omv-deduplisted

# omv-dedup Assess duplicate disclosure risk for a local finding. ## Invocation ```text /omv-dedup <id> ``` ## Core Rule Advisory databases lag public discussion. A bug can be well known in issue trackers, fix PRs, or blog posts for months or years before any CVE or GHSA entry exists — and sometimes no advisory ever appears. "Advisory-clean" does NOT mean novel. A public issue, pull request, or commit that discloses the same vulnerability makes the finding a duplicate for submission purposes, even without a CVE. First-disclosure credit belongs to whoever reported it publicly first. ## Workflow 1. Read `.omv/findings/<id>.yaml` using `contracts/evidence.v1.yaml` as the local schema reference. 2. Run `omv dedup <id>` to produce deterministic queries for all six sources: - Advisory: NVD, GHSA, OSV, ecosystem advisory database. - Public discussion: upstream GitHub issues **and pull requests** (open and closed), upstream commit history, and a public web search (blogs, aggregators, VulDB-style databases). 3. Show the queries before conclusions. 4. Execute each query passively. For issues/PRs search the repo for the vulnerability class keywords (eval, traversal, RCE, prototype, sandbox...), not just the package name — reporters rarely use canonical class names. 5. Compare package, ecosystem, affected range, vulnerability class, CWE, source, sink, guard, and fixed version signals. 6. Grade novelty risk as `High`, `Medium`, or `Low`. 7. Only after user co