Publish to website and update all the required outputs to go.

.agents/skills/LICENSE

@@ -0,0 +1,21 @@
+Copyright 2026 Carnegie Mellon University.
+
+Licensed under a MIT (SEI)-style license, please see license.txt or contact permission@sei.cmu.edu for full terms.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+This Software includes and/or can make use of certain third party software ("Third Party Software"). The Third Party Software that is used by the software is dependent upon your system configuration, but typically includes the software identified in this license.txt file, and/or described in the documentation and/or read me file. By using this software, you agree to comply with any and all relevant Third Party Software terms and conditions contained in any such Third Party Software or separate license file distributed with such Third Party Software. The parties who own the Third Party Software ("Third Party Licensors") are intended third party beneficiaries to this License with respect to the terms applicable to their Third Party Software. Third Party Software licenses only apply to the Third Party Software and not any other portion of SEI Software or this software as a whole.
+
+This material is based upon work funded and supported by the Department of Defense under Contract No. FA8702-15-D-0002 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. 
+
+The view, opinions, and/or findings contained in this material are those of the author(s) and should not be construed as an official Government position, policy, or decision, unless designated by other documentation. 
+
+References herein to any specific commercial product, process, or service by trade name, trade mark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation, or favoring by Carnegie Mellon University or its Software Engineering Institute.
+
+NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
+
+[DISTRIBUTION STATEMENT A] This material has been approved for public release and unlimited distribution.  Please see Copyright notice for non-US Government use and distribution.
+
+DM24-0278

.agents/skills/eval-against-decision_point/SKILL.md

@@ -0,0 +1,208 @@
+---
+name: eval-against-decision_point
+description: Use ONLY when evaluating SSVC decision points against a vulnerability report. Provides shared evaluation process, JSON output schema, process of elimination, confidence threshold, and sub-skill invocation pattern used by all SSVC decision point skills.
+---
+
+# SSVC Base Evaluation Skill
+
+This skill defines the shared rules and process that all SSVC decision point evaluation skills follow. It is not invoked directly by a user — it is referenced by each individual decision point skill.
+
+---
+
+## Role
+
+You are an SSVC analyst. Given a vulnerability report and the documentation for a specific SSVC decision point, your job is to evaluate the vulnernability report against the decision point and produce a structured JSON output.
+
+---
+
+## Inputs
+
+Every SSVC decision point skill will provide you with:
+
+1. **The vulnerability report** — the artifact being evaluated (e.g., CVE description, NVD entry, vendor advisory, internal ticket). Accept whatever format is provided.
+2. **Documentation** — fetched at runtime from the `@ssvc-docs` reference (see below). Each decision point skill specifies exactly which files to read.
+
+---
+
+## State Reset
+
+At the start of every evaluation — regardless of what was read or evaluated previously in the conversation — treat all documentation as unloaded. Do not reuse file contents, definitions, or canonical values from a prior evaluation. Always re-fetch every file specified by the decision point skill using the `Read` tool before proceeding.
+
+---
+
+## Fetching Documentation at Runtime
+
+All SSVC documentation lives under the `@ssvc-docs` reference, which maps to the local SSVC repository. Use the `Read` tool to fetch each file specified by the decision point skill before beginning evaluation.
+
+Key paths under `@ssvc-docs`:
+- Reference docs: `docs/reference/decision_points/<name>.md`
+- Python source (canonical values): `src/ssvc/decision_points/ssvc/<name>.py`
+- How-to guides (where they exist): `docs/howto/gathering_info/<name>.md`
+- Shared includes (where referenced): `docs/_includes/<name>.md`
+- Decision tables (where applicable): `src/ssvc/decision_tables/ssvc/<name>.py`
+
+Read all files specified by the decision point skill before beginning evaluation. Do not skip any file, even if you believe you already know the content.
+
+---
+
+## Sub-Skill Invocation (Compound Decision Points)
+
+Some decision points are compound — they depend on the outputs of other decision points. When a decision point skill instructs you to invoke sub-skills:
+
+1. Invoke each dependency skill in order, passing the same vulnerability report.
+2. Collect the JSON output from each dependency.
+3. Use those outputs as additional context when evaluating the compound decision point.
+4. Include the dependency outputs in your final JSON under `dependencies`.
+
+---
+
+## Evaluation Process
+
+Follow these steps for every evaluation:
+
+### Step 1: Read all specified documentation
+Use the `Read` tool to fetch every file listed by the decision point skill. Extract:
+- The canonical name and current version of the decision point
+- All possible values and their definitions (from the Python source)
+- Any default value guidance
+- Any how-to guidance for gathering information
+
+### Step 2: Enumerate all possible values
+List every possible value for the decision point. For each value:
+- State its name and definition (from the Python source)
+- Assess whether the vulnerability report supports or contradicts it
+- Explicitly state whether this value is **eliminated**, **possible**, or **selected**
+
+Always enumerate all values, even when you are highly confident in the answer.
+
+### Step 3: Apply process of elimination
+For each **eliminated** value, provide a clear, evidence-based reason grounded in the report. Reference specific details from the report where possible.
+
+### Step 4: Assess confidence
+After elimination, assess your confidence (0.0–1.0) that the remaining selected value is correct, considering:
+- Completeness of information in the report
+- Ambiguity in the decision point definition
+- Whether defaults had to be applied
+
+### Step 5: Apply the confidence threshold
+- If confidence >= 0.70: select a value and produce a full output
+- If confidence < 0.70: set `deferred: true`, leave `selected_value` as `null`, and list remaining candidates for human review
+
+### Step 6: Produce JSON output
+Output only valid JSON matching the `SelectionList`-extended schema below. Do not include prose outside the JSON block.
+
+---
+
+## Output Schema
+
+Output is a `SelectionList`-shaped envelope extended with per-selection analysis fields.
+
+```json
+{
+  "schemaVersion": "2.0.0",
+  "timestamp": "<RFC 3339 datetime>",
+  "selections": [
+    {
+      "namespace": "ssvc",
+      "name": "<decision point name>",
+      "key": "<decision point key>",
+      "version": "<semver version string>",
+      "values": [{"name": "<selected value name>", "key": "<selected value key>"}],
+      "confidence": <float 0.0-1.0>,
+      "deferred": <true|false>,
+      "eliminated_values": [
+        {
+          "name": "<eliminated value name>",
+          "key": "<eliminated value key>",
+          "reason": "<evidence-based explanation>"
+        }
+      ],
+      "justification": "<narrative explanation of the selected value, or explanation of why evaluation was deferred>",
+      "dependencies": {
+        "<decision_point_name>": { <nested selection object> }
+      }
+    }
+  ]
+}
+```
+
+**Field rules:**
+- `schemaVersion`: always `"2.0.0"`
+- `timestamp`: RFC 3339 datetime; use the current date/time
+- `selections`: always a single-element array for primitive decision points; compound decision points include dependency outputs under `dependencies`
+- `values`: when `deferred` is `false`, contains exactly one `{name, key}` object for the selected value; when `deferred` is `true`, contains all remaining candidate values each prefixed with `"POSSIBILITIES: "` in the `name` field
+- `confidence`: always required; numeric, two decimal places
+- `deferred`: `true` when confidence < 0.70
+- `eliminated_values`: always populated with all non-selected values; each entry uses `{name, key, reason}` consistent with `MinimalDecisionPointValue` plus a `reason` field
+- `justification`: always required; summarizes the reasoning
+- `dependencies`: omit this field entirely if the decision point has no dependencies
+
+---
+
+## Defaults
+
+Some decision points specify a default value to apply when information is insufficient. When a default is applied:
+- Write the word "OKLAHOMA"
+- Note it explicitly in `justification`
+- Reflect the resulting uncertainty in `confidence` (defaults typically warrant lower confidence)
+
+---
+
+## Example Output (Automatable, confident)
+
+```json
+{
+  "schemaVersion": "2.0.0",
+  "timestamp": "2025-01-01T12:00:00Z",
+  "selections": [
+    {
+      "namespace": "ssvc",
+      "name": "Automatable",
+      "key": "A",
+      "version": "2.0.0",
+      "values": [{"name": "Yes", "key": "Y"}],
+      "confidence": 0.88,
+      "deferred": false,
+      "eliminated_values": [
+        {
+          "name": "No",
+          "key": "N",
+          "reason": "The report states the vulnerability allows unauthenticated remote code execution over the public internet. All four kill chain steps (reconnaissance via internet scanning, weaponization via public PoC, delivery over TCP, exploitation via RCE) can be reliably automated."
+        }
+      ],
+      "justification": "The vulnerability enables unauthenticated RCE on a network-exposed service. Public PoC code exists. All four kill chain steps are reliably automatable, satisfying the definition of Yes."
+    }
+  ]
+}
+```
+
+## Example Output (deferred)
+
+```json
+{
+  "schemaVersion": "2.0.0",
+  "timestamp": "2025-01-01T12:00:00Z",
+  "selections": [
+    {
+      "namespace": "ssvc",
+      "name": "System Exposure",
+      "key": "SE",
+      "version": "1.0.1",
+      "values": [
+        {"name": "POSSIBILITIES: Controlled", "key": "C"},
+        {"name": "POSSIBILITIES: Small", "key": "S"}
+      ],
+      "confidence": 0.55,
+      "deferred": true,
+      "eliminated_values": [
+        {
+          "name": "Open",
+          "key": "O",
+          "reason": "The report does not indicate the service is directly internet-facing without any filtering."
+        }
+      ],
+      "justification": "OKLAHOMA The report does not provide sufficient detail about network topology or firewall configuration to distinguish between Controlled and Small exposure. Human review is required."
+    }
+  ]
+}
+```

.agents/skills/ssvc/technical_impact/SKILL.md

@@ -0,0 +1,27 @@
+---
+name: technical-impact
+description: Use when evaluating the SSVC Technical Impact decision point for a vulnerability report. Determines the technical impact of exploiting the vulnerability on the affected component.
+---
+
+# SSVC: Technical Impact
+
+Follow the `eval-against-decision_point` evaluation process.
+
+## Decision Point
+
+**Name:** Technical Impact  
+**Question:** What is the technical impact of exploiting the vulnerability on the affected component?
+
+## Dependencies
+
+None. This is a primitive decision point.
+
+## Documentation to Fetch at Runtime
+
+Use the `Read` tool to fetch all of the following files before beginning evaluation. The base path for `@ssvc-docs` is the SSVC repository root.
+
+| File | Path under @ssvc-docs |
+|---|---|
+| Python source (canonical values) | `src/ssvc/decision_points/ssvc/technical_impact.py` |
+| Reference doc | `docs/reference/decision_points/technical_impact.md` |
+| How-to guide | `docs/howto/gathering_info/technical_impact.md` |

.github/workflows/lint_md_changes.yml

@@ -21,7 +21,7 @@ jobs:
       with:
         files: '**/*.md'
         separator: ","
-    - uses: DavidAnson/markdownlint-cli2-action@v24
+    - uses: DavidAnson/markdownlint-cli2-action@v24.2.0
       if: steps.changed-files.outputs.any_changed == 'true'
       with:
         globs: ${{ steps.changed-files.outputs.all_changed_files }}

.github/workflows/run_doctools.yml

@@ -16,13 +16,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
-          ref: ${{ github.head_ref }}
           fetch-depth: 0
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: "3.12"
 
@@ -42,7 +41,7 @@ jobs:
         if: github.event.pull_request.head.repo.full_name != github.repository
         run: |
           git add data/
-          if git diff --cached --quiet; then
+          if git diff --cached --quiet -I '^[ ]+"generatedAt":'; then
             echo "No data/ changes detected."
           else
             echo "::error::This PR is from a fork and data/ files need to be regenerated."

.markdownlint.yml

@@ -15,7 +15,7 @@ MD033: false
 # MD040/fenced-code-language : Fenced code blocks should have a language specified : https://github.com/DavidAnson/markdownlint/blob/v0.37.4/doc/md040.md
 MD040: false
 # 041 First line in file should be a top level header
-# Disabled because we use `include-markdown` plugin for merging markdown files
+# Disabled because we use `include-markdown` plugin for merging files
 MD041: false
 # 046 Code block style
 # Disabled because mkdocs-material uses indented blocks for admonitions
@@ -28,4 +28,4 @@ MD049:
 # Force asterisk style for strong
 MD050:
   style: "asterisk"
-
+MD060: false

.opencode/opencode.json

@@ -0,0 +1,9 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "references": {
+    "ssvc-docs": {
+      "path": "../SSVC",
+      "description": "SSVC documentation and source code. Use for decision point definitions, reference docs, how-to guides, and decision tables."
+    }
+  }
+}

LICENSE

@@ -22,11 +22,11 @@ DM24-0278
 
 ---
 
-The following statement applies to py, json, csv, sh, toml files (software):
+The following license applies to all software files (.py, .json, .csv, .sh, .toml) and programming-related configuration files (.md, .yaml) located in the .github/ and .agent/ directories.
 
 Copyright 2026 Carnegie Mellon University.
 
-Licensed under a MIT (SEI)-style license, please see license.txt or contact permission@sei.cmu.edu for full terms.
+Licensed under a MIT (SEI)-style license, please see information below, you may also contact permission@sei.cmu.edu for full terms.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 

data/json/decision_points/ssvc/human_impact_2_0_2.json

@@ -9,17 +9,17 @@
     {
       "key": "L",
       "name": "Low",
-      "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)"
+      "definition": "Safety Impact:(Negligible OR Marginal) AND Mission Impact:(Degraded OR MEF Support Crippled)"
     },
     {
       "key": "M",
       "name": "Medium",
-      "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))"
+      "definition": "(Safety Impact:(Negligible OR Marginal) AND Mission Impact:MEF Failure) OR (Safety Impact:Critical AND Mission Impact:Degraded)"
     },
     {
       "key": "H",
       "name": "High",
-      "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)"
+      "definition": "Safety Impact:Critical AND Mission Impact:(MEF Support Crippled OR MEF Failure)"
     },
     {
       "key": "VH",

data/json/decision_tables/ssvc/deployer_patch_application_priority_1_0_0.json

@@ -87,17 +87,17 @@
         {
           "key": "L",
           "name": "Low",
-          "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)"
+          "definition": "Safety Impact:(Negligible OR Marginal) AND Mission Impact:(Degraded OR MEF Support Crippled)"
         },
         {
           "key": "M",
           "name": "Medium",
-          "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))"
+          "definition": "(Safety Impact:(Negligible OR Marginal) AND Mission Impact:MEF Failure) OR (Safety Impact:Critical AND Mission Impact:Degraded)"
         },
         {
           "key": "H",
           "name": "High",
-          "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)"
+          "definition": "Safety Impact:Critical AND Mission Impact:(MEF Support Crippled OR MEF Failure)"
         },
         {
           "key": "VH",

data/json/decision_tables/ssvc/human_impact_1_0_0.json

@@ -77,17 +77,17 @@
         {
           "key": "L",
           "name": "Low",
-          "definition": "Safety Impact:(Negligible) AND Mission Impact:(Degraded OR Crippled)"
+          "definition": "Safety Impact:(Negligible OR Marginal) AND Mission Impact:(Degraded OR MEF Support Crippled)"
         },
         {
           "key": "M",
           "name": "Medium",
-          "definition": "(Safety Impact:Negligible AND Mission Impact:MEF Failure) OR (Safety Impact:Marginal AND Mission Impact:(Degraded OR Crippled))"
+          "definition": "(Safety Impact:(Negligible OR Marginal) AND Mission Impact:MEF Failure) OR (Safety Impact:Critical AND Mission Impact:Degraded)"
         },
         {
           "key": "H",
           "name": "High",
-          "definition": "(Safety Impact:Critical AND Mission Impact:(Degraded OR Crippled)) OR (Safety Impact:Marginal AND Mission Impact:MEF Failure)"
+          "definition": "Safety Impact:Critical AND Mission Impact:(MEF Support Crippled OR MEF Failure)"
         },
         {
           "key": "VH",