[chaksaray]

Closes #444.

Adds security_boundary, missing_control and vulnerability_rationale to the seven JUSTIFY records (AVE-2026-00004, 00005, 00033, 00040, 00047, 00073, 00075), additively, in the shape AVE-2026-00087 uses and before mitigation. Following the maintainer's decision of 2026-11-04, the agentic distinction is written into vulnerability_rationale.vulnerability; an optional agentic_distinction field is for schema 2.0.0. No fingerprint, score, mapping, status or reference is touched.

Per record

Record	Audit	Taken from	The distinction in vulnerability
00004	E JUSTIFY, HIGH	full section, lines 679 to 717	the shared channel rationale: mechanism conventional, the channel is natural language that SAST scanners do not read
00005	E JUSTIFY, HIGH	full section, lines 718 to 752	the same channel as 00004, plus why it stays a separate class: irrecoverable loss with no code-execution requirement
00033	E JUSTIFY, HIGH	full section, lines 753 to 783	the shared channel rationale, as for 00004 and 00005
00040	E JUSTIFY	compact entry, lines 1659 to 1669	its own argument: the trust elevation backend systems grant an agent compared with raw user input
00047	E JUSTIFY, HIGH	full section, lines 784 to 823	its own argument: the credential sits in the context window an LLM reads, where a prompt injection payload can induce it to be exfiltrated
00073	E JUSTIFY, HIGH	full section, lines 1078 to 1117	its own argument: endpoints that exist only because the component is agentic, with the cited CVE-2026-21852 case
00075	E JUSTIFY, HIGH	full section, lines 1118 to 1166	its own sourced argument: a technique for evading agent-skill scanners specifically (CSA AI Safety Initiative and Trail of Bits research cited in the record)

• security_boundary, missing_control, capability and the first part of vulnerability are the audit's text for the record, with the first word of the two phrases lower-cased and their closing full stop dropped, as in the template. The distinction sentences are the audit's and the decision memo's, restated for the record.
• 00005 and 00033: the audit's missing-control text is "Same as 00004" and "Same NL-vs-code detection gap as 00004/00005". Restated so that each record stands alone: for 00005 the same words as 00004's, for 00033 "no detection of unsafe deserialization or eval when it is instructed in natural language and not written as code".
• The audit's full sections have no impact line, so for six records the impact is written from the record's own description, close to its words. 00040's comes from the audit's Q7 block.
• 00075's boundary drops the audit's comparison with 00062; 00073's vulnerability states the CVE case the record itself cites.

Checked

• python scripts/check_vulnerability_taxonomy.py: 16 of 89 records missing the fields before, 9 after; --strict --only passes for each of the seven.
• python -m pytest tests -q and validate_records.py pass; check_revisions_ratchet.py --ratchet-since origin/develop passes (no severity, status or derived basis changed, so no revisions entry is needed).
• Each record differs from origin/develop only in security_boundary, missing_control, vulnerability_rationale and last_updated, proved by parsing both versions; each diff is 8 added lines and the last_updated line (set to 2026-11-04, as CONTRIBUTING's "Improving existing records" says). Records were edited by exact text insertion, not json.dumps.
• dist/ and schema/ are untouched: the workflow that regenerates dist/ opens that pull request after a merge. No em dashes added.

Not done, and not checked

• Primary sources for 00004, 00005, 00033 and 00040 (their references are only taxonomy pages and the record's own file): the queue's find_primary_source, a separate task.
• docs/decisions/quality-queue.json still lists these seven records' add_taxonomy_fields and write_rationale actions; it is refreshed separately once the batches are in.
• The wording is the audit's and the memo's, restated. It is worth a read by someone who knows the record, in particular the distinction sentences, which are judgments.