[Anurag-S1ngh]

Summary

• cve-tool exits 20 (no cve_authority.tool declared anywhere), 21 (the configured tool has no adapter) and 22 (the adapter does not implement the check). Step 0 item 5 routed these to recipe only by accident, through the allocate-stage fallthrough with an unexpected server-check exit N reason, while api-allocation.md documents them as the recipe path. Both checks now take the recipe path with a reason that names the missing key.
• Step 0 item 5 of cve-allocate now states what a non-Vulnogram adopter does: skip the API pre-flight entirely and take Step 3's recipe path. The print-the-link-and-take-the-ID flow plus a plain CVE JSON 5 record is the documented default for projects allocating through another CNA (for example the GitHub CNA or MITRE directly).
• The recipe text no longer presents the Vulnogram Allocate button as the only way the CVE ID can arrive.

Type of change

• Skill change (skills/<name>/SKILL.md) - no eval fixtures exist for cve-allocate; measured_tokens re-stamped (7250)
• Python package (tools/security-management/)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Other:

Test plan

• prek run --all-files --skip workspace-pytest - passes; hooks that require Python >= 3.11 (run-workspace-check.sh for ruff/mypy/pytest, check-family-plugins, render-preflight-fixtures, skill-script-tests) fail on this machine's Python 3.9.6 identically on pristine upstream/main; the touched package passes its own ruff check, ruff format --check and mypy.
• uv run --project tools/security-management --group dev pytest tools/security-management/tests - 967 passed (7 new parametrized/added preflight assertions over exits 20/21/22, including one case pinning that exit 20's reason names cve_authority.tool)
• check-placeholders.sh OK; skill-token-count --check clean
• Other: skill behaviour for Vulnogram adopters is unchanged (exit 0 flows map exactly as before)

RFC-AI-0004 compliance

• HITL - no new mutation; allocation stays behind the same human confirmation and governance gate
• Vendor neutrality - the neutral print-the-link-and-take-the-ID default is now documented as the default for non-Vulnogram CNA tools; placeholders used throughout

Linked issues

Closes #1799

Notes for reviewers

• Much of cve-allocate: the pre-flight checks and the default record format assume Vulnogram #1799 already landed: the tools/cve-tool contract, the cve_authority.tool selection, #1905 (ASF defaults out of non-ASF drafts) and the independent organization manifest (tool: mitre-form, cve_tool_url: https://www.cve.org, cve.org record_url_template). What remained is the cve-allocate pre-flight telling non-Vulnogram adopters nothing, with a code/doc mismatch on the 20/21/22 exits.
• The emitted CVE record stays plain CVE JSON 5 in every path; non-ASF adopters must still set [cna].org_id in cve-json-config.toml (enforced by generate-cve-json, unchanged).
• Trade-off considered and rejected: renaming or neutralizing tools/cve-tool-vulnogram/ (the directory name, the generate-cve-json docstrings) was left out as out of scope for this issue.

[Kaap10]

Thanks @Anurag-S1ngh.

The logic to route exits 20, 21, and 22 to the recipe path and the test additions in test_cve_allocate.py are correct.

However, CI is currently failing on the prek job (check-family-plugins).

Issue:

tools/security-management/ is a substrate tool whose runtime files are mirrored into plugins/magpie-security-tools/tools/security-management/. Because gate.py and recipe.py were edited in tools/security-management/, the copy under plugins/magpie-security-tools/ is now out of sync.

Fix:

Please run the framework helper to sync the substrate copy, amend, and force-push:

python tools/dev/check-family-plugins.py --fix
git add plugins/magpie-security-tools/
git commit --amend --no-edit
git push origin <your-branch> --force-with-lease

Once synced, prek will pass green.

[Anurag-S1ngh]

Hi @Kaap10, thanks for the review. The plugin mirror is synced in 52302dd, and prek is green now. I put the sync in a separate commit rather than amending, so the branch has not been rewritten. Could you take another look?

[Kaap10]

Thanks @Anurag-S1ngh!

The substrate mirror under plugins/magpie-security-tools/ is now properly synced with tools/security-management/, and all CI checks (including prek) are passing green.

The routing of exit codes 20, 21, and 22 to the recipe path in gate.py, the updated recipe instructions, and the unit tests in test_cve_allocate.py look solid.

LGTM!

---

This review was drafted by an AI-assisted tool and
confirmed by an Apache Magpie maintainer. The maintainer
approving this PR has read the findings and signed off. If
something feels off, please reply on the PR and a maintainer
will follow up.

More on how Apache Magpie handles maintainer review:
Contributing guide.