feat(tools): temporal_priority — temporal urgency scorer + CLI subcommand (+68 tests)

[manus-use]

Summary

Implements the temporal-priority CLI subcommand and temporal_priority Strands tool — both documented in the README but completely unimplemented (no tool file, no CLI dispatch, no tests existed).

What it does

Produces a 0–100 urgency score combining six temporal signals to answer: "given everything I know today, how urgent is this CVE?"

Signals (weighted composite)

Signal	Weight	Source
CVSS base score	25%	NVD API
Current EPSS	25%	FIRST.org API
EPSS spike recency	15%	FIRST.org time-series (exponential decay, 14-day half-life)
CISA KEV membership	20%	CISA KEV catalog
Patch availability	5%	NVD references (inverted: no patch = more urgent)
CVE age	10%	NVD publish date (exponential decay, 90-day half-life)

Urgency labels

Score	Label
80–100	CRITICAL
60–79	HIGH
40–59	MEDIUM
20–39	LOW
0–19	INFORMATIONAL

Usage

manus-agent temporal-priority CVE-2024-3094
manus-agent temporal-priority CVE-2024-3094 --output json | jq .score

Files changed

• src/manus_agent/tools/temporal_priority.py — new tool (Strands TOOL_SPEC + compute_temporal_priority core function)
• src/manus_agent/cli.py — dispatch + parser + _SUBCOMMANDS registration
• tests/test_temporal_priority.py — 68 tests, 100% mocked (no real HTTP)

Test categories (68 tests)

• TOOL_SPEC contract (4)
• Input validation (5)
• HTTP helper retry/back-off (5)
• CVSS scoring (6)
• EPSS current scoring (5)
• EPSS spike scoring (4)
• KEV scoring (4)
• Patch availability scoring (5)
• Age scoring (5)
• Composite scoring (8)
• Tool entry point (4)
• CLI subcommand (6)
• Edge cases (7)

Design decisions

• Zero new dependencies — uses only requests (already a project dependency)
• Retry/back-off on all HTTP calls (configurable via env vars)
• Graceful degradation — missing signals default to neutral (0.5) or zero, never crash
• Pre-fetchable data — compute_temporal_priority() accepts pre-fetched NVD/EPSS/KEV data for pipeline integration
• Configurable weights — all weights overridable via TP_W_* environment variables

Duplicate check

Confirmed no overlap with any open or merged PR:

• Open PRs checked: feat(cli): add manus-agent cluster-variants subcommand for CVE variant clustering #136–test(tools): comprehensive test suite for browser_agent_tool module (+69 tests) #185 (50 open PRs)
• Closest: feat: add cve-enrich tool and CLI subcommand for multi-source CVE enrichment #170 (cve-enrich — single CVE multi-source enrichment, different purpose), feat: add cve-neighbors tool and CLI subcommand (+51 tests) #180 (cve-neighbors — related CVEs), feat(tools): exploit complexity scorer — score_exploit_complexity tool + manus-use exploit-complexity subcommand #57 (merged, exploit-complexity — different scoring model)
• No open or merged PR implements temporal-priority or a combined urgency scorer