diff --git a/.cursor/ONBOARDING.md b/.cursor/ONBOARDING.md
new file mode 100644
index 000000000..b9da963c7
--- /dev/null
+++ b/.cursor/ONBOARDING.md
@@ -0,0 +1,98 @@
+# OSIM Onboarding Guide
+
+## 1. Understand the ecosystem
+- **OSIM** is the Vue 3 frontend (Incident Response Web UI) backed by **OSIDB** (the REST API).
+- Two repos to know: `osim` (frontend) and `osim-ui-tests` (Playwright E2E tests).
+- Read [`docs/overview.md`](../docs/overview.md) for architecture, directory layout, and core patterns.
+
+---
+
+## 2. Local setup
+- Install deps: `yarn`
+- Configure `public/runtime.json` pointing to local or staging OSIDB (see `docs/overview.md` → *Local Configuration*).
+- Auth modes: `kerberos` for stage/prod, `credentials` for local OSIDB instances.
+- Run dev server: `yarn dev`
+
+---
+
+## 3. Source structure
+
+| Dir | What lives there |
+|---|---|
+| `src/components/` | Reusable Vue components |
+| `src/views/` | Route-mounted pages (`*View.vue`) |
+| `src/composables/` | `use*` hooks for shared logic |
+| `src/services/` | API/data access (`*Service.ts`) |
+| `src/stores/` | Pinia cross-component state |
+| `src/types/` | Zod schemas + TypeScript types |
+| `src/generated-client/` | Auto-generated OSIDB API client |
+
+---
+
+## 4. Core coding conventions
+- Always use `<script setup lang="ts">` (Vue 3 Composition API).
+- All env vars are prefixed `OSIM_`.
+- API calls go through services, not directly in components.
+- Use Pinia only when state needs to be shared across siblings.
+- Schema validation uses **Zod** — `src/types/zodFlaw.ts` is the main reference.
+- Prefer nesting `<input>` inside `<label>` over `id`/`for` pairs.
+
+---
+
+## 5. Development workflow (feature end-to-end)
+
+```
+SCAFFOLD  → create component + composable + service + Zod type
+ITERATE   → edit freely
+REVIEW    → yarn vibe-check  (lint + type-check + unit tests)
+COMMIT    → gitmoji + short imperative message (e.g. ✨ add flaw priority filter)
+E2E TEST  → write spec in osim-ui-tests workspace
+```
+
+---
+
+## 6. Key commands
+
+```bash
+yarn dev                        # dev server
+yarn vibe-check                 # lint + type-check + tests (required before PR)
+yarn lint                       # ESLint only
+yarn type-check                 # TypeScript only
+yarn test:unit                  # Vitest unit tests
+yarn generate-openapi-client    # regenerate API client from openapi-osidb.yml
+```
+
+---
+
+## 7. Git workflow
+- Branch names: `feature/`, `fix/`, `refactor/`, `docs/` + short kebab-case description.
+- Commit format: `<gitmoji> <short imperative sentence>` (e.g. `🐛 fix owner field not saving`).
+- Consolidate commits before pushing. Run `yarn vibe-check` before opening a PR.
+
+---
+
+## 8. E2E tests (`osim-ui-tests`)
+- Specs live in `tests/`, page helpers in `pages/`.
+- Required env vars: `OSIDB_URL`, `OSIM_URL`, `LOGIN_USERNAME`, `LOGIN_PASSWORD`.
+- Run a single spec: `yarn playwright test tests/<file>.spec.ts --headed`
+- Record new interactions: `yarn playwright codegen $OSIM_URL`
+
+---
+
+## 9. OpenAPI client
+- API contract lives in `openapi-osidb.yml`.
+- After backend schema changes, regenerate with `yarn generate-openapi-client`.
+
+---
+
+## 10. PR checklist (from `CONTRIBUTING.md`)
+- [ ] Linting passed
+- [ ] Type checks passed
+- [ ] Test suite passed
+- [ ] Commits consolidated
+- [ ] Changelog updated
+- [ ] Test cases added/updated
+
+---
+
+> **First reading path:** `README.md` → `docs/overview.md` → `CONTRIBUTING.md` → pick a small `fix/` ticket to trace through the full workflow once.
diff --git a/.cursor/README.md b/.cursor/README.md
new file mode 100644
index 000000000..754d5a994
--- /dev/null
+++ b/.cursor/README.md
@@ -0,0 +1,140 @@
+# Cursor Agentic Config — osim
+
+Local-only config (not tracked by git). Covers the full SDLC for the osim Vue 3 frontend.
+
+---
+
+## Rules (auto-applied by Cursor)
+
+| File | Applies to | Purpose |
+|------|-----------|---------|
+| `rules/vue-typescript.mdc` | `*.vue`, `*.ts` | Vue 3 composition API, Zod validation, security patterns |
+| `rules/git-workflow.mdc` | Always | Gitmoji commits, semantic branch naming |
+
+---
+
+## Agents (invoke with `@agent-name` or describe the task)
+
+### `code-reviewer` — Review code changes
+
+**When to use:** After you're satisfied with an implementation and want a structured review before running checks.
+
+**Example prompts:**
+```
+Review my changes to CommentList.vue and useFlawCommentFilter.ts
+```
+```
+@code-reviewer — what issues do you see in the flaw form changes?
+```
+
+**What it does:**
+- Runs `git diff HEAD` to see what changed
+- Checks TypeScript safety, Vue 3 patterns, security, code quality
+- Returns 🔴 Critical / 🟡 Suggestion / 🟢 Minor feedback with file+line references
+- Does NOT auto-run lint or tests
+
+---
+
+### `feature-scaffolder` — Generate new feature boilerplate
+
+**When to use:** Starting a new feature that needs component + composable + service + types.
+
+**Example prompts:**
+```
+Use feature-scaffolder to add a comment type filter. UI-only, no API changes needed.
+```
+```
+Scaffold a new CvssOverrideForm component similar to CvssCalculator.
+```
+
+**What it does:**
+1. Reads 2–3 similar existing files to match conventions
+2. Generates: `components/<Name>/<Name>.vue`, `composables/use<Name>Model.ts`, optionally service + Zod type
+3. Lists which existing files need updating to wire it in
+4. Stops — does NOT run type-check or tests
+
+---
+
+### `pr-description` — Generate a PR description from branch changes
+
+**When to use:** Before opening a PR.
+
+**Example prompts:**
+```
+Write the PR description for this branch.
+```
+```
+@pr-description
+```
+
+**Output:**
+```
+## Summary
+Add comment type filter to flaw comment list.
+
+## Changes
+- CommentList.vue: new filter UI with CommentType checkboxes
+- useFlawCommentFilter.ts: reactive filter composable
+
+## Considerations
+- Filter state is local — resets on navigation
+```
+
+---
+
+### `release-manager` — Prepare a release branch and PR
+
+**When to use:** When cutting a new versioned release from `main`.
+
+**Example prompts:**
+```
+Create a release for OSIDB-4935
+```
+```
+Prepare the release branch for ticket OSIDB-5012
+```
+
+**What it does:**
+1. Checks out `main` and pulls latest
+2. Derives the version (`YYYY.M.Z`) from the current date and existing tags/CHANGELOG
+3. Creates branch `release/OSIDB-{XXXX}-v{YYYY.M.Z}`
+4. Updates `CHANGELOG.md`: renames `[Unreleased]` header and fixes the links block
+5. Verifies no misplaced entries (commits since last tag vs CHANGELOG sections)
+6. Commits with `🔖 release v{YYYY.M.Z}`
+7. Pushes branch and opens a PR with label `Internal`, reviewers `osim-devs`, and the release changelog as description
+
+---
+
+## Workflow: Implementing a feature end-to-end
+
+```
+1. SCAFFOLD    → "Use feature-scaffolder to build X"
+                 Agent generates files, stops.
+
+2. ITERATE     → Edit freely. No agent checks between iterations.
+
+3. REVIEW      → "Review my changes to <files>"  ← code-reviewer
+                 Fix any 🔴 items.
+
+4. VALIDATE    → "Run vibe-check"
+                 Agent runs: yarn vibe-check (lint + type-check + tests)
+
+5. COMMIT      → "Commit this"
+                 osim-commit skill generates: ✨ short imperative message
+
+6. E2E TESTS   → Switch to osim-ui-tests workspace
+                 "Write an E2E test for X"  ← e2e-test-writer agent there
+```
+
+---
+
+## Key SDLC commands (run manually or ask the agent explicitly)
+
+```bash
+yarn lint              # ESLint only
+yarn type-check        # TypeScript only
+yarn test:unit         # Vitest unit tests
+yarn vibe-check        # lint + type-check + tests (pre-PR gate)
+yarn dev               # local dev server
+yarn generate-openapi-client  # regenerate API client from openapi-osidb.yml
+```
diff --git a/.cursor/agents/code-reviewer.md b/.cursor/agents/code-reviewer.md
new file mode 100644
index 000000000..0597b9ea6
--- /dev/null
+++ b/.cursor/agents/code-reviewer.md
@@ -0,0 +1,43 @@
+---
+name: code-reviewer
+description: Vue 3 / TypeScript code review specialist for osim. Proactively reviews code for quality, security, type safety, and osim conventions. Use after writing or modifying Vue components, composables, services, or TypeScript files.
+---
+
+You are a senior code reviewer for the osim frontend — a Vue 3 + TypeScript security advisory management tool.
+
+## When invoked
+
+1. Run `git diff HEAD` to see recent changes
+2. Focus review on modified `.vue`, `.ts` files
+3. **Do NOT run** `yarn type-check`, `yarn lint`, or tests — only run these when the user explicitly asks
+
+## Review checklist
+
+**TypeScript safety**
+- No `any`; proper use of `unknown` + type guards
+- Zod schemas used for API response validation (`ZodFlaw*` types)
+- Generated OpenAPI client used — no hand-rolled fetch calls
+
+**Vue 3 patterns**
+- `<script setup lang="ts">` with typed `defineProps`/`defineEmits`
+- Logic extracted into composables when reused across >1 component
+- No direct DOM manipulation — use template refs + Vue reactivity
+
+**Security**
+- `v-html` only with `sanitize-html`-processed content
+- User inputs validated before use
+- No secrets, tokens, or credentials in code
+
+**Code quality**
+- Functions are focused and <40 lines
+- Error states handled (not swallowed)
+- Loading states reflected in UI
+
+## Output format
+
+Organize feedback as:
+- 🔴 **Critical** — must fix before merge
+- 🟡 **Suggestion** — should address
+- 🟢 **Minor** — optional improvement
+
+Include specific file + line reference and a concrete fix for each 🔴 item.
diff --git a/.cursor/agents/feature-scaffolder.md b/.cursor/agents/feature-scaffolder.md
new file mode 100644
index 000000000..ecbfbb603
--- /dev/null
+++ b/.cursor/agents/feature-scaffolder.md
@@ -0,0 +1,48 @@
+---
+name: feature-scaffolder
+description: Scaffolds new osim features following existing patterns. Use when creating a new Vue component, composable, service, or full feature (component + composable + service + types). Reads existing similar files to match conventions before generating code.
+---
+
+You are a feature scaffolding specialist for the osim Vue 3 frontend.
+
+## When invoked
+
+1. Ask the user: what feature are they building? (component name, data model, API endpoint)
+2. Find 2-3 similar existing files for reference:
+   - Similar component in `src/components/`
+   - Related service in `src/services/`
+   - Related Zod type in `src/types/`
+3. Read those files to extract naming conventions, import patterns, and structure
+4. Generate the scaffolding following those exact patterns
+
+## Scaffold structure for a typical feature
+
+```
+src/
+  components/<FeatureName>/
+    <FeatureName>.vue          # main component (script setup)
+    <FeatureName>.spec.ts      # unit test skeleton
+  composables/
+    use<FeatureName>Model.ts   # reactive state + actions
+  services/
+    <FeatureName>Service.ts    # API calls via generated client
+  types/
+    zod<FeatureName>.ts        # Zod schema + inferred TS type
+```
+
+## Key conventions to match
+
+- Import paths use `@/` alias
+- Services use the generated OpenAPI client from `@/generated/`
+- Composables return `{ data, isLoading, error, actions }` pattern
+- Zod schemas live in `@/types/zod*.ts`
+- Component props are strictly typed with `defineProps<T>()`
+
+## Output
+
+Generate each file with full content. After scaffolding, tell the user:
+1. Which files were created
+2. Which existing files need to import/register the new component
+3. Wait for user confirmation before running any checks
+
+**Do NOT automatically run** `yarn type-check`, `yarn lint`, or tests. The user will explicitly ask when ready for post-implementation validation.
diff --git a/.cursor/agents/pr-description.md b/.cursor/agents/pr-description.md
new file mode 100644
index 000000000..e4f5a0259
--- /dev/null
+++ b/.cursor/agents/pr-description.md
@@ -0,0 +1,35 @@
+---
+name: pr-description
+description: Generates a concise pull request description for osim based on branch changes. Use when opening a PR, writing a PR description, or summarizing what a branch does. Analyzes git diff vs main to produce a minimal summary, changes list, and optional considerations.
+---
+
+You are a PR description writer for the osim frontend. Be extremely concise — no filler, no narration.
+
+## When invoked
+
+1. Run `git log main...HEAD --oneline` to see commits
+2. Run `git diff main...HEAD --stat` to see changed files
+3. Run `git diff main...HEAD` for content (skim — don't read everything)
+4. Produce the PR description
+
+## Output format
+
+```
+## Summary
+One sentence. What this PR does and why.
+
+## Changes
+- <file or area>: <what changed> (1 line max per item)
+- ...
+
+## Considerations
+- <only if there's something the reviewer must know: breaking change, migration step, env var, flag, risk>
+```
+
+## Rules
+
+- Summary: max 1 sentence, no "This PR..."
+- Changes: bullet per logical change, not per file. High-level. Max 6 bullets.
+- Considerations: omit section entirely if nothing noteworthy
+- No markdown headers beyond the 3 above
+- No emojis unless a gitmoji fits naturally in a bullet
diff --git a/.cursor/agents/release-manager.md b/.cursor/agents/release-manager.md
new file mode 100644
index 000000000..e14183104
--- /dev/null
+++ b/.cursor/agents/release-manager.md
@@ -0,0 +1,91 @@
+---
+name: release-manager
+description: Automates the osim release branch creation process. Use when the user asks to create a release, cut a release, prepare a release branch, or start an osim release for a given OSIDB ticket number.
+---
+
+You are a release manager for the osim frontend. When asked to create a release, you receive an OSIDB ticket number and run the full release workflow automatically.
+
+## Inputs
+
+The user provides the OSIDB ticket number (e.g. `4935`). Derive everything else automatically.
+
+## Workflow
+
+### 1. Update main
+
+```bash
+cd /home/cavalenc/Dev/prodsec/osim
+git checkout main && git fetch origin && git pull origin main
+```
+
+### 2. Determine version
+
+- `YYYY` = current year, `M` = current month (no leading zero)
+- `Z` = counter: check existing tags for `v{YYYY}.{M}.*` and CHANGELOG headers; `Z` = highest existing + 1, starting at `0` if none
+
+```bash
+git tag --list "v{YYYY}.{M}.*" --sort=-version:refname | head -5
+```
+
+### 3. Create branch
+
+```bash
+git checkout -b release/OSIDB-{XXXX}-v{YYYY.M.Z}
+```
+
+### 4. Update CHANGELOG.md
+
+**4a.** Rename `## [Unreleased]` → `## [{YYYY.M.Z}]`
+
+**4b.** In the links block at the bottom, replace:
+```
+[Unreleased]: https://github.com/RedHatProductSecurity/osim/compare/v{PREV}...HEAD
+```
+With:
+```
+[Unreleased]: https://github.com/RedHatProductSecurity/osim/compare/v{YYYY.M.Z}...HEAD
+[{YYYY.M.Z}]: https://github.com/RedHatProductSecurity/osim/compare/v{PREV}...v{YYYY.M.Z}
+```
+
+### 5. Check for misplaced entries
+
+Run `git log v{PREV}..HEAD --oneline --no-merges` and cross-check each feature/fix commit against the CHANGELOG sections. If any entry is listed in a prior release but its code commit is after `v{PREV}`, move it to `## [{YYYY.M.Z}]`. Report any corrections made.
+
+### 6. Commit
+
+```bash
+git add CHANGELOG.md
+git commit -m "🔖 release v{YYYY.M.Z}"
+```
+
+### 7. Push and open PR
+
+```bash
+git push -u origin release/OSIDB-{XXXX}-v{YYYY.M.Z}
+```
+
+Extract the changelog body for `{YYYY.M.Z}` (all lines between its header and the next `## [`) and create the PR:
+
+```bash
+gh pr create \
+  --base main \
+  --title "release v{YYYY.M.Z}" \
+  --label "Internal" \
+  --reviewer "RedHatProductSecurity/osim-devs" \
+  --body "..."
+```
+
+PR body format:
+```
+## Release v{YYYY.M.Z}
+
+{changelog content}
+
+---
+Ticket: OSIDB-{XXXX}
+```
+
+## Notes
+
+- Show a summary at the end: branch name, version, PR URL, and any misplaced entries corrected.
+- Do NOT push or open PRs on the `main` branch directly.
diff --git a/.cursor/rules/git-workflow.mdc b/.cursor/rules/git-workflow.mdc
new file mode 100644
index 000000000..ae963b161
--- /dev/null
+++ b/.cursor/rules/git-workflow.mdc
@@ -0,0 +1,35 @@
+---
+description: Git commit and branch conventions for osim
+alwaysApply: true
+---
+
+# Git Workflow
+
+## Branch Naming
+`feature/`, `fix/`, `refactor/`, `docs/` + short kebab-case description
+e.g. `feature/flaw-comment-pagination`, `fix/cvss-score-display`
+
+## Commit Messages
+Format: `<gitmoji> <short imperative sentence>`
+
+| Type | Gitmoji |
+|------|---------|
+| New feature | ✨ |
+| Bug fix | 🐛 |
+| Refactor | ♻️ |
+| Tests | ✅ |
+| Docs | 📝 |
+| Chore/deps | 🔧 |
+| Security | 🔒 |
+| Performance | ⚡ |
+| Types | 🏷️ |
+
+Examples:
+- `✨ add pagination to flaw comment list`
+- `🐛 fix CVSS score not updating on NVD import`
+- `♻️ extract comment parsing into useFlawComments composable`
+
+## PR Standards
+- Group related commits; minimize count before push
+- Run `yarn vibe-check` before opening PR
+- Reference issue/ticket in PR description
diff --git a/.cursor/rules/vue-typescript.mdc b/.cursor/rules/vue-typescript.mdc
new file mode 100644
index 000000000..8a017308e
--- /dev/null
+++ b/.cursor/rules/vue-typescript.mdc
@@ -0,0 +1,37 @@
+---
+description: Vue 3 + TypeScript standards for osim frontend
+globs: **/*.vue,**/*.ts
+alwaysApply: false
+---
+
+# Vue 3 + TypeScript Standards
+
+## Components
+- Use `<script setup lang="ts">` with Composition API
+- Composition over inheritance; extract reusable logic into `use*` composables
+- Props via `defineProps<T>()` with explicit types — no `PropType` workarounds
+- Emit via `defineEmits<{ eventName: [payload: Type] }>()`
+
+## TypeScript
+- No `any`; prefer `unknown` + type narrowing
+- Validate API responses against Zod schemas (`ZodFlaw*` types in `@/types/zodFlaw`)
+- Use generated OpenAPI client from `@/generated/` — never hand-roll API calls
+- Run `yarn type-check` before committing
+
+## Services & State
+- API calls belong in `@/services/*Service.ts`, not in components
+- Global state in Pinia stores (`@/stores/`); local state with `ref`/`computed`
+- `osimRuntime` store for environment/backend config
+
+## Security
+- Sanitize HTML before rendering with `sanitize-html` (see `CommentList.vue`)
+- Never use `v-html` without sanitization — add `eslint-disable` comment only with sanitized input
+- Validate and encode all user-supplied URL parameters
+
+## Scripts (run only when user asks)
+- `yarn lint` — ESLint check
+- `yarn type-check` — TS type validation
+- `yarn test:unit` — Vitest unit tests
+- `yarn vibe-check` — combined lint + type-check + tests
+
+**Never auto-run these after implementation.** Wait for explicit user confirmation before triggering any validation pipeline.
diff --git a/AI_GUIDELINES.md b/AI_GUIDELINES.md
new file mode 100644
index 000000000..0f9dcd4e4
--- /dev/null
+++ b/AI_GUIDELINES.md
@@ -0,0 +1,74 @@
+# OSIM — AI Assistant Guidelines
+
+OSIM is a Vue 3 + TypeScript security advisory management frontend for OSIDB.
+
+## Tech Stack
+
+- Vue 3 (Composition API, `<script setup>`), TypeScript strict mode
+- Pinia (state), Vue Router 4, Bootstrap 5
+- Vitest + Vue Test Utils (unit), Playwright (E2E in `osim-ui-tests`)
+- OpenAPI-generated client (`src/generated/`), Zod for runtime validation
+- ESLint + Stylelint, Vite
+
+## File Layout
+
+```
+src/
+  components/   # UI components (directory-based, co-located spec files)
+  composables/  # use*() hooks — reactive state + actions
+  services/     # API calls via generated client only
+  stores/       # Pinia stores
+  types/        # Zod schemas + inferred TS types (zod*.ts)
+  generated/    # OpenAPI client — never edit manually
+  widgets/      # Complex reusable components
+```
+
+## Core Conventions
+
+- `<script setup lang="ts">` — always
+- `defineProps<T>()` / `defineEmits<{}>()` — explicit types, no `PropType`
+- API calls only through generated OpenAPI client — no hand-rolled fetch
+- Zod schemas in `src/types/zod*.ts` for all API response types
+- `v-html` requires `sanitize-html` preprocessing — no exceptions
+- No `any` — use `unknown` + type narrowing
+
+## Development Commands
+
+```bash
+yarn dev             # dev server (HTTPS, hot reload)
+yarn lint            # ESLint + Stylelint
+yarn type-check      # TypeScript validation
+yarn test:unit       # Vitest unit tests
+yarn vibe-check      # lint + type-check + tests (pre-PR gate)
+yarn generate-openapi-client  # regenerate API client
+```
+
+## Security Notes
+
+This application handles security advisories and vulnerability data.
+- Sanitize all user-generated HTML before rendering
+- Validate user inputs before use
+- Never expose credentials, tokens, or internal hostnames in code
+- Auth is JWT-based; token handling is in `src/stores/`
+
+## AI Workflow Notes
+
+- Implement first — do not auto-run lint/tests after changes
+- Only run validation when explicitly asked
+- Search existing implementations before generating new ones
+- Follow established patterns in composables and services
+
+## Local Cursor Config (`.cursor/`)
+
+A richer local-only Cursor config lives at `.cursor/` (excluded from git via `.git/info/exclude` — persists across all branches).
+
+**Rules** (auto-applied by file type):
+- `rules/vue-typescript.mdc` — Vue 3 composition, Zod, security patterns (`*.vue`, `*.ts`)
+- `rules/git-workflow.mdc` — gitmoji commits, branch naming (always)
+
+**Agents** (invoke by description or `@name`):
+- `code-reviewer` — structured Vue/TS diff review, no auto-validation
+- `feature-scaffolder` — generates component + composable + service + Zod type from description
+- `pr-description` — concise PR summary from `git diff main...HEAD`
+
+See `.cursor/README.md` for usage examples and the full SDLC workflow.
diff --git a/CLAUDE.md b/CLAUDE.md
new file mode 100644
index 000000000..06b4e08cd
--- /dev/null
+++ b/CLAUDE.md
@@ -0,0 +1,12 @@
+# OSIM — Claude Guidelines
+
+Refer to [AI_GUIDELINES.md](./AI_GUIDELINES.md) for full project context.
+
+## Key reminders
+
+- Do what has been asked; nothing more, nothing less
+- Never create files unless strictly necessary — prefer editing existing ones
+- Never proactively create documentation unless explicitly requested
+- Implement first — do not auto-run lint, type-check, or tests after changes; wait until asked
+- Always use the generated OpenAPI client (`src/generated/`) for API calls
+- `v-html` requires `sanitize-html` — no exceptions