Focus CVE automation on top 5 priority packages first

Situation

Stack-rank the CVE priority package list and start automation with just the top 5 packages. Drive open CVE count for those 5 as close to zero as possible before expanding scope. Report closed-by-automation separately from will-not-do.

Reasoning

Focus beats breadth. Getting automation working perfectly on 5 packages proves the system and creates momentum. Trying to boil the ocean leads to partial solutions everywhere. The current priority list is too long - cutting it to a core set makes success achievable.

Additional Context

Discussion about where to start CVE automation work. 75% metric should be about spending 75% less dollars on humans, not just closing tickets. Need to flood merge requests as a feature to demonstrate value.

Observed Evidence

Peter: "What if we just picked five packages and said, we are going to make NARF and CVE automation try to drive the open number of CVEs against those five packages... as close to zero as possible" and "The core set needs to be smaller than it is today" and Max: "Go stack rank it and say, Im going to take the first five"

Confidence Breakdown

Reasoning Depth Analysis