feat(security): import email-delivered scans; add submit-to-oss-scan

.agents/skills/magpie-security-submit-to-oss-scan

@@ -0,0 +1 @@
+../../plugins/magpie-security/skills/submit-to-oss-scan

.claude-plugin/marketplace.json

@@ -70,7 +70,7 @@
       "name": "magpie-security",
       "source": "./plugins/magpie-security",
       "version": "0.9.0.dev202610241347",
-      "description": "Apache Magpie security family (15 skills)."
+      "description": "Apache Magpie security family (16 skills)."
     },
     {
       "name": "magpie-setup",

.claude/skills/magpie-security-submit-to-oss-scan

@@ -0,0 +1 @@
+../../.agents/skills/magpie-security-submit-to-oss-scan

.github/labeler.yml

@@ -27,11 +27,13 @@ capability:authoring:
       - any-glob-to-any-file:
           - 'plugins/magpie-security/skills/model-prepare/**'
           - 'plugins/magpie-security/skills/model-update/**'
+          - 'plugins/magpie-security/skills/submit-to-oss-scan/**'
           - 'plugins/magpie-utilities/skills/optimize-skill/**'
           - 'plugins/magpie-utilities/skills/write-skill/**'
           - 'tools/skill-evals/evals/optimize-skill/**'
           - 'tools/skill-evals/evals/security-model-prepare/**'
           - 'tools/skill-evals/evals/security-model-update/**'
+          - 'tools/skill-evals/evals/security-submit-to-oss-scan/**'
           - 'tools/skill-evals/evals/write-skill/**'
 
 capability:fix:
@@ -376,6 +378,7 @@ family:security:
           - 'tools/skill-evals/evals/security-model-prepare/**'
           - 'tools/skill-evals/evals/security-model-update/**'
           - 'tools/skill-evals/evals/security-model-verify/**'
+          - 'tools/skill-evals/evals/security-submit-to-oss-scan/**'
           - 'tools/skill-evals/evals/security-tracker-stats-dashboard/**'
 
 family:setup:

.github/skills/magpie-security-submit-to-oss-scan

@@ -0,0 +1 @@
+../../.agents/skills/magpie-security-submit-to-oss-scan

.grok/skills/magpie-security-submit-to-oss-scan

@@ -0,0 +1 @@
+../../.agents/skills/magpie-security-submit-to-oss-scan

.kiro/skills/magpie-security-submit-to-oss-scan

@@ -0,0 +1 @@
+../../.agents/skills/magpie-security-submit-to-oss-scan

README.md

@@ -178,7 +178,7 @@ means and which modes are still proposed vs. shipping today.
 |---|---|---|---|---|
 | [**setup**](docs/setup/README.md) | always-on | (infra) | Isolated agent setup, framework install + maintenance, shared-config sync. The prerequisite — at minimum the `setup` skill itself runs out of this family. | 11 skills, [`docs/setup/`](docs/setup/) |
 | **utilities** | always-on | (meta) | Framework meta-skills: author skills (`write-skill`), restructure them (`optimize-skill`), reconcile skill state (`skill-reconciler`), report framework issues (`report-framework-issue`), and print a live index (`list-skills`). | 5 skills |
-| [**security**](docs/security/README.md) | opt-in | Triage, Drafting | 16-step security-issue handling lifecycle — from `security@` import through CVE publication, including state sync — plus producing, verifying, and maintaining the project's own security model. Maintainer-only. | 15 skills, [`docs/security/`](docs/security/) |
+| [**security**](docs/security/README.md) | opt-in | Triage, Drafting | 16-step security-issue handling lifecycle — from `security@` import through CVE publication, including state sync — plus producing, verifying, and maintaining the project's own security model. Maintainer-only. | 16 skills, [`docs/security/`](docs/security/) |
 | [**pr-management**](docs/pr-management/README.md) | opt-in | Triage | Maintainer-facing PR-queue management — triage, stats, deep code review, stack review, express-lane merge, stale-sweep, reviewer routing, and pre-first-PR checks. | 9 skills, [`docs/pr-management/`](docs/pr-management/README.md) |
 | [**issue**](docs/issue-management/README.md) | opt-in | Triage, Drafting | General-issue lifecycle: triage, reproduction, fix drafting, reassess, stale-sweep, deduplication, and backlog reporting. | 8 skills, [`docs/issue-management/`](docs/issue-management/README.md) |
 | [**release-management**](docs/release-management/README.md) | opt-in | Triage, Drafting | 14-step ASF release lifecycle, planning issue, RC cut + sign, `[VOTE]` thread, tally, promote, `[ANNOUNCE]`, archive, audit log. Agent never holds the RM's signing key and never publishes the release. **Experimental**, all 10 skills shipped. | 10 skills, [`docs/release-management/`](docs/release-management/) |

docs/labels-and-capabilities.md

@@ -276,6 +276,7 @@ Capabilities for every skill currently in
 | `security-issue-deduplicate` | `capability:resolve` |
 | `issue-deduplicate` | `capability:resolve` *(closes a duplicate general-issue and posts cross-reference comments; maintainer confirms before any action is applied)* |
 | `security-model-update` | `capability:reassess` + `capability:authoring` *(re-reads closed trackers, reporter threads, and canned responses against the published model — reassess — and proposes the known-non-finding and gap diff — authoring)* |
+| `security-submit-to-oss-scan` | `capability:authoring` *(prepares the scanner enrolment and derives its threat-model summary from the project's security model)* |
 | `issue-reassess` | `capability:reassess` |
 | `issue-reproducer` | `capability:reassess` |
 | `pr-management-stats` | `capability:stats` |
@@ -354,7 +355,7 @@ or a contract-free mix of substrates (e.g. `tools/spec-inventory` is
 | [`tools/osv`](../tools/osv/) | `contract:security-cross-ref` | OSV.dev vulnerability cross-reference client (Vendor: OSV.dev): queries vulnerability records, alias cross-references (CVE ↔ GHSA ↔ OSV IDs), affected package versions, and vulnerabilities associated with a public upstream commit via OSV.dev REST API v1 |
 | [`tools/people`](../tools/people/) | `contract:people` | Adapter contract for accounts on a forge or tracker: profile lookup, repository collaborators, team membership (one confirmed write). Pure interface spec; GitHub implements every verb, Jira profile lookup only |
 | [`tools/ponymail`](../tools/ponymail/) | `contract:mail-archive` + `contract:mail-source` | PonyMail public mail-archive substrate (ASF `lists.apache.org`); implements the `tools/mail-archive/` contract for archive reads and the `tools/mail-source/` contract for inbound list-traffic ingestion |
-| [`tools/scan-format`](../tools/scan-format/) | `contract:scan-format` | Adapter contract for security-scanner report formats (ASVS reference); reads a scan's finding index + per-finding evidence for the `security-issue-import-from-scan` pipeline. |
+| [`tools/scan-format`](../tools/scan-format/) | `contract:scan-format` | Adapter contract for security-scanner report formats (ASVS reference; `anthropic-oss-scanner` for scans delivered as one email); reads a scan's finding index + per-finding evidence for the `security-issue-import-from-scan` pipeline. |
 | [`tools/permission-audit`](../tools/permission-audit/) | `substrate:sandbox` | Audit + atomically edit Claude Code `permissions.allow[]` entries; backs `/magpie-setup:setup verify --apply-permission-audit` (check 8d) |
 | [`tools/adversarial-review`](../tools/adversarial-review/) | `substrate:review` | Runs other models' CLIs (Codex, Copilot, Gemini, Claude) read-only over a change before its PR is created, and merges their findings into one advisory JSON report |
 | [`tools/vetted-ops`](../tools/vetted-ops/) | `substrate:sandbox` | Fixed, policy-scoped forge operations — a closed catalogue whose parameters can never become commands or flags, so one `allow` entry replaces the wildcard Layer 3 `ask` rules |

docs/modes.md

@@ -61,7 +61,7 @@ Autonomous* (the renamed former *Auto-merge*).
 |---|---|---|---|
 | **Triage** | *(Agentic Triage)* Issues, security reports, PRs: spot, classify, route, surface duplicates. Every output is a suggestion the human signs off on. | stable (security) / experimental (pr-management, issue-management, contributor-nomination, repo-health, release-management) | 40 |
 | **Mentoring** | *(Agentic Mentoring)* Joins issue and PR threads in a teaching register: clarifying questions, pointers to project conventions, paired examples from prior PRs, hand-off to a human when scope exceeds the agent. Also authors net-new good first issues, curates the existing backlog, and explains filed issues to newcomers to lower onboarding latency. | experimental | 7 |
-| **Drafting** | *(Agentic Drafting)* Agent drafts a fix for a well-scoped problem and opens a PR; every PR is reviewed and merged by a human committer. | stable (security-only); experimental (issue-management, audit-findings, release-management family) | 11 |
+| **Drafting** | *(Agentic Drafting)* Agent drafts a fix for a well-scoped problem and opens a PR; every PR is reviewed and merged by a human committer. | stable (security-only); experimental (issue-management, audit-findings, release-management family) | 12 |
 | **Pairing** | *(Agentic Pairing)* Developer-side dev-cycle skills with mentorship intrinsic — multi-agent review pipelines, self-review and pre-flight patterns, scoped fix drafting under the developer's driver's seat. | experimental | 3 |
 | **Meta** | *(framework infrastructure & authoring)* Adoption, isolation, upgrade, status, and skill-authoring flows plus read-only stats dashboards' framework plumbing. These skills are framework machinery rather than a maintainership mode; they do not act on issues, PRs, or contributor threads on their own. | stable | 20 |
 | **Agentic Autonomous** | Auto-merge restricted to objectively boring change classes only (lint, dependency bumps inside an allow-list, license-header insertion, formatting, broken-link repair). | off | 0 |
@@ -188,6 +188,7 @@ the agent never merges its own work.
 |---|---|---|
 | [`security-issue-fix`](../skills/security-issue-fix/SKILL.md) | Draft a fix PR in `<upstream>` from a triaged, CVE-allocated tracker. | stable (security-only) |
 | [`issue-fix-workflow`](../skills/issue-fix-workflow/SKILL.md) | Draft a fix for a triaged general-issue-tracker issue (BUG or FEATURE-REQUEST). | experimental |
+| [`security-submit-to-oss-scan`](../skills/security-submit-to-oss-scan/SKILL.md) | Draft the enrolment PR for an automated security scanner: `project.yaml`, an offline-capable `Dockerfile`, and a threat-model summary derived from the project's security model. | experimental |
 | [`audit-finding-fix`](../skills/audit-finding-fix/SKILL.md) | Draft fixes for non-security audit-tool findings (lint violations, type errors, CodeQL alerts, doc-coverage gaps); re-runs the tool after each batch to confirm findings are cleared. | experimental |
 | [`release-prepare`](../skills/release-prepare/SKILL.md) | Planning issue + version-bump / changelog / NOTICE / LICENSE prep PR (Steps 1-2). Also the post-release `-SNAPSHOT` bump (Step 14). | experimental |
 | [`release-keys-sync`](../skills/release-keys-sync/SKILL.md) | Draft the `KEYS` diff for a new Release Manager (Step 3). Agent never holds the private key. | experimental |

docs/quick-start.md

@@ -36,7 +36,7 @@ project and no opt-in from your teammates. Committing anything for other
 people is a separate act called **adoption** —
 [Installation or Adoption?](quick-start/two-ways.md) draws the line.
 
-**What you get.** 81 skills your agent can run, grouped into 10 **families** —
+**What you get.** 82 skills your agent can run, grouped into 10 **families** —
 PR triage and review, issue triage, security-report handling, release
 management, contributor mentoring. Install only the families you need; each one
 you add costs context in every session —
@@ -180,7 +180,7 @@ draws the line.
 
 **Every skill configures itself on first use.** You do not have to remember
 which projects are set up, or run anything to prepare a family before you use
-it: 70 of the 81 skills open with a silent pre-flight — the eleven exceptions are
+it: 71 of the 82 skills open with a silent pre-flight — the eleven exceptions are
 the setup skills themselves, which are what you run to fix whatever it finds.
 
 The first time you call a skill in a project, that pre-flight works out how

docs/quick-start/families.md

@@ -41,7 +41,7 @@ today — you are not meant to take all of them.
 | Plugin | Skills | The problem it solves | What it offers |
 |---|---|---|---|
 | `magpie-setup` | 11 | Your agent can read every credential on your machine, and you have no way to tell whether it is sandboxed right now. | A filesystem sandbox, a clean-env wrapper, a status line that shows sandbox state, and a red banner before any bypass. Plus install, upgrade, and drift checks. **You must install this one first** — it is what installs everything else. |
-| `magpie-security` | 15 | Security reports arrive by mail and must be triaged, fixed, and disclosed on a clock — with nothing leaking early. | A 16-step lifecycle: intake from the mailbox, validity triage, canned responses, fix drafting, CVE allocation, advisory and publication. Drafts land in Gmail; nothing is ever sent for you. |
+| `magpie-security` | 16 | Security reports arrive by mail and must be triaged, fixed, and disclosed on a clock — with nothing leaking early. | A 16-step lifecycle: intake from the mailbox, validity triage, canned responses, fix drafting, CVE allocation, advisory and publication. Drafts land in Gmail; nothing is ever sent for you. |
 | `magpie-release-management` | 10 | An ASF release is a long checklist where one missed step invalidates the vote. | RC cut, RC verification (signatures, hashes, LICENSE/NOTICE, no stray binaries), the `[VOTE]` thread, the tally, promotion, `[ANNOUNCE]`, archive sweep, audit log. The agent never holds your signing key and never publishes. |
 | `magpie-pr-management` | 9 | The PR queue grows faster than you can read it, and the oldest ones quietly rot. | Queue triage into ready / needs-review / waiting-on-author, deep code review with blocking vs non-blocking findings, whole-stack review of stacked PRs, reviewer routing, express-lane merge, stale sweep, and queue statistics. |
 | `magpie-issue` | 8 | A backlog full of duplicates, unreproducible reports, and issues nobody has read in a year. | Triage with proposed labels, duplicate clustering, reproduction attempts across versions, fix drafting, reassessment of old issues, stale sweep, and backlog stats. |

docs/security/README.md

@@ -53,7 +53,7 @@ and reuse the skills verbatim.
 
 ## Install & first runs
 
-Install just this family — one plugin, 15 skills. The security-report lifecycle, from intake through CVE publication.
+Install just this family — one plugin, 16 skills. The security-report lifecycle, from intake through CVE publication.
 
 Once you have [added the marketplace](../setup/marketplace-install.md):
 
@@ -104,12 +104,12 @@ says which file is missing.
 | [`canned-responses.md`](../../plugins/magpie-setup/templates/canned-responses.md) | Reusable reporter-facing reply templates. | `issue-invalidate`, `issue-triage` |
 | [`fix-workflow.md`](../../plugins/magpie-setup/templates/fix-workflow.md) | Fork / clone / toolchain specifics, backport-label policy, commit-trailer wording, PR scrubbing, private-PR fallback. | `issue-fix` |
 | [`milestones.md`](../../plugins/magpie-setup/templates/milestones.md) | Milestone naming conventions + create-and-assign recipe. | `issue-sync` |
-| [`project.md`](../../plugins/magpie-setup/templates/project.md) | Project manifest. Identity, repositories, mailing lists, tools enabled, CVE tooling, GitHub project-board + issue-template field declarations. The single file every skill reads to resolve project-scoped references. | `cve-allocate`, `issue-deduplicate`, `issue-fix`, `issue-import`, `issue-import-from-md`, `issue-import-from-pr`, `issue-import-from-scan`, `issue-import-via-forwarder`, `issue-invalidate`, `issue-triage`, `model-verify`, `tracker-stats-dashboard` |
+| [`project.md`](../../plugins/magpie-setup/templates/project.md) | Project manifest. Identity, repositories, mailing lists, tools enabled, CVE tooling, GitHub project-board + issue-template field declarations. The single file every skill reads to resolve project-scoped references. | `cve-allocate`, `issue-deduplicate`, `issue-fix`, `issue-import`, `issue-import-from-md`, `issue-import-from-pr`, `issue-import-from-scan`, `issue-import-via-forwarder`, `issue-invalidate`, `issue-triage`, `model-verify`, `submit-to-oss-scan`, `tracker-stats-dashboard` |
 | [`release-trains.md`](../../plugins/magpie-setup/templates/release-trains.md) | Active release branches, release-manager attribution per cut, rotation rosters, security-team roster. | `issue-triage` |
 | [`scanner-products.md`](../../plugins/magpie-setup/templates/scanner-products.md) | Private scanner product names, and the finder-anonymisation rule applied before anything is quoted publicly. | `issue-sync` |
 | [`scope-labels.md`](../../plugins/magpie-setup/templates/scope-labels.md) | Scope label → CVE product / `packageName` / collection-URL mapping. Exactly one scope label per tracker. | `issue-deduplicate`, `issue-import-from-md`, `issue-import-from-pr`, `issue-triage`, `tracker-stats-dashboard` |
 | [`security-intake-config.md`](../../plugins/magpie-setup/templates/security-intake-config.md) | Capability-flag vocabulary for the intake path: how reports arrive, what counts as in scope, and what a receipt says. | `issue-import` |
-| [`security-model.md`](../../plugins/magpie-setup/templates/security-model.md) | Authoritative URL for the project's Security Model + known-useful anchors + drafting rule. | `issue-triage`, `model-prepare`, `model-update`, `model-verify` |
+| [`security-model.md`](../../plugins/magpie-setup/templates/security-model.md) | Authoritative URL for the project's Security Model + known-useful anchors + drafting rule. | `issue-triage`, `model-prepare`, `model-update`, `model-verify`, `submit-to-oss-scan` |
 | [`security-tracker-stats.md`](../../plugins/magpie-setup/templates/security-tracker-stats.md) | Which tracker fields and windows the stats dashboard reads, and what it publishes. | `tracker-stats-dashboard` |
 | [`title-normalization.md`](../../plugins/magpie-setup/templates/title-normalization.md) | Regex cascade the `security-cve-allocate` skill applies to tracker titles before pasting them into the CVE-tool allocation form. | `cve-allocate` |
 

docs/setup/marketplace.md

@@ -53,7 +53,7 @@ Magpie**. The [pinned snapshot install](../quick-start/other-install-methods.md)
 for the cases it does not cover.
 
 > [!IMPORTANT]
-> A marketplace install drops the 81 skills into your agent and is complete
+> A marketplace install drops the 82 skills into your agent and is complete
 > for day-to-day use. What it does **not** set up on its own is the
 > repo-side machinery — the committed pin, the gitignored snapshot, drift
 > detection, agentic overrides — or the secure-agent setup, which you run
@@ -159,7 +159,7 @@ can say so, because it is the floor everything else is managed from.
 
 | Family plugin | Skills | ~Always-on tokens |
 |---|---|---|
-| `magpie-security` | 15 | ~1.1k |
+| `magpie-security` | 16 | ~1.2k |
 | `magpie-setup` | 11 | ~0.8k |
 | `magpie-release-management` | 10 | ~0.8k |
 | `magpie-pr-management` | 9 | ~1.0k |

docs/vendor-neutrality.md

@@ -603,15 +603,15 @@ generated block below.
 | `contract:security-tracker` | ✅ | vendor-backed | Atlassian, agnostic | 2 backend vendors: Atlassian, agnostic; partial foundation, not counted: asf-security-dash |
 | `contract:body-field` | ✅ | agnostic | Atlassian, GitHub, agnostic | vendor-neutral by construction — one spec serves every backend |
 
-**Per-skill assessment: 81/81 skills carry no vendor lock-in.** A skill is *capability-pure* when it names no backend at all, *portable* when every backend it names has an alternative (its contract is green), and *vendor-coupled* only when it reaches for a backend that is the sole implementation of a capability.
+**Per-skill assessment: 82/82 skills carry no vendor lock-in.** A skill is *capability-pure* when it names no backend at all, *portable* when every backend it names has an alternative (its contract is green), and *vendor-coupled* only when it reaches for a backend that is the sole implementation of a capability.
 
 | Skill neutrality | Count |
 |---|---|
 | capability-pure (names no backend) | 30 |
-| portable (named backends are swappable) | 51 |
+| portable (named backends are swappable) | 52 |
 | vendor-coupled (sole-backend dependency) | 0 |
 
-Organization scope (declared, orthogonal to vendor): ASF = 16, agnostic = 65.
+Organization scope (declared, orthogonal to vendor): ASF = 16, agnostic = 66.
 
 **LLM / agent-integration neutrality**