feat: add deterministic report skeleton renderer (v0.9.0)

Add render_template.py to omv-report — takes an Evidence.v1 YAML and
renders a pre-filled report skeleton for vuldb, ghsa, osv, or md formats.
Structural fields (package, versions, CVSS, CWE, source→sink→guard,
reproducer, dedup checklist) are filled deterministically; prose sections
carry [DRAFT: ...] markers for Claude to complete.

- Gates on status:confirmed + submission_score≥75 (--force bypasses)
- OSV emits pure JSON; VulDB/GHSA/MD emit Markdown with score footer
- Score computation mirrors contracts/evidence.v1.yaml scoring guide
- Adds confirmed-prototype-pollution.yaml fixture (100/100 scores)
- Adds four golden files (vuldb/ghsa/osv/md) for exact-match regression
- release_check.py: validate_renderer() runs all four formats at release time
- SKILL.md: confirmed path now documents running the renderer for a skeleton

Author: bx33661

scripts/release_check.py

@@ -28,6 +28,9 @@
     ("skills/omv-repro/scripts/check_output.py", "2", "skills/omv-repro/evals/golden/blocked-repro-failure.md"),
 ]
 
+RENDERER_FIXTURE = "skills/omv-report/evals/fixtures/confirmed-prototype-pollution.yaml"
+RENDERER_FORMATS = ["vuldb", "ghsa", "osv", "md"]
+
 
 def run(args: list[str]) -> None:
     subprocess.run(args, cwd=REPO_ROOT, check=True)
@@ -113,6 +116,39 @@ def validate_stable_evals() -> None:
         ])
 
 
+def validate_renderer() -> None:
+    renderer = REPO_ROOT / "skills/omv-report/scripts/render_template.py"
+    fixture = REPO_ROOT / RENDERER_FIXTURE
+    golden_dir = REPO_ROOT / "skills/omv-report/evals/golden"
+
+    for fmt in RENDERER_FORMATS:
+        ext = "json" if fmt == "osv" else "md"
+        golden = golden_dir / f"render-{fmt}.{ext}"
+        if not golden.exists():
+            raise SystemExit(f"missing renderer golden: {golden}")
+
+        result = subprocess.run(
+            [sys.executable, str(renderer), "--finding", str(fixture), "--format", fmt],
+            capture_output=True,
+            text=True,
+            cwd=REPO_ROOT,
+        )
+        if result.returncode != 0:
+            raise SystemExit(
+                f"renderer failed for --format {fmt}:\n{result.stderr.strip()}"
+            )
+
+        actual = result.stdout
+        expected = golden.read_text(encoding="utf-8")
+        if actual != expected:
+            raise SystemExit(
+                f"renderer golden mismatch for --format {fmt}\n"
+                f"Re-run: python3 {renderer} --finding {fixture} --format {fmt}"
+            )
+
+    print(f"OK: renderer golden tests passed ({', '.join(RENDERER_FORMATS)})", flush=True)
+
+
 def main() -> None:
     parser = argparse.ArgumentParser()
     parser.add_argument(
@@ -136,6 +172,7 @@ def main() -> None:
     validate_versions()
     run([sys.executable, str(VALIDATE_SCRIPT)])
     validate_stable_evals()
+    validate_renderer()
 
     artifacts: list[Path] = []
     if args.write_artifacts:

skills/omv-report/SKILL.md

@@ -59,6 +59,24 @@ Use the validation result to choose output mode:
 - `submissionScore` below 75 or `verdict.exploitability` not `proven`: do not produce a submission-ready report; explain what evidence or reproduction artifact is missing.
 - `evidence.repro_artifacts` present: reference the artifacts as local reviewer evidence. If absent, warn that the report depends only on inline reproducer text.
 
+### Deterministic Skeleton Renderer
+
+For confirmed findings with submission score ≥ 75, run the deterministic renderer first to get a pre-filled skeleton:
+
+```bash
+python3 "$(omv doctor --json | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('skillsDir',''))")/omv-report/scripts/render_template.py" \
+  --finding .omv/findings/<id>.yaml --format vuldb|ghsa|osv|md
+```
+
+Or if the skill directory is known (e.g. `~/.claude/skills/omv-report/`):
+
+```bash
+python3 ~/.claude/skills/omv-report/scripts/render_template.py \
+  --finding .omv/findings/<id>.yaml --format vuldb
+```
+
+The renderer fills all structural fields (package, versions, CVSS, CWE, source→sink→guard, reproducer, dedup checklist) and leaves `[DRAFT: ...]` markers for prose sections. Fill in every `[DRAFT: ...]` before submitting. Do not submit placeholders.
+
 After producing a submission-ready report for a confirmed finding, suggest removing it from the active local queue:
 
 ```bash

skills/omv-report/evals/fixtures/confirmed-prototype-pollution.yaml

@@ -0,0 +1,75 @@
+schema_version: "1"
+handoff_version: "1.0"
+status: confirmed
+researcher_goal: VulDB
+
+package:
+  ecosystem: npm
+  registry_name: demo-merge
+  repository_url: https://github.com/example/demo-merge
+  vendor: example-utils project
+  product: demo-merge
+
+versions:
+  tested: "2.4.1"
+  affected_range: "up to and including 2.4.1"
+  fixed: "2.4.2"
+
+vulnerability:
+  class: Prototype Pollution
+  cwe: CWE-1321
+  affected_component: src/merge.js
+  affected_function: mergeDeep()
+
+evidence:
+  source: "JSON.parse(req.body) passed to mergeDeep()"
+  sink: "target[key] = value in mergeDeep() at src/merge.js:42"
+  guard: "no blocklist for __proto__, constructor, prototype"
+  reproducer: |
+    node -e "const {mergeDeep}=require('./'); mergeDeep({},JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}'));" \
+      && node -e "const {mergeDeep}=require('./'); mergeDeep({},JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}')); console.log({}.polluted);"
+  observed_result: "prints 'yes' confirming Object.prototype mutation"
+  repro_artifacts:
+    - .omv/repro/demo-merge-pp/commands.sh
+    - .omv/repro/demo-merge-pp/observed.txt
+
+cvss:
+  vector: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+  score: "6.4"
+  severity: Medium
+
+impact:
+  attack_vector: Network
+  authentication_required: "true"
+  user_interaction_required: "false"
+  scope_changed: "true"
+  confidentiality: Low
+  integrity: Low
+  availability: None
+
+dedup:
+  nvd_searched: true
+  ghsa_searched: true
+  ecosystem_db_searched: true
+  existing_cve: none
+  notes: "Searched NVD, GHSA, npmjs advisory DB — no existing entry found"
+
+disclosure:
+  vendor_contacted: true
+  contact_date: "2026-04-20"
+  vendor_response: acknowledged
+  planned_disclosure_date: "2026-05-20"
+
+blockers: []
+
+verdict:
+  exploitability: proven
+  confidence: high
+  reason: "Local reproducer confirmed Object.prototype mutation via __proto__ injection"
+
+provenance:
+  verification_date: "2026-04-28"
+  researcher: researcher
+  unverified_fields: []
+  tool_versions:
+    omv-find: "0.8.0"

skills/omv-report/evals/golden/render-ghsa.md

@@ -0,0 +1,51 @@
+## GitHub Security Advisory
+
+**Ecosystem**
+npm
+
+**Package name**
+demo-merge
+
+**Affected versions**
+>= 0, < 2.4.2
+
+**Patched versions**
+2.4.2
+
+**Severity**
+Medium
+
+**CWE IDs**
+CWE-1321
+
+**Title**
+demo-merge: Prototype Pollution in mergeDeep()
+
+**Description**
+### Summary
+[DRAFT: One paragraph: Prototype Pollution in demo-merge up to and including 2.4.1.]
+
+### Details
+
+- Source: JSON.parse(req.body) passed to mergeDeep()
+- Sink:   target[key] = value in mergeDeep() at src/merge.js:42
+- Guard:  no blocklist for __proto__, constructor, prototype
+
+Affected file: `src/merge.js`
+Affected function: `mergeDeep()`
+
+### Impact
+[DRAFT: Attacker control, required auth (true), user interaction (false), scope (true). CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N]
+
+### Proof of Concept
+```
+node -e "const {mergeDeep}=require('./'); mergeDeep({},JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}'));" \
+  && node -e "const {mergeDeep}=require('./'); mergeDeep({},JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}')); console.log({}.polluted);"
+```
+Expected output: prints 'yes' confirming Object.prototype mutation
+
+### Recommended Fix
+[DRAFT: Specific code fix — reject prototype-mutating keys, validate input, add output encoding, etc.]
+
+---
+Rendered by omv render_template  |  evidence: 100/100  |  submission: 100/100  |  status: confirmed

skills/omv-report/evals/golden/render-md.md

@@ -0,0 +1,55 @@
+# demo-merge: Prototype Pollution in mergeDeep()
+
+## Summary
+[DRAFT: One paragraph: Prototype Pollution in demo-merge up to and including 2.4.1, classified as CWE-1321. Local reproducer confirmed Object.prototype mutation via __proto__ injection]
+
+## Affected Versions
+- Package: `npm:demo-merge`
+- Tested version: `2.4.1`
+- Affected range: `up to and including 2.4.1`
+- Fixed version: `2.4.2`
+
+## Technical Details
+
+- Source: JSON.parse(req.body) passed to mergeDeep()
+- Sink:   target[key] = value in mergeDeep() at src/merge.js:42
+- Guard:  no blocklist for __proto__, constructor, prototype
+
+Affected file: `src/merge.js`
+Affected function: `mergeDeep()`
+
+[DRAFT: Explain the root cause and why the guard is insufficient or absent.]
+
+## Impact
+[DRAFT: Attacker control, required auth (true), user interaction (false), scope (true), security consequences (C:Low I:Low A:None).]
+
+CVSS v3.1: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N` — 6.4 Medium
+
+## Proof of Concept
+
+```
+node -e "const {mergeDeep}=require('./'); mergeDeep({},JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}'));" \
+  && node -e "const {mergeDeep}=require('./'); mergeDeep({},JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}')); console.log({}.polluted);"
+```
+Expected output: prints 'yes' confirming Object.prototype mutation
+
+## Remediation
+[DRAFT: Specific fix — e.g. reject prototype-mutating keys, validate input range, add output encoding.]
+
+## Disclosure Timeline
+
+- 2026-04-20: vendor contacted
+- response: acknowledged
+- 2026-05-20: planned public disclosure
+
+## References
+
+- Repository: https://github.com/example/demo-merge
+- CWE-1321: https://cwe.mitre.org/data/definitions/1321.html
+
+Reproduction artifacts:
+  - .omv/repro/demo-merge-pp/commands.sh
+  - .omv/repro/demo-merge-pp/observed.txt
+
+---
+Rendered by omv render_template  |  evidence: 100/100  |  submission: 100/100  |  status: confirmed

skills/omv-report/evals/golden/render-osv.json

@@ -0,0 +1,50 @@
+{
+  "schema_version": "1.6.0",
+  "id": "TBD",
+  "modified": "2026-04-28T00:00:00Z",
+  "published": "2026-05-20T00:00:00Z",
+  "summary": "demo-merge: Prototype Pollution in mergeDeep()",
+  "details": "[DRAFT: Root cause, affected component (src/merge.js mergeDeep()), impact, and attack requirements.]  Source: JSON.parse(req.body) passed to mergeDeep() \u2192 Sink: target[key] = value in mergeDeep() at src/merge.js:42 \u2192 Guard: no blocklist for __proto__, constructor, prototype  Observed: prints 'yes' confirming Object.prototype mutation",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "demo-merge"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.4.2"
+            }
+          ]
+        }
+      ],
+      "versions": [
+        "2.4.1"
+      ],
+      "database_specific": {
+        "cwe_ids": [
+          "CWE-1321"
+        ],
+        "source": "Source: JSON.parse(req.body) passed to mergeDeep() \u2192 Sink: target[key] = value in mergeDeep() at src/merge.js:42 \u2192 Guard: no blocklist for __proto__, constructor, prototype"
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/example/demo-merge"
+    }
+  ],
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ]
+}

skills/omv-report/evals/golden/render-vuldb.md

@@ -0,0 +1,38 @@
+## VulDB Form Fields
+
+**Vendor**
+example-utils project
+
+**Product**
+demo-merge
+
+**Version**
+up to and including 2.4.1
+
+**Class**
+Prototype Pollution
+
+**Description**
+[DRAFT: Write continuous prose: affected component (src/merge.js mergeDeep()), root cause (no blocklist for __proto__, constructor, prototype), attacker action, impact (Medium 6.4), attack requirements (Auth:true UI:false), and suggested fix.]
+
+Source → Sink → Guard:
+- Source: JSON.parse(req.body) passed to mergeDeep()
+- Sink:   target[key] = value in mergeDeep() at src/merge.js:42
+- Guard:  no blocklist for __proto__, constructor, prototype
+
+Observed result: prints 'yes' confirming Object.prototype mutation
+
+Reproducer:
+  node -e "const {mergeDeep}=require('./'); mergeDeep({},JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}'));" \
+    && node -e "const {mergeDeep}=require('./'); mergeDeep({},JSON.parse('{\"__proto__\":{\"polluted\":\"yes\"}}')); console.log({}.polluted);"
+
+**Advisory / Exploit**
+https://github.com/example/demo-merge
+
+**CVE checkbox**
+[x] vendor contacted on 2026-04-20 (response: acknowledged)
+[x] no existing CVE found (NVD, GHSA, and ecosystem DB searched)
+[ ] no other CNA submission in progress — confirm before submitting
+
+---
+Rendered by omv render_template  |  evidence: 100/100  |  submission: 100/100  |  status: confirmed