Take the input domain list and, from a fresh git pull of https://github.com/CVEProject/cvelistV5 plus the latest five posts from each of https://socket.dev/blog/category/security-news, https://thehackernews.com/, and https://www.ox.security/blog, reach a named set of critical, unauthenticated, network-exploitable RCE CVEs published in the trailing 48h, and for every listed domain a per-CVE verdict from the /external-enumeration skill against its live external surface of subdomains, services, favicons, and webarchive URLs. Include a CVE only when it is provably critical, needs no authentication, is reachable over the public internet, attains RCE, and is under 48h old; drop anything unproven. Prove every verdict from an observation made this run, never a carried-over assumption, re-confirming each technology live; a CVE that ties to no observed asset is not-affected-from-external-surface, never guessed. Emit the seven-column table - CVE, Product, Vector, Customer, Vulnerable Technology Used, Simple PoC, Possible Mitigating Factors. Keep the per-domain tech stack and per-domain CVE verdicts in cache/** and carry them forward across runs; write the full host surface to subdomains_union.txt. Then rebuild the exposure-flow spec, render it to out.html, verify it headlessly by DOM-shimming the script and asserting finite coords and rasterizing to eyeball, and publish to the fixed artifact URL in place - never mint a new one. Never exploit a live host - the PoC stays a replication recipe. Touch only cache/**, subdomains_union.txt, and out.html. Stop when every named CVE has a per-domain verdict for all listed domains and the table is emitted, when the Sankey is verified and published to the fixed URL, and when a coverage-reflection pass over subdomains, technologies, favicons, and webarchive URLs surfaces nothing that changes a verdict.