Commit 20151fb9ea61

@@ -29,7 +29,12 @@ This returns JSON with:
 - `github_merged` — PRs authored and merged (keys: `repo`, `number`, `title`, `url`)
 - `github_reviewed` — PRs reviewed, excluding own PRs (keys: `repo`, `number`, `title`, `author`, `url`)
 - `github_issues_created` — Issues filed (keys: `repo`, `number`, `title`, `url`)
-- `github_security_advisories` — Security advisories where user is credited or author (keys: `ghsa_id`, `cve_id`, `summary`, `severity`, `state`, `repo`, `url`, `credits`, `role`). Filtered to only advisories where the user appears in `credits` or is the `author` — `collaborating_users` is skipped (indicates team access, not active involvement). Comments on advisories are not accessible via the API (private fork).
+- `github_security_advisories` — Security advisories **active in the period** (created, published, closed, or updated in window) across the configured VMT repos (keys: `ghsa_id`, `cve_id`, `summary`, `severity`, `state`, `repo`, `url`, `credits`, `role`). The `role` field is one of:
+  - `author` — the user opened the advisory
+  - `credited` — the user is in the `credits` list
+  - `triaged` — neither, but the repo is a VMT repo, so the advisory was reviewed as part of the security queue
+
+  daily-plan paginates (`--paginate --slurp`, `per_page=100`) so high-volume repos like `tektoncd/pipeline` are not truncated. The actual review activity (comments, state transitions) lives in private advisory forks and is **not** exposed by the REST API — `triaged` is a proxy based on VMT repo membership. The ground-truth signal for review/triage workload is the **tekton-vmt mailing list** (see 2g).
 
 daily-plan automatically splits queries by month and uses `--limit 1000` to avoid GitHub Search API truncation. Results are scoped to the configured owners (tektoncd, openshift-pipelines).
 
@@ -124,6 +129,26 @@ Or via MCP if available:
 mcp__slack__search_messages: from:vdemeest after:<START> before:<END>
 ```
 
+### 2g. tekton-vmt — Security Review & Triage (ground truth)
+
+The security advisory review/triage workload is **not** fully visible via the GitHub API (review activity lives in private advisory forks). The reliable signal is the `tekton-vmt` mailing list traffic. Count distinct security threads in the period:
+
+```bash
+# distinct threads (strip Re:/Fwd: and dedup)
+mu find 'tekton-vmt AND date:<START_YYYYMMDD>..<END_YYYYMMDD>' --fields 's' 2>/dev/null \
+  | sed 's/^Re: //; s/^Fwd: //' | sort -u | wc -l
+
+# full list with subjects for the report narrative
+mu find 'tekton-vmt AND date:<START_YYYYMMDD>..<END_YYYYMMDD>' --fields 's' 2>/dev/null \
+  | sed 's/^Re: //; s/^Fwd: //' | sort | uniq -c | sort -rn
+```
+
+Combine this with `github_security_advisories`:
+- **Credited/Authored** advisories (`role` in author/credited) — formal recognition, list individually with CVE links
+- **Triaged** advisories (`role` = triaged) + tekton-vmt thread count — the review queue volume; summarize as a count with notable examples
+
+This ensures the security section reflects the full VMT workload, not just credited CVEs.
+
 ## Step 3 — Analyze & Categorize
 
 Before generating HTML, analyze the raw data:
@@ -174,7 +199,7 @@ Every data section must open with a `<div class="section-summary">` containing 2
 3. GitHub — PRs Authored & Merged (grouped by repo, with group headers like "⚡ Tekton Core", "🏛 Community")
 4. GitHub — PRs Reviewed (grouped by repo)
 5. GitHub — Issues Filed (grouped by theme)
-6. GitHub — Security Advisories (credited/authored only)
+6. GitHub — Security Advisories — split into **Credited/Authored** (list with CVE links) and **Triaged (VMT review queue)** (count + notable examples), supplemented by the tekton-vmt thread count
 7. GitLab — MRs Reviewed (grouped by release track)
 8. Key Initiatives & Strategic Contributions (achievement grid)
 9. Meeting & Cross-Team Engagement (Google Calendar)

@@ -21,7 +21,7 @@ This skill produces a single self-contained HTML file with:
 - Jira epics/features closed
 - GitHub PRs authored & reviewed (grouped by repo)
 - GitHub issues filed (grouped by theme)
-- GitHub security advisories (filtered to credited/authored only)
+- GitHub security advisories (credited/authored + triaged VMT review queue)
 - GitLab MRs reviewed (grouped by release track)
 - Key initiatives & strategic contributions
 - Meeting & cross-team engagement (Google Calendar)
@@ -33,7 +33,7 @@ This skill produces a single self-contained HTML file with:
 
 | Source | Tool | What |
 |--------|------|------|
-| **GitHub + Jira + Org + AI + Security Advisories** | `daily-plan review <range> --json` | Primary data: PRs (monthly pagination, no truncation), reviews, issues, Jira (resolutiondate JQL), org-mode done items, AI sessions, security advisories (filtered to credits+author involvement) |
+| **GitHub + Jira + Org + AI + Security Advisories** | `daily-plan review <range> --json` | Primary data: PRs (monthly pagination, no truncation), reviews, issues, Jira (resolutiondate JQL), org-mode done items, AI sessions, security advisories (active in window, tagged author/credited/triaged) |
 | **GitLab** (gitlab.cee.redhat.com) | REST API via `curl` | MRs authored and reviewed (internal Red Hat instance) |
 | **Google Calendar** | GoogleWorkspace skill scripts (`workspace.js calendar`) | Recurring meetings, cross-team engagement |
 | **Gmail / mu** | `mu find` (Maildir) + GoogleWorkspace skill scripts | Meeting notes (Gemini), key email threads, outbound communications |