# AGENTS
## Role
Connector for NVD API v2: fetch, validate, map CVE items to canonical advisories, including CVSS/CWE/CPE as aliases/references.
## Scope
- Windowed fetch by modified range (6-12h default) with pagination; respect rate limits.
- Parse NVD JSON; validate against schema; extract CVSS v3/v4 metrics, CWE IDs, configurations.cpeMatch.
- Map to Advisory: primary id='CVE-YYYY-NNNN'; references; AffectedPackage entries for CPE (type=cpe) and optional vendor tags.
- Optional change-history capture: store previous payload hashes and diff summaries for auditing modified CVEs.
- Watermark: last successful modified_end; handle partial windows with overlap to avoid misses.
## Participants
- Merge engine reconciles NVD with PSIRT/OVAL (NVD yields to OVAL for OS packages).
- KEV connector may flag some CVEs; NVD severity is preserved but not overridden by KEV.
- Exporters consume canonical advisories.
## Interfaces & contracts
- Job kinds: nvd:fetch, nvd:parse, nvd:map.
- Input params: windowHours, since, until; safe defaults in FeedserOptions.
- Output: raw documents, sanitized DTOs, mapped advisories + provenance (document, parser).
## In/Out of scope
In: registry-level data, references, generic CPEs.
Out: authoritative distro package ranges; vendor patch states.
## Observability & security expectations
- Metrics: SourceDiagnostics publishes `feedser.source.http.*` counters/histograms tagged `feedser.source=nvd`; dashboards slice on the tag to track page counts, schema failures, map throughput, and window advancement. Structured logs include window bounds and etag hits.
## Tests
- Author and review coverage in `../StellaOps.Feedser.Source.Nvd.Tests`.
- Shared fixtures (e.g., `MongoIntegrationFixture`, `ConnectorTestHarness`) live in `../StellaOps.Feedser.Testing`.
- Keep fixtures deterministic; match new cases to real-world advisories or regression scenarios.
