@blamejs/exceptd-skills 0.10.0 → 0.10.1

package/data/playbooks/cred-stores.json

@@ -9,11 +9,17 @@
         "version": "1.0.0",
         "date": "2026-05-11",
         "summary": "Initial seven-phase credential-store inventory playbook. Inspects ~/.aws/credentials, ~/.kube/config, ~/.config/gcloud/credentials.db, ~/.docker/config.json, ~/.npmrc, ~/.pypirc, GPG keychain. Distinguishes long-lived static credentials from short-lived federated (SSO-issued kube tokens, IAM Identity Center / Workforce Identity / OIDC-issued service account tokens). Reports identity-assurance posture per store with framework-gap mapping.",
-        "framework_gaps_updated": ["nist-800-53-IA-5", "nist-800-63b-aal", "iso-27001-2022-A.5.16", "nis2-art21-2j"]
+        "framework_gaps_updated": [
+          "nist-800-53-IA-5",
+          "nist-800-63b-aal",
+          "iso-27001-2022-A.5.16",
+          "nis2-art21-2j"
+        ]
       }
     ],
     "owner": "@blamejs/identity",
     "air_gap_mode": true,
+    "scope": "system",
     "preconditions": [
       {
         "id": "home-dir-readable",
@@ -34,23 +40,42 @@
       }
     ]
   },
-
   "domain": {
     "name": "Per-user credential store inventory + identity-assurance posture",
     "attack_class": "identity-abuse",
     "atlas_refs": [],
-    "attack_refs": ["T1078", "T1552.001", "T1552.004", "T1528", "T1606.001"],
+    "attack_refs": [
+      "T1078",
+      "T1552.001",
+      "T1552.004",
+      "T1528",
+      "T1606.001"
+    ],
     "cve_refs": [],
-    "cwe_refs": ["CWE-522", "CWE-256", "CWE-798", "CWE-732"],
-    "d3fend_refs": ["D3-CAA", "D3-FCR", "D3-ANCI"],
+    "cwe_refs": [
+      "CWE-522",
+      "CWE-256",
+      "CWE-798",
+      "CWE-732"
+    ],
+    "d3fend_refs": [
+      "D3-CAA",
+      "D3-FCR",
+      "D3-ANCI"
+    ],
     "frameworks_in_scope": [
-      "nist-800-53", "iso-27001-2022", "soc2", "pci-dss-4",
-      "nis2", "dora", "uk-caf", "au-ism", "au-essential-8"
+      "nist-800-53",
+      "iso-27001-2022",
+      "soc2",
+      "pci-dss-4",
+      "nis2",
+      "dora",
+      "uk-caf",
+      "au-ism",
+      "au-essential-8"
     ]
   },
-
   "phases": {
-
     "govern": {
       "jurisdiction_obligations": [
         {
@@ -59,7 +84,11 @@
           "obligation": "notify_regulator",
           "window_hours": 24,
           "clock_starts": "detect_confirmed",
-          "evidence_required": ["credential_inventory", "exposure_window_estimate", "rotation_status"]
+          "evidence_required": [
+            "credential_inventory",
+            "exposure_window_estimate",
+            "rotation_status"
+          ]
         },
         {
           "jurisdiction": "EU",
@@ -67,7 +96,10 @@
           "obligation": "notify_regulator",
           "window_hours": 4,
           "clock_starts": "detect_confirmed",
-          "evidence_required": ["initial_notification", "ict_third_party_dependencies"]
+          "evidence_required": [
+            "initial_notification",
+            "ict_third_party_dependencies"
+          ]
         },
         {
           "jurisdiction": "EU",
@@ -75,7 +107,10 @@
           "obligation": "notify_regulator",
           "window_hours": 72,
           "clock_starts": "detect_confirmed",
-          "evidence_required": ["credential_inventory", "data_subject_impact_assessment"]
+          "evidence_required": [
+            "credential_inventory",
+            "data_subject_impact_assessment"
+          ]
         },
         {
           "jurisdiction": "AU",
@@ -83,7 +118,10 @@
           "obligation": "notify_regulator",
           "window_hours": 72,
           "clock_starts": "validate_complete",
-          "evidence_required": ["materiality_assessment", "remediation_completed_evidence"]
+          "evidence_required": [
+            "materiality_assessment",
+            "remediation_completed_evidence"
+          ]
         }
       ],
       "theater_fingerprints": [
@@ -91,25 +129,41 @@
           "pattern_id": "sso-attested-but-aws-static-keys-live",
           "claim": "We use SSO / Identity Center / Workforce Identity for all cloud access — no static keys.",
           "fast_detection_test": "Cat ~/.aws/credentials. If file is non-empty AND contains an [profile] block with aws_access_key_id (not just aws_sso_session-shaped config), SSO attestation is incomplete. Repeat for ~/.config/gcloud/credentials.db (sqlite query for service_account-shaped rows) and ~/.kube/config (token: field with no exec: federated flow).",
-          "implicated_controls": ["nist-800-53-IA-2", "iso-27001-2022-A.5.16", "soc2-cc6.1"]
+          "implicated_controls": [
+            "nist-800-53-IA-2",
+            "iso-27001-2022-A.5.16",
+            "soc2-cc6.1"
+          ]
         },
         {
           "pattern_id": "mfa-attested-but-pat-bypasses",
           "claim": "MFA is enforced for all developer access.",
           "fast_detection_test": "GitHub PATs, NPM tokens, PyPI tokens, container registry tokens bypass MFA by design — they are long-lived bearer tokens. Inspect ~/.npmrc, ~/.pypirc, ~/.docker/config.json for raw tokens. Any non-OAuth-flow token is an MFA bypass primitive whose existence undermines the MFA attestation.",
-          "implicated_controls": ["nist-800-53-IA-2(1)", "iso-27001-2022-A.5.17", "pci-dss-4-req-8.4"]
+          "implicated_controls": [
+            "nist-800-53-IA-2(1)",
+            "iso-27001-2022-A.5.17",
+            "pci-dss-4-req-8.4"
+          ]
         },
         {
           "pattern_id": "passkey-attested-but-ssh-keys-stale",
           "claim": "Passkeys / FIDO2 are deployed for all auth — phishing-resistant.",
           "fast_detection_test": "ls -la ~/.ssh/ and check mtime on private keys. SSH keys older than 12 months on a workstation that's been online during that time are stale credentials that exist outside the FIDO2 trust model. Any FIDO2 / Passkey attestation that does not also address legacy SSH key lifecycle is incomplete.",
-          "implicated_controls": ["nist-800-63b-aal3", "iso-27001-2022-A.5.16", "uk-caf-b2"]
+          "implicated_controls": [
+            "nist-800-63b-aal3",
+            "iso-27001-2022-A.5.16",
+            "uk-caf-b2"
+          ]
         },
         {
           "pattern_id": "credential-age-not-tracked",
           "claim": "Credentials are rotated quarterly per policy.",
           "fast_detection_test": "Stat each credential file: mtime is the upper bound on credential age. If any ~/.aws/credentials or ~/.kube/config or ~/.docker/config.json mtime is > 90 days, the policy is not enforced on this workstation. Compare against the policy text: if policy says 'rotated' but no rotation cadence is technically enforced, it is theater.",
-          "implicated_controls": ["nist-800-53-IA-5(1)", "iso-27001-2022-A.5.17", "pci-dss-4-req-8.3.7"]
+          "implicated_controls": [
+            "nist-800-53-IA-5(1)",
+            "iso-27001-2022-A.5.17",
+            "pci-dss-4-req-8.3.7"
+          ]
         }
       ],
       "framework_context": {
@@ -148,9 +202,13 @@
           }
         ]
       },
-      "skill_preload": ["identity-assurance", "framework-gap-analysis", "compliance-theater", "policy-exception-gen"]
+      "skill_preload": [
+        "identity-assurance",
+        "framework-gap-analysis",
+        "compliance-theater",
+        "policy-exception-gen"
+      ]
     },
-
     "direct": {
       "threat_context": "Developer workstation credential harvest is the dominant 2025-2026 cloud-account-compromise vector. Mandiant / CrowdStrike Q1 2026 IR data: ~38% of cloud account intrusions traced to harvest of ~/.aws/credentials, ~/.kube/config, ~/.config/gcloud, or ~/.npmrc on a developer endpoint. Stealer malware families (Lumma, Rhadamanthys, Stealc) ship dedicated parsers for these files. AI-coding-assistant agentic flows expand the attack surface: any tool a developer trusts to read their workspace can be prompt-injected to exfiltrate these stores. Identity-assurance posture matters: workstations using exclusively federated short-lived credentials (SSO → STS:AssumeRoleWithWebIdentity → 1h credentials in ~/.aws/cli/cache) deny the harvest its target; workstations with long-lived static credentials provide it directly. Frameworks attest AAL3 + SSO without requiring the workstation-inventory evidence that distinguishes the two postures.",
       "rwep_threshold": {
@@ -160,10 +218,27 @@
       },
       "framework_lag_declaration": "NIST 800-63b AAL specs, NIST 800-53 IA-2/IA-5, ISO A.5.16/A.5.17, NIS2 Art.21(2)(j), PCI-DSS Req.8 collectively specify target authenticator properties (phishing-resistant, short-lived, MFA-gated). They do not require enumeration of credentials actually present on developer endpoints. SSO + MFA attestation is accepted as evidence even when local credential stores hold long-lived bearer tokens that bypass SSO. Gap = ~25 days between credential-store drift (new PAT issued, new long-lived AWS key created) and any framework's review cadence.",
       "skill_chain": [
-        { "skill": "identity-assurance", "purpose": "Score each inventoried credential against AAL/IAL/FAL framework. Distinguish AAL3 short-lived from AAL1 long-lived. Map to NIST 800-63 obligations.", "required": true },
-        { "skill": "framework-gap-analysis", "purpose": "Map credential-store findings to which IA/A.5 controls claim to cover them and where the gap is.", "required": true },
-        { "skill": "compliance-theater", "purpose": "Run the theater test on the org's SSO / MFA / passkey attestation against the live credential-store state.", "required": true },
-        { "skill": "policy-exception-gen", "purpose": "Generate auditor-ready exception language for long-lived credentials that cannot be eliminated (e.g. CI bootstrap secrets, legacy SaaS without OIDC).", "skip_if": "close.exception_generation.trigger_condition == false", "required": false }
+        {
+          "skill": "identity-assurance",
+          "purpose": "Score each inventoried credential against AAL/IAL/FAL framework. Distinguish AAL3 short-lived from AAL1 long-lived. Map to NIST 800-63 obligations.",
+          "required": true
+        },
+        {
+          "skill": "framework-gap-analysis",
+          "purpose": "Map credential-store findings to which IA/A.5 controls claim to cover them and where the gap is.",
+          "required": true
+        },
+        {
+          "skill": "compliance-theater",
+          "purpose": "Run the theater test on the org's SSO / MFA / passkey attestation against the live credential-store state.",
+          "required": true
+        },
+        {
+          "skill": "policy-exception-gen",
+          "purpose": "Generate auditor-ready exception language for long-lived credentials that cannot be eliminated (e.g. CI bootstrap secrets, legacy SaaS without OIDC).",
+          "skip_if": "close.exception_generation.trigger_condition == false",
+          "required": false
+        }
       ],
       "token_budget": {
         "estimated_total": 18000,
@@ -178,7 +253,6 @@
         }
       }
     },
-
     "look": {
       "artifacts": [
         {
@@ -288,18 +362,53 @@
         }
       ],
       "fallback_if_unavailable": [
-        { "artifact_id": "aws-credentials", "fallback_action": "mark_inconclusive", "confidence_impact": "high" },
-        { "artifact_id": "kube-config", "fallback_action": "mark_inconclusive", "confidence_impact": "high" },
-        { "artifact_id": "gcloud-credentials", "fallback_action": "mark_inconclusive", "confidence_impact": "high" },
-        { "artifact_id": "docker-config", "fallback_action": "mark_inconclusive", "confidence_impact": "medium" },
-        { "artifact_id": "npmrc", "fallback_action": "mark_inconclusive", "confidence_impact": "medium" },
-        { "artifact_id": "pypirc", "fallback_action": "mark_inconclusive", "confidence_impact": "medium" },
-        { "artifact_id": "gpg-keys", "fallback_action": "use_compensating_artifact", "confidence_impact": "low" },
-        { "artifact_id": "ssh-keys-inventory", "fallback_action": "escalate_to_human", "confidence_impact": "high" },
-        { "artifact_id": "keychain-inventory", "fallback_action": "mark_inconclusive", "confidence_impact": "low" }
+        {
+          "artifact_id": "aws-credentials",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "kube-config",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "gcloud-credentials",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "docker-config",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "npmrc",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "pypirc",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "gpg-keys",
+          "fallback_action": "use_compensating_artifact",
+          "confidence_impact": "low"
+        },
+        {
+          "artifact_id": "ssh-keys-inventory",
+          "fallback_action": "escalate_to_human",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "keychain-inventory",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "low"
+        }
       ]
     },
-
     "detect": {
       "indicators": [
         {
@@ -431,27 +540,91 @@
         "not_detected": "All credential stores inspected AND no deterministic indicators fired AND all-stores-empty-or-federated fires positively AND all credential files have mode 0600."
       }
     },
-
     "analyze": {
       "rwep_inputs": [
-        { "signal_id": "aws-static-key-present", "rwep_factor": "active_exploitation", "weight": 30, "notes": "Stealer malware ships dedicated AWS-credentials parsers. Treat as exploitation-imminent on any compromised endpoint." },
-        { "signal_id": "kube-static-token", "rwep_factor": "active_exploitation", "weight": 25, "notes": "Static kube tokens enable cluster pivot; ATT&CK T1528 in published threat actor playbooks." },
-        { "signal_id": "gcp-service-account-json-adc", "rwep_factor": "active_exploitation", "weight": 30, "notes": "Service account JSON = same risk class as AWS access keys." },
-        { "signal_id": "docker-cleartext-auth", "rwep_factor": "blast_radius", "weight": 15, "notes": "Registry compromise = supply-chain pivot." },
-        { "signal_id": "npm-pat-present", "rwep_factor": "active_exploitation", "weight": 25, "notes": "Publish-capable NPM PAT = supply-chain attack primitive (event-stream, ua-parser-js, chalk classes of incidents)." },
-        { "signal_id": "pypi-token-present", "rwep_factor": "active_exploitation", "weight": 25, "notes": "PyPI publish token = same supply-chain pattern as NPM." },
-        { "signal_id": "ssh-key-rsa-short-bits", "rwep_factor": "ai_weaponization", "weight": 5, "notes": "AI-accelerated cryptanalysis is not yet a practical threat to RSA-2048, but DSA + RSA-1024 cracking is operational." },
-        { "signal_id": "ssh-key-old", "rwep_factor": "blast_radius", "weight": 10, "notes": "Stale key = unknown exposure history." },
-        { "signal_id": "credentials-file-bad-perms", "rwep_factor": "active_exploitation", "weight": 20, "notes": "Permissive perms on a creds file = same-host LPE chains to credential theft." }
+        {
+          "signal_id": "aws-static-key-present",
+          "rwep_factor": "active_exploitation",
+          "weight": 30,
+          "notes": "Stealer malware ships dedicated AWS-credentials parsers. Treat as exploitation-imminent on any compromised endpoint."
+        },
+        {
+          "signal_id": "kube-static-token",
+          "rwep_factor": "active_exploitation",
+          "weight": 25,
+          "notes": "Static kube tokens enable cluster pivot; ATT&CK T1528 in published threat actor playbooks."
+        },
+        {
+          "signal_id": "gcp-service-account-json-adc",
+          "rwep_factor": "active_exploitation",
+          "weight": 30,
+          "notes": "Service account JSON = same risk class as AWS access keys."
+        },
+        {
+          "signal_id": "docker-cleartext-auth",
+          "rwep_factor": "blast_radius",
+          "weight": 15,
+          "notes": "Registry compromise = supply-chain pivot."
+        },
+        {
+          "signal_id": "npm-pat-present",
+          "rwep_factor": "active_exploitation",
+          "weight": 25,
+          "notes": "Publish-capable NPM PAT = supply-chain attack primitive (event-stream, ua-parser-js, chalk classes of incidents)."
+        },
+        {
+          "signal_id": "pypi-token-present",
+          "rwep_factor": "active_exploitation",
+          "weight": 25,
+          "notes": "PyPI publish token = same supply-chain pattern as NPM."
+        },
+        {
+          "signal_id": "ssh-key-rsa-short-bits",
+          "rwep_factor": "ai_weaponization",
+          "weight": 5,
+          "notes": "AI-accelerated cryptanalysis is not yet a practical threat to RSA-2048, but DSA + RSA-1024 cracking is operational."
+        },
+        {
+          "signal_id": "ssh-key-old",
+          "rwep_factor": "blast_radius",
+          "weight": 10,
+          "notes": "Stale key = unknown exposure history."
+        },
+        {
+          "signal_id": "credentials-file-bad-perms",
+          "rwep_factor": "active_exploitation",
+          "weight": 20,
+          "notes": "Permissive perms on a creds file = same-host LPE chains to credential theft."
+        }
       ],
       "blast_radius_model": {
         "scope_question": "Given the inventoried credential stores, what is the realistic blast radius if this endpoint is compromised by stealer malware or a prompt-injected agent?",
         "scoring_rubric": [
-          { "condition": "All stores empty or federated (all-stores-empty-or-federated fires), all permissions correct, SSH keys ed25519 + recent + agent-mediated", "blast_radius_score": 1, "description": "Endpoint compromise yields no useful long-lived credentials. AAL3-equivalent." },
-          { "condition": "One static credential present in a single bounded scope (e.g. one read-only PAT) AND federated paths exist for all primary providers", "blast_radius_score": 2, "description": "Limited bounded scope from one static credential. Cleanup feasible without org-wide impact." },
-          { "condition": "Multiple static credentials across one provider OR a single static credential with broad scope (admin / wildcard / cross-account-trust)", "blast_radius_score": 3, "description": "Provider-account-level pivot from a single endpoint compromise." },
-          { "condition": "Static credentials across multiple providers (cloud + SCM + registry) OR publish-capable supply-chain token (NPM/PyPI/container) present", "blast_radius_score": 4, "description": "Cross-provider pivot + supply-chain attack primitive." },
-          { "condition": "All of: static cloud admin key + publish-capable supply-chain token + permissive permissions + stale SSH keys", "blast_radius_score": 5, "description": "Maximum endpoint-derived blast radius. Identity boundary collapse from this single compromise." }
+          {
+            "condition": "All stores empty or federated (all-stores-empty-or-federated fires), all permissions correct, SSH keys ed25519 + recent + agent-mediated",
+            "blast_radius_score": 1,
+            "description": "Endpoint compromise yields no useful long-lived credentials. AAL3-equivalent."
+          },
+          {
+            "condition": "One static credential present in a single bounded scope (e.g. one read-only PAT) AND federated paths exist for all primary providers",
+            "blast_radius_score": 2,
+            "description": "Limited bounded scope from one static credential. Cleanup feasible without org-wide impact."
+          },
+          {
+            "condition": "Multiple static credentials across one provider OR a single static credential with broad scope (admin / wildcard / cross-account-trust)",
+            "blast_radius_score": 3,
+            "description": "Provider-account-level pivot from a single endpoint compromise."
+          },
+          {
+            "condition": "Static credentials across multiple providers (cloud + SCM + registry) OR publish-capable supply-chain token (NPM/PyPI/container) present",
+            "blast_radius_score": 4,
+            "description": "Cross-provider pivot + supply-chain attack primitive."
+          },
+          {
+            "condition": "All of: static cloud admin key + publish-capable supply-chain token + permissive permissions + stale SSH keys",
+            "blast_radius_score": 5,
+            "description": "Maximum endpoint-derived blast radius. Identity boundary collapse from this single compromise."
+          }
         ]
       },
       "compliance_theater_check": {
@@ -491,59 +664,98 @@
         }
       ],
       "escalation_criteria": [
-        { "condition": "rwep >= 90 AND credential_is_publish_capable == true", "action": "page_on_call" },
-        { "condition": "blast_radius_score >= 4", "action": "trigger_playbook", "target_playbook": "secrets" },
-        { "condition": "compliance_theater_check.verdict == 'theater' AND jurisdiction_obligations contains 'EU'", "action": "notify_legal" },
-        { "condition": "any_static_admin_credential == true", "action": "raise_severity" }
+        {
+          "condition": "rwep >= 90 AND credential_is_publish_capable == true",
+          "action": "page_on_call"
+        },
+        {
+          "condition": "blast_radius_score >= 4",
+          "action": "trigger_playbook",
+          "target_playbook": "secrets"
+        },
+        {
+          "condition": "compliance_theater_check.verdict == 'theater' AND jurisdiction_obligations contains 'EU'",
+          "action": "notify_legal"
+        },
+        {
+          "condition": "any_static_admin_credential == true",
+          "action": "raise_severity"
+        }
       ]
     },
-
     "validate": {
       "remediation_paths": [
         {
           "id": "migrate-aws-to-sso",
           "description": "Replace static aws_access_key_id entries with sso_session profiles using IAM Identity Center (or AWS SSO). Remove old key from ~/.aws/credentials AND deactivate at IAM console.",
-          "preconditions": ["org_has_identity_center == true", "user_enrolled_in_sso == true"],
+          "preconditions": [
+            "org_has_identity_center == true",
+            "user_enrolled_in_sso == true"
+          ],
           "priority": 1,
-          "compensating_controls": ["iam-key-deactivated", "cloudtrail-monitor-on-old-key-for-residual-use"],
+          "compensating_controls": [
+            "iam-key-deactivated",
+            "cloudtrail-monitor-on-old-key-for-residual-use"
+          ],
           "estimated_time_hours": 1
         },
         {
           "id": "migrate-gcp-to-workforce-identity",
           "description": "Replace ~/.config/gcloud/application_default_credentials.json service_account with workforce identity (gcloud auth login or workforce-pool federation). Delete the service account key at GCP console.",
-          "preconditions": ["org_has_workforce_identity_pool == true OR user_has_authorized_user_credentials == true"],
+          "preconditions": [
+            "org_has_workforce_identity_pool == true OR user_has_authorized_user_credentials == true"
+          ],
           "priority": 1,
-          "compensating_controls": ["gcp-key-deleted", "gcp-audit-log-monitor-on-old-key"],
+          "compensating_controls": [
+            "gcp-key-deleted",
+            "gcp-audit-log-monitor-on-old-key"
+          ],
           "estimated_time_hours": 1
         },
         {
           "id": "migrate-kube-to-oidc",
           "description": "Replace static token: kubeconfig entries with exec: hooks (oidc-login, aws eks get-token, gke-gcloud-auth-plugin). Revoke old service-account token via kubectl delete secret.",
-          "preconditions": ["cluster_supports_oidc == true OR cluster_is_managed_cloud_k8s == true"],
+          "preconditions": [
+            "cluster_supports_oidc == true OR cluster_is_managed_cloud_k8s == true"
+          ],
           "priority": 1,
-          "compensating_controls": ["kube-token-revoked", "k8s-audit-log-monitor-on-old-token"],
+          "compensating_controls": [
+            "kube-token-revoked",
+            "k8s-audit-log-monitor-on-old-token"
+          ],
           "estimated_time_hours": 1
         },
         {
           "id": "migrate-docker-to-cred-helpers",
           "description": "Replace ~/.docker/config.json auths.auth with credHelpers/credsStore directives routing to OS keychain or cloud-IAM (ecr-login, gcloud, acr).",
-          "preconditions": ["target_registry_supports_cred_helper == true"],
+          "preconditions": [
+            "target_registry_supports_cred_helper == true"
+          ],
           "priority": 1,
-          "compensating_controls": ["docker-token-rotated"],
+          "compensating_controls": [
+            "docker-token-rotated"
+          ],
           "estimated_time_hours": 0.5
         },
         {
           "id": "rotate-supply-chain-tokens",
           "description": "For ~/.npmrc / ~/.pypirc tokens: rotate AND scope down (read-only where possible) AND move to OS keychain (npm config set _authToken in keychain-backed config OR pypi via keyring backend).",
-          "preconditions": ["org_authority_to_rotate == true"],
+          "preconditions": [
+            "org_authority_to_rotate == true"
+          ],
           "priority": 2,
-          "compensating_controls": ["token-scope-tightened", "publish-mfa-required"],
+          "compensating_controls": [
+            "token-scope-tightened",
+            "publish-mfa-required"
+          ],
           "estimated_time_hours": 1
         },
         {
           "id": "fix-credentials-perms",
           "description": "chmod 0600 on all credential files; chmod 0700 on ~/.config/gcloud/, ~/.aws/, ~/.ssh/.",
-          "preconditions": ["file_owner_is_current_user"],
+          "preconditions": [
+            "file_owner_is_current_user"
+          ],
           "priority": 2,
           "compensating_controls": [],
           "estimated_time_hours": 0.25
@@ -551,17 +763,27 @@
         {
           "id": "modernize-ssh-keys",
           "description": "Generate fresh ed25519 SSH key; deploy public key to all currently-authorized hosts; remove old RSA/DSA private keys from disk. Optionally use ssh-agent + Yubikey for hardware backing.",
-          "preconditions": ["all_authorized_hosts_known == true"],
+          "preconditions": [
+            "all_authorized_hosts_known == true"
+          ],
           "priority": 2,
-          "compensating_controls": ["ssh-key-inventory-updated"],
+          "compensating_controls": [
+            "ssh-key-inventory-updated"
+          ],
           "estimated_time_hours": 2
         },
         {
           "id": "policy-exception",
           "description": "If static credential cannot be eliminated (e.g. legacy SaaS without OIDC), generate exception with bounded compensating controls and time-bound rotation cadence.",
-          "preconditions": ["federated_alternative_unavailable == true"],
+          "preconditions": [
+            "federated_alternative_unavailable == true"
+          ],
           "priority": 4,
-          "compensating_controls": ["credential-vaulted", "rotation-cadence-30d", "audit-log-monitor-on-credential"],
+          "compensating_controls": [
+            "credential-vaulted",
+            "rotation-cadence-30d",
+            "audit-log-monitor-on-credential"
+          ],
           "estimated_time_hours": 4
         }
       ],
@@ -601,46 +823,84 @@
         "risk": "Even after migration to federated identity, transient short-lived tokens (~/.aws/cli/cache/*.json, ~/.config/gcloud/access_tokens.db, ~/.kube/cache/) remain on disk during their TTL. Stealer malware that runs during a session window can still harvest live federated tokens.",
         "why_remains": "Short-lived tokens still exist; the trade-off is shorter exposure window (1h vs. perpetual) but not zero. The compensating control is endpoint protection + IdP risk-based authentication (impossible-travel, device-binding), not absence of tokens-on-disk.",
         "acceptance_level": "manager",
-        "compensating_controls_in_place": ["all-federated-paths", "edr-active-on-endpoint", "idp-risk-based-authn", "quarterly-credential-inventory-cadence"]
+        "compensating_controls_in_place": [
+          "all-federated-paths",
+          "edr-active-on-endpoint",
+          "idp-risk-based-authn",
+          "quarterly-credential-inventory-cadence"
+        ]
       },
       "evidence_requirements": [
         {
           "evidence_type": "scan_report",
           "description": "Pre-remediation credential-store inventory + post-remediation rescan.",
           "retention_period": "1_year",
-          "framework_satisfied": ["nist-800-53-IA-2", "nist-800-53-IA-5", "iso-27001-2022-A.5.16"]
+          "framework_satisfied": [
+            "nist-800-53-IA-2",
+            "nist-800-53-IA-5",
+            "iso-27001-2022-A.5.16"
+          ]
         },
         {
           "evidence_type": "log_excerpt",
           "description": "Provider audit log excerpt for the lifetime of each rotated credential.",
           "retention_period": "7_years",
-          "framework_satisfied": ["nis2-art21-2c", "soc2-cc7.2"]
+          "framework_satisfied": [
+            "nis2-art21-2c",
+            "soc2-cc7.2"
+          ]
         },
         {
           "evidence_type": "ticket_reference",
           "description": "Credential rotation tickets at each provider; SSO/Workforce Identity migration approvals.",
           "retention_period": "7_years",
-          "framework_satisfied": ["soc2-cc8.1", "iso-27001-2022-A.8.32"]
+          "framework_satisfied": [
+            "soc2-cc8.1",
+            "iso-27001-2022-A.8.32"
+          ]
         },
         {
           "evidence_type": "attestation",
           "description": "Signed exceptd attestation: user identity, endpoint identity, inventory hash, RWEP at detection, RWEP post-remediation, AAL claimed/supported by evidence.",
           "retention_period": "7_years",
-          "framework_satisfied": ["nist-800-63b-aal", "nist-800-53-CA-7", "iso-27001-2022-A.5.36"]
+          "framework_satisfied": [
+            "nist-800-63b-aal",
+            "nist-800-53-CA-7",
+            "iso-27001-2022-A.5.36"
+          ]
         }
       ],
       "regression_trigger": [
-        { "condition": "monthly", "interval": "30d" },
-        { "condition": "post_new_provider_onboarded", "interval": "on_event" },
-        { "condition": "post_employee_role_change", "interval": "on_event" },
-        { "condition": "post_credential_compromise_incident", "interval": "on_event" }
+        {
+          "condition": "monthly",
+          "interval": "30d"
+        },
+        {
+          "condition": "post_new_provider_onboarded",
+          "interval": "on_event"
+        },
+        {
+          "condition": "post_employee_role_change",
+          "interval": "on_event"
+        },
+        {
+          "condition": "post_credential_compromise_incident",
+          "interval": "on_event"
+        }
       ]
     },
-
     "close": {
       "evidence_package": {
         "bundle_format": "json",
-        "contents": ["scan_report", "log_excerpt", "ticket_reference", "attestation", "framework_gap_mapping", "compliance_theater_verdict", "residual_risk_statement"],
+        "contents": [
+          "scan_report",
+          "log_excerpt",
+          "ticket_reference",
+          "attestation",
+          "framework_gap_mapping",
+          "compliance_theater_verdict",
+          "residual_risk_statement"
+        ],
         "destination": "local_only",
         "signed": true
       },
@@ -652,28 +912,42 @@
           "framework_gap": "NIST 800-63 AAL specifies target authenticators, not bypass-credential exclusion. NIST 800-53 IA family names password authenticators, not all bearer-token authenticators. ISO and NIS2 are policy-shaped on identity lifecycle.",
           "new_control_requirement": "Quarterly endpoint-credential-store inventory required for all users in scope of an AAL3 attestation. Static-credential presence on an AAL3-attested user's endpoint = automatic finding requiring remediation OR documented exception."
         },
-        "feeds_back_to_skills": ["identity-assurance", "framework-gap-analysis", "compliance-theater"]
+        "feeds_back_to_skills": [
+          "identity-assurance",
+          "framework-gap-analysis",
+          "compliance-theater"
+        ]
       },
       "notification_actions": [
         {
           "obligation_ref": "EU/NIS2 Art.23 24h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["credential_inventory", "exposure_window_estimate", "rotation_status"],
+          "evidence_attached": [
+            "credential_inventory",
+            "exposure_window_estimate",
+            "rotation_status"
+          ],
           "draft_notification": "NIS2 Art.23 early-warning notification: Credential-store finding on ${affected_user_count} user endpoint(s); static long-lived credentials identified across ${provider_count} provider(s). Credentials rotated to federated equivalents. Exposure window: ${exposure_window}. Full incident assessment within 72h per Art.23(4)."
         },
         {
           "obligation_ref": "EU/DORA Art.19 4h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["initial_notification", "ict_third_party_dependencies"],
+          "evidence_attached": [
+            "initial_notification",
+            "ict_third_party_dependencies"
+          ],
           "draft_notification": "DORA Art.19 initial notification: Major ICT-related incident — endpoint credential exposure on financial-entity user endpoint(s). ICT third-party dependencies: ${ict_dependencies}. Full classification + impact assessment to follow within statutory windows."
         },
         {
           "obligation_ref": "EU/GDPR Art.33 72h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["credential_inventory", "data_subject_impact_assessment"],
+          "evidence_attached": [
+            "credential_inventory",
+            "data_subject_impact_assessment"
+          ],
           "draft_notification": "GDPR Art.33 72-hour notification: Endpoint credential exposure event affecting credentials with potential access to systems processing personal data. Categories of data subjects potentially affected: ${data_subject_categories}. Containment: credentials rotated; provider audit logs reviewed for misuse window."
         }
       ],
@@ -682,7 +956,13 @@
         "exception_template": {
           "scope": "Static credential of class ${credential_class} for provider ${provider_name} on user endpoint(s) ${affected_endpoint_count}; federated alternative unavailable due to ${blocking_reason}.",
           "duration": "until_next_audit",
-          "compensating_controls": ["credential-vaulted-with-passphrase", "rotation-cadence-30d", "audit-log-monitor-on-credential", "edr-alert-on-credential-file-read", "ip-allowlist-tightened"],
+          "compensating_controls": [
+            "credential-vaulted-with-passphrase",
+            "rotation-cadence-30d",
+            "audit-log-monitor-on-credential",
+            "edr-alert-on-credential-file-read",
+            "ip-allowlist-tightened"
+          ],
           "risk_acceptance_owner": "ciso",
           "auditor_ready_language": "Pursuant to ${framework_id} ${control_id}, the organization documents a time-bound risk acceptance for static credential ${credential_class} on ${affected_endpoint_count} endpoint(s). Provider: ${provider_name}. Blocking reason for federation: ${blocking_reason_narrative}. Compensating controls in place: credential vaulted with passphrase-on-use; ${rotation_cadence_days}-day forced rotation; provider audit log monitored daily for anomalous use; EDR alerts on read of the credential file outside the documented use pattern. Residual exposure: static credential remains valid during its rotation window; vaulting + passphrase reduces but does not eliminate stealer-malware harvest if endpoint is fully compromised. Risk accepted by ${ciso_name} on ${acceptance_date}. Time-bound until ${duration_expiry} OR provider OIDC availability, whichever is first. The exception will be re-evaluated on (a) provider OIDC availability, (b) listed expiry date, (c) any audit-log anomaly on the credential — whichever is first."
         }
@@ -694,22 +974,27 @@
       }
     }
   },
-
   "directives": [
     {
       "id": "full-credential-store-inventory",
       "title": "Full per-user credential-store inventory across cloud, k8s, container registry, package managers, SSH, GPG",
-      "applies_to": { "always": true }
+      "applies_to": {
+        "always": true
+      }
     },
     {
       "id": "cloud-static-keys",
       "title": "Targeted directive — long-lived cloud credentials (AWS access keys, GCP service account JSON, Azure SP secrets)",
-      "applies_to": { "attack_technique": "T1552.001" }
+      "applies_to": {
+        "attack_technique": "T1552.001"
+      }
     },
     {
       "id": "supply-chain-tokens",
       "title": "Targeted directive — publish-capable package-manager tokens (NPM, PyPI, container registry)",
-      "applies_to": { "attack_technique": "T1528" }
+      "applies_to": {
+        "attack_technique": "T1528"
+      }
     }
   ]
 }