docs: describe the tool by what it does — check an advisory bundle

[Ali Bahaloo (alibahaloo)]

The description still read "Fleet-wide firewall impact analysis, straight from Cisco" — written before the bundle check existed. Both ledes described only the device-by-device sweep, so the workflow the tool is actually for was invisible until deep into "Run it".

New description

Check a Cisco advisory bundle against your firewall inventory

Cisco publishes firewall vulnerabilities in bundles — an Event Response page listing every advisory released that day. Give this tool the link to one and it tells you which of your firewalls and software releases that publication impacts, and the release that fixes each.

In the banner:

                    Cisco Advisory Impact Analyzer
 Check a Cisco advisory bundle against your firewall inventory · TELUS Digital

Applied to all nine places a description lives. Four shared the old literal (README.md, docs/index.html, pyproject.toml, the banner slogan); the rest are the <meta> description, both ledes, --help, and the package docstring — that last one only turned up by grepping for the stale string.

Run it is restructured so the bundle prompt is the flow, with --erp ERP-75736 immediately after it for scheduling.

Two gaps this turned up, both worth more than the wording

--erp was missing from the README's automation flag table. That absence is why it looked like the flag didn't exist at all — the table is where you'd look. Added, with a runnable scheduled-review example. The exit-codes line below it now covers the bundle failures too: 2 for a value that isn't a bundle address, 1 for Cisco unreachable or a page yielding no advisories, and no report written either way.

sec.cloudapps.cisco.com was absent from the network prerequisites — in both files, and from the Could not reach Cisco troubleshooting entry. A user behind a corporate proxy would have been blocked on the bundle fetch with nothing in the docs explaining why. Now listed alongside apix.cisco.com and id.cisco.com, with a note on which does what.

What is deliberately kept

The whole-inventory report (press Enter at the prompt) keeps a short note at the end of "Run it" rather than equal billing. It still works, so removing it from the docs would misdescribe the tool in the other direction — but it is no longer what the tool announces itself as.

"Fleet" survives in three places on purpose: the two disclaimers (not a whole-inventory assessment), where the strong word is doing real work, and --uninstall --yes # for scripts / fleet cleanup, which is about machines rather than firewalls.

Also considered and not done: removing --erp to make the tool single-purpose. Principle III requires every capability be reachable "without human input", and the ERP link is the tool's only required input — dropping the flag would leave its sole function invocable only by a human at a prompt, breaking scheduled reviews (User Story 2) and the container harness's automated checks.

Scope

Documentation and packaging metadata only. No behaviour change; 402 tests pass unchanged.

No VERSION bump — matching f78ca51, e156578 and 73de536, all docs-only and none bumped. e156578 changed a pyproject.toml field, the same category as description.

🤖 Generated with Claude Code