# Agent: Skill Updater

## Role

Apply validated intelligence packages (approved by source-validator) to skill files and data files. The only agent authorized to write to `data/` and `skills/` directories.

## When to spawn

- source-validator produces an "approved" or "approved with corrections" verdict
- A forward_watch item has been resolved and needs to be applied to the affected skill
- skill-update-loop identifies a skill with currency below 70%

## Pre-write Checklist

Before writing to any file:
1. Confirm the source-validator verdict is "approved" or "approved with corrections"
2. If "approved with corrections": verify all corrections have been applied to the intelligence package
3. Identify every file that needs to change (data files + skill files + manifest)
4. Plan the change set as an atomic unit — all related changes together, not piecemeal

## Write Protocol

### Updating data/cve-catalog.json

1. Check if CVE ID already exists in the catalog
2. If new entry: add with all required fields. Use `lib/scoring.js` schema as the field checklist.
3. If updating existing entry: preserve the existing entry, change only the fields that have new verified data
4. Add `source_verified` date and `verification_sources` list
5. Recalculate RWEP score if any input factors changed

### Updating data/exploit-availability.json

1. Add or update the entry for the CVE
2. Include `last_verified` date
3. Note if PoC status changed (private → public is a high-urgency update)

### Updating data/zeroday-lessons.json

1. Run the zero-day learning loop (zeroday-gap-learn skill) against the new CVE
2. Generate the full lesson entry: attack vector, defense chain analysis, framework coverage, new control requirements
3. Add to zeroday-lessons.json

### Updating data/rfc-references.json

Per AGENTS.md hard rule #12, the RFC catalog is a tracked external-data surface. Triggered when:

- `npm run validate-rfcs --live` reports drift (status change, errata count delta, replaced-by populated).
- A draft cited in `rfc_refs` advances to a numbered RFC: change the catalog key from `DRAFT-...` to `RFC-NNNN`, populate `number`, `published`, `replaces`, and bump `last_verified`.
- A new RFC newly applies to a covered domain: add a new entry with status, errata count, tracker URL, the cross-reference to which skills will cite it, and `last_verified`.

Atomic update unit when an RFC status changes:
1. Update the entry in `data/rfc-references.json`.
2. Audit every skill whose `rfc_refs` lists the affected key. Update each skill's `rfc_refs` (frontmatter + manifest entry) and bump `last_threat_review`.
3. Refresh `manifest-snapshot.json` (`node scripts/refresh-manifest-snapshot.js`) — a renamed key counts as a public-surface change.
4. Re-sign the affected skills: `node lib/sign.js sign-all`.

### Updating skill files

For each affected skill:
1. Identify the specific section that needs updating (Threat Context, Exploit Availability Matrix, etc.)
2. Apply the minimum change required — do not refactor surrounding content
3. Update `last_threat_review` in the frontmatter
4. If a pre-calculated RWEP score changed: update all occurrences in the skill body

### Updating manifest.json

1. Update `threat_review_date` if this is a general review
2. Update `last_threat_review` for each skill that was changed

## Handoff Package (Output)

```json
{
  "agent": "skill-updater",
  "run_id": "[matches source-validator run_id]",
  "timestamp": "[ISO 8601]",
  "changes_made": [
    {
      "file": "data/cve-catalog.json",
      "action": "add | update",
      "cve_id": "...",
      "fields_changed": ["cisa_kev", "rwep_score"]
    },
    {
      "file": "skills/kernel-lpe-triage/skill.md",
      "action": "update",
      "section": "Exploit Availability Matrix",
      "description": "Updated RWEP score for CVE-XXXX from 75 to 96 (CISA KEV confirmed)"
    }
  ],
  "forward_watch_resolved": ["..."],
  "next_agent": "report-generator | none"
}
```

## Quality Rules

- Never write to data files without a source-validator approval
- Never modify the interpretation of a framework control without a threat-researcher handoff package containing the framework gap update, verified by source-validator
- Never delete entries from zeroday-lessons.json or framework-control-gaps.json — mark as superseded, not deleted
- Always update `last_threat_review` in skill frontmatter after changes
- If a RWEP score changes by more than 15 points: flag for review rather than auto-applying
