Milestone: vulnerability KB subsystem (Prolog facts + provenance) #1

New issue

Open

opened 2026-09-24 23:34:47 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-09-24 23:34:47 +00:00

(Migrated from github.com)

Source: https://github.com/lost-rob0t/zero-forge/blob/master/docs/architecture.md (stable doc, no ADARD approval state claimed)
Lineage: port-mapping milestone derived from ZeroForge; Python original at https://github.com/lost-rob0t/zero-forge

Scope

Implement the vulnerability knowledge base subsystem as Prolog facts/rules:

vuln/… predicate family for CVE records, advisories, evidence items, and
forge artifacts, each carrying provenance (source, fetched-at, digest).
Idempotent KB load/save backed by deterministic files, no external DB
requirement for v1.
Query predicates used by later milestones: lookup by CVE ID, by affected
package/CPE, by artifact status, by evidence class.
Fail-closed reads: records without provenance or with unverifiable claims
are quarantined, never silently merged.

Acceptance criteria

KB module loads under SWI-Prolog with no dependency on the prolog-rlm pack
internals beyond its public API.
Round-trip load/save test; duplicate ingest is a no-op.
Unprovenanced record ingest is rejected into a quarantine predicate, test covered.
Deterministic test suite runnable via swipl -q -s test/run_tests.pl style runner.

Dependencies

None. This is the root milestone.

Non-goals

No CVE ingestion format work here (own milestone).
No LLM/model calls; the KB is fully deterministic.

Implementation approval is not inferred from this issue.

**Source**: https://github.com/lost-rob0t/zero-forge/blob/master/docs/architecture.md (stable doc, no ADARD approval state claimed) **Lineage**: port-mapping milestone derived from ZeroForge; Python original at https://github.com/lost-rob0t/zero-forge ## Scope Implement the vulnerability knowledge base subsystem as Prolog facts/rules: - `vuln/…` predicate family for CVE records, advisories, evidence items, and forge artifacts, each carrying provenance (source, fetched-at, digest). - Idempotent KB load/save backed by deterministic files, no external DB requirement for v1. - Query predicates used by later milestones: lookup by CVE ID, by affected package/CPE, by artifact status, by evidence class. - Fail-closed reads: records without provenance or with unverifiable claims are quarantined, never silently merged. ## Acceptance criteria - KB module loads under SWI-Prolog with no dependency on the prolog-rlm pack internals beyond its public API. - Round-trip load/save test; duplicate ingest is a no-op. - Unprovenanced record ingest is rejected into a quarantine predicate, test covered. - Deterministic test suite runnable via `swipl -q -s test/run_tests.pl` style runner. ## Dependencies None. This is the root milestone. ## Non-goals - No CVE ingestion format work here (own milestone). - No LLM/model calls; the KB is fully deterministic. Implementation approval is not inferred from this issue.