Skip to content
Reference

Case Proposal Messages

A case proposal is a pre-case bootstrap message flow described in ADR-0023. It allows the report receiver — the actor that received the Offer(VulnerabilityReport), whether a Vendor, a Coordinator, or any other role — to request case initialization from a case-actor service before a case exists. The report receiver is the proposer, and if the case-actor service accepts the proposal, it becomes the case's Case Owner (CP-01-003, CP-09-001). No case URI is in scope; the proposal itself is the shared object.

The flow is: Create(CaseProposal) → service accepts or rejects (Accept(CaseProposal) / Reject(CaseProposal)). On acceptance the service proceeds to Create(VulnerabilityCase) separately (CP-05-003).

These messages have no formal-protocol shorthand (see ADR-0083).

Occasions

When… Send Send to Sent by Distinguished by Details
a report receiver asks a Case Actor Service to open a case for a report Create(CaseProposal) an actor outside any case the case proposal's author (usually: vendor, coordinator) — Create case proposal
a Case Actor Service agrees to open the proposed case Accept(CaseProposal) an actor outside any case the addressee of the case proposal — Accept case proposal
a Case Actor Service declines to open the proposed case Reject(CaseProposal) an actor outside any case the addressee of the case proposal — Reject case proposal

Create case proposal

Submits a case proposal for the attached report to the service's inbox. No case exists yet.

  • When… a report receiver asks a Case Actor Service to open a case for a report
  • Send: Create(CaseProposal)
  • Send to: an actor outside any case
  • Sent by: the case proposal's author (usually: vendor, coordinator)
  • Mapping status: none
{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Create",
  "id": "urn:uuid:3ea88279-b174-498a-9330-a25cbec1eadc",
  "name": "VendorCo Create urn:uuid:b618db43-753d-47d0-954a-187abb27b83c",
  "to": [
    "https://example.org/case-actors/alpha"
  ],
  "actor": {
    "id": "https://vultron.example/organizations/vendorco",
    "type": "Organization",
    "name": "VendorCo",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "inbox": "https://vultron.example/organizations/vendorco/inbox",
    "outbox": "https://vultron.example/organizations/vendorco/outbox",
    "embargoPolicy": {
      "id": "https://vultron.example/organizations/vendorco/embargo-policy",
      "type": "EmbargoPolicy",
      "published": "2026-06-01T19:12:00+00:00",
      "updated": "2026-06-01T19:12:00+00:00",
      "actorId": "https://vultron.example/organizations/vendorco",
      "inbox": "https://vultron.example/organizations/vendorco/inbox",
      "preferredDuration": "P45D",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  },
  "object": {
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld",
    "type": "CaseProposal",
    "id": "urn:uuid:b618db43-753d-47d0-954a-187abb27b83c",
    "published": "2026-10-23T20:17:37+00:00",
    "updated": "2026-10-23T20:17:37+00:00",
    "summary": "Request case initialization for a new vulnerability.",
    "attributedTo": "https://vultron.example/organizations/vendorco",
    "object": {
      "id": "https://demo.vultron.local/VulnerabilityReport/e28f4965-7838-4644-b4a8-10604c7ee92f",
      "type": "VulnerabilityReport",
      "name": "FDR-8675309",
      "published": "2026-10-23T20:17:06+00:00",
      "updated": "2026-10-23T20:17:06+00:00",
      "content": "I found a vulnerability!",
      "attributedTo": "https://vultron.example/users/finndervul",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "target": "https://example.org/case-actors/alpha",
    "proposerCaseRoles": [
      "vendor"
    ]
  }
}

When the report receiver still holds the Offer(VulnerabilityReport) that brought it the report, the proposal carries that Offer whole as inReplyTo, alongside the bare offerId and offerActorId provenance. That is how a Reporter's proposed embargo terms reach the case-actor (EP-04-004).

  • Triggering transition: none — initiates the proposal sub-protocol.
  • Actor: the Create goes to the service's inbox. Its actor is the proposing actor's full profile inline, not a URI, and its id is the proposal's attributedTo. The profile carries the proposer's embargoPolicy when it has published one, which is the Case Owner's actor default (EP-04-003); the case-actor reads the default from that profile alone, and refuses an actor that is a bare URI, a Link, an untyped or non-actor object, or a profile naming another actor, at the parse edge (CP-01-010).
  • Case roles: the proposal's proposerCaseRoles lists the Coordinated Vulnerability Disclosure (CVD) roles the proposer holds in a case it owns, taken from its own configuration (CP-01-011). The case-actor seats the proposer with those roles plus CASE_OWNER, and refuses a proposal that claims CASE_MANAGER (CP-01-012, ADR-0133).
  • Spec: CP-01-010, CP-01-011, CP-01-012, CP-03-001, CP-04-001.
  • Example artifact: create_case_proposal.json.

Accept case proposal

Accepts the case proposal and tells the proposing actor that a case will be opened for its report.

  • When… a Case Actor Service agrees to open the proposed case
  • Send: Accept(CaseProposal)
  • Send to: an actor outside any case
  • Sent by: the addressee of the case proposal
  • Mapping status: none
{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Accept",
  "id": "urn:uuid:f86e02a8-87aa-4df4-8ebc-ead076b533dd",
  "name": "https://example.org/case-actors/alpha Accept urn:uuid:89507033-3a7a-4b79-bf97-ce62c31606d4",
  "to": [
    "https://vultron.example/organizations/vendorco"
  ],
  "actor": "https://example.org/case-actors/alpha",
  "object": {
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld",
    "type": "CaseProposal",
    "id": "urn:uuid:89507033-3a7a-4b79-bf97-ce62c31606d4",
    "published": "2026-10-23T20:17:37+00:00",
    "updated": "2026-10-23T20:17:37+00:00",
    "summary": "Request case initialization for a new vulnerability.",
    "attributedTo": "https://vultron.example/organizations/vendorco",
    "object": {
      "id": "https://demo.vultron.local/VulnerabilityReport/e28f4965-7838-4644-b4a8-10604c7ee92f",
      "type": "VulnerabilityReport",
      "name": "FDR-8675309",
      "published": "2026-10-23T20:17:06+00:00",
      "updated": "2026-10-23T20:17:06+00:00",
      "content": "I found a vulnerability!",
      "attributedTo": "https://vultron.example/users/finndervul",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "target": "https://example.org/case-actors/alpha",
    "proposerCaseRoles": [
      "vendor"
    ]
  }
}
  • Triggering transition: none — response to a proposal, not a state machine event.
  • What follows: Create(VulnerabilityCase) follows separately (CP-05-003). The service, as CASE_MANAGER, is that Create's actor. The case's attributedTo is the proposing actor, who becomes the Case Owner — not the service (CP-09-001).
  • Spec: CP-03-002, CP-05-003.
  • Example artifact: accept_case_proposal.json.

Reject case proposal

Rejects the case proposal. No case is opened.

  • When… a Case Actor Service declines to open the proposed case
  • Send: Reject(CaseProposal)
  • Send to: an actor outside any case
  • Sent by: the addressee of the case proposal
  • Mapping status: none
{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Reject",
  "id": "urn:uuid:636ea13c-bbc4-46c1-b6df-2f62d7f42d7a",
  "name": "https://example.org/case-actors/alpha Reject urn:uuid:9d7ac46b-3b76-46d6-afff-4c0a19e378c0",
  "to": [
    "https://vultron.example/organizations/vendorco"
  ],
  "actor": "https://example.org/case-actors/alpha",
  "object": {
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld",
    "type": "CaseProposal",
    "id": "urn:uuid:9d7ac46b-3b76-46d6-afff-4c0a19e378c0",
    "published": "2026-10-23T20:17:37+00:00",
    "updated": "2026-10-23T20:17:37+00:00",
    "summary": "Request case initialization for a new vulnerability.",
    "attributedTo": "https://vultron.example/organizations/vendorco",
    "object": {
      "id": "https://demo.vultron.local/VulnerabilityReport/e28f4965-7838-4644-b4a8-10604c7ee92f",
      "type": "VulnerabilityReport",
      "name": "FDR-8675309",
      "published": "2026-10-23T20:17:06+00:00",
      "updated": "2026-10-23T20:17:06+00:00",
      "content": "I found a vulnerability!",
      "attributedTo": "https://vultron.example/users/finndervul",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "target": "https://example.org/case-actors/alpha",
    "proposerCaseRoles": [
      "vendor"
    ]
  }
}
  • Triggering transition: none — response to a proposal.
  • What follows: the proposing actor may revise and resubmit (CP-05-004).
  • Spec: CP-03-003, CP-05-004.
  • Example artifact: reject_case_proposal.json.