{"corrections":[{"applied_on":"2026-08-22","entity":"technique","fields":["family","mechanism","first_seen","provenance_note"],"migration":"20260822000031","operation":"corrected","rationale":"The technique was first imported while nothing was reproduced, so it took the known-only fallback for every derived field and kept it permanently once the reproduction landed - import_registry writes a technique row only when its cluster key is new and there is no upsert. Its published state said so in its own words: the provenance note read \"known-but-not-reproduced coverage gap\", the mechanism restated the technique's own title, and first_seen was the 2020-01-01 default. NullRabbit has since reproduced it on ethereum, so each placeholder now stood in front of real evidence. Converging is a restoration rather than a rewrite, which is what separates this from the producer drift the projection declines to apply.","summary":"One technique converged from the known-only fallback to its reproduction","technique_ids":["NRDAX-T0323"]},{"applied_on":"2026-08-20","entity":"technique","fields":["family"],"migration":"20260820000028","operation":"corrected","rationale":"family holds the producer's label and is treated as published identity, so the projection never tracks the producer's current value: a modal family moves as instances accumulate under a technique, and following it would rewrite a citation on churn. This one was not churn. The slug clusters a single primitive, so there was never a modal contest to resolve; the producer relabelled that primitive and the published row kept protocol_logic_exploit, a label whose only remaining holders are two unclustered EVM DeFi findings outside the network-boundary scope entirely.","summary":"Producer family corrected on one technique after an upstream relabel","technique_ids":["NRDAX-T0392"]},{"applied_on":"2026-07-29","entity":"technique","fields":["mechanism"],"migration":"20260729000027","operation":"corrected","rationale":"The producer's build_attack_kb.py truncated the corpus source_note to 200 characters to keep its local index compact, and handed that same dict to the registry write-through, so the cut value overwrote the producer mechanism and rode the import into frozen technique rows. The tell was uniform: exactly 200 characters, ending mid-word. The full text survived in the corpus bundle manifest and every published prefix matched it exactly, which made this a restoration rather than a rewrite.","summary":"Mechanism text recovered on 57 techniques where it was cut at 200 characters","technique_ids":["NRDAX-T0009","NRDAX-T0023","NRDAX-T0041","NRDAX-T0042","NRDAX-T0046","NRDAX-T0050","NRDAX-T0056","NRDAX-T0059","NRDAX-T0061","NRDAX-T0064","NRDAX-T0071","NRDAX-T0096","NRDAX-T0099","NRDAX-T0111","NRDAX-T0112","NRDAX-T0122","NRDAX-T0129","NRDAX-T0143","NRDAX-T0145","NRDAX-T0148","NRDAX-T0156","NRDAX-T0165","NRDAX-T0171","NRDAX-T0182","NRDAX-T0185","NRDAX-T0187","NRDAX-T0192","NRDAX-T0195","NRDAX-T0196","NRDAX-T0198","NRDAX-T0202","NRDAX-T0203","NRDAX-T0205","NRDAX-T0207","NRDAX-T0211","NRDAX-T0225","NRDAX-T0246","NRDAX-T0254","NRDAX-T0280","NRDAX-T0291","NRDAX-T0292","NRDAX-T0295","NRDAX-T0307","NRDAX-T0312","NRDAX-T0317","NRDAX-T0321","NRDAX-T0326","NRDAX-T0327","NRDAX-T0328","NRDAX-T0332","NRDAX-T0338","NRDAX-T0349","NRDAX-T0351","NRDAX-T0352","NRDAX-T0381","NRDAX-T0409","NRDAX-T0417"]},{"applied_on":"2026-07-27","entity":"technique","fields":["family","mechanism","first_seen","provenance_note"],"migration":"20260727000024","operation":"corrected","rationale":"import_registry writes a technique row only when its cluster key is new and there is no upsert, so a slug first imported while nothing was reproduced took the known-only FALLBACK for every derived field and kept all of them permanently once the reproduction landed. The reproduction became an instance; the technique's own fields never caught up, so a reproduced technique still told every reader it was an unreproduced coverage gap. The importer now recomputes exactly these fields on exactly this transition.","summary":"Seven techniques converged from the known-only fallback to their reproduction","technique_ids":["NRDAX-T0009","NRDAX-T0096","NRDAX-T0110","NRDAX-T0111","NRDAX-T0332","NRDAX-T0338","NRDAX-T0381"]},{"applied_on":"2026-07-27","entity":"technique","fields":["mechanism"],"migration":"20260727000023","operation":"corrected","rationale":"The producer's cluster job buckets a reproduced primitive into a coarse class for clustering purposes. For seven techniques the record was then built from that coarse path, taking the class as the family and the technique slug as the mechanism. Both real values survived on the primitive all along. The data was never missing, it failed to propagate, and the records carried 27 to 41 characters against a median of 200 across the classified corpus.","summary":"Mechanism text recovered for seven techniques that restated their own title","technique_ids":["NRDAX-T0009","NRDAX-T0096","NRDAX-T0110","NRDAX-T0111","NRDAX-T0332","NRDAX-T0338","NRDAX-T0381"]},{"applied_on":"2026-07-23","entity":"external_reference","fields":[],"migration":"20260723000017","operation":"removed","rationale":"Part two of the scope correction. The first part cleared 55 references on the reproduced slice; this cleared 551 technique-level references across the known-only side, plus the 352 spurious known-coverage cells they created. The same producer defect, at scale.","summary":"The same out-of-scope references removed from 249 known-only techniques","technique_ids":["NRDAX-T0003","NRDAX-T0004","NRDAX-T0007","NRDAX-T0008","NRDAX-T0010","NRDAX-T0011","NRDAX-T0012","NRDAX-T0014","NRDAX-T0015","NRDAX-T0016","NRDAX-T0017","NRDAX-T0018","NRDAX-T0019","NRDAX-T0020","NRDAX-T0021","NRDAX-T0022","NRDAX-T0026","NRDAX-T0027","NRDAX-T0028","NRDAX-T0029","NRDAX-T0030","NRDAX-T0031","NRDAX-T0033","NRDAX-T0034","NRDAX-T0035","NRDAX-T0036","NRDAX-T0037","NRDAX-T0039","NRDAX-T0040","NRDAX-T0043","NRDAX-T0044","NRDAX-T0045","NRDAX-T0047","NRDAX-T0049","NRDAX-T0051","NRDAX-T0053","NRDAX-T0054","NRDAX-T0057","NRDAX-T0058","NRDAX-T0062","NRDAX-T0063","NRDAX-T0065","NRDAX-T0066","NRDAX-T0067","NRDAX-T0068","NRDAX-T0069","NRDAX-T0072","NRDAX-T0074","NRDAX-T0075","NRDAX-T0077","NRDAX-T0078","NRDAX-T0079","NRDAX-T0081","NRDAX-T0082","NRDAX-T0083","NRDAX-T0084","NRDAX-T0085","NRDAX-T0086","NRDAX-T0087","NRDAX-T0090","NRDAX-T0091","NRDAX-T0092","NRDAX-T0093","NRDAX-T0094","NRDAX-T0098","NRDAX-T0102","NRDAX-T0103","NRDAX-T0104","NRDAX-T0105","NRDAX-T0107","NRDAX-T0108","NRDAX-T0109","NRDAX-T0113","NRDAX-T0114","NRDAX-T0115","NRDAX-T0116","NRDAX-T0118","NRDAX-T0119","NRDAX-T0121","NRDAX-T0123","NRDAX-T0127","NRDAX-T0128","NRDAX-T0130","NRDAX-T0132","NRDAX-T0133","NRDAX-T0134","NRDAX-T0136","NRDAX-T0137","NRDAX-T0138","NRDAX-T0147","NRDAX-T0149","NRDAX-T0151","NRDAX-T0152","NRDAX-T0154","NRDAX-T0155","NRDAX-T0157","NRDAX-T0158","NRDAX-T0159","NRDAX-T0161","NRDAX-T0162","NRDAX-T0163","NRDAX-T0164","NRDAX-T0167","NRDAX-T0168","NRDAX-T0170","NRDAX-T0172","NRDAX-T0173","NRDAX-T0174","NRDAX-T0176","NRDAX-T0177","NRDAX-T0178","NRDAX-T0179","NRDAX-T0180","NRDAX-T0181","NRDAX-T0186","NRDAX-T0189","NRDAX-T0190","NRDAX-T0191","NRDAX-T0193","NRDAX-T0194","NRDAX-T0200","NRDAX-T0201","NRDAX-T0204","NRDAX-T0208","NRDAX-T0209","NRDAX-T0212","NRDAX-T0215","NRDAX-T0216","NRDAX-T0217","NRDAX-T0218","NRDAX-T0220","NRDAX-T0224","NRDAX-T0229","NRDAX-T0230","NRDAX-T0231","NRDAX-T0232","NRDAX-T0233","NRDAX-T0234","NRDAX-T0235","NRDAX-T0236","NRDAX-T0237","NRDAX-T0239","NRDAX-T0240","NRDAX-T0241","NRDAX-T0242","NRDAX-T0243","NRDAX-T0244","NRDAX-T0245","NRDAX-T0247","NRDAX-T0250","NRDAX-T0251","NRDAX-T0252","NRDAX-T0253","NRDAX-T0255","NRDAX-T0256","NRDAX-T0257","NRDAX-T0258","NRDAX-T0259","NRDAX-T0260","NRDAX-T0262","NRDAX-T0263","NRDAX-T0264","NRDAX-T0265","NRDAX-T0266","NRDAX-T0267","NRDAX-T0268","NRDAX-T0269","NRDAX-T0270","NRDAX-T0271","NRDAX-T0272","NRDAX-T0273","NRDAX-T0274","NRDAX-T0276","NRDAX-T0277","NRDAX-T0278","NRDAX-T0282","NRDAX-T0283","NRDAX-T0284","NRDAX-T0285","NRDAX-T0286","NRDAX-T0287","NRDAX-T0289","NRDAX-T0290","NRDAX-T0293","NRDAX-T0294","NRDAX-T0296","NRDAX-T0299","NRDAX-T0300","NRDAX-T0301","NRDAX-T0302","NRDAX-T0304","NRDAX-T0305","NRDAX-T0306","NRDAX-T0308","NRDAX-T0309","NRDAX-T0310","NRDAX-T0313","NRDAX-T0314","NRDAX-T0315","NRDAX-T0316","NRDAX-T0318","NRDAX-T0322","NRDAX-T0323","NRDAX-T0324","NRDAX-T0325","NRDAX-T0334","NRDAX-T0335","NRDAX-T0336","NRDAX-T0337","NRDAX-T0339","NRDAX-T0340","NRDAX-T0341","NRDAX-T0344","NRDAX-T0346","NRDAX-T0348","NRDAX-T0356","NRDAX-T0357","NRDAX-T0358","NRDAX-T0359","NRDAX-T0360","NRDAX-T0361","NRDAX-T0362","NRDAX-T0363","NRDAX-T0364","NRDAX-T0365","NRDAX-T0366","NRDAX-T0367","NRDAX-T0368","NRDAX-T0370","NRDAX-T0371","NRDAX-T0372","NRDAX-T0373","NRDAX-T0374","NRDAX-T0375","NRDAX-T0376","NRDAX-T0377","NRDAX-T0378","NRDAX-T0379","NRDAX-T0380","NRDAX-T0385","NRDAX-T0390","NRDAX-T0391","NRDAX-T0393","NRDAX-T0395","NRDAX-T0397","NRDAX-T0402","NRDAX-T0404","NRDAX-T0405","NRDAX-T0412"]},{"applied_on":"2026-07-23","entity":"external_reference","fields":[],"migration":"20260723000016","operation":"removed","rationale":"The producer's cluster job writes a found row for a triage candidate WITHOUT checking whether triage kept the finding in NRDAX's network-boundary scope, so execution-layer, smart-contract and dependency findings explicitly rejected as not a network-wire attack were projected onto in-scope techniques as technique-level references and known-coverage cells. The visible symptom was a cosmos vote-extension panic carrying a polkadot reference. The read boundary now re-derives scope rather than trusting the clustering.","summary":"Out-of-scope found references and coverage cells removed from 29 reproduced techniques","technique_ids":["NRDAX-T0005","NRDAX-T0006","NRDAX-T0009","NRDAX-T0046","NRDAX-T0056","NRDAX-T0064","NRDAX-T0076","NRDAX-T0088","NRDAX-T0096","NRDAX-T0110","NRDAX-T0112","NRDAX-T0120","NRDAX-T0122","NRDAX-T0142","NRDAX-T0171","NRDAX-T0192","NRDAX-T0199","NRDAX-T0205","NRDAX-T0211","NRDAX-T0214","NRDAX-T0249","NRDAX-T0295","NRDAX-T0317","NRDAX-T0320","NRDAX-T0328","NRDAX-T0332","NRDAX-T0333","NRDAX-T0338","NRDAX-T0353"]},{"applied_on":"2026-07-21","entity":"instance","fields":["fidelity"],"migration":"20260721000015","operation":"corrected","rationale":"Nine original-research instances were imported as proxy but were every one measured against a real go-ethereum 1.17.4 localnet, which is lab by the FidelityClass taxonomy. For six of them the producer's own value had since settled on lab, but import_registry is increment-only and skips existing instances, so the published rows stayed stale. The label was publicly visible and contradicted both the linked advisories and same-technique siblings already tagged lab.","summary":"go-ethereum instance fidelity corrected from proxy to lab","technique_ids":[]},{"applied_on":"2026-07-15","entity":"registry","fields":["version"],"migration":"20260715000013","operation":"corrected","rationale":"The registry is no longer framed as a raw import: it is reproduced-first, with an explicit network-boundary scope and a MITRE AADAPT crosswalk on the ceded records. Deliberately NOT v1.0, which would imply a stable-release and re-taxonomy claim that is not being made. The version is served on the homepage only and citations omit it by design, so no pasted citation ever carried the retired tag.","summary":"Registry version tag moved from v0.1-import to v0.2","technique_ids":[]},{"applied_on":"2026-07-14","entity":"external_reference","fields":["ref_id"],"migration":"20260714000010","operation":"corrected","rationale":"The vendor-advisory sibling of the nr-advisory leak. The producer routes any public_source starting http(s) to vendor-advisory, and the projection kept the whole annotated string as the id, so file:line locations and finding tags leaked into the public feed and STIX alongside the URL. Each affected id was trimmed to its leading URL, keeping the public reference and its link.","summary":"Trailing research prose trimmed from vendor-advisory reference ids","technique_ids":[]},{"applied_on":"2026-07-14","entity":"external_reference","fields":[],"migration":"20260714000009","operation":"removed","rationale":"The producer's view derived external_ref_kind with nr-advisory as a CATCH-ALL, so anything that was not a CVE, a GHSA or an http(s) URL was stamped nr-advisory. That bucket held internal notes: hypothesis tags, exact file:line code locations and private findings-repo paths, which the projection then emitted verbatim into the public feed, per-technique JSON and STIX as reference ids. A genuine nr-advisory id is NR-YYYY-NNN, and none of these were. The leaked rows were dropped; where a row carried a real reference alongside the prose, its id was trimmed rather than deleted.","summary":"Internal research prose removed from public reference ids mislabelled nr-advisory","technique_ids":[]},{"applied_on":"2026-07-14","entity":"external_reference","fields":["ref_id","url"],"migration":"20260714000008","operation":"corrected","rationale":"The projection copied the producer's single free-form external_ref string verbatim into BOTH ref_id and url, so a CVE or GHSA sourced from a URL was not findable by its canonical id. /cve/{reference}, citation ids and the STIX external_id all key on ref_id. The canonical id was extracted into ref_id and the real link kept in url; newly imported rows now take the same path.","summary":"Instance reference ids canonicalised out of their source URLs","technique_ids":[]},{"applied_on":"2026-07-13","entity":"technique","fields":["first_seen"],"migration":"20260713000007","operation":"corrected","rationale":"Imports derived first_seen from the earliest four-digit run found anywhere in a reference id, so GitHub PR and release numbers were read as disclosure years: a Firedancer release id gave 2030, an Optimism PR number gave 1972. The bad dates propagated into the Atom feed's updated timestamps and the sitemap. Only CVE ids carry a reliable year, so the coverage-gap slice was recomputed from its earliest CVE year, or the 2020-01-01 default where it has no CVE.","summary":"Known-only technique first_seen dates recomputed from CVE years","technique_ids":[]}],"count":13}