From 8d7e101d1a2a07b507ae2b1af333aa6fc4e95bf9 Mon Sep 17 00:00:00 2001 From: Masyarakat AI Indonesia - FMD <202437583+masyarakatai@users.noreply.github.com> Date: Tue, 20 Oct 2026 19:45:19 +0700 Subject: [PATCH 1/2] docs: use supported record fetch state flag --- .../magpie-security/skills/issue-sync/apply-and-push.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/plugins/magpie-security/skills/issue-sync/apply-and-push.md b/plugins/magpie-security/skills/issue-sync/apply-and-push.md index 58fea1202..2977fc1e7 100644 --- a/plugins/magpie-security/skills/issue-sync/apply-and-push.md +++ b/plugins/magpie-security/skills/issue-sync/apply-and-push.md @@ -519,10 +519,10 @@ the four gates that need judgement (trigger conditions, the incomplete-fix claus immediately call the adapter's `fetch_current_state(cve_id)` to confirm the state advanced. For Vulnogram the entrypoint is `vulnogram-api-record-fetch`: - ```bash - uv run --project /tools/cve-tool-vulnogram/oauth-api vulnogram-api-record-fetch \ - --cve-id --jq '.body.CNA_private.state' - ``` + ```bash + uv run --project /tools/cve-tool-vulnogram/oauth-api vulnogram-api-record-fetch \ + --cve-id --state-only + ``` If that fetch entrypoint is not yet installed on the operator's machine (see [`tools/cve-tool-vulnogram/oauth-api/README.md`](../../../../tools/cve-tool-vulnogram/oauth-api/README.md)), read the state from the `push_update` response envelope, which the contract requires to include the saved state. From a65e6ed5bf45cd805dd9bc8eca275b14b392725c Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Tue, 20 Oct 2026 22:57:58 +0200 Subject: [PATCH 2/2] fix(issue-sync): use --state-only in the push verify hint too The sync push rule emitted the same unsupported `--jq` record-fetch command the doc fix replaced; point it, and the eval fixture that quotes it, at `--state-only`. Restore the list item's 3-space fence indent. Generated-by: Claude Opus 5 --- .../magpie-security/skills/issue-sync/apply-and-push.md | 8 ++++---- .../src/security_management/issue_sync/push.py | 2 +- .../fixtures/case-5-clean-push-fix-released/report.md | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/plugins/magpie-security/skills/issue-sync/apply-and-push.md b/plugins/magpie-security/skills/issue-sync/apply-and-push.md index 2977fc1e7..0bf6bce9c 100644 --- a/plugins/magpie-security/skills/issue-sync/apply-and-push.md +++ b/plugins/magpie-security/skills/issue-sync/apply-and-push.md @@ -519,10 +519,10 @@ the four gates that need judgement (trigger conditions, the incomplete-fix claus immediately call the adapter's `fetch_current_state(cve_id)` to confirm the state advanced. For Vulnogram the entrypoint is `vulnogram-api-record-fetch`: - ```bash - uv run --project /tools/cve-tool-vulnogram/oauth-api vulnogram-api-record-fetch \ - --cve-id --state-only - ``` + ```bash + uv run --project /tools/cve-tool-vulnogram/oauth-api vulnogram-api-record-fetch \ + --cve-id --state-only + ``` If that fetch entrypoint is not yet installed on the operator's machine (see [`tools/cve-tool-vulnogram/oauth-api/README.md`](../../../../tools/cve-tool-vulnogram/oauth-api/README.md)), read the state from the `push_update` response envelope, which the contract requires to include the saved state. diff --git a/tools/security-management/src/security_management/issue_sync/push.py b/tools/security-management/src/security_management/issue_sync/push.py index 57d010347..03e853396 100644 --- a/tools/security-management/src/security_management/issue_sync/push.py +++ b/tools/security-management/src/security_management/issue_sync/push.py @@ -176,7 +176,7 @@ def out(action: str, why: str, **extra: Any) -> dict[str, Any]: return out( "pending", "verify the state advance", - next=f"uv run --project {oauth_api} vulnogram-api-record-fetch --cve-id {w(cve_id)} --jq '.body.CNA_private.state'", + next=f"uv run --project {oauth_api} vulnogram-api-record-fetch --cve-id {w(cve_id)} --state-only", ) if fetched in LATER: return out( diff --git a/tools/skill-evals/evals/security-issue-sync/step-5b-judged-gates/fixtures/case-5-clean-push-fix-released/report.md b/tools/skill-evals/evals/security-issue-sync/step-5b-judged-gates/fixtures/case-5-clean-push-fix-released/report.md index 47d11a6ac..de30832b2 100644 --- a/tools/skill-evals/evals/security-issue-sync/step-5b-judged-gates/fixtures/case-5-clean-push-fix-released/report.md +++ b/tools/skill-evals/evals/security-issue-sync/step-5b-judged-gates/fixtures/case-5-clean-push-fix-released/report.md @@ -32,5 +32,5 @@ asked to be credited. Not a follow-up to any earlier CVE. Adapter session probe (`vulnogram-api-check`): `valid`. `vulnogram-api-record-update`: exit 0 at 2026-10-03T14:12:09Z. -`vulnogram-api-record-fetch --jq '.body.CNA_private.state'`: `"REVIEW"` +`vulnogram-api-record-fetch --state-only`: `REVIEW` (normalised: `review-ready`).