@blamejs/exceptd-skills 0.10.0 → 0.10.1

package/data/playbooks/secrets.json

@@ -9,11 +9,18 @@
         "version": "1.0.0",
         "date": "2026-05-11",
         "summary": "Initial seven-phase repo-scoped secret-exfiltration playbook. Walks the current repository to depth 6 (excluding node_modules, .git/objects, dist, build) for secret-shape regexes (AWS, GCP, GitHub, Slack, Stripe, JWT, SSH private keys, OpenAI, Anthropic), world-writable .env / .ssh files, and IaC files with embedded credentials. Closes the GRC loop with DLP framework-gap mapping + auditor-ready exception generation.",
-        "framework_gaps_updated": ["nist-800-53-SC-28", "iso-27001-2022-A.8.24", "gdpr-art-32", "pci-dss-4-req-3", "soc2-cc6.1"]
+        "framework_gaps_updated": [
+          "nist-800-53-SC-28",
+          "iso-27001-2022-A.8.24",
+          "gdpr-art-32",
+          "pci-dss-4-req-3",
+          "soc2-cc6.1"
+        ]
       }
     ],
     "owner": "@blamejs/grc",
     "air_gap_mode": true,
+    "scope": "code",
     "preconditions": [
       {
         "id": "repo-context",
@@ -36,23 +43,41 @@
       }
     ]
   },
-
   "domain": {
     "name": "Repository-scoped secret exfiltration risk",
     "attack_class": "dlp-exfiltration",
-    "atlas_refs": ["AML.T0055"],
-    "attack_refs": ["T1552.001", "T1552.004", "T1552.005", "T1078.004"],
+    "atlas_refs": [
+      "AML.T0055"
+    ],
+    "attack_refs": [
+      "T1552.001",
+      "T1552.004",
+      "T1552.005",
+      "T1078.004"
+    ],
     "cve_refs": [],
-    "cwe_refs": ["CWE-798", "CWE-200", "CWE-312", "CWE-732"],
-    "d3fend_refs": ["D3-CAA", "D3-FCR"],
+    "cwe_refs": [
+      "CWE-798",
+      "CWE-200",
+      "CWE-312",
+      "CWE-732"
+    ],
+    "d3fend_refs": [
+      "D3-CAA",
+      "D3-FCR"
+    ],
     "frameworks_in_scope": [
-      "nist-800-53", "iso-27001-2022", "soc2", "pci-dss-4",
-      "nis2", "dora", "uk-caf", "hipaa"
+      "nist-800-53",
+      "iso-27001-2022",
+      "soc2",
+      "pci-dss-4",
+      "nis2",
+      "dora",
+      "uk-caf",
+      "hipaa"
     ]
   },
-
   "phases": {
-
     "govern": {
       "jurisdiction_obligations": [
         {
@@ -61,7 +86,11 @@
           "obligation": "notify_regulator",
           "window_hours": 72,
           "clock_starts": "detect_confirmed",
-          "evidence_required": ["secret_inventory", "data_subject_impact_assessment", "containment_record"]
+          "evidence_required": [
+            "secret_inventory",
+            "data_subject_impact_assessment",
+            "containment_record"
+          ]
         },
         {
           "jurisdiction": "EU",
@@ -69,7 +98,10 @@
           "obligation": "notify_affected_individuals",
           "window_hours": 72,
           "clock_starts": "analyze_complete",
-          "evidence_required": ["data_subject_categories_affected", "containment_record"]
+          "evidence_required": [
+            "data_subject_categories_affected",
+            "containment_record"
+          ]
         },
         {
           "jurisdiction": "EU",
@@ -77,7 +109,11 @@
           "obligation": "notify_regulator",
           "window_hours": 24,
           "clock_starts": "detect_confirmed",
-          "evidence_required": ["secret_inventory", "exposure_window_estimate", "rotation_status"]
+          "evidence_required": [
+            "secret_inventory",
+            "exposure_window_estimate",
+            "rotation_status"
+          ]
         },
         {
           "jurisdiction": "UK",
@@ -85,7 +121,10 @@
           "obligation": "notify_regulator",
           "window_hours": 72,
           "clock_starts": "detect_confirmed",
-          "evidence_required": ["secret_inventory", "data_subject_impact_assessment"]
+          "evidence_required": [
+            "secret_inventory",
+            "data_subject_impact_assessment"
+          ]
         },
         {
           "jurisdiction": "US-CA",
@@ -93,7 +132,10 @@
           "obligation": "notify_affected_individuals",
           "window_hours": 1440,
           "clock_starts": "analyze_complete",
-          "evidence_required": ["california_resident_records_affected", "containment_record"]
+          "evidence_required": [
+            "california_resident_records_affected",
+            "containment_record"
+          ]
         }
       ],
       "theater_fingerprints": [
@@ -101,19 +143,30 @@
           "pattern_id": "gitleaks-in-ci-as-prevention",
           "claim": "gitleaks / trufflehog runs in CI → no secrets in repo.",
           "fast_detection_test": "Run a current scan against the repo HEAD and against the working tree (uncommitted files). CI catches committed-and-pushed secrets only. Uncommitted .env files, files in .gitignore, secrets in build artifacts under dist/, and IaC files staged-but-not-committed are all outside CI scope. Find any non-empty .env, .env.local, .npmrc, .pypirc, or terraform.tfvars in the working tree to verify.",
-          "implicated_controls": ["nist-800-53-SA-11", "soc2-cc7.1", "iso-27001-2022-A.8.28"]
+          "implicated_controls": [
+            "nist-800-53-SA-11",
+            "soc2-cc7.1",
+            "iso-27001-2022-A.8.28"
+          ]
         },
         {
           "pattern_id": "vault-attested-but-bypassed",
           "claim": "We use Vault / Secrets Manager / KMS — no static credentials.",
           "fast_detection_test": "Grep the working tree for AWS_ACCESS_KEY_ID, GOOGLE_APPLICATION_CREDENTIALS pointing to a JSON file, ANTHROPIC_API_KEY, OPENAI_API_KEY, GITHUB_TOKEN literals. Vault-attested orgs commonly bypass for 'just this one dev workflow' or 'CI bootstrap secrets'. Any non-templated secret in the working tree is theater regardless of Vault posture.",
-          "implicated_controls": ["nist-800-53-SC-12", "iso-27001-2022-A.8.24", "pci-dss-4-req-3"]
+          "implicated_controls": [
+            "nist-800-53-SC-12",
+            "iso-27001-2022-A.8.24",
+            "pci-dss-4-req-3"
+          ]
         },
         {
           "pattern_id": "pre-commit-hook-as-control",
           "claim": "Pre-commit hooks catch secrets before commit.",
           "fast_detection_test": "Check whether the repo's .pre-commit-config.yaml / lefthook.yml / husky config actually invokes a secret-scan tool AND whether the team has ever bypassed via --no-verify (visible in git log for repos with verified commits or in the reflog). Pre-commit is bypassable; pre-receive (server-side) is not. If only pre-commit exists, the control is advisory.",
-          "implicated_controls": ["soc2-cc7.1", "iso-27001-2022-A.8.28"]
+          "implicated_controls": [
+            "soc2-cc7.1",
+            "iso-27001-2022-A.8.28"
+          ]
         }
       ],
       "framework_context": {
@@ -152,9 +205,13 @@
           }
         ]
       },
-      "skill_preload": ["dlp-gap-analysis", "framework-gap-analysis", "compliance-theater", "policy-exception-gen"]
+      "skill_preload": [
+        "dlp-gap-analysis",
+        "framework-gap-analysis",
+        "compliance-theater",
+        "policy-exception-gen"
+      ]
     },
-
     "direct": {
       "threat_context": "Secret-in-repo is the #1 cause of cloud account compromise in 2025-2026 IR data. AI-coding-assistant adoption has accelerated the rate: AI assistants generate boilerplate that embeds API keys directly (Anthropic's own published guidance warns against this). GitGuardian Q1 2026 report: ~7.2M secrets leaked to public GitHub in Q1 alone, with OpenAI and Anthropic API keys representing the fastest-growing leak categories. Attack pattern: scraper bots monitor GitHub firehose for committed secrets within minutes of push; AWS keys are exploited within ~5 minutes of public exposure, often before the developer notices the commit. Working-tree scan (this playbook) catches the pre-commit window AND uncommitted secrets that CI scanners miss entirely (build artifacts, .env files in .gitignore, IaC tfvars files, .npmrc auth tokens).",
       "rwep_threshold": {
@@ -164,10 +221,27 @@
       },
       "framework_lag_declaration": "GDPR Art.32, ISO A.8.24, PCI-DSS Req.3, SOC 2 CC6.1 collectively cover encryption + key management + access control in production storage backends. None of them name 'secret in source artifact' as a distinct exposure category, despite this being the dominant 2025-2026 cloud-compromise vector. NIS2 Art.21(2)(j) names cryptography but not development-workflow exposure. Gap = ~30 days between developer commit and framework's quarterly access-review cadence; in practice, scraper bots exploit faster than any framework cadence.",
       "skill_chain": [
-        { "skill": "dlp-gap-analysis", "purpose": "Inventory secret-shape findings in the working tree; assess exposure window; map to provider-specific rotation procedures.", "required": true },
-        { "skill": "framework-gap-analysis", "purpose": "Map findings to which framework controls claim to address secret protection and where the gap is.", "required": true },
-        { "skill": "compliance-theater", "purpose": "Run the theater test on the org's secret-scanning attestation (CI gitleaks + Vault posture).", "required": true },
-        { "skill": "policy-exception-gen", "purpose": "Generate auditor-ready exception language for secrets that cannot be rotated immediately (e.g. requires coordinated multi-system rotation).", "skip_if": "close.exception_generation.trigger_condition == false", "required": false }
+        {
+          "skill": "dlp-gap-analysis",
+          "purpose": "Inventory secret-shape findings in the working tree; assess exposure window; map to provider-specific rotation procedures.",
+          "required": true
+        },
+        {
+          "skill": "framework-gap-analysis",
+          "purpose": "Map findings to which framework controls claim to address secret protection and where the gap is.",
+          "required": true
+        },
+        {
+          "skill": "compliance-theater",
+          "purpose": "Run the theater test on the org's secret-scanning attestation (CI gitleaks + Vault posture).",
+          "required": true
+        },
+        {
+          "skill": "policy-exception-gen",
+          "purpose": "Generate auditor-ready exception language for secrets that cannot be rotated immediately (e.g. requires coordinated multi-system rotation).",
+          "skip_if": "close.exception_generation.trigger_condition == false",
+          "required": false
+        }
       ],
       "token_budget": {
         "estimated_total": 19000,
@@ -182,7 +256,6 @@
         }
       }
     },
-
     "look": {
       "artifacts": [
         {
@@ -261,16 +334,43 @@
         }
       ],
       "fallback_if_unavailable": [
-        { "artifact_id": "repo-tree", "fallback_action": "escalate_to_human", "confidence_impact": "high" },
-        { "artifact_id": "env-files", "fallback_action": "mark_inconclusive", "confidence_impact": "medium" },
-        { "artifact_id": "auth-config-files", "fallback_action": "mark_inconclusive", "confidence_impact": "medium" },
-        { "artifact_id": "ssh-private-keys", "fallback_action": "mark_inconclusive", "confidence_impact": "high" },
-        { "artifact_id": "iac-credential-bearers", "fallback_action": "mark_inconclusive", "confidence_impact": "medium" },
-        { "artifact_id": "secret-regex-scan-text-files", "fallback_action": "escalate_to_human", "confidence_impact": "high" },
-        { "artifact_id": "world-writable-secret-files", "fallback_action": "mark_inconclusive", "confidence_impact": "medium" }
+        {
+          "artifact_id": "repo-tree",
+          "fallback_action": "escalate_to_human",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "env-files",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "auth-config-files",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "ssh-private-keys",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "iac-credential-bearers",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "secret-regex-scan-text-files",
+          "fallback_action": "escalate_to_human",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "world-writable-secret-files",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        }
       ]
     },
-
     "detect": {
       "indicators": [
         {
@@ -424,27 +524,91 @@
         "not_detected": "Full repo walk completed AND zero deterministic patterns matched AND no high-confidence patterns matched AND no world-writable secret files AND .ssh keys (if present) have mode 0600."
       }
     },
-
     "analyze": {
       "rwep_inputs": [
-        { "signal_id": "aws-access-key-id", "rwep_factor": "active_exploitation", "weight": 30, "notes": "Scraper bots monetize within minutes of public exposure. Treat as exploitation-imminent." },
-        { "signal_id": "aws-access-key-id", "rwep_factor": "ai_weaponization", "weight": 10, "notes": "AI-powered scrapers triage and weaponize at scale." },
-        { "signal_id": "gcp-service-account-json", "rwep_factor": "active_exploitation", "weight": 30, "notes": "Same as AWS." },
-        { "signal_id": "github-personal-access-token", "rwep_factor": "active_exploitation", "weight": 25, "notes": "PAT exposure = repo + CI compromise + supply chain pivot." },
-        { "signal_id": "openai-api-key", "rwep_factor": "active_exploitation", "weight": 20, "notes": "Spend abuse is automatic; AI account compromise extends to fine-tunes / files / projects in account." },
-        { "signal_id": "anthropic-api-key", "rwep_factor": "active_exploitation", "weight": 20, "notes": "Same as OpenAI." },
-        { "signal_id": "ssh-private-key-block", "rwep_factor": "blast_radius", "weight": 20, "notes": "Inline private key = lateral movement primitive." },
-        { "signal_id": "world-writable-env-file", "rwep_factor": "blast_radius", "weight": 15, "notes": "Tampering primitive on dev workstation; supply-chain implications if CI pulls from same path." },
-        { "signal_id": "ssh-key-bad-perms", "rwep_factor": "blast_radius", "weight": 10, "notes": "Permission flaw enables credential theft by any local user." }
+        {
+          "signal_id": "aws-access-key-id",
+          "rwep_factor": "active_exploitation",
+          "weight": 30,
+          "notes": "Scraper bots monetize within minutes of public exposure. Treat as exploitation-imminent."
+        },
+        {
+          "signal_id": "aws-access-key-id",
+          "rwep_factor": "ai_weaponization",
+          "weight": 10,
+          "notes": "AI-powered scrapers triage and weaponize at scale."
+        },
+        {
+          "signal_id": "gcp-service-account-json",
+          "rwep_factor": "active_exploitation",
+          "weight": 30,
+          "notes": "Same as AWS."
+        },
+        {
+          "signal_id": "github-personal-access-token",
+          "rwep_factor": "active_exploitation",
+          "weight": 25,
+          "notes": "PAT exposure = repo + CI compromise + supply chain pivot."
+        },
+        {
+          "signal_id": "openai-api-key",
+          "rwep_factor": "active_exploitation",
+          "weight": 20,
+          "notes": "Spend abuse is automatic; AI account compromise extends to fine-tunes / files / projects in account."
+        },
+        {
+          "signal_id": "anthropic-api-key",
+          "rwep_factor": "active_exploitation",
+          "weight": 20,
+          "notes": "Same as OpenAI."
+        },
+        {
+          "signal_id": "ssh-private-key-block",
+          "rwep_factor": "blast_radius",
+          "weight": 20,
+          "notes": "Inline private key = lateral movement primitive."
+        },
+        {
+          "signal_id": "world-writable-env-file",
+          "rwep_factor": "blast_radius",
+          "weight": 15,
+          "notes": "Tampering primitive on dev workstation; supply-chain implications if CI pulls from same path."
+        },
+        {
+          "signal_id": "ssh-key-bad-perms",
+          "rwep_factor": "blast_radius",
+          "weight": 10,
+          "notes": "Permission flaw enables credential theft by any local user."
+        }
       ],
       "blast_radius_model": {
         "scope_question": "Given the secret(s) found in the working tree, what is the blast radius if this repo (or its working copy) is read by an unauthorized party?",
         "scoring_rubric": [
-          { "condition": "Single test/expired/example credential matched with FP distinguishing test passing", "blast_radius_score": 1, "description": "False-positive shaped match; no live exposure." },
-          { "condition": "Single non-production credential (test env, sandbox account) confirmed live", "blast_radius_score": 2, "description": "Sandbox-scope compromise. Cleanup required but limited." },
-          { "condition": "Single production credential confirmed live (or unconfirmed but production-shaped) on a single-cloud or single-vendor account", "blast_radius_score": 3, "description": "Production single-account compromise. Spend + data exposure within that account's IAM scope." },
-          { "condition": "Production credential AND credential has broad IAM scope (admin / wildcard / service-account JSON with project owner)", "blast_radius_score": 4, "description": "Cloud-account-wide compromise. Data exfil + resource creation + lateral to other tenants." },
-          { "condition": "Multiple production credentials AND credentials span identity layers (cloud + SaaS + SCM) AND repo is or was public", "blast_radius_score": 5, "description": "Org-wide identity boundary collapse. Treat as confirmed incident." }
+          {
+            "condition": "Single test/expired/example credential matched with FP distinguishing test passing",
+            "blast_radius_score": 1,
+            "description": "False-positive shaped match; no live exposure."
+          },
+          {
+            "condition": "Single non-production credential (test env, sandbox account) confirmed live",
+            "blast_radius_score": 2,
+            "description": "Sandbox-scope compromise. Cleanup required but limited."
+          },
+          {
+            "condition": "Single production credential confirmed live (or unconfirmed but production-shaped) on a single-cloud or single-vendor account",
+            "blast_radius_score": 3,
+            "description": "Production single-account compromise. Spend + data exposure within that account's IAM scope."
+          },
+          {
+            "condition": "Production credential AND credential has broad IAM scope (admin / wildcard / service-account JSON with project owner)",
+            "blast_radius_score": 4,
+            "description": "Cloud-account-wide compromise. Data exfil + resource creation + lateral to other tenants."
+          },
+          {
+            "condition": "Multiple production credentials AND credentials span identity layers (cloud + SaaS + SCM) AND repo is or was public",
+            "blast_radius_score": 5,
+            "description": "Org-wide identity boundary collapse. Treat as confirmed incident."
+          }
         ]
       },
       "compliance_theater_check": {
@@ -484,45 +648,78 @@
         }
       ],
       "escalation_criteria": [
-        { "condition": "rwep >= 90 AND credential_appears_live == true", "action": "page_on_call" },
-        { "condition": "blast_radius_score >= 4", "action": "trigger_playbook", "target_playbook": "cred-stores" },
-        { "condition": "compliance_theater_check.verdict == 'theater' AND jurisdiction_obligations contains 'EU'", "action": "notify_legal" },
-        { "condition": "any_secret_in_committed_history == true", "action": "raise_severity" }
+        {
+          "condition": "rwep >= 90 AND credential_appears_live == true",
+          "action": "page_on_call"
+        },
+        {
+          "condition": "blast_radius_score >= 4",
+          "action": "trigger_playbook",
+          "target_playbook": "cred-stores"
+        },
+        {
+          "condition": "compliance_theater_check.verdict == 'theater' AND jurisdiction_obligations contains 'EU'",
+          "action": "notify_legal"
+        },
+        {
+          "condition": "any_secret_in_committed_history == true",
+          "action": "raise_severity"
+        }
       ]
     },
-
     "validate": {
       "remediation_paths": [
         {
           "id": "rotate-and-purge",
           "description": "(1) Rotate the credential at the provider (AWS IAM, GCP, GitHub, Slack, Stripe, OpenAI, Anthropic), (2) revoke any sessions tied to the old credential, (3) remove the literal from the working tree + replace with a Vault/Secrets Manager template, (4) if the credential ever entered git history, BFG / git-filter-repo the history AND notify any forks/mirrors.",
-          "preconditions": ["provider_supports_revocation == true", "rotation_ownership_identified == true"],
+          "preconditions": [
+            "provider_supports_revocation == true",
+            "rotation_ownership_identified == true"
+          ],
           "priority": 1,
-          "compensating_controls": ["session-revocation", "cloudtrail-or-audit-log-review-for-misuse-window"],
+          "compensating_controls": [
+            "session-revocation",
+            "cloudtrail-or-audit-log-review-for-misuse-window"
+          ],
           "estimated_time_hours": 2
         },
         {
           "id": "fix-file-permissions",
           "description": "For world-writable .env / .ssh / auth-config files: chmod 0600 (private keys) or 0640 (env files). For SSH key with bad perms: chmod 0600 and re-load via ssh-add.",
-          "preconditions": ["file_owner_is_current_user OR has_sudo == true"],
+          "preconditions": [
+            "file_owner_is_current_user OR has_sudo == true"
+          ],
           "priority": 2,
-          "compensating_controls": ["perm-change-recorded"],
+          "compensating_controls": [
+            "perm-change-recorded"
+          ],
           "estimated_time_hours": 0.5
         },
         {
           "id": "tighten-prevention",
           "description": "Install pre-commit hook + pre-receive server-side hook running gitleaks/trufflehog. Add .gitignore entries for env/auth-config files. Add CI step scanning build artifacts under dist/build.",
-          "preconditions": ["repo_governance_authority == true"],
+          "preconditions": [
+            "repo_governance_authority == true"
+          ],
           "priority": 2,
-          "compensating_controls": ["pre-commit-config-versioned", "ci-config-versioned"],
+          "compensating_controls": [
+            "pre-commit-config-versioned",
+            "ci-config-versioned"
+          ],
           "estimated_time_hours": 2
         },
         {
           "id": "policy-exception",
           "description": "If rotation requires coordinated multi-system rollout (e.g. credential is consumed by 50+ services), generate exception with bounded duration + compensating audit-log monitoring.",
-          "preconditions": ["coordinated_rotation_required == true", "credential_misuse_monitoring_in_place == true"],
+          "preconditions": [
+            "coordinated_rotation_required == true",
+            "credential_misuse_monitoring_in_place == true"
+          ],
           "priority": 4,
-          "compensating_controls": ["enhanced-audit-log-alerting-on-credential", "incident-response-team-on-standby"],
+          "compensating_controls": [
+            "enhanced-audit-log-alerting-on-credential",
+            "incident-response-team-on-standby"
+          ],
           "estimated_time_hours": 24
         }
       ],
@@ -562,46 +759,87 @@
         "risk": "Even after rotation + purge + hook installation, the prior credential may have been scraped during the exposure window. The credential is revoked, but any data exfiltrated during the window is gone.",
         "why_remains": "Credential exposure is irreversible at the data-exfil level. Revocation prevents future misuse but does not undo prior misuse. Audit log review establishes upper bound on misuse but cannot prove negative for all classes (e.g. provider API calls within normal-looking patterns).",
         "acceptance_level": "ciso",
-        "compensating_controls_in_place": ["credential-rotated", "session-revoked", "audit-log-baseline-captured", "pre-commit-hook-active", "ci-secret-scan-extended-to-build-artifacts"]
+        "compensating_controls_in_place": [
+          "credential-rotated",
+          "session-revoked",
+          "audit-log-baseline-captured",
+          "pre-commit-hook-active",
+          "ci-secret-scan-extended-to-build-artifacts"
+        ]
       },
       "evidence_requirements": [
         {
           "evidence_type": "scan_report",
           "description": "Pre-remediation full working-tree scan output with file paths + line offsets + matched indicator IDs + RWEP per finding. Plus post-remediation rescan showing clean state.",
           "retention_period": "7_years",
-          "framework_satisfied": ["gdpr-art-32", "iso-27001-2022-A.8.24", "soc2-cc6.1", "pci-dss-4-req-3"]
+          "framework_satisfied": [
+            "gdpr-art-32",
+            "iso-27001-2022-A.8.24",
+            "soc2-cc6.1",
+            "pci-dss-4-req-3"
+          ]
         },
         {
           "evidence_type": "log_excerpt",
           "description": "Provider audit log excerpt for the exposure window for each rotated credential.",
           "retention_period": "7_years",
-          "framework_satisfied": ["gdpr-art-33", "soc2-cc7.2", "nis2-art21-2c"]
+          "framework_satisfied": [
+            "gdpr-art-33",
+            "soc2-cc7.2",
+            "nis2-art21-2c"
+          ]
         },
         {
           "evidence_type": "ticket_reference",
           "description": "Rotation ticket(s) with timestamps, approvers, provider rotation confirmation IDs.",
           "retention_period": "7_years",
-          "framework_satisfied": ["soc2-cc8.1", "iso-27001-2022-A.8.32"]
+          "framework_satisfied": [
+            "soc2-cc8.1",
+            "iso-27001-2022-A.8.32"
+          ]
         },
         {
           "evidence_type": "attestation",
           "description": "Signed exceptd attestation: repo identity, scan timestamp, finding count, RWEP at detection, RWEP post-remediation, rotated credential IDs (hashed).",
           "retention_period": "7_years",
-          "framework_satisfied": ["nist-800-53-CA-7", "iso-27001-2022-A.5.36", "nis2-art21-2c"]
+          "framework_satisfied": [
+            "nist-800-53-CA-7",
+            "iso-27001-2022-A.5.36",
+            "nis2-art21-2c"
+          ]
         }
       ],
       "regression_trigger": [
-        { "condition": "pre_commit", "interval": "on_event" },
-        { "condition": "weekly", "interval": "7d" },
-        { "condition": "post_dependency_update", "interval": "on_event" },
-        { "condition": "new_secret_pattern_published", "interval": "on_event" }
+        {
+          "condition": "pre_commit",
+          "interval": "on_event"
+        },
+        {
+          "condition": "weekly",
+          "interval": "7d"
+        },
+        {
+          "condition": "post_dependency_update",
+          "interval": "on_event"
+        },
+        {
+          "condition": "new_secret_pattern_published",
+          "interval": "on_event"
+        }
       ]
     },
-
     "close": {
       "evidence_package": {
         "bundle_format": "json",
-        "contents": ["scan_report", "log_excerpt", "ticket_reference", "attestation", "framework_gap_mapping", "compliance_theater_verdict", "residual_risk_statement"],
+        "contents": [
+          "scan_report",
+          "log_excerpt",
+          "ticket_reference",
+          "attestation",
+          "framework_gap_mapping",
+          "compliance_theater_verdict",
+          "residual_risk_statement"
+        ],
         "destination": "local_only",
         "signed": true
       },
@@ -613,42 +851,63 @@
           "framework_gap": "GDPR Art.32 / ISO A.8.24 / PCI Req.3 / SOC 2 CC6.1 + NIS2 Art.21(2)(j) collectively cover storage backend protection. None name source-artifact exposure as a distinct control class.",
           "new_control_requirement": "Continuous working-tree scanning + pre-commit + pre-receive secret blocking + build-artifact scan + Vault-templated secret enforcement. Source-artifact exposure becomes its own control class with quarterly attestation requirement."
         },
-        "feeds_back_to_skills": ["dlp-gap-analysis", "framework-gap-analysis", "compliance-theater"]
+        "feeds_back_to_skills": [
+          "dlp-gap-analysis",
+          "framework-gap-analysis",
+          "compliance-theater"
+        ]
       },
       "notification_actions": [
         {
           "obligation_ref": "EU/GDPR Art.33 72h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["secret_inventory", "data_subject_impact_assessment", "containment_record"],
+          "evidence_attached": [
+            "secret_inventory",
+            "data_subject_impact_assessment",
+            "containment_record"
+          ],
           "draft_notification": "GDPR Art.33 72-hour notification: Credential exposure event affecting ${credential_count} credential(s) of type ${credential_class}. Exposure window: ${exposure_window}. Affected processing operations: ${processing_operations}. Categories of data subjects potentially affected: ${data_subject_categories}. Containment actions: credentials rotated, sessions revoked, audit logs reviewed for misuse. Risk assessment: ${risk_level}. No notification to data subjects required because ${art34_reasoning} OR notification to data subjects required and being prepared. Contact: ${dpo_contact}."
         },
         {
           "obligation_ref": "EU/GDPR Art.34 72h",
           "deadline": "computed_at_runtime",
           "recipient": "data_subjects",
-          "evidence_attached": ["data_subject_categories_affected", "containment_record"],
+          "evidence_attached": [
+            "data_subject_categories_affected",
+            "containment_record"
+          ],
           "draft_notification": "GDPR Art.34 notification to data subjects (draft for review): We are writing to inform you of a credential exposure incident affecting systems that process your personal data. Affected systems: ${affected_systems}. Exposure window: ${exposure_window}. Containment actions completed: credentials rotated and revoked, audit logs reviewed. Steps you can take: ${recommended_actions}. Our DPO can be reached at ${dpo_contact}."
         },
         {
           "obligation_ref": "EU/NIS2 Art.23 24h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["secret_inventory", "exposure_window_estimate", "rotation_status"],
+          "evidence_attached": [
+            "secret_inventory",
+            "exposure_window_estimate",
+            "rotation_status"
+          ],
           "draft_notification": "NIS2 Art.23 early-warning notification: Credential exposure ${credential_class} on ${affected_system_count} system(s). Suspected window of exposure: ${exposure_window}. Initial containment: credentials rotated. Full incident assessment within 72h per Art.23(4)."
         },
         {
           "obligation_ref": "UK/UK GDPR Art.33 72h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["secret_inventory", "data_subject_impact_assessment"],
+          "evidence_attached": [
+            "secret_inventory",
+            "data_subject_impact_assessment"
+          ],
           "draft_notification": "UK GDPR Art.33 72-hour notification to ICO: Credential exposure event. Mirror of GDPR Art.33 notification body, addressed to ICO casework team."
         },
         {
           "obligation_ref": "US-CA/CCPA / CPRA Sec.1798.82 1440h",
           "deadline": "computed_at_runtime",
           "recipient": "data_subjects",
-          "evidence_attached": ["california_resident_records_affected", "containment_record"],
+          "evidence_attached": [
+            "california_resident_records_affected",
+            "containment_record"
+          ],
           "draft_notification": "California breach notification: We are writing to notify you of a security incident that may have affected your personal information. ${incident_description}. ${types_of_information_affected}. ${steps_taken}. ${steps_individuals_can_take}. ${contact_information}."
         }
       ],
@@ -657,7 +916,12 @@
         "exception_template": {
           "scope": "Credential of class ${credential_class} (${credential_id_hash}) cannot be rotated within ${obligation_window} due to ${blocking_reason}.",
           "duration": "until_vendor_patch",
-          "compensating_controls": ["enhanced-audit-log-alerting-on-credential-use", "incident-response-team-on-standby", "ip-allowlist-tightened-on-credential", "rate-limit-on-credential-tightened"],
+          "compensating_controls": [
+            "enhanced-audit-log-alerting-on-credential-use",
+            "incident-response-team-on-standby",
+            "ip-allowlist-tightened-on-credential",
+            "rate-limit-on-credential-tightened"
+          ],
           "risk_acceptance_owner": "ciso",
           "auditor_ready_language": "Pursuant to ${framework_id} ${control_id}, the organization documents a time-bound risk acceptance for unrotated credential ${credential_class} (${credential_id_hash}) on ${affected_system_count} system(s). Blocking reason: ${blocking_reason_narrative}. Rotation ETA: ${rotation_eta}. Compensating controls in place: ${compensating_controls}. Residual exposure: credential remains valid; provider audit logs are reviewed daily during the exception window for misuse indicators. Risk accepted by ${ciso_name} on ${acceptance_date}. Time-bound until ${duration_expiry} OR rotation completion, whichever is first. Detection coverage is provided by ${detection_controls}. The exception will be re-evaluated on (a) rotation completion, (b) listed expiry date, (c) any audit-log anomaly on the credential — whichever is first."
         }
@@ -669,22 +933,27 @@
       }
     }
   },
-
   "directives": [
     {
       "id": "full-repo-secret-scan",
       "title": "Full working-tree secret scan with all catalogued patterns + permission checks",
-      "applies_to": { "always": true }
+      "applies_to": {
+        "always": true
+      }
     },
     {
       "id": "high-velocity-credentials",
       "title": "Targeted directive — AWS / GCP / GitHub / OpenAI / Anthropic high-velocity credentials",
-      "applies_to": { "attack_technique": "T1552.001" }
+      "applies_to": {
+        "attack_technique": "T1552.001"
+      }
     },
     {
       "id": "private-key-material",
       "title": "Targeted directive — SSH/PEM private key material in working tree",
-      "applies_to": { "attack_technique": "T1552.004" }
+      "applies_to": {
+        "attack_technique": "T1552.004"
+      }
     }
   ]
 }