# AGENTS
## Role
Implement the Microsoft Security Response Center (MSRC) connector to ingest Microsoft security updates (Security Updates API / CVRF).

## Scope
- Identify MSRC data sources (Security Update Guide API, CVRF downloads) and incremental update strategy.
- Implement fetch/cursor pipeline with retry/backoff, handling API keys if required.
- Parse advisories to extract summary, affected products, KBs, CVEs, severities, mitigations.
- Map entries into canonical `Advisory` objects with aliases, references, affected packages, and range primitives (e.g., Windows build numbers, SemVer). 
- Provide deterministic fixtures and regression tests.

## Participants
- `Source.Common`, `Storage.Mongo`, `Feedser.Models`, `Feedser.Testing`.

## Interfaces & Contracts
- Job kinds: `msrc:fetch`, `msrc:parse`, `msrc:map`.
- Persist upstream metadata (e.g., `lastModified`, `releaseDate`).
- Alias set should include MSRC ID, CVEs, and KB identifiers.

## In/Out of scope
In scope: Microsoft Security Update Guide advisories.
Out of scope: Non-security Microsoft release notes.

## Observability & Security Expectations
- Log fetch/mapping stats, respect API rate limits, handle authentication securely.
- Sanitize payloads; validate JSON/CVRF before persistence.

## Tests
- Add `StellaOps.Feedser.Source.Vndr.Msrc.Tests` with fixtures covering fetch/parse/map.
- Snapshot canonical advisories; support fixture regeneration.
