Core System Architecture Part 98 — Anonymous Network Vulnerability Management, Exposure Discovery, Patch Prioritization, Remediation Coordination & Privacy-Preserving Security Maintenance Architecture
SIAR — Secure, Local-First, Multi-Transport Communication Platform
Series: Core System Architecture
Part: 98
Status: Architecture specification
Primary language: Rust
Builds on: Core System Architecture Parts 49, 51–53, 61–73, 78–83, 92–97
Primary purpose: define SIAR's vulnerability-management architecture for advisory ingestion, SBOM and artifact exposure discovery, host/service/package matching, exploitability context, risk prioritization, remediation coordination, patching, mitigation, maintenance scheduling, emergency response, rollback, verification, tenant/federation scope, exception handling, and privacy-preserving security maintenance.
1. Purpose
Vulnerability management answers:
What is vulnerable?
Where is it deployed?
How exploitable is it?
How urgent is remediation?
What can be patched safely?
How do we prove the fix worked?
A poor design can create:
unbounded host inventories
employee/device surveillance
stale patch dashboards
risk scores with no context
unsafe auto-updates
The governing principle is:
SIAR vulnerability management should reason about artifacts, services, packages, hosts, and trust boundaries—not users—and should drive verified remediation without creating a generalized monitoring system.
2. Architectural Position
Advisories / SBOM / Artifact Inventory / Host State
│
▼
Vulnerability Intake
│
▼
Exposure Matching
│
▼
Exploitability Evaluation
│
▼
Risk Prioritization
│
┌──────────┼──────────┐
│ │ │
Patch Mitigate Accept
│ │ │
└──────────┼──────────┘
▼
Remediation Plan
│
▼
Verify / Re-Evaluate
3. Core Separation
Keep distinct:
vulnerability
exposure
exploitability
risk
remediation
exception
patch rollout
verification
4. Non-Goals
Part 98 does not create:
a user risk score
employee device surveillance
unbounded network scanning
automatic patching with no rollback
dependency updates outside reviewed supply-chain controls
5. Vulnerability Identity
#![allow(unused)] fn main() { pub struct VulnerabilityId(pub String); }
6. Sources
Examples:
CVE
GHSA
RustSec advisory
OS vendor advisory
internal security advisory
7. Vulnerability Source
#![allow(unused)] fn main() { pub enum VulnerabilitySource { Cve, Ghsa, RustSec, OsVendor, LanguageEcosystem, Internal, FederationPeer, } }
8. Advisory Record
#![allow(unused)] fn main() { pub struct VulnerabilityAdvisory { pub id: VulnerabilityId, pub source: VulnerabilitySource, pub affected: AffectedComponentRange, pub severity: VulnerabilitySeverity, pub exploitability: ExploitabilityHint, pub fixed_versions: Vec<ComponentVersion>, pub published_at: CoarseTimestamp, } }
9. Vulnerability Severity
#![allow(unused)] fn main() { pub enum VulnerabilitySeverity { Low, Medium, High, Critical, } }
10. Severity ≠ Priority
Hard rule.
11. Why
Priority must include local exploitability and exposure context.
12. Vulnerability Intake
Inputs:
signed advisory feeds
RustSec
OS advisories
dependency scanners
internal incident findings
13. Intake Validation
Check:
source authenticity
schema validity
component identity
version ranges
timestamps
supersession
14. No Blind Feed Trust
Hard rule.
15. Advisory State
#![allow(unused)] fn main() { pub enum AdvisoryState { Candidate, Validated, Superseded, Withdrawn, } }
16. Withdrawn Advisory
Must remove active exposure warnings if no longer valid.
17. Hard rule.
18. Component Identity
Need canonical package identity.
19. Component ID
#![allow(unused)] fn main() { pub struct ComponentId { pub ecosystem: Ecosystem, pub name: ComponentName, } }
20. Ecosystem
#![allow(unused)] fn main() { pub enum Ecosystem { Cargo, Debian, Rpm, Apk, Android, Container, Firmware, Internal, } }
21. Version Matching
Typed per ecosystem.
22. No String-Comparison Version Logic
Hard rule.
23. SBOM Integration
Part 73.
24. Every production artifact should map to an SBOM.
25. SBOM Entry
#![allow(unused)] fn main() { pub struct SbomComponent { pub component: ComponentId, pub version: ComponentVersion, pub digest: Option<Digest>, pub dependency_path: DependencyPath, } }
26. Exposure Discovery
Match advisory → SBOM → deployed artifact/service.
27. Exposure Record
#![allow(unused)] fn main() { pub struct VulnerabilityExposure { pub exposure_id: ExposureId, pub vulnerability: VulnerabilityId, pub component: ComponentId, pub artifact: ArtifactDigest, pub scope: ExposureScope, pub state: ExposureState, } }
28. Exposure Scope
#![allow(unused)] fn main() { pub enum ExposureScope { Artifact(ArtifactDigest), Service(ServiceId), HostClass(HostClass), Environment(EnvironmentClass), TenantManaged(TenantId), FederationPeer(FederationDomainId), } }
29. No User Identity Scope
Hard rule.
30. Exposure State
#![allow(unused)] fn main() { pub enum ExposureState { Suspected, Confirmed, NotAffected, Mitigated, Fixed, ExceptionAccepted, } }
31. Suspected
Version match but local path not verified.
32. Confirmed
Affected and reachable/used.
33. NotAffected
Dependency present but vulnerable path absent or patch backported.
34. Mitigated
Temporary compensating control.
35. Fixed
Patched/remediated and verified.
36. ExceptionAccepted
Temporary accepted risk.
37. Hard Rule
Mitigated and ExceptionAccepted are not Fixed.
38. Exposure Discovery Sources
artifact manifests
deployment inventory
SBOM
host package inventory
container image manifests
runtime feature configuration
39. No User Activity Needed
Hard rule.
40. Asset Inventory
Infrastructure assets only.
41. Asset Types
#![allow(unused)] fn main() { pub enum AssetType { Artifact, Service, Host, ContainerImage, Database, Gateway, FederationPeer, ManagedDeviceClass, } }
42. ManagedDeviceClass
Not personal device identity by default.
43. Hard rule.
44. Inventory Record
#![allow(unused)] fn main() { pub struct AssetRecord { pub asset_id: AssetId, pub asset_type: AssetType, pub environment: EnvironmentClass, pub owner: ServiceOwnerRef, pub artifact: Option<ArtifactDigest>, } }
45. No Personal User Metadata
Hard rule.
46. Host Package Inventory
Potential privacy risk.
47. Server/managed infrastructure
Allowed.
48. Personal endpoint
Only SIAR app/runtime components by default.
49. No scanning unrelated personal apps.
50. Hard rule.
51. Vulnerability Matching
#![allow(unused)] fn main() { pub trait VulnerabilityMatcher { fn match_advisory( &self, advisory: &VulnerabilityAdvisory, asset: &AssetRecord, sbom: &Sbom, ) -> Result<ExposureMatch, VulnerabilityError>; } }
52. Matching Inputs Typed.
53. No regex over arbitrary package strings as security authority.
54. Hard rule.
55. Exploitability Context
Priority depends on real exposure.
56. Factors:
network reachability
feature enabled
privilege level
attack complexity
known exploit
sandboxing
compensating controls
57. Exploitability Context
#![allow(unused)] fn main() { pub struct ExploitabilityContext { pub reachable: ReachabilityClass, pub privilege: PrivilegeImpact, pub exploit_available: bool, pub feature_enabled: bool, pub mitigations: Vec<MitigationRef>, } }
58. Reachability Class
#![allow(unused)] fn main() { pub enum ReachabilityClass { PublicInternet, FederationOnly, InternalService, LocalOnly, Unreachable, } }
59. No User Traffic Analysis
Hard rule.
60. Reachability From Architecture/Network Policy
Not from user behavior graph.
61. Hard rule.
62. Exploit Intelligence
From Part 97.
63. Known Exploit
Raises urgency.
64. Threat Intel confidence considered.
65. No black-box scoring.
66. Hard rule.
67. Risk Priority
Use explicit factors.
68. Risk Priority
#![allow(unused)] fn main() { pub struct VulnerabilityPriority { pub severity: VulnerabilitySeverity, pub exploitability: ExploitabilityClass, pub exposure: ReachabilityClass, pub asset_criticality: AssetCriticality, pub priority: RemediationPriority, } }
69. Remediation Priority
#![allow(unused)] fn main() { pub enum RemediationPriority { Routine, Soon, Urgent, Emergency, } }
70. No One Numeric Score Required
Hard rule.
71. Critical Conditions
Examples:
known remote exploit
public-facing vulnerable service
release-signing compromise
tenant-isolation bypass
72. Emergency Remediation
Immediate.
73. Hard rule.
74. Asset Criticality
#![allow(unused)] fn main() { pub enum AssetCriticality { Low, Standard, High, Critical, } }
75. Critical Examples
identity provider
key service
release signer
federation gateway
control plane
76. Patch Availability
#![allow(unused)] fn main() { pub enum PatchAvailability { Available(ComponentVersion), BackportAvailable(ComponentVersion), NoPatch, WorkaroundOnly, } }
77. NoPatch
Requires mitigation/risk decision.
78. Hard rule.
79. Remediation Options
#![allow(unused)] fn main() { pub enum RemediationAction { UpgradeComponent, RebuildArtifact, DisableFeature, RestrictNetwork, RotateCredential, ReplaceComponent, Quarantine, AcceptTemporaryRisk, } }
80. Preferred
Patch/rebuild.
81. Mitigation
Temporary.
82. Risk Acceptance
Last resort.
83. Hard rule.
84. Remediation Plan
#![allow(unused)] fn main() { pub struct VulnerabilityRemediationPlan { pub exposure: ExposureId, pub actions: Vec<RemediationAction>, pub rollout: PatchRolloutPlan, pub verification: VerificationPlan, pub rollback: Option<RollbackPlanRef>, } }
85. No Remediation Without Verification
Hard rule.
86. Patch Rollout Plan
#![allow(unused)] fn main() { pub struct PatchRolloutPlan { pub phases: Vec<PatchRolloutPhase>, pub maintenance: MaintenancePolicy, pub max_unavailable: Option<u16>, } }
87. Rollout Phases
#![allow(unused)] fn main() { pub enum PatchRolloutPhase { Test, Canary, Partial, Broad, Complete, } }
88. Emergency
Can skip some phases only if policy permits.
89. Still requires rollback/verification.
90. Hard rule.
91. Patch Source
Only trusted release pipeline.
92. No direct package install from arbitrary advisory link.
93. Hard rule.
94. Patch Artifact
Must have:
signature
SBOM
provenance
tests
compatibility
95. Supply-chain controls apply.
96. No emergency bypass of artifact trust.
97. Hard rule.
98. Rebuild
Preferred for immutable infrastructure.
99. No in-place manual patch on compromised host if avoidable.
100. Hard rule.
101. Hotfix
If necessary:
signed
versioned
reproducible where possible
time-limited
merged back into normal release
102. No permanent undocumented hotfix.
103. Hard rule.
104. Maintenance Window
#![allow(unused)] fn main() { pub struct MaintenancePolicy { pub allowed_window: Option<MaintenanceWindow>, pub emergency_bypass: bool, } }
105. Routine Patch
Honor window.
106. Emergency Patch
Can bypass with approval.
107. User-facing service impact communicated.
108. Hard rule.
109. Tenant Maintenance
Tenant-specific schedule where applicable.
110. But critical platform vulnerability may override.
111. Scope clear.
112. Hard rule.
113. Managed Device Maintenance
Organization-managed profile only.
114. Personal device remains user-controlled outside app/runtime requirements.
115. Hard rule.
116. Patch Coordination
Service dependencies matter.
117. Example:
database
API
worker
client
118. Compatibility Matrix
#![allow(unused)] fn main() { pub struct PatchCompatibility { pub component: ComponentId, pub from: VersionRange, pub to: ComponentVersion, pub compatible_peers: Vec<VersionRange>, } }
119. No blind fleet-wide update.
120. Hard rule.
121. Mixed-Version Support
Important during rollout.
122. Protocol compatibility from Part 52.
123. Patch canary validates.
124. No global update if incompatible.
125. Hard rule.
126. Remediation Ownership
Every exposure has service owner.
127. Owner Ref
Infrastructure/team role, not person identity where possible.
128. Hard rule.
129. Remediation SLA
Based on priority.
130. Example:
Routine: 30 days
Soon: 14 days
Urgent: 72 hours
Emergency: immediate/24 hours
131. Policy configurable.
132. No one-size-fits-all.
133. Hard rule.
134. SLA Breach
Escalate.
135. Does not automatically imply exploit.
136. Hard rule.
137. Remediation Ticket
#![allow(unused)] fn main() { pub struct RemediationWorkItem { pub work_id: WorkItemId, pub exposure: ExposureId, pub owner: ServiceOwnerRef, pub priority: RemediationPriority, pub due_at: Timestamp, pub state: RemediationWorkState, } }
138. Work State
#![allow(unused)] fn main() { pub enum RemediationWorkState { Planned, InProgress, Testing, RollingOut, Verifying, Completed, Blocked, } }
139. No Completed Before Verification
Hard rule.
140. Verification
Need proof vulnerability is fixed.
141. Verification Sources
new SBOM
artifact digest
runtime version
control pass
exploit regression test
attestation
142. No "ticket closed" as proof.
143. Hard rule.
144. Verification Plan
#![allow(unused)] fn main() { pub struct VerificationPlan { pub checks: Vec<VerificationCheck>, pub minimum_evidence: EvidenceTrustLevel, } }
145. Verification Check
#![allow(unused)] fn main() { pub enum VerificationCheck { ComponentVersion, ArtifactDigest, SbomNoMatch, RuntimeAttestation, RegressionTest, ControlPass(ControlId), } }
146. Fixed State Requires Verification
Hard rule.
147. Re-Evaluation
After patch:
advisory match
exploitability
control state
148. No stale exposure state.
149. Hard rule.
150. Rollback
If patch breaks service.
151. Rollback target must still be safe enough.
152. Cannot rollback to known critically vulnerable version unless emergency mitigation exists.
153. Hard rule.
154. Rollback Decision
#![allow(unused)] fn main() { pub enum PatchRollbackDecision { Allowed, AllowedWithMitigation, Blocked, } }
155. Security Gate
Checks vulnerability state.
156. Hard rule.
157. No-Patch Vulnerability
Mitigation.
158. Examples:
disable affected feature
restrict ingress
remove component
sandbox harder
increase authentication
159. Mitigation State
#![allow(unused)] fn main() { pub struct VulnerabilityMitigation { pub exposure: ExposureId, pub action: RemediationAction, pub expires_at: Timestamp, pub verification: Vec<EvidenceRef>, } }
160. Expiry Required
Hard rule.
161. Mitigation Must Not Become Permanent Hidden Debt
Hard rule.
162. Risk Acceptance
Temporary.
163. Risk Acceptance Record
#![allow(unused)] fn main() { pub struct VulnerabilityRiskAcceptance { pub exposure: ExposureId, pub reason: RiskReasonCode, pub approvals: ApprovalBundle, pub expires_at: Timestamp, pub compensating_controls: Vec<ControlId>, } }
164. High/Critical requires multi-party approval.
165. No permanent acceptance.
166. Hard rule.
167. Risk Acceptance ≠ Fixed
Hard rule.
168. Acceptance Expiry
Exposure returns active priority.
169. No silent extension.
170. Hard rule.
171. Vulnerability Exception Audit
Part 94.
172. Record:
acceptance created
acceptance renewed
acceptance expired
173. No personal notes.
174. Hard rule.
175. Exposure Discovery Frequency
Event-driven + periodic.
176. Trigger on:
new advisory
new artifact
deployment change
SBOM change
host inventory change
177. Periodic safety sweep.
178. No constant full-fleet scan if unnecessary.
179. Hard rule.
180. Network Scanning
Limited.
181. Use inventory and service registry first.
182. Active scanning only approved infrastructure.
183. No scanning user home networks.
184. Hard rule.
185. Public Attack Surface Discovery
Can validate:
known service endpoints
TLS posture
exposed ports
186. Use known asset list.
187. No broad internet scanning from user devices.
188. Hard rule.
189. Exposure Discovery Agent
Minimal.
190. Reads:
installed SIAR package versions
artifact digest
runtime config
191. Does not read user content.
192. Hard rule.
193. Managed Device Exposure
Can report managed-app/runtime versions.
194. Not personal app inventory.
195. Hard rule.
196. Vulnerability Database
Stores:
advisories
component ranges
exposure refs
remediation state
verification evidence
197. No user behavior.
198. Hard rule.
199. Exposure Index
By:
component
artifact
service
environment
tenant managed scope
200. Not user.
201. Hard rule.
202. Prioritization Engine
#![allow(unused)] fn main() { pub trait VulnerabilityPrioritizer { fn prioritize( &self, exposure: &VulnerabilityExposure, context: &ExploitabilityContext, ) -> Result<VulnerabilityPriority, VulnerabilityError>; } }
203. Explainable factors.
204. No opaque ML score baseline.
205. Hard rule.
206. Priority Explanation
#![allow(unused)] fn main() { pub struct PriorityExplanation { pub reasons: Vec<PriorityReason>, } }
207. Example:
Known exploit
Publicly reachable
Critical identity service
No mitigation
208. Good.
209. Threat Intel Integration
Part 97.
210. Known exploit increases urgency.
211. False-positive/revoked intel updates priority.
212. Hard rule.
213. Incident Integration
Part 96.
214. Critical actively exploited exposure may open incident.
215. Incident and remediation workflows linked but separate.
216. Hard rule.
217. Compliance Integration
Part 95.
218. Controls:
critical exposure remediation SLA
patch verification
risk acceptance expiry
managed endpoint version
219. No Pass if critical exposure unresolved without approved exception.
220. Hard rule.
221. Audit Integration
Part 94.
222. Audit:
risk acceptance
emergency patch approval
critical rollback
patch policy change
223. Not every routine package update.
224. Hard rule.
225. Analytics Integration
Part 92.
226. Aggregate metrics:
open critical exposures
mean remediation time
patch rollout failure rate
227. No user identity.
228. Hard rule.
229. SOC Integration
Part 97.
230. IoCs/exploit intel feed prioritization.
231. Detection can alert on exploitation.
232. No duplicate responsibilities.
233. Hard rule.
234. Supply-Chain Integration
Part 73.
235. Patch artifact from normal trusted pipeline.
236. New SBOM required.
237. No "security patch" label bypass.
238. Hard rule.
239. Host Integrity Integration
Part 71.
240. After patch/rebuild:
reattest
verify artifact
verify config
241. No assumed success.
242. Hard rule.
243. Secrets Integration
Part 80.
244. If vulnerability exposes secret
rotate affected credential/key.
245. Patching code alone may be insufficient.
246. Hard rule.
247. Cryptographic Vulnerability
Part 66.
248. If primitive/suite affected:
deprecate suite
negotiate stronger suite
rotate keys
migrate protocol
249. No silent downgrade.
250. Hard rule.
251. Database Vulnerability
Patch service carefully.
252. Plan:
replica first
canary
failover
primary patch
reverify
253. No blind production restart.
254. Hard rule.
255. Client Vulnerability
Desktop/Android app.
256. Signed update.
257. Minimum supported version policy.
258. Security-critical client patch may force upgrade.
259. But local data access/recovery should remain safe.
260. Hard rule.
261. Forced Update Policy
#![allow(unused)] fn main() { pub enum ClientUpdatePolicy { Recommended, RequiredSoon, RequiredForNetworkAccess, } }
262. RequiredForNetworkAccess
Only if old client poses real security/privacy risk.
263. No routine coercion.
264. Hard rule.
265. Offline Clients
Cannot patch immediately.
266. On reconnect
check minimum supported version.
267. If blocked
allow safe local export/recovery where possible.
268. Good.
269. No destructive lockout.
270. Hard rule.
271. Mobile Store Delay
App store review can delay.
272. Alternative signed direct distribution where product supports.
273. Keep compatibility plan.
274. No unsigned emergency APK.
275. Hard rule.
276. Emergency Server Mitigation
Can restrict old client protocol.
277. Avoid exposing users.
278. Hard rule.
279. Federation Vulnerability
Peer software affected.
280. Local domain can:
require minimum peer version
restrict vulnerable capability
temporarily suspend federation
281. No remote patch authority.
282. Hard rule.
283. Federation Advisory
Signed.
284. Share vulnerability/mitigation relevant to peer.
285. No internal inventory.
286. Hard rule.
287. Vulnerability Disclosure Intake
External researchers.
288. Need responsible disclosure channel.
289. Intake record:
#![allow(unused)] fn main() { pub struct VulnerabilityReport { pub report_id: VulnerabilityReportId, pub reporter_contact: Option<ReporterContact>, pub affected_area: VulnerabilityArea, pub summary: BoundedText, pub evidence_ref: Option<SecureEvidenceRef>, } }
290. Reporter Can Be Anonymous
Good.
291. No forced identity.
292. Hard rule.
293. Report Evidence
Secure upload.
294. No email attachment requirement for sensitive PoC.
295. Good.
296. Disclosure Triage
Validate.
297. Do not run arbitrary PoC in production.
298. Hard rule.
299. Coordinated Disclosure
If valid:
confirm
remediate
prepare advisory
release patch
publish advisory
300. Reporter credit optional.
301. No deanonymization.
302. Hard rule.
303. Vulnerability Embargo
Sensitive until patch ready.
304. Access limited.
305. No broad internal distribution.
306. Hard rule.
307. Security Advisory
Signed public document.
308. Contains:
affected versions
severity
impact
fixed versions
mitigations
credits if consented
309. No sensitive exploit detail before safe disclosure.
310. Hard rule.
311. Patch Prioritization Policy
Versioned.
312. Example priority rule:
Known exploit + public reachability + critical asset => Emergency
313. Bounded deterministic rules.
314. No Turing-complete policy.
315. Hard rule.
316. Prioritization Rule
#![allow(unused)] fn main() { pub enum PriorityRule { KnownExploit, PublicReachable, PrivilegeEscalation, CriticalAsset, NoPatch, TenantIsolationImpact, PrivacyImpact, } }
317. Privacy Impact
First-class.
318. A vulnerability leaking anonymity metadata can be Emergency.
319. Hard rule.
320. Security Debt
Open vulnerabilities age.
321. Aging can increase urgency.
322. But no fake precision.
323. Hard rule.
324. Exposure Age
Coarse days.
325. No exact developer/employee tracking.
326. Hard rule.
327. SLA Dashboard
By service/team role.
328. No employee leaderboard.
329. Hard rule.
330. Maintenance UX
Operators need:
exposure
priority
affected service
patch availability
owner
deadline
verification state
331. Avoid:
blame
shaming
332. Good.
333. Patch Freeze
Sometimes change freeze active.
334. Emergency vulnerabilities can override freeze with approval.
335. Hard rule.
336. Change Management
Integrate release/rollout.
337. Patch = normal deployment with elevated urgency, not separate unsafe path.
338. Hard rule.
339. Patch Rollout Gate
Before each phase:
health
security
compatibility
privacy
340. Stop on regression.
341. Hard rule.
342. Canary Scope
Small service instance subset.
343. Not selected by user identity.
344. Hard rule.
345. User-Facing Canary
If client release rollout
local random/app-store cohort okay.
346. No user profiling.
347. Hard rule.
348. Patch Verification State
#![allow(unused)] fn main() { pub enum PatchVerificationState { Pending, Passed, Failed, Inconclusive, } }
349. Inconclusive ≠ Passed
Hard rule.
350. Patch Completion
Exposure becomes Fixed only after Passed.
351. Hard rule.
352. Re-Exposure
If vulnerable artifact redeployed.
353. Create new exposure/transition back.
354. No permanent closure masking.
355. Hard rule.
356. Anti-Rollback
Deployment policy must block known vulnerable artifact versions if prohibited.
357. Artifact denylist signed.
358. No stale rollout restore.
359. Hard rule.
360. Vulnerable Artifact Registry
#![allow(unused)] fn main() { pub struct VulnerableArtifactRecord { pub artifact: ArtifactDigest, pub vulnerabilities: Vec<VulnerabilityId>, pub policy: ArtifactSecurityPolicy, } }
361. Artifact Security Policy
#![allow(unused)] fn main() { pub enum ArtifactSecurityPolicy { Allowed, AllowedWithMitigation, Blocked, } }
362. Critical exploit
Blocked.
363. Hard rule.
364. Dependency Upgrade
Rust crates.
365. Cargo.lock change reviewed.
366. Run:
cargo audit
cargo deny
tests
reproducibility
SBOM
367. No mass "cargo update" in production branch.
368. Hard rule.
369. Transitive Dependency
Need dependency path.
370. Helps assess reachability.
371. No assumption all transitive vulnerabilities exploitable.
372. Hard rule.
373. Reachability Analysis
Optional static/dynamic.
374. Use code/module graph.
375. No production user behavior trace.
376. Hard rule.
377. Rust Feature Flags
Advisory may affect disabled feature.
378. SBOM/build metadata includes enabled features if practical.
379. Good.
380. NotAffected can be justified.
381. Hard rule.
382. OS Vulnerability
Image/base OS rebuild.
383. No mutable snowflake host patching baseline.
384. Hard rule.
385. Container Image Vulnerability
Rebuild image.
386. Never patch running container filesystem as final fix.
387. Hard rule.
388. Firmware Vulnerability
Special maintenance.
389. Verify vendor signature.
390. No custom unsigned firmware.
391. Hard rule.
392. Client Embedded Dependencies
Need SBOM for desktop/mobile binaries.
393. Track Rust crates/native codec libs/platform libs as applicable.
394. No blind spot.
395. Hard rule.
396. Privacy-Preserving Asset Discovery
Prefer declarative inventories.
397. Avoid broad discovery scans.
398. No user network mapping.
399. Hard rule.
400. Vulnerability Query API
#![allow(unused)] fn main() { pub trait VulnerabilityQueryService { fn exposures( &self, scope: ExposureScope, ) -> Result<Vec<VulnerabilityExposure>, VulnerabilityError>; fn exposure( &self, id: ExposureId, ) -> Result<VulnerabilityExposure, VulnerabilityError>; } }
401. No all-users/all-devices query.
402. Hard rule.
403. Remediation Service
#![allow(unused)] fn main() { pub trait VulnerabilityRemediationService { fn plan( &self, exposure: ExposureId, ) -> Result<VulnerabilityRemediationPlan, VulnerabilityError>; fn verify( &self, exposure: ExposureId, evidence: Vec<EvidenceRef>, ) -> Result<PatchVerificationState, VulnerabilityError>; } }
404. Advisory Service
#![allow(unused)] fn main() { pub trait VulnerabilityAdvisoryService { fn ingest( &self, advisory: VulnerabilityAdvisory, ) -> Result<(), VulnerabilityError>; } }
405. Exposure Matcher
#![allow(unused)] fn main() { pub trait ExposureDiscoveryService { fn evaluate_asset( &self, asset: AssetId, ) -> Result<Vec<VulnerabilityExposure>, VulnerabilityError>; } }
406. No Hidden Network Scan Side Effects
Hard rule.
407. Vulnerability Error Taxonomy
#![allow(unused)] fn main() { pub enum VulnerabilityError { AdvisoryInvalid, UnsupportedEcosystem, VersionParseFailed, AssetNotFound, ExposureNotFound, PatchUnavailable, RemediationDenied, VerificationFailed, RiskAcceptanceExpired, ScopeViolation, Internal, } }
408. Observability
Safe metrics:
open exposure count by severity
mean remediation time
patch success rate
verification failure rate
stale risk acceptance count
409. No user data.
410. Hard rule.
411. Vulnerability SLOs
Examples:
critical advisory ingestion latency
exposure discovery latency
emergency patch start latency
risk acceptance expiry enforcement
412. Privacy SLO
0 personal app inventories
0 user-network scanning
0 user behavior in exposure prioritization
413. Security SLO
0 critical blocked artifact deployed
0 fixed exposure without verification
0 expired risk acceptance treated as active
414. Failure Modes
advisory feed outage
false positive advisory
patch regression
inventory stale
verification inconclusive
415. Advisory Feed Outage
Use cached validated advisories.
416. Alert ops.
417. No assume no vulnerabilities.
418. Hard rule.
419. False Positive Advisory
Mark withdrawn/superseded.
420. Re-evaluate exposures.
421. No stale blocking.
422. Hard rule.
423. Patch Regression
Stop rollout.
424. Roll back only if security gate permits.
425. Otherwise apply mitigation.
426. Hard rule.
427. Inventory Stale
Exposure state becomes Unknown/Suspected.
428. No false NotAffected.
429. Hard rule.
430. Verification Inconclusive
Do not mark Fixed.
431. Hard rule.
432. Testing
Need vulnerability-management testkit.
433. Test Scenarios
RustSec advisory
critical public exploit
no-patch mitigation
patch rollback
risk acceptance expiry
434. Advisory Match Test
Affected version correctly matched.
435. Version Test
Semver/backport logic correct per ecosystem.
436. SBOM Test
Artifact maps to component exposure.
437. Feature Test
Disabled vulnerable feature can produce NotAffected only with evidence.
438. Reachability Test
Local-only exposure lower than public where policy says.
439. Known Exploit Test
Priority escalates.
440. Privacy Impact Test
Anonymity leak can be Emergency.
441. Risk Acceptance Test
Exception not Fixed.
442. Expiry Test
Expired acceptance returns active exposure.
443. Patch Verification Test
No Fixed before evidence passes.
444. Rollback Test
Known critically vulnerable target blocked.
445. Tenant Test
Tenant A exposure inventory not visible to B.
446. Personal Device Test
No unrelated app inventory collected.
447. Federation Test
Peer advisory does not reveal internal asset inventory.
448. Backup Test
Expired acceptance not resurrected.
449. Artifact Anti-Rollback Test
Blocked vulnerable release cannot redeploy.
450. Fuzzing
Fuzz:
advisory parser
version range parser
SBOM entry
patch plan
risk acceptance record
451. Property Tests
Properties:
expired risk acceptance can never produce ExceptionAccepted
verification Inconclusive can never produce Fixed
blocked artifact can never pass deployment gate
asset exposure matching never requires user behavioral data
452. Formal Verification Targets
Strong candidates:
exposure lifecycle
risk acceptance expiry
patch rollout/rollback
verification gate
453. Kani Candidate
priority/state transition invariants.
454. TLA+ Candidate
advisory → exposure → plan → canary → verify → complete / rollback.
455. Loom Candidate
concurrent advisory update + deployment change + exposure reevaluation.
456. Performance
Exposure matching incremental.
457. New advisory:
query matching SBOM components only.
458. New artifact:
evaluate its SBOM only.
459. No fleet-wide recompute on every change.
460. Hard rule.
461. Advisory Index
By component/ecosystem/version range.
462. Asset Index
By component/artifact/service/environment.
463. No user index.
464. Hard rule.
465. Patch Rollout
Asynchronous state machine.
466. No blocking dashboard request.
467. Hard rule.
468. Storage
Separate stores:
advisories
SBOM refs
asset inventory
exposures
remediation plans
risk acceptances
verification evidence refs
469. No user behavior store.
470. Hard rule.
471. Partitioning
By:
environment
service
tenant managed scope
federation peer
472. No global user partition.
473. Hard rule.
474. Crate Layout
Recommended:
crates/
├── siar-vulnerability-core/
├── siar-advisory-ingest/
├── siar-sbom-index/
├── siar-asset-inventory/
├── siar-exposure-discovery/
├── siar-vulnerability-priority/
├── siar-patch-planner/
├── siar-patch-rollout/
├── siar-risk-acceptance/
├── siar-vulnerability-verification/
├── siar-vulnerability-observability/
└── siar-vulnerability-testkit/
475. siar-vulnerability-core
Owns:
VulnerabilityId
ExposureId
states
severity
errors
476. siar-advisory-ingest
Trusted advisory normalization/validation.
477. siar-sbom-index
Component/version/dependency-path indexing.
478. siar-asset-inventory
Infrastructure/managed asset scope only.
479. siar-exposure-discovery
Advisory→SBOM→artifact/service matching.
480. siar-vulnerability-priority
Explainable exploitability/risk prioritization.
481. siar-patch-planner
Patch/mitigation/compatibility planning.
482. siar-patch-rollout
Canary/partial/broad/emergency patch state machine.
483. siar-risk-acceptance
Temporary approved exceptions.
484. siar-vulnerability-verification
Post-remediation evidence/re-evaluation.
485. siar-vulnerability-observability
Aggregate patch/exposure health only.
486. siar-vulnerability-testkit
advisory/exposure/patch/privacy tests.
487. Security, Privacy & Correctness Invariants
Mandatory:
1. Vulnerability management operates on artifacts, packages, services, hosts, managed assets, and federation peers—not user behavior, personal app inventories, or private content.
2. Advisory severity and remediation priority remain distinct; priority is derived from explainable exploitability, reachability, asset criticality, privacy impact, and known-exploit context.
3. Exposure discovery relies on trusted SBOM, artifact, deployment, and managed inventory data; broad user-device or user-network scanning is prohibited.
4. `Mitigated`, `ExceptionAccepted`, `Suspected`, and `NotAffected` are distinct states and can never be silently treated as `Fixed`.
5. A vulnerability becomes `Fixed` only after explicit verification evidence confirms the affected component/artifact/runtime is no longer vulnerable.
6. Security patches use the same signed, reproducible, provenance-checked release pipeline as normal software; urgency never permits unsigned or unverified patch artifacts.
7. Risk acceptance and mitigations are narrowly scoped, approved, time-bounded, auditable, and automatically invalid after expiry.
8. Patch rollback cannot restore a known critically vulnerable artifact unless an explicit verified mitigation and policy permit it.
9. Tenant, federation-peer, server, and managed-device exposure inventories remain isolated; one scope never grants visibility into unrelated personal or cross-tenant assets.
10. Vulnerability intelligence, patch workflows, dashboards, and metrics contain no user-level behavior, social graph, private message, search, or feed data.
11. Deployment anti-rollback policy prevents blocked vulnerable artifacts or expired risk acceptances from returning through stale backups, replicas, or old manifests.
12. Vulnerability management integrates with SOC, incident response, compliance, audit, supply-chain security, and host attestation without creating a parallel surveillance or unsafe patching path.
488. Initial Production Scope
Implement first:
typed advisory/vulnerability model
RustSec/CVE/OS advisory normalization
SBOM/component index
artifact/service asset inventory
incremental exposure discovery
exploitability context
explainable priority rules
patch availability state
patch/mitigation/remediation planning
canary/partial/broad rollout
risk acceptance with expiry
patch verification gate
vulnerable artifact blocking
compliance/audit/SOC integration
tenant/federation scope isolation
privacy-safe vulnerability metrics
vulnerability testkit
Then add:
static reachability analysis
advanced exploitability correlation
managed endpoint app-component checks
signed coordinated disclosure portal
formal patch/rollback verification
cross-domain vulnerability advisory federation
489. Definition of Done
Part 98 is complete when:
- advisories are normalized and source-validated
- SBOMs map vulnerabilities to real artifacts/services
- exposure scope excludes ordinary user behavior
- severity and remediation priority are distinct
- exploitability is explainable
- privacy-impacting vulnerabilities are first-class
- patches use trusted supply-chain paths
- rollouts support canary and rollback
- risk acceptance expires automatically
Fixedrequires verification- known critically vulnerable artifacts can be blocked from deployment
- tenant/federation/managed-device scope stays isolated
- dashboards contain no employee/user surveillance data
- advisory/exposure/patch/rollback/fuzz/formal tests are specified
490. Final Architecture
ADVISORIES / SBOM / INVENTORY
│
▼
EXPOSURE DISCOVERY
│
▼
EXPLOITABILITY CONTEXT
│
▼
PRIORITY DECISION
│
┌────────────┼────────────┐
│ │ │
PATCH MITIGATE ACCEPT
│ │ │
└────────────┼────────────┘
▼
ROLLOUT PLAN
│
▼
VERIFICATION
│
▼
FIXED / RE-EVALUATE
Vulnerability-management safety model:
trusted advisories
+
SBOM-driven exposure
+
explainable prioritization
+
signed patch pipeline
+
canary rollout
+
time-bounded exceptions
+
verification before closure
+
no user surveillance
not:
scan every device and network, assign opaque risk scores, push unverified emergency updates, and mark tickets closed without proving the vulnerability is gone
491. Final Principle
Vulnerability management should know exactly which components are exposed, why they matter, and whether the fix truly worked—without needing to observe the people using the system.
The correct model is:
ingest trusted advisories
+
map to SBOMs
+
evaluate real exposure
+
prioritize explainably
+
patch through trusted releases
+
roll out cautiously
+
verify explicitly
+
expire exceptions
+
never turn maintenance into surveillance
This architecture gives SIAR a privacy-preserving security-maintenance foundation for advisory intake, SBOM exposure discovery, patch prioritization, mitigation, risk acceptance, coordinated rollout, verification, client/server maintenance, and federation vulnerability handling while preserving the anonymity, local-first, least-authority, and anti-surveillance guarantees established across Parts 34–97.