arn-code-batch-cve-fix

Arness Batch CVE Fix

Apply per-group fixes for previously-triaged CVEs, open per-group pull requests targeting the configured Security branch:, and optionally archive fully-resolved past CVE proposals. This skill consumes the triage records, sub-issue numbers, and parent-issue handle produced by arn-code-batch-cve-scan and dispatches one worker per group inside a pre-created git worktree.

Key architectural constraint: This skill is a sequencer — it MUST NOT duplicate sub-reference logic. All procedural detail lives in references/. Worker isolation (worktree setup, isolation check, cleanup-on-failure) is INHERITED from arn-code-batch-implement/references/worker-instructions.md — this skill's own worker-instructions.md DELEGATES to that source-of-truth and documents only the per-group fix scope.

Interactive-only (per spec FR §30). There is no --mode= argument. There is no proposal artifact. There is no headless / scheduled fix path. Every PR is human-reviewed at creation time; every past-plan archive is confirmed via AskUserQuestion. The auto-apply boundary (see references/auto-apply-boundary.md) controls whether the worker drives the dependency bump itself (when all 5 conditions are met) or pauses for human application — the worker still always opens a PR for review.

Pipeline position:

arn-code-batch-cve-scan (triage records + parent + sub-issues)
                  │
                  ▼
        **arn-code-batch-cve-fix**
        ┌─────────┴────────────┐
        │ form groups          │
        │ apply auto-apply gate│
        │ dispatch workers     │
        │ open per-group PRs   │
        │ post-fix cleanup     │
        └──────────────────────┘
                  │
                  ▼
        Per-group PRs targeting <Security branch>
        (each PR contains `Closes #N` per sub-issue)
                  │
                  ▼ (after merge — polled or --cleanup-resolved)
        Past-plan cleanup (interactive archive of resolved CVE_<ts>/)