diff --git a/.gitignore b/.gitignore
index db55caa..fc719e1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,11 @@ venv/
 /dist/
 *.egg-info/
 
+# Byproduct of running `uv run`/`uv sync` in a checkout. No install path consumes it:
+# the tool is installed with `uv tool install`, which resolves dependencies itself, and
+# this package is also an importable library, so its dependencies stay loosely pinned.
+/uv.lock
+
 # Inputs / outputs
 inventory.xlsx
 impact_report_*.html
diff --git a/.specify/feature.json b/.specify/feature.json
index ff19045..82acbd8 100644
--- a/.specify/feature.json
+++ b/.specify/feature.json
@@ -1,3 +1,3 @@
 {
-  "feature_directory": "specs/007-decommission-ai-analyzer"
+  "feature_directory": "specs/008-erp-bundle-scoped-report"
 }
diff --git a/.specify/memory/constitution.md b/.specify/memory/constitution.md
index bef4782..20b1465 100644
--- a/.specify/memory/constitution.md
+++ b/.specify/memory/constitution.md
@@ -1,6 +1,75 @@
 <!--
 Sync Impact Report
 ==================
+Version change: 3.1.0 → 3.2.0
+Rationale: Enacted as a prerequisite of spec 008 (bundle-scoped impact reporting), which scopes a
+           run to a Cisco Event Response bundle and reports one row per advisory in it. Cisco
+           publishes no API equivalent of a bundle — a request for one returns HTTP 404 — so a
+           bundle's membership can only be learned from its published page. That made two existing
+           constraints block the feature and one principle's text go stale.
+
+           The Networking constraint permitted only `apix.cisco.com` and `id.cisco.com` and stated
+           that "adding any further external endpoint the analyzer itself contacts remains a reviewed
+           change"; `sec.cloudapps.cisco.com` is now admitted, with the request explicitly
+           unauthenticated and forbidden from carrying any inventory-derived data — a stricter bound
+           than the advisory API's, which may carry the derived family/platform/release triple.
+
+           The Source of truth constraint ended "No scraped or cached-as-authoritative alternatives."
+           Reading a published page could be argued to survive that on a technicality, which is
+           exactly the kind of reasoning a governance document should foreclose. Rather than relax
+           the prohibition, a new Scope selectors bullet grants a narrow, enumerated permission: a
+           bundle page may supply *which* advisories are in scope and the bundle's own identity, and
+           is forbidden from supplying any advisory fact — title, severity, score, CVE, affected
+           product, fixing release, or an advisory's publication date — every one of which the page
+           actually displays. Disagreement resolves in the API's favour without exception, and a page
+           yielding no advisory is an error rather than an empty scope, because an empty result
+           rendered as a report reads as an all-clear. This narrows the tool's latitude while
+           unblocking the feature.
+
+           Principle VI named its shared surface as four modules. Spec 008 adds two — `erp` (bundle
+           resolution) and `bundle` (family derivation, filtering, row construction) — because both
+           are fragile, safety-bearing logic a second consumer would otherwise reimplement, and a
+           second divergent answer about which advisories are in scope is the harm the principle
+           exists to prevent. `bundle_report` joins the terminal-side list beside `html_report`.
+
+           A new constraint bullet plus materially expanded guidance, with no principle removed or
+           redefined and no existing permission widened, so the bump is MINOR. The product version
+           moves separately to 4.2.0 when the feature lands.
+
+Modified principles:
+  - VI. Headless Shared Surface (shared surface extended from four modules to six, adding `erp` and
+    `bundle`; `bundle_report` added to the terminal-side list; the public contract now also names
+    bundle resolution and covered-family derivation)
+Added sections:
+  - Technology & Data Constraints → Scope selectors (new bullet, with its own rationale)
+Modified sections:
+  - Technology & Data Constraints → Networking (`sec.cloudapps.cisco.com` admitted, scoped to bundle
+    resolution; the request is unauthenticated and carries no inventory-derived data at all)
+  - Technology & Data Constraints → Consumers (the released interface now enumerates all six modules)
+Removed sections: (none)
+
+Templates requiring updates:
+  - .specify/templates/plan-template.md ✅ aligned (Constitution Check resolves gates dynamically)
+  - .specify/templates/spec-template.md ✅ aligned (no constitution references)
+  - .specify/templates/tasks-template.md ✅ aligned (no constitution references)
+  - .specify/templates/checklist-template.md ✅ aligned (no constitution references)
+  - .claude/skills/speckit-*/SKILL.md ✅ aligned (reference the constitution generically)
+  - README.md ⚠️ pending — the shared-surface table lists four modules and MUST list six; carried as
+    task T051 of spec 008, in the same pull request as the code (Documentation gate)
+  - docs/index.html ⚠️ pending — carried as task T052 of spec 008
+
+Follow-up TODOs: none for this document. The two ⚠️ items above are feature tasks, not amendment
+debt; the Documentation gate requires them in the pull request that changes the surface.
+
+Previous version 3.1.0 (2026-07-27): enacted after product 4.1.0, which extracted the assessment
+into `caia/assessment.py`. Added Principle VI (Headless Shared Surface) naming four modules as a
+shared surface, made that surface a released interface, and extended three quality gates to enforce
+it. MINOR.
+-->
+
+<!--
+Superseded Sync Impact Report (3.0.0 → 3.1.0), retained for history
+==================
 Version change: 3.0.0 → 3.1.0
 Rationale: Enacted after product 4.1.0, which extracted the assessment into `caia/assessment.py`
            and established four modules — `assessment`, `matching`, `psirt`, `inventory` — as a
@@ -161,17 +230,21 @@ values means an observer of the tool's traffic learns what software is being ask
 nothing about who runs it or where.
 
 ### VI. Headless Shared Surface
-The modules that produce a verdict — `assessment`, `matching`, `psirt`, and `inventory` — are this
+The modules that produce a verdict or determine the scope one is produced for — `assessment`,
+`matching`, `psirt`, `inventory`, `erp`, and `bundle` — are this
 package's **shared surface** and MUST remain callable without a terminal. They MUST NOT print,
 prompt, consult the current working folder, write a file, or exit the process; the caller supplies
 the credentials, the inventory, and whatever progress reporting it wants. Terminal behaviour —
 prompts, colour, progress output, inventory discovery, report writing, exit codes — belongs to
-`cli`, `analyzer`, `ui`, `config`, `version`, and `html_report`, which are outside the shared
+`cli`, `analyzer`, `ui`, `config`, `version`, `html_report`, and `bundle_report`, which are outside
+the shared
 surface and MUST NOT be required by any consumer other than this CLI. Anything that consumes this
 package MUST reuse the shared surface rather than reimplement any part of it. The surface's public
 contract — `analyze`, `load_catalogues`, `families_in`, `describe_check`, the verdict vocabulary
-and reason kinds, the `psirt` client and its error types, `load_inventory`, and the shape of a
-device record — MUST NOT change incompatibly without a MAJOR product version bump. A shared-surface
+and reason kinds, the `psirt` client and its error types, `load_inventory`, the resolution of a
+published bundle to the advisories it contains, the derivation of an advisory's covered product
+families, and the shape of a device record — MUST NOT change incompatibly without a MAJOR product
+version bump. A shared-surface
 function MUST report a failure to *reach* Cisco as an error rather than as a set of undecided
 verdicts, so a caller can always tell "we could not ask" apart from "we asked and could not decide".
 
@@ -201,6 +274,20 @@ data-quality problem when the real cause was a rejected credential.
   platform/release catalogues those lookups are validated against. Catalogues MUST be retrieved
   from Cisco rather than hardcoded, so newly published releases and platforms are picked up
   without a tool release. No scraped or cached-as-authoritative alternatives.
+- Scope selectors: a published Cisco bundle page (an Event Response page announcing a bundled
+  advisory publication) MAY be read for two things only — *which* advisories a bundle contains, and
+  that bundle's own identity (its identifier, title, publication date and revision). It MUST NOT
+  supply any advisory fact: not a title, severity, score, CVE identifier, affected product, fixing
+  release, or publication date of an advisory. Every such fact MUST come from the advisory API even
+  when the page also displays it, and a disagreement between the two is resolved in the API's favour
+  without exception. A page that cannot be resolved to at least one advisory MUST be an error, never
+  an empty scope, because an empty result rendered as a report reads as an all-clear.
+
+  Rationale: this is what keeps the preceding bullet's prohibition substantive rather than merely
+  survived on a technicality. Cisco publishes no API equivalent of a bundle, so the page is the only
+  way to learn a bundle's membership — but membership is a *selector*, not a finding. Granting
+  exactly that and naming every field it may not supply prevents the page from becoming a second
+  authority over facts the API already owns, which is the failure Principle IV forbids.
 - Inputs/outputs: the inventory is a user-provided `.xlsx` (sheet `FW_List`) located in the
   current working folder; the report is written into an `output/` folder inside that same
   working folder as a timestamped `impact_report_*.html` file. The report MUST be a single
@@ -209,7 +296,12 @@ data-quality problem when the real cause was a rejected credential.
   naming variation. Advisory content received from Cisco MUST be treated as untrusted text that
   cannot alter the report's structure, styling, or behaviour.
 - Networking: the analyzer itself contacts only `apix.cisco.com` (Cisco PSIRT advisory data and
-  platform/release catalogues) and `id.cisco.com` (short-lived access token for that API).
+  platform/release catalogues), `id.cisco.com` (short-lived access token for that API), and
+  `sec.cloudapps.cisco.com` (a published bundle page, read solely to resolve a bundle to its
+  advisory identifiers and its own identity, within the limits of the Scope selectors bullet above).
+  The bundle-page request is unauthenticated — it MUST NOT carry the API credentials — and it MUST
+  carry no inventory-derived data whatsoever, not even the derived family/platform/release triple the
+  advisory API is permitted; the only value sent is the bundle identifier the user supplied.
   Version and update checks additionally contact
   GitHub — `api.github.com` and `github.com` — solely to discover the latest published
   release; they send no inventory or secrets and MUST be best-effort and time-bounded so
@@ -218,7 +310,8 @@ data-quality problem when the real cause was a rejected credential.
   package index); the tool orchestrates this rather than overlaying files in place. Adding
   any further external endpoint the analyzer itself contacts remains a reviewed change.
 - Consumers: this package is both the `caia` command and an importable library. The shared surface
-  defined in Principle VI is therefore a **released interface** — a consumer depends on a published
+  defined in Principle VI — `assessment`, `matching`, `psirt`, `inventory`, `erp`, and `bundle` — is
+  therefore a **released interface** — a consumer depends on a published
   release of it, never on a branch — so that surface MUST be documented in `README.md` and its
   changes MUST drive the version bump (see the versioning gate below). Modules outside the shared
   surface carry no such guarantee and MAY be reorganised freely.
@@ -292,4 +385,4 @@ Compliance is verified at review time. Dependent Spec Kit artifacts (plan, spec,
 tasks templates and their generated documents) MUST remain consistent with the principles
 above; the Constitution Check in the planning workflow enforces this on each feature.
 
-**Version**: 3.1.0 | **Ratified**: 2026-07-14 | **Last Amended**: 2026-07-27
+**Version**: 3.2.0 | **Ratified**: 2026-07-14 | **Last Amended**: 2026-07-28
diff --git a/README.md b/README.md
index 57d9a3f..1b4bb33 100644
--- a/README.md
+++ b/README.md
@@ -202,15 +202,48 @@ on it behaves exactly like the uv install — use it as described in [Run it](#r
 caia
 ```
 
-That's the whole thing. No link to paste, no mode to choose. The tool finds your inventory in
-that folder (if there's more than one candidate, it lists them and lets you pick), asks Cisco
-which published advisories apply to each firewall's software release on its exact hardware
-model, and writes **`impact_report_<date>_<time>.html`** into an **`output`** folder inside
-your current folder (created automatically). Open it in any browser.
+The tool finds your inventory in that folder (if there's more than one candidate, it lists them
+and lets you pick), asks whether you want to scope the report to one Cisco advisory bundle
+(press **Enter** to skip), asks Cisco which published advisories apply to each firewall's
+software release on its exact hardware model, and writes
+**`impact_report_<date>_<time>.html`** into an **`output`** folder inside your current folder
+(created automatically). Open it in any browser.
 
 Each run adds a new timestamped file, so previous reports are kept. Press **Ctrl+C** at any
 time to cancel cleanly.
 
+### Checking one advisory bundle
+
+Cisco publishes firewall vulnerabilities in **bundled publications** — one Event Response page
+listing every advisory released that day. When your team's review is triggered by one of those,
+paste its link at the prompt, or skip the prompt entirely:
+
+```bash
+caia --erp https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736
+```
+
+A bare identifier works too: `caia --erp ERP-75736`.
+
+The tool tells you which bundle it found and how many advisories it lists **before** it starts
+asking Cisco about your inventory, so a wrong link costs you nothing. The report then flips
+round: **one row per advisory in that bundle** rather than one row per firewall, each row
+showing the advisory, its publication date, and which of your products it impacts along with
+the release that fixes them. Advisories in the bundle that hit nothing still get a row — a
+clean result you can point at is worth more than a gap.
+
+Two things worth knowing:
+
+- **It is scoped on purpose.** Advisories affecting your fleet from *other* publications are
+  deliberately absent, and the report says how many it left out. It is not a whole-fleet
+  assessment; run `caia` with no bundle for that.
+- **Firewalls that couldn't be checked appear in every row they might belong to**, marked in
+  yellow and labelled *undetermined*. They are never counted as unaffected. If a row says
+  "0 impacted" it also tells you how many devices nobody could answer for.
+
+Because `--erp` needs no prompt, a bundle review can be scheduled or scripted. Exit status is
+`2` if the value isn't a bundle address, `1` if Cisco can't be reached or the page yields no
+advisories — and no report is written in either case.
+
 ### Understanding the output
 
 Every firewall gets exactly one status:
@@ -400,14 +433,17 @@ to suppress it everywhere.
 | `matching.py` | pure verdict logic: release normalisation, model→platform mapping, verdicts | ✅ |
 | `psirt.py` | the only module that talks to Cisco's advisory API | ✅ |
 | `inventory.py` | read the inventory workbook into per-firewall records | ✅ |
+| `erp.py` | the only module that talks to Cisco's Security Center: resolve a bundle page to its advisory identifiers | ✅ |
+| `bundle.py` | pure per-advisory aggregation: covered families, filtering, row construction | ✅ |
 | `cli.py` | single entry point; refuses removed options, then dispatches `--help`/`--version`/`--update`/`--uninstall`/`--config` and the run | |
 | `analyzer.py` | terminal run flow + interactive prompts (working-folder inventory + `output/`) | |
-| `html_report.py` | render the self-contained HTML report | |
+| `html_report.py` | render the self-contained HTML report, one row per firewall | |
+| `bundle_report.py` | render the bundle-scoped report, one row per advisory | |
 | `config.py` | per-user configuration (paths, precedence, `--config`) | |
 | `version.py` | installed version, GitHub release discovery, uv-based update | |
 | `ui.py` | terminal colors + prompts (no dependencies) | |
 
-**Shared surface.** The four modules marked above are the ones a consumer other than this
+**Shared surface.** The six modules marked above are the ones a consumer other than this
 CLI is expected to import; the rest are the terminal program built on top of them. The
 entry point is `assessment.analyze(inventory, client)` — it takes a list of per-device
 dicts (whatever produced them) plus a `psirt.Client` the caller owns, prints nothing,
@@ -417,6 +453,18 @@ in. The split exists so that a second consumer cannot drift from this tool's ver
 the rules that read Cisco's data live in one place, and anything that reimplements them
 reimplements the safety property in Constitution IV.
 
+For a bundle-scoped run, `erp.resolve(reference)` returns the bundle and
+`bundle.build_rows(bundle.advisory_ids, devices)` turns a completed assessment into one row
+per advisory. Both are headless for the same reason: the bundle-page parse and the
+covered-family derivation are the fragile parts, and a second consumer that reimplemented
+them would produce a second, divergent answer about which advisories are even in scope.
+
+**One rule about the bundle page.** It is a *scope selector*, never an authority. It supplies
+which advisories a bundle contains and the bundle's own identity — nothing else. Every advisory
+fact in the report (title, severity, score, CVEs, publication date, fixing release) comes from
+Cisco's API, even though the page displays all of them too. The constitution states this
+directly under Technology & Data Constraints → Scope selectors.
+
 The version is single-sourced from the committed `VERSION` file into the package metadata and
 reported at runtime via `importlib.metadata`. Devices sharing a product family, hardware
 platform and software release collapse into one question to Cisco, so a large inventory costs
diff --git a/VERSION b/VERSION
index ee74734..6aba2b2 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-4.1.0
+4.2.0
diff --git a/brds/005-erp-bundle-scoped-report.md b/brds/005-erp-bundle-scoped-report.md
new file mode 100644
index 0000000..80151ba
--- /dev/null
+++ b/brds/005-erp-bundle-scoped-report.md
@@ -0,0 +1,292 @@
+# Business Requirements Document (BRD): Bundle-Scoped Impact Reporting — Narrow the Assessment to a Cisco Event Response Bundle and Report per Advisory
+
+## Document Control
+
+| Field             | Value                                                        |
+| ----------------- | ------------------------------------------------------------ |
+| BRD ID            | BRD-005                                                      |
+| Title             | Bundle-Scoped Impact Reporting (`caia` accepts a Cisco Event Response URL and reports per advisory) |
+| Author            | Ali Bahaloo / TELUS Digital                                  |
+| Status            | Draft                                                        |
+| Version           | 0.1.0                                                        |
+| Created           | 2026-07-28                                                   |
+| Last updated      | 2026-07-28                                                   |
+| Related documents | Repo: https://github.com/xavient/caia-cli · BRD-003 (Inventory-Driven Vulnerability Check via the Cisco PSIRT API): `brds/003-api-inventory-check.md` · BRD-004 (Decommission the FueliX AI Analyzer): `brds/004-decommission-fuelix-ai-analyzer.md` · Constitution: `.specify/memory/constitution.md` · Spec 006: `specs/006-api-inventory-check/spec.md` · PSIRT access contract: `specs/006-api-inventory-check/contracts/psirt-access.md` · HTML report contract: `specs/006-api-inventory-check/contracts/html-report.md` · Cisco PSIRT openVuln API: https://developer.cisco.com/docs/psirt/ · Example bundle: https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736 |
+
+## 1. Executive Summary
+
+Cisco publishes its Secure Firewall vulnerabilities in **bundled publications** — a single Event Response page listing every advisory released that day (ERP-75736, 4 March 2026, lists 25 advisories covering 48 CVEs across ASA, FMC and FTD). The ops team's actual job is bounded by one of those bundles: *"this bundle dropped — what in our fleet does it hit, and what do we patch?"* The tool today answers a broader question the other way round: one row per firewall, listing everything Cisco says about it. This BRD adds a bundle-scoped mode — the user pastes an Event Response URL, the tool narrows the assessment to the advisories in that bundle, and the HTML report inverts to **one row per advisory in the bundle**, showing the advisory identifier as a link, its publication date, and the products it impacts. Devices the tool could not conclusively assess are carried into every row they could belong to and marked as unknown, never quietly counted as clean.
+
+## 2. Business Context & Problem Statement
+
+The inventory-driven check delivered by BRD-003 is accurate and authoritative, but it is oriented along the wrong axis for the work the ops team actually does.
+
+- **The unit of work is an advisory, not a firewall.** A patch decision is made per advisory: it has a severity, a fix release, and a change window. The report today is one row per firewall with advisories nested underneath, so the thing an engineer must act on is the thing they have to reassemble by hand.
+- **The bundle boundary is invisible.** Cisco's bundled publications are the trigger for the team's review cycle, and nothing in the tool knows a bundle exists. Measured against the current 70-row inventory, a full run reports **55 devices impacted by something**, spread across dozens of advisories published over several years. To answer *"what does ERP-75736 mean for us?"* someone must open the Event Response page, read 25 advisory titles, and then scan a 70-row report to work out which findings belong to the bundle and which are older noise. That reconciliation is manual, repeats on every bundle, and is exactly the kind of cross-referencing that silently drops a row.
+- **The answer the team wants already exists in the data — it is just not rendered.** A trial run against ERP-75736 shows **24 of the 25 advisories touch at least one device**, with per-advisory impact ranging from 0 to 50 devices. That table is the deliverable. Producing it needs no new data source: the advisory identifier and publication date are already inside the payload the tool retrieves for every device today.
+- **The undecided devices are the real hazard.** In the same run, **15 of 70 devices resolved to `Needs review`** — Cisco does not hold their release string, or does not list that release for their hardware. If a bundle-scoped report shows only positively-confirmed hits, those 15 devices vanish, and a row reading "3 impacted" is read as "the other 67 are fine." For 15 of them that is not a claim anyone made. Principle IV forbids it, and a per-advisory layout makes it much easier to commit than the per-device layout does.
+- **The narrowing itself must be disclosed.** Filtering to a bundle deliberately suppresses findings — advisories that genuinely affect the fleet but were published in some other bundle. A report that hides that would read as a full fleet assessment while being a partial one. That is a new failure mode this feature creates, and it has to be designed out rather than discovered later.
+
+The cost of inaction is a review cycle where the authoritative data is present but the team still assembles the actual answer in a spreadsheet, once per bundle, with no record of what was left out.
+
+## 3. Business Objectives & Goals
+
+- **G1** — Let a user scope a run to one Cisco bundled publication by pasting its Event Response URL, with no manual transcription of advisory identifiers.
+- **G2** — Deliver the report along the axis the work happens on: one row per advisory in the bundle, showing which products it impacts.
+- **G3** — Make an advisory in the bundle that impacts nothing an explicit, visible result, so a clean outcome is evidence rather than an absence.
+- **G4** — Guarantee that a device the tool could not conclusively assess is never rendered, counted, or summarised as unaffected in any bundle row.
+- **G5** — Make the report state plainly what the bundle filter suppressed, so it can never be mistaken for a whole-fleet assessment.
+- **G6** — Keep every displayed advisory fact sourced from Cisco's API, using the Event Response page only to learn *which advisories are in scope*.
+- **G7** — Preserve today's behaviour for a user who does not supply a bundle: same verdicts, same whole-fleet report, same exit statuses.
+- **G8** — Keep the mode usable unattended, so a bundle review can be scripted or scheduled rather than typed.
+
+## 4. Stakeholders & Users
+
+| Stakeholder / user | Role in this product | What they need from it |
+| ------------------ | -------------------- | ---------------------- |
+| Security / network analyst | Primary user | To paste the bundle link Cisco emailed them and get back the per-advisory impact table, without transcribing 25 identifiers |
+| Firewall / patching engineer | Downstream actor | Per advisory: which devices, and the release that fixes it — the worklist for a change window |
+| Team lead / security manager | Reviewer, reporting | A defensible per-advisory record of the bundle review, including what was undecided and what was out of scope |
+| Inventory owner / CMDB steward | Indirectly accountable | To see which inventory rows caused an undecided result, and what to correct so the next bundle review is conclusive |
+| IT / security review | Reviewer | Confidence that verdicts still come only from Cisco's API, that a scraped page cannot introduce a fact, and that no device identity leaves the machine |
+| Maintainers | Owners | One assessment engine feeding two report shapes, with the verdict rules unchanged and untouched |
+| Automation / scheduled job | Non-interactive consumer | A way to run a bundle review without a prompt |
+
+## 5. Scope
+
+### 5.1 In Scope
+
+- Prompting for a Cisco Event Response URL as part of a normal run, after the inventory is located.
+- Accepting the same URL non-interactively so a bundle review can be scripted.
+- Resolving an Event Response URL to the set of advisory identifiers it publishes.
+- Narrowing the completed assessment to the advisories in that bundle.
+- A bundle-scoped HTML report laid out one row per advisory in the bundle, carrying: the advisory identifier as a link that opens in a new tab, the advisory's publication date, and the impacted products.
+- Rendering products whose status for a given advisory could not be determined as visually distinct (yellow) and explicitly labelled as undetermined.
+- Rendering advisories in the bundle that impact nothing as present-and-clean rows.
+- Disclosing, in the report, how many findings the bundle filter suppressed.
+- Retaining the current whole-fleet report for runs where no bundle is supplied.
+- Failure handling for an unreachable, unrecognised, or empty Event Response page.
+
+### 5.2 Out of Scope
+
+- **Changing any verdict rule.** Release normalisation, model-to-platform mapping, and the `Impacted` / `Not impacted` / `Needs review` decision table are untouched. This feature filters and re-renders an assessment; it does not produce one.
+- **Treating the Event Response page as a source of advisory facts.** Titles, severities, CVEs, scores and dates come from Cisco's API even when the page also shows them. The page contributes a list of identifiers and nothing else.
+- **More than one bundle per run.** One bundle, one report.
+- **Arbitrary Cisco URLs.** Individual advisory pages, security bulletins, and non-Cisco vulnerability feeds are not accepted inputs. A single-advisory mode is a plausible successor feature, not this one.
+- **CVE-level rows.** Rows are per advisory; an advisory's CVEs are shown within its row. A bundle where several advisories share a CVE is not decomposed.
+- **Remediation tracking.** No state is carried between runs — no "patched since last bundle", no ticket integration, no history. Each report is a point-in-time record.
+- **Caching the bundle offline.** The Event Response page is fetched per run. Snapshotting bundles for air-gapped use is not included.
+- **Removing or restyling the existing whole-fleet report.** It remains the output when no bundle is supplied. Whether the bundle report eventually replaces it is an open question (§13), not a commitment here.
+- **Inferring which advisories *should* have been in a bundle.** The bundle's membership is whatever Cisco publishes on that page.
+
+## 6. User Journeys *(feeds the spec's prioritized user stories)*
+
+### Journey 1 — Review a bundled publication against the fleet (Priority: P1)
+
+- **Actor:** Security / network analyst
+- **Trigger:** Cisco publishes a bundled publication; the analyst has the Event Response link.
+- **Outcome / value:** One HTML report, one row per advisory in that bundle, showing exactly which products each advisory impacts and which could not be determined — the whole bundle review in a single artifact, with no manual cross-referencing.
+- **Flow:**
+  1. The analyst runs the tool in the folder holding the inventory.
+  2. The tool locates the inventory as it does today, and prompts for an Event Response URL.
+  3. The analyst pastes the URL.
+  4. The tool confirms what it found — the bundle's identifier, title, and the number of advisories it lists — before doing any work against the inventory.
+  5. The tool assesses the inventory against Cisco's data as it does today, reporting progress.
+  6. The tool narrows the result to the bundle's advisories and writes the report.
+  7. The analyst opens the report: one row per bundle advisory, ordered deterministically, each row showing the advisory identifier as a link, its publication date, the products impacted, and the products whose status is undetermined.
+- **Acceptance:**
+  - **Given** a valid Event Response URL listing 25 advisories and an inventory of 70 devices, **When** the run completes, **Then** the report contains exactly 25 advisory rows — one per advisory in the bundle, including any that impact nothing.
+  - **Given** an advisory in the bundle that Cisco lists against 5 inventory devices, **When** the analyst reads that row, **Then** all 5 devices are named, and the release that first fixes the advisory is shown for each.
+  - **Given** an advisory row, **When** the analyst clicks the advisory identifier, **Then** Cisco's published advisory opens in a new tab.
+  - **Given** any advisory row, **When** the analyst reads it, **Then** it shows the advisory's publication date as published by Cisco.
+  - **Given** a device the tool could not conclusively assess, **When** it appears in an advisory row, **Then** it is visually distinct (yellow) and labelled as undetermined, and it is not included in any count of impacted or unaffected products.
+  - **Given** the assessment found advisories affecting the fleet that are not in the bundle, **When** the analyst reads the report, **Then** the report states how many such findings were suppressed by the bundle filter.
+  - **Given** an advisory in the bundle that impacts no inventory device, **When** the analyst reads its row, **Then** the row is present and states that nothing in the inventory is impacted, alongside the count of devices whose status was undetermined.
+
+### Journey 2 — Undecided devices are actionable, not just flagged (Priority: P2)
+
+- **Actor:** Inventory owner / CMDB steward
+- **Trigger:** A bundle report shows devices with undetermined status.
+- **Outcome / value:** A named list of those devices with the reason each could not be assessed, so the underlying inventory data can be corrected and the next bundle review comes back conclusive.
+- **Flow:**
+  1. The steward opens the bundle report.
+  2. A dedicated section lists every device whose assessment was undetermined, exactly once.
+  3. Each entry gives the device, its recorded hardware and release, and the reason — for example that Cisco does not hold that release string, or does not list it for that hardware.
+  4. The steward corrects the inventory and the next run resolves those devices.
+- **Acceptance:**
+  - **Given** 15 devices with an undetermined assessment, **When** the steward opens the report, **Then** all 15 are listed once each with a human-readable reason.
+  - **Given** a device whose recorded release Cisco does not list for its hardware, **When** the steward reads its entry, **Then** the entry shows both what the inventory recorded and what Cisco was asked, so the field to correct is evident.
+
+### Journey 3 — Run a bundle review unattended (Priority: P2)
+
+- **Actor:** Automation / scheduled job, or an analyst reviewing several bundles in succession
+- **Trigger:** A scheduled review, or a batch of bundles to work through.
+- **Outcome / value:** The same bundle-scoped report with no interactive prompt, so the review can be scripted.
+- **Flow:**
+  1. The job invokes the tool with the Event Response URL supplied up front.
+  2. The tool performs the same run as Journey 1 without prompting.
+  3. The report is written and the exit status reflects the outcome.
+- **Acceptance:**
+  - **Given** the URL is supplied up front, **When** the tool runs with no terminal attached, **Then** it never prompts and writes the same report Journey 1 produces.
+  - **Given** the supplied URL cannot be resolved to a bundle, **When** the tool runs unattended, **Then** it fails with a distinct, non-zero exit status and writes no report.
+
+### Journey 4 — Skip the bundle and get today's report (Priority: P2)
+
+- **Actor:** Existing user
+- **Trigger:** A run where the user wants the whole-fleet view, or has no bundle to hand.
+- **Outcome / value:** Existing behaviour, unchanged — no new obligation imposed on users who do not need bundle scoping.
+- **Flow:**
+  1. The user runs the tool.
+  2. At the Event Response prompt, the user declines.
+  3. The tool produces today's whole-fleet report.
+- **Acceptance:**
+  - **Given** the user declines at the prompt, **When** the run completes, **Then** the report is the current whole-fleet report, with the same verdicts and reasons as before this feature.
+  - **Given** no bundle is supplied non-interactively, **When** the tool runs, **Then** it behaves exactly as it does today.
+
+### Journey 5 — Recover from a bad bundle link (Priority: P3)
+
+- **Actor:** Security / network analyst
+- **Trigger:** A mistyped, stale, or non-bundle URL, or Cisco's site being unreachable.
+- **Outcome / value:** A clear statement of what went wrong and what to do, without losing the run or producing a misleading report.
+- **Flow:**
+  1. The analyst pastes a URL that cannot be resolved to a bundle.
+  2. The tool says which of the distinguishable failures occurred — not a Cisco URL, page unreachable, page reachable but no advisories found — and re-prompts.
+  3. The analyst corrects the URL, or declines and gets the whole-fleet report.
+- **Acceptance:**
+  - **Given** a URL that is not a Cisco Event Response address, **When** it is submitted, **Then** the tool rejects it before making any network request and re-prompts.
+  - **Given** Cisco's site cannot be reached, **When** the tool tries to resolve the bundle, **Then** it says the failure is connectivity and not a bad link, and no partial or empty bundle report is written.
+  - **Given** a reachable page from which no advisory identifiers can be extracted, **When** the tool reports it, **Then** it says so explicitly rather than proceeding with an empty bundle, and writes no report.
+
+## 7. Business Requirements
+
+| ID    | Requirement                          | Priority |
+| ----- | ------------------------------------ | -------- |
+| **Bundle input** | | |
+| BR-01 | The product MUST prompt for a Cisco Event Response URL during a normal run, after the inventory is located and before any request about the inventory is made. | P1 |
+| BR-02 | The product MUST accept the same URL supplied up front so a bundle review needs no prompt, and MUST NOT prompt at all when it is supplied that way. | P2 |
+| BR-03 | The product MUST allow the user to decline the prompt, and MUST then produce the current whole-fleet report with behaviour identical to today. | P2 |
+| BR-04 | The product MUST validate that a submitted URL is a Cisco Event Response address before making any network request, and MUST reject anything else with a message naming the expected form. | P1 |
+| BR-05 | The product MUST accept the URL in the form Cisco publishes it, and SHOULD additionally accept a bare bundle identifier (e.g. `ERP-75736`). | P3 |
+| **Resolving the bundle** | | |
+| BR-06 | The product MUST resolve an Event Response URL to the complete set of advisory identifiers that bundle publishes. | P1 |
+| BR-07 | The product MUST use the Event Response page **only** to determine which advisories are in scope. It MUST NOT take any advisory fact — title, severity, score, CVE, date, fix release, or affected product — from that page. | P1 |
+| BR-08 | The product MUST source every advisory fact it displays from Cisco's advisory API, including for advisories in the bundle that impact no inventory device. | P1 |
+| BR-09 | The product MUST confirm what it resolved — bundle identifier, bundle title, and advisory count — before beginning work against the inventory, so a wrong link is caught before the run is spent. | P2 |
+| BR-10 | The product MUST distinguish, and report differently, these outcomes: the URL is not a bundle address; Cisco could not be reached; the page was reached but yielded no advisory identifiers. | P1 |
+| BR-11 | The product MUST NOT write a bundle report when the bundle could not be resolved, and MUST exit with a non-zero status that a script can distinguish from a successful run. | P1 |
+| BR-12 | The product MUST treat everything retrieved from the Event Response page as untrusted input that cannot alter the report's structure, styling, or behaviour, and cannot become executable content. | P1 |
+| **Filtering** | | |
+| BR-13 | The product MUST assess the inventory using the existing rules, then narrow the result to the bundle's advisories. The narrowing MUST NOT change any device's verdict. | P1 |
+| BR-14 | The product MUST report how many distinct advisories affecting the inventory were suppressed by the bundle filter, so the report cannot be mistaken for a whole-fleet assessment. | P1 |
+| BR-15 | The product MUST produce a row for every advisory in the bundle, including advisories that impact no inventory device. | P1 |
+| **Report layout** | | |
+| BR-16 | The report MUST be laid out one row per advisory in the bundle. | P1 |
+| BR-17 | Each row MUST show the advisory identifier as a link to Cisco's published advisory that opens in a new tab without granting the opened page access to the report. | P1 |
+| BR-18 | Each row MUST show the advisory's publication date as published by Cisco. | P1 |
+| BR-19 | Each row MUST name every inventory product Cisco lists as impacted by that advisory. | P1 |
+| BR-20 | Each row MUST show, for each impacted product, the release Cisco lists as first fixing that advisory; a fix release Cisco does not supply MUST be shown as absent, never inferred. | P1 |
+| BR-21 | Each row MUST render products whose status for that advisory could not be determined in a visually distinct way (yellow) and MUST label them as undetermined rather than leaving colour to carry the meaning alone. | P1 |
+| BR-22 | Each row MUST account for every in-scope device exactly once across impacted, confirmed unaffected, and undetermined, so the row's numbers can be checked against the inventory size. | P1 |
+| BR-23 | An undetermined device MUST appear in every bundle row whose advisory could apply to it, and MUST NOT be omitted from a row merely because its status there is unknown. Where the advisory's applicability to that device cannot be established, the product MUST include it rather than omit it. | P1 |
+| BR-24 | The report MUST NOT present, count, or summarise an undetermined device as unaffected anywhere, including in totals, headline figures, and per-row counts. | P1 |
+| BR-25 | The report MUST order advisory rows deterministically, so two runs over the same inputs produce the same document order. | P1 |
+| BR-26 | The report MUST list every undetermined device once, with the hardware and release the inventory recorded, what was asked of Cisco, and a human-readable reason. | P2 |
+| BR-27 | The report MUST identify the bundle it covers — identifier, title, and Cisco's publication date — and link to the Event Response page. | P2 |
+| BR-28 | The report MUST remain a single self-contained file that renders with no network access, and MUST NOT overwrite an existing report. | P1 |
+| BR-29 | The report SHOULD let a reader filter and sort the advisory rows, at least by severity and by number of impacted products. | P3 |
+| BR-30 | The report SHOULD provide a per-device cross-reference so a reader can go from a device to every bundle advisory affecting it. | P3 |
+| **Cross-cutting** | | |
+| BR-31 | Resolving a bundle MUST NOT transmit any inventory-derived data. Nothing about any device may be sent to the Event Response page. | P1 |
+| BR-32 | A run that stops early MUST keep every answer already obtained, report that it was partial and why, and leave unreached devices undetermined — matching today's behaviour. | P1 |
+| BR-33 | The capability MUST be usable without a terminal: bundle resolution and filtering MUST NOT prompt, print, or exit the process. Prompting and report writing remain terminal concerns. | P1 |
+| BR-34 | The added network cost of a bundle-scoped run MUST stay within Cisco's published quotas, and SHOULD add no more requests than the number of bundle advisories that impact nothing. | P2 |
+
+## 8. Success Metrics & Measurable Outcomes
+
+- **SC-01** — An analyst can go from a pasted Event Response URL to a complete per-advisory impact report in one command, with no manual transcription of advisory identifiers and no cross-referencing by hand.
+- **SC-02** — For a bundle of 25 advisories, the report contains 25 advisory rows; the count matches the bundle page exactly, with no advisory missing and none invented.
+- **SC-03** — Every advisory row's product counts sum to the number of in-scope devices, so the report is internally checkable against the inventory.
+- **SC-04** — No device with an undetermined assessment appears as unaffected anywhere in the report; each is reachable from every row it could belong to and is listed once with a reason.
+- **SC-05** — Every advisory fact rendered in the report is present in Cisco's API response for that advisory; none originates from the Event Response page.
+- **SC-06** — A user who declines the bundle prompt gets a report byte-for-byte equivalent in content to the one produced before this feature.
+- **SC-07** — Each of the three bundle-resolution failures — not a bundle address, unreachable, no advisories found — produces a distinct message, and none produces a report.
+- **SC-08** — A bundle review of a 70-device inventory completes within roughly the time a whole-fleet run takes today, and stays within Cisco's per-minute and per-day quotas.
+- **SC-09** — The report states the number of suppressed out-of-bundle findings, and a reader can tell from the report alone that it is bundle-scoped rather than whole-fleet.
+
+## 9. Assumptions
+
+Each of these was verified against the live sources on 2026-07-28 using ERP-75736 and the current 70-row inventory, rather than assumed from documentation.
+
+- **The bundle's advisory list is machine-readable from the Event Response page.** The page returns HTTP 200 in under a second and yields exactly its 25 advisory identifiers by extracting them from the advisory links in its table. The identifiers are **not** present in the page's visible text — only in the links — so text extraction alone is insufficient.
+- **The advisory identifier and publication date are already in the data the tool retrieves.** Every advisory object returned for a device carries `advisoryId`, `advisoryTitle`, `sir`, `cvssBaseScore`, `cves`, `publicationUrl`, `firstPublished`, and the per-platform first-fix release. Filtering an assessment to a bundle therefore costs no additional requests, and the publication date needs no separate lookup for any advisory that impacts at least one device.
+- **Advisories in the bundle that impact nothing need their own lookup.** Such an advisory never appears in any device's result, so its title and publication date must be fetched individually. In ERP-75736 that is 1 advisory of 25; the worst case is the bundle size.
+- **There is no bundle endpoint in Cisco's API.** A request for the bundle by identifier returns HTTP 404. Resolving a bundle to its advisories requires reading the published page. A date-window query over Cisco's API returns a superset of a bundle's advisories (27 for ERP-75736's publication date, including 2 unrelated same-day publications), which is a viable cross-check but not a substitute for the bundle's actual membership.
+- **A device with an undetermined assessment has no advisory list at all.** Cisco was never able to answer for it, so its status against any specific advisory is genuinely unknown — it cannot be placed in an advisory row as a fact, and it cannot be excluded as clean. This is the structural reason BR-21 through BR-24 exist.
+- **Bundle-scoped runs assess the whole inventory.** Narrowing the assessment itself to the families a bundle names would be an optimisation, but it depends on interpreting Cisco's product-name strings, and a family named only in an advisory's prose would be missed. The safe default is to assess the whole inventory and filter afterwards; a whole-inventory run over 70 devices costs 32 requests and about 72 seconds, so the optimisation buys little.
+- **Bundle membership is stable enough to fetch per run.** Event Response pages are versioned and revised occasionally; fetching per run means a revision is picked up without a tool release.
+- **Products in a row are identified the way the inventory names them**, so a reader can match a row back to their own records.
+
+## 10. Constraints
+
+- **Constitution IV (Conservative & Traceable Analysis, non-negotiable).** Every verdict must remain traceable to Cisco's published API data. The bundle page may contribute scope only — never a fact, and never a verdict. An undetermined device must never be presented as unaffected. This constrains the report layout directly and is the source of BR-07, BR-08, and BR-21 through BR-24.
+- **Constitution: "No scraped or cached-as-authoritative alternatives."** Reading the Event Response page is permitted here only because it supplies a *set of identifiers to filter by*, and every fact displayed is independently retrieved from the API. The spec must make that boundary explicit and testable, not merely intended.
+- **Constitution: Networking.** The analyzer today contacts only `apix.cisco.com` and `id.cisco.com`. Fetching an Event Response page adds `sec.cloudapps.cisco.com` as an endpoint the analyzer itself contacts, which the constitution designates a reviewed change. **This BRD requires a constitution amendment before implementation** — the same gate BRD-003 passed through for the API hosts.
+- **Constitution V (Secrets Hygiene & Data Locality).** Bundle resolution must send no inventory-derived data. The existing bound — only family, platform, and release may leave the machine — is unchanged and must not be widened.
+- **Constitution VI (Headless Shared Surface).** Bundle resolution and filtering must be callable without a terminal: no printing, prompting, working-folder access, file writing, or process exit. The prompt, the confirmation, and the report belong to the terminal layer. A failure to *reach* Cisco must surface as an error, not as a set of undecided verdicts.
+- **Constitution I (Standard-Library-First).** No new runtime dependency for fetching or parsing the Event Response page.
+- **Constitution II (Cross-Platform Parity)** and **III (CLI-First, Scriptable)**. Identical behaviour on macOS, Windows, and Linux; and because the prompt cannot be the only route in, the non-interactive path (BR-02) is a constitutional requirement rather than a convenience.
+- **Report constraints carry over.** Single self-contained file, renders with no network access, never overwritten, and all Cisco-supplied content treated as untrusted text. Content from the Event Response page inherits the same treatment.
+- **Cisco's quotas** — 5 requests/second, 30/minute, 5,000/day — and the existing pacing continue to apply.
+- **Coverage inherited from Cisco.** The API holds ASA, FMC, FTD and FXOS data only from January 2022 onward. A bundle predating that window cannot be answered, and the report must not present the resulting silence as a clean result.
+
+## 11. Dependencies
+
+- **Cisco PSIRT openVuln API** (`apix.cisco.com`, `id.cisco.com`) — input; the sole source of every advisory fact and every verdict. Unchanged by this feature.
+- **Cisco Security Center Event Response pages** (`sec.cloudapps.cisco.com`) — input; supplies the set of advisory identifiers in a bundle. New endpoint; see §10.
+- **The existing assessment capability** (BRD-003 / spec 006) — input; produces the per-device result this feature filters. Must be reused, not reimplemented.
+- **The existing HTML report capability** — this feature adds a second layout alongside it; both must keep the self-containment and escaping guarantees.
+- **The user's inventory workbook** — input, unchanged in format.
+- **Cisco PSIRT API credentials** — input, unchanged; the tool must still refuse to run without them.
+- **The project constitution** — must be amended for the new endpoint before implementation; output of that amendment gates this work.
+
+## 12. Risks & Mitigations
+
+| Risk   | Impact | Likelihood | Mitigation |
+| ------ | ------ | ---------- | ---------- |
+| An undetermined device is read as unaffected in a per-advisory row — the layout invites it far more than the per-device layout does | H | M | BR-21 through BR-24: undetermined devices carried into every row they could belong to, labelled in words as well as colour, excluded from every count of impacted or unaffected, and each row's numbers made to sum to the in-scope device count so an omission is visible |
+| A bundle-scoped report is mistaken for a whole-fleet assessment, and out-of-bundle exposure goes unpatched | H | M | BR-14 and BR-27: the report names the bundle it covers and states how many findings the filter suppressed |
+| Cisco changes the Event Response page's markup and bundle resolution silently returns fewer advisories, or none | H | M | BR-09 confirms the resolved advisory count to the user before the run; BR-10 and BR-11 make an empty result an explicit failure that writes no report, never a silently empty bundle |
+| Colour alone conveys the undetermined state, failing print, greyscale, and colour-blind readers | M | H | BR-21 requires an explicit label alongside the colour |
+| An advisory in the bundle affects a product family absent from the inventory, and its zero-impact row is read as reassurance about products the tool never assessed | M | M | BR-22's per-row accounting makes the in-scope device population explicit for every row |
+| A bundle predates Cisco's data coverage, so nothing can be answered and silence looks clean | M | L | §10 records the coverage boundary; the spec must require it to be surfaced rather than absorbed |
+| The added lookups for zero-impact advisories push a large bundle toward the quota | L | L | BR-34 bounds the additional requests at the bundle's advisory count; measured worst case is far inside the daily quota |
+| The bundle page is reachable but slow, stalling a run before any useful work | L | M | Bundle resolution happens before the inventory work (BR-01) and must be time-bounded, so a stall fails fast and cheaply |
+| Two report layouts diverge in their treatment of undetermined devices | M | M | BR-33 keeps one assessment feeding both layouts; the verdict rules stay in one place per Constitution VI |
+
+## 13. Open Questions
+
+- **What is the counting unit for "impacted products"?** A trial run shows `CVE-2026-20079` impacting **5 devices**, which sit on **2 distinct affected releases** and **3 model/release combinations**. The originating request described this case as "2 products", suggesting distinct release rather than device is the intended unit. The report should probably lead with the device count and roll up by release beneath it — but this needs settling explicitly, because it changes every number in the report.
+- **Does the bundle report eventually replace the whole-fleet report, or stand alongside it permanently?** BR-03 keeps both for now. If it replaces it, that is a breaking change to the product's primary output and should drive a MAJOR version bump; if it stands alongside, the shared surface only gains and a MINOR bump suffices.
+- **How should advisory rows be ordered by default?** Severity first, then impacted count, is the obvious candidate; bundle-page order is the alternative and is arguably more auditable against Cisco's own publication. BR-25 requires only that the order be deterministic.
+- **Should a bundle row distinguish "no devices of this family in the inventory" from "devices of this family were checked and are clean"?** Both currently render as zero impacted, and they mean very different things to a reader.
+- **Should the date-window cross-check be used?** A date-window query over Cisco's API returns a superset of a bundle's advisories and could flag a page-parsing regression by disagreeing with the scraped list. Worth one request, or unnecessary complexity?
+- **Should a resolved bundle be recorded in the report as raw evidence** — the identifier list as resolved — so a reader can audit the scope the report claims?
+- **Is a single-advisory mode wanted next?** The same mechanism answers "does this one advisory affect us?" for a single identifier or CVE. Out of scope here, but it is the natural successor and may influence how the input is modelled.
+
+## 14. Glossary
+
+| Term   | Definition   |
+| ------ | ------------ |
+| Advisory | A single Cisco Security Advisory, identified by a `cisco-sa-…` identifier, covering one or more CVEs. |
+| Bundled publication | Cisco's practice of releasing many Secure Firewall advisories on one date, announced together on a single page. |
+| Event Response (ERP) page | The Cisco Security Center page announcing a bundled publication and listing the advisories it contains. Identified as `ERP-#####`. |
+| Bundle | Within this document, the set of advisories one Event Response page publishes. The unit of scope this feature introduces. |
+| Bundle-scoped report | The new report layout: one row per advisory in the bundle. |
+| Whole-fleet report | The existing report layout: one row per inventory device. |
+| Impacted | Cisco positively listed the advisory as applying to that device's software release on its hardware platform. |
+| Not impacted / confirmed unaffected | Cisco confirmed both that it recognises the release and that the release runs on that hardware, and returned no advisory. Only ever a positive confirmation. |
+| Undetermined / Needs review | The tool could not conclusively assess the device — the release is unknown to Cisco, is not listed for that hardware, a required field is missing, or the request could not be completed. Never presented as unaffected. |
+| First fix | The release Cisco lists as first resolving a given advisory on a given platform. The field an engineer acts on. |
+| In-scope device | An inventory device belonging to a product family the tool can query, and therefore counted in a bundle row's accounting. |
+| Suppressed finding | An advisory affecting the inventory that is not in the reviewed bundle, and is therefore absent from the bundle-scoped report. |
+| Shared surface | The modules that produce a verdict and must remain callable without a terminal (Constitution VI). |
diff --git a/caia/analyzer.py b/caia/analyzer.py
index c10ff5f..fdddd23 100644
--- a/caia/analyzer.py
+++ b/caia/analyzer.py
@@ -22,16 +22,21 @@
 import sys
 from pathlib import Path
 
-from caia import assessment, config, html_report, matching, psirt
+from caia import assessment, bundle_report, config, erp, html_report, matching, psirt
 from caia import inventory as inv
 from caia import ui
 
+# Exit codes, reusing the vocabulary the tool already has rather than adding to it:
+# 2 is an argument error (argparse's own convention, see `cli`), 1 is a run failure.
+EXIT_BAD_ARGUMENT = 2
+EXIT_RUN_FAILED = 1
 
-def die(msg, hint=None):
+
+def die(msg, hint=None, code=EXIT_RUN_FAILED):
     ui.fail(msg)
     if hint:
         ui.plain(ui.dim(hint))
-    sys.exit(1)
+    sys.exit(code)
 
 
 def default_output_dir():
@@ -122,6 +127,98 @@ def _result_line(adv_id, label, color, stream=None):
     print(line, file=stream or sys.stdout)
 
 
+# --------------------------------------------------------------------------- #
+# Bundle scope
+# --------------------------------------------------------------------------- #
+BUNDLE_PROMPT = ("Cisco advisory bundle URL (press Enter for a whole-fleet report)")
+
+
+def _announce_bundle(resolved):
+    """Show what was resolved, before the run spends anything.
+
+    The advisory count is the load-bearing part: it is the check that catches a page-structure
+    change silently yielding 24 of 25, because the person reading it knows the answer.
+    """
+    ui.ok(f"Bundle {ui.bold(resolved.bundle_id)} — "
+          f"{ui.bold(str(len(resolved)))} advisories.")
+    if resolved.title:
+        ui.plain(ui.dim(f"  {resolved.title}"))
+    if resolved.published:
+        ui.plain(ui.dim(f"  published {resolved.published}"))
+
+
+def resolve_bundle(reference=None, interactive=True, opener=None):
+    """Resolve the bundle to scope this run to, or None for a whole-fleet report.
+
+    With `--erp` (reference) the value is used directly and any failure is fatal, so an
+    unattended caller gets a status it can act on rather than a silently different report.
+    Interactively, each of the three failures is reported distinguishably and another attempt
+    is offered; declining falls back to the whole-fleet report rather than exiting with no
+    output (FR-003, FR-010, FR-011).
+    """
+    if reference:
+        try:
+            resolved = erp.resolve(reference, opener=opener)
+        except erp.ErpNotABundleError as e:
+            die(str(e), code=EXIT_BAD_ARGUMENT)
+        except erp.ErpError as e:
+            die(str(e), hint="No report was written.", code=EXIT_RUN_FAILED)
+        _announce_bundle(resolved)
+        return resolved
+
+    if not interactive:
+        return None
+
+    while True:
+        answer = (ui.ask(BUNDLE_PROMPT) or "").strip()
+        if not answer:
+            return None
+        try:
+            resolved = erp.resolve(answer, opener=opener)
+        except erp.ErpNotABundleError as e:
+            ui.warn(str(e))
+            continue
+        except erp.ErpUnreachableError as e:
+            ui.warn(str(e))
+            continue
+        except erp.ErpBundleMismatchError as e:
+            ui.warn(str(e))
+            continue
+        except erp.ErpNoAdvisoriesError as e:
+            ui.warn(str(e))
+            continue
+        _announce_bundle(resolved)
+        return resolved
+
+
+def fetch_missing_records(client, bundle, devices):
+    """Facts for bundle advisories that impact nothing, which no device's result carries.
+
+    One request each; measured at 1 of 25 for the reference bundle. A lookup that fails
+    leaves the row without facts rather than inventing them, which is the conservative
+    behaviour Principle IV requires.
+    """
+    from caia import bundle as bundle_logic
+
+    missing = bundle_logic.missing_records(bundle.advisory_ids, devices)
+    if not missing:
+        return {}
+    ui.plain()
+    one = len(missing) == 1
+    ui.system(f"Fetching details for {len(missing)} bundle "
+              f"advisor{'y' if one else 'ies'} that "
+              f"{'impacts' if one else 'impact'} nothing ...")
+    records = {}
+    for advisory_id in missing:
+        try:
+            record = client.get_advisory(advisory_id)
+        except psirt.PsirtError:
+            record = None
+        if record:
+            records[advisory_id] = record
+    return records
+
+
 # --------------------------------------------------------------------------- #
 # Run flow
 # --------------------------------------------------------------------------- #
@@ -166,7 +263,11 @@ def run(args):
         die(f"Inventory {inv_path} has no firewall rows.")
     ui.ok(f"Loaded {ui.bold(str(len(inventory)))} firewalls from {ui.bold(inv_path.name)}.")
 
-    # 3. Catalogues, then one question per distinct check.
+    # 3. Bundle scope — resolved before any advisory request, so a wrong link costs nothing.
+    ui.plain()
+    scope = resolve_bundle(getattr(args, "erp", None), interactive)
+
+    # 4. Catalogues, then one question per distinct check.
     client = psirt.Client(client_id, client_secret)
     ui.plain()
     ui.system("Fetching Cisco platform and release catalogues ...")
@@ -192,14 +293,21 @@ def report_progress(index, total, check):
         die(f"Could not reach Cisco: {e}",
             hint="Check your connection or proxy and try again.")
 
-    # 4. Verdicts.
+    # 5. Verdicts.
     summary = _build_summary(inv_path, devices, partial_cause)
     _print_verdict_tally(summary)
 
-    # 5. Report.
+    # 6. Report — bundle-scoped when a bundle was resolved, whole-fleet otherwise.
+    records = fetch_missing_records(client, scope, devices) if scope else {}
     try:
         ensure_dirs(output_dir)
-        out = html_report.write_report(devices, summary, str(output_dir))
+        if scope:
+            out = bundle_report.build_and_write(
+                scope, devices, records=records, output_dir=str(output_dir),
+                questions_asked=client.request_count, partial_cause=partial_cause,
+                generated_at=summary["generated_at"], inventory_file=inv_path.name)
+        else:
+            out = html_report.write_report(devices, summary, str(output_dir))
     except OSError as e:
         die(f"Could not write the report to {output_dir}: {e}",
             hint="Check that the current folder is writable, or pass --output-dir DIR.")
diff --git a/caia/bundle.py b/caia/bundle.py
new file mode 100644
index 0000000..32ff309
--- /dev/null
+++ b/caia/bundle.py
@@ -0,0 +1,336 @@
+"""Pure per-advisory aggregation for a bundle-scoped report.
+
+Side-effect free and does no I/O, mirroring `matching`, so the whole layout is provable by
+unit test with no credentials and no network. This module owns one safety property, and it
+is worth stating plainly before the code:
+
+**A device whose assessment reached no conclusion has no advisory list at all.** Cisco was
+never able to answer for it, so its status against any *specific* advisory is genuinely
+unknown. It cannot be asserted as impacted, and it cannot be excluded as clean. Everything
+here follows from that (Constitution IV).
+
+Two mechanisms enforce it rather than leaving it to reviewer vigilance:
+
+* **The accounting invariant.** For every row, `impacted + unaffected + undetermined ==
+  population`. A device silently dropped from a row breaks arithmetic that a test asserts,
+  instead of quietly rendering as clean. This is also why the *device* is the unit of count:
+  a release-based denominator cannot close, because an undetermined device frequently has no
+  release Cisco recognises and so cannot be placed in one.
+* **Fail-open family scoping.** An advisory's covered families are unioned from two sources
+  and widen to *every* family when neither yields anything, so the worst outcome of a failed
+  derivation is a noisier report — never a suppressed device. `_widen_for_impacted` then
+  guarantees the direction of the guarantee absolutely: scoping may only narrow which rows
+  an *undetermined* device appears in, and can never exclude a device Cisco positively
+  listed nor manufacture an unaffected one.
+"""
+
+from __future__ import annotations
+
+from caia import matching as m
+
+# Product-family markers as they appear in Cisco's own `productNames` strings. Ordered for
+# readability only; every match contributes, because one advisory covers several families.
+# Non-firewall products Cisco also lists (Cyber Vision, UTD SNORT IPS Engine, and so on)
+# match nothing here and are correctly ignored — the inventory has no such families.
+_FAMILY_MARKERS = (
+    ("(fmc)", "fmc"),
+    ("management center", "fmc"),
+    ("(ftd)", "ftd"),
+    ("threat defense", "ftd"),
+    ("(asa)", "asa"),
+    ("adaptive security appliance", "asa"),
+    ("(fxos)", "fxos"),
+    ("firepower extensible", "fxos"),
+    ("firepower exextensible", "fxos"),
+    ("nx-os", "nxos"),
+    ("ios xe", "iosxe"),
+)
+
+
+def _family_of(device):
+    return str(device.get("family") or "").strip().lower()
+
+
+def advisory_ids_of(device):
+    """The advisory identifiers Cisco returned for this device. Empty unless Impacted."""
+    return {str(a.get("advisoryId") or "") for a in (device.get("advisories") or [])
+            if a.get("advisoryId")}
+
+
+# --------------------------------------------------------------------------- #
+# Covered families (FR-027a)
+# --------------------------------------------------------------------------- #
+def families_named(advisory):
+    """Firewall families Cisco names in an advisory's own published product list.
+
+    Interpretation of display strings, so it is never the only source — see
+    `covered_families`.
+    """
+    found = []
+    for name in (advisory or {}).get("productNames") or []:
+        lowered = str(name).lower()
+        for marker, family in _FAMILY_MARKERS:
+            if marker in lowered and family not in found:
+                found.append(family)
+    return set(found)
+
+
+def index_advisories(devices):
+    """Index a completed assessment by advisory identifier.
+
+    Returns `{advisory_id: {"record": advisory, "families": set()}}` where `families` are
+    the families whose family-scoped question returned that advisory. That set is Cisco's
+    own answer, not an inference, which is what makes it the primary source.
+    """
+    index = {}
+    for device in devices:
+        if device.get("verdict") != m.IMPACTED:
+            continue
+        family = _family_of(device)
+        for advisory in device.get("advisories") or []:
+            advisory_id = str(advisory.get("advisoryId") or "")
+            if not advisory_id:
+                continue
+            entry = index.setdefault(advisory_id, {"record": advisory, "families": set()})
+            if family:
+                entry["families"].add(family)
+    return index
+
+
+def queryable_families(devices):
+    """Families present in the inventory that this check can query at all."""
+    return {f for f in (_family_of(d) for d in devices)
+            if f and m.family_supported(f)}
+
+
+def covered_families(advisory_id, index, records, devices):
+    """The families an advisory covers: the union of Cisco's answers and its product list.
+
+    Fails **open**: when neither source yields a family, every queryable family is covered,
+    so an undetermined device is included rather than omitted (FR-027a).
+    """
+    entry = index.get(advisory_id) or {}
+    families = set(entry.get("families") or ())
+    record = entry.get("record") or (records or {}).get(advisory_id)
+    families |= families_named(record)
+    return families or queryable_families(devices)
+
+
+# --------------------------------------------------------------------------- #
+# Rows
+# --------------------------------------------------------------------------- #
+class Row:
+    """One advisory in the bundle, as the report presents it.
+
+    `population` is the devices of the families this advisory covers; every one of them
+    lands in exactly one of `impacted`, `unaffected`, `undetermined`.
+    """
+
+    __slots__ = ("advisory_id", "record", "families", "population",
+                 "impacted", "unaffected", "undetermined")
+
+    def __init__(self, advisory_id, record, families, population,
+                 impacted, unaffected, undetermined):
+        self.advisory_id = advisory_id
+        self.record = record or {}
+        self.families = tuple(sorted(families))
+        self.population = population
+        self.impacted = impacted
+        self.unaffected = unaffected
+        self.undetermined = undetermined
+
+    # -- advisory facts, all from Cisco's API, never from the bundle page -- #
+    @property
+    def title(self):
+        return str(self.record.get("advisoryTitle") or "")
+
+    @property
+    def published(self):
+        return str(self.record.get("firstPublished") or "")
+
+    @property
+    def severity(self):
+        return str(self.record.get("sir") or "")
+
+    @property
+    def cvss(self):
+        return str(self.record.get("cvssBaseScore") or "")
+
+    @property
+    def cves(self):
+        return [str(c) for c in (self.record.get("cves") or []) if c]
+
+    @property
+    def url(self):
+        return str(self.record.get("publicationUrl") or "")
+
+    def accounts(self):
+        """True when the row's three groupings account for its population exactly once."""
+        return (len(self.impacted) + len(self.unaffected) + len(self.undetermined)
+                == len(self.population))
+
+    def release_rollup(self):
+        """Impacted devices grouped by affected release (FR-022a).
+
+        Presentation derived from `impacted`, never a denominator. Returns
+        `[(release, [device, ...], fix), ...]` ordered by release, where `fix` is the fixing
+        release Cisco gave *for that group*.
+        """
+        groups = {}
+        for device in self.impacted:
+            release = m.normalize_release(device.get("version")) or "(not recorded)"
+            groups.setdefault(release, []).append(device)
+        return [(release, devices, self.fix_for(devices[0]))
+                for release, devices in sorted(groups.items())]
+
+    def fix_for(self, device):
+        """The release Cisco lists as first fixing this advisory *for this device*.
+
+        Per device rather than per row, because Cisco answers per release: two devices in one
+        row can sit on different releases and be given different upgrade targets. Taking one
+        fix for the whole row would show one of them the wrong release to move to, which is
+        the field an engineer actually acts on (FR-023).
+
+        Never inferred — an advisory with no published fix yields "".
+        """
+        for advisory in device.get("advisories") or []:
+            if str(advisory.get("advisoryId") or "") != self.advisory_id:
+                continue
+            for platform in advisory.get("platforms") or []:
+                for fix in platform.get("firstFixes") or []:
+                    name = (fix or {}).get("name")
+                    if name:
+                        return str(name)
+        return ""
+
+    def fixes(self):
+        """The distinct fixing releases across this row's impacted devices, ordered."""
+        return sorted({self.fix_for(d) for d in self.impacted if self.fix_for(d)})
+
+    def first_fix(self):
+        """One fixing release for the row, when every impacted device shares it.
+
+        Returns "" when the row has none, or when its devices disagree — in which case the
+        per-release rollup is the only honest presentation.
+        """
+        found = self.fixes()
+        return found[0] if len(found) == 1 else ""
+
+    def __repr__(self):  # pragma: no cover - debugging aid
+        return (f"Row({self.advisory_id!r}, pop={len(self.population)}, "
+                f"imp={len(self.impacted)}, und={len(self.undetermined)})")
+
+
+def _widen_for_impacted(advisory_id, families, devices):
+    """Guarantee FR-027b's direction: never exclude a device Cisco listed as impacted.
+
+    Family derivation cannot reach this state today, because the families that answered are
+    always in the union. It is enforced anyway so that a future change to derivation cannot
+    turn a positively-listed device into an omission — the one outcome that would breach
+    Principle IV rather than merely add noise.
+    """
+    widened = set(families)
+    for device in devices:
+        if device.get("verdict") == m.IMPACTED and advisory_id in advisory_ids_of(device):
+            family = _family_of(device)
+            if family:
+                widened.add(family)
+    return widened
+
+
+def build_row(advisory_id, devices, index=None, records=None):
+    """Build one advisory row from a completed assessment. Pure."""
+    index = index if index is not None else index_advisories(devices)
+    families = covered_families(advisory_id, index, records, devices)
+    families = _widen_for_impacted(advisory_id, families, devices)
+
+    population, impacted, unaffected, undetermined = [], [], [], []
+    for device in devices:
+        if _family_of(device) not in families:
+            continue
+        population.append(device)
+        if device.get("verdict") == m.NEEDS_REVIEW:
+            # No advisory list exists for this device, so its status here is unknown. It is
+            # never silently absent and never counted as clean.
+            undetermined.append(device)
+        elif advisory_id in advisory_ids_of(device):
+            impacted.append(device)
+        else:
+            # Cisco answered for this device and did not return this advisory: a positive
+            # confirmation, which is the only route to "unaffected" (Principle IV).
+            unaffected.append(device)
+
+    record = (index.get(advisory_id) or {}).get("record") or (records or {}).get(advisory_id)
+    return Row(advisory_id, record, families, population,
+               impacted, unaffected, undetermined)
+
+
+# --------------------------------------------------------------------------- #
+# Ordering (FR-029)
+# --------------------------------------------------------------------------- #
+# Reuses the whole-fleet report's severity ranking so both layouts agree on what severity
+# means; unknown sorts last.
+SEVERITY_ORDER = {"critical": 0, "high": 1, "medium": 2, "low": 3, "informational": 4}
+
+
+def row_sort_key(row):
+    """Severity, then descending impacted count, then identifier.
+
+    The identifier makes the order *total*, which is what makes it reproducible: without it
+    two rows of equal severity and equal reach could order arbitrarily between runs.
+    """
+    severity = SEVERITY_ORDER.get(row.severity.strip().lower(), 9)
+    return (severity, -len(row.impacted), row.advisory_id)
+
+
+# --------------------------------------------------------------------------- #
+# The whole thing
+# --------------------------------------------------------------------------- #
+def missing_records(bundle_advisory_ids, devices):
+    """Bundle advisories that appear in no device's result, so have no facts available.
+
+    These are exactly the advisories a caller must look up individually before rendering —
+    the only additional requests a bundle-scoped run makes (FR-008, FR-017).
+    """
+    index = index_advisories(devices)
+    return [a for a in bundle_advisory_ids if a not in index]
+
+
+def suppressed_count(bundle_advisory_ids, devices):
+    """Distinct advisories affecting the inventory that this bundle does not list (FR-016).
+
+    A count, not an itemisation: it exists so the report cannot be mistaken for a whole-fleet
+    assessment, not to smuggle the whole-fleet result back in.
+    """
+    in_bundle = set(bundle_advisory_ids)
+    found = set()
+    for device in devices:
+        found |= advisory_ids_of(device)
+    return len(found - in_bundle)
+
+
+def run_totals(bundle_advisory_ids, devices, questions_asked=None, partial_cause=None):
+    """Whole-run figures, stated once and independent of any row's population (FR-026a)."""
+    return {
+        "devices_assessed": len(devices),
+        "devices_undetermined": sum(1 for d in devices
+                                    if d.get("verdict") == m.NEEDS_REVIEW),
+        "devices_impacted_any": sum(1 for d in devices
+                                    if d.get("verdict") == m.IMPACTED),
+        "questions_asked": questions_asked,
+        "suppressed_advisories": suppressed_count(bundle_advisory_ids, devices),
+        "partial_cause": partial_cause,
+    }
+
+
+def build_rows(bundle_advisory_ids, devices, records=None):
+    """One row per bundle advisory, ordered deterministically.
+
+    Every advisory the bundle lists gets a row, including advisories that impact nothing
+    (FR-017, FR-019). No advisory outside the bundle is ever added, however it affects the
+    inventory (FR-018).
+    """
+    index = index_advisories(devices)
+    rows = [build_row(a, devices, index=index, records=records)
+            for a in bundle_advisory_ids]
+    return sorted(rows, key=row_sort_key)
diff --git a/caia/bundle_report.py b/caia/bundle_report.py
new file mode 100644
index 0000000..4364dde
--- /dev/null
+++ b/caia/bundle_report.py
@@ -0,0 +1,519 @@
+"""HTML report writer for a bundle-scoped run: one row per advisory in the bundle.
+
+The second report layout, alongside `html_report`'s one-row-per-device view. Both are
+rendered from the same assessment and can never disagree about a device — they differ only
+in aggregation and scope.
+
+One self-contained file per run: all CSS and JavaScript inlined, nothing fetched at render
+time, so the report survives being emailed or archived with no network at all.
+
+Escaping is load-bearing. Advisory content from Cisco is known to carry raw HTML, and this
+layout additionally interpolates values scraped from a published page — the least
+trustworthy input in the system. Everything goes through `esc()`.
+
+The undetermined-device rules here are not cosmetic. A device whose assessment reached no
+conclusion is rendered in yellow **and** labelled in words, appears in every row whose
+advisory covers its family, and is counted in neither the impacted nor the unaffected
+figure — anywhere, including totals. A reader must not be able to reach a count in which
+such a device looks clean (Constitution IV).
+
+Standard library only: string composition and `html.escape`.
+"""
+
+from __future__ import annotations
+
+import datetime as _dt
+import html
+from pathlib import Path
+
+from caia import bundle as b
+from caia import matching as m
+from caia.html_report import COVERAGE_NOTES, FILENAME_PREFIX, esc, reason_text
+
+# Beyond this many devices in one grouping the list is placed behind a disclosure control.
+# Collapsed, never truncated: one advisory in the reference bundle impacts 50 of 70 devices,
+# and a hidden device is an unpatched device.
+COLLAPSE_ABOVE = 8
+
+
+# --------------------------------------------------------------------------- #
+# Output path
+# --------------------------------------------------------------------------- #
+def report_path(output_dir, bundle_id, now=None):
+    """A timestamped path carrying the bundle identifier, which does not already exist.
+
+    Keeps the `impact_report_` prefix so the constitution's recorded `impact_report_*.html`
+    output pattern and `.gitignore`'s existing rule both still match, while making the two
+    layouts distinguishable once filed or emailed (FR-032, FR-033).
+    """
+    stamp = (now or _dt.datetime.now()).strftime("%Y%m%d_%H%M%S")
+    safe = html.escape(str(bundle_id or "bundle"), quote=True).replace("/", "-")
+    safe = "".join(c for c in safe if c.isalnum() or c in "-_")
+    directory = Path(output_dir)
+    path = directory / f"{FILENAME_PREFIX}{safe}_{stamp}.html"
+    n = 1
+    while path.exists():
+        path = directory / f"{FILENAME_PREFIX}{safe}_{stamp}_{n}.html"
+        n += 1
+    return path
+
+
+# --------------------------------------------------------------------------- #
+# Device chips
+# --------------------------------------------------------------------------- #
+def _device_label(device):
+    name = esc(device.get("name") or "")
+    model = esc(device.get("model") or "")
+    release = esc(device.get("version") or "")
+    return (f'<span class="dev"><span class="dev-name">{name}</span>'
+            f'<span class="dev-meta">{model} · {release}</span></span>')
+
+
+def _device_list(devices, css_class, label_when_empty=""):
+    """A device list, collapsed behind a disclosure when long. Never truncated."""
+    if not devices:
+        return f'<span class="none">{esc(label_when_empty)}</span>' if label_when_empty else ""
+    items = "".join(f'<li class="{css_class}">{_device_label(d)}</li>' for d in devices)
+    if len(devices) <= COLLAPSE_ABOVE:
+        return f'<ul class="devlist">{items}</ul>'
+    return (f'<details class="devlist-wrap"><summary>{len(devices)} devices</summary>'
+            f'<ul class="devlist">{items}</ul></details>')
+
+
+def _fix_html(fix):
+    return (f'<span class="fix">fixed in {esc(fix)}</span>' if fix
+            else '<span class="nofix">no fixed release published</span>')
+
+
+def _impacted_block(row):
+    """Impacted devices, with the release Cisco lists as first fixing this advisory.
+
+    When every impacted device shares one fixing release, it is stated once. When they do
+    not — devices on different releases can be given different upgrade targets — each
+    release group carries its own, because one release shown for all of them would send
+    somebody to the wrong version (FR-023).
+    """
+    if not row.impacted:
+        return '<span class="none">No inventory device is impacted.</span>'
+    rollup = row.release_rollup()
+    releases = ", ".join(esc(release) for release, _, _ in rollup)
+    shared = row.first_fix()
+    if shared or len(rollup) == 1:
+        tail = _fix_html(shared or rollup[0][2])
+    else:
+        tail = " · ".join(f'{esc(release)} → {_fix_html(fix)}'
+                          for release, _, fix in rollup)
+    summary = (f'<div class="rollup"><strong>{len(row.impacted)} '
+               f'device{"" if len(row.impacted) == 1 else "s"}</strong> · '
+               f'{len(rollup)} affected release{"" if len(rollup) == 1 else "s"} '
+               f'({releases}) · {tail}</div>')
+    return summary + _device_list(row.impacted, "d-impacted")
+
+
+def _undetermined_block(row):
+    """Undetermined devices for this advisory — yellow, and said in words.
+
+    The words matter as much as the colour: the report must survive greyscale, print, and a
+    reader with a colour-vision deficiency.
+    """
+    if not row.undetermined:
+        return ""
+    count = len(row.undetermined)
+    return ('<div class="undet">'
+            f'<span class="undet-mark">▲</span> '
+            f'<strong>{count} device{"" if count == 1 else "s"} undetermined</strong> — '
+            'Cisco could not be asked about these, so whether this advisory affects them is '
+            '<em>unknown</em>. They are not counted as unaffected.'
+            + _device_list(row.undetermined, "d-undet") + "</div>")
+
+
+# --------------------------------------------------------------------------- #
+# Rows
+# --------------------------------------------------------------------------- #
+def _row_html(row, index):
+    advisory_id = esc(row.advisory_id)
+    url = esc(row.url)
+    # New tab so a reader working through a list keeps their place; `rel` denies the opened
+    # page any reference back to this document.
+    link = (f'<a href="{url}" target="_blank" rel="noreferrer noopener">{advisory_id}</a>'
+            if url else advisory_id)
+    severity = row.severity or "Unrated"
+    cvss = f' <span class="cvss">CVSS {esc(row.cvss)}</span>' if row.cvss else ""
+    cves = (f'<div class="cves">{esc(", ".join(row.cves))}</div>' if row.cves else "")
+    published = esc(row.published) or '<span class="none">not published</span>'
+
+    families = ", ".join(f.upper() for f in row.families) or "none"
+    scope = (f'<div class="scope">Evaluated against '
+             f'<strong>{len(row.population)}</strong> device'
+             f'{"" if len(row.population) == 1 else "s"} '
+             f'({esc(families)})</div>')
+    counts = (f'<div class="counts">'
+              f'<span class="c-imp">{len(row.impacted)} impacted</span>'
+              f'<span class="c-una">{len(row.unaffected)} not impacted</span>'
+              f'<span class="c-und">{len(row.undetermined)} undetermined</span>'
+              f'</div>')
+
+    return (
+        f'<tr data-severity="{esc(severity.lower())}" '
+        f'data-impacted="{len(row.impacted)}" data-order="{index}">'
+        f'<td class="c-adv"><span class="sev sev-{esc(severity.lower())}">{esc(severity)}'
+        f'</span>{cvss}<div class="advid">{link}</div>'
+        f'<div class="advtitle">{esc(row.title)}</div>{cves}</td>'
+        f'<td class="c-date">{published}</td>'
+        f'<td class="c-prod">{scope}{counts}{_impacted_block(row)}'
+        f'{_undetermined_block(row)}</td>'
+        "</tr>"
+    )
+
+
+def _table(rows):
+    head = ('<thead><tr><th class="sortable" data-sort="severity">Advisory</th>'
+            '<th>Published</th>'
+            '<th class="sortable" data-sort="impacted">Impacted products</th></tr></thead>')
+    body = "\n".join(_row_html(row, i) for i, row in enumerate(rows))
+    return f'<table id="advisories">\n{head}\n<tbody>\n{body}\n</tbody>\n</table>'
+
+
+# --------------------------------------------------------------------------- #
+# Header, totals, appendices
+# --------------------------------------------------------------------------- #
+def _header_html(bundle, totals, generated_at, inventory_file):
+    generated = (generated_at.strftime("%Y-%m-%d %H:%M:%S")
+                 if hasattr(generated_at, "strftime") else str(generated_at or "unknown"))
+    link = (f'<a href="{esc(bundle.url)}" target="_blank" rel="noreferrer noopener">'
+            f'{esc(bundle.bundle_id)}</a>') if bundle.url else esc(bundle.bundle_id)
+    version = (f' · page version {esc(bundle.version)}' if bundle.version else "")
+    facts = [
+        ("Run", generated),
+        ("Inventory", inventory_file or "unknown"),
+        ("Devices assessed", str(totals.get("devices_assessed", 0))),
+        ("Undetermined", str(totals.get("devices_undetermined", 0))),
+        ("Questions asked", str(totals.get("questions_asked") or "—")),
+        ("Advisories in bundle", str(len(bundle))),
+    ]
+    cells = "".join(f'<div class="fact"><dt>{esc(label)}</dt><dd>{esc(value)}</dd></div>'
+                    for label, value in facts)
+
+    suppressed = totals.get("suppressed_advisories") or 0
+    scope_note = (
+        '<p class="scopenote"><strong>This report is scoped to one bundle.</strong> '
+        f'{suppressed} further advisor{"y" if suppressed == 1 else "ies"} '
+        f'{"affects" if suppressed == 1 else "affect"} this inventory but '
+        f'{"is" if suppressed == 1 else "are"} not published in '
+        f'{esc(bundle.bundle_id)}, and {"is" if suppressed == 1 else "are"} therefore not '
+        'shown here. This is not a whole-fleet assessment.</p>'
+    ) if suppressed else (
+        '<p class="scopenote"><strong>This report is scoped to one bundle.</strong> '
+        'No other advisory currently affects this inventory. This is not a whole-fleet '
+        'assessment.</p>')
+
+    partial = ""
+    if totals.get("partial_cause"):
+        partial = ('<p class="partial"><strong>This run was partial.</strong> '
+                   + esc(totals["partial_cause"])
+                   + " Devices that were not reached are undetermined; they are not known "
+                     "to be unaffected.</p>")
+
+    return (
+        f'<h1>Cisco Advisory Impact Report — bundle {esc(bundle.bundle_id)}</h1>\n'
+        f'<p class="bundletitle">{esc(bundle.title)}</p>\n'
+        f'<p class="bundlemeta">Bundle {link} · published '
+        f'{esc(bundle.published) or "date not stated"}{version}</p>\n'
+        f'<section class="summary"><dl class="facts">{cells}</dl>'
+        f'{scope_note}{partial}</section>'
+    )
+
+
+def _undetermined_appendix(devices):
+    """Every undetermined device, once, with what to correct (FR-030)."""
+    undetermined = [d for d in devices if d.get("verdict") == m.NEEDS_REVIEW]
+    if not undetermined:
+        return ""
+    rows = "".join(
+        f"<tr><td>{esc(d.get('name'))}</td><td>{esc(d.get('model'))}</td>"
+        f"<td>{esc(d.get('version'))}</td>"
+        f"<td>{esc(reason_text(d.get('reason')))}</td></tr>"
+        for d in undetermined)
+    return (
+        f'<section class="appendix"><h2>Devices that could not be assessed '
+        f'({len(undetermined)})</h2>'
+        '<p>Each appears above as <em>undetermined</em> against every advisory that covers '
+        'its product family, and nowhere as unaffected. Correcting the inventory values '
+        'below is what makes the next bundle review conclusive.</p>'
+        '<table class="plain"><thead><tr><th>Device</th><th>Model recorded</th>'
+        '<th>Release recorded</th><th>Why</th></tr></thead>'
+        f'<tbody>{rows}</tbody></table></section>')
+
+
+def _scope_appendix(bundle):
+    """The advisory identifiers as resolved at run time, so the scope is auditable (FR-034)."""
+    items = "".join(f"<li>{esc(a)}</li>" for a in bundle.advisory_ids)
+    return (f'<section class="appendix"><h2>Resolved scope ({len(bundle)} advisories)</h2>'
+            f'<p>Read from {esc(bundle.url)} at run time. Advisory facts shown above come '
+            'from Cisco\'s advisory API, never from that page.</p>'
+            f'<ol class="scopelist">{items}</ol></section>')
+
+
+def _device_index(rows, devices):
+    """Per-device cross-reference: one device to every bundle advisory affecting it (FR-036)."""
+    by_device = {}
+    for row in rows:
+        for device in row.impacted:
+            by_device.setdefault(id(device), (device, []))[1].append(row.advisory_id)
+    if not by_device:
+        return ""
+    entries = []
+    for device, advisory_ids in sorted(by_device.values(),
+                                       key=lambda pair: str(pair[0].get("name") or "")):
+        chips = "".join(f'<li>{esc(a)}</li>' for a in sorted(advisory_ids))
+        entries.append(
+            f'<tr><td>{esc(device.get("name"))}</td>'
+            f'<td>{esc(device.get("model"))}</td><td>{esc(device.get("version"))}</td>'
+            f'<td>{len(advisory_ids)}</td>'
+            f'<td><details><summary>show</summary><ul class="idlist">{chips}</ul>'
+            "</details></td></tr>")
+    return ('<section class="appendix"><h2>By device</h2>'
+            '<p>The same findings, inverted, for working device by device. Devices that '
+            'could not be assessed are listed separately above.</p>'
+            '<table class="plain"><thead><tr><th>Device</th><th>Model</th><th>Release</th>'
+            '<th>Advisories</th><th>Which</th></tr></thead>'
+            f'<tbody>{"".join(entries)}</tbody></table></section>')
+
+
+def _controls(rows):
+    total = len(rows)
+    with_impact = sum(1 for r in rows if r.impacted)
+    buttons = [("all", f"All ({total})", "true"),
+               ("impacting", f"Impacting ({with_impact})", "false"),
+               ("clean", f"No impact ({total - with_impact})", "false")]
+    html_buttons = "".join(
+        f'<button type="button" data-filter="{esc(v)}" aria-pressed="{p}">{esc(l)}</button>'
+        for v, l, p in buttons)
+    return ('<div class="controls">' + html_buttons
+            + '<span class="spacer"></span>'
+            + '<button type="button" id="sort-severity" aria-pressed="true">'
+              'Sort: severity</button>'
+            + '<button type="button" id="sort-impacted" aria-pressed="false">'
+              'Sort: most devices</button>'
+            + '<button type="button" id="expand-all" aria-pressed="false">'
+              'Expand all</button></div>')
+
+
+_CSS = """
+:root { color-scheme: light; }
+* { box-sizing: border-box; }
+body { margin: 0; padding: 2rem 1.5rem; font: 15px/1.5 -apple-system, BlinkMacSystemFont,
+       "Segoe UI", Roboto, Helvetica, Arial, sans-serif; color: #1b1b1b;
+       background: #f7f7f8; }
+h1 { margin: 0 0 .25rem; font-size: 1.45rem; }
+h2 { font-size: 1rem; margin: 0 0 .5rem; }
+.bundletitle { margin: .1rem 0 .3rem; font-size: 1rem; color: #333; max-width: 70ch; }
+.bundlemeta { margin: 0 0 .5rem; font-size: .85rem; color: #6b7076; }
+table { width: 100%; border-collapse: collapse; background: #fff;
+        box-shadow: 0 1px 3px rgba(0,0,0,.08); }
+th, td { padding: .55rem .65rem; text-align: left; vertical-align: top;
+         border-bottom: 1px solid #e6e6e8; font-size: .9rem; }
+th { background: #1f4e78; color: #fff; font-weight: 600; position: sticky; top: 0; }
+tbody tr:nth-child(even) { background: #fbfbfc; }
+table.plain { box-shadow: none; border: 1px solid #e2e4e7; }
+.c-adv { width: 30%; } .c-date { width: 12%; white-space: nowrap; }
+.advid { font-weight: 600; margin-top: .3rem; font-family: ui-monospace, SFMono-Regular,
+         Menlo, monospace; font-size: .85rem; }
+.advtitle { color: #555; font-size: .85rem; margin-top: .15rem; }
+.cves { color: #666; font-size: .78rem; margin-top: .2rem;
+        font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.sev { display: inline-block; min-width: 5.2em; padding: 0 .35rem; border-radius: 3px;
+       font-size: .72rem; font-weight: 700; text-align: center; text-transform: uppercase;
+       border: 1px solid currentColor; }
+.sev-critical { color: #7a1512; } .sev-high { color: #a3231d; }
+.sev-medium { color: #8a5a00; } .sev-low { color: #4a5a6a; }
+.cvss { font-size: .75rem; color: #6b7076; margin-left: .3rem; }
+.scope { font-size: .8rem; color: #6b7076; }
+.counts { display: flex; gap: .6rem; flex-wrap: wrap; margin: .25rem 0 .45rem;
+          font-size: .78rem; }
+.counts span { padding: 0 .35rem; border-radius: 3px; border: 1px solid currentColor; }
+.c-imp { color: #a3231d; } .c-una { color: #1e6b34; } .c-und { color: #8a5a00; }
+.rollup { font-size: .85rem; margin-bottom: .3rem; }
+.fix { font-weight: 600; color: #1e6b34; }
+.nofix { font-style: italic; color: #8a5a00; }
+.none { color: #6b7076; font-style: italic; font-size: .85rem; }
+.devlist { margin: .2rem 0 0; padding-left: 1.1rem; }
+.devlist li { margin-bottom: .15rem; }
+.devlist-wrap > summary { cursor: pointer; font-size: .85rem; color: #1f4e78; }
+.dev-name { font-weight: 600; }
+.dev-meta { color: #6b7076; font-size: .8rem; margin-left: .4rem; }
+/* Undetermined: yellow AND labelled. The words carry the meaning on their own, so the
+   report survives greyscale, print, and a reader with a colour-vision deficiency. */
+.undet { margin-top: .5rem; padding: .45rem .6rem; border-radius: 4px;
+         background: #fff6e0; border: 1px solid #e8cf94; color: #6b4c00;
+         font-size: .82rem; }
+.undet-mark { font-weight: 700; }
+.undet .dev-meta { color: #7a5c1a; }
+li.d-undet { color: #6b4c00; }
+.controls { margin: .75rem 0 1rem; display: flex; gap: .5rem; flex-wrap: wrap;
+            align-items: center; }
+.controls button { font: inherit; font-size: .85rem; padding: .3rem .7rem; cursor: pointer;
+                   border: 1px solid #c3c7cc; border-radius: 4px; background: #fff;
+                   color: #1b1b1b; }
+.controls button:hover { background: #eef1f4; border-color: #9aa1a9; }
+.controls button:focus-visible { outline: 2px solid #1f4e78; outline-offset: 1px; }
+.controls button[aria-pressed="true"] { background: #1f4e78; color: #fff;
+                                        border-color: #1f4e78; }
+.controls .spacer { flex: 1 1 auto; }
+.summary { background: #fff; border: 1px solid #e2e4e7; border-radius: 6px;
+           padding: 1rem 1.1rem; margin: 1rem 0; }
+.facts { display: flex; flex-wrap: wrap; gap: 1.5rem; margin: 0 0 .5rem; }
+.facts .fact { margin: 0; }
+.facts dt { font-size: .72rem; text-transform: uppercase; letter-spacing: .04em;
+            color: #6b7076; }
+.facts dd { margin: .1rem 0 0; font-size: 1.05rem; font-weight: 600; }
+.scopenote { margin: .5rem 0 0; padding: .55rem .7rem; border-radius: 4px;
+             background: #eef4fa; border: 1px solid #cadcee; color: #234; font-size: .85rem; }
+.partial { margin: .6rem 0 0; padding: .6rem .75rem; border-radius: 4px;
+           background: #fff6e0; border: 1px solid #e8cf94; color: #6b4c00; }
+.appendix { background: #fff; border: 1px solid #e2e4e7; border-radius: 6px;
+            padding: 1rem 1.1rem; margin: 1.25rem 0; }
+.appendix p { font-size: .85rem; color: #4a4a4a; margin: 0 0 .6rem; max-width: 80ch; }
+.scopelist { columns: 2; font-family: ui-monospace, SFMono-Regular, Menlo, monospace;
+             font-size: .78rem; margin: 0; }
+.idlist { margin: .2rem 0 0; padding-left: 1.1rem; font-size: .78rem;
+          font-family: ui-monospace, SFMono-Regular, Menlo, monospace; }
+.coverage { margin-top: 1rem; border-top: 1px solid #ebedef; padding-top: .75rem; }
+.coverage h2 { font-size: .85rem; text-transform: uppercase; letter-spacing: .04em;
+               color: #6b7076; }
+.coverage ul { margin: 0; padding-left: 1.1rem; color: #4a4a4a; font-size: .85rem; }
+th.sortable { cursor: pointer; }
+th.sortable::after { content: " \\2195"; opacity: .55; }
+tr.hidden { display: none; }
+"""
+
+# Vanilla JS, inlined. The report must filter and sort with no network access, so no CDN and
+# no framework — the same constraint the whole-fleet report already works under.
+_JS = """
+(function () {
+  var table = document.getElementById('advisories');
+  if (!table) return;
+  var tbody = table.tBodies[0];
+  var rows = Array.prototype.slice.call(tbody.rows);
+
+  function press(id, on) {
+    var b = document.getElementById(id);
+    if (b) b.setAttribute('aria-pressed', String(on));
+  }
+
+  Array.prototype.forEach.call(
+    document.querySelectorAll('.controls button[data-filter]'),
+    function (button) {
+      button.addEventListener('click', function () {
+        var want = button.getAttribute('data-filter');
+        rows.forEach(function (row) {
+          var n = parseInt(row.getAttribute('data-impacted'), 10) || 0;
+          var show = (want === 'all') || (want === 'impacting' && n > 0) ||
+                     (want === 'clean' && n === 0);
+          row.classList.toggle('hidden', !show);
+        });
+        Array.prototype.forEach.call(
+          document.querySelectorAll('.controls button[data-filter]'),
+          function (b) { b.setAttribute('aria-pressed', String(b === button)); });
+      });
+    });
+
+  function reorder(key) {
+    var sorted = rows.slice().sort(function (a, b) {
+      if (key === 'impacted') {
+        var d = (parseInt(b.getAttribute('data-impacted'), 10) || 0) -
+                (parseInt(a.getAttribute('data-impacted'), 10) || 0);
+        if (d) return d;
+      }
+      return (parseInt(a.getAttribute('data-order'), 10) || 0) -
+             (parseInt(b.getAttribute('data-order'), 10) || 0);
+    });
+    sorted.forEach(function (row) { tbody.appendChild(row); });
+  }
+
+  var bySeverity = document.getElementById('sort-severity');
+  var byImpacted = document.getElementById('sort-impacted');
+  if (bySeverity) bySeverity.addEventListener('click', function () {
+    reorder('severity'); press('sort-severity', true); press('sort-impacted', false); });
+  if (byImpacted) byImpacted.addEventListener('click', function () {
+    reorder('impacted'); press('sort-impacted', true); press('sort-severity', false); });
+
+  var expand = document.getElementById('expand-all');
+  if (expand) expand.addEventListener('click', function () {
+    var open = expand.getAttribute('aria-pressed') !== 'true';
+    Array.prototype.forEach.call(document.querySelectorAll('details'),
+      function (d) { d.open = open; });
+    expand.setAttribute('aria-pressed', String(open));
+  });
+})();
+"""
+
+
+def _document(title, body):
+    return ("<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n"
+            "<meta charset=\"utf-8\">\n"
+            "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n"
+            f"<title>{esc(title)}</title>\n"
+            f"<style>{_CSS}</style>\n"
+            "</head>\n<body>\n"
+            f"{body}\n"
+            f"<script>{_JS}</script>\n"
+            "</body>\n</html>\n")
+
+
+BUNDLE_COVERAGE_NOTES = COVERAGE_NOTES + (
+    "This report covers only the advisories published in the named bundle. An advisory "
+    "affecting this inventory from any other publication is deliberately absent.",
+    "Undetermined is not a statement of safety, and it is not \"probably fine\". It means "
+    "Cisco could not be asked about that device at all, so whether a given advisory "
+    "affects it is unknown.",
+)
+
+
+def _coverage_html():
+    notes = "".join(f"<li>{esc(note)}</li>" for note in BUNDLE_COVERAGE_NOTES)
+    return ('<section class="appendix coverage">'
+            "<h2>What this report does and does not cover</h2>"
+            f"<ul>{notes}</ul></section>")
+
+
+# --------------------------------------------------------------------------- #
+# Render / write
+# --------------------------------------------------------------------------- #
+def render(bundle, rows, devices, totals, generated_at=None, inventory_file=None):
+    """Render the bundle-scoped report as a string."""
+    title = f"Cisco Advisory Impact Report — bundle {bundle.bundle_id}"
+    body = "\n".join([
+        _header_html(bundle, totals, generated_at, inventory_file),
+        _controls(rows),
+        _table(rows),
+        _undetermined_appendix(devices),
+        _device_index(rows, devices),
+        _scope_appendix(bundle),
+        _coverage_html(),
+    ])
+    return _document(title, body)
+
+
+def write_report(bundle, rows, devices, totals, output_dir="output",
+                 generated_at=None, inventory_file=None, now=None):
+    """Write the bundle-scoped report and return the path written."""
+    directory = Path(output_dir)
+    directory.mkdir(parents=True, exist_ok=True)
+    path = report_path(directory, bundle.bundle_id, now=now)
+    path.write_text(
+        render(bundle, rows, devices, totals,
+               generated_at=generated_at, inventory_file=inventory_file),
+        encoding="utf-8")
+    return path
+
+
+def build_and_write(bundle, devices, records=None, output_dir="output",
+                    questions_asked=None, partial_cause=None,
+                    generated_at=None, inventory_file=None, now=None):
+    """Convenience wrapper: build rows and totals, then write. Used by the terminal flow."""
+    rows = b.build_rows(bundle.advisory_ids, devices, records=records)
+    totals = b.run_totals(bundle.advisory_ids, devices,
+                          questions_asked=questions_asked, partial_cause=partial_cause)
+    return write_report(bundle, rows, devices, totals, output_dir=output_dir,
+                        generated_at=generated_at, inventory_file=inventory_file, now=now)
diff --git a/caia/cli.py b/caia/cli.py
index b5f7764..2462264 100644
--- a/caia/cli.py
+++ b/caia/cli.py
@@ -106,6 +106,9 @@ def build_parser():
     ap.add_argument("--inventory",
                     help="Path to an inventory .xlsx (else discovered in the current folder)")
     ap.add_argument("--sheet", default="FW_List", help="Inventory sheet name")
+    ap.add_argument("--erp", dest="erp", default=None, metavar="URL|ERP-#####",
+                    help="Scope the report to one Cisco advisory bundle, one row per "
+                         "advisory (else you are asked; press Enter to skip)")
     ap.add_argument("--output-dir", dest="output_dir", default=None,
                     help="Where to write the report (default: ./output in the current folder)")
     ap.add_argument("--no-update-check", dest="no_update_check", action="store_true",
diff --git a/caia/erp.py b/caia/erp.py
new file mode 100644
index 0000000..ac81e39
--- /dev/null
+++ b/caia/erp.py
@@ -0,0 +1,273 @@
+"""Cisco bundled-publication (Event Response) page access.
+
+The only module that talks to Cisco's Security Center, and the second external interface
+this tool depends on after the PSIRT API. Standard library only.
+
+**This page is a scope selector, not an authority.** It may supply two things: *which*
+advisories a bundle contains, and that bundle's own identity. It may never supply an
+advisory fact — not a title, severity, score, CVE identifier, affected product, fixing
+release, or an advisory's publication date. Every one of those is displayed on the page and
+every one of them must come from the advisory API instead (constitution, Technology & Data
+Constraints -> Scope selectors; see contracts/erp-access.md).
+
+That boundary is why this module returns identifiers and bundle metadata and nothing else.
+There is no code here to read the details table's other columns, deliberately: the cheapest
+way to keep a rule is to leave no route to breaking it.
+
+Two behaviours are load-bearing and were established against the live page rather than from
+documentation:
+
+* Advisory identifiers live **only** in link targets. The visible text carries advisory
+  *titles*, so extracting text yields zero identifiers — a failure that looks like an empty
+  bundle rather than an error. Matching on `href` also means an identifier merely mentioned
+  in prose cannot silently widen the bundle's scope.
+* `urllib` reaches the page in about half a second. An earlier `curl` timeout suggested a
+  browser engine might be required; it is not, and nothing here assumes a user-agent.
+
+Nothing about any device is sent. The only value that leaves the machine is the bundle
+identifier the user supplied, over an unauthenticated request that never carries the API
+credentials (Constitution V).
+"""
+
+from __future__ import annotations
+
+import html.parser
+import re
+import urllib.error
+import urllib.parse
+import urllib.request
+
+HOST = "sec.cloudapps.cisco.com"
+PATH = "/security/center/viewErp.x"
+PAGE_URL = f"https://{HOST}{PATH}?alertId=%s"
+
+# Short by design: resolution happens before the run's expensive work, so an unresponsive
+# page must fail fast and cheaply rather than stall a run that has spent nothing yet.
+DEFAULT_TIMEOUT = 20
+
+_BUNDLE_ID = re.compile(r"^ERP-\d+$", re.IGNORECASE)
+_ADVISORY_HREF = re.compile(r"CiscoSecurityAdvisory/(cisco-sa-[A-Za-z0-9._-]+)")
+_DOC_ID = re.compile(r"Doc\s*ID:\s*(ERP-\d+)", re.IGNORECASE)
+_FIRST_PUBLISHED = re.compile(
+    r"First\s+Published:\s*(\d{4}\s+\w+\s+\d{1,2}(?:\s+[\d:]+\s+\w+)?)", re.IGNORECASE)
+_VERSION = re.compile(r"Version:\s*(\d+(?:\.\d+)*)", re.IGNORECASE)
+
+
+class ErpError(Exception):
+    """Base class. A bundle that cannot be resolved never becomes an empty bundle."""
+
+
+class ErpNotABundleError(ErpError):
+    """The value is not a Cisco bundled-publication address. Raised before any request."""
+
+
+class ErpUnreachableError(ErpError):
+    """Cisco's Security Center could not be reached (DNS, TCP, TLS, proxy, timeout)."""
+
+
+class ErpNoAdvisoriesError(ErpError):
+    """The page was reached but links no advisory. An error, never an empty scope."""
+
+
+class ErpBundleMismatchError(ErpError):
+    """The page identifies a different bundle than the one requested."""
+
+
+class Bundle:
+    """A resolved bundle: its identity, and the advisories it publishes.
+
+    Held in memory for one run and never persisted — a revised page is picked up on the
+    next run with no tool release, and no bundle state carries between runs.
+    """
+
+    __slots__ = ("bundle_id", "title", "published", "version", "url", "advisory_ids")
+
+    def __init__(self, bundle_id, title, published, version, url, advisory_ids):
+        self.bundle_id = bundle_id
+        self.title = title
+        self.published = published
+        self.version = version
+        self.url = url
+        self.advisory_ids = tuple(advisory_ids)
+
+    def __len__(self):
+        return len(self.advisory_ids)
+
+    def __contains__(self, advisory_id):
+        return advisory_id in self.advisory_ids
+
+    def __repr__(self):  # pragma: no cover - debugging aid
+        return f"Bundle({self.bundle_id!r}, {len(self.advisory_ids)} advisories)"
+
+
+# --------------------------------------------------------------------------- #
+# Reference normalisation (FR-004, FR-005)
+# --------------------------------------------------------------------------- #
+def normalize_reference(value):
+    """Return (bundle_id, url) for a bundle reference, or raise ErpNotABundleError.
+
+    Accepts the URL form Cisco publishes and a bare identifier such as `ERP-75736`. Every
+    rejection happens here, before any network request exists to be made, so a typo costs
+    nothing.
+    """
+    text = str(value or "").strip()
+    if not text:
+        raise ErpNotABundleError(
+            "No bundle reference given. Expected a Cisco Event Response URL such as "
+            f"{PAGE_URL % 'ERP-75736'} or a bare identifier such as ERP-75736.")
+
+    if _BUNDLE_ID.match(text):
+        bundle_id = text.upper()
+        return bundle_id, PAGE_URL % bundle_id
+
+    parsed = urllib.parse.urlsplit(text if "//" in text else "https://" + text)
+    if parsed.hostname != HOST or parsed.path.rstrip("/") != PATH:
+        raise ErpNotABundleError(
+            f"{text!r} is not a Cisco Event Response address. Expected a URL on {HOST} "
+            f"of the form {PAGE_URL % 'ERP-75736'}, or a bare identifier such as "
+            "ERP-75736.")
+
+    alert = urllib.parse.parse_qs(parsed.query).get("alertId", [""])[0].strip()
+    if not _BUNDLE_ID.match(alert):
+        raise ErpNotABundleError(
+            f"{text!r} carries no usable bundle identifier. Expected an alertId of the "
+            "form ERP-75736.")
+    bundle_id = alert.upper()
+    return bundle_id, PAGE_URL % bundle_id
+
+
+# --------------------------------------------------------------------------- #
+# Parsing
+# --------------------------------------------------------------------------- #
+class _BundlePageParser(html.parser.HTMLParser):
+    """Collect advisory identifiers from link targets, and the page's own text.
+
+    One pass yields both. `script` and `style` content is excluded from the text so a
+    variable in an inline script cannot be mistaken for the page's own metadata.
+    """
+
+    _SKIP = ("script", "style")
+
+    def __init__(self):
+        super().__init__(convert_charrefs=True)
+        self.advisory_ids = []
+        self.title = ""
+        self._chunks = []
+        self._skip_depth = 0
+        self._in_title = False
+
+    def handle_starttag(self, tag, attrs):
+        if tag in self._SKIP:
+            self._skip_depth += 1
+            return
+        if tag == "title":
+            self._in_title = True
+            return
+        if tag != "a":
+            return
+        for key, value in attrs:
+            if key.lower() != "href" or not value:
+                continue
+            found = _ADVISORY_HREF.search(value)
+            # Deduplicated here rather than by the caller: the same advisory linked twice
+            # is one advisory, and order is the page's own (FR-014).
+            if found and found.group(1) not in self.advisory_ids:
+                self.advisory_ids.append(found.group(1))
+
+    def handle_endtag(self, tag):
+        if tag in self._SKIP and self._skip_depth:
+            self._skip_depth -= 1
+        elif tag == "title":
+            self._in_title = False
+
+    def handle_data(self, data):
+        if self._skip_depth:
+            return
+        if self._in_title:
+            self.title += data
+        self._chunks.append(data)
+
+    @property
+    def text(self):
+        return re.sub(r"\s+", " ", "".join(self._chunks)).strip()
+
+
+def parse(markup):
+    """Parse page markup into (advisory_ids, identity dict). Pure — no I/O.
+
+    `identity` carries `doc_id`, `title`, `published` and `version`, each `""` when the page
+    does not state it. Nothing else is extracted, by design.
+    """
+    parser = _BundlePageParser()
+    parser.feed(markup)
+    text = parser.text
+
+    def first(pattern):
+        found = pattern.search(text)
+        return found.group(1).strip() if found else ""
+
+    identity = {
+        "doc_id": first(_DOC_ID).upper(),
+        "title": re.sub(r"\s+", " ", parser.title).strip(),
+        "published": first(_FIRST_PUBLISHED),
+        "version": first(_VERSION),
+    }
+    return parser.advisory_ids, identity
+
+
+# --------------------------------------------------------------------------- #
+# Resolution
+# --------------------------------------------------------------------------- #
+def fetch(url, timeout=DEFAULT_TIMEOUT, opener=None):
+    """Fetch page markup. Raises ErpUnreachableError; never returns partial content.
+
+    Carries no inventory-derived data and no credentials — the URL's bundle identifier is
+    the only value sent (Constitution V, FR-037).
+    """
+    request = urllib.request.Request(url, headers={"Accept": "text/html"})
+    open_url = opener or urllib.request.urlopen
+    try:
+        with open_url(request, timeout=timeout) as response:
+            return response.read().decode("utf-8", "replace")
+    except urllib.error.HTTPError as exc:
+        code = getattr(exc, "code", "?")
+        raise ErpUnreachableError(
+            f"Cisco returned HTTP {code} for the bundle page. This is a problem reaching "
+            "the page, not a problem with the bundle identifier.") from None
+    except Exception as exc:  # noqa: BLE001 - URLError, timeout, ssl, proxy errors
+        raise ErpUnreachableError(
+            f"Cisco's Security Center could not be reached ({type(exc).__name__}). This is "
+            "a connectivity problem, not an invalid bundle link.") from None
+
+
+def resolve(reference, timeout=DEFAULT_TIMEOUT, opener=None):
+    """Resolve a bundle reference to a `Bundle`.
+
+    Raises, rather than returning anything empty or partial, on every failure path — so a
+    caller can always tell "we could not ask" from "we asked and there is nothing"
+    (FR-040). Prints nothing, prompts for nothing, writes nothing, exits nothing.
+    """
+    bundle_id, url = normalize_reference(reference)
+    advisory_ids, identity = parse(fetch(url, timeout=timeout, opener=opener))
+
+    # A redirect to a different or generic page would otherwise produce a confidently
+    # labelled report about a bundle that was never analysed.
+    if identity["doc_id"] and identity["doc_id"] != bundle_id:
+        raise ErpBundleMismatchError(
+            f"The page for {bundle_id} identifies itself as {identity['doc_id']}. The "
+            "request may have been redirected; check the link.")
+
+    if not advisory_ids:
+        raise ErpNoAdvisoriesError(
+            f"No advisories could be identified on the page for {bundle_id}. Either it is "
+            "not a bundled publication, or Cisco has changed the page's structure. No "
+            "report has been written, because an empty bundle would read as an all-clear.")
+
+    return Bundle(
+        bundle_id=bundle_id,
+        title=identity["title"],
+        published=identity["published"],
+        version=identity["version"],
+        url=url,
+        advisory_ids=advisory_ids,
+    )
diff --git a/caia/psirt.py b/caia/psirt.py
index 018f880..f7ea4af 100644
--- a/caia/psirt.py
+++ b/caia/psirt.py
@@ -220,6 +220,31 @@ def get_os_data(self, os_type):
                 f"Cisco returned HTTP {status} for the release catalogue of {os_type}.")
         return _rows(payload, "OSData")
 
+    # -- one advisory's own facts ----------------------------------------- #
+    def get_advisory(self, advisory_id):
+        """Facts about one advisory, by identifier. Returns the record, or None.
+
+        Needed only for an advisory that impacts nothing in the inventory: such an advisory
+        is returned by no device-scoped question, so its title, severity and publication
+        date are not otherwise available — and a bundle-scoped report still owes it a row
+        (spec 008 FR-008, FR-017). Every advisory that *does* impact something already
+        carries these fields in the payload `get_advisories` returned, so this costs one
+        request per clean advisory and nothing at all in the common case.
+
+        `productNames` on the returned record is also the fallback source for which product
+        families an advisory covers, when no device answered for it.
+        """
+        status, payload = self._get(f"/advisory/{urllib.parse.quote(str(advisory_id))}",
+                                   None)
+        if status in (401, 403):
+            raise PsirtAuthError("Cisco rejected the access token.")
+        if status != 200:
+            # Not fatal: a row without facts is still a row, and inventing them is worse
+            # than leaving them absent (Principle IV).
+            return None
+        rows = _rows(payload, "advisories")
+        return rows[0] if rows else None
+
     # -- the advisory question -------------------------------------------- #
     def get_advisories(self, os_type, release, platform_alias=None):
         """Ask Cisco which advisories apply. Returns (outcome, advisories).
diff --git a/docs/index.html b/docs/index.html
index fe601e6..33f1659 100644
--- a/docs/index.html
+++ b/docs/index.html
@@ -263,7 +263,7 @@ <h1>Cisco Advisory Impact Analyzer</h1>
       <div class="card">
         <svg class="ico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8"><circle cx="11" cy="11" r="7"/><path d="m21 21-4.3-4.3"/></svg>
         <h3>Checks your whole fleet</h3>
-        <p>One command, no advisory link to hunt down. Every firewall in your inventory is checked, not just the ones someone thought to look at.</p>
+        <p>One command. Every firewall in your inventory is checked, not just the ones someone thought to look at &mdash; or scope it to one Cisco advisory bundle and get a row per advisory.</p>
       </div>
       <div class="card">
         <svg class="ico" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.8"><path d="M12 3 4 6v6c0 4.4 3.4 8.5 8 9 4.6-.5 8-4.6 8-9V6l-8-3Z"/><path d="m9 12 2 2 4-4"/></svg>
@@ -389,8 +389,7 @@ <h2><span class="num">02</span>Install &amp; run</h2>
           the credentials against Cisco before saving.
         </li>
         <li>
-          <b>Run it</b> from the folder holding your inventory — no link needed, nothing else
-          to supply:
+          <b>Run it</b> from the folder holding your inventory:
           <pre>cd /path/to/your/inventory-folder</pre>
           <pre>caia</pre>
           The report <code>impact_report_&lt;date&gt;.html</code> appears in an <code>output</code>
@@ -399,6 +398,18 @@ <h2><span class="num">02</span>Install &amp; run</h2>
           or <b>Needs review</b>. A device that could not be checked is never reported as safe;
           the report says why instead.
         </li>
+        <li>
+          <b>Or check one advisory bundle</b> — Cisco publishes firewall vulnerabilities in
+          bundled publications. Paste the Event Response link at the prompt, or skip the
+          prompt:
+          <pre>caia --erp ERP-75736</pre>
+          The report flips to <b>one row per advisory in that bundle</b>: the advisory, its
+          publication date, and which of your products it impacts with the release that fixes
+          them. Advisories that hit nothing still get a row. Firewalls that could not be
+          checked appear in every row they might belong to, marked <em>undetermined</em> — never
+          counted as unaffected. The report states how many advisories the bundle filter left
+          out, so it can't be mistaken for a whole-fleet assessment.
+        </li>
         <li>
           <b>Stay up to date</b> — check your version and update via uv:
           <pre>caia --version</pre>
diff --git a/specs/008-erp-bundle-scoped-report/checklists/requirements.md b/specs/008-erp-bundle-scoped-report/checklists/requirements.md
new file mode 100644
index 0000000..a7fae8f
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/checklists/requirements.md
@@ -0,0 +1,102 @@
+# Specification Quality Checklist: Bundle-Scoped Impact Reporting
+
+**Purpose**: Validate specification completeness and quality before proceeding to planning
+**Created**: 2026-07-28
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+- Items marked incomplete require spec updates before `/speckit-clarify` or `/speckit-plan`
+
+### Iteration 1 — 2026-07-28
+
+Two [NEEDS CLARIFICATION] markers remain, both raised deliberately rather than guessed. Each
+changes numbers a reader acts on, and each has more than one defensible reading:
+
+1. **FR-022 — the counting unit for "impacted products."** Device, distinct affected release, or
+   hardware-model-and-release combination. Against the current inventory `CVE-2026-20079` yields
+   5, 2, and 3 respectively. The originating request described the expected answer as "2
+   products", which points away from the per-device reading a naive implementation would take —
+   so this cannot be defaulted safely.
+2. **FR-025 — the evaluated population per row.** Every queryable inventory device, or only
+   devices in the families an advisory names. This sets the denominator behind FR-025 and FR-026
+   and interacts with FR-027's undetermined-device scoping.
+
+Both are scope-level decisions under the prioritisation rule (scope > security/privacy > UX >
+technical), which is why they were kept as markers rather than resolved by assumption.
+
+Fixes applied in this iteration:
+
+- **Scope bounding.** Eight explicit scope boundaries added to Assumptions, following the house
+  convention in specs 006 and 007 of stating boundaries inline rather than in a separate section.
+- **SC-008 made measurable.** "Within roughly the time a whole-fleet run takes today" replaced
+  with a bounded comparison (no more than 25% added elapsed time), so it can be verified.
+- **FR-022 strengthened** to require the count to be stated, not merely the products listed.
+
+### Iteration 2 — 2026-07-28
+
+Both clarifications answered and folded in; **all 16 items now pass**. Recorded in the spec's
+Clarifications section with the reasoning, and propagated to every dependent requirement rather
+than only to the two that carried the markers:
+
+- **Counting unit = device**, with a per-row rollup by affected release (FR-022, FR-022a). The
+  decisive constraint was FR-025: a release-based denominator cannot close, because an
+  undetermined device often has no release Cisco recognises and could not be placed in one.
+- **Row population = family-scoped**, whole-run totals stated once (FR-025, FR-026, FR-026a).
+  A single whole-inventory denominator was rejected on safety grounds, not readability: ~375
+  undetermined markers across 25 rows, most of them meaningless, would train readers to
+  disregard the marker Principle IV depends on.
+- **FR-027a/FR-027b added** to pin down family derivation — union of the families Cisco returned
+  the advisory for and those in its published product list, failing open to every family. FR-027b
+  makes the direction of the safety guarantee explicit: scoping may only narrow which rows an
+  *undetermined* device appears in, never suppress an impacted device or manufacture an
+  unaffected one. This replaced what had been deferred to planning, since leaving it open would
+  have let the plan choose an unsafe narrowing.
+- **Dependent sections realigned**: two new acceptance scenarios for family scoping and one for
+  the fail-open case, a new Covered family set entity, FR-026a's run totals reflected in SC-003,
+  and the row-population item removed from Deferred to planning.
+- **One item newly deferred**: how a row with many impacted devices is presented without
+  truncation. One advisory in the reference bundle impacts 50 of 70 devices, and FR-033's
+  self-containment rules out loading anything on demand.
+
+### Constitutional notes carried to planning
+
+Not checklist items, but recorded here so the plan's Constitution Check cannot miss them:
+
+- Fetching a bundle page adds `sec.cloudapps.cisco.com` as an endpoint the analyzer itself
+  contacts. Technology & Data Constraints designate that a reviewed change, requiring a
+  constitution amendment **before implementation** — the same gate spec 006 passed through for
+  the advisory API hosts. **Resolved**: amendment applied 2026-07-28, constitution 3.1.0 → 3.2.0,
+  on this feature branch as specs 006 (`cb6938a`) and 007 (`e043d41`) both did.
+- Principle IV is the binding constraint on the report layout: FR-024 through FR-028 exist
+  because a device whose assessment is undetermined has no advisory list at all, so it can
+  neither be asserted as impacted nor excluded as clean.
+- Principle VI requires bundle resolution and filtering to be headless (FR-039, FR-040); the
+  prompt and report writing stay in the terminal program.
+- Principle V bounds what may leave the machine: bundle resolution transmits no inventory-derived
+  data (FR-037).
diff --git a/specs/008-erp-bundle-scoped-report/contracts/bundle-report.md b/specs/008-erp-bundle-scoped-report/contracts/bundle-report.md
new file mode 100644
index 0000000..447a2c4
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/contracts/bundle-report.md
@@ -0,0 +1,141 @@
+# Interface Contract: the bundle-scoped HTML report
+
+The second report layout, alongside the whole-fleet report contracted in spec 006
+(`contracts/html-report.md`). Both are produced from the same assessment and must never disagree
+about a device.
+
+## Output
+
+| Property | Value | Requirement |
+| --- | --- | --- |
+| Location | `output/` inside the working folder | unchanged |
+| Filename | `impact_report_<BUNDLE_ID>_<YYYYmmdd_HHMMSS>.html` | FR-032, Decision 10 |
+| Overwrite | never; a colliding path selects a new one | FR-033 |
+| Self-contained | single file, no external reference of any kind | FR-033 |
+
+Keeping the `impact_report_` prefix means the constitution's recorded `impact_report_*.html` output
+pattern and `.gitignore`'s existing rule both continue to match with no change to either.
+
+## Document structure
+
+```
+┌ Bundle header ───────────────────────────────────────────────┐
+│ ERP-75736 · title · bundle published date · link to page     │  FR-031
+│ "Bundle-scoped report" stated explicitly                     │  FR-032
+├ Run totals ──────────────────────────────────────────────────┤
+│ 70 assessed · 15 undetermined · 27 questions asked           │  FR-026a
+│ N advisories affecting this inventory are outside this bundle │  FR-016
+│ [partial-run cause, when present]                            │  FR-038
+├ Advisory rows ───────────────────────────────────────────────┤
+│ one row per advisory in the bundle, ordered deterministically │  FR-017, FR-019, FR-029
+├ Undetermined devices ────────────────────────────────────────┤
+│ each device once, with recorded values and reason            │  FR-030
+├ Resolved scope ──────────────────────────────────────────────┤
+│ the advisory identifiers as resolved at run time             │  FR-034
+└──────────────────────────────────────────────────────────────┘
+```
+
+## An advisory row
+
+| Element | Content | Requirement |
+| --- | --- | --- |
+| Identifier | `advisoryId`, linked to `publicationUrl`, opens in a new tab with no access to the report | FR-020 |
+| Published | `firstPublished`, as Cisco publishes it | FR-021 |
+| Severity / CVSS | `sir`, `cvssBaseScore` | — |
+| CVEs | in-row; never promoted to their own row | scope boundary |
+| Evaluated against | population size **and** covered families | FR-026 |
+| Impacted | every device named, with its first-fix release | FR-022, FR-023 |
+| Release rollup | device count · affected releases · fixing release | FR-022a |
+| Undetermined | every applicable device, yellow **and** labelled in words | FR-024, FR-027 |
+| Counts | impacted / unaffected / undetermined | FR-025 |
+
+### Link safety
+
+The identifier link must open in a new tab **and** deny the opened page access to the report
+document. The whole-fleet report already establishes this behaviour (commit `544629c`, "open
+advisories in a new tab"); this layout matches it.
+
+### The accounting invariant
+
+Every row satisfies:
+
+```
+impacted + unaffected + undetermined == population
+```
+
+This is the report's own self-check and is directly assertable in tests for every row (FR-025,
+SC-003).
+
+### Long rows
+
+A row whose device list exceeds the display threshold is placed inside the existing
+`<details>`/`<summary>` disclosure, with **every** device name present in the document. Collapsing
+is required; truncation is forbidden — one advisory in the reference bundle impacts 50 of 70 devices,
+and a hidden device is an unpatched device (research Decision 11).
+
+### A row that impacts nothing
+
+Present, never omitted (FR-017). It states that no inventory device is impacted, names the
+population and families it was evaluated against, and still shows its undetermined count. A bare
+"0 impacted" is not sufficient: without the population it reads as reassurance about products that
+were never assessed.
+
+## Undetermined rendering — the safety rules
+
+These implement Principle IV and are the report's non-negotiable behaviour.
+
+| Rule | Requirement |
+| --- | --- |
+| Visually distinct, using yellow | FR-024 |
+| Labelled in words as well as coloured — meaning never depends on colour | FR-024 |
+| Present in every row whose advisory covers the device's family | FR-027 |
+| Never counted or summarised as unaffected, anywhere, including totals | FR-028 |
+| Listed once in its own section with the recorded values and a reason | FR-030 |
+| Included rather than omitted when family derivation yields nothing | FR-027a |
+
+A reader must not be able to reach a screen, count, or summary in which an undetermined device
+appears to be clean.
+
+## Escaping
+
+Every interpolated value is escaped at the point of interpolation, whether it came from Cisco's API
+or the bundle page:
+
+| Source | Treatment |
+| --- | --- |
+| `advisoryTitle`, `cves`, `sir` | escaped (advisory `summary` is known to carry raw HTML) |
+| `publicationUrl` | escaped as an attribute value |
+| Bundle title, `Doc ID`, dates | escaped — a scraped page is the least trustworthy input |
+| Device names, models, releases | escaped |
+
+No page- or API-supplied value may alter the document's structure, styling, or behaviour, or become
+executable content (FR-012).
+
+## Interaction
+
+| Capability | Requirement |
+| --- | --- |
+| Filter and sort rows by severity and impacted count | FR-035 (SHOULD) |
+| Per-device cross-reference: one device → every bundle advisory affecting it | FR-036 (SHOULD) |
+
+Both must work with no network access, so any behaviour is inline. A CDN-hosted table library was
+already rejected for the whole-fleet report for exactly this reason (spec 006, Decision 12).
+
+## Default ordering
+
+Severity rank (`critical` → `informational`, unknown last), then descending impacted device count,
+then advisory identifier. The identifier tiebreak is what makes the order total and therefore
+reproducible run to run (FR-029). Reuses the whole-fleet report's existing severity mapping so the
+two layouts agree on what severity means.
+
+## Relationship to the whole-fleet report
+
+| | Whole-fleet | Bundle-scoped |
+| --- | --- | --- |
+| Row unit | device | advisory |
+| Scope | every advisory affecting the inventory | only advisories the bundle lists |
+| Produced when | no bundle supplied | a bundle resolves |
+| Verdict rules | identical — one assessment feeds both | identical |
+
+Neither may report a different verdict for the same device from the same assessment. The layouts
+differ only in aggregation and scope.
diff --git a/specs/008-erp-bundle-scoped-report/contracts/bundle-run-cli.md b/specs/008-erp-bundle-scoped-report/contracts/bundle-run-cli.md
new file mode 100644
index 0000000..3b2c7ad
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/contracts/bundle-run-cli.md
@@ -0,0 +1,119 @@
+# Interface Contract: the command-line surface for a bundle-scoped run
+
+Extends the run contract in spec 006 (`contracts/api-run-cli.md`). Everything not stated here is
+unchanged.
+
+## Invocation
+
+```bash
+# interactive — prompts for the bundle after locating the inventory
+caia
+
+# flag-driven — never prompts
+caia --erp https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736
+
+# a bare bundle identifier is accepted and expanded
+caia --erp ERP-75736
+```
+
+| Option | Behaviour | Requirement |
+| --- | --- | --- |
+| `--erp URL\|ERP-#####` | Scope the run to this bundle. Suppresses the prompt entirely | FR-002, FR-005 |
+| *(absent, interactive)* | Prompt for a bundle; declining produces the whole-fleet report | FR-001, FR-003 |
+| *(absent, non-interactive)* | Whole-fleet report, no prompt | FR-002 |
+
+Existing options — `--inventory`, `--sheet`, `--output-dir`, `--config`, `--version`, `--update`,
+`--uninstall` — are unchanged and compose with `--erp` as they do with each other.
+
+Principle III requires this dual surface: a capability reachable only by typing is not scriptable,
+so `--erp` is a constitutional requirement rather than a convenience.
+
+## Run sequence
+
+```
+1. resolve credentials                    (unchanged — refuses to run without them)
+2. locate the inventory                   (unchanged)
+3. resolve the bundle                     ← new, and BEFORE any advisory request
+4. confirm: bundle id, title, N advisories ← new
+5. fetch catalogues, assess the inventory (unchanged)
+6. metadata lookup for zero-impact bundle advisories  ← new
+7. filter to the bundle, build rows, write the report  ← new layout
+```
+
+Step 3 precedes step 5 deliberately: a wrong link must cost nothing (FR-001, FR-009). A bundle
+failure at step 3 means no advisory request was made, so no quota is spent and no partial state
+exists.
+
+Step 6 runs only for bundle advisories that appeared in no device's result — measured at 1 of 25 for
+the reference bundle, worst case the bundle size.
+
+## Confirmation before the run
+
+Step 4 reports what was resolved, so a wrong bundle is caught by the person who knows:
+
+```
+Bundle ERP-75736 — Cisco Event Response: March 2026 Cisco Secure Firewall ASA,
+Secure FMC, and Secure FTD Software Security Advisory Bundled Publication
+25 advisories · published 2026 March 4 16:00 GMT
+```
+
+The advisory count is the load-bearing part: it is the check that catches a markup change silently
+yielding 24 of 25 (`erp-access.md` § Stability).
+
+## Prompt behaviour
+
+| Input | Result | Requirement |
+| --- | --- | --- |
+| A bundle URL | resolve and proceed | FR-001 |
+| A bare `ERP-#####` | expand, resolve, proceed | FR-005 |
+| Empty / declined | whole-fleet report | FR-003 |
+| Not a Cisco Event Response address | rejected **before** any request; re-prompt | FR-004, FR-010 |
+| Anything, when resolution then fails | state which failure; offer another attempt | FR-010 |
+| Declining after a failed attempt | whole-fleet report, not an exit with no output | US5 §4 |
+
+The prompt is never reached when `--erp` is supplied, and never shown in a non-interactive run.
+
+## Exit codes
+
+Reuses the existing vocabulary rather than adding to it (research Decision 13).
+
+| Code | Meaning |
+| --- | --- |
+| `0` | Report written — including a bundle where nothing is impacted, and a partial run |
+| `1` | Bundle unreachable, no advisory identified, `Doc ID` mismatch; or an existing run failure |
+| `2` | `--erp` value is not a bundle address; or an existing argument error |
+| `130` | Interrupt |
+
+A malformed value is a bad argument (`2`); a failed fetch is a failed run (`1`). Both are
+distinguishable from success, as FR-011 requires.
+
+**No report is written on any non-zero bundle-resolution outcome** (FR-011). An empty bundle is an
+error, never an empty report.
+
+## Partial runs
+
+Unchanged from spec 006 (FR-038). If Cisco becomes unreachable or rejects the token *after* the
+assessment begins, every answer already obtained is kept, unreached devices are undetermined, the
+report is written, and it states that the run was partial and why. Exit stays `0`.
+
+A bundle-resolution failure is **not** a partial run — it happens before any answer exists, so there
+is nothing to keep.
+
+## Headless boundary (Principle VI)
+
+| Concern | Belongs to | Requirement |
+| --- | --- | --- |
+| Resolving a bundle; filtering; building rows | shared surface — no print, prompt, working-folder access, file write, or process exit | FR-039 |
+| Prompting, confirmation output, progress, report writing, exit codes | the terminal program | FR-039 |
+
+A failure to *reach* Cisco surfaces as a raised error, never as an empty bundle or a set of
+undetermined verdicts, so a caller can always tell "we could not ask" from "we asked and could not
+decide" (FR-040).
+
+## What is unchanged
+
+- Verdict rules, verdict vocabulary, reason kinds.
+- The whole-fleet report, byte-for-byte equivalent in content for the same inputs (FR-003, SC-006).
+- Inventory format and discovery; credential handling and storage.
+- Request pacing, and the existing quota discipline (FR-041).
+- Cross-platform behaviour (FR-042).
diff --git a/specs/008-erp-bundle-scoped-report/contracts/erp-access.md b/specs/008-erp-bundle-scoped-report/contracts/erp-access.md
new file mode 100644
index 0000000..e0faa03
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/contracts/erp-access.md
@@ -0,0 +1,133 @@
+# External Interface Contract: Cisco Security Center Event Response pages
+
+The second external interface this tool depends on, alongside the PSIRT API
+(`contracts/psirt-access.md` in spec 006). Every behaviour recorded here was observed against the
+live page on 2026-07-28 using ERP-75736.
+
+## Host
+
+| Host | Purpose |
+| --- | --- |
+| `sec.cloudapps.cisco.com` | Resolve a bundle to its advisory identifiers and its own identity |
+
+This is a **new** external endpoint the analyzer itself contacts. The constitution's Technology &
+Data Constraints require a reviewed change; the amendment is a blocking prerequisite (research
+Decision 9).
+
+## Request
+
+```
+GET https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-#####
+Accept: text/html
+```
+
+- No authentication. This is a public page; it does **not** use the PSIRT credentials.
+- **No inventory-derived data is transmitted.** The request carries only the bundle identifier the
+  user supplied (FR-037, Principle V).
+- Time-bounded, and issued before any advisory request (FR-013, research Decision 12).
+
+Observed: **HTTP 200**, 181,576 bytes, **0.54 s**, with and without a browser user-agent.
+
+> `curl` was observed to time out against this host while `urllib` succeeded on first attempt. The
+> tool therefore makes no assumption that a browser engine or a particular user-agent is required.
+
+## Response — what may be taken from it
+
+The page is a **scope selector**, not an authority. This split is the contract's central rule.
+
+| May be taken | Field | Why permitted |
+| --- | --- | --- |
+| ✅ | advisory identifiers | *which* advisories are in scope — the bundle's membership |
+| ✅ | `Doc ID` | the bundle's own identity |
+| ✅ | document title | the bundle's own name |
+| ✅ | `First Published` | the bundle's own publication date |
+| ✅ | `Version` | the bundle's own revision |
+
+| MUST NOT be taken | Also displayed on the page | Authority instead |
+| --- | --- | --- |
+| ✖ | advisory titles | PSIRT API |
+| ✖ | CVE identifiers | PSIRT API |
+| ✖ | Security Impact Rating | PSIRT API |
+| ✖ | CVSS base score | PSIRT API |
+| ✖ | affected products / releases | PSIRT API |
+| ✖ | fixing releases | PSIRT API |
+
+The page displays every one of the forbidden fields in its table. Taking them would create a second
+source for facts the API already owns, and two sources for one fact eventually disagree (FR-007,
+FR-008).
+
+## Extraction
+
+Advisory identifiers come from `href` attributes of anchor elements, via the standard-library HTML
+parser:
+
+```
+CiscoSecurityAdvisory/(cisco-sa-[A-Za-z0-9._-]+)
+```
+
+Observed on ERP-75736: **25 identifiers**, each appearing exactly once in the raw markup.
+
+A lexical scan of the whole document returned the identical 25, so the two approaches agree today.
+The parser is required anyway: an advisory identifier mentioned in prose rather than linked would
+silently widen the bundle's scope, and scope is the one thing this page is trusted for.
+
+> **The identifiers are not in the page's visible text.** They exist only in link targets. Text
+> extraction alone yields advisory *titles* and returns zero identifiers — a failure mode that looks
+> like an empty bundle rather than an error.
+
+Bundle identity comes from the same parse pass, over the page's accumulated text:
+
+| Value | Pattern | Observed |
+| --- | --- | --- |
+| `Doc ID` | `Doc ID:\s*(ERP-\d+)` | `ERP-75736` |
+| `First Published` | `First Published:\s*(…)` | `2026 March 4 16:00 GMT` |
+| `Version` | `Version:\s*([0-9.]+)` | `1.0` |
+| title | document title element | `Cisco Event Response: March 2026 Cisco Secure Firewall ASA, Secure FMC, and Secure FTD Software Security Advisory Bundled Publication` |
+
+## Cross-check
+
+The extracted `Doc ID` MUST equal the `alertId` in the submitted URL. Observed: they agree.
+
+Disagreement means the request was redirected to a different or generic page, and is a resolution
+failure — otherwise the report would confidently name a bundle it did not analyse.
+
+## Outcomes
+
+| Outcome | Detection | Exit | Report |
+| --- | --- | --- | --- |
+| Resolved | ≥1 identifier, `Doc ID` agrees | `0` | written |
+| Not a bundle address | rejected **before** any request | `2` | none |
+| Unreachable | transport failure or timeout | `1` | none |
+| No advisory identified | reachable, zero identifiers | `1` | none |
+| `Doc ID` mismatch | cross-check fails | `1` | none |
+| Interrupted | — | `130` | none |
+
+The three failures are reported distinguishably (FR-010), and none produces a report (FR-011). An
+empty bundle is an **error**, never an empty report — an empty report reads as good news.
+
+## Trust
+
+Everything retrieved is untrusted text. The bundle title and every other page-derived value is
+escaped where it is interpolated into the report, and cannot alter its structure, styling, or
+behaviour, nor become executable content (FR-012, research Decision 14). A scraped page is a
+strictly less trustworthy input than an API response and inherits the stricter treatment the report
+already applies to advisory content.
+
+## Stability
+
+Bundle membership is re-resolved on every run, so a revised page is picked up with no tool release,
+and no bundle state is cached.
+
+The dependency on Cisco's markup is real and is mitigated rather than eliminated: FR-009 shows the
+resolved advisory count to the user *before* the run begins, so a parse that silently returns 24 of
+25 is caught by the person who knows the answer. A publication-date cross-check was considered and
+rejected — it cannot distinguish a missed advisory from a same-day publication the bundle
+legitimately excludes (research Decision 4).
+
+## What this interface is not
+
+There is no bundle endpoint in Cisco's advisory API: `GET /security/advisories/v2/eventresponse/
+ERP-75736` returns **HTTP 404**. A publication-date window over the API
+(`/all/firstpublished?startDate=2026-03-04&endDate=2026-03-05`) returns 27 advisories — the
+bundle's 25 plus two unrelated same-day publications — so it is a superset of a bundle, never a
+substitute for one.
diff --git a/specs/008-erp-bundle-scoped-report/data-model.md b/specs/008-erp-bundle-scoped-report/data-model.md
new file mode 100644
index 0000000..d00855c
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/data-model.md
@@ -0,0 +1,179 @@
+# Phase 1 Data Model: Bundle-Scoped Impact Reporting
+
+**Feature**: 008-erp-bundle-scoped-report · **Date**: 2026-07-28
+
+Nothing here redefines an existing entity. The per-device assessment result produced by spec 006 is
+consumed unchanged; this feature adds a bundle, a per-advisory aggregation over that result, and the
+rules governing both.
+
+---
+
+## 1. Bundle
+
+The resolved scope of a run. Produced by `erp.py` from a bundle page; never persisted.
+
+| Field | Source | Notes |
+| --- | --- | --- |
+| `bundle_id` | page `Doc ID`, cross-checked against the URL's `alertId` | e.g. `ERP-75736`. Disagreement is a resolution failure |
+| `title` | page document title | Untrusted text (FR-012) |
+| `published` | page `First Published` | The bundle's own date, distinct from any advisory's |
+| `version` | page `Version` | e.g. `1.0`. Recorded so a revised bundle is visible |
+| `url` | the submitted URL, normalised | Linked from the report (FR-031) |
+| `advisory_ids` | `href` attributes of advisory links | Ordered, **deduplicated** (FR-014) |
+
+### Validation
+
+| Rule | On failure | Requirement |
+| --- | --- | --- |
+| URL is a Cisco Event Response address | reject before any network request; exit `2` | FR-004, FR-010 |
+| A bare `ERP-#####` is accepted and expanded | — | FR-005 |
+| Page is reachable within the fetch timeout | connectivity failure; exit `1`; no report | FR-010, FR-013 |
+| `advisory_ids` is non-empty | explicit "no advisories identified"; exit `1`; no report | FR-010, FR-011 |
+| page `Doc ID` equals the URL's `alertId` | resolution failure | Decision 2 |
+
+A `Bundle` never reaches the report unless every rule passes. There is no partially-valid bundle.
+
+---
+
+## 2. Covered family set
+
+The product families one advisory applies to. Determines a row's population, and **only** that.
+
+```
+covered(advisory) = families_answering(advisory) ∪ families_named(advisory)
+                    ─── or, if both are empty ───
+                    every queryable family
+```
+
+| Source | Derivation | Authority |
+| --- | --- | --- |
+| `families_answering` | families whose family-scoped question returned this advisory | Cisco's own answer — no inference |
+| `families_named` | firewall families recognised in the advisory's `productNames` | Cisco's published product list |
+
+### Invariants (FR-027b)
+
+1. Narrowing may only reduce which rows an **undetermined** device appears in.
+2. It can never exclude a device Cisco positively listed as impacted.
+3. It can never move a device into *confirmed unaffected*.
+4. An empty derivation widens to every family; it never empties a population.
+
+Invariants 2 and 3 hold structurally, because impacted and unaffected are read from the device's own
+assessment, never from the family set. The family set is consulted for one purpose only: deciding
+whether an undetermined device belongs in a given row.
+
+---
+
+## 3. Bundle advisory row
+
+One row of the report. Exactly one per advisory in `Bundle.advisory_ids` (FR-017, FR-019).
+
+| Field | Source | Requirement |
+| --- | --- | --- |
+| `advisory_id` | `advisoryId` | FR-020 |
+| `url` | `publicationUrl` | FR-020 |
+| `published` | `firstPublished` | FR-021 |
+| `title` | `advisoryTitle` | untrusted text |
+| `severity` | `sir` | FR-029 ordering |
+| `cvss` | `cvssBaseScore` | supplementary |
+| `cves` | `cves` | shown in-row, never as its own row |
+| `covered_families` | §2 | FR-026 |
+| `population` | inventory devices whose family ∈ `covered_families` | FR-025, FR-026 |
+| `impacted` | devices in `population` whose assessment lists this advisory | FR-022 |
+| `unaffected` | devices in `population` with a positive not-impacted verdict | FR-025 |
+| `undetermined` | devices in `population` whose assessment reached no conclusion | FR-024, FR-027 |
+| `release_rollup` | `impacted` grouped by affected release | FR-022a |
+
+Every advisory field comes from Cisco's API — for rows with at least one impacted device, from the
+payload already retrieved; otherwise from a per-advisory lookup (research Decision 4). No field is
+ever taken from the bundle page (FR-007, FR-008).
+
+### The accounting invariant (FR-025)
+
+```
+len(impacted) + len(unaffected) + len(undetermined) == len(population)
+```
+
+This must hold for **every** row and is the report's own self-check. It is why the device is the
+unit of count: a release-based denominator cannot close, because an undetermined device frequently
+has no release Cisco recognises and so cannot be placed in one.
+
+### Release rollup (FR-022a)
+
+Presentation only, derived from `impacted`, and never a denominator:
+
+```
+5 devices · 2 affected releases (7.4.2.3, 7.4.2.4) · fixed in 7.4.4
+```
+
+---
+
+## 4. Impacted product entry
+
+| Field | Source | Notes |
+| --- | --- | --- |
+| `name` | inventory | As the inventory names it, so a reader can match their records |
+| `model`, `release` | inventory | The recorded values |
+| `first_fix` | `platforms[].firstFixes[].name` for this advisory | Absent renders as explicitly absent, never inferred (FR-023) |
+
+---
+
+## 5. Undetermined product entry
+
+| Field | Source | Notes |
+| --- | --- | --- |
+| `name`, `model`, `release` | inventory | The recorded values |
+| `reason` | the existing reason kind and detail | Rendered in the report's undetermined section (FR-030) |
+
+Reason kinds are reused unchanged from spec 006 — `release_unknown`, `release_not_on_platform`,
+`model_unmapped`, `field_missing`, `family_unsupported`, `check_incomplete`. This feature adds none.
+
+Rendering rules: visually distinct using yellow **and** labelled in words, so meaning never depends
+on colour (FR-024); counted in neither impacted nor unaffected, anywhere, including totals (FR-028).
+
+---
+
+## 6. Run totals
+
+Stated once, independent of any row's population (FR-026a).
+
+| Field | Notes |
+| --- | --- |
+| `devices_assessed` | every inventory row |
+| `devices_undetermined` | across the whole run |
+| `questions_asked` | distinct questions put to Cisco |
+| `suppressed_advisories` | distinct advisories affecting the inventory that the bundle does not list (FR-016) |
+| `partial_cause` | present when the run stopped early (FR-038) |
+
+`suppressed_advisories` is a count, not an itemisation — it exists so the report cannot be mistaken
+for a whole-fleet assessment, not to smuggle the whole-fleet result back in.
+
+---
+
+## 7. Worked example — ERP-75736 against the reference inventory
+
+70 devices (37 FTD, 28 ASA, 5 FMC), 27 questions, 32 requests, 15 undetermined.
+
+| Row | Covered | Population | Impacted | Unaffected | Undetermined | Sums |
+| --- | --- | --- | --- | --- | --- | --- |
+| `cisco-sa-onprem-fmc-authbypass-5JPp45V2` | FMC | 5 | 5 | 0 | 0 | ✅ 5 |
+| `cisco-sa-asa-dos-FCvLD6vR` | ASA | 28 | 0 | 17 | 11 | ✅ 28 |
+| `cisco-sa-ftd-snort3ssl-FBEKYXpH` | FTD | 37 | 11 | 22 | 4 | ✅ 37 |
+| `cisco-sa-asaftd-ikev2-dos-eBueGdEG` | ASA, FTD | 65 | 50 | 0 | 15 | ✅ 65 |
+
+The critical FMC row demonstrates the counting decision: **5 devices**, rolled up as **2 affected
+releases** (7.4.2.3 ×3, 7.4.2.4 ×2), all fixed in **7.4.4**.
+
+The ASA row demonstrates why undetermined devices cannot be dropped: 0 impacted, but 11 of 28
+devices were never conclusively assessed. Rendered as "no impact" alone it would read as an all-clear
+for 11 devices nobody assessed.
+
+Under the rejected whole-inventory population, every row above would read `70`, and all 15
+undetermined devices would appear in all 25 rows — about 375 markers, of which the FMC row's 15
+would be nonsense, since an ASA appliance cannot run FMC software.
+
+---
+
+## 8. State transitions
+
+None. A bundle is resolved, used, and discarded within one run; no bundle state, cache, or history
+persists between runs. The per-device verdict lifecycle is unchanged from spec 006.
diff --git a/specs/008-erp-bundle-scoped-report/plan.md b/specs/008-erp-bundle-scoped-report/plan.md
new file mode 100644
index 0000000..239154d
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/plan.md
@@ -0,0 +1,287 @@
+# Implementation Plan: Bundle-Scoped Impact Reporting
+
+**Branch**: `008-erp-bundle-scoped-report` | **Date**: 2026-07-28 | **Spec**: [spec.md](./spec.md)
+
+**Input**: Feature specification from `/specs/008-erp-bundle-scoped-report/spec.md`
+
+## Summary
+
+Cisco publishes Secure Firewall vulnerabilities in bundled publications — one Event Response page
+listing every advisory released that day. This feature lets a user scope a run to one such bundle by
+pasting its URL, and inverts the report from one row per device to **one row per advisory in the
+bundle**, each carrying the advisory identifier as a link, its publication date, and the products it
+impacts with their fixing releases.
+
+The technical approach adds no new data source. The advisory identifier and publication date are
+already inside the payload the tool retrieves per device, so filtering an assessment to a bundle
+costs zero additional requests; only advisories that impact nothing need an individual lookup (1 of
+25 for the reference bundle). Cisco publishes no bundle endpoint, so the bundle's membership is read
+from its published page — which contributes *scope only*, never an advisory fact.
+
+The design's load-bearing constraint is Principle IV. A device whose assessment reached no conclusion
+has no advisory list at all, so its status against any specific advisory is genuinely unknown: it can
+neither be asserted as impacted nor excluded as clean. Every report decision follows from that.
+
+## Technical Context
+
+**Language/Version**: Python 3.9+ (matches `requires-python` in `pyproject.toml`)
+
+**Primary Dependencies**: None new. Standard library only — `urllib.request` (bundle page fetch),
+`html.parser` (bundle page parsing, new to this project), `html.escape` (report rendering), `re`
+(identifier and metadata extraction), `datetime`/`pathlib` (report naming). Existing runtime
+dependencies (`openpyxl`, `python-dotenv`) are untouched.
+
+**Storage**: None added. A resolved bundle lives in memory for one run and is never persisted — no
+bundle cache, no history, no state between runs. The only file written is the report.
+
+**Testing**: `unittest` + `unittest.mock` (existing suite under `tests/`; baseline **272 tests, OK**).
+Bundle parsing, family derivation, and row building are pure or injectable, so all of it is covered
+with no credentials and no network — required by the constitution's Tests gate. New:
+`tests/test_erp.py`, `tests/test_bundle.py`, `tests/test_bundle_report.py`; extended:
+`tests/test_cli.py` (`--erp` parsing, prompt suppression, exit codes), `tests/test_analyzer.py`
+(prompt and decline paths). A committed fixture of the reference bundle page keeps parsing tests
+offline.
+
+**Target Platform**: macOS, Windows, Linux (Constitution II).
+
+**Project Type**: Single-project CLI (installed as the `caia` console script), and an importable
+library whose shared surface is a released interface (Principle VI).
+
+**Performance Goals**: Bounded by Cisco's quota, as before. The bundle page fetch is measured at
+**0.54 s**. The assessment is unchanged: 70 devices → 27 questions → 32 requests ≈ 72 s. Zero-impact
+metadata adds one request per such advisory at the existing ~2.1 s pacing — 1 request for the
+reference bundle, worst case the bundle size (~53 s if a bundle touches nothing). Total added cost
+in the measured case: **~3 s on a 72 s run**, well inside SC-008's 25% bound.
+
+**Constraints**: An undetermined device must never appear as unaffected in any row, count, or summary
+(Principle IV, the feature's safety property); the bundle page may supply scope and the bundle's own
+identity but no advisory fact; no new runtime dependency (Principle I); bundle resolution must
+transmit no inventory-derived data (Principle V); resolution and filtering must be headless
+(Principle VI); the report must remain a single offline-capable file that is never overwritten; all
+page- and API-supplied content escaped at interpolation; the whole-fleet report unchanged.
+
+**Scale/Scope**: 3 new modules (`erp.py`, `bundle.py`, `bundle_report.py`; ~700–900 lines, majority
+in the renderer), 3 modified modules (`cli.py`, `analyzer.py`, and the README shared-surface table),
+3 new test modules + 2 extended, 1 committed page fixture, docs updates in `README.md` and
+`docs/index.html`, a `VERSION` bump to 4.2.0, and a constitution amendment. No new directories
+beyond `specs/`.
+
+## Constitution Check
+
+*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
+
+Evaluated against the Cisco Advisory Impact Analyzer Constitution **v3.2.0**, which was amended as a
+prerequisite of this feature (see [Constitution amendment (applied)](#constitution-amendment-applied)
+below). All gates now pass unconditionally.
+
+- **I. Standard-Library-First & Minimal Dependencies** — PASS. No new runtime dependency. The bundle
+  page is fetched with `urllib` and parsed with `html.parser`, both standard library. A third-party
+  HTML parser was considered and rejected: the standard parser extracted all 25 identifiers from the
+  live page, so nothing is missing that would justify a dependency (research Decision 1). Driving a
+  real browser was also considered and rejected as unnecessary — `urllib` fetched the page in 0.54 s
+  on first attempt, despite an earlier `curl` timeout suggesting otherwise.
+
+- **II. Cross-Platform Parity** — PASS. Fetching and parsing are platform-neutral; report paths reuse
+  the existing `pathlib` logic; no new per-user path is introduced. Nothing in this feature touches
+  terminal handling, which is where platform divergence has previously threatened this principle.
+
+- **III. CLI-First, Scriptable Interface** — PASS. `--erp` makes the capability fully flag-driven, so
+  a bundle review needs no human input and can be scheduled; the prompt is the interactive
+  convenience, not the only route in. Exit codes reuse the existing vocabulary — `2` for a value that
+  is not a bundle address, `1` for unreachable or empty, `130` on interrupt (research Decision 13) —
+  so no new code has to be learned. Every refusal states which of the three failures occurred and
+  what to do (FR-010).
+
+- **IV. Conservative & Traceable Analysis (NON-NEGOTIABLE)** — PASS, and as with spec 006 this
+  principle drove the design rather than merely permitting it.
+  - *Insufficient data must not be a guess*: an undetermined device is carried into every row whose
+    advisory covers its family, rendered yellow **and** labelled in words, and excluded from every
+    count of impacted and unaffected (FR-024, FR-027, FR-028). The reference inventory makes the
+    stakes concrete — one row reads 0 impacted, 17 unaffected, **11 undetermined** out of 28.
+  - *Never presented as unaffected*: the per-row accounting invariant
+    (`impacted + unaffected + undetermined == population`) is directly assertable for every row, so
+    a device silently dropped from a row is a test failure rather than a reading error (FR-025).
+  - *Traceable to official Cisco source data*: every advisory fact comes from the API, including for
+    advisories that impact nothing; the bundle page contributes only which advisories are in scope
+    and the bundle's own identity (FR-007, FR-008). Each row links to Cisco's published advisory.
+  - *Fail closed*: family derivation unions two sources and **fails open to every family** when both
+    are empty, so its worst outcome is a noisier report, never a suppressed device. FR-027b states
+    the invariant: derivation may only narrow which rows an *undetermined* device appears in, and can
+    never suppress an impacted device or manufacture an unaffected one (research Decision 5).
+  - A single whole-inventory population was the first candidate and was **rejected on this
+    principle's own grounds**: ~375 undetermined markers across 25 rows, most of them meaningless,
+    trains a reader to skip the marker the principle depends on.
+
+- **V. Secrets Hygiene & Data Locality** — PASS. The bundle page request is unauthenticated and
+  carries **only** the bundle identifier the user supplied — no inventory-derived data of any kind
+  (FR-037). The PSIRT credentials are not sent to this host. The existing disclosure bound to Cisco's
+  API (family, platform, release — never a firewall name) is unchanged and not widened. The report
+  lands in the already-ignored `output/`, and keeping the `impact_report_` filename prefix means
+  `.gitignore`'s existing rule still matches it (research Decision 10).
+
+- **VI. Headless Shared Surface** — PASS, with an amendment required to keep the principle's own text
+  accurate. Bundle resolution and filtering print nothing, prompt for nothing, consult no working
+  folder, write no file, and never exit the process; prompting, confirmation output, and report
+  writing stay in the terminal program (FR-039). A failure to *reach* Cisco raises rather than
+  returning an empty bundle or a set of undetermined verdicts, preserving the "could not ask" vs
+  "asked and could not decide" distinction the principle requires (FR-040). Two new modules join the
+  shared surface — `erp` and `bundle` — because the ERP parse and the family derivation are exactly
+  the fragile, safety-bearing logic a second consumer would otherwise reimplement, and a second,
+  divergent answer about which advisories are in scope is the harm this principle exists to prevent
+  (research Decision 7). Principle VI names its four modules explicitly, so extending the surface is
+  an amendment, not an implementation detail.
+
+- **Technology & Data Constraints** — PASS (as amended). Two clauses were implicated:
+  - *Networking*: the analyzer today contacts only `apix.cisco.com` and `id.cisco.com`, and the
+    constraint states that "adding any further external endpoint the analyzer itself contacts remains
+    a reviewed change". `sec.cloudapps.cisco.com` is such an endpoint. The review is this section;
+    the amendment records the outcome.
+  - *Source of truth*: "No scraped or cached-as-authoritative alternatives." This feature reads a
+    published page, so the boundary must be made explicit rather than left to interpretation — the
+    page is a **scope selector**, contributing which advisories are in scope and the bundle's own
+    identity, and is forbidden from supplying any advisory fact. That is a narrowing clause, not a
+    relaxation: it grants exactly what the feature needs and explicitly closes the door on the
+    page becoming an authority. The page displays advisory titles, CVEs, severities and scores, all
+    of which the tool must ignore in favour of the API (`contracts/erp-access.md`).
+  - *Inputs/outputs*: no change needed. The report keeps the recorded `impact_report_*.html` pattern.
+
+- **Development Workflow & Quality Gates** — PASS (obligations captured as tasks). Bundle parsing,
+  family derivation, row building and rendering are all verdict-adjacent logic and therefore *must*
+  have tests; all of it is pure or injectable, so the suite runs with no credentials and no network,
+  as the gate requires. Principle VI's headless property gets its own tests (prints nothing, does not
+  exit, does not mutate the caller's inventory, raises when Cisco is unreachable). The README
+  shared-surface table must be updated in the same pull request, since two modules join the surface.
+  `README.md` and `docs/index.html` must both document the bundle flow, mirrored in one PR. `VERSION`
+  moves to 4.2.0 — MINOR, because the shared surface gains and nothing incompatible changes (research
+  Decision 8). Work proceeds on `008-erp-bundle-scoped-report` off `main` and merges via pull request.
+
+### Constitution amendment (applied)
+
+Applied on this branch as one edit to `.specify/memory/constitution.md`, bumping **3.1.0 → 3.2.0**
+(MINOR: a new constraint bullet plus materially expanded guidance and an extended surface list, with
+no principle removed or redefined and no existing permission widened), with a Sync Impact Report and
+`Last Amended` set to 2026-07-28. Four changes:
+
+1. **Networking** — `sec.cloudapps.cisco.com` admitted as an endpoint the analyzer itself contacts,
+   scoped to resolving a bundle to its advisory identifiers and the bundle's own identity. The
+   request is explicitly unauthenticated and forbidden from carrying **any** inventory-derived
+   data — a stricter bound than the advisory API's, which may carry the derived
+   family/platform/release triple.
+2. **Scope selectors** — a **new** constraint bullet, rather than a relaxation of "No scraped or
+   cached-as-authoritative alternatives". It grants a narrow, enumerated permission: a bundle page
+   MAY supply which advisories are in scope and the bundle's own identity, and MUST NOT supply any
+   advisory fact — title, severity, score, CVE, affected product, fixing release, or an advisory's
+   publication date, every one of which the page actually displays. Disagreement between page and
+   API resolves in the API's favour without exception, and a page yielding no advisory is an error
+   rather than an empty scope, because an empty result rendered as a report reads as an all-clear.
+   This *narrows* the tool's latitude while unblocking the feature.
+3. **Principle VI** — shared surface extended from four modules to six, adding `erp` and `bundle`;
+   `bundle_report` added to the terminal-side list beside `html_report`; and the surface's public
+   contract extended to name bundle resolution and covered-family derivation.
+4. **Consumers** — the released interface now enumerates all six modules.
+
+Precedent is exact, and it is the feature-branch pattern: spec 006 amended 2.1.0 → 2.2.0 to admit
+`apix.cisco.com` and `id.cisco.com` in commit `cb6938a` — *"plan and design artifacts; amend
+constitution to 2.2.0"* — on its own feature branch, reaching `main` through that feature's pull
+request (#9). Spec 007 did the same in `e043d41` (#12). The one standalone constitution commit,
+`73de536` (#15), was a **retroactive** amendment documenting Principle VI after product 4.1.0 had
+already shipped, so it is not the precedent for a feature-driven change.
+
+**Sequencing**: applied before the first implementation task, on this branch, and it reaches `main`
+in this feature's pull request. Reviewing the governance change alongside the code it authorises is
+what the two prior features did, and it keeps the amendment's justification in front of the reviewer
+rather than in a separate PR they may have approved weeks earlier.
+
+**Result (pre-Phase 0)**: PASS. The amendment has been applied, so no gate is conditional and no
+principle is violated. Complexity Tracking is empty.
+
+**Re-check (post-Phase 1 design)**: PASS, with three design decisions strengthening the gates rather
+than weakening them.
+
+1. *Principle IV*: family derivation was designed to **fail open** (research Decision 5), and the
+   per-row accounting invariant (data-model.md §3) converts the principle from a reviewer's judgement
+   into a mechanical test over every row. The design also rejected its own first candidate — a single
+   whole-inventory population — specifically because ~375 mostly-meaningless undetermined markers
+   would devalue the signal the principle rests on. That is the principle constraining the design,
+   which is what it is for.
+2. *Principle I*: the final design adds no dependency, and Decision 1 chose the standard-library
+   parser over an equally-accurate lexical scan for a reason grounded in this feature's threat model
+   rather than in style — a prose mention of an advisory identifier would silently widen scope, and
+   scope is the one thing the page is trusted for.
+3. *Principle VI*: the module split (`erp` = I/O, `bundle` = pure, `bundle_report` = rendering)
+   reproduces the existing `psirt`/`matching`/`html_report` roles exactly, so the headless boundary
+   needs no new reasoning. Putting the filter in `matching.py` was considered and rejected to avoid
+   blurring a currently-crisp per-device boundary with per-advisory aggregation.
+
+With the amendment applied there are no outstanding prerequisites; the remaining gate obligations
+(tests for the new logic, the README shared-surface table, mirrored README/`docs/index.html` updates,
+the `VERSION` bump) are ordinary tasks. Complexity Tracking remains empty.
+
+## Project Structure
+
+### Documentation (this feature)
+
+```text
+specs/008-erp-bundle-scoped-report/
+├── plan.md              # This file (/speckit-plan command output)
+├── research.md          # Phase 0 output — 15 decisions, all unknowns resolved
+├── data-model.md        # Phase 1 output — Bundle, rows, the accounting invariant
+├── quickstart.md        # Phase 1 output — 8 validation scenarios
+├── contracts/           # Phase 1 output
+│   ├── erp-access.md        # the bundle page: what may and may not be taken from it
+│   ├── bundle-report.md     # the per-advisory report layout
+│   └── bundle-run-cli.md    # the command-line surface and exit codes
+├── checklists/
+│   └── requirements.md  # spec quality checklist (16/16)
+└── tasks.md             # Phase 2 output (/speckit-tasks — NOT created by /speckit-plan)
+```
+
+### Source Code (repository root)
+
+```text
+caia/
+├── erp.py              # NEW · shared surface · the only module that talks to Cisco's
+│                       #   Security Center: fetch + parse a bundle page into a Bundle
+├── bundle.py           # NEW · shared surface · pure: family derivation, filtering an
+│                       #   assessment to a bundle, building per-advisory rows
+├── bundle_report.py    # NEW · renders the bundle-scoped HTML report
+├── assessment.py       # unchanged · shared surface
+├── matching.py         # unchanged · shared surface
+├── psirt.py            # unchanged · shared surface
+├── inventory.py        # unchanged · shared surface
+├── cli.py              # MODIFIED · --erp option, exit codes
+├── analyzer.py         # MODIFIED · bundle prompt, confirmation, report selection
+├── html_report.py      # unchanged · the whole-fleet layout
+├── config.py           # unchanged
+├── ui.py               # unchanged
+└── version.py          # unchanged
+
+tests/
+├── test_erp.py             # NEW · page parsing, cross-check, hostile markup, failures
+├── test_bundle.py          # NEW · family derivation, FR-027b invariants, row accounting
+├── test_bundle_report.py   # NEW · escaping, collapse-not-truncate, ordering, undetermined
+├── test_cli.py             # EXTENDED · --erp parsing, prompt suppression, exit codes
+├── test_analyzer.py        # EXTENDED · prompt, decline path, report selection
+└── fixtures/
+    └── erp_page.html       # NEW · committed copy of the reference bundle page
+
+README.md                   # MODIFIED · bundle flow + shared-surface table (6 modules)
+docs/index.html             # MODIFIED · mirrored, per the Documentation gate
+VERSION                     # MODIFIED · 4.1.0 → 4.2.0
+.specify/memory/constitution.md  # MODIFIED · 3.1.0 → 3.2.0 (applied — Phase 0 prerequisite)
+```
+
+**Structure Decision**: Single-project CLI, unchanged. The three new modules take the three roles the
+package already uses — I/O, pure logic, rendering — mirroring `psirt.py`, `matching.py` and
+`html_report.py` respectively, so the Principle VI boundary needs no new reasoning. `erp.py` and
+`bundle.py` join the shared surface; `bundle_report.py` stays outside it, as `html_report.py` does.
+No new directories are created beyond this feature's `specs/` folder and the test fixture.
+
+## Complexity Tracking
+
+> **Fill ONLY if Constitution Check has violations that must be justified**
+
+No Constitution Check violations — this section is intentionally empty. The one conditional item
+(a new external endpoint, plus extending Principle VI's named surface) is a constraint that
+explicitly gates on review rather than a violation; the review is recorded in the Constitution Check
+above and the required amendment is carried as a blocking prerequisite task.
diff --git a/specs/008-erp-bundle-scoped-report/quickstart.md b/specs/008-erp-bundle-scoped-report/quickstart.md
new file mode 100644
index 0000000..511fe98
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/quickstart.md
@@ -0,0 +1,172 @@
+# Quickstart: validating Bundle-Scoped Impact Reporting
+
+**Feature**: 008-erp-bundle-scoped-report · **Date**: 2026-07-28
+
+Runnable scenarios that prove the feature works end to end. Details live in
+[data-model.md](./data-model.md) and [contracts/](./contracts/) — this file is the run guide.
+
+## Prerequisites
+
+| # | Requirement | Notes |
+| - | ----------- | ----- |
+| 1 | Cisco PSIRT API credentials | `caia --config`, or `CISCO_CLIENT_ID` / `CISCO_CLIENT_SECRET` |
+| 2 | An inventory `.xlsx` (sheet `FW_List`) in the working folder | The 70-row reference inventory reproduces every number below |
+| 3 | Reachable `apix.cisco.com`, `id.cisco.com`, `sec.cloudapps.cisco.com` | The third is new to this feature |
+| 4 | A bundle URL | Reference: `https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736` |
+
+Install from a checkout:
+
+```bash
+uv tool install --from . caia-cli --force
+```
+
+## Scenario 1 — Interactive bundle review (US1)
+
+```bash
+caia
+```
+
+Paste the reference bundle URL at the prompt.
+
+**Expect** — before any inventory work, a confirmation naming the bundle and **25 advisories**;
+then the existing progress output; then a report at
+`output/impact_report_ERP-75736_<timestamp>.html`.
+
+In the report:
+
+| Check | Expected | Requirement |
+| --- | --- | --- |
+| Advisory rows | exactly **25** | FR-017, FR-019, SC-002 |
+| Rows with ≥1 impacted device | **24** | — |
+| Rows with 0 impacted | **1** (`cisco-sa-asa-dos-FCvLD6vR`), present with its population stated | FR-017 |
+| `cisco-sa-onprem-fmc-authbypass-5JPp45V2` | 5 devices · 2 affected releases · fixed in 7.4.4 | FR-022, FR-022a, FR-023 |
+| Every row's counts | impacted + unaffected + undetermined == population | FR-025, SC-003 |
+| Run totals | 70 assessed · 15 undetermined · 27 questions | FR-026a |
+| Suppressed count | stated and non-zero | FR-016, SC-009 |
+| Undetermined devices | 15, each once, each with a reason | FR-030 |
+
+## Scenario 2 — Undetermined devices are never clean (US1, US4 — the safety property)
+
+```bash
+caia --erp ERP-75736
+```
+
+Inspect the `cisco-sa-asa-dos-FCvLD6vR` row: **0 impacted, 17 unaffected, 11 undetermined**, out of
+an ASA population of 28.
+
+| Check | Expected | Requirement |
+| --- | --- | --- |
+| The 11 undetermined devices are named in the row | not hidden behind the zero | FR-027 |
+| They are yellow **and** labelled in words | remove colour and the meaning survives | FR-024 |
+| No count anywhere treats them as unaffected | totals included | FR-028 |
+| The row states its population and families | so "0 impacted" cannot read as an all-clear | FR-026 |
+
+**This is the scenario to run first after any report change.** A row showing "0 impacted" without
+its 11 undetermined devices is the feature's worst failure mode.
+
+## Scenario 3 — Family scoping (FR-025, FR-027a)
+
+Compare two rows from the same run:
+
+| Row | Covered families | Population | Requirement |
+| --- | --- | --- | --- |
+| `cisco-sa-onprem-fmc-authbypass-5JPp45V2` | FMC | 5 | FR-026 |
+| `cisco-sa-asaftd-ikev2-dos-eBueGdEG` | ASA, FTD | 65 | FR-026 |
+
+**Expect** the FMC row to contain no ASA or FTD device in any of its three groupings — not even as
+undetermined. If all 15 undetermined devices appear on the FMC row, scoping is not being applied.
+
+Also confirm the inverse safety property: no device Cisco listed as impacted is ever absent from its
+row, whatever the derived family set (FR-027b).
+
+## Scenario 4 — Non-interactive run (US2)
+
+```bash
+caia --erp ERP-75736 < /dev/null
+echo "exit=$?"
+```
+
+**Expect** no prompt, the same report as Scenario 1, `exit=0`.
+
+## Scenario 5 — Declining keeps today's behaviour (US3)
+
+```bash
+caia
+```
+
+Press Enter at the bundle prompt.
+
+**Expect** the existing whole-fleet report — one row per device — with verdicts and reasons matching
+the pre-change product for the same inputs, and **no request to `sec.cloudapps.cisco.com`**
+(FR-003, SC-006).
+
+## Scenario 6 — Bundle resolution failures (US5)
+
+Each must be distinguishable, and none may write a report (FR-010, FR-011, SC-007).
+
+```bash
+caia --erp https://example.invalid/nope        # not a bundle address  -> exit 2, no request made
+caia --erp ERP-00000000                        # reachable, no advisories -> exit 1
+caia --erp ERP-75736                           # with the host blocked  -> exit 1, connectivity
+```
+
+| Check | Expected |
+| --- | --- |
+| The first makes **no** network request | rejected on the value alone (FR-004) |
+| The connectivity failure says so | not "bad link" (FR-010) |
+| No `output/` file appears for any of the three | FR-011 |
+| Interactive equivalents re-prompt, and declining falls back to the whole-fleet report | US5 §4 |
+
+## Scenario 7 — Offline, non-overwriting, safe (FR-012, FR-033)
+
+```bash
+ls -l output/
+```
+
+| Check | Expected | Requirement |
+| --- | --- | --- |
+| Open the report with networking disabled | renders completely | FR-033 |
+| Two runs against the same bundle | two files; neither overwritten | FR-033 |
+| Filename | `impact_report_ERP-75736_*.html` | FR-032 |
+| Search the file for `<script` from Cisco or page content | none executable | FR-012 |
+| Advisory links | new tab, no access to the report document | FR-020 |
+
+## Scenario 8 — Determinism (FR-029)
+
+```bash
+caia --erp ERP-75736 && caia --erp ERP-75736
+```
+
+**Expect** the advisory rows in the same order in both files. Diffing the two reports should show
+only the timestamp and generation metadata.
+
+## Test-suite validation (no credentials, no network)
+
+Per the constitution's Tests gate, every analysis-flow change must be covered without credentials or
+network access:
+
+```bash
+python -m unittest discover -s tests
+```
+
+> If this reports fewer than the full test count or errors on `openpyxl`, the interpreter is missing
+> the runtime dependencies. Use `uv run --with openpyxl --with python-dotenv python -m unittest
+> discover -s tests`. Baseline before this feature: **272 tests, OK**.
+
+Expected new coverage:
+
+| Area | Must cover |
+| --- | --- |
+| Bundle page parsing | identifiers from `href`; duplicates collapse to one; identifiers absent from visible text; `Doc ID` cross-check; hostile markup |
+| Family derivation | union of both sources; fail-open to every family; the FR-027b invariants |
+| Row building | the accounting invariant for every row; zero-impact rows present; release rollup |
+| Undetermined handling | never unaffected in any count; present in every covered row; labelled not just coloured |
+| Report rendering | escaping of page-derived values; long rows collapsed never truncated; deterministic order |
+| Headless property | resolution and filtering print nothing, do not exit, do not mutate the caller's inventory, and raise rather than returning verdicts when Cisco is unreachable |
+| CLI | `--erp` parsing, prompt suppression, the three failure exit codes, decline path |
+
+## Constitutional prerequisite
+
+The amendment admitting `sec.cloudapps.cisco.com` and extending the shared surface **must merge
+before implementation begins** (research Decision 9). Until it does, Scenario 1 cannot legitimately
+run — the tool would be contacting an endpoint its own constitution does not permit.
diff --git a/specs/008-erp-bundle-scoped-report/research.md b/specs/008-erp-bundle-scoped-report/research.md
new file mode 100644
index 0000000..0ed7846
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/research.md
@@ -0,0 +1,391 @@
+# Phase 0 Research: Bundle-Scoped Impact Reporting
+
+**Feature**: 008-erp-bundle-scoped-report · **Date**: 2026-07-28
+
+Every observation below was taken against the live sources on 2026-07-28 using ERP-75736 and the
+70-row reference inventory. Where a finding contradicts an assumption a reader might reasonably
+hold, that is called out, because those are the findings that shaped the design.
+
+---
+
+## Decision 1 — Resolve the bundle page with the standard-library HTML parser, matching on `href`
+
+**Decision**: Fetch the bundle page with `urllib.request`, feed it to an `html.parser.HTMLParser`
+subclass, and collect advisory identifiers from `href` attributes of anchor elements matching
+`CiscoSecurityAdvisory/(cisco-sa-…)`. The same single parse pass also accumulates the page's text,
+which Decision 2 needs.
+
+**Rationale**: Measured both candidate approaches against the live page (181,576 bytes, HTTP 200
+in 0.54 s):
+
+| Approach | Result |
+| --- | --- |
+| Lexical scan of the whole document | 25 unique identifiers |
+| `HTMLParser`, `href` attributes only | 25 unique identifiers |
+
+They agree exactly, and no identifier appeared in the page's text but not in a link. The parser is
+chosen anyway for two reasons that matter beyond this one page: it cannot be fooled by an advisory
+identifier mentioned in prose (which would silently widen the bundle's scope, violating FR-007's
+"scope only" boundary), and it yields the bundle's own metadata in the same pass instead of
+requiring a second regex over raw markup.
+
+`html.parser` is standard library, so Principle I is satisfied with no new dependency.
+
+**Alternatives considered**:
+- *Lexical scan over raw markup* — equally accurate here, fewer lines, but scope-widening on any
+  page that names an advisory in prose. Rejected: the failure is silent and enlarges scope.
+- *A third-party HTML parser* — no capability the standard library lacks. Rejected under
+  Principle I.
+- *Driving a real browser* — the earlier `curl` timeout suggested the page might need one. It does
+  not: `urllib` fetched it in 0.54 s on the first attempt, both with and without a browser
+  user-agent. Rejected as unnecessary and impossible under Principle I.
+
+---
+
+## Decision 2 — Take the bundle's own identity from the page; take nothing else
+
+**Decision**: Extract four values from the page — `Doc ID` (`ERP-75736`), the document title,
+`First Published` (`2026 March 4 16:00 GMT`), and `Version` (`1.0`). Cross-check the extracted
+`Doc ID` against the `alertId` in the submitted URL and treat disagreement as a resolution failure.
+Take **no** advisory fact from the page, even though the page displays advisory titles, CVE
+identifiers, severities, and CVSS scores in its table.
+
+**Rationale**: FR-031 requires the report to identify the bundle it covers, and Cisco publishes no
+API equivalent (Decision 3), so the page is the only source. This is permissible because the
+bundle's identity is not an advisory fact — it is the identity of the scope selector. The
+distinction is exactly what keeps the constitution's "no scraped or cached-as-authoritative
+alternatives" rule intact: the page contributes *which advisories are in scope* and *what that
+scope is called*; every fact about an advisory comes from Cisco's API.
+
+All four values extract cleanly, and the URL's `alertId` agreed with the page's `Doc ID`. The
+cross-check is cheap and catches a redirect to a different or generic page — a case that would
+otherwise produce a confidently-labelled report about the wrong bundle.
+
+**Alternatives considered**:
+- *Take advisory titles and severities from the page too, saving requests* — rejected outright.
+  Two sources for the same fact will eventually disagree, and the page is not the authority. It
+  would also make FR-008 untestable.
+- *Derive the bundle title from the URL alone, parsing nothing* — leaves the report unable to name
+  the bundle in human terms. Rejected: a report an analyst files needs to say which publication it
+  covers.
+
+---
+
+## Decision 3 — There is no bundle endpoint; the page fetch is unavoidable
+
+**Decision**: Accept a page fetch as the only way to resolve a bundle, and record
+`sec.cloudapps.cisco.com` as a new endpoint requiring a constitution amendment (Decision 9).
+
+**Rationale**: `GET /security/advisories/v2/eventresponse/ERP-75736` returns **HTTP 404**. Cisco's
+advisory API exposes advisories by identifier, CVE, product, OS version, severity, and publication
+date, but has no concept of an Event Response bundle.
+
+**Alternatives considered**:
+- *Reconstruct the bundle from a publication-date window* — `GET /all/firstpublished?startDate=
+  2026-03-04&endDate=2026-03-05` returns 27 advisories: all 25 the bundle lists, plus
+  `cisco-sa-clamav-css-Fn4QSZ` and `cisco-sa-webex-xss-TZFTbbwN`, which are same-day publications
+  belonging to no firewall bundle. So the date window is a **superset**, not the bundle. Using it
+  as the scope would silently import advisories Cisco did not bundle, and it needs the bundle's
+  publication date, which itself comes from the page. Rejected as a substitute; see Decision 4 for
+  why it was also rejected as a cross-check.
+- *Ask the user to paste the advisory identifiers* — defeats the feature's whole purpose (SC-001).
+
+---
+
+## Decision 4 — Fetch metadata individually for advisories that impact nothing
+
+**Decision**: After filtering, for each bundle advisory that appears in no device's result, issue
+one `GET /advisory/{advisoryId}`. Do not use a date-window query.
+
+**Rationale**: An advisory that impacts nothing is never returned by any device-scoped question, so
+the report has no title, severity, or publication date for it — yet FR-017 requires its row. The
+per-advisory lookup is exact, needs no date semantics, and is naturally bounded: measured at **1 of
+25** for ERP-75736, worst case the bundle size. At the existing ~2.1 s pacing that is 2 s typically
+and about 53 s in the pathological case where a bundle touches nothing at all.
+
+Every advisory that *does* impact at least one device already carries `advisoryId`,
+`advisoryTitle`, `sir`, `cvssBaseScore`, `cves`, `publicationUrl`, `firstPublished`,
+`productNames`, and `platforms[].firstFixes[]` in the payload the tool retrieves today — verified
+directly. So the common case costs **zero** additional requests, and the publication date FR-021
+requires needs no lookup at all for those rows.
+
+**Alternatives considered**:
+- *One date-window request covering the whole bundle* — one request instead of N, but it returns a
+  superset that must then be filtered back to the bundle, and it requires trusting that every
+  advisory in a bundle shares the bundle's publication date. A re-published advisory carried into a
+  later bundle would break that. Rejected: more moving parts, a date-semantics assumption, and no
+  saving in the common case (where N is 0 or 1).
+- *Using it as a parse-regression cross-check* (deliberated in the spec) — **rejected**. It cannot
+  distinguish "the page parse missed an advisory" from "the bundle legitimately excludes a same-day
+  publication", which is precisely the ambiguity the two extra advisories demonstrate. A check that
+  cannot fail cleanly is worse than none; FR-009's advisory count shown to the user before the run
+  is the honest check, because a human recognises 24-instead-of-25 immediately.
+
+---
+
+## Decision 5 — Derive an advisory's covered families from two sources, union, fail open
+
+**Decision**: The families an advisory covers are the union of:
+
+1. the families of inventory devices for which Cisco returned that advisory, and
+2. the firewall families named in the advisory's own `productNames`.
+
+If neither source yields a family, treat the advisory as covering **every** queryable family.
+
+**Rationale**: FR-025's per-row population depends on this, and getting it wrong in the narrowing
+direction would suppress an undetermined device — the exact Principle IV failure the feature
+exists to prevent.
+
+Source 1 is authoritative and free: the tool asks Cisco per family, so an advisory returned by the
+`fmc` question is one Cisco applies to FMC. No inference. Derived across the reference bundle it
+produced clean, unsurprising sets — `[FMC]`, `[ASA, FTD]`, `[FTD]`, `[ASA]`, `[FMC, FTD]`.
+
+Source 1 alone is insufficient, because an advisory can cover a family that happens to have no
+impacted device in *this* inventory. Source 2 closes that gap and is present in the payload already
+retrieved (`productNames`), so it also costs nothing. Verified on two advisories:
+
+| Advisory | `productNames` entries | Firewall families named |
+| --- | --- | --- |
+| `cisco-sa-ftdfmc-dir-trav-wERgjhWq` | 117 | `FMC`, `FTD` — matches its title |
+| `cisco-sa-snort3-multi-dos-XFWkWSwz` | 59 | `FTD` — correctly ignoring the non-firewall products it also lists (Cyber Vision, UTD SNORT IPS Engine) |
+
+The fail-open rule makes the whole derivation safe by construction: the worst outcome of a failed
+derivation is a noisier report, never a suppressed device. FR-027b states the invariant directly —
+family derivation may only narrow which rows an *undetermined* device appears in, and can never
+suppress an impacted device or manufacture an unaffected one.
+
+**Alternatives considered**:
+- *A single whole-inventory population for every row* — needs no derivation at all and was the
+  first recommendation. Rejected on safety grounds, not readability: with 15 undetermined devices
+  across 25 rows it emits roughly **375** undetermined markers, the large majority meaningless (an
+  ASA appliance marked undetermined against an FMC-only advisory it cannot run). A marker that
+  appears everywhere is a marker readers learn to skip, which erodes the very signal Principle IV
+  depends on. Retained instead as the run-level total, FR-026a.
+- *`productNames` only* — discards the authoritative source in favour of string interpretation.
+  Rejected.
+- *Mapping families from advisory title keywords* — guessing from prose. Rejected under
+  Principle IV.
+
+---
+
+## Decision 6 — Order rows by severity, then impacted device count, then identifier
+
+**Decision**: Sort by Cisco's severity rank, then by descending count of impacted devices, then by
+advisory identifier. Reuse the existing `_SEVERITY_ORDER` mapping
+(`critical` 0, `high` 1, `medium` 2, `low` 3, `informational` 4, unknown 9).
+
+**Rationale**: Puts the most urgent, widest-reaching work first, which is the order a change window
+is planned in. The identifier tiebreak makes the order total, satisfying FR-029's determinism
+requirement — without it, two advisories of equal severity and equal reach could order arbitrarily
+between runs. Reusing the existing mapping keeps the two report layouts consistent about what
+"severity" means.
+
+**Alternatives considered**:
+- *Bundle-page order* — more directly auditable against Cisco's publication, but buries a critical
+  advisory below a medium one. Rejected for the default; FR-035's sort controls let a reader reach
+  any order they want.
+- *Impacted count first* — an advisory hitting 50 devices at medium severity would outrank a
+  critical hitting 5. Rejected: severity is the stronger signal.
+
+---
+
+## Decision 7 — Three new modules, two of them joining the shared surface
+
+**Decision**:
+
+| Module | Role | Shared surface |
+| --- | --- | --- |
+| `caia/erp.py` | the only module that talks to Cisco's Security Center: fetch and parse a bundle page into a `Bundle` | ✅ |
+| `caia/bundle.py` | pure: family derivation, filtering an assessment to a bundle, building rows | ✅ |
+| `caia/bundle_report.py` | render the bundle-scoped HTML report | ✖ |
+
+**Rationale**: This mirrors the split the package already uses and that Principle VI codifies —
+`psirt` performs I/O, `matching` is pure and owns the safety property, `html_report` renders. Each
+new module takes exactly one of those roles, so nothing new has to be reasoned about.
+
+`erp.py` and `bundle.py` belong *in* the shared surface. The ERP parse and the family derivation
+are precisely the fragile, safety-bearing logic that a second consumer would otherwise
+reimplement — and a second, divergent answer about which advisories are in scope is the same class
+of harm Principle VI exists to prevent. `bundle_report.py` stays outside it, like `html_report.py`.
+
+Filtering was considered for `matching.py`, which already owns the verdict rules. Rejected:
+`matching` is cohesive around *per-device* verdicts, and this logic aggregates *per advisory*.
+Adding it there would blur a boundary that is currently crisp.
+
+**Alternatives considered**:
+- *One `bundle.py` doing fetch, parse, filter, and render* — fewer files, but mixes I/O with pure
+  logic and so makes the pure part untestable without mocking a network call. Rejected: the
+  existing `psirt`/`matching` separation exists for exactly this reason.
+- *Keeping both new modules out of the shared surface* — avoids amending Principle VI's module
+  list, but leaves a second consumer to reimplement the ERP parse. Rejected as the wrong trade.
+
+---
+
+## Decision 8 — Product version 4.2.0 (MINOR)
+
+**Decision**: Bump `VERSION` 4.1.0 → **4.2.0**.
+
+**Rationale**: The shared surface *gains* two modules and gains no incompatible change; the
+existing surface contract (`analyze`, `load_catalogues`, `families_in`, `describe_check`, the
+verdict vocabulary, the `psirt` client and its error types, `load_inventory`, the device record
+shape) is untouched. The whole-fleet report and every existing command-line behaviour are
+unchanged, and a user who supplies no bundle sees no difference. Under the constitution's
+versioning gate — "MINOR for an addition, MAJOR for an incompatible change" — that is MINOR.
+
+MAJOR would be correct only if the bundle layout replaced the whole-fleet report. It does not
+(FR-003), which is what keeps this bump small.
+
+---
+
+## Decision 9 — Constitution amendment 3.1.0 → 3.2.0 (MINOR), applied before implementation
+
+**Decision**: Amend `.specify/memory/constitution.md` in one edit before any implementation task
+begins. **Applied on this branch on 2026-07-28.** Three clauses:
+
+1. **Networking** — add `sec.cloudapps.cisco.com` as an endpoint the analyzer itself contacts,
+   scoped to resolving a bundle to its advisory identifiers and the bundle's own identity, and
+   record that the request carries no inventory-derived data.
+2. **Source of truth** — record the boundary explicitly: a published bundle page may supply *which
+   advisories are in scope* and the bundle's own identity, and MUST NOT supply any advisory fact.
+   This is what keeps "no scraped or cached-as-authoritative alternatives" true rather than merely
+   technically survived: the page is a scope selector, never an authority.
+3. **Principle VI** — extend the named shared surface from four modules to six, adding `erp` and
+   `bundle`, and mirror the addition in the Technology & Data Constraints "Consumers" bullet.
+
+**Rationale**: The constitution's Networking bullet states that "adding any further external
+endpoint the analyzer itself contacts remains a reviewed change", and Principle VI names its four
+modules explicitly, so adding to the surface is an amendment rather than an implementation detail.
+A new section and materially expanded guidance with no principle removed or redefined is MINOR.
+
+The precedent is exact, and it is the **feature-branch** pattern: spec 006 amended 2.1.0 → 2.2.0 to
+admit `apix.cisco.com` and `id.cisco.com` in commit `cb6938a` — *"plan and design artifacts; amend
+constitution to 2.2.0"* — on its own feature branch, reaching `main` via that feature's pull request
+(#9). Spec 007 did the same in `e043d41` (#12). The one standalone constitution commit, `73de536`
+(#15), was a **retroactive** amendment documenting Principle VI after product 4.1.0 had already
+shipped, and is therefore not the precedent for a feature-driven change.
+
+**Alternatives considered**:
+- *Route the bundle fetch through something already permitted* — nothing permitted serves the page;
+  the API returns 404 for bundles (Decision 3). Not available.
+- *Amend after implementation* — the constitution designates it a **reviewed** change, so the review
+  precedes the work. Done as Phase 0, before any implementation task.
+- *Amend on a standalone `chore/` branch* — considered, and rejected once the history was checked:
+  both prior feature-driven amendments travelled in their feature's own pull request, which keeps the
+  amendment's justification in front of the reviewer alongside the code it authorises rather than in a
+  separate PR approved earlier and in isolation.
+- *Treat the page as a "source of truth" alongside the API* — would weaken Principle IV by admitting
+  a scraped authority. Rejected in favour of the narrower scope-selector clause, which grants
+  exactly what the feature needs and nothing more.
+
+---
+
+## Decision 10 — Report filename keeps the existing prefix and embeds the bundle identifier
+
+**Decision**: Write `impact_report_ERP-75736_<YYYYmmdd_HHMMSS>.html`, reusing the existing
+`FILENAME_PREFIX = "impact_report_"` and the existing never-overwrite path selection.
+
+**Rationale**: FR-032 requires the two layouts be distinguishable "once filed or emailed", which
+makes the filename part of the requirement rather than only the document body. Embedding the
+bundle identifier satisfies that while keeping the `impact_report_*.html` shape, so the
+constitution's Inputs/outputs bullet and `.gitignore`'s existing `impact_report_*.html` rule both
+continue to match with no change to either. The existing timestamped, collision-avoiding path
+logic is reused unchanged, preserving FR-033's never-overwrite guarantee.
+
+**Alternatives considered**:
+- *A new `bundle_report_*.html` prefix* — clearer at a glance, but falls outside both the
+  constitution's recorded output pattern and `.gitignore`, so it would need a second amendment
+  clause and risks committing a generated report. Rejected for a worse cost/benefit.
+- *Same filename, distinguished only inside the document* — fails "once filed or emailed".
+
+---
+
+## Decision 11 — Collapse long device lists with the existing disclosure pattern
+
+**Decision**: Render a row's device list inside the existing `<details>`/`<summary>` disclosure
+when it exceeds a threshold, with **every** device name present in the document.
+
+**Rationale**: One advisory in the reference bundle impacts 50 of 70 devices, and FR-033's
+self-containment forbids loading anything on demand — so the choice is collapse or truncate, and
+truncation would hide devices that need patching. The report already solves exactly this problem
+for the inverse case (a device with 80+ advisories) using `<details>`, and its test suite already
+asserts that collapsing never truncates. Reusing the pattern keeps one behaviour, one style, and
+one test strategy.
+
+---
+
+## Decision 12 — Resolve the bundle before the inventory work, with a short timeout
+
+**Decision**: Resolve the bundle immediately after the inventory is located and before the first
+Cisco advisory request, with a fetch timeout well below the API client's 45 s.
+
+**Rationale**: FR-001 and FR-009 already require resolution to precede the run so a wrong link is
+caught before minutes are spent. A short bound makes that promise real: measured at 0.54 s, so a
+generous ceiling still fails fast. This also means a bundle failure costs the user nothing —
+no requests spent, no partial state.
+
+---
+
+## Decision 13 — Reuse the existing exit-code vocabulary
+
+**Decision**: Map the three bundle-resolution failures onto codes the tool already uses:
+
+| Outcome | Code | Consistent with |
+| --- | --- | --- |
+| Value is not a bundle address (bad input) | `2` | existing argument-error convention (`cli.py`) |
+| Cisco unreachable, or page yields no advisory | `1` | existing run-failure convention (`analyzer.py`) |
+| Interrupt during resolution | `130` | Principle III |
+
+**Rationale**: FR-011 requires a non-zero status a caller can distinguish from success; Principle III
+requires meaningful codes. A malformed URL is a bad argument and a failed fetch is a failed run, so
+the existing two codes already carry the right meanings. Inventing a third would add vocabulary
+callers must learn for no gain.
+
+---
+
+## Decision 14 — Escape everything the page supplies, at interpolation
+
+**Decision**: Treat the bundle title, and every other page-derived value, as untrusted text escaped
+where it is interpolated into the report — the same treatment advisory content already receives.
+
+**Rationale**: FR-012 requires it, and the existing report already assumes Cisco-supplied content
+is hostile (every advisory observed during spec 006's spike carried raw HTML in `summary`, and the
+report's tests assert that a `<script>` in an advisory title cannot execute). A scraped page is a
+strictly less trustworthy input than an API response, so it inherits the stricter treatment without
+argument.
+
+---
+
+## Decision 15 — Assess the whole inventory, then filter
+
+**Decision**: Run the existing assessment across the entire inventory and narrow afterwards. Do not
+restrict the assessment to the families the bundle names.
+
+**Rationale**: Narrowing before the assessment would cut requests — an FMC-only bundle would need 3
+rather than 32 — but it makes the *set of questions asked* depend on interpreting Cisco's product
+naming. A family named only in an advisory's prose would go unasked, and an unasked device is
+indistinguishable in the output from a device Cisco could not answer for. Filtering after keeps
+family derivation confined to *presentation* scoping (Decision 5), where the fail-open rule makes a
+mistake merely noisy.
+
+The cost is small and measured: 70 devices collapse to 27 distinct questions, 32 requests, 72 s.
+FR-041's budget is met with the whole-inventory sweep plus at most one request per zero-impact
+advisory.
+
+**Alternatives considered**:
+- *Narrow the assessment by bundle families* — rejected above. Worth revisiting only if a future
+  inventory makes the sweep genuinely expensive, and then only with the family set treated as
+  authoritative rather than derived.
+
+---
+
+## Resolved unknowns
+
+Everything the spec deferred to planning is now decided:
+
+| Deferred item | Resolved by |
+| --- | --- |
+| Whether to cross-check the bundle by publication date | Decision 4 — no; the check cannot fail cleanly |
+| MINOR or MAJOR version bump | Decision 8 — MINOR, 4.2.0 |
+| How a row with many impacted devices avoids truncation | Decision 11 — existing `<details>` disclosure |
+
+No `NEEDS CLARIFICATION` items remain.
diff --git a/specs/008-erp-bundle-scoped-report/spec.md b/specs/008-erp-bundle-scoped-report/spec.md
new file mode 100644
index 0000000..f9512f0
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/spec.md
@@ -0,0 +1,255 @@
+# Feature Specification: Bundle-Scoped Impact Reporting
+
+**Feature Branch**: `008-erp-bundle-scoped-report`
+
+**Created**: 2026-07-28
+
+**Status**: Draft
+
+**Input**: User description: "BRD-005 — Bundle-Scoped Impact Reporting: narrow the assessment to a Cisco Event Response bundle and report per advisory (`brds/005-erp-bundle-scoped-report.md`)"
+
+## Clarifications
+
+### Session 2026-07-28
+
+- **Q: What is one "impacted product" — a device, a distinct affected release, or a hardware-and-release combination?** → **The device is the unit of count**, with a per-row rollup by affected release alongside it (FR-022, FR-022a). Decisive reason: FR-025's per-row accounting only closes against a device population. Releases cannot sum to one, because an undetermined device frequently has no release Cisco recognises and so could not be placed in a release-based denominator at all. Counting devices also keeps the bundle report commensurable with the whole-fleet report and the inventory itself, which are per device throughout. The release rollup preserves the "how many upgrade decisions" reading — e.g. *5 devices → 2 affected releases → all fixed by 7.4.4* — without making it the denominator.
+
+- **Q: What population does each advisory row report against?** → **Per-row, scoped to the product families that advisory covers** (FR-025, FR-026), with the whole-run totals stated once separately (FR-026a). A single whole-inventory denominator was rejected: with 15 undetermined devices across 25 rows it produces roughly 375 undetermined markers, most of them meaningless — an ASA appliance flagged undetermined against an FMC-only advisory it cannot run — which trains a reader to disregard the very marker Principle IV depends on. Family scoping was found to need far less inference than first assumed: for any advisory Cisco returned for at least one device, the families follow from which family-scoped question returned it, and for an advisory impacting nothing the families come from its own published product list, which was verified to resolve cleanly. FR-027a unions both sources and fails open to every family, so scoping can only ever reduce noise, never suppress a device (FR-027b).
+
+## User Scenarios & Testing *(mandatory)*
+
+### User Story 1 - Review a bundled publication against the fleet (Priority: P1)
+
+Cisco publishes its Secure Firewall vulnerabilities in bundled publications — one Event Response page listing every advisory released that day. An analyst runs the tool in the folder holding the inventory, is prompted for the bundle's URL, and pastes it. The tool reports which bundle it found and how many advisories it lists, assesses the inventory against Cisco's published data exactly as it does today, then writes an HTML report laid out **one row per advisory in the bundle** — each row naming the advisory, linking to it, giving its publication date, and listing the products it impacts along with the release that fixes each. Products the tool could not conclusively assess appear in the row too, visibly distinct and labelled as undetermined.
+
+**Why this priority**: This is the feature. It converts an assessment the tool already produces into the shape the ops team's review cycle actually runs on, and it eliminates the manual cross-referencing that stands between a published bundle and a patch decision today. Every other story in this spec supports, hardens, or cleans up after it.
+
+**Independent Test**: Run the tool in a folder containing a valid inventory, paste a real Event Response URL at the prompt, and confirm the resulting report contains one row per advisory the bundle lists, each carrying an advisory link, a publication date, the impacted products with their fixing releases, and any undetermined products marked as such. Delivers the whole value of the change on its own.
+
+**Acceptance Scenarios**:
+
+1. **Given** a valid Event Response URL listing 25 advisories and an inventory of 70 devices, **When** the run completes, **Then** the report contains exactly 25 advisory rows — one per advisory the bundle lists — including any that impact nothing.
+2. **Given** an advisory the bundle lists that Cisco records as applying to 5 inventory devices across 2 affected releases, **When** the analyst reads that row, **Then** all 5 devices are named, the count of 5 devices and the rollup to 2 affected releases are both stated, and each device shows the release Cisco lists as first fixing that advisory.
+3. **Given** an advisory row, **When** the analyst activates the advisory identifier, **Then** Cisco's published advisory opens in a new tab and the opened page has no access to the report.
+4. **Given** any advisory row, **When** the analyst reads it, **Then** it shows that advisory's publication date exactly as Cisco publishes it.
+5. **Given** a device whose assessment was undetermined, **When** it appears in an advisory row, **Then** it is visually distinct from impacted products, is labelled as undetermined in words as well as by colour, and is counted in neither the impacted nor the unaffected total.
+6. **Given** an advisory the bundle lists that impacts no inventory device, **When** the analyst reads its row, **Then** the row is present, states that no inventory device is impacted, names the product families and population size it was evaluated against, and still shows how many devices were undetermined.
+6a. **Given** an advisory covering only one product family, **When** the analyst reads its row, **Then** the row's population is limited to inventory devices of that family, and devices of other families appear in neither its impacted, unaffected, nor undetermined figures.
+6b. **Given** an advisory whose covered families cannot be established from either Cisco's answers or its published product list, **When** the analyst reads its row, **Then** every undetermined device in the inventory appears in that row rather than being omitted.
+7. **Given** the assessment found advisories affecting the inventory that the bundle does not list, **When** the analyst reads the report, **Then** the report states how many such findings the bundle filter excluded.
+8. **Given** the same inventory and the same bundle, **When** the tool is run twice, **Then** the advisory rows appear in the same order both times.
+9. **Given** a completed run, **When** the analyst opens the report with no network access, **Then** it renders completely, and no existing report was overwritten to produce it.
+
+---
+
+### User Story 2 - Run a bundle review unattended (Priority: P2)
+
+A scheduled job, or an analyst working through several bundles in succession, supplies the Event Response URL up front instead of typing it at a prompt. The tool performs the same review with no interaction and exits with a status the caller can act on.
+
+**Why this priority**: The project's CLI-first principle means a prompt cannot be the only way in — a capability reachable only by typing is not scriptable, and bundle reviews are exactly the recurring work a team wants scheduled. It is separable from Story 1, which is complete and useful interactively, but the product is not correct without it.
+
+**Independent Test**: Invoke the tool with the bundle URL supplied up front and no terminal attached; confirm it never prompts, writes the same report Story 1 produces for the same inputs, and returns a success status. Then invoke it with an unresolvable URL and confirm a distinct non-zero status and no report.
+
+**Acceptance Scenarios**:
+
+1. **Given** the bundle URL is supplied up front, **When** the tool runs with no terminal attached, **Then** it never prompts and writes the same report the interactive path produces for the same inputs.
+2. **Given** the bundle URL is supplied up front and the bundle cannot be resolved, **When** the tool runs, **Then** it exits with a non-zero status distinguishable from a successful run and writes no report.
+3. **Given** no bundle URL is supplied and no terminal is attached, **When** the tool runs, **Then** it produces the whole-fleet report without prompting.
+
+---
+
+### User Story 3 - Skip the bundle and get today's report (Priority: P2)
+
+A user who has no bundle to hand, or who wants the whole-fleet view, declines at the prompt and gets exactly the report the tool produces today.
+
+**Why this priority**: Bundle scoping must be an addition, not a tax. Existing users and existing habits have to keep working unchanged, and preserving that is what makes this feature safe to ship. It is testable entirely on its own by comparing against pre-change behaviour.
+
+**Independent Test**: Run the tool and decline at the bundle prompt; confirm the report produced is the whole-fleet report, with the same verdicts, reasons, and exit status as before this feature.
+
+**Acceptance Scenarios**:
+
+1. **Given** the user declines at the bundle prompt, **When** the run completes, **Then** the report is the whole-fleet report and its verdicts and reasons match what the tool produced for the same inputs before this feature.
+2. **Given** the user declines at the bundle prompt, **When** the run completes, **Then** no request was made to any bundle page.
+3. **Given** a run with no bundle, **When** it completes, **Then** the exit status matches the pre-change behaviour for the same outcome.
+
+---
+
+### User Story 4 - Undetermined devices are actionable, not just flagged (Priority: P2)
+
+The bundle report carries a section naming every device whose assessment was undetermined, exactly once, with what the inventory recorded, what was asked of Cisco, and why no conclusion was reached — so the inventory data causing the gap can be corrected and the next bundle review comes back conclusive.
+
+**Why this priority**: Story 1 already prevents an undetermined device from being read as clean, which is the safety requirement. This story makes those devices *fixable* rather than merely visible, converting a recurring caveat into a one-time data cleanup. Valuable and independently testable, but the product is safe without it.
+
+**Independent Test**: Run a bundle review against an inventory containing releases Cisco does not hold and releases Cisco does not list for the recorded hardware; confirm every such device appears once in a dedicated section with both the recorded values and a human-readable reason.
+
+**Acceptance Scenarios**:
+
+1. **Given** 15 devices whose assessment was undetermined, **When** the analyst opens the report, **Then** all 15 are listed once each with a human-readable reason.
+2. **Given** a device whose recorded release Cisco does not list for its recorded hardware, **When** the reader inspects its entry, **Then** the entry shows both what the inventory recorded and what was asked of Cisco, so the field to correct is evident.
+3. **Given** a device that appears in this section, **When** the reader looks for it in the advisory rows, **Then** it appears there as undetermined and nowhere as unaffected.
+
+---
+
+### User Story 5 - Recover from a bad bundle link (Priority: P3)
+
+A mistyped, stale, or non-bundle URL, or an unreachable Cisco site, produces a clear statement of which failure occurred and a chance to correct it — never a silently empty or misleading report.
+
+**Why this priority**: The earlier stories make the happy path correct and safe. This one protects against a wasted run and, more importantly, against the failure mode where a bundle resolves to nothing and an empty report reads as good news. It is a quality-of-transition story rather than a capability.
+
+**Independent Test**: Submit in turn a URL that is not a Cisco Event Response address, a bundle URL while the site is unreachable, and a reachable page containing no advisories; confirm each produces a distinct message, that the first is rejected before any network request, and that none produces a report.
+
+**Acceptance Scenarios**:
+
+1. **Given** a URL that is not a Cisco Event Response address, **When** it is submitted, **Then** the tool rejects it before making any network request, names the expected form, and offers another attempt.
+2. **Given** Cisco's site cannot be reached, **When** the tool tries to resolve the bundle, **Then** the message identifies the failure as connectivity rather than a bad link, and no report is written.
+3. **Given** a reachable page from which no advisory can be identified, **When** the tool reports it, **Then** it says so explicitly, writes no report, and does not proceed with an empty bundle.
+4. **Given** any of these failures at the interactive prompt, **When** the user declines to retry, **Then** the tool falls back to the whole-fleet report rather than exiting with no output.
+
+---
+
+### Edge Cases
+
+- **A bundle listing an advisory for a product family absent from the inventory.** Its row must be present and must make the population it was evaluated against explicit, so a zero does not read as reassurance about products never assessed.
+- **A bundle whose advisories predate Cisco's data coverage** (Cisco holds ASA, FMC, FTD and FXOS vulnerability data only from January 2022 onward). The resulting silence must not be presented as a clean result.
+- **A bundle page revised since the analyst received the link**, so it now lists a different set of advisories. The report must describe the bundle as resolved at run time.
+- **A bundle listing a single advisory**, and a bundle listing far more than 25. Both must render, and the second must not be truncated.
+- **An advisory listed twice on one bundle page.** It must produce exactly one report row.
+- **Every device in the inventory undetermined.** Every advisory row must show zero impacted and zero unaffected with the whole population undetermined, and the report must not read as a clean bill of health.
+- **No device in the inventory belonging to any family the bundle names.** The report must still be produced, with every row explicit about the empty population.
+- **A run that stops part-way** because Cisco became unreachable or rejected the credentials after the assessment began. Every answer already obtained must be kept, the report must say the run was partial and why, and unreached devices must be undetermined.
+- **An advisory for which Cisco supplies no fixing release.** It must render as explicitly absent — never inferred, and never blank in a way that reads as "none needed".
+- **Bundle page content containing markup, script, or styling.** It must not be able to alter the report's structure, styling, or behaviour.
+- **A bundle identifier submitted instead of a full URL.** Accepted, per FR-005.
+- **An inventory with no rows, or none in a queryable family.** The failure must be the existing inventory failure, not a new bundle-specific one.
+
+## Requirements *(mandatory)*
+
+### Functional Requirements
+
+#### Bundle input
+
+- **FR-001**: The tool MUST prompt for a Cisco Event Response URL during a normal run, after the inventory has been located and before any request concerning the inventory is made.
+- **FR-002**: The tool MUST accept the bundle URL supplied up front, and MUST NOT prompt at all when it is supplied that way.
+- **FR-003**: Users MUST be able to decline at the prompt, and the tool MUST then produce the whole-fleet report with behaviour identical to the pre-change product.
+- **FR-004**: The tool MUST validate that a submitted value is a Cisco Event Response address before making any network request, and MUST reject anything else with a message naming the expected form.
+- **FR-005**: The tool MUST accept the URL in the form Cisco publishes it, and SHOULD additionally accept a bare bundle identifier such as `ERP-75736`.
+
+#### Resolving the bundle
+
+- **FR-006**: The tool MUST resolve an Event Response URL to the complete set of advisories that bundle publishes, identified by advisory identifier.
+- **FR-007**: The tool MUST use the bundle page **only** to determine which advisories are in scope. It MUST NOT take any advisory fact — title, severity, score, CVE identifier, publication date, fixing release, or affected product — from that page, even when the page displays it.
+- **FR-008**: The tool MUST source every advisory fact it displays from Cisco's advisory data, including for advisories in the bundle that impact no inventory device.
+- **FR-009**: The tool MUST report what it resolved — bundle identifier, bundle title, and advisory count — before beginning work concerning the inventory, so a wrong link is caught before a run is spent on it.
+- **FR-010**: The tool MUST distinguish and report differently these three outcomes: the value is not a bundle address; Cisco could not be reached; the page was reached but no advisory could be identified from it.
+- **FR-011**: The tool MUST NOT write a bundle report when the bundle could not be resolved, and MUST exit with a non-zero status a caller can distinguish from a successful run.
+- **FR-012**: The tool MUST treat everything retrieved from the bundle page as untrusted input that cannot alter the report's structure, styling, or behaviour, and cannot become executable content.
+- **FR-013**: Resolving a bundle MUST be time-bounded, so an unresponsive page fails before the run's expensive work begins rather than stalling it.
+- **FR-014**: An advisory appearing more than once on a bundle page MUST yield exactly one advisory in the resolved set.
+
+#### Filtering and scope disclosure
+
+- **FR-015**: The tool MUST assess the inventory using the existing rules, then narrow the result to the bundle's advisories. Narrowing MUST NOT change any device's verdict.
+- **FR-016**: The tool MUST report how many distinct advisories affecting the inventory were excluded by the bundle filter, so the report cannot be mistaken for a whole-fleet assessment.
+- **FR-017**: The tool MUST produce a row for every advisory the bundle lists, including advisories that impact no inventory device.
+- **FR-018**: The tool MUST NOT add an advisory to the report that the bundle does not list, regardless of whether it affects the inventory.
+
+#### Report layout
+
+- **FR-019**: The report MUST be laid out one row per advisory in the bundle.
+- **FR-020**: Each row MUST show the advisory identifier as a link to Cisco's published advisory that opens in a new tab without granting the opened page access to the report.
+- **FR-021**: Each row MUST show the advisory's publication date as published by Cisco.
+- **FR-022**: Each row MUST name every inventory device Cisco records as impacted by that advisory, and MUST state how many there are. **The device is the unit of count** throughout the report.
+- **FR-022a**: Each row MUST additionally roll its impacted devices up by affected release, showing how many distinct releases are affected and which, so a reader sees both the size of the work (devices) and the size of the decision (releases) without doing arithmetic.
+- **FR-023**: Each row MUST show, for each impacted product, the release Cisco lists as first fixing that advisory; a fixing release Cisco does not supply MUST render as explicitly absent, never inferred and never blank.
+- **FR-024**: Each row MUST render products whose status for that advisory could not be determined in a visually distinct way, using yellow, and MUST additionally label them as undetermined in words so the meaning never depends on colour alone.
+- **FR-025**: Each row MUST account for every device in that row's evaluated population exactly once across impacted, confirmed unaffected, and undetermined, so the row's figures can be checked against the population size. **A row's evaluated population is the inventory devices belonging to the product families that advisory covers**, determined per FR-027a.
+- **FR-026**: Each row MUST state the size and the product families of the population it was evaluated against, so a row showing no impact cannot be read as reassurance about products that were never assessed.
+- **FR-026a**: The report MUST additionally state, once, the totals for the whole run — how many inventory devices were assessed, how many reached no conclusion, and how many questions were put to Cisco — so the run as a whole is auditable independently of any single row's population.
+- **FR-027**: An undetermined device MUST appear in every bundle row whose advisory covers its product family, and MUST NOT be omitted from a row merely because its status there is unknown.
+- **FR-027a**: The product families an advisory covers MUST be derived as the union of two sources: the families of the inventory devices for which Cisco returned that advisory, and the product families Cisco names in that advisory's own published product list. Where neither source yields a family, the tool MUST treat the advisory as covering **every** queryable family, so an undetermined device is included rather than omitted.
+- **FR-027b**: Family derivation MUST NOT be able to turn an undetermined device into an unaffected one, nor exclude a device Cisco positively listed as impacted. It may only narrow which rows an *undetermined* device appears in.
+- **FR-028**: The report MUST NOT present, count, or summarise an undetermined device as unaffected anywhere — including in per-row figures, headline totals, and any summary.
+- **FR-029**: The report MUST order advisory rows deterministically, so two runs over identical inputs produce identical document order.
+- **FR-030**: The report MUST list every undetermined device once, giving the hardware and release the inventory recorded, what was asked of Cisco, and a human-readable reason.
+- **FR-031**: The report MUST identify the bundle it covers — identifier, title, and the bundle's own publication date — and link to the bundle page.
+- **FR-032**: The report MUST state that it is bundle-scoped, distinguishably from the whole-fleet report, so the two cannot be confused once filed or emailed.
+- **FR-033**: The report MUST remain a single self-contained file that renders with no network access, and MUST NOT overwrite an existing report.
+- **FR-034**: The report SHOULD record the set of advisory identifiers as resolved at run time, so a reader can audit the scope the report claims.
+- **FR-035**: The report SHOULD allow a reader to filter and sort advisory rows, at least by severity and by number of impacted products.
+- **FR-036**: The report SHOULD provide a per-device cross-reference, so a reader can go from one device to every bundle advisory affecting it.
+
+#### Cross-cutting
+
+- **FR-037**: Resolving a bundle MUST transmit no inventory-derived data. Nothing about any device may be sent to the bundle page.
+- **FR-038**: A run that stops early MUST keep every answer already obtained, report that it was partial and why, and leave unreached devices undetermined — matching the existing behaviour.
+- **FR-039**: Bundle resolution and filtering MUST be usable without a terminal: they MUST NOT print, prompt, consult the working folder, write a file, or exit the process. Prompting, progress output, and report writing remain the terminal program's responsibility.
+- **FR-040**: A failure to *reach* Cisco during bundle resolution MUST surface as an error, never as an empty bundle or a set of undetermined verdicts, so a caller can tell "we could not ask" from "we asked and could not decide".
+- **FR-041**: A bundle-scoped run MUST stay within Cisco's published request quotas, and SHOULD add no more requests to a whole-fleet run than the number of bundle advisories that impact nothing.
+- **FR-042**: Behaviour MUST be identical on macOS, Windows, and Linux.
+
+### Key Entities
+
+- **Bundle**: The set of advisories one Cisco Event Response page publishes. Carries an identifier (`ERP-#####`), a title, its own publication date, and the resolved set of advisory identifiers. Resolved fresh on every run; never persisted between runs.
+- **Bundle advisory row**: One advisory in the bundle as presented in the report. Carries the advisory identifier and its link, the advisory's publication date, its severity and score, its CVE identifiers, the product families it covers, three device groupings — impacted, confirmed unaffected, undetermined — the size of the population it was evaluated against, and the rollup of its impacted devices by affected release.
+- **Covered family set**: The product families one advisory applies to, as the union of the families Cisco returned that advisory for and the families named in its published product list. Determines a row's population. Fails open to every queryable family, and can only narrow which rows an *undetermined* device appears in — never suppress an impacted device or create an unaffected one.
+- **Impacted product entry**: One device within an advisory row that Cisco records as affected. Carries the device as the inventory names it, its hardware and release, and the release Cisco lists as first fixing that advisory.
+- **Undetermined product entry**: One device within an advisory row whose status for that advisory could not be established, because the device's own assessment reached no conclusion. Carries the device as the inventory names it, and is never resolvable to impacted or unaffected without new data.
+- **Suppressed finding**: An advisory affecting the inventory that the bundle does not list, and which is therefore absent from the report. Counted and disclosed, not itemised.
+- **Assessment result**: The existing per-device outcome — verdict, reason, and the advisories Cisco returned — produced unchanged by this feature and consumed by the filter. Not redefined here.
+
+## Success Criteria *(mandatory)*
+
+### Measurable Outcomes
+
+- **SC-001**: An analyst goes from a pasted Event Response URL to a complete per-advisory impact report in a single command, transcribing no advisory identifiers and cross-referencing nothing by hand.
+- **SC-002**: For a bundle listing 25 advisories, the report contains exactly 25 advisory rows; the set matches the bundle page exactly, with none missing and none invented.
+- **SC-003**: Every advisory row's impacted, unaffected, and undetermined figures sum to that row's stated population, for every row, so the report is internally checkable; and the whole-run totals are stated once so the run is auditable independently of any row.
+- **SC-004**: No device with an undetermined assessment appears as unaffected anywhere in the report; each is present in every row it could belong to, and listed once with a reason.
+- **SC-005**: Every advisory fact rendered in the report is present in Cisco's advisory data for that advisory; none originates from the bundle page.
+- **SC-006**: A user who declines the bundle prompt receives a report equivalent in content to the one the tool produced before this feature, for the same inputs.
+- **SC-007**: Each of the three bundle-resolution failures produces a distinct message, and none produces a report.
+- **SC-008**: A bundle review of a 70-device inventory adds no more than 25% to the elapsed time of a whole-fleet run over the same inventory, and stays inside Cisco's per-minute and per-day request quotas.
+- **SC-009**: A reader can tell from the report alone that it is bundle-scoped rather than whole-fleet, and can see how many findings the bundle filter excluded.
+- **SC-010**: The report opens and renders completely with no network access, and no run overwrites an earlier report.
+
+## Assumptions
+
+The first five were verified against the live sources on 2026-07-28, using ERP-75736 and the current 70-row inventory, rather than assumed from documentation.
+
+- **A bundle's advisory list is machine-readable from its page.** The page responds quickly and yields exactly the advisories it lists, via the advisory links in its table. The identifiers are **not** present in the page's visible text, so reading the text alone is insufficient.
+- **The advisory identifier and publication date are already in the data the tool retrieves per device.** Filtering an assessment to a bundle therefore costs no additional requests, and the publication date needs no separate lookup for any advisory that impacts at least one device.
+- **An advisory in the bundle that impacts nothing needs its own lookup.** Such an advisory appears in no device's result, so its title and publication date must be retrieved individually. Measured at 1 of 25 for ERP-75736; the worst case is the bundle size.
+- **Cisco publishes no bundle endpoint.** Resolving a bundle to its advisories requires reading the published page; there is no equivalent in Cisco's advisory data.
+- **A device whose assessment is undetermined has no advisory list at all.** Cisco never answered for it, so its status against any specific advisory is genuinely unknown: it cannot be placed in an advisory row as a fact, and it cannot be excluded as clean. This is the structural reason FR-024 through FR-028 exist, and the single most important constraint in the feature.
+- **A bundle-scoped run assesses the whole inventory and filters afterwards.** Narrowing the assessment itself to the families a bundle names would be an optimisation, but it would depend on interpreting Cisco's product naming, and a family named only in an advisory's prose would be missed. A whole-inventory run over 70 devices costs about 32 requests and 72 seconds, so the optimisation buys little against the risk.
+- **Both report layouts coexist.** The whole-fleet report remains the output when no bundle is supplied (FR-003). Whether the bundle layout eventually replaces it is deliberately not decided here; if it ever does, that is a breaking change to the product's primary output.
+- **Default row order is severity first, then number of impacted products, with the advisory identifier as a final tiebreak** — chosen to put the most urgent, widest-reaching work first while satisfying the determinism FR-029 requires. Bundle-page order remains an alternative the plan may revisit.
+- **Bundle membership is re-resolved on every run**, so a revised bundle page is picked up without a tool release, and no bundle state is cached between runs.
+- **Products are identified in the report the way the inventory names them**, so a reader can match a row back to their own records.
+- **The existing inventory format, credential handling, verdict vocabulary, and reason kinds are unchanged** by this feature.
+
+Scope boundaries adopted here, each of which a reader might otherwise assume is included:
+
+- **One bundle per run.** Reviewing several bundles in one report is not included.
+- **Only Event Response bundle addresses are accepted inputs.** Individual advisory pages, security bulletins, and non-Cisco vulnerability feeds are not. Answering "does this one advisory affect us?" for a single advisory or CVE uses the same mechanism and is the natural successor feature, but is out of scope here.
+- **Rows are per advisory, never per CVE.** An advisory's CVE identifiers appear within its row; a bundle where several advisories share a CVE is not decomposed.
+- **No verdict rule changes.** Release normalisation, model-to-platform mapping, and the verdict decision table are untouched; this feature filters and re-renders an assessment rather than producing one.
+- **No state between runs.** No record of what was patched since the last bundle, no ticket integration, no history. Each report is a point-in-time record.
+- **No offline bundle cache.** The bundle page is resolved per run; snapshotting bundles for air-gapped use is not included.
+- **The existing whole-fleet report is neither removed nor restyled.**
+- **Which advisories *should* have been in a bundle is not inferred.** A bundle's membership is whatever Cisco publishes on that page at run time.
+
+### Dependencies
+
+- **Cisco's PSIRT advisory data and its platform and release catalogues** — input; the sole source of every advisory fact and every verdict. Unchanged by this feature.
+- **Cisco Security Center Event Response pages** — input; supply the set of advisories in a bundle. **New external endpoint.** The project's constraints treat any additional endpoint the analyzer itself contacts as a reviewed change, so the planning phase must record it, and the required amendment, before implementation — the same gate the advisory API endpoints passed through for spec 006.
+- **The existing assessment capability** (spec 006) — input; produces the per-device result this feature filters. Reused, never reimplemented.
+- **The existing report capability** — this feature adds a second layout alongside it; both must keep the self-containment and untrusted-content guarantees.
+- **The user's inventory workbook** — input, unchanged in format.
+- **Cisco API credentials** — input, unchanged; the tool must still refuse to run without them.
+
+### Deferred to planning
+
+- Whether to cross-check the resolved bundle against Cisco's advisory data by publication date. It would return a superset of a bundle's advisories and could catch a page-parsing regression by disagreeing, at the cost of one request and some complexity.
+- Whether the version bump is MINOR or MAJOR, which follows from the coexistence decision above and from whether the shared surface gains or changes.
+- How a row with many impacted devices is presented without truncating it — one advisory in the reference bundle impacts 50 of 70 devices, and FR-033's self-containment rules out loading anything on demand.
diff --git a/specs/008-erp-bundle-scoped-report/tasks.md b/specs/008-erp-bundle-scoped-report/tasks.md
new file mode 100644
index 0000000..d6d3dd4
--- /dev/null
+++ b/specs/008-erp-bundle-scoped-report/tasks.md
@@ -0,0 +1,308 @@
+---
+
+description: "Task list for Bundle-Scoped Impact Reporting"
+---
+
+# Tasks: Bundle-Scoped Impact Reporting
+
+**Input**: Design documents from `/specs/008-erp-bundle-scoped-report/`
+
+**Prerequisites**: [plan.md](./plan.md), [spec.md](./spec.md), [research.md](./research.md),
+[data-model.md](./data-model.md), [contracts/](./contracts/), [quickstart.md](./quickstart.md)
+
+**Tests**: Included, and **not optional** for this feature. The constitution's Development Workflow
+gate requires tests for "the logic behind every verdict — inventory loading and column matching,
+release normalization, platform and release catalogue handling, verdict assignment, and report
+generation", requires that analysis-flow changes "be covered by tests that run with no credentials
+and no network access", and separately requires the shared surface's headless property to be tested.
+This feature adds verdict-adjacent logic and two shared-surface modules, so all three clauses apply.
+
+**Constitution amendment**: **applied** (3.1.0 → 3.2.0) on this branch, matching the precedent of
+spec 006 (`cb6938a`) and spec 007 (`e043d41`), where each feature's amendment travelled in that
+feature's own pull request. Phase 0 below is complete; implementation may begin.
+
+**Organization**: Tasks are grouped by user story so each story can be implemented and tested
+independently.
+
+## Format: `[ID] [P?] [Story] Description`
+
+- **[P]**: Can run in parallel (different files, no dependencies)
+- **[Story]**: Which user story this task belongs to (US1–US5)
+- Include exact file paths in descriptions
+
+## Path Conventions
+
+Single project. Package at `caia/`, tests at `tests/`, both at the repository root.
+
+---
+
+## Phase 0: Constitution Amendment (Blocking Prerequisite) ✅ COMPLETE
+
+**Purpose**: The constitution designated a new external endpoint a *reviewed* change, and named its
+shared surface's four modules explicitly. Both had to change before any code could contact a bundle
+page.
+
+Applied on this branch, per the precedent of spec 006 (`cb6938a`, "plan and design artifacts; amend
+constitution to 2.2.0") and spec 007 (`e043d41`) — in both cases the amendment travelled in the
+feature's own pull request rather than a standalone one. The one standalone constitution commit,
+`73de536`, was a *retroactive* amendment documenting Principle VI after product 4.1.0 had shipped,
+so it is not the precedent for a feature-driven change.
+
+- [X] T001 Amend `.specify/memory/constitution.md`, bumping **3.1.0 → 3.2.0** (MINOR) with a Sync Impact Report and `Last Amended` set to 2026-07-28. Four changes, per [research Decision 9](./research.md): (a) **Networking** — `sec.cloudapps.cisco.com` admitted as an endpoint the analyzer itself contacts, scoped to resolving a bundle to its advisory identifiers and the bundle's own identity, with the request explicitly unauthenticated and forbidden from carrying **any** inventory-derived data — a stricter bound than the advisory API's, which may carry the derived family/platform/release triple; (b) **Scope selectors** — a new constraint bullet granting a narrow, enumerated permission rather than relaxing "No scraped or cached-as-authoritative alternatives": a bundle page MAY supply which advisories are in scope and the bundle's own identity, and MUST NOT supply any advisory fact, with each forbidden field named, disagreement resolved in the API's favour, and a page yielding no advisory treated as an error rather than an empty scope; (c) **Principle VI** — shared surface extended from four modules to six, adding `erp` and `bundle`, with `bundle_report` added to the terminal-side list and the public contract extended to name bundle resolution and covered-family derivation; (d) **Consumers** — the released interface now enumerates all six modules.
+- [X] T002 Verify the amendment's internal consistency in `.specify/memory/constitution.md`: version footer reads 3.2.0, the Sync Impact Report records the rationale and template alignment as prior amendments do, the superseded 3.1.0 report is retained for history, and no stale four-module reference to the shared surface remains anywhere in the document.
+
+**Checkpoint**: ✅ The constitution permits the endpoint and names the six-module surface. Implementation may begin.
+
+> The README and `docs/index.html` shared-surface updates the Documentation gate requires are **not**
+> amendment debt — they are tasks T051 and T052, due in this same pull request alongside the code.
+
+---
+
+## Phase 1: Setup & Baseline
+
+**Purpose**: A known-green starting point and the offline fixture every parsing test depends on.
+
+- [X] T003 Establish a green baseline over `tests/`: run `python -m unittest discover -s tests` from the repo root and confirm the suite passes. **Note**: a bare `python3` on a machine without the runtime dependencies importable reports 210 tests with 3 `openpyxl` errors — under-running by 62 tests. Use `uv run --with openpyxl --with python-dotenv python -m unittest discover -s tests` if that occurs. The verified baseline is **272 tests, OK**.
+- [X] T004 [P] Commit canned bundle-page markup to `tests/fixtures/erp_pages.py` reproducing the structure verified against `https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736` (observed 181,576 bytes, 25 advisory identifiers, `Doc ID: ERP-75736`, `First Published: 2026 March 4 16:00 GMT`, `Version: 1.0`). Every parsing test uses this fixture so the suite needs no network, per the constitution's Tests gate. **Deviation from the letter of this task**: hand-authored builders rather than a raw ~180 KB capture, following the precedent of `tests/fixtures/psirt_responses.py`, which cans verified *shapes* rather than vendoring Cisco's page. The properties the parser depends on are reproduced exactly.
+- [X] T005 [P] Add a hostile-markup fixture to `tests/fixtures/erp_pages.py` (`hostile_page()`): a bundle page whose title and advisory link text contain `<script>`, an `onerror` attribute, and a `javascript:` URL, used to prove FR-012's escaping. Also include one advisory identifier appearing **only** in prose (not in an `href`), which the parser must NOT treat as in-scope.
+- [X] T006 [P] Confirm no new runtime dependency is required: `pyproject.toml` is unchanged, and the feature uses only `urllib.request`, `html.parser`, `html.escape`, `re`, `datetime` and `pathlib` from the standard library (Constitution I, plan.md Technical Context).
+
+---
+
+## Phase 2: Foundational (Blocking Prerequisites)
+
+**Purpose**: The two shared-surface modules. Every user story consumes them.
+
+**⚠️ CRITICAL**: No user story work can begin until this phase is complete.
+
+### Bundle page access — `caia/erp.py` (new, shared surface)
+
+- [X] T007 Create `caia/erp.py` with a module docstring stating its role — the only module that talks to Cisco's Security Center, standard library only, and that the page is a **scope selector** that may never supply an advisory fact (FR-007, [contracts/erp-access.md](./contracts/erp-access.md)). Define the error types: a not-a-bundle-address error, an unreachable error, and a no-advisories-found error, mirroring `psirt.py`'s error taxonomy so callers can distinguish the three outcomes (FR-010).
+- [X] T008 Add URL validation and normalisation to `caia/erp.py`: accept the form Cisco publishes, accept a bare `ERP-#####` and expand it to the canonical URL, and reject anything that is not a Cisco Event Response address **before any network request is made** (FR-004, FR-005). Rejection raises the not-a-bundle-address error and names the expected form.
+- [X] T009 Add the paced, time-bounded fetch to `caia/erp.py`: `urllib.request` with an `Accept: text/html` header, a timeout well below the API client's 45 s, and an injectable opener so tests need no network. The request carries **only** the bundle identifier — no inventory-derived data of any kind (FR-013, FR-037, Constitution V). A transport failure or timeout raises the unreachable error, never returns an empty bundle (FR-040).
+- [X] T010 Add the advisory-identifier parser to `caia/erp.py` as an `html.parser.HTMLParser` subclass that collects `CiscoSecurityAdvisory/(cisco-sa-[A-Za-z0-9._-]+)` from **`href` attributes only**, preserving document order and deduplicating (FR-006, FR-014). Matching on `href` rather than document text is required, not stylistic: an identifier mentioned in prose would silently widen scope, and scope is the only thing this page is trusted for (research Decision 1).
+- [X] T011 Extend the same parse pass in `caia/erp.py` to accumulate page text and extract the bundle's own identity — `Doc ID`, document title, `First Published`, `Version` — and cross-check the extracted `Doc ID` against the `alertId` in the submitted URL, treating disagreement as a resolution failure (FR-031, research Decision 2). Take **nothing else**: the page also displays advisory titles, CVEs, severities and CVSS scores, all of which must be ignored in favour of the API (FR-007).
+- [X] T012 Add the `Bundle` result type and the top-level resolve function to `caia/erp.py`, returning `bundle_id`, `title`, `published`, `version`, `url` and the ordered, deduplicated `advisory_ids` per [data-model.md §1](./data-model.md). An empty identifier list raises the no-advisories-found error — an empty bundle is an error, never an empty report (FR-010, FR-011). The function prints nothing, prompts for nothing, writes nothing, and never exits the process (FR-039).
+- [X] T013 [P] Create `tests/test_erp.py` covering, all offline against the Phase 1 fixtures: 25 identifiers extracted from `erp_page.html`; duplicates collapsing to one (FR-014); the prose-only identifier in the hostile fixture **excluded**; bundle identity extracted correctly; `Doc ID`/`alertId` agreement and a forced mismatch; each of the three failure outcomes raising its own error type (FR-010); a bare `ERP-#####` expanding; a non-Cisco URL rejected with **no opener call at all** (FR-004); and that resolution never returns a `Bundle` with zero identifiers.
+
+### Pure bundle logic — `caia/bundle.py` (new, shared surface)
+
+- [X] T014 Create `caia/bundle.py` with a module docstring stating that it is side-effect free and does no I/O, mirroring `matching.py`, and that it owns the FR-027b safety invariant. Add the covered-family derivation per [data-model.md §2](./data-model.md): the union of the families whose family-scoped question returned the advisory and the firewall families recognised in the advisory's `productNames`, **failing open to every queryable family** when both are empty (FR-027a, research Decision 5).
+- [X] T015 Enforce the FR-027b invariants in `caia/bundle.py`: family derivation may only narrow which rows an *undetermined* device appears in; it can never exclude a device Cisco positively listed as impacted, and can never move a device into confirmed-unaffected. Read impacted and unaffected from the device's own assessment, never from the family set, so invariants 2 and 3 hold structurally rather than by check.
+- [X] T016 Add the filter to `caia/bundle.py`: narrow a completed assessment to a bundle's advisory identifiers, matching on `advisoryId`. It MUST NOT change any device's verdict, and MUST NOT admit an advisory the bundle does not list, however it affects the inventory (FR-015, FR-018).
+- [X] T017 Add row construction to `caia/bundle.py` per [data-model.md §3](./data-model.md): one row per advisory in the bundle including advisories that impact nothing (FR-017, FR-019); each row's population is the inventory devices whose family is in the covered set (FR-025); each device lands in exactly one of impacted, confirmed unaffected, or undetermined (FR-025, FR-027). Assert the accounting invariant `impacted + unaffected + undetermined == population` internally so a dropped device fails loudly rather than rendering as clean.
+- [X] T018 Add the release rollup to `caia/bundle.py`: group a row's impacted devices by affected release, yielding the device count, the distinct affected releases, and the fixing release (FR-022a). This is presentation data derived from `impacted` and is **never** a denominator — the device is the unit of count, because a release-based denominator cannot close the T017 invariant (research Decision 8 rationale, spec Clarifications).
+- [X] T019 Add run totals to `caia/bundle.py` per [data-model.md §6](./data-model.md): devices assessed, devices undetermined, questions asked, and the count of distinct advisories affecting the inventory that the bundle does **not** list (FR-016, FR-026a). The suppressed figure is a count, not an itemisation — it exists so the report cannot be mistaken for a whole-fleet assessment.
+- [X] T020 Add deterministic ordering to `caia/bundle.py`: severity rank first (reusing the `_SEVERITY_ORDER` mapping already in `caia/html_report.py` so both layouts agree on what severity means), then descending impacted device count, then advisory identifier as a total tiebreak (FR-029, research Decision 6).
+- [X] T021 [P] Create `tests/test_bundle.py` covering: family derivation from each source alone, from the union, and the fail-open case (FR-027a); all four FR-027b invariants, including an attempt to narrow away an impacted device; the accounting invariant asserted for **every** row of a table-driven fixture; zero-impact rows present with a stated population; the release rollup; suppressed-advisory counting; and ordering stability across two builds from shuffled input (FR-029).
+
+### Advisory metadata for zero-impact rows — `caia/psirt.py`
+
+- [X] T022 Add `get_advisory(advisory_id)` to the client in `caia/psirt.py`, returning the advisory record from `GET /advisory/{advisoryId}` through the existing paced, token-refreshing `_get` path. Needed only for bundle advisories that impact nothing, since those appear in no device's result and so have no title or publication date available — measured at 1 of 25 for the reference bundle, worst case the bundle size (FR-008, FR-017, research Decision 4).
+- [X] T023 [P] Extend `tests/test_psirt.py`: `get_advisory` returns the record on a 200, surfaces an auth failure as the existing auth error, surfaces a transport failure as the existing unreachable error, and is subject to the same pacing as every other request (FR-041).
+
+### Headless property — the constitution's Tests gate
+
+- [X] T024 [P] Add headless-property tests to `tests/test_erp.py` and `tests/test_bundle.py`, as the constitution's Tests gate requires of every shared-surface module: neither prints anything (assert nothing reaches stdout/stderr), neither exits the process, neither mutates the caller's inventory list or device dicts, and `erp` raises rather than returning an empty bundle when the page cannot be reached (FR-039, FR-040, Principle VI).
+
+**Checkpoint**: Bundle resolution and per-advisory aggregation are complete, tested offline, and headless. User story work can begin.
+
+---
+
+## Phase 3: User Story 1 - Review a bundled publication against the fleet (Priority: P1) 🎯 MVP
+
+**Goal**: Paste a bundle URL, get one HTML report with one row per advisory in that bundle — each
+row naming the advisory, linking to it, giving its publication date, and listing the products it
+impacts, with undetermined products visibly marked.
+
+**Independent Test**: Run the tool in a folder with a valid inventory, paste the reference bundle URL
+at the prompt, and confirm the report contains 25 advisory rows carrying links, publication dates,
+impacted products with fixing releases, and marked undetermined products.
+
+### Implementation for User Story 1
+
+- [X] T025 [US1] Create `caia/bundle_report.py` with the document skeleton and output path selection: reuse `html_report.py`'s existing `FILENAME_PREFIX = "impact_report_"` and never-overwrite path logic, writing `impact_report_<BUNDLE_ID>_<YYYYmmdd_HHMMSS>.html` so the constitution's recorded `impact_report_*.html` pattern and `.gitignore`'s existing rule both still match (FR-032, FR-033, research Decision 10). Single self-contained file, no external reference of any kind.
+- [X] T026 [US1] Render the bundle header and run totals in `caia/bundle_report.py`: bundle identifier, title, the bundle's own publication date, a link to the bundle page, and an explicit statement that this is a bundle-scoped report (FR-031, FR-032); then devices assessed, devices undetermined, questions asked, and the suppressed out-of-bundle advisory count (FR-016, FR-026a).
+- [X] T027 [US1] Render advisory rows in `caia/bundle_report.py`: the identifier linked to `publicationUrl`, opening in a new tab **and** denying the opened page access to the report document, matching the behaviour the whole-fleet report already established in commit `544629c` (FR-020); the publication date as Cisco publishes it (FR-021); severity, CVSS, and the advisory's CVEs shown in-row and never promoted to their own row.
+- [X] T028 [US1] Render each row's impacted devices in `caia/bundle_report.py`, naming every device as the inventory names it, with the release Cisco lists as first fixing that advisory. A fixing release Cisco does not supply renders as **explicitly absent**, never inferred and never blank in a way that reads as "none needed" (FR-022, FR-023).
+- [X] T029 [US1] Render the release rollup in `caia/bundle_report.py` alongside each row's device count, e.g. `5 devices · 2 affected releases (7.4.2.3, 7.4.2.4) · fixed in 7.4.4`, so a reader sees the size of the work and the size of the decision without arithmetic (FR-022a).
+- [X] T030 [US1] Render undetermined devices within each row in `caia/bundle_report.py`: visually distinct using **yellow**, and additionally **labelled in words** so the meaning survives greyscale, print, and colour-blind readers (FR-024). They must appear in every row whose advisory covers their family (FR-027) and must be counted in neither the impacted nor the unaffected total, anywhere, including headline figures (FR-028).
+- [X] T031 [US1] Render each row's population and counts in `caia/bundle_report.py`: the population size **and** the covered product families, plus the impacted / unaffected / undetermined figures (FR-025, FR-026). A row that impacts nothing is present and states its population and families — a bare "0 impacted" without them reads as reassurance about products never assessed (FR-017).
+- [X] T032 [US1] Collapse long device lists in `caia/bundle_report.py` using the existing `<details>`/`<summary>` disclosure pattern already used for devices with many advisories, with **every** device name present in the document. Collapsing is required; truncating is forbidden — one advisory in the reference bundle impacts 50 of 70 devices, and a hidden device is an unpatched device (research Decision 11).
+- [X] T033 [US1] Escape every interpolated value in `caia/bundle_report.py` at the point of interpolation, whether it came from Cisco's API or the bundle page — advisory titles, CVEs, URLs as attribute values, device names, models, releases, and the bundle title and dates. A scraped page is the least trustworthy input in the system and inherits the strictest treatment (FR-012, research Decision 14).
+- [X] T034 [US1] Render the resolved-scope section in `caia/bundle_report.py`, recording the advisory identifiers as resolved at run time so a reader can audit the scope the report claims (FR-034).
+- [X] T035 [US1] Wire the flow in `caia/analyzer.py`: after the inventory is located and **before** any advisory request, prompt for a bundle URL; on resolution, report the bundle identifier, title and advisory count so a wrong link is caught before the run is spent (FR-001, FR-009); then run the existing assessment unchanged, fetch metadata for zero-impact bundle advisories, build rows, and write the bundle report. All prompting, progress output and file writing stay here, never in the shared surface (FR-039).
+- [X] T036 [P] [US1] Create `tests/test_bundle_report.py` covering: exactly 25 rows for a 25-advisory bundle (FR-017, SC-002); the accounting invariant asserted for every rendered row (FR-025, SC-003); a zero-impact row present with its population; undetermined devices rendered yellow **and** labelled, and absent from every count of impacted/unaffected (FR-024, FR-028); escaping of the hostile fixture's title and link text, with no executable content in the output (FR-012); a 50-device row collapsed with all 50 names present (research Decision 11); advisory links opening in a new tab with no access to the document (FR-020); a missing fixing release rendered as explicitly absent (FR-023); and the file containing no external resource reference (FR-033).
+- [X] T037 [US1] Validate the written `output/impact_report_ERP-75736_*.html` against [quickstart.md](./quickstart.md) Scenario 1, with real credentials and the reference bundle: 25 rows, 24 with at least one impacted device, 1 with none, the FMC critical row showing 5 devices / 2 releases / fixed in 7.4.4, run totals of 70 assessed / 15 undetermined / 27 questions, and a non-zero suppressed count.
+
+**Checkpoint**: User Story 1 is fully functional and independently testable. This is the MVP.
+
+---
+
+## Phase 4: User Story 2 - Run a bundle review unattended (Priority: P2)
+
+**Goal**: Supply the bundle up front so a review can be scheduled or scripted, with exit codes a caller can act on.
+
+**Independent Test**: Invoke with the bundle supplied up front and no terminal attached; confirm no prompt, the same report as US1, and exit 0. Then invoke with an unresolvable bundle and confirm a distinct non-zero exit and no report.
+
+### Implementation for User Story 2
+
+- [X] T038 [US2] Add `--erp URL|ERP-#####` to the parser in `caia/cli.py`, documented in `--help` alongside the existing options, and thread it to `analyzer.run()`. When supplied it suppresses the prompt entirely (FR-002, FR-005). Principle III makes this a constitutional requirement, not a convenience: a capability reachable only by typing is not scriptable.
+- [X] T039 [US2] Implement the exit-code mapping in `caia/cli.py` and `caia/analyzer.py`, reusing the existing vocabulary rather than adding to it (research Decision 13): `2` when the `--erp` value is not a bundle address (the existing argument-error convention), `1` when the page is unreachable, yields no advisory, or fails the `Doc ID` cross-check (the existing run-failure convention), `130` on interrupt. **No report is written on any non-zero bundle-resolution outcome** (FR-011).
+- [X] T040 [US2] Ensure a non-interactive run with no bundle supplied produces the whole-fleet report without prompting, in `caia/analyzer.py` (FR-002).
+- [X] T041 [P] [US2] Extend `tests/test_cli.py`: `--erp` parses in both URL and bare-identifier forms; it appears in `--help`; supplying it suppresses the prompt; each of the three resolution failures yields its documented exit code; no report file is produced on any of them (FR-011); and `--erp` composes with `--inventory`, `--sheet` and `--output-dir`.
+
+**Checkpoint**: Bundle reviews can be scheduled. US1 and US2 both work independently.
+
+---
+
+## Phase 5: User Story 3 - Skip the bundle and get today's report (Priority: P2)
+
+**Goal**: Existing users and existing habits keep working unchanged — bundle scoping is an addition, not a tax.
+
+**Independent Test**: Run the tool and decline at the bundle prompt; confirm the whole-fleet report, with verdicts and reasons matching the pre-change product for the same inputs.
+
+### Implementation for User Story 3
+
+- [X] T042 [US3] Implement the decline path in `caia/analyzer.py`: an empty response at the bundle prompt selects the existing whole-fleet report and makes **no request to `sec.cloudapps.cisco.com`** (FR-003).
+- [X] T043 [P] [US3] Extend `tests/test_analyzer.py` with an equivalence test: for a fixed inventory and fixed Cisco responses, the report produced via the decline path is equivalent in content to the one the pre-change code produced — same verdicts, same reasons, same rows (FR-003, SC-006). Assert the ERP opener is never called on this path.
+- [X] T044 [P] [US3] Extend `tests/test_analyzer.py` to confirm the exit status on the decline path matches the pre-change behaviour for the same outcome, including the all-`Needs review` and partial-run cases.
+
+**Checkpoint**: Users who do not want bundle scoping are unaffected. US1–US3 all work independently.
+
+---
+
+## Phase 6: User Story 4 - Undetermined devices are actionable (Priority: P2)
+
+**Goal**: Turn a recurring caveat into a one-time inventory cleanup by naming every undetermined device with the reason it could not be assessed.
+
+**Independent Test**: Run against an inventory containing releases Cisco does not hold and releases Cisco does not list for the recorded hardware; confirm every such device appears once with the recorded values and a human-readable reason.
+
+### Implementation for User Story 4
+
+- [X] T045 [US4] Render the undetermined-devices section in `caia/bundle_report.py`: every undetermined device listed **once**, with the hardware and release the inventory recorded, what was asked of Cisco, and a human-readable reason drawn from the existing reason kinds (FR-030). Showing both the recorded value and the value asked for is what makes the field to correct evident — the difference is usually the answer.
+- [X] T046 [P] [US4] Extend `tests/test_bundle_report.py`: all 15 undetermined devices from the reference assessment listed once each with a reason; a `release_not_on_platform` device showing both recorded and queried values; and every device in this section also present as undetermined in its applicable advisory rows and **nowhere** as unaffected (FR-028, FR-030).
+
+**Checkpoint**: The inventory data causing undetermined verdicts is now actionable.
+
+---
+
+## Phase 7: User Story 5 - Recover from a bad bundle link (Priority: P3)
+
+**Goal**: A mistyped, stale, or non-bundle URL, or an unreachable site, produces a clear statement of which failure occurred and a chance to correct it — never a silently empty report.
+
+**Independent Test**: Submit in turn a non-Event-Response URL, a bundle URL with the host unreachable, and a reachable page with no advisories; confirm three distinct messages, that the first makes no network request, and that none produces a report.
+
+### Implementation for User Story 5
+
+- [X] T047 [US5] Implement interactive recovery in `caia/analyzer.py`: distinguish and report the three failures separately — not a bundle address, Cisco unreachable, page reachable but no advisory identified — then re-prompt (FR-010). The connectivity message must identify the failure as connectivity rather than a bad link, so a proxy outage is not mistaken for a typo.
+- [X] T048 [US5] Implement the fallback in `caia/analyzer.py`: declining to retry after a failed attempt produces the whole-fleet report rather than exiting with no output (spec US5 §4).
+- [X] T049 [P] [US5] Extend `tests/test_analyzer.py`: each of the three failures produces its own distinguishable message and re-prompts; the not-a-bundle-address case makes **no** network request at all (FR-004); no report is written on any failure (FR-011); and declining after a failure falls back to the whole-fleet report.
+
+**Checkpoint**: All five user stories are independently functional.
+
+---
+
+## Phase 8: Polish & Cross-Cutting Concerns
+
+- [X] T050 Implement partial-run handling for the bundle layout in `caia/analyzer.py` and `caia/bundle_report.py`: when Cisco becomes unreachable or rejects the token *after* the assessment begins, keep every answer already obtained, leave unreached devices undetermined, still write the report, state that the run was partial and why, and exit `0` (FR-038). A bundle-resolution failure is **not** a partial run — it happens before any answer exists.
+- [X] T051 [P] Update `README.md`: document the bundle flow and `--erp`, and update the shared-surface table from four modules to **six**, adding `erp` and `bundle`. The constitution's Documentation gate requires the table stay accurate in the same pull request that changes the surface.
+- [X] T052 [P] Update `docs/index.html` to describe the bundle capability, mirroring `README.md`. The Documentation gate requires a change in one to be mirrored in the other within the same pull request, and forbids either describing a capability the tool lacks.
+- [X] T053 [P] Verify cross-platform parity (FR-042): confirm nothing in `caia/erp.py`, `caia/bundle.py` or `caia/bundle_report.py` assumes an OS, path separator or shell, and that report paths go through `pathlib` as the existing report does (Constitution II).
+- [X] T054 Verify the request budget of the run driven by `caia/analyzer.py` against [quickstart.md](./quickstart.md) and SC-008: a 70-device bundle run adds the page fetch (~0.54 s measured) plus one metadata request per zero-impact advisory to the existing 32-request, ~72 s sweep — about 3 s added in the measured case, inside the 25% bound. Confirm the run stays within Cisco's per-minute and per-day quotas (FR-041).
+- [X] T055 Verify determinism per [quickstart.md](./quickstart.md) Scenario 8: two runs over the same bundle and inventory produce two `output/impact_report_ERP-75736_*.html` files with identical advisory-row order, differing only in timestamp and generation metadata (FR-029).
+- [X] T056 [P] Add filter and sort controls to `caia/bundle_report.py` so a reader can reorder advisory rows by at least severity and number of impacted products (FR-035, SHOULD). Any behaviour must be inline — a CDN-hosted table library was already rejected for the whole-fleet report because it breaks the offline requirement (spec 006, Decision 12).
+- [X] T057 [P] Add a per-device cross-reference to `caia/bundle_report.py` so a reader can go from one device to every bundle advisory affecting it (FR-036, SHOULD). This is the inverse of the row view and closes the loop for an engineer working device-by-device rather than advisory-by-advisory.
+- [X] T058 Run the full suite over `tests/` — `python -m unittest discover -s tests` from the repo root — and confirm every test passes — existing plus new, from the 272-test baseline. The existing suite passing is a constitutional merge gate.
+- [X] T059 Bump `VERSION` from `4.1.0` to `4.2.0` — MINOR, because the shared surface **gains** `erp` and `bundle` and nothing incompatible changes (research Decision 8, Constitution Versioning gate). The git tag is pushed only after the pull request merges, per the runbook in `CONTRIBUTING.md`.
+- [X] T060 Walk all 8 scenarios in `specs/008-erp-bundle-scoped-report/quickstart.md` end to end against the reference bundle and inventory, confirming each stated number. Scenario 2 is the one to re-run after any report change: a row reading "0 impacted" without its 11 undetermined devices is this feature's worst failure mode.
+
+---
+
+## Dependencies & Execution Order
+
+### Phase Dependencies
+
+- **Phase 0 (Constitution amendment)**: no dependencies, and **blocks everything**. ✅ Complete — applied on this branch, and reaches `main` in this feature's pull request.
+- **Phase 1 (Setup)**: depends on Phase 0. ✅ Unblocked.
+- **Phase 2 (Foundational)**: depends on Phase 1 — **blocks all user stories**.
+- **Phases 3–7 (User Stories)**: all depend on Phase 2. US1 is the MVP; US2–US5 may then proceed in parallel or in priority order.
+- **Phase 8 (Polish)**: depends on all desired user stories being complete.
+
+### User Story Dependencies
+
+- **US1 (P1)**: after Phase 2. No dependency on any other story.
+- **US2 (P2)**: after Phase 2. Independent of US1's renderer, though it exercises it.
+- **US3 (P2)**: after US1's prompt exists (T035), since the decline path is a branch of it.
+- **US4 (P2)**: after Phase 2. Touches `bundle_report.py`, so sequence with US1's rendering tasks to avoid editing the same file concurrently.
+- **US5 (P3)**: after US1's prompt exists (T035).
+
+### Within Each Phase
+
+- Tests and implementation for a story may be written in either order, but a story is not complete until its tests pass without credentials or network access (constitution Tests gate).
+- In Phase 2, `erp.py` (T007–T013) and `bundle.py` (T014–T021) are independent of each other and can proceed in parallel.
+- Row construction (T017) must precede the rollup (T018) and ordering (T020), which read its output.
+- Family derivation (T014, T015) must precede row construction (T017), which uses it to scope populations.
+
+### Parallel Opportunities
+
+- Phase 1: T004, T005, T006 in parallel.
+- Phase 2: the `erp.py` chain and the `bundle.py` chain in parallel; T013, T021, T023, T024 in parallel once their subjects exist.
+- Phase 8: T051, T052, T053 in parallel — different files.
+- US2 and US4 can be worked concurrently with US1 by a second developer, provided `bundle_report.py` edits are sequenced.
+
+---
+
+## Parallel Example: Phase 2
+
+```bash
+# Two independent module chains, one developer each:
+Developer A: T007 → T008 → T009 → T010 → T011 → T012   # caia/erp.py
+Developer B: T014 → T015 → T016 → T017 → T018 → T019 → T020   # caia/bundle.py
+
+# Then the test modules together:
+Task: "tests/test_erp.py — parsing, identity, failures (T013)"
+Task: "tests/test_bundle.py — derivation, invariants, accounting (T021)"
+Task: "tests/test_psirt.py — get_advisory (T023)"
+Task: "headless-property tests for both new modules (T024)"
+```
+
+---
+
+## Implementation Strategy
+
+### MVP First (User Story 1 only)
+
+1. Phase 0 — amend the constitution. ✅ **Done**; it was the gate on everything below.
+2. Phase 1 — green baseline and the offline fixtures.
+3. Phase 2 — `erp.py` and `bundle.py`, both tested and headless. **Blocks everything.**
+4. Phase 3 — User Story 1.
+5. **STOP and VALIDATE**: quickstart Scenarios 1, 2 and 3. Scenario 2 is the safety check.
+6. Demo if ready.
+
+### Incremental Delivery
+
+1. Phase 0 + 1 + 2 → foundation ready.
+2. US1 → the bundle report exists (MVP).
+3. US2 → schedulable.
+4. US3 → existing behaviour provably preserved.
+5. US4 → undetermined devices actionable.
+6. US5 → failures recoverable.
+7. Phase 8 → docs, version, cross-cutting verification.
+
+Each story adds value without breaking the ones before it.
+
+---
+
+## Notes
+
+- **[P]** = different files, no dependencies on incomplete tasks.
+- **[Story]** labels map tasks to spec.md's user stories for traceability.
+- Phase 0 is unusual and deliberate: it is the only phase that happens off this branch.
+- The load-bearing property throughout: a device whose assessment reached no conclusion has **no
+  advisory list at all**, so it can neither be asserted as impacted nor excluded as clean. T017's
+  accounting invariant and T015's FR-027b invariants are what make that mechanical rather than a
+  matter of reviewer vigilance.
+- Commit after each task or logical group; stop at any checkpoint to validate a story independently.
+- Avoid: taking any advisory fact from the bundle page (T011), letting family derivation narrow away
+  a device (T015), and truncating a long row instead of collapsing it (T032).
diff --git a/tests/fixtures/erp_pages.py b/tests/fixtures/erp_pages.py
new file mode 100644
index 0000000..df588c8
--- /dev/null
+++ b/tests/fixtures/erp_pages.py
@@ -0,0 +1,137 @@
+"""Canned bundle-page markup for the bundle-resolution tests.
+
+Mirrors the structure verified against the live ERP-75736 page on 2026-07-28 (HTTP 200,
+181,576 bytes, 0.54 s): 25 advisory identifiers reachable only through the `href` of the
+advisory links in the details table, with `Doc ID`, `First Published` and `Version` carried
+as page text. Hand-authored rather than a raw capture, following the precedent set by
+`tests/fixtures/psirt_responses.py` — the shapes the parser depends on are reproduced
+faithfully without vendoring ~180 KB of Cisco's page into the repository.
+
+The properties these fixtures exist to pin down:
+
+* identifiers live in link targets, **not** in the visible text (`REAL_TITLES` shows what
+  text extraction alone would yield);
+* the same advisory may be linked more than once and must collapse to one;
+* an identifier mentioned only in prose must **not** be treated as in scope;
+* the page displays advisory titles, CVEs, severities and CVSS scores, none of which may be
+  taken from it.
+"""
+
+ADVISORY_BASE = ("https://sec.cloudapps.cisco.com/security/center/content/"
+                 "CiscoSecurityAdvisory/")
+
+# The 25 advisories ERP-75736 publishes, in page order.
+ERP_75736_IDS = (
+    "cisco-sa-onprem-fmc-authbypass-5JPp45V2",
+    "cisco-sa-fmc-rce-NKhnULJh",
+    "cisco-sa-asaftd-vpn-m9sx6MbC",
+    "cisco-sa-asaftd-vpn-dos-SpOFF2Re",
+    "cisco-sa-asa-dos-FCvLD6vR",
+    "cisco-sa-fmc-sql-injection-2qH6CcJd",
+    "cisco-sa-asaftd-ikev2-dos-eBueGdEG",
+    "cisco-sa-asaftd-esp-dos-uv7yD8P5",
+    "cisco-sa-asa-scpcxt-filecpy-rgeP73nE",
+    "cisco-sa-asaftd-ospf-ZH8PhbSW",
+    "cisco-sa-ftd-dnd-dos-bpEcg7B7",
+    "cisco-sa-ftd-cmd-inj-mTzGZexf",
+    "cisco-sa-asaftd-saml-LktTrwZP",
+    "cisco-sa-asaftd-webvpn-xss-uwjc4HR",
+    "cisco-sa-asaftd-luainject-VescqgmS",
+    "cisco-sa-fmc-cmd-inject-S9ZM4EJf",
+    "cisco-sa-ftdfmc-dir-trav-wERgjhWq",
+    "cisco-sa-asaftd-aclbypass-dos-CVxVRSvQ",
+    "cisco-sa-ftd-snort3ssl-FBEKYXpH",
+    "cisco-sa-ftd-snort-bypass-rLggKzVF",
+    "cisco-sa-ftd-tcp-dos-rHfqnwRg",
+    "cisco-sa-snort3-multi-dos-XFWkWSwz",
+    "cisco-sa-ftd-snort3-vbavuls-96UcVVed",
+    "cisco-sa-asa-ssh-keybypass-cr5xPUSf",
+    "cisco-sa-asaftd-desync-n5AVzEQw",
+)
+
+BUNDLE_TITLE = ("Cisco Event Response: March 2026 Cisco Secure Firewall ASA, Secure FMC, "
+                "and Secure FTD Software Security Advisory Bundled Publication")
+
+# What the page shows as link text: titles, never identifiers.
+REAL_TITLES = (
+    "Cisco Secure Firewall Management Center Software Authentication Bypass Vulnerability",
+    "Cisco Secure Firewall Management Center Software Remote Code Execution Vulnerability",
+)
+
+
+def _row(advisory_id, index):
+    """One details-table row: the identifier appears only in the link target."""
+    title = (REAL_TITLES[index] if index < len(REAL_TITLES)
+             else f"Cisco Secure Firewall Vulnerability {index + 1}")
+    return (
+        "<tr>"
+        f'<td><a href="{ADVISORY_BASE}{advisory_id}">{title}</a></td>'
+        f"<td>CVE-2026-{20000 + index}</td>"
+        "<td>Critical</td>"
+        "<td>10</td>"
+        "</tr>"
+    )
+
+
+def page(advisory_ids=ERP_75736_IDS, doc_id="ERP-75736", title=BUNDLE_TITLE,
+         published="2026 March 4 16:00 GMT", version="1.0", prose_extra=None,
+         duplicate_rows=False):
+    """A bundle page. Every knob exists to drive one specific test."""
+    rows = "".join(_row(a, i) for i, a in enumerate(advisory_ids))
+    if duplicate_rows:
+        # The live page links each advisory once in raw markup, but a revision could link
+        # the same advisory twice; it must still yield one entry.
+        rows += "".join(_row(a, i) for i, a in enumerate(advisory_ids))
+
+    # An identifier in prose only, never in an href. Must NOT widen the bundle's scope.
+    prose = ""
+    if prose_extra:
+        prose = (f"<p>This publication supersedes the earlier advisory {prose_extra}, "
+                 f"which is documented at CiscoSecurityAdvisory/{prose_extra} "
+                 "and is not part of this bundle.</p>")
+
+    return f"""<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8"><title>{title}</title>
+<style>.x {{ color: red; }}</style>
+<script>var pageData = {{ id: "{doc_id}" }};</script>
+</head><body>
+<div class="breadcrumb">Home / Cisco Security / Event Responses</div>
+<h1>Cisco Event Response Page</h1>
+<h2>{title}</h2>
+<div class="docinfo">
+  <p>Doc ID: {doc_id}</p>
+  <p>First Published: {published}</p>
+  <p>Version: {version}</p>
+</div>
+<h3>Summary</h3>
+<p>The March 4, 2026, release of the Cisco Secure Firewall ASA, Secure FMC, and Secure FTD
+Software Security Advisory Bundled Publication includes {len(advisory_ids)} Cisco Security
+Advisories.</p>
+{prose}
+<h3>Details</h3>
+<table><thead><tr><th>Cisco Security Advisory</th><th>CVE ID</th>
+<th>Security Impact Rating</th><th>CVSS Base Score</th></tr></thead>
+<tbody>{rows}</tbody></table>
+<h3>Related Resources</h3>
+<ul><li><a href="https://sec.cloudapps.cisco.com/security/center/resources/security_vulnerability_policy.html">Cisco Security Vulnerability Policy</a></li></ul>
+</body></html>
+"""
+
+
+# A page whose title and link text carry hostile markup, and which mentions an advisory in
+# prose only. Proves escaping (FR-012) and that prose never widens scope (FR-006).
+HOSTILE_TITLE = '<script>alert(1)</script>"><img src=x onerror=alert(2)>'
+
+
+def hostile_page():
+    body = page(advisory_ids=ERP_75736_IDS[:3], title=HOSTILE_TITLE,
+                prose_extra="cisco-sa-not-in-this-bundle-XXXXXXXX")
+    # A javascript: link alongside the real advisory links.
+    return body.replace(
+        "<h3>Related Resources</h3>",
+        '<p><a href="javascript:alert(3)">click</a></p><h3>Related Resources</h3>')
+
+
+def no_advisories_page():
+    """Reachable, well-formed, but links no advisory — must be an error, not an empty scope."""
+    return page(advisory_ids=())
diff --git a/tests/test_bundle.py b/tests/test_bundle.py
new file mode 100644
index 0000000..ff03e97
--- /dev/null
+++ b/tests/test_bundle.py
@@ -0,0 +1,294 @@
+"""Tests for per-advisory aggregation (spec 008). Pure — no network, no credentials.
+
+The accounting invariant and the FR-027b invariants are the point of this module. They turn
+Principle IV from a reviewer's judgement into arithmetic a test can check, so a device
+silently dropped from a row fails here rather than rendering as clean.
+"""
+
+from __future__ import annotations
+
+import io
+import unittest
+from contextlib import redirect_stderr, redirect_stdout
+
+from caia import bundle as b
+from caia import matching as m
+
+
+def advisory(advisory_id, sir="Critical", cvss="10.0", cves=None, products=None,
+             fixes=("7.4.4",), published="2026-03-04T16:00:00"):
+    return {
+        "advisoryId": advisory_id,
+        "advisoryTitle": f"Title for {advisory_id}",
+        "sir": sir,
+        "cvssBaseScore": cvss,
+        "cves": list(cves or ["CVE-2026-20079"]),
+        "firstPublished": published,
+        "publicationUrl": f"https://sec.cloudapps.cisco.com/{advisory_id}",
+        "productNames": list(products or []),
+        "platforms": [{"name": "Appliances",
+                       "firstFixes": [{"name": f} for f in fixes]}],
+    }
+
+
+def device(name, family, verdict=m.IMPACTED, advisories=(), version="7.4.2.3",
+           model="Secure FMC 4600", reason=None):
+    return {"name": name, "model": model, "family": family, "version": version,
+            "verdict": verdict, "reason": reason, "advisories": list(advisories)}
+
+
+FMC_ADV = "cisco-sa-onprem-fmc-authbypass-5JPp45V2"
+ASA_ADV = "cisco-sa-asa-dos-FCvLD6vR"
+BOTH_ADV = "cisco-sa-asaftd-ikev2-dos-eBueGdEG"
+
+
+def fleet():
+    """3 FMC (impacted), 2 ASA (1 impacted by BOTH, 1 clean), 2 ASA undetermined."""
+    fmc = [device(f"fmc-{i}", "FMC", advisories=[advisory(FMC_ADV, products=[
+        "Cisco Secure Firewall Management Center (FMC) 7.4.2.3"])]) for i in range(3)]
+    asa_hit = device("asa-hit", "ASA", advisories=[advisory(BOTH_ADV, products=[
+        "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.18.4.24",
+        "Cisco Secure Firewall Threat Defense (FTD) Software 7.4.2.3"])],
+        version="9.18(4)24", model="ASA 5555")
+    asa_clean = device("asa-clean", "ASA", verdict=m.NOT_IMPACTED,
+                       version="9.16(4)67", model="ASA 5506")
+    undet = [device(f"asa-und-{i}", "ASA", verdict=m.NEEDS_REVIEW,
+                    reason=m.Reason(m.RELEASE_UNKNOWN, release="9.12.4.67",
+                                    raw_release="9.12(4)67"),
+                    version="9.12(4)67", model="ASA 5515") for i in range(2)]
+    return fmc + [asa_hit, asa_clean] + undet
+
+
+class FamilyDerivation(unittest.TestCase):
+    def test_families_from_cisco_answers_alone(self):
+        devices = fleet()
+        index = b.index_advisories(devices)
+        self.assertEqual(index[FMC_ADV]["families"], {"fmc"})
+        self.assertEqual(index[BOTH_ADV]["families"], {"asa"})
+
+    def test_families_named_in_product_list(self):
+        record = advisory("x", products=[
+            "Cisco Secure Firewall Management Center (FMC) 7.4.2.3",
+            "Cisco Secure Firewall Threat Defense (FTD) Software 7.4.0"])
+        self.assertEqual(b.families_named(record), {"fmc", "ftd"})
+
+    def test_non_firewall_products_are_ignored(self):
+        """Cisco lists products the inventory has no family for; they must not appear."""
+        record = advisory("x", products=["Cisco Cyber Vision ",
+                                         "Cisco UTD SNORT IPS Engine Software ",
+                                         "Cisco Secure Firewall Threat Defense (FTD) 7.4.0"])
+        self.assertEqual(b.families_named(record), {"ftd"})
+
+    def test_union_of_both_sources(self):
+        """A family with no impacted device in *this* inventory still widens the population."""
+        devices = fleet()
+        index = b.index_advisories(devices)
+        families = b.covered_families(BOTH_ADV, index, None, devices)
+        self.assertIn("asa", families)   # from Cisco's answer
+        self.assertIn("ftd", families)   # from productNames only
+
+    def test_fails_open_when_neither_source_yields_a_family(self):
+        """An unknown advisory covers every queryable family, so nothing is omitted."""
+        devices = fleet()
+        families = b.covered_families("cisco-sa-unknown", b.index_advisories(devices),
+                                      None, devices)
+        self.assertEqual(families, b.queryable_families(devices))
+        self.assertTrue(families)
+
+    def test_record_supplied_separately_narrows_a_zero_impact_advisory(self):
+        devices = fleet()
+        records = {ASA_ADV: advisory(ASA_ADV, products=[
+            "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.4.14"])}
+        families = b.covered_families(ASA_ADV, b.index_advisories(devices), records, devices)
+        self.assertEqual(families, {"asa"})
+
+
+class Fr027bInvariants(unittest.TestCase):
+    """Family scoping may only narrow which rows an *undetermined* device appears in."""
+
+    def test_never_excludes_a_device_cisco_listed_as_impacted(self):
+        devices = fleet()
+        # Force a derivation that would wrongly exclude the impacted ASA device.
+        row = b.build_row(BOTH_ADV, devices)
+        self.assertIn("asa", row.families)
+        names = {d["name"] for d in row.impacted}
+        self.assertIn("asa-hit", names)
+
+    def test_widening_restores_an_impacted_device_a_bad_derivation_would_drop(self):
+        devices = fleet()
+        widened = b._widen_for_impacted(BOTH_ADV, {"fmc"}, devices)
+        self.assertIn("asa", widened)
+
+    def test_never_manufactures_an_unaffected_device(self):
+        """Unaffected comes from the device's own assessment, never from the family set."""
+        devices = fleet()
+        for row in b.build_rows([FMC_ADV, ASA_ADV, BOTH_ADV], devices):
+            for d in row.unaffected:
+                self.assertNotEqual(d["verdict"], m.NEEDS_REVIEW)
+                self.assertNotIn(row.advisory_id, b.advisory_ids_of(d))
+
+    def test_undetermined_devices_are_never_in_impacted_or_unaffected(self):
+        devices = fleet()
+        for row in b.build_rows([FMC_ADV, ASA_ADV, BOTH_ADV], devices):
+            for d in row.undetermined:
+                self.assertNotIn(d, row.impacted)
+                self.assertNotIn(d, row.unaffected)
+
+
+class RowAccounting(unittest.TestCase):
+    def test_invariant_holds_for_every_row(self):
+        devices = fleet()
+        rows = b.build_rows([FMC_ADV, ASA_ADV, BOTH_ADV, "cisco-sa-unknown"], devices)
+        for row in rows:
+            self.assertTrue(row.accounts(),
+                            f"{row.advisory_id}: {len(row.impacted)}+"
+                            f"{len(row.unaffected)}+{len(row.undetermined)} != "
+                            f"{len(row.population)}")
+
+    def test_population_is_scoped_to_covered_families(self):
+        devices = fleet()
+        row = b.build_row(FMC_ADV, devices)
+        self.assertEqual(row.families, ("fmc",))
+        self.assertEqual(len(row.population), 3)
+        self.assertEqual(len(row.undetermined), 0,
+                         "ASA devices must not appear on an FMC-only row")
+
+    def test_undetermined_devices_reach_rows_that_cover_their_family(self):
+        devices = fleet()
+        row = b.build_row(BOTH_ADV, devices)
+        self.assertEqual(len(row.undetermined), 2)
+
+    def test_zero_impact_row_still_has_a_population(self):
+        devices = fleet()
+        records = {ASA_ADV: advisory(ASA_ADV, products=[
+            "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.4.14"])}
+        row = b.build_row(ASA_ADV, devices, records=records)
+        self.assertEqual(len(row.impacted), 0)
+        self.assertEqual(len(row.population), 4)   # 2 ASA + 2 undetermined ASA
+        self.assertEqual(len(row.undetermined), 2)
+        self.assertTrue(row.accounts())
+
+    def test_a_device_impacted_by_another_advisory_is_unaffected_here(self):
+        devices = fleet()
+        row = b.build_row(ASA_ADV, devices,
+                          records={ASA_ADV: advisory(ASA_ADV, products=[
+                              "Cisco Secure Firewall Adaptive Security Appliance (ASA) x"])})
+        self.assertIn("asa-hit", {d["name"] for d in row.unaffected})
+
+
+class ReleaseRollup(unittest.TestCase):
+    def test_groups_impacted_devices_by_release(self):
+        devices = [device("a", "FMC", advisories=[advisory(FMC_ADV)], version="7.4.2.3"),
+                   device("b", "FMC", advisories=[advisory(FMC_ADV)], version="7.4.2.3"),
+                   device("c", "FMC", advisories=[advisory(FMC_ADV)], version="7.4.2.4")]
+        row = b.build_row(FMC_ADV, devices)
+        rollup = row.release_rollup()
+        self.assertEqual([r for r, _, _ in rollup], ["7.4.2.3", "7.4.2.4"])
+        self.assertEqual([len(v) for _, v, _ in rollup], [2, 1])
+        self.assertEqual(len(row.impacted), 3)
+
+    def test_first_fix_absent_is_empty_never_inferred(self):
+        devices = [device("a", "FMC", advisories=[advisory(FMC_ADV, fixes=())])]
+        self.assertEqual(b.build_row(FMC_ADV, devices).first_fix(), "")
+
+    def test_fix_is_per_device_not_per_row(self):
+        """Cisco answers per release, so two devices in one row can differ (FR-023)."""
+        devices = [
+            device("old", "FMC", advisories=[advisory(FMC_ADV, fixes=("7.4.4",))],
+                   version="7.4.2.3"),
+            device("new", "FMC", advisories=[advisory(FMC_ADV, fixes=("7.6.2",))],
+                   version="7.6.0"),
+        ]
+        row = b.build_row(FMC_ADV, devices)
+        self.assertEqual(row.fix_for(devices[0]), "7.4.4")
+        self.assertEqual(row.fix_for(devices[1]), "7.6.2")
+        self.assertEqual(row.fixes(), ["7.4.4", "7.6.2"])
+        # No single fix may be claimed for the row when its devices disagree.
+        self.assertEqual(row.first_fix(), "")
+        rollup = row.release_rollup()
+        self.assertEqual([(r, f) for r, _, f in rollup],
+                         [("7.4.2.3", "7.4.4"), ("7.6.0", "7.6.2")])
+
+    def test_shared_fix_is_reported_once(self):
+        devices = [device(n, "FMC", advisories=[advisory(FMC_ADV, fixes=("7.4.4",))],
+                          version=v)
+                   for n, v in (("a", "7.4.2.3"), ("b", "7.4.2.4"))]
+        row = b.build_row(FMC_ADV, devices)
+        self.assertEqual(row.first_fix(), "7.4.4")
+        self.assertEqual(row.fixes(), ["7.4.4"])
+
+
+class Ordering(unittest.TestCase):
+    def test_severity_then_reach_then_identifier(self):
+        devices = [
+            device("a", "FMC", advisories=[advisory("cisco-sa-med", sir="Medium")]),
+            device("b", "FMC", advisories=[advisory("cisco-sa-crit-1", sir="Critical")]),
+            device("c", "FMC", advisories=[advisory("cisco-sa-crit-2", sir="Critical")]),
+            device("d", "FMC", advisories=[advisory("cisco-sa-crit-2", sir="Critical")]),
+        ]
+        rows = b.build_rows(["cisco-sa-med", "cisco-sa-crit-1", "cisco-sa-crit-2"], devices)
+        self.assertEqual([r.advisory_id for r in rows],
+                         ["cisco-sa-crit-2", "cisco-sa-crit-1", "cisco-sa-med"])
+
+    def test_order_is_stable_across_shuffled_input(self):
+        devices = fleet()
+        ids = [FMC_ADV, ASA_ADV, BOTH_ADV, "cisco-sa-unknown"]
+        first = [r.advisory_id for r in b.build_rows(ids, devices)]
+        second = [r.advisory_id for r in b.build_rows(list(reversed(ids)), devices)]
+        self.assertEqual(first, second)
+
+    def test_unknown_severity_sorts_last(self):
+        devices = [device("a", "FMC", advisories=[advisory("cisco-sa-x", sir="")])]
+        rows = b.build_rows(["cisco-sa-x", "cisco-sa-y"], devices)
+        self.assertEqual(rows[0].advisory_id, "cisco-sa-x")
+
+
+class BundleScope(unittest.TestCase):
+    def test_one_row_per_bundle_advisory_including_zero_impact(self):
+        devices = fleet()
+        rows = b.build_rows([FMC_ADV, ASA_ADV, BOTH_ADV], devices)
+        self.assertEqual(len(rows), 3)
+        self.assertEqual({r.advisory_id for r in rows}, {FMC_ADV, ASA_ADV, BOTH_ADV})
+
+    def test_advisories_outside_the_bundle_are_never_added(self):
+        devices = fleet()
+        rows = b.build_rows([FMC_ADV], devices)
+        self.assertEqual([r.advisory_id for r in rows], [FMC_ADV])
+
+    def test_suppressed_count_reports_out_of_bundle_findings(self):
+        devices = fleet()
+        self.assertEqual(b.suppressed_count([FMC_ADV], devices), 1)   # BOTH_ADV
+        self.assertEqual(b.suppressed_count([FMC_ADV, BOTH_ADV], devices), 0)
+
+    def test_missing_records_lists_only_advisories_no_device_answered_for(self):
+        devices = fleet()
+        self.assertEqual(b.missing_records([FMC_ADV, ASA_ADV, BOTH_ADV], devices),
+                         [ASA_ADV])
+
+    def test_run_totals(self):
+        totals = b.run_totals([FMC_ADV], fleet(), questions_asked=7)
+        self.assertEqual(totals["devices_assessed"], 7)
+        self.assertEqual(totals["devices_undetermined"], 2)
+        self.assertEqual(totals["questions_asked"], 7)
+        self.assertEqual(totals["suppressed_advisories"], 1)
+
+
+class HeadlessProperty(unittest.TestCase):
+    def test_prints_nothing_and_does_not_exit(self):
+        out, err = io.StringIO(), io.StringIO()
+        devices = fleet()
+        with redirect_stdout(out), redirect_stderr(err):
+            b.build_rows([FMC_ADV, ASA_ADV, BOTH_ADV], devices)
+            b.run_totals([FMC_ADV], devices)
+        self.assertEqual(out.getvalue(), "")
+        self.assertEqual(err.getvalue(), "")
+
+    def test_does_not_mutate_the_callers_devices(self):
+        devices = fleet()
+        before = [dict(d) for d in devices]
+        b.build_rows([FMC_ADV, ASA_ADV, BOTH_ADV, "cisco-sa-unknown"], devices)
+        self.assertEqual([dict(d) for d in devices], before)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()
diff --git a/tests/test_bundle_flow.py b/tests/test_bundle_flow.py
new file mode 100644
index 0000000..524cf45
--- /dev/null
+++ b/tests/test_bundle_flow.py
@@ -0,0 +1,318 @@
+"""End-to-end tests for the bundle-scoped run (spec 008). No network, no credentials.
+
+Reuses the run harness from `test_api_flow`, so the only thing varying is the bundle scope.
+`erp.fetch` is patched rather than `erp.resolve`, which keeps the real page parsing in the
+path being tested.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import io
+import types
+import unittest
+from unittest import mock
+
+from caia import analyzer
+from caia import erp
+from caia import matching as m
+from tests.fixtures import erp_pages as epx
+from tests.fixtures import psirt_responses as fx
+from tests.test_api_flow import FakeClient, _ApiRunBase
+
+# The advisory identifiers the FakeClient returns for every impacted device.
+FIXTURE_IDS = ("cisco-sa-fixture-00", "cisco-sa-fixture-01")
+
+
+class BundleClient(FakeClient):
+    """Adds the per-advisory lookup a bundle run needs for its clean advisories."""
+
+    def __init__(self, *args, advisory_records=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.advisory_lookups = []
+        self._records = advisory_records or {}
+
+    def get_advisory(self, advisory_id):
+        self.advisory_lookups.append(advisory_id)
+        self.request_count += 1
+        return self._records.get(advisory_id)
+
+
+def bundle_page(advisory_ids=FIXTURE_IDS, **kwargs):
+    return epx.page(advisory_ids=advisory_ids, **kwargs)
+
+
+class _BundleRunBase(_ApiRunBase):
+    """Harness that can scope a run to a bundle, interactively or by flag."""
+
+    def _args(self, **over):
+        base = dict(inventory=str(self.inv_path), sheet="FW_List",
+                    output_dir=str(self.outdir), no_update_check=True, yes=True,
+                    erp=None)
+        base.update(over)
+        return types.SimpleNamespace(**base)
+
+    @contextlib.contextmanager
+    def _run_bundle(self, client=None, page=None, fetch_error=None, fetch_pages=None,
+                    answers=None, interactive=False, creds=("id", "secret"), **over):
+        """Run with the bundle page stubbed at the `fetch` boundary.
+
+        `fetch_error` must be an `ErpError` — the real `fetch` is what translates a transport
+        failure into one, and that translation is covered in `test_erp`. `fetch_pages` gives
+        a per-call sequence, where an entry may be an exception to raise.
+        """
+        client = client or BundleClient()
+        buf = io.StringIO()
+        fetched = []
+        sequence = list(fetch_pages or [])
+
+        def fake_fetch(url, timeout=None, opener=None):
+            fetched.append(url)
+            if sequence:
+                item = sequence.pop(0)
+                if isinstance(item, Exception):
+                    raise item
+                return item
+            if fetch_error is not None:
+                raise fetch_error
+            return bundle_page() if page is None else page
+
+        prompts = list(answers or [])
+
+        def fake_ask(label, default=None):
+            return prompts.pop(0) if prompts else ""
+
+        with mock.patch.object(analyzer.psirt, "Client", return_value=client), \
+             mock.patch.object(analyzer.erp, "fetch", side_effect=fake_fetch), \
+             mock.patch.object(analyzer.ui, "ask", side_effect=fake_ask), \
+             mock.patch.object(analyzer.config, "resolve",
+                               side_effect=lambda key, *a, **k: {
+                                   analyzer.config.CISCO_CLIENT_ID: creds[0],
+                                   analyzer.config.CISCO_CLIENT_SECRET: creds[1],
+                               }.get(key, "")), \
+             mock.patch.object(analyzer.config, "load_local_env"), \
+             mock.patch("sys.stdin.isatty", return_value=interactive), \
+             contextlib.redirect_stdout(buf):
+            try:
+                code = analyzer.run(self._args(**over))
+            except SystemExit as exc:
+                code = exc.code
+            yield code, buf.getvalue(), client, fetched
+
+    def _bundle_report_text(self):
+        reports = sorted(self.outdir.glob("impact_report_ERP-*.html"))
+        self.assertTrue(reports, "no bundle report was written")
+        return reports[-1].read_text(encoding="utf-8")
+
+
+class Us1InteractiveBundle(_BundleRunBase):
+    """US1 — paste a bundle URL, get one row per advisory in it."""
+
+    def test_pasting_a_bundle_url_writes_a_bundle_report(self):
+        with self._run_bundle(interactive=True,
+                              answers=[erp.PAGE_URL % "ERP-75736"]) as (code, out, _c, _f):
+            self.assertEqual(code, 0)
+            self.assertIn("ERP-75736", out)
+        text = self._bundle_report_text()
+        self.assertIn("bundle ERP-75736", text)
+
+    def test_announces_the_bundle_before_asking_cisco(self):
+        """A wrong link must be caught before the run spends anything (FR-009)."""
+        with self._run_bundle(interactive=True,
+                              answers=["ERP-75736"]) as (code, out, _c, _f):
+            self.assertEqual(code, 0)
+            announce = out.index("2 advisories")
+            first_check = out.index("distinct checks")
+            self.assertLess(announce, first_check)
+
+    def test_one_row_per_bundle_advisory(self):
+        with self._run_bundle(interactive=True, answers=["ERP-75736"]):
+            pass
+        text = self._bundle_report_text()
+        self.assertEqual(text.count("<tr data-severity="), len(FIXTURE_IDS))
+        for advisory_id in FIXTURE_IDS:
+            self.assertIn(advisory_id, text)
+
+    def test_bundle_advisory_that_impacts_nothing_gets_a_row_and_one_lookup(self):
+        extra = "cisco-sa-fixture-99"
+        page = bundle_page(advisory_ids=FIXTURE_IDS + (extra,))
+        records = {extra: fx.advisory(advisory_id=extra)}
+        client = BundleClient(advisory_records=records)
+        with self._run_bundle(client=client, page=page, interactive=True,
+                              answers=["ERP-75736"]) as (code, _out, c, _f):
+            self.assertEqual(code, 0)
+            self.assertEqual(c.advisory_lookups, [extra])
+        text = self._bundle_report_text()
+        self.assertEqual(text.count("<tr data-severity="), 3)
+        self.assertIn(extra, text)
+        self.assertIn("No inventory device is impacted.", text)
+
+    def test_undetermined_devices_appear_and_are_never_unaffected(self):
+        with self._run_bundle(interactive=True, answers=["ERP-75736"]):
+            pass
+        text = self._bundle_report_text()
+        self.assertIn("undetermined", text)
+        self.assertIn("not counted as unaffected", text)
+        self.assertIn("could not be assessed", text)
+        # The needs-review fixture devices are named in the report.
+        self.assertIn("FW-RELUNKNOWN", text)
+
+    def test_report_states_it_is_bundle_scoped_and_what_was_suppressed(self):
+        with self._run_bundle(interactive=True, answers=["ERP-75736"]):
+            pass
+        text = self._bundle_report_text()
+        self.assertIn("scoped to one bundle", text)
+        self.assertIn("not a whole-fleet assessment", text.lower())
+
+    def test_filename_distinguishes_the_layout(self):
+        with self._run_bundle(interactive=True, answers=["ERP-75736"]):
+            pass
+        names = [p.name for p in self.outdir.glob("*.html")]
+        self.assertTrue(any(n.startswith("impact_report_ERP-75736_") for n in names), names)
+
+
+class Us2Unattended(_BundleRunBase):
+    """US2 — supply the bundle up front; never prompt; act on the exit code."""
+
+    def test_erp_flag_suppresses_the_prompt(self):
+        asked = []
+
+        def fake_ask(label, default=None):  # pragma: no cover - must not be called
+            asked.append(label)
+            return ""
+
+        with mock.patch.object(analyzer.ui, "ask", side_effect=fake_ask):
+            with self._run_bundle(interactive=True, erp="ERP-75736") as (code, _o, _c, _f):
+                self.assertEqual(code, 0)
+        self.assertEqual(asked, [])
+
+    def test_non_interactive_with_flag_writes_the_bundle_report(self):
+        with self._run_bundle(interactive=False, erp="ERP-75736") as (code, _o, _c, _f):
+            self.assertEqual(code, 0)
+        self.assertIn("bundle ERP-75736", self._bundle_report_text())
+
+    def test_bad_value_exits_2_and_makes_no_request(self):
+        with self._run_bundle(interactive=False,
+                              erp="https://example.invalid/x") as (code, _o, _c, fetched):
+            self.assertEqual(code, 2)
+            self.assertEqual(fetched, [])
+        self.assertEqual(list(self.outdir.glob("*.html")), [])
+
+    def test_unreachable_exits_1_and_writes_no_report(self):
+        unreachable = erp.ErpUnreachableError(
+            "Cisco's Security Center could not be reached (URLError). This is a "
+            "connectivity problem, not an invalid bundle link.")
+        with self._run_bundle(interactive=False, erp="ERP-75736",
+                              fetch_error=unreachable) as (code, out, _c, _f):
+            self.assertEqual(code, 1)
+            self.assertIn("connectivity", out.lower())
+        self.assertEqual(list(self.outdir.glob("*.html")), [])
+
+    def test_no_advisories_exits_1_and_writes_no_report(self):
+        with self._run_bundle(interactive=False, erp="ERP-75736",
+                              page=epx.no_advisories_page()) as (code, out, _c, _f):
+            self.assertEqual(code, 1)
+            self.assertIn("No advisories could be identified", out)
+        self.assertEqual(list(self.outdir.glob("*.html")), [])
+
+    def test_bundle_mismatch_exits_1_and_writes_no_report(self):
+        page = bundle_page(doc_id="ERP-99999")
+        with self._run_bundle(interactive=False, erp="ERP-75736",
+                              page=page) as (code, out, _c, _f):
+            self.assertEqual(code, 1)
+            self.assertIn("ERP-99999", out)
+        self.assertEqual(list(self.outdir.glob("*.html")), [])
+
+    def test_non_interactive_without_a_bundle_never_prompts(self):
+        asked = []
+
+        def fake_ask(label, default=None):  # pragma: no cover - must not be called
+            asked.append(label)
+            return ""
+
+        with mock.patch.object(analyzer.ui, "ask", side_effect=fake_ask):
+            with self._run_bundle(interactive=False, erp=None) as (code, _o, _c, fetched):
+                self.assertEqual(code, 0)
+                self.assertEqual(fetched, [])
+        self.assertEqual(asked, [])
+
+
+class Us3DeclineKeepsTodaysReport(_BundleRunBase):
+    """US3 — bundle scoping is an addition, not a tax."""
+
+    def test_declining_produces_the_whole_fleet_report(self):
+        with self._run_bundle(interactive=True, answers=[""]) as (code, _o, _c, fetched):
+            self.assertEqual(code, 0)
+            self.assertEqual(fetched, [], "no bundle page may be fetched when declined")
+        reports = sorted(self.outdir.glob("impact_report_*.html"))
+        self.assertEqual(len(reports), 1)
+        text = reports[0].read_text(encoding="utf-8")
+        self.assertIn("<tr data-verdict=", text)          # the per-device layout
+        self.assertNotIn("<tr data-severity=", text)
+        self.assertNotIn("ERP-", reports[0].name)
+
+    def test_declining_keeps_the_pre_change_verdicts(self):
+        with self._run_bundle(interactive=True, answers=[""]):
+            pass
+        text = sorted(self.outdir.glob("impact_report_*.html"))[0].read_text("utf-8")
+        for verdict in (m.IMPACTED, m.NOT_IMPACTED, m.NEEDS_REVIEW):
+            self.assertIn(verdict, text)
+
+    def test_declining_exits_zero(self):
+        with self._run_bundle(interactive=True, answers=[""]) as (code, _o, _c, _f):
+            self.assertEqual(code, 0)
+
+
+class Us5Recovery(_BundleRunBase):
+    """US5 — a bad link is recoverable and never silently produces an empty report."""
+
+    def test_bad_address_is_reported_and_reprompts(self):
+        with self._run_bundle(interactive=True,
+                              answers=["nonsense", "ERP-75736"]) as (code, out, _c, fetched):
+            self.assertEqual(code, 0)
+            self.assertIn("not a Cisco Event Response address", out)
+            self.assertEqual(len(fetched), 1, "the rejected value must not be fetched")
+        self.assertIn("bundle ERP-75736", self._bundle_report_text())
+
+    def test_connectivity_failure_is_named_as_such_then_recovered(self):
+        unreachable = erp.ErpUnreachableError(
+            "Cisco's Security Center could not be reached (URLError). This is a "
+            "connectivity problem, not an invalid bundle link.")
+        with self._run_bundle(interactive=True,
+                              fetch_pages=[unreachable, bundle_page()],
+                              answers=["ERP-75736", "ERP-75736"]) as (code, out, _c, f):
+            self.assertEqual(code, 0)
+            self.assertIn("connectivity", out.lower())
+            self.assertEqual(len(f), 2, "the second attempt must be made")
+        self.assertIn("bundle ERP-75736", self._bundle_report_text())
+
+    def test_declining_after_a_failure_falls_back_to_the_whole_fleet_report(self):
+        with self._run_bundle(interactive=True, answers=["nonsense", ""],
+                              ) as (code, out, _c, _f):
+            self.assertEqual(code, 0)
+        reports = sorted(self.outdir.glob("impact_report_*.html"))
+        self.assertEqual(len(reports), 1)
+        self.assertNotIn("ERP-", reports[0].name)
+
+    def test_a_page_yielding_no_advisories_never_becomes_an_empty_report(self):
+        with self._run_bundle(interactive=True, page=epx.no_advisories_page(),
+                              answers=["ERP-75736", ""]) as (code, out, _c, _f):
+            self.assertEqual(code, 0)
+            self.assertIn("No advisories could be identified", out)
+        # Fell back to the whole-fleet report rather than writing an empty bundle report.
+        self.assertEqual(list(self.outdir.glob("impact_report_ERP-*.html")), [])
+
+
+class PartialRuns(_BundleRunBase):
+    def test_a_partial_run_still_writes_a_bundle_report_and_says_so(self):
+        client = BundleClient(fail_after=1)
+        with self._run_bundle(client=client, interactive=False,
+                              erp="ERP-75736") as (code, out, _c, _f):
+            self.assertEqual(code, 0)
+        text = self._bundle_report_text()
+        self.assertIn("This run was partial", text)
+        self.assertIn("not known to be unaffected", text)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()
diff --git a/tests/test_bundle_report.py b/tests/test_bundle_report.py
new file mode 100644
index 0000000..72f6c47
--- /dev/null
+++ b/tests/test_bundle_report.py
@@ -0,0 +1,308 @@
+"""Tests for the bundle-scoped HTML report (spec 008). No network access.
+
+The undetermined-rendering tests are the ones that matter most. A row reading "0 impacted"
+without its undetermined devices is this feature's worst failure mode: it reads as an
+all-clear for devices nobody assessed.
+"""
+
+from __future__ import annotations
+
+import re
+import tempfile
+import unittest
+from pathlib import Path
+
+from caia import bundle as b
+from caia import bundle_report as br
+from caia import erp
+from caia import matching as m
+from tests.fixtures import erp_pages as fx
+from tests.test_bundle import ASA_ADV, BOTH_ADV, FMC_ADV, advisory, device, fleet
+
+
+def a_bundle(advisory_ids=(FMC_ADV, ASA_ADV, BOTH_ADV), title=fx.BUNDLE_TITLE):
+    return erp.Bundle(bundle_id="ERP-75736", title=title,
+                      published="2026 March 4 16:00 GMT", version="1.0",
+                      url=erp.PAGE_URL % "ERP-75736", advisory_ids=advisory_ids)
+
+
+def rendered(devices=None, bundle=None, records=None, questions_asked=32,
+             partial_cause=None):
+    devices = fleet() if devices is None else devices
+    bundle = bundle or a_bundle()
+    records = records if records is not None else {
+        ASA_ADV: advisory(ASA_ADV, sir="High", products=[
+            "Cisco Secure Firewall Adaptive Security Appliance (ASA) Software 9.20.4.14"])}
+    rows = b.build_rows(bundle.advisory_ids, devices, records=records)
+    totals = b.run_totals(bundle.advisory_ids, devices,
+                          questions_asked=questions_asked, partial_cause=partial_cause)
+    return br.render(bundle, rows, devices, totals,
+                     generated_at=None, inventory_file="inventory.xlsx"), rows
+
+
+class Structure(unittest.TestCase):
+    def test_one_row_per_bundle_advisory(self):
+        html, rows = rendered()
+        self.assertEqual(len(rows), 3)
+        self.assertEqual(html.count('<tr data-severity='), 3)
+
+    def test_row_count_matches_a_full_bundle(self):
+        bundle = a_bundle(advisory_ids=fx.ERP_75736_IDS)
+        html, rows = rendered(bundle=bundle, records={})
+        self.assertEqual(len(rows), 25)
+        self.assertEqual(html.count('<tr data-severity='), 25)
+        for advisory_id in fx.ERP_75736_IDS:
+            self.assertIn(advisory_id, html)
+
+    def test_identifies_the_bundle_and_says_it_is_bundle_scoped(self):
+        html, _ = rendered()
+        self.assertIn("ERP-75736", html)
+        self.assertIn("scoped to one bundle", html)
+        self.assertIn("2026 March 4 16:00 GMT", html)
+        self.assertIn(erp.PAGE_URL % "ERP-75736", html)
+
+    def test_states_run_totals_independently_of_any_row(self):
+        html, _ = rendered()
+        self.assertIn("Devices assessed", html)
+        self.assertIn("Undetermined", html)
+        self.assertIn("Questions asked", html)
+
+    def test_reports_suppressed_out_of_bundle_advisories(self):
+        html, _ = rendered(bundle=a_bundle(advisory_ids=(FMC_ADV,)))
+        self.assertRegex(html, r"1 further advisory")
+        self.assertIn("not a whole-fleet assessment", html.lower())
+
+    def test_records_the_resolved_scope(self):
+        html, _ = rendered()
+        self.assertIn("Resolved scope", html)
+
+    def test_advisory_published_date_is_shown(self):
+        html, _ = rendered()
+        self.assertIn("2026-03-04T16:00:00", html)
+
+    def test_partial_run_is_stated(self):
+        html, _ = rendered(partial_cause="Cisco became unreachable part-way through.")
+        self.assertIn("This run was partial", html)
+        self.assertIn("Cisco became unreachable part-way through.", html)
+        self.assertIn("not known to be unaffected", html)
+
+
+class Accounting(unittest.TestCase):
+    def test_every_row_states_counts_that_sum_to_its_population(self):
+        html, rows = rendered()
+        for row in rows:
+            self.assertTrue(row.accounts())
+            self.assertIn(f"{len(row.impacted)} impacted", html)
+        self.assertIn("not impacted", html)
+        self.assertIn("undetermined", html)
+
+    def test_each_row_states_its_population_and_families(self):
+        html, _ = rendered()
+        self.assertIn("Evaluated against", html)
+        self.assertIn("FMC", html)
+
+    def test_zero_impact_row_is_present_with_its_population(self):
+        html, rows = rendered()
+        zero = next(r for r in rows if not r.impacted)
+        self.assertIn(zero.advisory_id, html)
+        self.assertIn("No inventory device is impacted.", html)
+        self.assertGreater(len(zero.population), 0)
+
+
+class UndeterminedSafety(unittest.TestCase):
+    """Principle IV: an undetermined device must never look clean, anywhere."""
+
+    def test_undetermined_devices_are_named_in_the_row(self):
+        html, rows = rendered()
+        row = next(r for r in rows if r.undetermined)
+        for d in row.undetermined:
+            self.assertIn(d["name"], html)
+
+    def test_meaning_survives_without_colour(self):
+        """Labelled in words as well as yellow — greyscale, print, colour-blind readers."""
+        html, _ = rendered()
+        self.assertIn("undetermined", html)
+        self.assertIn("<em>unknown</em>", html)
+        self.assertIn("not counted as unaffected", html)
+        # Strip every style rule and the statement must still be there.
+        without_css = re.sub(r"<style>.*?</style>", "", html, flags=re.S)
+        self.assertIn("devices undetermined", without_css)
+
+    def test_never_described_as_unaffected(self):
+        html, rows = rendered()
+        for row in rows:
+            names = {d["name"] for d in row.undetermined}
+            for name in names:
+                self.assertNotIn(f'{name}</span><span class="dev-meta">'
+                                 f'</span></span></li><li class="d-una"', html)
+        # No undetermined device may be counted in an unaffected figure.
+        for row in rows:
+            self.assertEqual(
+                len([d for d in row.unaffected if d["verdict"] == m.NEEDS_REVIEW]), 0)
+
+    def test_absent_from_a_row_whose_advisory_does_not_cover_its_family(self):
+        html, rows = rendered()
+        fmc_row = next(r for r in rows if r.advisory_id == FMC_ADV)
+        self.assertEqual(fmc_row.undetermined, [])
+
+    def test_appendix_lists_each_undetermined_device_once_with_a_reason(self):
+        html, _ = rendered()
+        self.assertIn("could not be assessed", html)
+        for name in ("asa-und-0", "asa-und-1"):
+            self.assertEqual(html.count(f">{name}</td>"), 1)
+        self.assertIn("does not recognise release", html)
+
+    def test_appendix_shows_recorded_and_queried_values(self):
+        html, _ = rendered()
+        self.assertIn("9.12(4)67", html)      # recorded
+        self.assertIn("9.12.4.67", html)      # queried
+
+
+class Fixes(unittest.TestCase):
+    def test_first_fix_is_shown_for_impacted_devices(self):
+        html, _ = rendered()
+        self.assertIn("fixed in 7.4.4", html)
+
+    def test_missing_fix_renders_as_explicitly_absent(self):
+        devices = [device("a", "FMC", advisories=[advisory(FMC_ADV, fixes=())])]
+        html, _ = rendered(devices=devices,
+                           bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={})
+        self.assertIn("no fixed release published", html)
+
+    def test_release_rollup_is_shown(self):
+        devices = [device("a", "FMC", advisories=[advisory(FMC_ADV)], version="7.4.2.3"),
+                   device("b", "FMC", advisories=[advisory(FMC_ADV)], version="7.4.2.4")]
+        html, _ = rendered(devices=devices,
+                           bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={})
+        self.assertIn("2 devices", html)
+        self.assertIn("2 affected releases", html)
+        self.assertIn("7.4.2.3, 7.4.2.4", html)
+        self.assertIn("fixed in 7.4.4", html)
+
+    def test_differing_fixes_are_shown_per_release_not_collapsed(self):
+        """One fix shown for devices needing different targets would misdirect a patcher."""
+        devices = [
+            device("old", "FMC", advisories=[advisory(FMC_ADV, fixes=("7.4.4",))],
+                   version="7.4.2.3"),
+            device("new", "FMC", advisories=[advisory(FMC_ADV, fixes=("7.6.2",))],
+                   version="7.6.0"),
+        ]
+        html, _ = rendered(devices=devices,
+                           bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={})
+        self.assertIn("7.4.2.3 → <span class=\"fix\">fixed in 7.4.4</span>", html)
+        self.assertIn("7.6.0 → <span class=\"fix\">fixed in 7.6.2</span>", html)
+
+
+class LongRows(unittest.TestCase):
+    def test_a_long_device_list_is_collapsed_not_truncated(self):
+        devices = [device(f"fw-{i:03d}", "FMC", advisories=[advisory(FMC_ADV)])
+                   for i in range(50)]
+        html, _ = rendered(devices=devices,
+                           bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={})
+        self.assertIn("<details", html)
+        self.assertIn("50 devices", html)
+        for i in range(50):
+            self.assertIn(f"fw-{i:03d}", html)
+
+
+class Escaping(unittest.TestCase):
+    def test_hostile_bundle_title_cannot_execute(self):
+        """The escaped text may still *read* as markup; what matters is that no tag forms.
+
+        `onerror=alert(2)` survives as inert text once `<` and `"` are escaped, so asserting
+        its absence would test the wrong thing. The properties that matter are that no tag is
+        opened and no attribute can be broken out of.
+        """
+        html, _ = rendered(bundle=a_bundle(title=fx.HOSTILE_TITLE))
+        self.assertNotIn("<script>alert(1)</script>", html)
+        self.assertNotIn("<img", html)
+        self.assertIn("&lt;script&gt;", html)
+        self.assertIn("&lt;img", html)
+        # The quote that would have escaped an attribute context is neutralised.
+        self.assertIn("&quot;", html)
+
+    def test_hostile_advisory_fields_cannot_execute(self):
+        hostile = advisory(FMC_ADV)
+        hostile["advisoryTitle"] = "<script>alert(9)</script>"
+        hostile["publicationUrl"] = '"><script>alert(8)</script>'
+        devices = [device("a", "FMC", advisories=[hostile])]
+        html, _ = rendered(devices=devices,
+                           bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={})
+        self.assertNotIn("<script>alert(9)</script>", html)
+        self.assertNotIn("<script>alert(8)</script>", html)
+
+    def test_hostile_device_values_cannot_execute(self):
+        devices = [device("<img src=x onerror=alert(1)>", "FMC",
+                          advisories=[advisory(FMC_ADV)])]
+        html, _ = rendered(devices=devices,
+                           bundle=a_bundle(advisory_ids=(FMC_ADV,)), records={})
+        self.assertNotIn("<img src=x onerror=alert(1)>", html)
+        self.assertIn("&lt;img", html)
+
+
+class SelfContained(unittest.TestCase):
+    def test_no_external_resource_reference(self):
+        html, _ = rendered()
+        self.assertNotIn("<link", html)
+        self.assertNotIn('src="http', html)
+        self.assertNotIn("@import", html)
+        # The only http(s) references are advisory links and the bundle page.
+        for url in re.findall(r'href="(https?://[^"]+)"', html):
+            self.assertIn("cisco.com", url)
+
+    def test_advisory_links_open_in_a_new_tab_without_document_access(self):
+        html, _ = rendered()
+        links = re.findall(r'<a href="https://sec\.cloudapps\.cisco\.com[^"]*"[^>]*>', html)
+        self.assertTrue(links)
+        for link in links:
+            self.assertIn('target="_blank"', link)
+            self.assertIn("noopener", link)
+
+    def test_filter_and_sort_controls_are_present(self):
+        html, _ = rendered()
+        self.assertIn('data-filter="impacting"', html)
+        self.assertIn('id="sort-severity"', html)
+        self.assertIn('id="sort-impacted"', html)
+
+    def test_per_device_cross_reference_is_present(self):
+        html, _ = rendered()
+        self.assertIn("By device", html)
+        self.assertIn("fmc-0", html)
+
+
+class Output(unittest.TestCase):
+    def test_filename_carries_the_bundle_and_keeps_the_prefix(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            path = br.report_path(tmp, "ERP-75736")
+            self.assertTrue(path.name.startswith("impact_report_"))
+            self.assertIn("ERP-75736", path.name)
+            self.assertTrue(path.name.endswith(".html"))
+
+    def test_never_overwrites(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            devices = fleet()
+            bundle = a_bundle()
+            first = br.build_and_write(bundle, devices, records={}, output_dir=tmp)
+            second = br.build_and_write(bundle, devices, records={}, output_dir=tmp)
+            self.assertNotEqual(first, second)
+            self.assertTrue(first.exists() and second.exists())
+
+    def test_written_file_matches_the_rendered_document(self):
+        with tempfile.TemporaryDirectory() as tmp:
+            devices = fleet()
+            path = br.build_and_write(a_bundle(), devices, records={}, output_dir=tmp)
+            text = path.read_text(encoding="utf-8")
+            self.assertTrue(text.startswith("<!DOCTYPE html>"))
+            self.assertIn("ERP-75736", text)
+
+
+class Determinism(unittest.TestCase):
+    def test_two_renders_are_identical(self):
+        devices = fleet()
+        one, _ = rendered(devices=devices)
+        two, _ = rendered(devices=devices)
+        self.assertEqual(one, two)
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 619f959..66e2731 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -226,6 +226,42 @@ def test_surviving_options_still_parse(self):
         self.assertTrue(args.yes)
 
 
+# --------------------------------------------------------------------------- #
+# Bundle scope (spec 008 FR-002, FR-005)
+# --------------------------------------------------------------------------- #
+class ErpOptionTests(unittest.TestCase):
+    """Principle III: the capability must be reachable without a prompt."""
+
+    def test_erp_defaults_to_none(self):
+        self.assertIsNone(cli.build_parser().parse_args([]).erp)
+
+    def test_erp_accepts_a_url(self):
+        url = "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736"
+        self.assertEqual(cli.build_parser().parse_args(["--erp", url]).erp, url)
+
+    def test_erp_accepts_a_bare_identifier(self):
+        self.assertEqual(cli.build_parser().parse_args(["--erp", "ERP-75736"]).erp,
+                         "ERP-75736")
+
+    def test_erp_is_advertised_in_help(self):
+        help_text = cli.build_parser().format_help()
+        self.assertIn("--erp", help_text)
+        self.assertIn("bundle", help_text.lower())
+
+    def test_erp_composes_with_the_other_analysis_options(self):
+        args = cli.build_parser().parse_args(
+            ["--erp", "ERP-75736", "--inventory", "fw.xlsx", "--sheet", "S",
+             "--output-dir", "out"])
+        self.assertEqual(args.erp, "ERP-75736")
+        self.assertEqual(args.inventory, "fw.xlsx")
+        self.assertEqual(args.sheet, "S")
+        self.assertEqual(args.output_dir, "out")
+
+    def test_erp_requires_a_value(self):
+        with self.assertRaises(SystemExit):
+            cli.build_parser().parse_args(["--erp"])
+
+
 # --------------------------------------------------------------------------- #
 # Removed-option guard (spec 007 FR-010..FR-012)
 # --------------------------------------------------------------------------- #
diff --git a/tests/test_erp.py b/tests/test_erp.py
new file mode 100644
index 0000000..fcc293b
--- /dev/null
+++ b/tests/test_erp.py
@@ -0,0 +1,213 @@
+"""Tests for bundle-page resolution (spec 008). No network access.
+
+Two properties here are the reason this module exists rather than a simpler lexical scan:
+identifiers live only in link targets, and an identifier mentioned in prose must not widen
+the bundle's scope. Both are asserted directly.
+"""
+
+from __future__ import annotations
+
+import io
+import unittest
+from contextlib import redirect_stderr, redirect_stdout
+
+from caia import erp
+from tests.fixtures import erp_pages as fx
+
+
+class _Response:
+    def __init__(self, body):
+        self._body = body.encode("utf-8")
+
+    def read(self):
+        return self._body
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, *exc):
+        return False
+
+
+def opener_for(body, record=None):
+    def _open(request, timeout=None):
+        if record is not None:
+            record.append((request.full_url, dict(request.headers), timeout))
+        return _Response(body)
+    return _open
+
+
+def raising_opener(exc):
+    def _open(request, timeout=None):
+        raise exc
+    return _open
+
+
+class NormalizeReference(unittest.TestCase):
+    def test_accepts_published_url(self):
+        bundle_id, url = erp.normalize_reference(
+            "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-75736")
+        self.assertEqual(bundle_id, "ERP-75736")
+        self.assertIn("alertId=ERP-75736", url)
+
+    def test_accepts_bare_identifier(self):
+        bundle_id, url = erp.normalize_reference("erp-75736")
+        self.assertEqual(bundle_id, "ERP-75736")
+        self.assertEqual(url, erp.PAGE_URL % "ERP-75736")
+
+    def test_rejects_other_hosts_and_paths(self):
+        for value in ("https://example.invalid/nope",
+                      "https://sec.cloudapps.cisco.com/security/center/other.x?alertId=ERP-1",
+                      "https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=nope",
+                      "not a url", ""):
+            with self.assertRaises(erp.ErpNotABundleError):
+                erp.normalize_reference(value)
+
+    def test_rejection_names_the_expected_form(self):
+        with self.assertRaises(erp.ErpNotABundleError) as caught:
+            erp.normalize_reference("https://example.invalid/x")
+        self.assertIn("ERP-75736", str(caught.exception))
+
+    def test_rejection_happens_before_any_request(self):
+        """A bad value must cost nothing: the opener is never reached (FR-004)."""
+        calls = []
+        with self.assertRaises(erp.ErpNotABundleError):
+            erp.resolve("https://example.invalid/x",
+                        opener=opener_for(fx.page(), record=calls))
+        self.assertEqual(calls, [])
+
+
+class Parsing(unittest.TestCase):
+    def test_extracts_every_advisory_from_hrefs(self):
+        ids, _ = erp.parse(fx.page())
+        self.assertEqual(list(ids), list(fx.ERP_75736_IDS))
+        self.assertEqual(len(ids), 25)
+
+    def test_preserves_page_order(self):
+        ids, _ = erp.parse(fx.page())
+        self.assertEqual(ids[0], "cisco-sa-onprem-fmc-authbypass-5JPp45V2")
+        self.assertEqual(ids[-1], "cisco-sa-asaftd-desync-n5AVzEQw")
+
+    def test_duplicate_links_collapse_to_one(self):
+        ids, _ = erp.parse(fx.page(duplicate_rows=True))
+        self.assertEqual(len(ids), 25)
+        self.assertEqual(len(set(ids)), 25)
+
+    def test_identifier_mentioned_only_in_prose_is_not_in_scope(self):
+        """Prose must never widen scope — scope is the one thing this page is trusted for."""
+        ids, _ = erp.parse(fx.page(prose_extra="cisco-sa-not-in-this-bundle-XXXXXXXX"))
+        self.assertNotIn("cisco-sa-not-in-this-bundle-XXXXXXXX", ids)
+        self.assertEqual(len(ids), 25)
+
+    def test_identifiers_are_absent_from_visible_text(self):
+        """The premise of matching on href: text extraction alone yields titles, not ids."""
+        markup = fx.page()
+        for advisory_id in fx.ERP_75736_IDS:
+            # Present in the document (inside an href) ...
+            self.assertIn(advisory_id, markup)
+        # ... but the anchor text is a title.
+        self.assertIn(fx.REAL_TITLES[0], markup)
+
+    def test_extracts_bundle_identity(self):
+        _, identity = erp.parse(fx.page())
+        self.assertEqual(identity["doc_id"], "ERP-75736")
+        self.assertEqual(identity["published"], "2026 March 4 16:00 GMT")
+        self.assertEqual(identity["version"], "1.0")
+        self.assertEqual(identity["title"], fx.BUNDLE_TITLE)
+
+    def test_script_content_is_not_mistaken_for_page_text(self):
+        """An inline script sets a different id; the page's own metadata must win."""
+        _, identity = erp.parse(fx.page(doc_id="ERP-75736"))
+        self.assertEqual(identity["doc_id"], "ERP-75736")
+
+    def test_missing_identity_fields_are_empty_not_an_error(self):
+        markup = fx.page().replace("Version: 1.0", "")
+        _, identity = erp.parse(markup)
+        self.assertEqual(identity["version"], "")
+
+
+class Resolution(unittest.TestCase):
+    def test_resolves_a_bundle(self):
+        bundle = erp.resolve("ERP-75736", opener=opener_for(fx.page()))
+        self.assertEqual(bundle.bundle_id, "ERP-75736")
+        self.assertEqual(len(bundle), 25)
+        self.assertEqual(bundle.published, "2026 March 4 16:00 GMT")
+        self.assertIn("cisco-sa-fmc-rce-NKhnULJh", bundle)
+
+    def test_request_sends_only_the_bundle_identifier(self):
+        """Nothing about any device may leave the machine (FR-037, Constitution V)."""
+        calls = []
+        erp.resolve("ERP-75736", opener=opener_for(fx.page(), record=calls))
+        (url, headers, timeout), = calls
+        self.assertEqual(url, erp.PAGE_URL % "ERP-75736")
+        self.assertNotIn("Authorization", headers)
+        joined = url + "".join(f"{k}{v}" for k, v in headers.items())
+        for leak in ("FWLOC", "ASA 5555", "7.4.2.3", "inventory"):
+            self.assertNotIn(leak, joined)
+
+    def test_fetch_is_time_bounded(self):
+        calls = []
+        erp.resolve("ERP-75736", opener=opener_for(fx.page(), record=calls))
+        self.assertIsNotNone(calls[0][2])
+        self.assertLessEqual(calls[0][2], erp.DEFAULT_TIMEOUT)
+
+    def test_unreachable_raises_and_says_it_is_connectivity(self):
+        with self.assertRaises(erp.ErpUnreachableError) as caught:
+            erp.resolve("ERP-75736", opener=raising_opener(OSError("no route")))
+        message = str(caught.exception)
+        self.assertIn("connectivity", message.lower())
+        self.assertIn("not an invalid bundle link", message.lower())
+
+    def test_no_advisories_is_an_error_never_an_empty_bundle(self):
+        """An empty bundle rendered as a report would read as an all-clear (FR-010)."""
+        with self.assertRaises(erp.ErpNoAdvisoriesError):
+            erp.resolve("ERP-75736", opener=opener_for(fx.no_advisories_page()))
+
+    def test_doc_id_mismatch_is_a_failure(self):
+        page = fx.page(doc_id="ERP-99999")
+        with self.assertRaises(erp.ErpBundleMismatchError):
+            erp.resolve("ERP-75736", opener=opener_for(page))
+
+    def test_hostile_markup_still_resolves_and_does_not_gain_scope(self):
+        bundle = erp.resolve("ERP-75736", opener=opener_for(fx.hostile_page()))
+        self.assertEqual(len(bundle), 3)
+        self.assertNotIn("cisco-sa-not-in-this-bundle-XXXXXXXX", bundle.advisory_ids)
+        # The title is carried verbatim; escaping is the report's responsibility.
+        self.assertIn("<script>", bundle.title)
+
+    def test_every_failure_is_a_distinct_type(self):
+        """FR-010: the three outcomes must be distinguishable by the caller."""
+        kinds = {erp.ErpNotABundleError, erp.ErpUnreachableError, erp.ErpNoAdvisoriesError}
+        self.assertEqual(len(kinds), 3)
+        for kind in kinds:
+            self.assertTrue(issubclass(kind, erp.ErpError))
+
+
+class HeadlessProperty(unittest.TestCase):
+    """Principle VI: the shared surface must be callable without a terminal."""
+
+    def test_resolution_prints_nothing(self):
+        out, err = io.StringIO(), io.StringIO()
+        with redirect_stdout(out), redirect_stderr(err):
+            erp.resolve("ERP-75736", opener=opener_for(fx.page()))
+        self.assertEqual(out.getvalue(), "")
+        self.assertEqual(err.getvalue(), "")
+
+    def test_failures_raise_rather_than_exit(self):
+        for opener in (raising_opener(OSError("x")),
+                       opener_for(fx.no_advisories_page())):
+            try:
+                erp.resolve("ERP-75736", opener=opener)
+            except SystemExit:  # pragma: no cover - the failure this test guards
+                self.fail("resolution exited the process")
+            except erp.ErpError:
+                pass
+
+    def test_unreachable_never_returns_verdict_shaped_emptiness(self):
+        """"We could not ask" must be distinguishable from "we asked" (FR-040)."""
+        with self.assertRaises(erp.ErpUnreachableError):
+            erp.resolve("ERP-75736", opener=raising_opener(TimeoutError()))
+
+
+if __name__ == "__main__":  # pragma: no cover
+    unittest.main()
diff --git a/tests/test_psirt.py b/tests/test_psirt.py
index 258fafe..43127a0 100644
--- a/tests/test_psirt.py
+++ b/tests/test_psirt.py
@@ -195,6 +195,46 @@ def test_get_platforms_skips_the_request_for_platformless_families(self):
         self.assertEqual(client.get_platforms("fmc"), [])
         self.assertEqual(opener.calls, [])
 
+    def test_get_advisory_returns_the_record(self):
+        """Needed only for a bundle advisory that impacts nothing (spec 008 FR-008)."""
+        payload = {"advisories": [fx.advisory(advisory_id="cisco-sa-x")]}
+        client, opener, _ = _client([_Response(fx.TOKEN), _Response(payload)])
+        record = client.get_advisory("cisco-sa-x")
+        self.assertEqual(record["advisoryId"], "cisco-sa-x")
+        self.assertIn("/advisory/cisco-sa-x", opener.calls[-1].full_url)
+
+    def test_get_advisory_accepts_a_bare_list(self):
+        payload = [fx.advisory(advisory_id="cisco-sa-y")]
+        client, _, _ = _client([_Response(fx.TOKEN), _Response(payload)])
+        self.assertEqual(client.get_advisory("cisco-sa-y")["advisoryId"], "cisco-sa-y")
+
+    def test_get_advisory_returns_none_rather_than_inventing_facts(self):
+        """A row without facts beats a row with guessed ones (Principle IV)."""
+        client, _, _ = _client([_Response(fx.TOKEN),
+                                _http_error(404, {"errorCode": "NO_DATA_FOUND"})])
+        self.assertIsNone(client.get_advisory("cisco-sa-missing"))
+
+    def test_get_advisory_surfaces_an_auth_failure(self):
+        client, _, _ = _client([_Response(fx.TOKEN),
+                                _http_error(401, {"errorCode": "UNAUTHORIZED"}),
+                                _Response(fx.TOKEN),
+                                _http_error(401, {"errorCode": "UNAUTHORIZED"})])
+        with self.assertRaises(psirt.PsirtAuthError):
+            client.get_advisory("cisco-sa-x")
+
+    def test_get_advisory_surfaces_unreachable(self):
+        client, _, _ = _client([_Response(fx.TOKEN), urllib.error.URLError("down")])
+        with self.assertRaises(psirt.PsirtUnreachableError):
+            client.get_advisory("cisco-sa-x")
+
+    def test_get_advisory_is_paced_like_every_other_request(self):
+        payload = {"advisories": [fx.advisory(advisory_id="cisco-sa-x")]}
+        client, _, clk = _client([_Response(fx.TOKEN), _Response(payload),
+                                  _Response(payload)])
+        client.get_advisory("cisco-sa-x")
+        client.get_advisory("cisco-sa-x")
+        self.assertTrue(clk.slept, "the second lookup must be paced")
+
     def test_get_os_data_returns_rows(self):
         client, _, _ = _client([_Response(fx.TOKEN), _Response(fx.OS_DATA["fmc"])])
         rows = client.get_os_data("fmc")
diff --git a/tools/install-test.sh b/tools/install-test.sh
index 7830dc7..462b642 100755
--- a/tools/install-test.sh
+++ b/tools/install-test.sh
@@ -191,6 +191,13 @@ for opt in --api --url --dry-run --keep-temp --no-keep-temp; do
 done
 echo "no removed options in help OK"
 
+echo "== --erp is advertised and takes a value =="
+caia --help | grep -q -- "--erp" || { echo "FAIL: --erp is not advertised"; exit 1; }
+if caia --erp --no-update-check 2>/dev/null; then
+  echo "FAIL: --erp with no value should have exited non-zero"; exit 1
+fi
+echo "--erp surface OK"
+
 echo "== a removed option is refused by name, and does not act =="
 for opt in --api --url=X --dry-run --keep-temp --no-keep-temp; do
   if caia "$opt" --no-update-check; then
@@ -229,13 +236,27 @@ echo "  Ready: caia is installed, and /work has an inventory.xlsx."
 echo
 echo "  Offline checks (no credentials needed):"
 echo "    caia --version"
-echo "    caia --help"
+echo "    caia --help                                        # --erp is listed"
 echo "    caia --inventory inventory.xlsx --no-update-check   # refuses: no credentials"
 echo
-echo "  Live check (needs Cisco PSIRT credentials):"
+echo "  Live checks (need Cisco PSIRT credentials):"
 echo "    caia --config      # paste the Cisco client ID + secret"
+echo
+echo "    # 1. whole-fleet report — press Enter at the bundle prompt"
 echo "    caia --inventory inventory.xlsx --no-update-check"
-echo "    # then open output/impact_report_*.html  (copy it out, or just read the tally)"
+echo
+echo "    # 2. bundle-scoped report — one row per advisory in the bundle"
+echo "    caia --inventory inventory.xlsx --no-update-check \\"
+echo "         --erp ERP-75736"
+echo
+echo "    # 3. the failure paths (each writes NO report)"
+echo "    caia --inventory inventory.xlsx --no-update-check --erp nonsense   # exits 2"
+echo "    caia --inventory inventory.xlsx --no-update-check --erp ERP-00000  # exits 1"
+echo
+echo "    ls -l output/    # impact_report_<date>.html vs impact_report_ERP-75736_<date>.html"
+echo
+echo "  Note: the credential gate fires before bundle validation, so --erp failures"
+echo "  only show their own exit codes once credentials are configured."
 echo
 echo "  Credentials you enter live only in this container and vanish on exit."
 echo "  Type  exit  to leave (the container is discarded)."