Show the Endor id in the published tables

[p80n-sec]

CVE-2026-27959 carries endor_id: ENDOR-VUL-2026-2301, but its Endor Reference cell rendered a dash.

Cause

The schema has two separate Endor concepts, and only one of them ever reached the published tables:

Field	Meaning	Rendered where, before
endor_id	durable internal identifier, set from record creation	pending table only
refs.endor	transparency-page URL, often lands later or never	published tables + detail page

So a record's Endor id disappeared at exactly the point it went public. The value was stored and validating correctly the whole time — it just had no render path for status: published.

All four GT Edge findings showed a dash there too; the column had never rendered anything.

Change

_endor_reference() in the HTML renderer, mirrored in the README renderer:

• endor_id is the visible text
• it becomes a hyperlink once refs.endor exists — same text either way, so adding the URL later changes nothing visually except the link
• only a URL and no id → falls back to the Endor label, as before
• neither → dash, and the detail page omits the row entirely, as before

No record data changed; this is renderer-only.

Result

site table   ENDOR-VUL-2026-2301          (plain text, no URL yet)
detail page  Endor reference | ENDOR-VUL-2026-2301
README       … | 7.5 | ENDOR-VUL-2026-2301 · [Writeup](…) |

Verification

• pytest -q — 157 passed (152 before, 5 new)
• The 5 new tests were written first and confirmed failing
• generate exit 0; generate --check exit 0; second run byte-identical
• The five cells belonging to records with no endor_id still render dashes

Note

In the README the Endor id lands in the Links column, so that column now holds one entry that is plain text rather than a link until the transparency URL exists. The site table has a dedicated Endor Reference column and doesn't have this wrinkle. Easy to drop the README half if you'd rather that column stayed links-only.

🤖 Generated with Claude Code