Skip to content
Reference

Case State (CS) Messages

The CS shorthands announce case-state events. Their wire vocabulary splits along a scope boundary that the "case state" name obscures:

  • V, F, D are participant-scoped — one per (actor × case). They ride as_ParticipantStatus (vfState and dState) on Add(ParticipantStatus)[target=CaseParticipant].
  • P, X, A are case-scoped — one per case, in the pxaState field of as_CaseStatus. A participant reports them in the case status its own Add(ParticipantStatus)[target=CaseParticipant] embeds. Only the Case Manager sends Add(CaseStatus)[target=VulnerabilityCase], to participants, as its record of the value it adopted, and a receiver refuses one from any other sender (RSH-04-001, RSH-04-005).

There are no case-level V/F/D states. A case-level status cannot express which vendor became aware or ready, which is the purpose of the V/F/D dimensions in multi-party CVD; those dimensions are always participant-specific (ADR-0075). vfState and dState are absent for participants that are neither Vendor nor Deployer.

The Add carries the new status object inline. The protocol names one form for each: Add(CaseStatus) brings a case status into the case, and Add(ParticipantStatus) brings a participant status into the case (ADR-0137). A received Create(CaseStatus) or Create(ParticipantStatus) is not a protocol message, and its receiver must not change the case file because of it (VAM-01-011). This implementation's inbox refuses either one as an unrecognized activity and changes nothing (VAM-01-010).

Occasions

When… Send Send to Sent by Distinguished by Details
the Case Manager records that the public knows of the vulnerability Add(CaseStatus)[target=VulnerabilityCase] a participant the case manager pxaState = Pxa Public awareness in a case status
the Case Manager records that an exploit for the vulnerability is public Add(CaseStatus)[target=VulnerabilityCase] a participant the case manager pxaState = PXa Exploit public in a case status
the Case Manager records that attackers are exploiting the vulnerability Add(CaseStatus)[target=VulnerabilityCase] a participant the case manager pxaState = pxA Attacks observed in a case status
a Vendor becomes aware of the vulnerability Add(ParticipantStatus)[target=CaseParticipant] the case manager the case manager or the case owner or the participant status's author (usually: vendor) vfState = Vf Vendor Awareness (CV)
a Vendor has a fix ready Add(ParticipantStatus)[target=CaseParticipant] the case manager the case manager or the case owner or the participant status's author (usually: vendor) vfState = VF Fix Readiness (CF)
a Deployer has deployed the fix Add(ParticipantStatus)[target=CaseParticipant] the case manager the case manager or the case owner or the participant status's author (usually: deployer) dState = D Fix Deployed (CD)
a Participant learns that the public knows of the vulnerability Add(ParticipantStatus)[target=CaseParticipant] the case manager the case manager or the case owner or the participant status's author caseStatus.pxaState = Pxa Public awareness in a participant status
a Participant learns that an exploit for the vulnerability is public Add(ParticipantStatus)[target=CaseParticipant] the case manager the case manager or the case owner or the participant status's author caseStatus.pxaState = PXa Exploit public in a participant status
a Participant observes attacks that exploit the vulnerability Add(ParticipantStatus)[target=CaseParticipant] the case manager the case manager or the case owner or the participant status's author caseStatus.pxaState = pxA Attacks observed in a participant status

Public awareness in a case status

Tells a participant that the case status now records that the public knows of the vulnerability.

  • When… the Case Manager records that the public knows of the vulnerability
  • Send: Add(CaseStatus)[target=VulnerabilityCase]
  • Send to: a participant
  • Sent by: the case manager
  • Distinguished by: pxaState = Pxa
  • Formal definition: Public Awareness (CP)
  • Mapping status: collapse

Only the Case Manager sends a case status, as its record of the pxaState it adopted, and a receiver refuses one from any other sender. A participant reports public awareness, a public exploit or observed attacks in its own participant status instead.

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:97dcc887-5c05-4c38-aa46-0f94d0be1c31",
  "name": "https://vultron.example/case-actors/vendorco-case-actor Add NONE Pxa to urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
  "to": [
    "https://vultron.example/users/finndervul"
  ],
  "actor": "https://vultron.example/case-actors/vendorco-case-actor",
  "target": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
  "object": {
    "id": "https://vultron.example/cases/1/status/2",
    "type": "CaseStatus",
    "name": "NONE Pxa",
    "context": "https://vultron.example/cases/1",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "emState": "NONE",
    "pxaState": "Pxa",
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: p → P (case-scoped).

Exploit public in a case status

Tells a participant that the case status now records that an exploit is publicly available.

  • When… the Case Manager records that an exploit for the vulnerability is public
  • Send: Add(CaseStatus)[target=VulnerabilityCase]
  • Send to: a participant
  • Sent by: the case manager
  • Distinguished by: pxaState = PXa
  • Formal definition: Exploit Public (CX)
  • Mapping status: collapse

Only the Case Manager sends a case status, as its record of the pxaState it adopted, and a receiver refuses one from any other sender. A participant reports public awareness, a public exploit or observed attacks in its own participant status instead.

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:c2cd72e4-9954-4160-992f-ae2a2d63843d",
  "name": "https://vultron.example/case-actors/vendorco-case-actor Add NONE PXa to urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
  "to": [
    "https://vultron.example/users/finndervul"
  ],
  "actor": "https://vultron.example/case-actors/vendorco-case-actor",
  "target": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
  "object": {
    "id": "https://vultron.example/cases/1/status/3",
    "type": "CaseStatus",
    "name": "NONE PXa",
    "context": "https://vultron.example/cases/1",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "emState": "NONE",
    "pxaState": "PXa",
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: x → X (case-scoped).

Attacks observed in a case status

Tells a participant that the case status now records that attackers are exploiting the vulnerability.

  • When… the Case Manager records that attackers are exploiting the vulnerability
  • Send: Add(CaseStatus)[target=VulnerabilityCase]
  • Send to: a participant
  • Sent by: the case manager
  • Distinguished by: pxaState = pxA
  • Formal definition: Attacks Observed (CA)
  • Mapping status: collapse

Only the Case Manager sends a case status, as its record of the pxaState it adopted, and a receiver refuses one from any other sender. A participant reports public awareness, a public exploit or observed attacks in its own participant status instead.

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:a302a4fd-01e7-455a-a68e-d850464765ab",
  "name": "https://vultron.example/case-actors/vendorco-case-actor Add NONE pxA to urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
  "to": [
    "https://vultron.example/users/finndervul"
  ],
  "actor": "https://vultron.example/case-actors/vendorco-case-actor",
  "target": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
  "object": {
    "id": "https://vultron.example/cases/1/status/4",
    "type": "CaseStatus",
    "name": "NONE pxA",
    "context": "https://vultron.example/cases/1",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "emState": "NONE",
    "pxaState": "pxA",
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: a → A (case-scoped).

Vendor Awareness (CV)

Announces that the report has reached the Vendor whose participant record is the target.

  • When… a Vendor becomes aware of the vulnerability
  • Send: Add(ParticipantStatus)[target=CaseParticipant]
  • Send to: the case manager
  • Sent by: the case manager or the case owner or the participant status's author (usually: vendor)
  • Distinguished by: vfState = Vf
  • Seen in: How to Post a Status Update or a Case Note
  • Formal definition: Vendor Awareness (CV)
  • Mapping status: collapse
{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:67f2b7c4-f702-4187-9015-a7645760426c",
  "name": "https://vultron.example/organizations/vendor Add ACCEPTED Vf NONE pxa to https://vultron.example/cases/1/participants/vendor",
  "actor": "https://vultron.example/organizations/vendor",
  "target": "https://vultron.example/cases/1/participants/vendor",
  "object": {
    "id": "https://vultron.example/cases/1/participants/vendor/status/2",
    "type": "ParticipantStatus",
    "name": "ACCEPTED Vf NONE pxa",
    "context": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "attributedTo": "https://vultron.example/organizations/vendor",
    "rmState": "ACCEPTED",
    "vfState": "Vf",
    "caseEngagement": true,
    "cvdRole": [
      "VENDOR"
    ],
    "caseStatus": {
      "id": "https://vultron.example/cases/1/status/1",
      "type": "CaseStatus",
      "name": "NONE pxa",
      "context": "https://vultron.example/cases/1",
      "published": "2026-06-01T19:12:00+00:00",
      "updated": "2026-06-01T19:12:00+00:00",
      "emState": "NONE",
      "pxaState": "pxa",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: vfd → Vfd (participant-scoped).
  • Sender: a Participant with direct knowledge of the notification.

Fix Readiness (CF)

Announces that the Vendor whose participant record is the target has a fix ready.

  • When… a Vendor has a fix ready
  • Send: Add(ParticipantStatus)[target=CaseParticipant]
  • Send to: the case manager
  • Sent by: the case manager or the case owner or the participant status's author (usually: vendor)
  • Distinguished by: vfState = VF
  • Seen in: How to Post a Status Update or a Case Note
  • Formal definition: Fix Readiness (CF)
  • Mapping status: collapse
{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:990657d9-2fd2-44b0-9f6c-4325cb4d8780",
  "name": "https://vultron.example/organizations/vendor Add ACCEPTED VF NONE pxa to https://vultron.example/cases/1/participants/vendor",
  "actor": "https://vultron.example/organizations/vendor",
  "target": "https://vultron.example/cases/1/participants/vendor",
  "object": {
    "id": "https://vultron.example/cases/1/participants/vendor/status/3",
    "type": "ParticipantStatus",
    "name": "ACCEPTED VF NONE pxa",
    "context": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "attributedTo": "https://vultron.example/organizations/vendor",
    "rmState": "ACCEPTED",
    "vfState": "VF",
    "caseEngagement": true,
    "cvdRole": [
      "VENDOR"
    ],
    "caseStatus": {
      "id": "https://vultron.example/cases/1/status/1",
      "type": "CaseStatus",
      "name": "NONE pxa",
      "context": "https://vultron.example/cases/1",
      "published": "2026-06-01T19:12:00+00:00",
      "updated": "2026-06-01T19:12:00+00:00",
      "emState": "NONE",
      "pxaState": "pxa",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: Vfd → VFd (participant-scoped).

Fix Deployed (CD)

Announces that the Deployer whose participant record is the target has deployed the fix.

  • When… a Deployer has deployed the fix
  • Send: Add(ParticipantStatus)[target=CaseParticipant]
  • Send to: the case manager
  • Sent by: the case manager or the case owner or the participant status's author (usually: deployer)
  • Distinguished by: dState = D
  • Seen in: How to Post a Status Update or a Case Note
  • Formal definition: Fix Deployed (CD)
  • Mapping status: collapse
{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:f1dcd2b9-8855-42b7-a142-80744595a1a9",
  "name": "https://vultron.example/organizations/deployer Add ACCEPTED D NONE pxa to https://vultron.example/cases/1/participants/deployer",
  "actor": "https://vultron.example/organizations/deployer",
  "target": "https://vultron.example/cases/1/participants/deployer",
  "object": {
    "id": "https://vultron.example/cases/1/participants/deployer/status/4",
    "type": "ParticipantStatus",
    "name": "ACCEPTED D NONE pxa",
    "context": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "attributedTo": "https://vultron.example/organizations/deployer",
    "rmState": "ACCEPTED",
    "dState": "D",
    "caseEngagement": true,
    "cvdRole": [
      "DEPLOYER"
    ],
    "caseStatus": {
      "id": "https://vultron.example/cases/1/status/1",
      "type": "CaseStatus",
      "name": "NONE pxa",
      "context": "https://vultron.example/cases/1",
      "published": "2026-06-01T19:12:00+00:00",
      "updated": "2026-06-01T19:12:00+00:00",
      "emState": "NONE",
      "pxaState": "pxa",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: VFd → VFD (participant-scoped, deployer path).

Public awareness in a participant status

Announces, in the sender's own participant status, evidence that the vulnerability is known to the public.

  • When… a Participant learns that the public knows of the vulnerability
  • Send: Add(ParticipantStatus)[target=CaseParticipant]
  • Send to: the case manager
  • Sent by: the case manager or the case owner or the participant status's author
  • Distinguished by: caseStatus.pxaState = Pxa
  • Seen in: How to Post a Status Update or a Case Note
  • Formal definition: Public Awareness (CP)
  • Mapping status: collapse

A participant status is a snapshot of every dimension the sender holds, so it can also carry an unchanged vfState or dState; the dimension that changed makes the occasion. The report is the sender's view of the case status, not a change to it. The Case Manager records the status on the sender's participant record and chooses whether to adopt the reported pxaState for the case, by default only with the Case Owner's authorization. Only an adopted value changes the case status, and while an embargo is active or proposed, it ends or abandons the embargo.

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:aa89bce1-9fdd-4111-936b-4343532101b1",
  "name": "https://vultron.example/organizations/finder Add ACCEPTED NONE Pxa to https://vultron.example/cases/1/participants/finder",
  "actor": "https://vultron.example/organizations/finder",
  "target": "https://vultron.example/cases/1/participants/finder",
  "object": {
    "id": "https://vultron.example/cases/1/participants/finder/status/5",
    "type": "ParticipantStatus",
    "name": "ACCEPTED NONE Pxa",
    "context": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "attributedTo": "https://vultron.example/organizations/finder",
    "rmState": "ACCEPTED",
    "caseEngagement": true,
    "cvdRole": [
      "REPORTER"
    ],
    "caseStatus": {
      "id": "https://vultron.example/cases/1/status/5",
      "type": "CaseStatus",
      "name": "NONE Pxa",
      "context": "https://vultron.example/cases/1",
      "published": "2026-06-01T19:12:00+00:00",
      "updated": "2026-06-01T19:12:00+00:00",
      "emState": "NONE",
      "pxaState": "Pxa",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: p → P (case-scoped, reported in the sender's participant status).

Exploit public in a participant status

Announces, in the sender's own participant status, evidence that an exploit is publicly available.

  • When… a Participant learns that an exploit for the vulnerability is public
  • Send: Add(ParticipantStatus)[target=CaseParticipant]
  • Send to: the case manager
  • Sent by: the case manager or the case owner or the participant status's author
  • Distinguished by: caseStatus.pxaState = PXa
  • Seen in: How to Post a Status Update or a Case Note
  • Formal definition: Exploit Public (CX)
  • Mapping status: collapse

A participant status is a snapshot of every dimension the sender holds, so it can also carry an unchanged vfState or dState; the dimension that changed makes the occasion. The report is the sender's view of the case status, not a change to it. The Case Manager records the status on the sender's participant record and chooses whether to adopt the reported pxaState for the case, by default only with the Case Owner's authorization. Only an adopted value changes the case status, and while an embargo is active or proposed, it ends or abandons the embargo.

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:f21fafbb-20e7-4b07-98c7-9f5844716672",
  "name": "https://vultron.example/organizations/finder Add ACCEPTED NONE PXa to https://vultron.example/cases/1/participants/finder",
  "actor": "https://vultron.example/organizations/finder",
  "target": "https://vultron.example/cases/1/participants/finder",
  "object": {
    "id": "https://vultron.example/cases/1/participants/finder/status/6",
    "type": "ParticipantStatus",
    "name": "ACCEPTED NONE PXa",
    "context": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "attributedTo": "https://vultron.example/organizations/finder",
    "rmState": "ACCEPTED",
    "caseEngagement": true,
    "cvdRole": [
      "REPORTER"
    ],
    "caseStatus": {
      "id": "https://vultron.example/cases/1/status/6",
      "type": "CaseStatus",
      "name": "NONE PXa",
      "context": "https://vultron.example/cases/1",
      "published": "2026-06-01T19:12:00+00:00",
      "updated": "2026-06-01T19:12:00+00:00",
      "emState": "NONE",
      "pxaState": "PXa",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: x → X (case-scoped, reported in the sender's participant status).

Attacks observed in a participant status

Announces, in the sender's own participant status, evidence that attackers are exploiting the vulnerability.

  • When… a Participant observes attacks that exploit the vulnerability
  • Send: Add(ParticipantStatus)[target=CaseParticipant]
  • Send to: the case manager
  • Sent by: the case manager or the case owner or the participant status's author
  • Distinguished by: caseStatus.pxaState = pxA
  • Seen in: How to Post a Status Update or a Case Note
  • Formal definition: Attacks Observed (CA)
  • Mapping status: collapse

A participant status is a snapshot of every dimension the sender holds, so it can also carry an unchanged vfState or dState; the dimension that changed makes the occasion. The report is the sender's view of the case status, not a change to it. The Case Manager records the status on the sender's participant record and chooses whether to adopt the reported pxaState for the case, by default only with the Case Owner's authorization. Only an adopted value changes the case status, and while an embargo is active or proposed, it ends or abandons the embargo.

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "type": "Add",
  "id": "urn:uuid:ba39b9bb-b4fa-4bb6-90cf-329c1977a134",
  "name": "https://vultron.example/organizations/finder Add ACCEPTED NONE pxA to https://vultron.example/cases/1/participants/finder",
  "actor": "https://vultron.example/organizations/finder",
  "target": "https://vultron.example/cases/1/participants/finder",
  "object": {
    "id": "https://vultron.example/cases/1/participants/finder/status/7",
    "type": "ParticipantStatus",
    "name": "ACCEPTED NONE pxA",
    "context": "urn:uuid:d483d06d-400e-47fd-9b8a-9a2643e3a4b0",
    "published": "2026-06-01T19:12:00+00:00",
    "updated": "2026-06-01T19:12:00+00:00",
    "attributedTo": "https://vultron.example/organizations/finder",
    "rmState": "ACCEPTED",
    "caseEngagement": true,
    "cvdRole": [
      "REPORTER"
    ],
    "caseStatus": {
      "id": "https://vultron.example/cases/1/status/7",
      "type": "CaseStatus",
      "name": "NONE pxA",
      "context": "https://vultron.example/cases/1",
      "published": "2026-06-01T19:12:00+00:00",
      "updated": "2026-06-01T19:12:00+00:00",
      "emState": "NONE",
      "pxaState": "pxA",
      "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
    },
    "@context": "https://certcc.github.io/Vultron/ns/context.jsonld"
  }
}
  • Triggering transition: a → A (case-scoped, reported in the sender's participant status).

Formal messages with no dedicated wire activity

CK — CS Acknowledgment

  • Protocol role: Acknowledges receipt of a CS message.
  • Triggering transition: any valid CS message.
  • Wire activity: none dedicated. Case-status changes are ledger-replicated, so acknowledgment is cumulative and implicit through hash-chain continuity (ADR-0083).
  • Formal definition: Message Types.

CE — CS Error

  • Protocol role: Indicates a Participant received an unexpected CS message.
  • Triggering transition: any unexpected CS message.
  • Wire activity: none dedicated. Faults are conveyed by Create(ProcessingFault), as:Reject, or Add(Note), partitioned by failure mode (ADR-0083).
  • Formal definition: Message Types.