@blamejs/exceptd-skills 0.10.0 → 0.10.1

package/data/playbooks/hardening.json

@@ -9,11 +9,18 @@
         "version": "1.0.0",
         "date": "2026-05-11",
         "summary": "Initial seven-phase Linux hardening posture playbook. Inventories kernel hardening flags (/proc/sys/kernel/*, /proc/cmdline), CPU mitigation status (/sys/devices/system/cpu/vulnerabilities), sysctl posture, sshd_config, sudoers structure, PAM stack, and MAC posture (SELinux/AppArmor). This is the posture corroborator that the kernel playbook references — kernel.json answers 'is the running kernel in a vulnerable affected_versions range?', hardening.json answers 'and even if it is, do the hardening flags actually permit the exploit's primitive?'.",
-        "framework_gaps_updated": ["nist-800-53-CM-6", "nist-800-53-CM-7", "iso-27001-2022-A.8.9", "cmmc-cm-l2-3.4.2", "au-essential-8-application-hardening"]
+        "framework_gaps_updated": [
+          "nist-800-53-CM-6",
+          "nist-800-53-CM-7",
+          "iso-27001-2022-A.8.9",
+          "cmmc-cm-l2-3.4.2",
+          "au-essential-8-application-hardening"
+        ]
       }
     ],
     "owner": "@blamejs/platform-security",
     "air_gap_mode": false,
+    "scope": "system",
     "preconditions": [
       {
         "id": "linux-platform",
@@ -40,24 +47,47 @@
       }
     ]
   },
-
   "domain": {
     "name": "Linux kernel + system hardening posture",
     "attack_class": "kernel-lpe",
     "atlas_refs": [],
-    "attack_refs": ["T1068", "T1611", "T1556", "T1098"],
-    "cve_refs": ["CVE-2026-31431", "CVE-2026-43284", "CVE-2026-43500"],
-    "cwe_refs": ["CWE-732", "CWE-269", "CWE-426", "CWE-1188"],
-    "d3fend_refs": ["D3-KBPI", "D3-PA", "D3-EI"],
+    "attack_refs": [
+      "T1068",
+      "T1611",
+      "T1556",
+      "T1098"
+    ],
+    "cve_refs": [
+      "CVE-2026-31431",
+      "CVE-2026-43284",
+      "CVE-2026-43500"
+    ],
+    "cwe_refs": [
+      "CWE-732",
+      "CWE-269",
+      "CWE-426",
+      "CWE-1188"
+    ],
+    "d3fend_refs": [
+      "D3-KBPI",
+      "D3-PA",
+      "D3-EI"
+    ],
     "frameworks_in_scope": [
-      "nist-800-53", "nist-csf-2", "iso-27001-2022",
-      "soc2", "pci-dss-4", "nis2", "dora",
-      "uk-caf", "au-ism", "au-essential-8", "cmmc"
+      "nist-800-53",
+      "nist-csf-2",
+      "iso-27001-2022",
+      "soc2",
+      "pci-dss-4",
+      "nis2",
+      "dora",
+      "uk-caf",
+      "au-ism",
+      "au-essential-8",
+      "cmmc"
     ]
   },
-
   "phases": {
-
     "govern": {
       "jurisdiction_obligations": [
         {
@@ -66,7 +96,10 @@
           "obligation": "patch_critical",
           "window_hours": 720,
           "clock_starts": "analyze_complete",
-          "evidence_required": ["hardening_baseline_documented", "drift_remediation_record"]
+          "evidence_required": [
+            "hardening_baseline_documented",
+            "drift_remediation_record"
+          ]
         },
         {
           "jurisdiction": "AU",
@@ -74,7 +107,10 @@
           "obligation": "patch_critical",
           "window_hours": 720,
           "clock_starts": "validate_complete",
-          "evidence_required": ["hardening_baseline_documented", "drift_remediation_record"]
+          "evidence_required": [
+            "hardening_baseline_documented",
+            "drift_remediation_record"
+          ]
         },
         {
           "jurisdiction": "US",
@@ -82,7 +118,10 @@
           "obligation": "patch_critical",
           "window_hours": 720,
           "clock_starts": "validate_complete",
-          "evidence_required": ["baseline_configuration_document", "ssp_section_update"]
+          "evidence_required": [
+            "baseline_configuration_document",
+            "ssp_section_update"
+          ]
         }
       ],
       "theater_fingerprints": [
@@ -90,19 +129,29 @@
           "pattern_id": "cis-benchmark-as-state",
           "claim": "We follow the CIS Benchmark for $distro → hardening complete.",
           "fast_detection_test": "Run the CIS Benchmark scanner today and diff against the last attested benchmark run. Drift between attested run and today is the theater margin. If the org cannot produce a benchmark run within the last 90 days OR the diff shows > 5 controls regressed, the attestation is theater.",
-          "implicated_controls": ["nist-800-53-CM-6", "iso-27001-2022-A.8.9", "cmmc-cm-l2-3.4.1"]
+          "implicated_controls": [
+            "nist-800-53-CM-6",
+            "iso-27001-2022-A.8.9",
+            "cmmc-cm-l2-3.4.1"
+          ]
         },
         {
           "pattern_id": "selinux-permissive-as-enabled",
           "claim": "SELinux is enabled.",
           "fast_detection_test": "Run `getenforce`. 'Enforcing' is real; 'Permissive' is logs-only — the MAC policy is loaded but not blocking. Treat Permissive as the same posture as Disabled for blast-radius purposes; the audit attestation often does not distinguish.",
-          "implicated_controls": ["nist-800-53-AC-3", "iso-27001-2022-A.8.3"]
+          "implicated_controls": [
+            "nist-800-53-AC-3",
+            "iso-27001-2022-A.8.3"
+          ]
         },
         {
           "pattern_id": "kptr-restrict-zero-with-kaslr-attested",
           "claim": "KASLR is enabled, kernel address randomization mitigates kernel LPE primitives.",
           "fast_detection_test": "Check `cat /proc/sys/kernel/kptr_restrict`. If 0, /proc/kallsyms is world-readable and KASLR is effectively defeated for any local attacker. KASLR-enabled with kptr_restrict=0 is the classic kernel-hardening theater shape.",
-          "implicated_controls": ["nist-800-53-SC-30", "iso-27001-2022-A.8.31"]
+          "implicated_controls": [
+            "nist-800-53-SC-30",
+            "iso-27001-2022-A.8.31"
+          ]
         }
       ],
       "framework_context": {
@@ -135,9 +184,14 @@
           }
         ]
       },
-      "skill_preload": ["kernel-lpe-triage", "security-maturity-tiers", "framework-gap-analysis", "compliance-theater", "policy-exception-gen"]
+      "skill_preload": [
+        "kernel-lpe-triage",
+        "security-maturity-tiers",
+        "framework-gap-analysis",
+        "compliance-theater",
+        "policy-exception-gen"
+      ]
     },
-
     "direct": {
       "threat_context": "Kernel LPE class of 2026 is exquisitely sensitive to hardening posture. CVE-2026-31431 'Copy Fail' (KEV 2026-03-15) requires unprivileged user namespaces to be enabled — `kernel.unprivileged_userns_clone = 1` is the gating flag. Distros differ on the default: Debian 12 ships it 0, Ubuntu 24.04 ships it 1, RHEL 9 ships it 0 unless explicitly enabled. Similarly, CVE-2026-43284 / CVE-2026-43500 chain through unprivileged BPF primitives — `kernel.unprivileged_bpf_disabled = 0` is the gating flag. SELinux in Enforcing mode breaks the standard exploitation chain for several LPE classes; SELinux in Permissive provides no mitigation, only logging. MAC posture is therefore decisive for blast-radius scoring even when kernel version is technically vulnerable. The combination matters: vulnerable kernel + permissive MAC + relaxed hardening flags = exploitable; vulnerable kernel + enforcing MAC + tight hardening flags = primitive broken even pre-patch.",
       "rwep_threshold": {
@@ -147,11 +201,32 @@
       },
       "framework_lag_declaration": "NIST CM-6, ISO A.8.9, Essential 8 OS Hardening, CMMC CM.L2-3.4.1/2 all permit baseline + change-management evidence without requiring continuous attestation of the specific kernel hardening flags (kptr_restrict, unprivileged_userns_clone, unprivileged_bpf_disabled, yama.ptrace_scope, dmesg_restrict, kernel.lockdown, MAC enforcement mode) that determine whether a vulnerable kernel is actually exploitable. Gap = ~21 days at typical orgs between drift event and review. For environments using GitOps-deployed kernel parameters, drift can occur faster than monitoring catches.",
       "skill_chain": [
-        { "skill": "kernel-lpe-triage", "purpose": "Identify which hardening flags gate exploitation of catalogued LPE CVEs; map flag state to per-CVE exploitability.", "required": true },
-        { "skill": "security-maturity-tiers", "purpose": "Score current hardening posture against tier model; identify gaps to next tier.", "required": true },
-        { "skill": "framework-gap-analysis", "purpose": "Map hardening drift findings to which CM-6 / A.8.9 / Essential 8 controls were attested-but-drifted.", "required": true },
-        { "skill": "compliance-theater", "purpose": "Run the theater test on the org's CIS/STIG/Essential 8 attestation.", "required": true },
-        { "skill": "policy-exception-gen", "purpose": "Generate auditor-ready exception language for hardening flags that cannot be tightened (e.g. unprivileged_userns_clone needed for legitimate container workloads).", "skip_if": "close.exception_generation.trigger_condition == false", "required": false }
+        {
+          "skill": "kernel-lpe-triage",
+          "purpose": "Identify which hardening flags gate exploitation of catalogued LPE CVEs; map flag state to per-CVE exploitability.",
+          "required": true
+        },
+        {
+          "skill": "security-maturity-tiers",
+          "purpose": "Score current hardening posture against tier model; identify gaps to next tier.",
+          "required": true
+        },
+        {
+          "skill": "framework-gap-analysis",
+          "purpose": "Map hardening drift findings to which CM-6 / A.8.9 / Essential 8 controls were attested-but-drifted.",
+          "required": true
+        },
+        {
+          "skill": "compliance-theater",
+          "purpose": "Run the theater test on the org's CIS/STIG/Essential 8 attestation.",
+          "required": true
+        },
+        {
+          "skill": "policy-exception-gen",
+          "purpose": "Generate auditor-ready exception language for hardening flags that cannot be tightened (e.g. unprivileged_userns_clone needed for legitimate container workloads).",
+          "skip_if": "close.exception_generation.trigger_condition == false",
+          "required": false
+        }
       ],
       "token_budget": {
         "estimated_total": 19000,
@@ -166,7 +241,6 @@
         }
       }
     },
-
     "look": {
       "artifacts": [
         {
@@ -276,17 +350,48 @@
         }
       ],
       "fallback_if_unavailable": [
-        { "artifact_id": "sysctl-kernel-hardening", "fallback_action": "escalate_to_human", "confidence_impact": "high" },
-        { "artifact_id": "kernel-cmdline", "fallback_action": "use_compensating_artifact", "confidence_impact": "low" },
-        { "artifact_id": "cpu-vulnerabilities", "fallback_action": "mark_inconclusive", "confidence_impact": "low" },
-        { "artifact_id": "kernel-lockdown", "fallback_action": "mark_inconclusive", "confidence_impact": "medium" },
-        { "artifact_id": "selinux-state", "fallback_action": "use_compensating_artifact", "confidence_impact": "medium" },
-        { "artifact_id": "apparmor-state", "fallback_action": "use_compensating_artifact", "confidence_impact": "medium" },
-        { "artifact_id": "sshd-config", "fallback_action": "use_compensating_artifact", "confidence_impact": "medium" },
-        { "artifact_id": "audit-rules", "fallback_action": "mark_inconclusive", "confidence_impact": "low" }
+        {
+          "artifact_id": "sysctl-kernel-hardening",
+          "fallback_action": "escalate_to_human",
+          "confidence_impact": "high"
+        },
+        {
+          "artifact_id": "kernel-cmdline",
+          "fallback_action": "use_compensating_artifact",
+          "confidence_impact": "low"
+        },
+        {
+          "artifact_id": "cpu-vulnerabilities",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "low"
+        },
+        {
+          "artifact_id": "kernel-lockdown",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "selinux-state",
+          "fallback_action": "use_compensating_artifact",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "apparmor-state",
+          "fallback_action": "use_compensating_artifact",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "sshd-config",
+          "fallback_action": "use_compensating_artifact",
+          "confidence_impact": "medium"
+        },
+        {
+          "artifact_id": "audit-rules",
+          "fallback_action": "mark_inconclusive",
+          "confidence_impact": "low"
+        }
       ]
     },
-
     "detect": {
       "indicators": [
         {
@@ -406,26 +511,85 @@
         "not_detected": "All required sysctl flags collected AND posture matches Essential 8 ML3 or CIS Level 2 baseline AND MAC layer is Enforcing AND no boot-time mitigation overrides are set."
       }
     },
-
     "analyze": {
       "rwep_inputs": [
-        { "signal_id": "kptr-restrict-disabled", "rwep_factor": "blast_radius", "weight": 15, "notes": "Decisive for kernel LPE exploitability; multiplies impact of any matched kernel CVE." },
-        { "signal_id": "unprivileged-userns-enabled", "rwep_factor": "active_exploitation", "weight": 20, "notes": "Gates CVE-2026-31431 exploitability; full weight when paired with vulnerable kernel." },
-        { "signal_id": "unprivileged-bpf-allowed", "rwep_factor": "active_exploitation", "weight": 15, "notes": "Gates BPF-class LPE exploitability." },
-        { "signal_id": "yama-ptrace-permissive", "rwep_factor": "blast_radius", "weight": 10, "notes": "Credential-theft primitive; blast radius amplifier rather than direct LPE." },
-        { "signal_id": "kaslr-disabled-at-boot", "rwep_factor": "active_exploitation", "weight": 25, "notes": "Makes kernel LPEs deterministic; full weight." },
-        { "signal_id": "mitigations-off", "rwep_factor": "active_exploitation", "weight": 20, "notes": "Re-opens CPU side-channel LPE classes; full weight." },
-        { "signal_id": "selinux-not-enforcing", "rwep_factor": "blast_radius", "weight": 10, "notes": "Removes a layer that would otherwise break the exploitation chain for several LPEs." },
-        { "signal_id": "sshd-permitrootlogin-yes", "rwep_factor": "blast_radius", "weight": 15, "notes": "Removes the LPE step entirely if credential is obtained." }
+        {
+          "signal_id": "kptr-restrict-disabled",
+          "rwep_factor": "blast_radius",
+          "weight": 15,
+          "notes": "Decisive for kernel LPE exploitability; multiplies impact of any matched kernel CVE."
+        },
+        {
+          "signal_id": "unprivileged-userns-enabled",
+          "rwep_factor": "active_exploitation",
+          "weight": 20,
+          "notes": "Gates CVE-2026-31431 exploitability; full weight when paired with vulnerable kernel."
+        },
+        {
+          "signal_id": "unprivileged-bpf-allowed",
+          "rwep_factor": "active_exploitation",
+          "weight": 15,
+          "notes": "Gates BPF-class LPE exploitability."
+        },
+        {
+          "signal_id": "yama-ptrace-permissive",
+          "rwep_factor": "blast_radius",
+          "weight": 10,
+          "notes": "Credential-theft primitive; blast radius amplifier rather than direct LPE."
+        },
+        {
+          "signal_id": "kaslr-disabled-at-boot",
+          "rwep_factor": "active_exploitation",
+          "weight": 25,
+          "notes": "Makes kernel LPEs deterministic; full weight."
+        },
+        {
+          "signal_id": "mitigations-off",
+          "rwep_factor": "active_exploitation",
+          "weight": 20,
+          "notes": "Re-opens CPU side-channel LPE classes; full weight."
+        },
+        {
+          "signal_id": "selinux-not-enforcing",
+          "rwep_factor": "blast_radius",
+          "weight": 10,
+          "notes": "Removes a layer that would otherwise break the exploitation chain for several LPEs."
+        },
+        {
+          "signal_id": "sshd-permitrootlogin-yes",
+          "rwep_factor": "blast_radius",
+          "weight": 15,
+          "notes": "Removes the LPE step entirely if credential is obtained."
+        }
       ],
       "blast_radius_model": {
         "scope_question": "Given the inventoried hardening posture, what is the realistic delta between 'kernel CVE matched' and 'kernel CVE actually exploitable on this host'?",
         "scoring_rubric": [
-          { "condition": "All deterministic hardening flags hardened (kptr_restrict=2, unprivileged_userns_clone=0 or under MAC, unprivileged_bpf_disabled=1, KASLR enabled, mitigations=auto, MAC Enforcing, lockdown=integrity or confidentiality)", "blast_radius_score": 1, "description": "Hardening posture closes most catalogued LPE primitives. Vulnerable kernel does not mean exploitable host." },
-          { "condition": "One deterministic hardening flag drifted from baseline (e.g. unprivileged_userns_clone=1 due to container workload, MAC compensating) OR MAC layer compensates for drift", "blast_radius_score": 2, "description": "Trade-off posture. Drift is intentional and compensated; documented." },
-          { "condition": "Two or more deterministic hardening flags drifted AND no MAC compensation OR MAC in Permissive mode", "blast_radius_score": 3, "description": "Drift not compensated. Vulnerable kernel + this posture = exploitable in principle." },
-          { "condition": "Deterministic drift AND kernel playbook reports matched LPE with active_exploitation=confirmed AND no live-patch", "blast_radius_score": 4, "description": "Operational exposure. Exploitation chain is complete given foothold." },
-          { "condition": "Deterministic drift AND host is k8s control-plane OR identity broker OR has cross-account trust", "blast_radius_score": 5, "description": "Drift on a host whose compromise is org-wide. Identity boundary collapse risk." }
+          {
+            "condition": "All deterministic hardening flags hardened (kptr_restrict=2, unprivileged_userns_clone=0 or under MAC, unprivileged_bpf_disabled=1, KASLR enabled, mitigations=auto, MAC Enforcing, lockdown=integrity or confidentiality)",
+            "blast_radius_score": 1,
+            "description": "Hardening posture closes most catalogued LPE primitives. Vulnerable kernel does not mean exploitable host."
+          },
+          {
+            "condition": "One deterministic hardening flag drifted from baseline (e.g. unprivileged_userns_clone=1 due to container workload, MAC compensating) OR MAC layer compensates for drift",
+            "blast_radius_score": 2,
+            "description": "Trade-off posture. Drift is intentional and compensated; documented."
+          },
+          {
+            "condition": "Two or more deterministic hardening flags drifted AND no MAC compensation OR MAC in Permissive mode",
+            "blast_radius_score": 3,
+            "description": "Drift not compensated. Vulnerable kernel + this posture = exploitable in principle."
+          },
+          {
+            "condition": "Deterministic drift AND kernel playbook reports matched LPE with active_exploitation=confirmed AND no live-patch",
+            "blast_radius_score": 4,
+            "description": "Operational exposure. Exploitation chain is complete given foothold."
+          },
+          {
+            "condition": "Deterministic drift AND host is k8s control-plane OR identity broker OR has cross-account trust",
+            "blast_radius_score": 5,
+            "description": "Drift on a host whose compromise is org-wide. Identity boundary collapse risk."
+          }
         ]
       },
       "compliance_theater_check": {
@@ -465,53 +629,96 @@
         }
       ],
       "escalation_criteria": [
-        { "condition": "deterministic_hardening_drift == true AND kernel.playbook.reports_matched_lpe == true", "action": "trigger_playbook", "target_playbook": "kernel" },
-        { "condition": "selinux_disabled AND apparmor_no_enforcing_profiles AND blast_radius_score >= 3", "action": "raise_severity" },
-        { "condition": "sshd_permitrootlogin_yes == true", "action": "page_on_call" },
-        { "condition": "compliance_theater_check.verdict == 'theater' AND jurisdiction_obligations contains 'EU'", "action": "notify_legal" }
+        {
+          "condition": "deterministic_hardening_drift == true AND kernel.playbook.reports_matched_lpe == true",
+          "action": "trigger_playbook",
+          "target_playbook": "kernel"
+        },
+        {
+          "condition": "selinux_disabled AND apparmor_no_enforcing_profiles AND blast_radius_score >= 3",
+          "action": "raise_severity"
+        },
+        {
+          "condition": "sshd_permitrootlogin_yes == true",
+          "action": "page_on_call"
+        },
+        {
+          "condition": "compliance_theater_check.verdict == 'theater' AND jurisdiction_obligations contains 'EU'",
+          "action": "notify_legal"
+        }
       ]
     },
-
     "validate": {
       "remediation_paths": [
         {
           "id": "tighten-sysctl",
           "description": "Apply hardened sysctl values: kptr_restrict=2, unprivileged_userns_clone=0 (or compensate with MAC), unprivileged_bpf_disabled=1, yama.ptrace_scope=2, fs.suid_dumpable=0, dmesg_restrict=1. Persist via /etc/sysctl.d/99-exceptd-hardening.conf.",
-          "preconditions": ["no_workload_requires_relaxed_flag == true OR mac_compensation_in_place == true", "ops_authorization_for_sysctl_changes == true"],
+          "preconditions": [
+            "no_workload_requires_relaxed_flag == true OR mac_compensation_in_place == true",
+            "ops_authorization_for_sysctl_changes == true"
+          ],
           "priority": 1,
-          "compensating_controls": ["change-management-ticket", "regression-test-suite-passed"],
+          "compensating_controls": [
+            "change-management-ticket",
+            "regression-test-suite-passed"
+          ],
           "estimated_time_hours": 2
         },
         {
           "id": "tighten-kernel-cmdline",
           "description": "Remove `nokaslr` / `kaslr=off` / `mitigations=off` from /etc/default/grub or equivalent bootloader config; reboot to apply. Optionally add `lockdown=integrity` for kernels >= 5.4.",
-          "preconditions": ["vendor_supports_lockdown == true OR removing_existing_override == true", "reboot_window_within_72h == true"],
+          "preconditions": [
+            "vendor_supports_lockdown == true OR removing_existing_override == true",
+            "reboot_window_within_72h == true"
+          ],
           "priority": 2,
-          "compensating_controls": ["change-management-ticket", "post-boot-cmdline-verification"],
+          "compensating_controls": [
+            "change-management-ticket",
+            "post-boot-cmdline-verification"
+          ],
           "estimated_time_hours": 4
         },
         {
           "id": "enable-mac-enforcing",
           "description": "Move SELinux from Permissive to Enforcing (after audit log review for would-have-denials) OR move AppArmor profiles from 'complain' to 'enforce'.",
-          "preconditions": ["audit_log_review_complete == true", "workload_compatible_with_enforcing == true"],
+          "preconditions": [
+            "audit_log_review_complete == true",
+            "workload_compatible_with_enforcing == true"
+          ],
           "priority": 1,
-          "compensating_controls": ["audit-log-baseline-captured", "regression-test-suite-passed"],
+          "compensating_controls": [
+            "audit-log-baseline-captured",
+            "regression-test-suite-passed"
+          ],
           "estimated_time_hours": 4
         },
         {
           "id": "tighten-sshd",
           "description": "Set PermitRootLogin no, PasswordAuthentication no (or require MFA via PAM), MaxAuthTries 3, restrict via AllowUsers/AllowGroups. Test from a second session before logging out.",
-          "preconditions": ["non_root_admin_account_exists == true", "ssh_key_or_mfa_already_deployed == true"],
+          "preconditions": [
+            "non_root_admin_account_exists == true",
+            "ssh_key_or_mfa_already_deployed == true"
+          ],
           "priority": 1,
-          "compensating_controls": ["second-session-verified", "break-glass-console-access-confirmed"],
+          "compensating_controls": [
+            "second-session-verified",
+            "break-glass-console-access-confirmed"
+          ],
           "estimated_time_hours": 1
         },
         {
           "id": "policy-exception",
           "description": "If a hardening flag cannot be tightened due to workload requirements (e.g. unprivileged_userns_clone needed for rootless containers), generate an auditor-ready exception with named compensating controls.",
-          "preconditions": ["workload_requires_relaxed_flag == true", "mac_or_alternative_compensation_documented == true"],
+          "preconditions": [
+            "workload_requires_relaxed_flag == true",
+            "mac_or_alternative_compensation_documented == true"
+          ],
           "priority": 4,
-          "compensating_controls": ["mac-profile-tightened", "enhanced-audit-on-affected-syscall-path", "ciso-acceptance-on-residual-risk"],
+          "compensating_controls": [
+            "mac-profile-tightened",
+            "enhanced-audit-on-affected-syscall-path",
+            "ciso-acceptance-on-residual-risk"
+          ],
           "estimated_time_hours": 8
         }
       ],
@@ -557,47 +764,89 @@
         "risk": "Hardened posture still permits a kernel LPE that does not depend on any of the inventoried gating flags. New LPEs may emerge whose primitive is unrelated to userns/BPF/ptrace/kptr.",
         "why_remains": "Hardening flags are a moving target — new CVEs name new primitives, and a host hardened against today's catalog may be exposed to tomorrow's. The compensating control is regression cadence + new-CVE-in-class trigger, not absolute hardening.",
         "acceptance_level": "manager",
-        "compensating_controls_in_place": ["mac-enforcing", "monthly-hardening-diff-cadence", "edr-on-syscall-anomalies", "kernel-playbook-tied-to-this-baseline"]
+        "compensating_controls_in_place": [
+          "mac-enforcing",
+          "monthly-hardening-diff-cadence",
+          "edr-on-syscall-anomalies",
+          "kernel-playbook-tied-to-this-baseline"
+        ]
       },
       "evidence_requirements": [
         {
           "evidence_type": "scan_report",
           "description": "Full sysctl + cmdline + MAC + sshd_config + lockdown inventory output with timestamps and host identity.",
           "retention_period": "1_year",
-          "framework_satisfied": ["nist-800-53-CM-6", "iso-27001-2022-A.8.9", "cmmc-cm-l2-3.4.2", "au-essential-8-os-hardening"]
+          "framework_satisfied": [
+            "nist-800-53-CM-6",
+            "iso-27001-2022-A.8.9",
+            "cmmc-cm-l2-3.4.2",
+            "au-essential-8-os-hardening"
+          ]
         },
         {
           "evidence_type": "config_diff",
           "description": "Pre/post diff of sysctl values + /etc/default/grub + sshd_config showing remediation applied.",
           "retention_period": "7_years",
-          "framework_satisfied": ["nist-800-53-CM-3", "iso-27001-2022-A.8.32"]
+          "framework_satisfied": [
+            "nist-800-53-CM-3",
+            "iso-27001-2022-A.8.32"
+          ]
         },
         {
           "evidence_type": "exploit_replay_negative",
           "description": "Safe-mode primitive-trigger replays for each catalogued kernel LPE with hardening-flag dependency, showing post-remediation EPERM.",
           "retention_period": "1_year",
-          "framework_satisfied": ["soc2-cc7.1", "iso-27001-2022-A.8.8"]
+          "framework_satisfied": [
+            "soc2-cc7.1",
+            "iso-27001-2022-A.8.8"
+          ]
         },
         {
           "evidence_type": "attestation",
           "description": "Signed exceptd attestation: hardening baseline hash, scan timestamp, drift count, RWEP at detection, RWEP post-remediation.",
           "retention_period": "7_years",
-          "framework_satisfied": ["nist-800-53-CA-7", "iso-27001-2022-A.5.36", "nis2-art21-2c"]
+          "framework_satisfied": [
+            "nist-800-53-CA-7",
+            "iso-27001-2022-A.5.36",
+            "nis2-art21-2c"
+          ]
         }
       ],
       "regression_trigger": [
-        { "condition": "new_cve_in_class == true", "interval": "on_event" },
-        { "condition": "kernel_upgrade == true", "interval": "on_event" },
-        { "condition": "monthly", "interval": "30d" },
-        { "condition": "post_major_deploy", "interval": "on_event" },
-        { "condition": "post_distro_release_upgrade", "interval": "on_event" }
+        {
+          "condition": "new_cve_in_class == true",
+          "interval": "on_event"
+        },
+        {
+          "condition": "kernel_upgrade == true",
+          "interval": "on_event"
+        },
+        {
+          "condition": "monthly",
+          "interval": "30d"
+        },
+        {
+          "condition": "post_major_deploy",
+          "interval": "on_event"
+        },
+        {
+          "condition": "post_distro_release_upgrade",
+          "interval": "on_event"
+        }
       ]
     },
-
     "close": {
       "evidence_package": {
         "bundle_format": "csaf-2.0",
-        "contents": ["scan_report", "config_diff", "exploit_replay_negative", "attestation", "framework_gap_mapping", "compliance_theater_verdict", "residual_risk_statement"],
+        "contents": [
+          "scan_report",
+          "config_diff",
+          "exploit_replay_negative",
+          "attestation",
+          "framework_gap_mapping",
+          "compliance_theater_verdict",
+          "residual_risk_statement"
+        ],
         "destination": "local_only",
         "signed": true
       },
@@ -609,28 +858,42 @@
           "framework_gap": "Baseline-attestation cadence (annual to quarterly) is structurally slower than drift cadence (per-package-install, per-kernel-parameter-change). Frameworks lag drift by ~21 days at typical orgs.",
           "new_control_requirement": "Monthly programmatic verification of named kernel hardening flags (sysctl + cmdline + MAC + sshd effective config) against documented baseline. Drift triggers automatic regeneration of the kernel-LPE playbook scope."
         },
-        "feeds_back_to_skills": ["kernel-lpe-triage", "security-maturity-tiers", "framework-gap-analysis", "compliance-theater"]
+        "feeds_back_to_skills": [
+          "kernel-lpe-triage",
+          "security-maturity-tiers",
+          "framework-gap-analysis",
+          "compliance-theater"
+        ]
       },
       "notification_actions": [
         {
           "obligation_ref": "EU/NIS2 Art.21 720h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["hardening_baseline_documented", "drift_remediation_record"],
+          "evidence_attached": [
+            "hardening_baseline_documented",
+            "drift_remediation_record"
+          ],
           "draft_notification": "NIS2 Art.21 critical-vulnerability handling record: Hardening drift identified on ${affected_host_count} host(s) gating exploitability of catalogued kernel LPE(s) ${matched_cve_ids}. Drift count: ${drift_count}. Compensating controls in place: ${compensating_controls}. Remediation completed by ${remediation_date}. Evidence: hardening baseline + drift remediation record attached."
         },
         {
           "obligation_ref": "AU/Essential 8 Application Hardening 720h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["hardening_baseline_documented", "drift_remediation_record"],
+          "evidence_attached": [
+            "hardening_baseline_documented",
+            "drift_remediation_record"
+          ],
           "draft_notification": "Essential 8 OS Hardening evidence package: Hardening baseline verification on ${affected_host_count} host(s). Maturity Level claimed: ${ml_claimed}. Maturity Level supported by evidence: ${ml_evidence}. Drift remediation record: ${remediation_summary}."
         },
         {
           "obligation_ref": "US/CMMC 2.0 CM.L2-3.4.2 720h",
           "deadline": "computed_at_runtime",
           "recipient": "internal_legal",
-          "evidence_attached": ["baseline_configuration_document", "ssp_section_update"],
+          "evidence_attached": [
+            "baseline_configuration_document",
+            "ssp_section_update"
+          ],
           "draft_notification": "CMMC CM.L2-3.4.2 baseline configuration update: Hardening baseline diff on ${affected_host_count} host(s). SSP section to update: ${ssp_section}. Drift remediation record attached. Continuous-monitoring evidence retained for assessor review."
         }
       ],
@@ -639,7 +902,12 @@
         "exception_template": {
           "scope": "Hardening flag(s) ${flag_list} relaxed on ${affected_host_count} host(s) due to documented workload requirement (${workload_class}).",
           "duration": "until_next_audit",
-          "compensating_controls": ["mac-profile-tightened-on-affected-syscall", "enhanced-audit-on-affected-path", "edr-anomaly-detection-on-affected-primitive", "monthly-residual-risk-review"],
+          "compensating_controls": [
+            "mac-profile-tightened-on-affected-syscall",
+            "enhanced-audit-on-affected-path",
+            "edr-anomaly-detection-on-affected-primitive",
+            "monthly-residual-risk-review"
+          ],
           "risk_acceptance_owner": "manager",
           "auditor_ready_language": "Pursuant to ${framework_id} ${control_id}, the organization documents a time-bound risk acceptance for hardening flag(s) ${flag_list} on ${affected_host_count} host(s). Workload requirement: ${workload_requirement_narrative}. Compensating controls in place: ${compensating_controls}. Residual exposure post-compensation: only those kernel LPEs whose primitive specifically requires the relaxed flag AND whose mitigation path does not exist in MAC policy. Risk accepted by ${manager_name} on ${acceptance_date}. Time-bound until ${duration_expiry}. Detection coverage during the exception window is provided by ${detection_controls}. Re-evaluation triggers: (a) workload no longer requires the relaxed flag, (b) listed expiry date, (c) new exploitation indicator firing on the affected primitive — whichever is first."
         }
@@ -651,22 +919,27 @@
       }
     }
   },
-
   "directives": [
     {
       "id": "full-hardening-posture",
       "title": "Full hardening posture inventory — sysctl, cmdline, MAC, sshd, sudoers, PAM",
-      "applies_to": { "always": true }
+      "applies_to": {
+        "always": true
+      }
     },
     {
       "id": "kernel-lpe-gating-flags",
       "title": "Targeted directive — flags that gate catalogued kernel LPE exploitability",
-      "applies_to": { "attack_technique": "T1068" }
+      "applies_to": {
+        "attack_technique": "T1068"
+      }
     },
     {
       "id": "userns-gating-flag",
       "title": "Targeted directive — unprivileged_userns_clone state for CVE-2026-31431",
-      "applies_to": { "cve": "CVE-2026-31431" }
+      "applies_to": {
+        "cve": "CVE-2026-31431"
+      }
     }
   ]
 }