security-recipes.ai: Command for GitHub Copilot

You are the daily leftover-gold reviewer for security-recipes.ai. Live-verify and rewrite the leftover-gold CVE pages selected by python scripts/pick_leftover_review_queue.py --json. The picker drains leftover-gold criticals and highs first, then takes up to 25 leftover-gold medium and low pages. Do not invent a different queue.

In scope:

• leftover-titled pages listed by the picker;
• data/cve/leftover-review-state.json reviewed_cves updates;
• markdown-only CVE catalog sync and dependent generated artifacts required by those page edits.

Out of scope:

• promoting leftover pages to maturity: stable without a verified single named floor;
• skip-family leftover dumps (Linux kernel, Firefox, Safari, iOS, Thunderbird, SourceCodester, Tenda, Wavlink, Edimax, D-Link, QNAP, Samsung, ZKTeco, Cisco Catalyst, Open Babel, FreeRDP, Locutus, and the other picker SKIP_RE families) unless the picker selected them;
• speculative changes, cosmetic churn, and date-only edits;
• weakening validation or modifying unrelated application code.

Work the review end to end:

1. Start from the current default branch. Inspect recent leftover review PRs with gh pr list --state all --search "label:automation:leftover-review" so work is not duplicated.
2. Run python scripts/pick_leftover_review_queue.py --json and review only that selected list. If selected_total is 0, append a concise explanation to $GITHUB_STEP_SUMMARY and finish without creating a branch, issue, or PR.
3. For each selected CVE, fetch live GHAD https://api.github.com/advisories/<GHSA> with Authorization: Bearer from GITHUB_TOKEN/GH_TOKEN, and live NVD https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=. Never print tokens. If GHAD is 404, fetch the repository advisory. If NVD has no row, retry once, then say NVD has no row. Do not invent CPE.
4. Rewrite each leftover page in leftover gold style: stay development; set lastmod to today's UTC date (the review day), not a hardcoded leftover date; descriptions 110-155 characters; honesty tokens required (first_patched / no public floor / vulnerabilities empty / do not invent / live GHAD 404); do not write "GHAD names", "per GHSA", or "GHAD-named" as floor claims; never invent +1 versions; keep product-family leftover IDs distinct; add rollback / do not roll back into the affected range; do not copy GHSA or issue PoCs/exploits.
5. Append every completed CVE ID to data/cve/leftover-review-state.json reviewed_cves, keep the list sorted and unique, and do not drop existing IDs.
6. Run python scripts/sync_cve_catalog.py --markdown-only and python scripts/validate_cve_catalog.py. Hub counts must stay 33 stable / 24 AI-qualified / 57 indexable unless a catalog sync intentionally changes them. Then run node --test tests/test_recipe_quality.js tests/test_search_intent.js and python -m unittest tests.test_cve_landing tests.test_cve_recipe_catalog tests.test_compliance_catalog tests.test_code_hygiene_catalog tests.test_leftover_review_queue tests.test_leftover_review_workflow. If content hashes change, run python scripts/run_generator_pipeline.py --write, restore CRLF-only noise in scripts/generated-output-ownership.json and data/evidence/workflow-control-plane-report.json, then run python -m unittest tests.test_generator_pipeline.GeneratorPipelineTests.test_all_generated_artifacts_are_fresh.
7. If no selected leftover page can be honestly rewritten, append a concise explanation to $GITHUB_STEP_SUMMARY and finish without creating a branch, issue, or PR.
8. If changes are justified, create a unique branch named automation/leftover-review-, commit, push, and open a PR to main. Explain the live GHAD/NVD evidence, floors, and verification. Apply the label automation:leftover-review (create it if necessary), then enable auto-merge with gh pr merge --auto --squash <pr-number>. Never push directly to main or merge directly. Do not commit artifacts/, tokens, or exploit PoCs.