The byte ceiling Pilot fetches under, 64 MiB, applied to the served stream and again to its expansion. The feed is one short row per scored CVE, so the headroom is several times over.

The longest feed line Pilot holds, 4 KiB. A scored row is under 100 bytes, so a longer line is no row, and bytes that never reach a newline cannot pile up.

One fetch of the feed: the scores it carries, and what it says about itself. The feed declares its own score date, so a stalled feed is visible without a second source of truth.

Fetch the feed and decode it into a score table, bounded by cap bytes on each side of decompression. A non-2xx, undecodable, over-large, or scoreless feed throws.

The feed passed a byte ceiling, so the fetch refused it whole. Each carries that ceiling and the bytes seen when it tripped, which is the ceiling plus at most one chunk.

The feed decoded to no scores at all: an error page served as 200, or a column order the row decode no longer reads. Whole-feed failure remains distinct from an individual missing score.

A gzip member ended before its end-of-stream marker, so the rows it carried may be a fraction.

Why one attempt at the feed produced no scores.

The failure as an operator reads it. It never names the feed URL, which can carry a credential.

The feed failures a compile can continue past. An invalid URL is a configuration fault, and anything unnamed here may be a bug, so both stay exceptions rather than read as an outage.

Fetch the feed under the advisory retry policy. A failure classifyEpssFailure names returns as a value, and every other exception, a cancellation included, propagates.

What one compile joins onto its advisories.

Settle one attempt under the ecosystem's requirement. A failure stays Left where the ecosystem requires enrichment, so an unavailable feed never stands in for a required one.

The feed an enrichment joined, if one arrived.

The status the artifact records for this enrichment.

The scores from one fetch of the feed. Keys are upper-cased CVE ids, so a case difference between the feed and an advisory's aliases cannot silently miss the join.

Build a score table from (CVE id, probability) rows. A duplicate id keeps the higher score, the fail-closed direction for a rule that denies above a threshold.

The highest score the feed carries for any of these identifiers, or Nothing when it scores none of them.

How many CVEs the table scores.

One feed row as (CVE id, probability). A comment, the header, an unreadable row, and a score outside [0, 1] all yield Nothing, so one bad row drops out instead of failing the pass.

What the feed's leading comment line declares. FIRST.org writes it as #model_version:v2026.08.01,score_date:2026-08-29T00:00:00+0000.

Read the feed's leading comment line. A line that is not a comment, a comment naming neither field, and a date the grammar cannot read all yield absence, never a substitute value.