<!-- START doctoc generated TOC please keep comment here to allow auto update -->
<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
**Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*

- [📰 Advisory archived — sync taking it from here](#-advisory-archived--sync-taking-it-from-here)
  - [What still needs to happen (and who does it)](#what-still-needs-to-happen-and-who-does-it)
  - [Where this fits in the lifecycle](#where-this-fits-in-the-lifecycle)

<!-- END doctoc generated TOC please keep comment here to allow auto update -->

<!-- SPDX-License-Identifier: Apache-2.0
     https://www.apache.org/licenses/LICENSE-2.0 -->

<!--
     Manual-paste variant of the publication-ready notification
     comment posted by `security-issue-sync` when the *Public advisory
     URL* body field has just been populated and the CVE JSON has been
     regenerated to carry the archive URL as a `vendor-advisory`
     reference (Step 14 of the lifecycle).

     **Informational only.** Sync drives every state change in the
     post-2026 flow — the regenerated JSON push (Step 5b), the
     `REVIEW` → `PUBLIC` advance (`vulnogram-api-record-publish`),
     the label flips, the tracker close, the board archive. The
     RM's only remaining actions land in the *wrap-up* comment
     sync posts immediately after the close (archive the tracker
     from the `Announced` column, conditionally close the
     milestone).

     The manual-paste variant fires when sync could not auto-push
     the JSON this run (no OAuth credentials, expired session,
     transient HTTP error). In that case the post-archive JSON
     push, the `READY` → `PUBLIC` move, and the tracker close are
     all deferred until the security team's next sync resolves the
     push issue — the body of this comment explains the deferral.

     Placeholders the skill substitutes:

       CVE_ID                e.g. CVE-2026-40690
       RM_HANDLE             GitHub handle of the release manager
                             (with leading `@`)
       ARCHIVE_URL           The captured users-list archive URL (the
                             value just populated into the *Public
                             advisory URL* body field)
       SOURCE_TAB_URL        <cve_tool_record_url_template>#source
       JSON_ANCHOR_URL       Tracker body deep-link to the embedded
                             CVE JSON section
       CVE_ORG_URL           https://www.cve.org/CVERecord?id=CVE_ID
                             (the public mirror, post-PUBLIC)

     The HTML marker on the first line is load-bearing: the skill
     detects an already-posted publication-ready comment by grepping
     for this exact string and skips the post on subsequent sync runs
     (idempotency).
-->
<!-- apache-magpie: release-manager-publication-ready v1 -->

## 📰 Advisory archived — sync taking it from here

RM_HANDLE — the advisory you sent in Step 2 of the hand-off comment above has now been archived on the public users-list. **You do not need to do anything in Vulnogram in response to this comment.**

This sync pass made the following deterministic updates on this tracker:

- **Public advisory URL** body field populated: [ARCHIVE_URL](ARCHIVE_URL)
- The embedded CVE JSON regenerated to include the archive URL as a `vendor-advisory` reference in `references[]`.
- The `announced` label added.

### What still needs to happen (and who does it)

The Vulnogram OAuth push was blocked on this sync (no credentials, expired session, or transient error). Until the security team's next sync resolves the push, the final transitions are **deferred**:

- 🟡 Re-push the regenerated JSON to [`#source`](SOURCE_TAB_URL) (sync, next pass).
- 🟡 Move the record `READY` → `PUBLIC` via `vulnogram-api-record-publish` (sync, next pass).
- 🟡 Close this tracker as `completed` (sync, next pass).
- 🟡 Post the wrap-up comment with your final board-archive + milestone-close cleanup (sync, next pass).

**The release manager should not paste the JSON manually or move the state manually** unless an explicit "sync is stuck — please paste manually" follow-up arrives. Doing those manually races the automation and creates noisy timeline state.

If sync hasn't picked this up within ~24h, ping @potiuk on this tracker and we'll resolve the push issue on our side.

### Where this fits in the lifecycle

Step 14 (advisory archive captured) → Step 15 (record `PUBLIC` + tracker close) — see [`tools/cve-tool-vulnogram/record.md`](record.md) for the full Vulnogram-side checklist. The wrap-up comment that closes the loop is the explicit go-ahead for your board-archive + milestone-close actions.
