value": "Within the feed-currency-attestation artefact: the configured feed pipeline names NVD + KEV + GHSA but does NOT name at least one of {Theori / Xint, depthfirst, Zellic, Google Project Zero AI, GTIG annual zero-day report, Microsoft Security Research AI program}.",
+          "description": "Structurally blind to AI-discovery attribution signal. The operator may receive the CVE through NVD but without the AI-discovery enrichment.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "false_positive_checks_required": [
+            "Confirm the operator does not consume AI-discovery signal through a secondary aggregator (Snyk Intel, Wiz CNAPP threat-intel, Mandiant Advantage, Recorded Future) that already enriches with AI-discovery attribution. Aggregator coverage is acceptable if it explicitly surfaces the ai_discovered field.",
+            "Confirm the operator's organisation-internal CVE store doesn't independently flag AI-discovery via a manual triage step. Manual triage on the receiving side is acceptable but should be documented in policy."
+          ]
+        },
+        {
+          "id": "policy-no-ai-discovered-tier",
+          "type": "log_pattern",
+          "value": "Within the vulnerability-management-policy artefact: the SLA matrix has no row keyed off ai_discovered == true / AI-discovered class / equivalent. The matrix uses only severity (critical / high / medium / low) and KEV flag.",
+          "description": "Policy treats AI-discovered identically to non-AI-discovered. Per Hard Rule #7 and the +15 RWEP factor, this under-weights the operational risk class.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "false_positive_checks_required": [
+            "Confirm the policy's KEV-tier handling is sufficient for the operator's AI-discovered CVE arrival pattern. If the operator has a 4-hour SLA on KEV that fires when an AI-discovered CVE accumulates to KEV, the effective handling may close the gap — but only if the KEV-listing lag is acceptable.",
+            "Confirm the policy doesn't reference AI-discovery in a non-SLA section (e.g. a 'threat intelligence triage' standalone document). Find the cross-reference before concluding the gap."
+          ]
+        },
+        {
+          "id": "deployment-tempo-equal-ai-vs-non-ai",
+          "type": "behavioral_signal",
+          "value": "Within the patch-deployment-tempo artefact: median time-to-deploy for critical AI-discovered CVEs is within 10% of median time-to-deploy for critical non-AI CVEs over the trailing 90 days.",
+          "description": "Operationally, the operator processes AI-discovered identically to non-AI despite the structural asymmetry. Confirms the policy-no-ai-discovered-tier finding has operational consequence.",
+          "confidence": "high",
+          "deterministic": false,
+          "false_positive_checks_required": [
+            "Confirm the 90-day sample contains sufficient AI-discovered CVE volume to be statistically meaningful (≥ 5 entries). Small-sample tempo equality may reflect noise, not policy.",
+            "Confirm the tempo metric measures time-to-deploy on AFFECTED assets, not time-to-acknowledge or time-to-ticket-creation. Deployment is the gate that matters."
+          ]
+        },
+        {
+          "id": "asset-unpatched-past-rwep-sla",
+          "type": "log_pattern",
+          "value": "Cross-join cve-catalog-ai-flagged-entries × asset-applicability-map × patch-deployment-tempo: any asset still unpatched after the RWEP-derived SLA window (4h for RWEP >= 90, 24h for 75-89, 72h for 60-74) for an AI-discovered CVE.",
+          "description": "Asset has exceeded the canonical RWEP-derived SLA for an AI-discovered CVE. Immediate-action class.",
+          "confidence": "deterministic",
+          "deterministic": true,
+          "attack_ref": "T1068",
+          "false_positive_checks_required": [
+            "Confirm the asset has live-patch coverage in place. A kernel asset with kpatch / canonical-livepatch active against the specific CVE is not 'unpatched' from a risk-state perspective even if the reboot-installed patch is still pending.",
+            "Confirm the asset is not on a documented exception register with compensating controls. Exception with compensating controls is not the same shape as overdue.",
+            "Confirm the RWEP score derivation matches lib/scoring.js — a score that's been hand-edited above the formula output is itself a finding (catalog drift), not a deployment failure."
+          ]
+        },
+        {
+          "id": "no-ai-discovery-verification-process",
+          "type": "behavioral_signal",
+          "value": "The ai-discovery-verification-archive artefact is empty OR every entry is band-C-unverified — the operator's process does not include attribution verification before applying the +15 ai_factor.",
+          "description": "Operator applies (or fails to apply) ai_factor based on the CVE catalog's flag without independent verification. Either over-prioritises unverified claims or under-prioritises confirmed AI-discoveries depending on operator policy.",
+          "confidence": "high",
+          "deterministic": false
+        }
+      ],
+      "false_positive_profile": [
+        {
+          "indicator_id": "ai-discovered-cve-applicable",
+          "benign_pattern": "Asset has live-patch coverage in place against the specific CVE (e.g. canonical-livepatch / kpatch for kernel LPE) and the live-patch is loaded.",
+          "distinguishing_test": "Cross-reference the asset's livepatch state against the CVE id. For kernel CVEs, read /sys/kernel/livepatch/*/cve-ids; for RHEL kpatch, kpatch list. If the CVE id appears in the loaded patch list, downgrade to monitor and re-check on reboot or next livepatch reconciliation."
+        },
+        {
+          "indicator_id": "policy-no-ai-discovered-tier",
+          "benign_pattern": "Operator's SLA matrix has a 'KEV + public PoC' tier that ages AI-discovered CVEs into the same handling tier within the time window the operator's deployment can absorb.",
+          "distinguishing_test": "Compute the lag between disclosure and KEV-listing for the most recent 5 AI-discovered CVEs in scope. If the median lag plus the KEV-tier SLA exceeds the AI-accelerated weaponization tempo (~7-14 days for the current cycle), the KEV-tier handling is insufficient."
+        }
+      ],
+      "minimum_signal": {
+        "detected": "At least one of {ai-discovered-cve-applicable, asset-unpatched-past-rwep-sla, ai-discovery-feed-coverage-incomplete, policy-no-ai-discovered-tier} fires AND the operator has assets in scope.",
+        "inconclusive": "CVE catalog accessible but asset-applicability-map cannot be reconciled (CMDB unreachable). Cannot bound triage scope.",
+        "not_detected": "Feed pipeline names at least one AI-discovery source, policy SLA matrix has an AI-discovered tier with SLA aligned to RWEP-derived timeline, no asset is past the RWEP-SLA for any flagged AI-discovered CVE, attribution-verification process is operational with band-A or band-B classification for every entry where ai_factor is applied."
+      }
+    },
+    "analyze": {
+      "rwep_inputs": [
+        {
+          "signal_id": "ai-discovered-cve-applicable",
+          "rwep_factor": "ai_weaponization",
+          "weight": 15,
+          "notes": "Per the canonical lib/scoring.js formula, ai_discovered = true contributes +15 ai_factor."
+        },
+        {
+          "signal_id": "ai-discovered-cve-applicable",
+          "rwep_factor": "public_poc",
+          "weight": 20,
+          "notes": "AI-discovered CVEs in the 2026 cycle almost always have public PoC at disclosure (Copy Fail 732 bytes; Fragnesia one-line; nginx-rift depthfirst github)."
+        },
+        {
+          "signal_id": "asset-unpatched-past-rwep-sla",
+          "rwep_factor": "active_exploitation",
+          "weight": 20,
+          "notes": "Asset overdue past RWEP-SLA on an AI-discovered CVE class with public PoC is operationally already in the active-exploitation window."
+        },
+        {
+          "signal_id": "asset-unpatched-past-rwep-sla",
+          "rwep_factor": "blast_radius",
+          "weight": 25,
+          "notes": "Blast radius proportional to the underlying CVE's affected population × the operator's asset count in scope."
+        },
+        {
+          "signal_id": "ai-discovery-feed-coverage-incomplete",
+          "rwep_factor": "ai_weaponization",
+          "weight": 10,
+          "notes": "Structurally blind to AI-discovery signal: every AI-discovered CVE in the cycle is mis-prioritised."
+        },
+        {
+          "signal_id": "policy-no-ai-discovered-tier",
+          "rwep_factor": "ai_weaponization",
+          "weight": 10,
+          "notes": "Policy gap propagates to every AI-discovered CVE the operator processes."
+        },
+        {
+          "signal_id": "ai-discovery-attribution-band-c-unverified",
+          "rwep_factor": "patch_available",
+          "weight": -5,
+          "notes": "Modest mitigation: unverified attribution argues for moderate triage tempo until corroborated."
+        }
+      ],
+      "blast_radius_model": {
+        "scope_question": "If the operator fails to triage an AI-discovered CVE within the AI-accelerated weaponization window, what scope of compromise does the operator's asset estate realistically deliver to an adversary with access to the same AI tooling?",
+        "scoring_rubric": [
+          {
+            "condition": "AI-discovered CVE applies to <= 5 ephemeral or low-sensitivity assets; no production data path.",
+            "blast_radius_score": 1,
+            "description": "Limited to ephemeral asset compromise; minimal data path."
+          },
+          {
+            "condition": "AI-discovered CVE applies to one production service with internal data only; no PII / regulated data.",
+            "blast_radius_score": 2,
+            "description": "Internal-data exposure; embarrassment + competitive cost."
+          },
+          {
+            "condition": "AI-discovered CVE applies to production service handling PII / PHI / cardholder data with retention 3-10 years.",
+            "blast_radius_score": 3,
+            "description": "Personal data exposure under GDPR / HIPAA / PCI scope; notification obligations on the standard clock."
+          },
+          {
+            "condition": "AI-discovered CVE applies to multiple production services OR a service in critical-function path (DORA Art.3 critical or important function) OR the underlying CVE is a kernel LPE / pre-auth RCE on web-fabric.",
+            "blast_radius_score": 4,
+            "description": "Multi-asset cross-service compromise OR critical-function disruption. Material impact under SEC Item 1.05; DORA major-incident classification."
+          },
+          {
+            "condition": "AI-discovered CVE applies to identity-plane / signing-root / org-admin path OR the operator's response is structurally blind (no AI-discovery feed coverage) across the whole estate.",
+            "blast_radius_score": 5,
+            "description": "Identity-plane compromise OR estate-wide structural blindness — every future AI-discovered CVE in the cycle inherits the same gap."
+          }
+        ]
+      },
+      "compliance_theater_check": {
+        "claim": "Vulnerability management is operating per NIST 800-53 RA-5 + SI-2 + SI-5, ISO 27001 A.5.7 + A.8.8, NIS2 Art.21(2)(c), DORA Art.10, SOC 2 CC7.1 — feeds are ingested, SLAs are tracked, severity-based remediation is in flight.",
+        "audit_evidence": "Quarterly vulnerability scan reports, SLA conformance dashboard, NVD + KEV + GHSA feed ingestion logs, severity-based remediation tickets.",
+        "reality_test": "For the trailing 90 days: (a) enumerate every AI-discovered CVE the operator was in scope of; (b) confirm the operator's feed pipeline ingested the AI-discovery attribution within 7 days of public disclosure (not the CVE itself — the AI-discovery attribution); (c) confirm RWEP-tier handling applied a tighter SLA than CVSS-tier on every AI-discovered entry; (d) confirm at least one band-A or band-B verification record exists for entries where ai_factor was applied. Theater verdict if (a)-(d) miss: the audit-clean vulnerability-management programme is structurally blind to the AI-discovery class.",
+        "theater_verdict_if_gap": "Operator demonstrates a NIST/ISO-compliant vulnerability-management programme that processes AI-discovered CVEs at the same tempo as non-AI CVEs, without subscription to any AI-discovery vendor feed, without RWEP-tier SLA differentiation, without attribution verification. Either (a) subscribe to AI-discovery vendor feeds (Theori, depthfirst, Zellic, GTIG) and add ingestion to the pipeline, (b) introduce an ai_discovered SLA tier in the policy matrix with windows tied to RWEP-derived timelines, (c) deploy an attribution-verification process before applying +15 ai_factor, (d) track patch-deployment-tempo by ai_discovered flag to surface tempo equality as a finding, OR (e) generate a defensible policy exception via policy-exception-gen acknowledging the structural blindness + compensating-control posture."
+      },
+      "framework_gap_mapping": [
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "nist-800-53",
+          "claimed_control": "RA-5 — Vulnerability Scanning",
+          "actual_gap": "Treats discovery-mechanism as undifferentiated. No control text requires AI-discovery to be tracked as triage input.",
+          "required_control": "Extend RA-5 with an ai_discovered triage input requirement: vulnerability-management programmes must track ai_discovered as a structured field, apply tighter SLA tier than non-AI CVEs of equivalent severity, and subscribe to at least one AI-discovery vendor feed."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "nist-800-53",
+          "claimed_control": "SI-2 — Flaw Remediation",
+          "actual_gap": "Organisation-defined timeframes typically 30 days for critical. AI-discovered + public PoC has been weaponised before 30-day window completes.",
+          "required_control": "Add SI-2 sub-control binding remediation timeframe to RWEP-derived SLA for AI-discovered class: 4h for RWEP >= 90, 24h for 75-89, 72h for 60-74."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "nist-800-53",
+          "claimed_control": "SI-5 — Security Alerts, Advisories, and Directives",
+          "actual_gap": "Names CISA + US-CERT + vendor advisories. AI-discovery vendor feeds not enumerated.",
+          "required_control": "Update SI-5 enumeration to include AI-discovery vendor feeds: Theori, depthfirst, Zellic, Google Project Zero AI, GTIG annual zero-day reports, Microsoft Security Research AI program."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "iso-27001-2022",
+          "claimed_control": "A.5.7 — Threat intelligence",
+          "actual_gap": "Describes feed collection without naming AI-discovery as discrimination axis.",
+          "required_control": "Amend A.5.7 implementation guidance to require AI-discovery as a discrete threat-intelligence axis with named vendor coverage."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "iso-27001-2022",
+          "claimed_control": "A.8.8 — Management of technical vulnerabilities",
+          "actual_gap": "'Appropriate timescales' undefined; AI-discovery not surfaced as treatment input.",
+          "required_control": "Amend A.8.8 implementation guidance: AI-discovered CVE class has 'appropriate timescale' aligned to RWEP-derived SLA, not standard 30-day critical interpretation."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "nis2",
+          "claimed_control": "Art.21(2)(c) — Vulnerability handling and disclosure",
+          "actual_gap": "Process-only; AI-discovery weaponization-velocity not recognised triage input.",
+          "required_control": "Implementing act binding essential-entity vulnerability-handling to ai_discovered tracking + tightened SLA tier + AI-discovery feed coverage."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "dora",
+          "claimed_control": "Art.10 — ICT-related Incident Management",
+          "actual_gap": "Classification thresholds inherit CVSS-equivalent severity. No AI-discovery uplift.",
+          "required_control": "RTS/ITS adding AI-discovered class as classification axis for financial-entity incident management; AI-discovered + critical-function path triggers major-incident classification."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "eu-cra",
+          "claimed_control": "Art.14 — Coordinated vulnerability disclosure",
+          "actual_gap": "Covers manufacturer disclosure; consumer-side AI-discovery-aware triage unaddressed.",
+          "required_control": "Implementing act extending Art.14 with consumer-side guidance: AI-discovered CVE in a third-party dependency triggers manufacturer + consumer joint triage with RWEP-derived SLA."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "soc2",
+          "claimed_control": "CC7.1 — System operation monitoring",
+          "actual_gap": "Does not anchor AI-discovered CVE intel as discrete control.",
+          "required_control": "Trust-services-criteria update: CC7.1 evidence must include AI-discovery feed coverage attestation + per-CVE attribution verification log."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "uk-caf",
+          "claimed_control": "B4 — System security",
+          "actual_gap": "Outcome-based; AI-discovery weaponization-velocity not named.",
+          "required_control": "NCSC profile addendum: B4 evidence must demonstrate AI-discovery feed coverage + AI-discovered CVE tempo metric tracked separately from non-AI."
+        },
+        {
+          "finding_id": "ai-discovered-cve-triage-gap",
+          "framework": "au-ism",
+          "claimed_control": "ISM-1493 — Vulnerability management",
+          "actual_gap": "Patch-application ladder on advisory date + severity. AI-discovery cycle compression not addressed.",
+          "required_control": "ACSC ISM update binding AI-discovered CVE class to a tighter SLA than ML3 48h; AI-discovered + deterministic + public PoC = 4h immediate-action."
+        }
+      ],
+      "escalation_criteria": [
+        {
+          "condition": "rwep >= 90 AND asset-unpatched-past-rwep-sla == fired",
+          "action": "page_on_call"
+        },
+        {
+          "condition": "blast_radius_score >= 4",
+          "action": "raise_severity"
+        },
+        {
+          "condition": "ai-discovery-feed-coverage-incomplete == fired AND jurisdiction_obligations contains 'EU'",
+          "action": "notify_legal"
+        },
+        {
+          "condition": "compliance_theater_check.verdict == 'theater'",
+          "action": "trigger_playbook",
+          "target_playbook": "framework"
+        },
+        {
+          "condition": "any matched_cve.attack_class == 'kernel-lpe' AND asset-unpatched-past-rwep-sla == fired",
+          "action": "trigger_playbook",
+          "target_playbook": "kernel"
+        },
+        {
+          "condition": "any matched_cve.affects_dependency_tree == true",
+          "action": "trigger_playbook",
+          "target_playbook": "sbom"
+        }
+      ]
+    },
+    "validate": {
+      "remediation_paths": [
+        {
+          "id": "subscribe-ai-discovery-feeds",
+          "description": "Add subscription to AI-discovery vendor feeds in the operator's vulnerability-intel pipeline: Theori writeups, depthfirst disclosures, Zellic publications, Google Project Zero AI, GTIG annual + monthly zero-day reports, Microsoft Security Research AI program. Configure the pipeline to enrich CVE entries with ai_discovered + discovery_attribution_note fields.",
+          "preconditions": [
+            "vulnerability_intel_pipeline_operational == true",
+            "operator_can_add_feed_sources == true"
+          ],
+          "priority": 1,
+          "compensating_controls": [
+            "ai_discovery_aggregator_subscription_as_interim",
+            "manual_weekly_triage_against_named_sources_during_pipeline_buildout"
+          ],
+          "estimated_time_hours": 16
+        },
+        {
+          "id": "introduce-ai-discovered-sla-tier",
+          "description": "Add an ai_discovered SLA tier to the vulnerability-management policy matrix. SLA windows aligned to RWEP-derived timeline: 4h for RWEP >= 90, 24h for 75-89, 72h for 60-74, 7d for 40-59, 30d for 20-39. Bind to a deployment cadence metric tracked per AI-discovered CVE.",
+          "preconditions": [
+            "policy_ownership_attested == true",
+            "deployment_cadence_supports_sla_tightening == true"
+          ],
+          "priority": 1,
+          "compensating_controls": [
+            "interim_compensating_controls_for_assets_unable_to_meet_sla",
+            "live_patch_subscription_for_kernel_assets"
+          ],
+          "estimated_time_hours": 12
+        },
+        {
+          "id": "deploy-attribution-verification-process",
+          "description": "Establish a verification process before applying the +15 ai_factor: source-corroborate attribution against vendor writeup + at least one secondary outlet (The Hacker News, Help Net Security, BleepingComputer, The Register), classify into band A (publicly attributed), band B (AI-assisted with secondary corroboration), or band C (claimed without corroboration). Apply +15 only on band A or B.",
+          "preconditions": [
+            "verification_archive_writable == true",
+            "operator_assigns_verification_owner == true"
+          ],
+          "priority": 2,
+          "compensating_controls": [
+            "weekly_attribution_corroboration_review",
+            "automated_secondary_source_polling"
+          ],
+          "estimated_time_hours": 10
+        },
+        {
+          "id": "track-tempo-per-ai-flag",
+          "description": "Add deployment-tempo metric segmented by ai_discovered flag. Surface tempo equality between AI and non-AI populations as a programme-level finding requiring policy update.",
+          "preconditions": [
+            "deployment_metric_pipeline_operational == true"
+          ],
+          "priority": 3,
+          "compensating_controls": [
+            "monthly_metric_review_with_security_leadership"
+          ],
+          "estimated_time_hours": 8
+        },
+        {
+          "id": "live-patch-coverage-for-ai-kernel-class",
+          "description": "Subscribe to live-patch services (kpatch / canonical-livepatch / kGraft / CloudLinux KernelCare) for every kernel host in scope of AI-discovered kernel LPE CVEs. Confirm the live patch covers the specific CVE id via /sys/kernel/livepatch/*/cve-ids.",
+          "preconditions": [
+            "kernel_inventory_in_ai_discovered_scope == true",
+            "operator_holds_live_patch_subscription == true"
+          ],
+          "priority": 3,
+          "compensating_controls": [
+            "module_unload_mitigation_where_applicable",
+            "host_isolation_during_window_pending_reboot"
+          ],
+          "estimated_time_hours": 6
+        },
+        {
+          "id": "policy-exception",
+          "description": "For assets that cannot reach the AI-discovered-tier SLA within the cycle: generate auditor-ready policy exception with compensating controls (live patch, network isolation, module unload, monitoring), time-bound risk acceptance, and remediation milestones.",
+          "preconditions": [
+            "remediation_paths[1..5] partially blocked",
+            "ciso_acceptance_obtainable == true"
+          ],
+          "priority": 6,
+          "compensating_controls": [
+            "enhanced_endpoint_monitoring",
+            "compensating_network_segmentation",
+            "weekly_exception_register_review"
+          ],
+          "estimated_time_hours": 6
+        }
+      ],
+      "validation_tests": [
+        {
+          "id": "feed-coverage-includes-ai-discovery",
+          "test": "Read the feed-currency-attestation. Assert at least one of {Theori, depthfirst, Zellic, GTIG, Project Zero AI, Microsoft Security Research AI} is named as a configured source AND last_update is within 30 days.",
+          "expected_result": "Configured AI-discovery feed sources count >= 1; last_update <= 30 days ago.",
+          "test_type": "functional"
+        },
+        {
+          "id": "policy-has-ai-discovered-tier",
+          "test": "Read the vulnerability-management-policy SLA matrix. Assert a row keyed off ai_discovered == true with SLA windows aligned to RWEP-derived timeline.",
+          "expected_result": "Policy matrix has ai_discovered tier; SLA windows match {4h, 24h, 72h, 7d, 30d} for RWEP brackets {>=90, 75-89, 60-74, 40-59, 20-39}.",
+          "test_type": "functional"
+        },
+        {
+          "id": "verification-band-applied-correctly",
+          "test": "For each cve-catalog entry where rwep_factors.ai_factor == 15: assert a band-A or band-B record exists in the ai-discovery-verification-archive.",
+          "expected_result": "100% of ai_factor-applied entries have band-A or band-B verification on file.",
+          "test_type": "functional"
+        },
+        {
+          "id": "no-asset-past-sla-for-ai-discovered",
+          "test": "Cross-join cve-catalog-ai-flagged-entries × asset-applicability-map × patch-deployment-tempo. Assert 0 assets past their RWEP-derived SLA window for any AI-discovered CVE.",
+          "expected_result": "Zero assets past SLA; or assets past SLA are on the exception register with compensating controls.",
+          "test_type": "functional"
+        },
+        {
+          "id": "kernel-live-patch-cve-id-present",
+          "test": "For every kernel host in scope of an AI-discovered kernel LPE CVE: read /sys/kernel/livepatch/*/cve-ids. Assert the CVE id is present OR a documented reboot is scheduled within the SLA window.",
+          "expected_result": "Every kernel host either has the CVE-specific live patch loaded OR has a scheduled reboot inside the SLA.",
+          "test_type": "functional"
+        },
+        {
+          "id": "tempo-metric-segmented",
+          "test": "Read the patch-deployment-tempo artefact. Assert the metric is reported separately for ai_discovered == true vs ai_discovered == false.",
+          "expected_result": "Tempo dashboard has two distinct series.",
+          "test_type": "functional"
+        },
+        {
+          "id": "synthetic-exploit-replay-negative",
+          "test": "For each AI-discovered kernel LPE CVE in scope where remediation is claimed complete: run the public PoC (or equivalent benign reproducer) against a non-production canary host. Confirm exploitation fails post-remediation.",
+          "expected_result": "PoC fails on every remediated canary host.",
+          "test_type": "exploit_replay"
+        }
+      ],
+      "residual_risk_statement": {
+        "risk": "Operator estate retains exposure to AI-discovered CVE class for assets where AI-discovery feed coverage, SLA-tier handling, or live-patch coverage is incomplete, leaving an AI-accelerated weaponization window during which the same AI tooling that found the bug can develop the exploit.",
+        "why_remains": "AI-discovery feed coverage is dependent on vendor publication cadence (Theori, depthfirst, Zellic publish on their own timelines). RWEP-derived SLA tightening requires deployment-cadence investment the operator may need a programme cycle to reach. Live-patch coverage is vendor + subscription dependent. Attribution verification is human-loop today; corroboration is delayed by 24-72h after disclosure. The residual window is the gap between operational AI-discovery cycle (~hours-to-days) and the operator's hardened response cycle (~days-to-weeks).",
+        "acceptance_level": "ciso",
+        "compensating_controls_in_place": [
+          "ai_discovery_feed_subscription",
+          "ai_discovered_sla_tier_in_policy",
+          "attribution_verification_process",
+          "deployment_tempo_segmented_metric",
+          "live_patch_coverage_for_kernel_class",
+          "enhanced_monitoring_during_residual_window",
+          "asset_isolation_for_exception_register_entries"
+        ]
+      },
+      "evidence_requirements": [
+        {
+          "evidence_type": "attestation",
+          "description": "Feed-coverage attestation listing configured AI-discovery vendor sources + last-update timestamps; signed.",
+          "retention_period": "7_years",
+          "framework_satisfied": [
+            "nist-800-53-SI-5",
+            "iso-27001-2022-A.5.7",
+            "nis2-art21-2c"
+          ]
+        },
+        {
+          "evidence_type": "config_diff",
+          "description": "Diff of vulnerability-management-policy showing introduction of ai_discovered SLA tier + RWEP-derived window mapping; change-management approval reference.",
+          "retention_period": "audit_cycle",
+          "framework_satisfied": [
+            "nist-800-53-SI-2",
+            "nist-800-53-RA-5",
+            "iso-27001-2022-A.8.8",
+            "soc2-CC7.1"
+          ]
+        },
+        {
+          "evidence_type": "scan_report",
+          "description": "Per-CVE deployment-tempo report segmented by ai_discovered flag; trailing 90 days.",
+          "retention_period": "1_year",
+          "framework_satisfied": [
+            "nist-800-53-SI-2",
+            "iso-27001-2022-A.8.8",
+            "soc2-CC7.1"
+          ]
+        },
+        {
+          "evidence_type": "exploit_replay_negative",
+          "description": "Synthetic PoC reproduction against canary hosts confirming exploitation fails post-remediation.",
+          "retention_period": "1_year",
+          "framework_satisfied": [
+            "soc2-CC7.1",
+            "iso-27001-2022-A.8.8"
+          ]
+        },
+        {
+          "evidence_type": "attestation",
+          "description": "Attribution-verification archive showing band-A or band-B classification for every entry where ai_factor was applied.",
+          "retention_period": "7_years",
+          "framework_satisfied": [
+            "iso-27001-2022-A.5.7",
+            "nis2-art21-2c"
+          ]
+        }
+      ],
+      "regression_trigger": [
+        {
+          "condition": "new_ai_discovered_cve_published",
+          "interval": "on_event"
+        },
+        {
+          "condition": "gtig_annual_zero_day_report_published",
+          "interval": "on_event"
+        },
+        {
+          "condition": "vendor_publishes_ai_discovery_advisory",
+          "interval": "on_event"
+        },
+        {
+          "condition": "monthly",
+          "interval": "30d"
+        }
+      ]
+    },
+    "close": {
+      "evidence_package": {
+        "bundle_format": "csaf-2.0",
+        "contents": [
+          "feed_coverage_attestation",
+          "vulnerability_management_policy_diff",
+          "deployment_tempo_segmented_report",
+          "exploit_replay_negative",
+          "attribution_verification_archive",
+          "framework_gap_mapping",
+          "compliance_theater_verdict",
+          "residual_risk_statement",
+          "attestation"
+        ],
+        "destination": "local_only",
+        "signed": true
+      },
+      "learning_loop": {
+        "enabled": true,
+        "lesson_template": {
+          "attack_vector": "AI-discovered CVE class triage failure — the operator processes AI-discovered CVEs at non-AI tempo because the vulnerability-management programme has no ai_discovered axis. Adversary with access to the same AI tooling that found the bug develops the exploit faster than the operator's deployment SLA closes.",
+          "control_gap": "Vulnerability management treats discovery-mechanism as undifferentiated. No feed coverage of AI-discovery vendor sources. No SLA-tier differentiation. No attribution verification before triage. No tempo metric segmented by ai_discovered.",
+          "framework_gap": "NIST RA-5 + RA-7 + SI-2 + SI-5, ISO A.5.7 + A.8.8, NIS2 Art.21(2)(c), DORA Art.10, EU CRA Art.14, SOC 2 CC7.1, UK CAF B4, AU ISM-1493 all permit AI-blind vulnerability-management programmes as compliant. Framework cadence ~540 days behind operational AI-discovery wave.",
+          "new_control_requirement": "Add an 'AI-discovery aware vulnerability management' sub-control across the framework set requiring: (a) AI-discovery vendor feed subscription with ingestion attested, (b) ai_discovered SLA tier in policy aligned to RWEP-derived window, (c) attribution-verification process producing band classification, (d) deployment-tempo metric segmented by ai_discovered, (e) annual review against GTIG zero-day report and named-source publication cadence."
+        },
+        "feeds_back_to_skills": [
+          "ai-attack-surface",
+          "exploit-scoring",
+          "framework-gap-analysis",
+          "compliance-theater",
+          "ai-risk-management",
+          "threat-model-currency",
+          "zeroday-gap-learn"
+        ]
+      },
+      "notification_actions": [
+        {
+          "obligation_ref": "EU/NIS2 Art.23 24h",
+          "deadline": "computed_at_runtime",
+          "recipient": "internal_legal",
+          "evidence_attached": [
+            "ai_discovery_attribution_evidence",
+            "affected_asset_inventory",
+            "remediation_eta"
+          ],
+          "draft_notification": "Initial NIS2 Art.23 24-hour early-warning notification: AI-discovered CVE ${cve_id} (${cve_name}) impacting ${affected_asset_count} asset(s) in scope. AI-discovery attribution: ${attribution_band} (source: ${attribution_source}). RWEP at detection: ${rwep_at_detection}. Containment: ${containment_record}. Remediation ETA: ${remediation_eta}. Full incident assessment to follow within 72 hours per Art.23(4)."
+        },
+        {
+          "obligation_ref": "EU/DORA Art.19 4h",
+          "deadline": "computed_at_runtime",
+          "recipient": "internal_legal",
+          "evidence_attached": [
+            "ict_critical_function_impact",
+            "containment_record"
+          ],
+          "draft_notification": "DORA Art.19 initial notification: Major ICT-related incident — AI-discovered CVE ${cve_id} impacting ICT services supporting ${critical_or_important_functions}. AI-discovery attribution adds operational weaponization-velocity factor; affected dependencies: ${affected_dependencies}. Full classification + impact assessment to follow within statutory windows."
+        },
+        {
+          "obligation_ref": "EU/EU CRA Art.14 24h",
+          "deadline": "computed_at_runtime",
+          "recipient": "internal_legal",
+          "evidence_attached": [
+            "actively_exploited_assessment",
+            "user_notification_draft"
+          ],
+          "draft_notification": "EU CRA Art.14 notification: AI-discovered vulnerability ${cve_id} affecting ${product_name} (manufactured by ${manufacturer}). Actively-exploited assessment: ${active_exploitation_state}. User notification draft attached for review."
+        },
+        {
+          "obligation_ref": "US-Federal/CIRCIA (proposed; CISA reporting) 72h",
+          "deadline": "computed_at_runtime",
+          "recipient": "internal_legal",
+          "evidence_attached": [
+            "covered_cyber_incident_assessment",
+            "ai_discovery_attribution"
+          ],
+          "draft_notification": "CIRCIA covered cyber incident report: AI-discovered CVE ${cve_id} (${cve_name}) with public PoC and ${active_exploitation_state} active exploitation. Operator's affected assets: ${affected_asset_count}. Remediation milestones: ${remediation_milestones}."
+        },
+        {
+          "obligation_ref": "US-Federal/SEC Item 1.05 (8-K) 96h",
+          "deadline": "computed_at_runtime",
+          "recipient": "internal_legal",
+          "evidence_attached": [
+            "material_impact_determination",
+            "incident_description"
+          ],
+          "draft_notification": "SEC Item 1.05 8-K disclosure draft: Material cybersecurity incident — AI-discovered CVE ${cve_id} affecting ${affected_systems}. Materiality determination: ${materiality_justification}. Remediation status: ${remediation_status}."
+        }
+      ],
+      "exception_generation": {
+        "trigger_condition": "remediation_blocked == true OR vendor_patch_pending == true OR live_patch_unavailable_for_specific_cve == true",
+        "exception_template": {
+          "scope": "Asset(s) ${asset_list} cannot reach AI-discovered-tier SLA for CVE ${cve_id} within current cycle. Blocking factors: ${blocking_factors} (e.g. vendor patch pending, reboot window constrained, live-patch service lacks CVE-specific cover, dependency-chain rebuild required).",
+          "duration": "until_vendor_patch_or_72h",
+          "compensating_controls": [
+            "enhanced_endpoint_monitoring_for_affected_asset",
+            "network_segmentation_isolating_affected_asset",
+            "module_unload_mitigation_where_applicable",
+            "host_isolation_during_window",
+            "live_patch_subscription_status_tracked",
+            "regression_alerting_on_exploitation_indicators"
+          ],
+          "risk_acceptance_owner": "ciso",
+          "auditor_ready_language": "Pursuant to ${framework_id} ${control_id}, the organisation documents a time-bound risk acceptance for AI-discovered CVE ${cve_id} (${cve_name}) affecting asset(s) ${asset_list}. AI-discovery attribution: ${attribution_band} (source: ${attribution_source}); RWEP at detection: ${rwep_at_detection}; AI-accelerated weaponization-velocity factor applied. The organisation acknowledges that current framework controls do not require AI-discovery as a discrete triage input and that this gap is documented in ${exceptd_framework_gap_mapping_ref}. Compensating controls in place: ${compensating_controls}. Remediation milestones: ${remediation_milestones}. Risk accepted by ${ciso_name} on ${acceptance_date}. Time-bound until ${duration_expiry} (vendor patch publication, live-patch availability, OR ${default_72h_expiry}, whichever is first). Re-evaluation triggers: vendor patch publication, live-patch coverage gain, CISA KEV listing, confirmed in-the-wild exploitation, OR scheduled expiry."
+        }
+      },
+      "regression_schedule": {
+        "next_run": "computed_at_runtime",
+        "trigger": "both",
+        "notify_on_skip": true
+      }
+    }
+  },
+  "directives": [
+    {
+      "id": "full-ai-discovered-triage",
+      "title": "Full AI-discovered CVE triage — feed coverage + SLA tier + attribution verification + tempo metric",
+      "applies_to": {
+        "always": true
+      }
+    },
+    {
+      "id": "copy-fail-class-recheck",
+      "title": "Targeted recheck for Copy Fail (CVE-2026-31431) and Copy Fail-class AI-discovered kernel LPE",
+      "applies_to": {
+        "cve": "CVE-2026-31431"
+      },
+      "phase_overrides": {
+        "direct": {
+          "rwep_threshold": {
+            "escalate": 85,
+            "monitor": 60,
+            "close": 30
+          }
+        }
+      }
+    },
+    {
+      "id": "fragnesia-class-recheck",
+      "title": "Targeted recheck for Fragnesia (CVE-2026-46300) Dirty Frag family",
+      "applies_to": {
+        "cve": "CVE-2026-46300"
+      }
+    },
+    {
+      "id": "nginx-rift-class-recheck",
+      "title": "Targeted recheck for NGINX Rift (CVE-2026-42945) class — AI-discovered web-fabric CVEs",
+      "applies_to": {
+        "cve": "CVE-2026-42945"
+      }
+    }
+  ]
+}