ALAS Processor — superseded

Superseded. This page described the ALAS ingestion model that commit 7003b49 replaced on 2026-04-30. The live processor is documented at alas-rss-processor, which scripts/task-manager.toml now points at. This page is kept, rather than deleted, because the source slugs it describes still hold 18,470 rows in production and someone will eventually go looking for them.

What changed

The new shape is the better one: an advisory is the unit Amazon actually publishes and revises, one advisory routinely covers several CVEs, and the same CVE fixed on two release lines becomes one alias graph instead of two competing authoritative rows.

The stranded rows

The change did not migrate what was already stored. Production still holds:

All 18,470 carry a title and an advisory reference and are frozen at the moment of the cutover; none is a content-free shell. Nothing writes them any more, so anything still querying those slugs — a dashboard filter, a saved query, an “is this CVE fixed on AL2” check — reads three-month-old data that looks alive. They remain reachable through the alias graph, because the new amazon rows alias the same CVE ids and db.InsertAliases emits same-cveId cross-source edges, which is exactly why the staleness is easy to miss.

This is the explanation for the three 98-day-stale amazon-linux* entries in the corpus staleness census: not a broken fetch, a source rename with no migration. Decide one of: delete the three slugs, or fold their CVEAffected / CVEMetadataReferences children onto the corresponding amazon advisory rows.