vulnerability-disclosure-and-retest-manager

Import findings into a JSON retest register using the vdrm_register.py script, then update each finding's status with fix commits and notes as remediation progresses. The register tracks severity, confidence, evidence, retest steps, and full status history.

The register script deduplicates findings that share the same root cause, affected asset, and remediation by computing a dedupe key. Duplicates are merged into one canonical finding retaining all source IDs, union of evidence, highest severity, and lowest confidence.

Findings use exactly five statuses: open, fixed, partially_fixed, accepted_risk, and not_reproducible. A finding cannot be marked fixed from code review alone when runtime behavior, deployment, or data cleanup was part of the original issue.

No, the register script is a tracking helper, not a verifier. Manual retest evidence controls status; the skill routes retests to the original audit skills such as crypto-architecture-review or network-payload-zero-knowledge-test when authorized.

Do not use it to replace the original technical audit that found the issue, and do not start tracking, disclosure, or retesting merely because findings exist. It activates only when the user explicitly requests remediation tracking, disclosure drafting, retest planning, or audit closure.