Entry and exit discipline for the channel

This document reaches every customer's agents from one hardcoded URL, so a
publish is a decision taken on their behalf. Records what earns that — an
actively exploited vulnerability, recognisable in one request, in software
customers run, in the days before a fix — and the three steps out: in as log,
promoted only with a reason, then into the engine or deleted.

Also records that customers do not need this channel for their own rules.
Create Custom Ruleset takes the same fields and reaches their own agents; the
config pull and this feed are each forbidden from touching the other's
sources.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r

CVE-CHANNEL.md

@@ -13,6 +13,34 @@ Engine 3.0.47 and later fetch it hourly from:
 
     https://git.artica.center/Andre/edgeguard-owasp-feed/raw/branch/main/cve.json
 
+## When a rule belongs here, and when it does not
+
+This document reaches every customer's agents from one hardcoded URL, so a
+publish is a decision taken on their behalf. It earns that only in a narrow
+case: **an actively exploited vulnerability, recognisable in a single request,
+in software customers run, during the days before a real fix exists.** That is
+a few a year.
+
+Entry and exit, so rules do not accumulate because publishing is easy:
+
+1. **In as `log`.** It records matches and scores nothing, so it refuses
+   nothing while you see what it would have caught.
+2. **Promoted to `critical` only with a reason.** Severity is what acts —
+   `high` scores 4 against a default threshold of 5 and does nothing on its
+   own. A rule left at `high` is inert, not cautious.
+3. **Then out.** Anything still worth enforcing after the emergency moves into
+   the engine, where it works with no network and cannot be withdrawn by a bad
+   publish — Log4Shell, Spring4Shell and PHP2Shell all live there. Anything no
+   longer worth it is deleted and the stamp bumped.
+
+A rule sitting here indefinitely is in the wrong place.
+
+**And customers do not need this channel for their own rules.** Create Custom
+Ruleset in the console takes the same fields and reaches their agents through
+the configuration pull, scoped to the sites they choose. The config pull is
+forbidden from touching the sources this feed owns and this feed is forbidden
+from touching theirs, so the two cannot clear each other.
+
 ## Publishing a patch
 
 Add a rule to the single ruleset, bump `build_datetime`, commit, push. An