cra-kit: fix Art. 14/17 citations; defer compliance commitments

Review fixes for #603. Corrects the citations the previous commit got
wrong, and takes the public compliance commitments back out so they can
land as their own PR with sign-off.

Citations:
- ENISA is a co-addressee by statute, not a copy recipient. Art. 14(1)
  requires notification simultaneously to the coordinator CSIRT and to
  ENISA; Art. 14(7) directs the submission to the CSIRT end-point,
  "simultaneously accessible to ENISA". Drop the "not sent to ENISA
  directly" framing, which overcorrected.
- Art. 14(7) sets a four-step cascade where there is no EU main
  establishment (authorised representative, importer, distributor,
  Member State with the most users), not a single AR rule.
- EUVD publication is Art. 17(5), not Art. 16(2), and carries the "in
  agreement with the manufacturer" qualifier. The EUVD itself is
  established under NIS2 Art. 12(2). Corrected in the process doc, the
  glossary and the references list.
- Severe-incident deadlines are in Art. 14(4), with the one-month final
  report at 14(4)(c). Art. 14(3) is the duty to notify.
- Support period is Art. 13(8); Art. 13(2) is the risk-assessment duty.
- SRP user validation runs in parallel with reporting and is not a
  prerequisite for fulfilling the reporting obligation, so it cannot gate
  a filing. ENISA's "Assigned Representative" is a platform user role,
  not the Art. 18 authorised representative.
- Triage box content line was one column wider than its border.

Commitments deferred:
- Restore the vulnerability-handling status to the pending-approval
  state, in the document and in 00-INDEX.md.
- Restore the on-call section. The published CVD policy carries no 24h
  acknowledgement and no 72h triage target, so the packet cannot cite it
  as the public source for either.

Also corrects the remaining "24h ENISA" wording in the 00-INDEX.md
timeline, which the previous commit missed.

Signed-off-by: Sameeh Jubran <sameeh@wolfssl.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: sameehj

cra-kit/CRA-Supply-Chain-Glossary.md

@@ -82,11 +82,11 @@ that no SBOM tool can satisfy. **Not legal advice** — engage CRA counsel.
 | **Declaration of conformity** | Art. 28 | Manufacturer's signed statement of CRA compliance. Names the product, lists applicable EU acts, identifies the manufacturer (and EU AR if applicable). |
 | **Importer** | Art. 19 | EU entity placing a non-EU product on the EU market. Carries CRA obligations parallel to the manufacturer (verify CE mark, retain AR contact, assist regulators). |
 | **Distributor** | Art. 20 | Party in the supply chain making the product available on the EU market without altering it. Lighter obligations than importer/manufacturer, but must verify CE mark and assist regulators. |
-| **Support period** | Art. 13(2), 13(8) | Minimum duration during which the manufacturer must provide **free security updates**. Default: at least **5 years**, unless the product is expected to be in use for a shorter period (and longer where the expected lifetime is longer). Must be declared in the technical documentation. |
+| **Support period** | Art. 13(8) | Minimum duration during which the manufacturer must provide **free security updates**. Default: at least **5 years**, unless the product is expected to be in use for a shorter period (and longer where the expected lifetime is longer). Must be declared in the technical documentation. |
 | **ENISA** | Art. 14, 16 | EU Agency for Cybersecurity. Operates the **Single Reporting Platform (SRP)**; manufacturers file through it and reports reach the **coordinator CSIRT** with ENISA notified **simultaneously** — the **24-hour** early-warning when a vulnerability is **actively exploited**, plus 72-hour update and 14-day final report. |
 | **SRP** (Single Reporting Platform) | Art. 16 | ENISA-operated platform (live **11 Sep 2026**) where manufacturers file Art. 14 reports once; routes to the coordinator CSIRT + ENISA and on to affected Member States. |
-| **CSIRT** (designated as coordinator) | Art. 14(7) | National incident-response team that receives your Art. 14 report via the SRP and disseminates it. Determined by your EU main establishment — or, for non-EU manufacturers, your **Authorised Representative's** Member State. |
-| **EUVD** (European Vulnerability Database) | Art. 16(2) / NIS2 | ENISA's public database where **fixed** vulnerabilities reported via the SRP are published; makes disclosure timelines verifiable. |
+| **CSIRT** (designated as coordinator) | Art. 14(7) | National incident-response team that receives your Art. 14 report via the SRP and disseminates it. Determined by your EU main establishment — or, where there is none, by the ordered cascade in Art. 14(7): authorised representative, then importer, then distributor, then the Member State with the most users. |
+| **EUVD** (European Vulnerability Database) | Art. 17(5) / NIS2 Art. 12(2) | ENISA's public database where **fixed** vulnerabilities reported via the SRP are published; makes disclosure timelines verifiable. |
 | **CNA** | (CVE programme) | **CVE Numbering Authority** — organisation authorised to assign CVE IDs within its scope. wolfSSL is a CNA for wolfSSL libraries. |
 
 For execution detail on these obligations, see [`CRA-Compliance-Shortlist.md`](CRA-Compliance-Shortlist.md) "Beyond this kit (structural CRA obligations)".

cra-kit/wolfssl-inc-auditor-packet/00-INDEX.md

@@ -7,7 +7,7 @@
 | [`declaration-of-conformity.template.md`](declaration-of-conformity.template.md) | Art. 28 | 🟡 Template ready; signature pending product release alignment |
 | [`eu-authorised-representative.md`](eu-authorised-representative.md) | Art. 18 | 🟠 In progress — appointment underway |
 | [`support-period-policy.md`](support-period-policy.md) | Art. 13(2), 13(8) | ✅ Decided — 5-year minimum, longer for LTS lines |
-| [`vulnerability-handling-process.md`](vulnerability-handling-process.md) | Art. 13, 14, 16 | ✅ Process documented; wolfSSL Inc. commits to Art. 13/14 compliance |
+| [`vulnerability-handling-process.md`](vulnerability-handling-process.md) | Art. 13, 14, 16 | 🟡 Process documented; public SLA pending leadership approval |
 | [`technical-documentation-outline.md`](technical-documentation-outline.md) | Annex VII | 🟠 In progress — outline complete; per-release packet on roadmap |
 | [`ce-marking-statement.md`](ce-marking-statement.md) | Art. 30 | 🟡 Will affix on first CRA-applicable release after 11 Dec 2027 |
 
@@ -22,5 +22,5 @@
 
 ## CRA timeline anchors
 
-- **11 Sep 2026** — Art. 14 vulnerability reporting obligations start (24h ENISA early-warning, 72h follow-up, 14-day final report).
+- **11 Sep 2026** — Art. 14 vulnerability reporting obligations start; the SRP goes live (24h early-warning via the SRP to the coordinator CSIRT + ENISA, 72h follow-up, 14-day final report).
 - **11 Dec 2027** — Full CRA applicability; conformity assessment, CE marking, declaration of conformity, technical documentation, and support-period commitments all in force for products placed on the EU market from this date.

cra-kit/wolfssl-inc-auditor-packet/vulnerability-handling-process.md

@@ -1,6 +1,6 @@
 # Vulnerability handling process — wolfSSL Inc.
 
-**Status:** ✅ wolfSSL Inc. commits to complying with its CRA Art. 13/14 obligations
+**Status:** 🟡 Process documented; public SLA pending leadership approval
 **CRA reference:** Art. 13 (vulnerability handling), Art. 14 (active-exploitation reporting), Art. 16 (Single Reporting Platform)
 
 ## Discovery → report → triage → fix → disclosure
@@ -25,7 +25,7 @@
    ┌────────────────┐       ┌──────────────────┐
    │ Triage (72h):  │       │ Active exploit?  │
    │ severity, CVSS,│ ────▶ │ Yes ─▶ SRP 24h   │
-   │ scope, fix plan│       │ No  ─▶ standard   │
+   │ scope, fix plan│       │ No  ─▶ standard  │
    └────────┬───────┘       └──────────────────┘
             │
             ▼
@@ -45,24 +45,32 @@
 
 ## How an Art. 14 report is filed (SRP → CSIRT + ENISA → EUVD)
 
-Reports are **not** sent to ENISA directly. Under Art. 14/16 a manufacturer files
-through the **Single Reporting Platform (SRP)** operated by ENISA, using the
-electronic notification end-point of the **CSIRT designated as coordinator**; ENISA
-receives the notification **simultaneously**. The coordinator CSIRT then disseminates
-it to the CSIRTs of other affected Member States and to market-surveillance
-authorities.
+A manufacturer files **once**, through the **Single Reporting Platform (SRP)**
+operated by ENISA. Art. 14(1) requires notification **simultaneously to the CSIRT
+designated as coordinator and to ENISA**, and Art. 14(7) directs that submission to
+the coordinator CSIRT's electronic notification end-point, "simultaneously accessible
+to ENISA". The coordinator CSIRT then disseminates it to the CSIRTs of other affected
+Member States and to market-surveillance authorities.
 
 - **Which CSIRT?** Art. 14(7) ties the coordinator CSIRT to the manufacturer's EU
-  main establishment. wolfSSL Inc. is US-established with **no EU main establishment**,
-  so the coordinator is determined by the Member State of its **EU Authorised
-  Representative** (Art. 18) — see [`eu-authorised-representative.md`](eu-authorised-representative.md).
-  Resolving the AR therefore also fixes the reporting end-point.
+  main establishment. Where there is none, the same paragraph sets an ordered
+  cascade: (a) the Member State of the authorised representative acting for the
+  highest number of that manufacturer's products, then (b) the importer, (c) the
+  distributor, and (d) the Member State in which the highest number of users are
+  located. wolfSSL Inc. is US-established with **no EU main establishment**, so its
+  coordinator is fixed by that cascade.
 - **Platform availability.** The SRP goes live **11 Sep 2026**, the date Art. 14
-  reporting begins. Manufacturers (or their AR) register via an **EU Login** account;
-  the coordinator CSIRT validates the representative's authority to file.
-- **Where fixed vulnerabilities are published.** Once a report is filed and a fix is
-  available, ENISA publishes the entry to the **European Vulnerability Database
-  (EUVD)** (Art. 16(2)) — making the disclosure timeline publicly verifiable.
+  reporting begins. Filers register through an **EU Login** account. ENISA's guidance
+  states that the coordinator CSIRT's validation of a platform user's authority runs
+  *in parallel with* reporting and is **not a prerequisite for fulfilling the CRA
+  reporting obligation**, so validation status never blocks a submission. Note that
+  ENISA's "Assigned Representative" is a platform user role, **not** the Art. 18
+  authorised representative.
+- **Where fixed vulnerabilities are published.** Once a corrective or mitigating
+  measure is available, ENISA adds the notified vulnerability to the **European
+  Vulnerability Database (EUVD)**, established under NIS2 Art. 12(2), **in agreement
+  with the manufacturer** (Art. 17(5)) — making the disclosure timeline publicly
+  verifiable.
 
 ## Public-facing artefacts
 
@@ -84,28 +92,27 @@ authorities.
 | Final report (via SRP) | **14 days after a corrective or mitigating measure is available** (Art. 14(2)(c)) | Hard regulatory deadline. Clock runs from fix-availability, **not** from awareness or CVE publication. |
 | Coordinated public disclosure | Typically 90 days from triage; case-by-case | Negotiable with reporter. |
 
-wolfSSL Inc. commits to meeting these Art. 14 deadlines for wolfSSL libraries it
-places on the EU market. The acknowledgement and triage targets above are also
-reflected in the public CVD policy at `/.well-known/vulnerability-disclosure-policy.txt`.
+These targets are not yet publicly committed in the CVD policy. Once the
+leadership decision is taken, the CVD policy at `/.well-known/vulnerability-disclosure-policy.txt`
+will be updated to include them.
 
-**Severe incidents (Art. 14(3)).** The same 24h early-warning / 72h notification
-cadence also applies to **severe incidents** affecting the security of the product,
-with a **final report within one month** of the 72-hour notification (rather than the
-14-day-after-fix deadline that applies to vulnerabilities).
+**Severe incidents (Art. 14(3)–(4)).** Art. 14(3) extends the same 24h early-warning
+/ 72h notification cadence to **severe incidents** affecting the security of the
+product. Those deadlines sit in Art. 14(4): (a) 24 hours, (b) 72 hours, and (c) a
+**final report within one month** of the 72-hour notification, rather than the
+14-day-after-fix deadline that applies to vulnerabilities under Art. 14(2)(c).
 
 ## On-call coverage
 
-wolfSSL Inc. operates a **follow-the-sun support organisation** — a weekly support
-captain plus engineers across Japan, Europe, and the USA — providing continuous
-24/7/365 human coverage, including weekends and holidays. This existing coverage is
-the staffing basis for meeting the Art. 14 24-hour clock at any time.
+🟠 **In progress.** Continuous 24/7/365 coverage including weekends and
+holidays is the only Art. 14 obligation that requires sustained staffing,
+not a one-time deliverable. Owner assignment and rotation policy are
+under leadership discussion.
 
-The remaining work is **process, not staffing**: formalising the security-escalation
-runbook on top of that coverage, so any on-shift support captain can recognise an
-active-exploitation report and reach the person authorised to file via the SRP
-without waiting for a single time zone. Completing that runbook — together with the
-EU AR appointment that fixes the coordinator CSIRT (see above) — is the priority
-before 11 Sep 2026.
+The current interim arrangement is a single primary contact during business
+hours plus a documented escalation path; this does not satisfy the Art. 14
+24-hour clock for incidents reported overnight or on holidays. Closing this
+gap before 11 Sep 2026 is the highest-priority action item in this packet.
 
 ## What this means for customers
 
@@ -119,7 +126,9 @@ When you ship a product containing wolfSSL:
 
 - CRA Art. 13: vulnerability handling, support period, security updates
 - CRA Art. 14: notification obligations (24h, 72h, 14 days / 1 month)
-- CRA Art. 16: Single Reporting Platform; EUVD publication of fixed vulnerabilities
+- CRA Art. 16: Single Reporting Platform
+- CRA Art. 17(5): EUVD publication of fixed vulnerabilities, in agreement with the
+  manufacturer (the EUVD itself is established under NIS2 Art. 12(2))
 - [ENISA — Single Reporting Platform (SRP)](https://www.enisa.europa.eu/topics/product-security-and-certification/single-reporting-platform-srp)
 - [European Vulnerability Database (EUVD)](https://euvd.enisa.europa.eu/)
 - [`../CRA-Compliance-Shortlist.md`](../CRA-Compliance-Shortlist.md) — pillar 4