<!-- START doctoc generated TOC please keep comment here to allow auto update -->
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
**Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*

- [📰 Advisory archived — sync taking it from here  *(CVE JSON auto-pushed)*](#-advisory-archived--sync-taking-it-from-here--cve-json-auto-pushed)
  - [What still happens automatically on the next sync](#what-still-happens-automatically-on-the-next-sync)
  - [Where this fits in the lifecycle](#where-this-fits-in-the-lifecycle)

<!-- END doctoc generated TOC please keep comment here to allow auto update -->

<!-- SPDX-License-Identifier: Apache-2.0
     https://www.apache.org/licenses/LICENSE-2.0 -->

<!--
     OAuth-pushed variant of the publication-ready notification
     comment posted by `security-issue-sync` when the *Public advisory
     URL* body field has just been populated, the CVE JSON has been
     regenerated to carry the archive URL as a `vendor-advisory`
     reference, **and** the regenerated JSON has been pushed to
     Vulnogram via the OAuth API on the same sync pass (Step 14 of
     the lifecycle).

     **Informational only.** Sync drives every state change in the
     post-2026 flow — the regenerated JSON push happened this run,
     and on the next sync pass the `READY` → `PUBLIC` advance
     (`vulnogram-api-record-publish`), the label flips, the tracker
     close, and the board archive will all fire automatically. The
     RM's only remaining actions land in the *wrap-up* comment sync
     posts immediately after the close.

     This template is the counterpart to `release-manager-publication-
     comment.md` (the manual-paste variant). The sync skill picks
     between the two based on the outcome of `vulnogram-api-check` +
     `vulnogram-api-record-update` — see Step 5b of
     `.claude/skills/security-issue-sync/SKILL.md` for the decision
     flow.

     Idempotency: the marker on the first line is the **same** as the
     manual-paste variant's; the skill keys idempotency on the marker
     and detects the variant by re-reading the body. On a re-sync
     where the previous comment was manual-paste but the current push
     succeeded, the skill PATCH-edits the body in place.

     Placeholders the skill substitutes:

       CVE_ID                e.g. CVE-2026-40690
       RM_HANDLE             GitHub handle of the release manager
                             (with leading `@`)
       ARCHIVE_URL           The captured users-list archive URL
       SOURCE_TAB_URL        <cve_tool_record_url_template>#source
       JSON_ANCHOR_URL       Tracker body deep-link to the embedded
                             CVE JSON section
       CVE_ORG_URL           https://www.cve.org/CVERecord?id=CVE_ID
       PUSH_TIMESTAMP        ISO-8601 timestamp of the
                             `vulnogram-api-record-update` call
                             this sync pass made
-->
<!-- apache-magpie: release-manager-publication-ready v1 -->

## 📰 Advisory archived — sync taking it from here  *(CVE JSON auto-pushed)*

RM_HANDLE — the advisory you sent in Step 2 of the hand-off comment above has now been archived on the public users-list. **You do not need to do anything in Vulnogram in response to this comment.**

This sync pass made the following deterministic updates:

- **Public advisory URL** body field populated: [ARCHIVE_URL](ARCHIVE_URL)
- The embedded CVE JSON regenerated to include the archive URL as a `vendor-advisory` reference.
- The regenerated JSON auto-pushed to [`#source`](SOURCE_TAB_URL) via the Vulnogram OAuth API at `PUSH_TIMESTAMP` (no manual paste needed).
- The `announced` label added.

### What still happens automatically on the next sync

- ✅ The record is now staged for the `READY` → `PUBLIC` move (sync drives this via `vulnogram-api-record-publish` on its next pass).
- ✅ This tracker will be closed as `completed`.
- ✅ A **wrap-up comment** will then be posted on this tracker with the only remaining manual actions for you: archive this tracker from the `Announced` column on the [security project board](https://github.com/<tracker>/projects), and (conditionally) close the milestone if every sibling on it has shipped.

The CVE will propagate to [`cve.org`](CVE_ORG_URL) within a few hours of the `READY → PUBLIC` move. Once it does, sync posts a courtesy *"CVE is live on cve.org"* note to the reporter on the original email thread (no action from you needed).

### Where this fits in the lifecycle

Step 14 (advisory archive captured) → Step 15 (record `PUBLIC` + tracker close) — see [`tools/cve-tool-vulnogram/record.md`](record.md) for the full Vulnogram-side checklist. The wrap-up comment that follows in the next sync pass is the explicit go-ahead for your final board + milestone cleanups.
