{
 "schema_version": 4,
 "columns": [
  "cve_id",
  "state",
  "days_public",
  "hours_public",
  "public_date",
  "public_date_origin",
  "clock_known",
  "rule",
  "rule_strength",
  "rule_certainty",
  "rule_basis",
  "self_disclosed",
  "owner_nameable",
  "veto_evaluated",
  "clock_origin",
  "advisory_date",
  "advisory_days_public",
  "sources",
  "feed_count",
  "refs",
  "source_urls",
  "package",
  "ecosystem",
  "description",
  "state_verified_this_run"
 ],
 "csv_encoding": {
  "object": "JSON, keys sorted. json.loads() on the cell.",
  "array": "JSON, keys sorted. json.loads() on the cell.",
  "bool": "the strings true and false, lowercase.",
  "null": "the empty cell."
 },
 "fields": {
  "cve_id": {
   "type": "string",
   "absent": "never absent",
   "meaning": "The CVE ID. Always present."
  },
  "state": {
   "type": "string",
   "absent": "never absent",
   "meaning": "Reservation state from the CVE Services endpoint. Always RESERVED in this file; the field exists so a consumer can assert it."
  },
  "days_public": {
   "type": "integer|null",
   "absent": "null",
   "meaning": "Days since the earliest advisory this site can see. A FLOOR on how long the ID has been public, never a measure of lateness. null when no feed supplied a usable date."
  },
  "hours_public": {
   "type": "integer|null",
   "absent": "null",
   "meaning": "The same quantity in the rule's unit."
  },
  "public_date": {
   "type": "date|null",
   "absent": "null",
   "meaning": "Earliest advisory date this site saw."
  },
  "public_date_origin": {
   "type": "string",
   "absent": "never absent",
   "meaning": "How `public_date` was obtained. 'feed' where a configured feed supplied it during the gather. 'lookup' where no feed did and Ubuntu's tracker was asked for this ID by name, which is how rows older than the Ubuntu walk's reach get an age at all. 'none' where the row still has no date and cannot be aged. A 'lookup' date is a tracker date exactly as a walked one is: it starts the buffer and never the 72-hour expectation, and it adds no source to `sources` because the ID was only looked up on the strength of another feed having already found it."
  },
  "clock_known": {
   "type": "boolean",
   "absent": "never absent",
   "meaning": "false when no feed supplied a date, in which case the row cannot be aged at any threshold."
  },
  "rule": {
   "type": "string",
   "absent": "never absent",
   "meaning": "CONSTANT '4.5.1.6' under v1, and this says so rather than listing an alternative no code path can reach. 4.5.1.4 needs an owner, v1 attributes nothing, so every row is the SHOULD reading. Kept rather than cut because it returns the day NAMING_ENABLED flips, and cutting it now would mean two breaks for a consumer."
  },
  "rule_strength": {
   "type": "string",
   "absent": "never absent",
   "meaning": "CONSTANT 'SHOULD' under v1, matching `rule`."
  },
  "rule_certainty": {
   "type": "string",
   "absent": "never absent",
   "meaning": "CONSTANT 'unmeasurable' under v1: the disclosure ordering needs an owner. An unmeasurable row is filed under the WEAKER rule, so it is not evidence that a third party disclosed first."
  },
  "rule_basis": {
   "type": "string",
   "absent": "never absent",
   "meaning": "CONSTANT 'unattributed' under v1: the rule call rests on no owner because there is none."
  },
  "self_disclosed": {
   "type": "boolean",
   "absent": "never absent",
   "meaning": "CONSTANT false under v1. The only route to a 4.5.1.4 reading, and that reading is unreachable here."
  },
  "owner_nameable": {
   "type": "boolean",
   "absent": "never absent",
   "meaning": "ALWAYS false in v1: this site publishes no attribution. The one field to branch on. `owner`, `owner_tier`, `owner_method` and `owner_contested` were removed in schema v2 rather than published as permanent nulls."
  },
  "clock_origin": {
   "type": "string",
   "absent": "never absent",
   "meaning": "'advisory' if any feed that referenced this ID publishes actual advisories, otherwise 'tracker'. The 72-hour expectation runs from Public Disclosure, and a distribution tracker entry is a public source under the RBP definition but is NOT a Public Disclosure under 4.5.1.4 or 4.5.1.6. past_expectation is false on every tracker-only row for that reason."
  },
  "advisory_date": {
   "type": "date|null",
   "absent": "null",
   "meaning": "Earliest date from an advisory feed. null on tracker-only rows. This, not public_date, is what may start the 72-hour clock."
  },
  "advisory_days_public": {
   "type": "integer|null",
   "absent": "null",
   "meaning": "Days since advisory_date. null on tracker-only rows, where days_public is still reported: 'referenced for N days' is true of a tracker entry, 'N days late' is not."
  },
  "veto_evaluated": {
   "type": "boolean",
   "absent": "never absent",
   "meaning": "Whether a product-map verdict existed to contest the name at all. false means silence, not agreement."
  },
  "sources": {
   "type": "string",
   "absent": "\"\"",
   "meaning": "Comma-joined feed names that referenced this ID."
  },
  "source_urls": {
   "type": "object",
   "absent": "{}",
   "meaning": "One advisory URL per feed that referenced this ID, keyed by feed name. This is the evidence: each entry is a public page naming an ID the CVE List has not published. Empty only for feeds that publish no per-ID page. cve.org is never used as a fallback, because it renders nothing for a RESERVED ID and a link that disproves itself is worse than no link."
  },
  "feed_count": {
   "type": "integer",
   "absent": "never absent",
   "meaning": "Number of feeds, including mirrors."
  },
  "refs": {
   "type": "string",
   "absent": "\"\"",
   "meaning": "Semicolon-joined per-feed references. Truncated at 250 characters."
  },
  "package": {
   "type": "string",
   "absent": "\"\"",
   "meaning": "Affected package, where derivable. Often empty."
  },
  "ecosystem": {
   "type": "string",
   "absent": "\"\"",
   "meaning": "Package ecosystem, where derivable."
  },
  "description": {
   "type": "string",
   "absent": "\"\"",
   "meaning": "The upstream advisory's own summary, cut at the first sentence, with URLs and tracker annotations removed. Not a title, and not analysis by this site. Falls back to the package name where nothing usable survived."
  },
  "state_verified_this_run": {
   "type": "boolean",
   "absent": "true",
   "meaning": "false means the reservation endpoint could not be reached for this row and it was carried forward from the previous snapshot rather than dropped."
  }
 }
}