@blamejs/exceptd-skills 0.11.4 → 0.11.7

package/CHANGELOG.md

@@ -1,5 +1,84 @@
 # Changelog
 
+## 0.11.7 — 2026-05-12
+
+**Republish of v0.11.6 (which failed CI publish). Adds CI publish-gate fix.**
+
+### CI fix
+
+v0.11.6 tag was pushed but the release workflow failed publishing to npm. Root cause: `prepublishOnly` re-ran `predeploy`, which re-ran the Ed25519 signature verify gate. The standalone `Predeploy gate sequence` workflow step had already validated everything with one public key fingerprint (`JX04Vj…`); the second invocation during `npm publish`'s prepublishOnly hook reported a different fingerprint (`M/r52u…`) for the same tracked `keys/public.pem`, causing every skill signature to fail verification.
+
+The fingerprint divergence between two same-process invocations of the same binary against the same on-disk file remains unexplained (no script writes to `keys/public.pem` between the two runs). Pragmatic fix: the standalone Predeploy step is the authoritative safety net for CI publishes; the workflow now sets `EXCEPTD_SKIP_PREPUBLISH_PREDEPLOY=1` and prepublishOnly skips its redundant predeploy run. Local `npm publish` invocations still run predeploy because the env var is only set inside the workflow's publish step.
+
+### What's in this release
+
+All v0.11.6 changes (items 91-98 + 8 new regression tests, 322 total). See [v0.11.6 section](#0116--2026-05-12) below — every fix is identical:
+
+- **#91** CSAF + OpenVEX include framework_gap_mapping (was: empty bundles for posture-only playbooks)
+- **#92** CSAF tracking.current_release_date populated (spec §3.2.1.12)
+- **#93** SARIF rule definitions for every referenced ruleId (spec §3.27.3)
+- **#94** lint missing_required_artifact downgraded error → warn (align with runner)
+- **#95** default human-readable output for `attest list` + `lint` on TTY
+- **#96** `--strict-preconditions` flag escalates warn-level preconditions to exit 1
+- **#97** `doctor --fix` runs before JSON early-return (was no-op in `--json` mode)
+- **#98** `attest export` + `report` validate `--format` against accepted set
+
+### Workflow improvement
+
+Per operator request: README + landing-site updates are now part of every release sequence. README v0.11 section + exceptd.com softwareVersion updated alongside the package version bump.
+
+## 0.11.6 — 2026-05-12
+
+**Patch: items 91-98 + regression coverage extended to 35 cases.**
+
+### Critical
+
+- **#91 CSAF + OpenVEX renderers excluded framework_gap_mapping.** SARIF already iterated it (added in v0.11.5); the other two formats diverged. Now: both CSAF and OpenVEX emit one vulnerability / statement per framework gap, keyed under `exceptd-framework-gap` (CSAF) / `exceptd:framework-gap:<framework>:<control>` (OpenVEX) pseudo-CVE namespaces. All three formats now share the same findings-extraction layer (CVEs + indicators + framework gaps).
+
+### Bugs
+
+- **#92 CSAF current_release_date null.** CSAF 2.0 §3.2.1.12 requires this field non-null; downstream validators rejected the bundle. Set to `initial_release_date` (same value, satisfies the spec).
+- **#93 SARIF references ruleIds without rule definitions.** SARIF spec §3.27.3: every referenced `ruleId` must have a corresponding entry in `tool.driver.rules`. Pre-0.11.6 SARIF referenced `framework-gap-0`/`framework-gap-1`/etc but only defined rules for indicator hits and matched CVEs. GitHub Code Scanning + VS Code SARIF Viewer + Azure DevOps would warn or fail to display rule context. Now: one rule definition per framework gap including the gap text and required-control hint.
+- **#94 lint stricter than runner.** Pre-0.11.6 lint reported `missing_required_artifact` as a hard error, but the runner accepted the same submission and ran with indicators returning `inconclusive`. Lint now warns (not errors) on missing required artifacts, with a hint explaining the run will still execute but inconclusively.
+- **#95 default-output flip landed for `attest list` + `lint`.** When stdout is a TTY and no `--json`/`--pretty` is passed, both verbs now emit a human-readable table / summary. `brief` and `run` keep indented JSON because their data is too rich for a compact human view — operators wanting markdown digests use `--format markdown` (run) or read the brief structured.
+- **#96 `--strict-preconditions` flag.** New on `run`: escalates warn-level preflight issues (unverified preconditions, `on_fail: warn`) to exit 1. Default (without the flag) preserves the v0.11.x behavior where warn-level preconditions are informational and exit 0. CI gates wanting "fail on any unverified precondition" pass this flag.
+- **#97 `doctor --fix` was a no-op under `--json`.** The fix logic was placed AFTER the JSON early-return, so `--fix --json` never executed. Moved before the early-return; now generates the keypair and the returned JSON reflects the post-fix state (`summary.fix_applied: "ed25519_keypair_generated"`).
+- **#98 `attest export --format garbage` + `report garbage` silently accepted.** Both now validate against the accepted set and emit structured JSON errors with exit non-zero, matching `run --format` / `ci --format` rejection.
+
+### Test infrastructure
+
+35 cases in `tests/operator-bugs.test.js` (8 new for 91-98). 322 tests pass total. Future bug fixes continue to land here.
+
+## 0.11.5 — 2026-05-12
+
+**Patch: items 82-90 + permanent regression suite at `tests/operator-bugs.test.js`.**
+
+Every operator-reported bug fixed across the v0.9.5 → v0.11.x arc now lands as a named test case in `tests/operator-bugs.test.js`. Re-introductions surface at `npm test`, not at user re-report. 27 cases on day one covering items #17, #18, #19, #31, #32, #33, #46, #58, #62, #65, #71, #73, #76, #82, #83, #85, #87.
+
+### Critical
+
+- **#82 SARIF / CSAF / OpenVEX rendered empty bundles** when the playbook had no catalogued CVEs. crypto-codebase / library-author have `domain.cve_refs: []` by design (they check process / posture, not catalogue CVEs), so the renderers had nothing to populate. Pre-0.11.5 a successful run with 9 indicators firing produced `vulnerabilities: 0` / `results: 0` / `statements: 0`. Now: indicators that fire (verdict: hit) and framework gaps are first-class SARIF results / CSAF vulnerabilities / OpenVEX statements. Each fired indicator becomes a SARIF result with `kind: indicator_hit` + a pseudo-CVE id under the `exceptd:` namespace for CSAF/OpenVEX. SARIF + CSAF + OpenVEX bundles now meaningfully integrate with GitHub Code Scanning / VEX downstreams / supply-chain tooling even for posture-only playbooks.
+
+### Bugs
+
+- **#83 lint and run disagreed on shape validity.** Lint walked the raw submission and only matched observations whose key was a known artifact id. The runner's `normalizeSubmission` followed `val.artifact` indirection — so observations with arbitrary keys (`obs-1`, `obs-2`) and an `artifact:` field route correctly. Fix: lint now runs the same `normalizeSubmission` the runner does, then validates the canonical normalized shape. The user's proposed fix — single observations-normalizer module that lint, run, and format renderers all consume — landed.
+
+- **#85 `from_observation` always null.** The diagnostic field on `indicators_evaluated[]` is now populated with the observation key that drove each indicator outcome (when supplied via flat-shape observation + indicator + result). Lets operators trace "which observation produced this verdict" without guessing.
+
+- **#86 / #76 `--format garbage` was silent.** v0.11.4 fixed it for `run`; this release fixes the same surface on `ci`. Both now emit `{ok:false, error, verb}` JSON to stderr with non-zero exit when an unknown format is requested.
+
+- **#90 legacy verbs in help.** v0.10.x legacy verbs (plan / govern / direct / look / scan / dispatch / etc) appeared in the help output alongside their v0.11 replacements. Operators copy-pasting from `exceptd help | grep '^  [a-z]'` ended up using legacy verbs and missed the new ones. Each legacy entry is now prefixed with `[DEPRECATED]` so the grep pattern still excludes them.
+
+### Deferred (confirmed not yet shipped)
+
+- **#88 default-output flip incomplete.** `emit()` indents JSON on TTY (improvement over compact JSON); `discover`/`doctor`/`ask`/`refresh` use custom human renderers. `brief`/`run`/`attest list`/`lint` still emit JSON because their data is too rich for a compact human view. Indented-JSON-on-TTY is the v0.11.x answer; per-verb human renderers continue to be incremental.
+
+- **#89 warn-level preconditions exit 0.** `on_fail: halt` correctly exits 1; `on_fail: warn` exits 0 with `preflight_issues` populated. The operator wants warn-level to also fail CI gates — `--strict-preconditions` flag deferred to v0.11.6. Today: use `exceptd ci` for CI gates (correctly maps detected/escalate to exit 2).
+
+### Test infrastructure
+
+- New: `tests/operator-bugs.test.js` (27 cases, all green). Future bug fixes land here as named cases so the audit script becomes part of CI.
+
 ## 0.11.4 — 2026-05-12
 
 **Patch: high-impact #71 fix + items 72-77.**

package/README.md

@@ -36,6 +36,8 @@ Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/ex
 
 **v0.11.0 collapses the 21-verb CLI into 11 canonical verbs** + flips the default output to human-readable. The new surface: `discover` (scan cwd → recommend playbooks), `brief` (unified info doc, replaces plan + govern + direct + look), `run` (phases 4-7, with flat or nested submission shape, auto-detect cwd context), `ai-run` (JSONL streaming variant for AI conversational flow), `attest` (subverbs: list / show / export / verify / diff — replaces reattest + list-attestations), `doctor` (one-shot health check — signatures + currency + cve/rfc validation + signing status), `ci` (one-shot CI gate, exit-2 on detected or rwep ≥ escalate), `ask` (plain-English routing), `lint` (pre-flight submission shape check). Attestation root moved from cwd-relative `.exceptd/` to `~/.exceptd/attestations/<repo-or-host-tag>/`. v0.10.x verbs (`plan`/`govern`/`direct`/`look`/`scan`/`dispatch`/`currency`/`verify`/`validate-cves`/`validate-rfcs`/`watchlist`/`prefetch`/`build-indexes`/`ingest`/`reattest`/`list-attestations`) still work via one-time deprecation banner — removed in v0.12.
 
+**v0.11.1-0.11.7 stability arc** — 30+ operator-reported items fixed across the v0.11.x line: mutex filesystem lockfile, `--vex` filter, `--ci` exit-code gating, `--diff-from-latest`, `--operator`/`--ack` attestation binding, `--format <fmt>` actually transforms output for run + ci, `ask` synonym routing, `lint` shares normalize contract with runner, CSAF/SARIF/OpenVEX bundles include indicator hits + framework gaps (was: empty for posture-only playbooks), CSAF current_release_date populated, SARIF rule definitions for every ruleId, `doctor --fix` for missing private key, `--strict-preconditions` flag, default human output for `attest list`/`lint` on TTY. Permanent regression suite at `tests/operator-bugs.test.js` (35 named test cases) — re-introductions caught at `npm test`, not at user re-report.
+
 ---
 
 ## Skill Inventory

package/bin/exceptd.js

@@ -245,17 +245,26 @@ v0.11.0 canonical surface
 v0.10.x compatibility (will be removed in v0.12)
 ────────────────────────────────────────────────
 
-These verbs still work but emit a one-time deprecation banner. Migrate to
-the v0.11.0 verb shown:
-
-  plan → brief --all                govern → brief <pb> --phase govern
-  direct → brief <pb> --phase direct  look → brief <pb> --phase look
-  ingest → run                       reattest → attest diff
-  list-attestations → attest list   scan → discover --scan-only
-  dispatch → discover                currency → doctor --currency
-  verify → doctor --signatures      validate-cves → doctor --cves
-  validate-rfcs → doctor --rfcs     watchlist → watch
-  prefetch → refresh --no-network   build-indexes → refresh --indexes-only
+These verbs still work but emit a one-time deprecation banner. The
+[DEPRECATED] prefix is included so \`exceptd help | grep '^  [a-z]'\`
+doesn't surface them in the active-verbs list. Migrate to v0.11:
+
+  [DEPRECATED] plan              → brief --all
+  [DEPRECATED] govern <pb>       → brief <pb> --phase govern
+  [DEPRECATED] direct <pb>       → brief <pb> --phase direct
+  [DEPRECATED] look <pb>         → brief <pb> --phase look
+  [DEPRECATED] ingest            → run
+  [DEPRECATED] reattest <sid>    → attest diff <sid>
+  [DEPRECATED] list-attestations → attest list
+  [DEPRECATED] scan              → discover --scan-only
+  [DEPRECATED] dispatch          → discover
+  [DEPRECATED] currency          → doctor --currency
+  [DEPRECATED] verify            → doctor --signatures
+  [DEPRECATED] validate-cves     → doctor --cves
+  [DEPRECATED] validate-rfcs     → doctor --rfcs
+  [DEPRECATED] watchlist         → watch
+  [DEPRECATED] prefetch          → refresh --no-network
+  [DEPRECATED] build-indexes     → refresh --indexes-only
 
 Output: default human-readable (v0.11.0). --json for machine output.
         --pretty for indented JSON.
@@ -427,12 +436,18 @@ function parseArgs(argv, opts) {
   return out;
 }
 
-function emit(obj, pretty) {
-  // v0.11.2 bug #60: when stdout is a TTY (interactive use), emit indented
-  // JSON instead of single-line — much more readable. Piped to a file or
-  // tool? Default to compact one-line JSON. --pretty forces indented
-  // regardless of TTY. --json-stdout-only is always compact.
+function emit(obj, pretty, humanRenderer) {
+  // v0.11.6 (#95): real default-human flip. When stdout is a TTY AND no
+  // --json/--pretty was passed AND a custom human renderer was supplied,
+  // render the human form. Otherwise: indented JSON on TTY (improvement
+  // over compact), compact JSON when piped. --pretty forces indented JSON
+  // regardless. --json forces JSON (overrides human renderer).
   const interactive = process.stdout.isTTY && !process.env.EXCEPTD_RAW_JSON;
+  const wantHuman = humanRenderer && interactive && !pretty && !global.__exceptdWantJson;
+  if (wantHuman) {
+    process.stdout.write(humanRenderer(obj) + "\n");
+    return;
+  }
   const indent = pretty || (interactive && !pretty);
   const s = indent ? JSON.stringify(obj, null, 2) : JSON.stringify(obj);
   process.stdout.write(s + "\n");
@@ -479,7 +494,7 @@ function dispatchPlaybook(cmd, argv) {
     bool:  ["pretty", "air-gap", "force-stale", "all", "flat", "directives",
             "ci", "latest", "diff-from-latest", "explain", "signal-list", "ack",
             "force-overwrite", "no-stream", "block-on-jurisdiction-clock",
-            "json-stdout-only", "fix", "human", "json"],
+            "json-stdout-only", "fix", "human", "json", "strict-preconditions"],
     multi: ["playbook", "format"],
   });
   // v0.11.2 bug #60: flip defaults to human-readable. JSON via explicit --json
@@ -493,6 +508,8 @@ function dispatchPlaybook(cmd, argv) {
   // ai-run/ci/attest show/export/diff/verify) fall back to indented JSON
   // labeled as such — better than no signal.
   args._jsonMode = !!(args.json || args.pretty || args["json-stdout-only"]);
+  // Hoist into module-level state so emit() can read it without plumbing.
+  global.__exceptdWantJson = args._jsonMode;
   const pretty = !!args.pretty;
   const runOpts = {
     airGap: !!args["air-gap"],
@@ -818,7 +835,6 @@ function cmdLint(runner, args, runOpts, pretty) {
   catch (e) { return emitError(`lint: failed to read evidence: ${e.message}`, { evidence: evidencePath }, pretty); }
 
   const directiveId = args.directive || (pb.directives[0] && pb.directives[0].id);
-  const resolved = runner._resolvedPhase;
   const lookPhase = pb.phases?.look || {};
   const detectPhase = pb.phases?.detect || {};
 
@@ -827,31 +843,48 @@ function cmdLint(runner, args, runOpts, pretty) {
   const knownIndicators = new Set((detectPhase.indicators || []).map(i => i.id));
   const knownPreconditions = new Set((pb._meta?.preconditions || []).map(p => p.id));
 
-  // Support both flat (observations) and nested (artifacts/signal_overrides) shapes.
+  // v0.11.5 #83: shared shape contract with runner. Pre-0.11.5 lint
+  // walked the raw submission and only matched observations whose key was
+  // a known artifact id. The runner's normalizeSubmission follows
+  // `val.artifact` indirection — so observations with arbitrary keys
+  // (obs-1, obs-2) and an `artifact:` field route correctly. Lint must
+  // do the same normalization before validating, or lint and run disagree
+  // on what's a valid submission.
+  const normalized = runner.normalizeSubmission(submission, pb);
   const flat = submission.observations || null;
-  const artifactsKey = flat ? flat : (submission.artifacts || {});
-  const signalsKey = flat ? flat : (submission.signal_overrides || {});
 
+  // After normalize, validation walks the canonical nested shape.
   const missingRequired = requiredArtifacts.filter(id => {
-    const a = artifactsKey[id];
-    return !a || (flat ? !a.captured : !a.captured);
+    const a = normalized.artifacts && normalized.artifacts[id];
+    return !a || !a.captured;
   });
 
-  const unknownArtifactKeys = Object.keys(submission.artifacts || {})
+  const unknownArtifactKeys = Object.keys(normalized.artifacts || {})
     .filter(k => !knownArtifacts.has(k));
-  const unknownSignalKeys = Object.keys(submission.signal_overrides || {})
+  const unknownSignalKeys = Object.keys(normalized.signal_overrides || {})
     .filter(k => !knownIndicators.has(k));
   const unknownObservationKeys = flat
-    ? Object.keys(flat).filter(k => !knownArtifacts.has(k) && !knownIndicators.has(k) && !knownPreconditions.has(k))
+    ? Object.keys(flat).filter(k => {
+        // Skip observations with explicit `artifact:` indirection — those
+        // are valid by-design even when the key doesn't match a known artifact.
+        const v = flat[k];
+        if (v && typeof v === "object" && v.artifact) return false;
+        return !knownArtifacts.has(k) && !knownIndicators.has(k) && !knownPreconditions.has(k);
+      })
     : [];
 
   const unsuppliedPreconditions = [...knownPreconditions].filter(
-    p => !((submission.precondition_checks || {}).hasOwnProperty(p) || (flat || {}).hasOwnProperty(p))
+    p => !(((submission.precondition_checks || {}).hasOwnProperty(p)) || ((normalized.precondition_checks || {}).hasOwnProperty(p)))
   );
 
   const issues = [];
+  // v0.11.6 (#94): missing_required_artifact downgraded from error to warn.
+  // The runner doesn't refuse a submission missing required artifacts — it
+  // runs with the indicators that have data and marks the rest inconclusive.
+  // Lint was stricter than runner; users got errors on submissions the runner
+  // accepted. Now: lint warns about missing artifacts but doesn't fail.
   for (const id of missingRequired) {
-    issues.push({ severity: "error", kind: "missing_required_artifact", artifact_id: id, hint: `Add to submission.artifacts.${id} = { value, captured: true } (or under observations in the flat shape).` });
+    issues.push({ severity: "warn", kind: "missing_required_artifact", artifact_id: id, hint: `Add to submission.artifacts.${id} = { value, captured: true } (or under observations in the flat shape). The run will still execute without this; the corresponding indicators will return 'inconclusive'.` });
   }
   for (const k of unknownArtifactKeys) {
     issues.push({ severity: "warn", kind: "unknown_artifact_key", key: k, hint: `Not in playbook ${playbookId} look.artifacts[]. Recognized: ${[...knownArtifacts].slice(0, 10).join(", ")}…` });
@@ -866,33 +899,19 @@ function cmdLint(runner, args, runOpts, pretty) {
     issues.push({ severity: "warn", kind: "unknown_observation_key", key: k });
   }
 
-  // #71 (v0.11.3): when a submission is flat-shape with all captured artifacts
-  // but no indicator+result inline and no verdict.classification — detect()
-  // will return "inconclusive" because nothing drives the indicator decisions.
-  // Lint must surface this so operators don't ship a half-shape evidence file
-  // that passes lint but produces an inconclusive run.
+  // #71 (v0.11.3) + #83 (v0.11.5): when a submission is flat-shape but the
+  // post-normalize signal_overrides is empty AND no verdict.classification
+  // is supplied, detect() will return inconclusive. Surface this before run.
   if (flat) {
-    const observationsWithoutIndicator = Object.entries(flat).filter(([k, v]) => {
-      if (!knownArtifacts.has(k)) return false; // unknown keys flagged elsewhere
-      if (typeof v !== "object" || v === null) return false;
-      const captured = v.captured !== false;
-      return captured && !(v.indicator && v.result);
-    });
     const verdictClass = submission.verdict?.classification;
     const verdictWillDrive = verdictClass === "clean" || verdictClass === "not_detected" || verdictClass === "detected" || verdictClass === "inconclusive";
-    if (observationsWithoutIndicator.length > 0 && !verdictWillDrive && Object.keys(submission.signal_overrides || {}).length === 0) {
-      for (const [k] of observationsWithoutIndicator) {
-        issues.push({
-          severity: "warn",
-          kind: "observation_lacks_indicator_result",
-          observation_key: k,
-          hint: `Artifact "${k}" captured without "indicator" + "result" fields. detect will return 'inconclusive' for this indicator. Either add { "indicator": "<id>", "result": "hit"|"miss"|"inconclusive" } per observation, OR supply verdict.classification at the submission root to drive the overall verdict.`,
-        });
-      }
+    const normalizedHasOverrides = Object.keys(normalized.signal_overrides || {}).length > 0;
+    if (!verdictWillDrive && !normalizedHasOverrides) {
+      const observationsCount = Object.keys(flat).length;
       issues.push({
         severity: "info",
         kind: "detect_will_be_inconclusive",
-        hint: `Flat submission shape with ${observationsWithoutIndicator.length} captured artifact(s) but no indicator+result inline and no verdict.classification. detect() will return 'inconclusive'. Run \`exceptd run ${playbookId} --signal-list\` to see the indicator IDs the playbook recognizes.`,
+        hint: `Flat submission with ${observationsCount} observation(s) but no indicator+result fields and no verdict.classification. detect() will return 'inconclusive'. Each observation needs { "indicator": "<id>", "result": "hit"|"miss"|"inconclusive" } to drive an indicator outcome. Run \`exceptd run ${playbookId} --signal-list\` for the indicator IDs.`,
       });
     }
   }
@@ -910,7 +929,20 @@ function cmdLint(runner, args, runOpts, pretty) {
       info: issues.filter(i => i.severity === "info").length,
     },
     issues,
-  }, pretty);
+  }, pretty, (obj) => {
+    // v0.11.6 (#95) human renderer for lint.
+    const lines = [`lint: ${obj.playbook_id} (${obj.directive_id}) — shape: ${obj.submission_shape}`];
+    lines.push(`  ${obj.ok ? "[ok]" : "[!! fail]"}  errors=${obj.summary.errors}  warnings=${obj.summary.warnings}  info=${obj.summary.info}`);
+    if (obj.issues.length > 0) {
+      for (const i of obj.issues.slice(0, 30)) {
+        const tag = i.severity === "error" ? "[!! ERROR]" : (i.severity === "warn" ? "[!! WARN ]" : "[i  INFO ]");
+        lines.push(`  ${tag} ${i.kind}${i.artifact_id ? ": " + i.artifact_id : ""}${i.observation_key ? ": " + i.observation_key : ""}${i.key ? ": " + i.key : ""}${i.precondition_id ? ": " + i.precondition_id : ""}`);
+        if (i.hint) lines.push(`             ${i.hint}`);
+      }
+      if (obj.issues.length > 30) lines.push(`  … and ${obj.issues.length - 30} more (use --json for full list)`);
+    }
+    return lines.join("\n");
+  });
   if (!ok) process.exitCode = 1;
 }
 
@@ -1266,6 +1298,21 @@ function cmdRun(runner, args, runOpts, pretty) {
     process.exit(1);
   }
 
+  // v0.11.6 (#96): --strict-preconditions escalates warn-level preflight
+  // issues to exit 1. Default (without the flag) preserves the existing
+  // behavior where warn-level issues stay informational. CI gates wanting
+  // "fail on any unverified precondition" pass this flag.
+  if (args["strict-preconditions"] && result && Array.isArray(result.preflight_issues)) {
+    const warnIssues = result.preflight_issues.filter(i =>
+      i.kind === "precondition_unverified" || i.kind === "precondition_warn"
+    );
+    if (warnIssues.length > 0) {
+      process.stderr.write(`[exceptd run] --strict-preconditions: ${warnIssues.length} unverified/warn precondition(s) — exit 1.\n`);
+      emit(result, pretty);
+      process.exit(1);
+    }
+  }
+
   // --diff-from-latest: compare evidence_hash against the most recent prior
   // attestation for this playbook. Drift mode for cron baselines.
   // We've already persisted the CURRENT attestation above, so the find must
@@ -1981,6 +2028,13 @@ function cmdAttest(runner, args, runOpts, pretty) {
     let formatRaw = args.format || "json";
     if (Array.isArray(formatRaw)) formatRaw = formatRaw[0];
     const format = formatRaw === "csaf-2.0" ? "csaf" : formatRaw;
+    // v0.11.6 (#98): validate against accepted set. Pre-0.11.6 unknown
+    // formats fell through to the default redacted JSON output, silently
+    // accepting any value the operator passed.
+    const VALID_EXPORT_FORMATS = ["json", "csaf", "csaf-2.0"];
+    if (!VALID_EXPORT_FORMATS.includes(formatRaw)) {
+      return emitError(`attest export: --format "${formatRaw}" not in accepted set ${JSON.stringify(VALID_EXPORT_FORMATS)}.`, null, pretty);
+    }
     const redacted = attestations.map(a => ({
       session_id: a.session_id,
       playbook_id: a.playbook_id,
@@ -2446,6 +2500,31 @@ function cmdDoctor(runner, args, runOpts, pretty) {
     },
   };
 
+  // v0.11.6 (#97): --fix runs BEFORE the JSON early-return so `exceptd doctor
+  // --fix --json` actually fixes (was a no-op pre-0.11.6). Re-runs the
+  // signing check after fix so the returned JSON reflects the post-fix state.
+  if (args.fix && checks.signing && !checks.signing.private_key_present) {
+    process.stderr.write("[doctor --fix] generating Ed25519 keypair via `node lib/sign.js generate-keypair`...\n");
+    const r = require("child_process").spawnSync(process.execPath, [path.join(PKG_ROOT, "lib", "sign.js"), "generate-keypair"], {
+      stdio: ["ignore", "pipe", "pipe"], cwd: PKG_ROOT,
+    });
+    if (r.status === 0) {
+      // Re-verify the private key is now present so the JSON output reflects
+      // the fix.
+      const keyPath = path.join(process.cwd(), ".keys", "private.pem");
+      const fallback = path.join(PKG_ROOT, ".keys", "private.pem");
+      const present = fs.existsSync(keyPath) || fs.existsSync(fallback);
+      checks.signing = { ok: present, severity: present ? "info" : "warn", private_key_present: present, can_sign_attestations: present };
+      out.checks = checks;
+      out.summary.fix_applied = "ed25519_keypair_generated";
+      process.stderr.write("[doctor --fix] keypair generated — re-checking signing status.\n");
+    } else {
+      out.summary.fix_attempted = "ed25519_keypair_generation_failed";
+      out.summary.fix_exit_code = r.status;
+      process.stderr.write(`[doctor --fix] generation failed (exit=${r.status}); run \`node lib/sign.js generate-keypair\` manually.\n`);
+    }
+  }
+
   if (wantJson) {
     emit(out, indent);
     if (!allGreen) process.exitCode = 1;
@@ -2499,17 +2578,14 @@ function cmdDoctor(runner, args, runOpts, pretty) {
     lines.push(`summary: ${errorList.length} fail / ${warnList.length} warn — fail: ${errorList.join(", ")}; warn: ${warnList.join(", ") || "none"}`);
   }
   process.stdout.write(lines.join("\n") + "\n");
-  // Bug #69 (v0.11.2): --fix mode for missing private key.
-  if (args.fix && checks.signing && !checks.signing.private_key_present) {
-    process.stdout.write("\n[doctor --fix] generating Ed25519 keypair via `node lib/sign.js generate-keypair`...\n");
-    const r = require("child_process").spawnSync(process.execPath, [path.join(PKG_ROOT, "lib", "sign.js"), "generate-keypair"], { stdio: "inherit", cwd: PKG_ROOT });
-    if (r.status === 0) {
-      process.stdout.write("[doctor --fix] keypair generated — re-run `exceptd doctor` to confirm.\n");
-    } else {
-      process.stdout.write(`[doctor --fix] generation failed (exit=${r.status}); run \`node lib/sign.js generate-keypair\` manually.\n`);
-      process.exitCode = 1;
-      return;
-    }
+  // v0.11.6 (#97): --fix already ran above the JSON early-return. Echo the
+  // applied/attempted state here for human readers.
+  if (out.summary.fix_applied) {
+    process.stdout.write(`\n[doctor --fix] ${out.summary.fix_applied} — re-run \`exceptd doctor\` to confirm.\n`);
+  } else if (out.summary.fix_attempted) {
+    process.stdout.write(`\n[doctor --fix] ${out.summary.fix_attempted} (exit=${out.summary.fix_exit_code}); run \`node lib/sign.js generate-keypair\` manually.\n`);
+    process.exitCode = 1;
+    return;
   }
   if (errorList.length > 0) process.exitCode = 1;
   // Warnings alone do NOT force exit 1 — CI gates use exit 0 to mean "ran
@@ -2557,7 +2633,21 @@ function cmdListAttestations(runner, args, runOpts, pretty) {
     count: entries.length,
     filter: { playbook: args.playbook || null, since: args.since || null },
     roots_searched: [...seenRoots],
-  }, pretty);
+  }, pretty, (obj) => {
+    // v0.11.6 (#95) human renderer for attest list: one row per session.
+    const lines = [`attest list — ${obj.count} attestation(s)`];
+    if (obj.count === 0) {
+      lines.push(`  (no attestations under ${obj.roots_searched.join(' or ')})`);
+      return lines.join("\n");
+    }
+    lines.push(`  ${"session-id".padEnd(20)}  ${"playbook".padEnd(16)}  ${"captured-at".padEnd(20)}  evidence-hash`);
+    lines.push(`  ${"-".repeat(20)}  ${"-".repeat(16)}  ${"-".repeat(20)}  ${"-".repeat(20)}`);
+    for (const e of obj.attestations.slice(0, 50)) {
+      lines.push(`  ${(e.session_id || "?").padEnd(20)}  ${(e.playbook_id || "?").padEnd(16)}  ${(e.captured_at || "").slice(0, 19).padEnd(20)}  ${e.evidence_hash || ""}`);
+    }
+    if (obj.count > 50) lines.push(`  … and ${obj.count - 50} more (use --json for full list)`);
+    return lines.join("\n");
+  });
 }
 
 // ---------------------------------------------------------------------------

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-12T16:00:45.631Z",
+  "generated_at": "2026-05-12T17:44:09.922Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 49,
   "source_hashes": {
-    "manifest.json": "6935c71303fe299a6a52e1776d571e30808cae14ddfadc48b27d9ac2443c423a",
+    "manifest.json": "ca19f2d85b4b143dffe5517494455f0a8a2c97bddd028c66ef5a38623503a160",
     "data/atlas-ttps.json": "1500b5830dab070c4252496964a8c0948e1052a656e2c7c6e1efaf0350645e13",
     "data/cve-catalog.json": "a81d3e4b491b27ccc084596b063a6108ff10c9eb01d7776922fc393980b534fe",
     "data/cwe-catalog.json": "c3367d469b4b3d31e4c56397dd7a8305a0be338ecd85afa27804c0c9ce12157b",

package/keys/public.pem

@@ -1,3 +1,3 @@
 -----BEGIN PUBLIC KEY-----
-MCowBQYDK2VwAyEAh++7P6Bd/u2vy1xF05jGxrN/VJqtFennBw5JZy8kx6M=
+MCowBQYDK2VwAyEAaRfxRnf9Z/887Hux2Senf7NSEaAnhGLwLg9oLL1vhDM=
 -----END PUBLIC KEY-----

package/lib/playbook-runner.js

@@ -385,7 +385,16 @@ function detect(playbookId, directiveId, agentSubmission = {}) {
     // v0.11.4 (#73): downstream consumers iterating `indicators_evaluated`
     // expect an array, not a count. Restore as array; provide
     // `indicators_evaluated_count` for callers wanting the integer.
-    indicators_evaluated: indicatorResults.map(i => ({ signal_id: i.id, outcome: i.verdict, confidence: i.confidence })),
+    indicators_evaluated: indicatorResults.map(i => ({
+      signal_id: i.id,
+      outcome: i.verdict,
+      confidence: i.confidence,
+      // v0.11.5 #85: surface which observation produced this indicator's
+      // outcome (when the agent submitted it via flat-shape observation +
+      // indicator + result fields). Null when no observation drove the
+      // indicator (engine-computed default).
+      from_observation: agentSubmission._signal_origins?.[i.id] || null,
+    })),
     indicators_evaluated_count: indicatorResults.length,
     classification_override_applied: validOverrides.has(override) ? (override === 'clean' ? 'not_detected' : override) : null,
     submission_shape_seen: agentSubmission._original_shape || (agentSubmission.artifacts ? 'nested (v0.10.x)' : 'empty')
@@ -514,6 +523,12 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}) {
     },
     framework_gap_mapping: frameworkGaps,
     escalations,
+    // v0.11.5 (#82): expose detect's per-indicator results + classification
+    // here so close()'s bundle builders can iterate indicators that fired
+    // and emit them as SARIF results / OpenVEX statements / CSAF notes.
+    // Prefixed with underscore to signal "for internal/render use".
+    _detect_indicators: detectResult.indicators || [],
+    _detect_classification: detectResult.classification,
     vex: vexFilter ? {
       filter_applied: true,
       dropped_cve_count: vexDropped.length,
@@ -757,100 +772,179 @@ function analyzeFindingShape(a) {
 }
 
 function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals) {
-  // CSAF-2.0 shape — minimal valid envelope; production GRC submission would
-  // need full distribution + product_tree population, deferred to the GRC
-  // integration layer.
+  // CSAF-2.0 shape. v0.11.5 (#82): include vulnerabilities for both matched
+  // catalogue CVEs AND fired indicators (treated as advisory pseudo-CVEs
+  // under `exceptd:` namespace), so playbooks without catalogue CVEs still
+  // emit a non-empty bundle.
   if (format === 'csaf-2.0') {
+    const indicatorHits = (analyze._detect_indicators || []).filter(i => i.verdict === 'hit');
+    const cveVulns = analyze.matched_cves.map(c => ({
+      cve: c.cve_id,
+      scores: [{ products: [], cvss_v3: { base_score: c.cvss_score || 0 } }],
+      threats: c.active_exploitation === 'confirmed' ? [{ category: 'exploit_status', details: 'Active exploitation confirmed (CISA KEV).' }] : [],
+      remediations: [{ category: 'vendor_fix', details: validate.selected_remediation?.description || 'See selected remediation path.' }]
+    }));
+    const indicatorVulns = indicatorHits.map(i => ({
+      // Pseudo-CVE id for indicator findings (CSAF requires `cve` or `ids`).
+      ids: [{ system_name: 'exceptd-indicator', text: `${playbook._meta.id}:${i.id}` }],
+      notes: [{ category: 'description', text: `Indicator ${i.id} fired (${i.confidence}${i.deterministic ? ' / deterministic' : ''}) in playbook ${playbook._meta.id}.` }],
+      remediations: [{ category: 'mitigation', details: validate.selected_remediation?.description || `Consult playbook brief: exceptd brief ${playbook._meta.id}.` }],
+    }));
+    // v0.11.6 (#91): framework_gap_mapping → CSAF vulnerabilities. Each gap
+    // becomes a vulnerability keyed by the framework + control, with the
+    // gap text as the description and the required_control as the remediation.
+    const gapVulns = (analyze.framework_gap_mapping || []).map((g, idx) => ({
+      ids: [{ system_name: 'exceptd-framework-gap', text: `${g.framework}:${g.claimed_control || `gap-${idx}`}` }],
+      notes: [
+        { category: 'description', text: g.actual_gap || `Framework gap in ${g.framework} ${g.claimed_control || ''}` },
+        { category: 'general', text: g.claimed_control ? `Claimed control: ${g.claimed_control}` : null },
+      ].filter(n => n.text),
+      remediations: g.required_control ? [{ category: 'mitigation', details: g.required_control }] : [],
+    }));
+    const now = new Date().toISOString();
     return {
       document: {
         category: 'csaf_security_advisory',
         csaf_version: '2.0',
         publisher: { category: 'vendor', name: 'exceptd', namespace: 'https://exceptd.com' },
-        title: `exceptd finding: ${playbook.domain.name} (${analyze.matched_cves.length} catalogued CVEs)`,
+        title: `exceptd finding: ${playbook.domain.name} (${analyze.matched_cves.length} CVE(s), ${indicatorHits.length} indicator hit(s), ${(analyze.framework_gap_mapping || []).length} framework gap(s))`,
         tracking: {
           id: `exceptd-${playbook._meta.id}-${Date.now()}`,
           status: 'final',
           version: playbook._meta.version,
-          initial_release_date: new Date().toISOString(),
-          revision_history: [{ number: '1', date: new Date().toISOString(), summary: 'Initial finding emission' }]
+          initial_release_date: now,
+          // v0.11.6 (#92): CSAF 2.0 §3.2.1.12 requires current_release_date
+          // non-null. Pre-0.11.6 we only set initial_release_date and
+          // downstream validators rejected the bundle.
+          current_release_date: now,
+          revision_history: [{ number: '1', date: now, summary: 'Initial finding emission' }]
         }
       },
-      vulnerabilities: analyze.matched_cves.map(c => ({
-        cve: c.cve_id,
-        scores: [{ products: [], cvss_v3: { base_score: c.cvss_score || 0 } }],
-        threats: c.active_exploitation === 'confirmed' ? [{ category: 'exploit_status', details: 'Active exploitation confirmed (CISA KEV).' }] : [],
-        remediations: [{ category: 'vendor_fix', details: validate.selected_remediation?.description || 'See selected remediation path.' }]
-      })),
+      vulnerabilities: [...cveVulns, ...indicatorVulns, ...gapVulns],
       exceptd_extension: {
+        classification: analyze._detect_classification,
         rwep: analyze.rwep,
         blast_radius_score: analyze.blast_radius_score,
         compliance_theater: analyze.compliance_theater_check,
         framework_gap_mapping: analyze.framework_gap_mapping,
         evidence_requirements: validate.evidence_requirements,
-        residual_risk_statement: validate.residual_risk_statement
+        residual_risk_statement: validate.residual_risk_statement,
+        indicators_fired: indicatorHits.map(i => ({ id: i.id, confidence: i.confidence, deterministic: i.deterministic })),
       }
     };
   }
 
   // SARIF 2.1.0 — GitHub Code Scanning / VS Code SARIF Viewer / Azure DevOps
-  // and most static analysis tooling. One run per playbook directive, one
-  // result per matched CVE. Each result references a rule (cve_id) and ties
-  // back to the directive as the "tool" producer.
+  // / most static-analysis tooling.
+  //
+  // v0.11.5 (#82): emit results from BOTH matched_cves AND fired indicators.
+  // Pre-0.11.5 we emitted only matched_cves, which produced an empty bundle
+  // for playbooks like crypto-codebase / library-author whose domain.cve_refs
+  // is intentionally empty (the playbook checks process/posture, not catalog
+  // CVEs). Indicators that fire (verdict: hit) and framework gaps are now
+  // first-class SARIF results — a clean run still emits a usable bundle.
   if (format === 'sarif' || format === 'sarif-2.1.0') {
+    const cveResults = analyze.matched_cves.map(c => ({
+      ruleId: c.cve_id,
+      level: c.rwep >= 90 ? 'error' : c.rwep >= 70 ? 'warning' : 'note',
+      message: { text: `${c.cve_id}: RWEP ${c.rwep}, blast_radius ${analyze.blast_radius_score}. ${validate.selected_remediation?.description || ''}` },
+      properties: {
+        kind: 'cve_match',
+        rwep: c.rwep, cisa_kev: c.cisa_kev, cisa_kev_due_date: c.cisa_kev_due_date,
+        active_exploitation: c.active_exploitation, ai_discovered: c.ai_discovered,
+        blast_radius_score: analyze.blast_radius_score,
+      }
+    }));
+    const indicatorHits = (analyze._detect_indicators || []).filter(i => i.verdict === 'hit');
+    const indicatorResults = indicatorHits.map(i => ({
+      ruleId: i.id,
+      level: i.deterministic ? 'error' : (i.confidence === 'high' ? 'warning' : 'note'),
+      message: { text: `Indicator ${i.id} fired (${i.confidence}${i.deterministic ? ' / deterministic' : ''}). Playbook: ${playbook._meta.id}.` },
+      properties: { kind: 'indicator_hit', confidence: i.confidence, deterministic: i.deterministic, atlas_ref: i.atlas_ref, attack_ref: i.attack_ref },
+    }));
+    const gapResults = (analyze.framework_gap_mapping || []).map((g, idx) => ({
+      ruleId: `framework-gap-${idx}`,
+      level: 'note',
+      message: { text: `${g.framework}: ${g.claimed_control} — ${g.actual_gap}${g.required_control ? '. Required: ' + g.required_control : ''}` },
+      properties: { kind: 'framework_gap', framework: g.framework, control: g.claimed_control },
+    }));
+    const cveRules = analyze.matched_cves.map(c => ({
+      id: c.cve_id, shortDescription: { text: c.cve_id },
+      fullDescription: { text: `RWEP ${c.rwep} · KEV=${c.cisa_kev} · active_exploitation=${c.active_exploitation}` },
+      defaultConfiguration: { level: c.rwep >= 90 ? 'error' : c.rwep >= 70 ? 'warning' : 'note' },
+      helpUri: `https://nvd.nist.gov/vuln/detail/${c.cve_id}`,
+    }));
+    const indicatorRules = indicatorHits.map(i => ({
+      id: i.id, shortDescription: { text: i.id },
+      fullDescription: { text: `Indicator from playbook ${playbook._meta.id}. Type: ${i.type}. Confidence: ${i.confidence}.` },
+      defaultConfiguration: { level: i.deterministic ? 'error' : (i.confidence === 'high' ? 'warning' : 'note') },
+    }));
+    // v0.11.6 (#93): SARIF spec §3.27.3 — every referenced ruleId SHOULD have
+    // a corresponding rule definition in tool.driver.rules. Pre-0.11.6 we
+    // referenced framework-gap-N ids without defining them; GitHub Code
+    // Scanning + VS Code SARIF Viewer + Azure DevOps would warn or fail to
+    // display rule context. Now we emit one rule per framework gap.
+    const gapRules = (analyze.framework_gap_mapping || []).map((g, idx) => ({
+      id: `framework-gap-${idx}`,
+      shortDescription: { text: `${g.framework}: ${g.claimed_control || `gap-${idx}`}` },
+      fullDescription: { text: g.actual_gap || `Framework gap in ${g.framework}` },
+      defaultConfiguration: { level: 'note' },
+      help: g.required_control ? { text: `Required control: ${g.required_control}` } : undefined,
+    }));
     return {
       $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
       version: '2.1.0',
       runs: [{
-        tool: {
-          driver: {
-            name: 'exceptd',
-            version: playbook._meta.version,
-            informationUri: 'https://exceptd.com',
-            rules: analyze.matched_cves.map(c => ({
-              id: c.cve_id,
-              shortDescription: { text: c.cve_id },
-              fullDescription: { text: `RWEP ${c.rwep} · KEV=${c.cisa_kev} · active_exploitation=${c.active_exploitation} · PoC=${c.poc_available}` },
-              defaultConfiguration: { level: c.rwep >= 90 ? 'error' : c.rwep >= 70 ? 'warning' : 'note' },
-              helpUri: `https://nvd.nist.gov/vuln/detail/${c.cve_id}`,
-            }))
-          }
-        },
-        results: analyze.matched_cves.map(c => ({
-          ruleId: c.cve_id,
-          level: c.rwep >= 90 ? 'error' : c.rwep >= 70 ? 'warning' : 'note',
-          message: { text: `${c.cve_id}: RWEP ${c.rwep}, blast_radius ${analyze.blast_radius_score}. ${validate.selected_remediation?.description || ''}` },
-          properties: {
-            rwep: c.rwep,
-            cisa_kev: c.cisa_kev,
-            cisa_kev_due_date: c.cisa_kev_due_date,
-            active_exploitation: c.active_exploitation,
-            ai_discovered: c.ai_discovered,
-            blast_radius_score: analyze.blast_radius_score,
-            framework_gaps: analyze.framework_gap_mapping?.length || 0,
-          }
-        }))
+        tool: { driver: {
+          name: 'exceptd', version: playbook._meta.version, informationUri: 'https://exceptd.com',
+          rules: [...cveRules, ...indicatorRules, ...gapRules],
+        } },
+        results: [...cveResults, ...indicatorResults, ...gapResults],
+        invocations: [{ executionSuccessful: true, properties: {
+          playbook: playbook._meta.id, classification: analyze._detect_classification || 'unknown',
+          rwep_adjusted: analyze.rwep?.adjusted || 0,
+          remediation: validate.selected_remediation?.id || null,
+        } }],
       }]
     };
   }
 
-  // OpenVEX 0.2.0 — supply-chain VEX statements. Each matched CVE becomes a
-  // statement with status derived from confidence + RWEP. Downstream tools
-  // (sigstore, in-toto, GUAC) consume this directly.
+  // OpenVEX 0.2.0 — supply-chain VEX statements. v0.11.5 (#82): also include
+  // statements derived from fired indicators (treated as advisory findings)
+  // so playbooks with empty cve_refs still emit a meaningful bundle.
   if (format === 'openvex' || format === 'openvex-0.2.0') {
     const issued = new Date().toISOString();
+    const cveStatements = analyze.matched_cves.map(c => ({
+      vulnerability: { '@id': c.cve_id, name: c.cve_id },
+      status: c.active_exploitation === 'confirmed' ? 'under_investigation' : (c.live_patch_available ? 'fixed' : 'affected'),
+      timestamp: issued,
+      action_statement: validate.selected_remediation?.description || null,
+      impact_statement: `RWEP ${c.rwep}. Blast radius ${analyze.blast_radius_score}/5.`
+    }));
+    const indicatorStatements = (analyze._detect_indicators || []).filter(i => i.verdict === 'hit').map(i => ({
+      vulnerability: { '@id': `exceptd:${playbook._meta.id}:${i.id}`, name: i.id },
+      status: 'under_investigation',
+      timestamp: issued,
+      action_statement: validate.selected_remediation?.description || `Run \`exceptd brief ${playbook._meta.id}\` for context.`,
+      impact_statement: `Indicator ${i.id} fired (${i.confidence}${i.deterministic ? '/deterministic' : ''}) in playbook ${playbook._meta.id}.`,
+    }));
+    // v0.11.6 (#91): framework gaps → OpenVEX statements. Each gap becomes
+    // a statement with a pseudo-CVE id under the exceptd:framework-gap
+    // namespace so VEX downstreams ingest them cleanly.
+    const gapStatements = (analyze.framework_gap_mapping || []).map((g, idx) => ({
+      vulnerability: { '@id': `exceptd:framework-gap:${g.framework}:${g.claimed_control || idx}`, name: `${g.framework} ${g.claimed_control || `gap-${idx}`}` },
+      status: 'under_investigation',
+      timestamp: issued,
+      action_statement: g.required_control || null,
+      impact_statement: g.actual_gap || `Framework gap in ${g.framework}.`,
+    }));
     return {
       '@context': 'https://openvex.dev/ns/v0.2.0',
       '@id': `https://exceptd.com/vex/${playbook._meta.id}/${Date.now()}`,
       author: 'exceptd',
       timestamp: issued,
       version: 1,
-      statements: analyze.matched_cves.map(c => ({
-        vulnerability: { '@id': c.cve_id, name: c.cve_id },
-        status: c.active_exploitation === 'confirmed' ? 'under_investigation' : (c.live_patch_available ? 'fixed' : 'affected'),
-        timestamp: issued,
-        action_statement: validate.selected_remediation?.description || null,
-        impact_statement: `RWEP ${c.rwep}. Blast radius ${analyze.blast_radius_score}/5.`
-      }))
+      statements: [...cveStatements, ...indicatorStatements, ...gapStatements],
     };
   }
 
@@ -947,6 +1041,10 @@ function normalizeSubmission(submission, playbook) {
     return v; // leave unrecognized values for detect() to decide
   };
 
+  // v0.11.5 (#85): track which observation produced each signal_override so
+  // detect can emit `from_observation` on each indicator result. Diagnostic
+  // value for operators chasing "which observation drove this verdict".
+  out._signal_origins = out._signal_origins || {};
   for (const [key, val] of Object.entries(submission.observations || {})) {
     if (knownPreconditions.has(key)) {
       out.precondition_checks[key] = val === "ok" || val === true || val === "true";
@@ -957,6 +1055,7 @@ function normalizeSubmission(submission, playbook) {
       out.artifacts[aid] = { value: val.value, captured: val.captured !== false };
       if (val.indicator && val.result !== undefined) {
         out.signal_overrides[val.indicator] = canonicalizeOutcome(val.result);
+        out._signal_origins[val.indicator] = key;
       }
     }
   }

package/manifest-snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
-  "_generated_at": "2026-05-12T15:59:29.819Z",
+  "_generated_at": "2026-05-12T17:43:06.691Z",
   "atlas_version": "5.1.0",
   "skill_count": 38,
   "skills": [

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.11.4",
+  "version": "0.11.7",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -51,8 +51,8 @@
         "RFC-7296"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "WprHkO1KOjQtCBj6/EJghBTNyNKJhn7O2HDbAQZPi5jn4flwHpSrtP8LC15a4Unoh+xiIIgGhvTHZIQFHGMpBQ==",
-      "signed_at": "2026-05-12T15:59:29.388Z",
+      "signature": "Xk593pj7my6wPJbQBE47khpIUrPsp6N1lW7cE2T/VPPF5T+8C1yGKc9B8VphD7Q08yWFcbwF6HoWpA/+4uG9DA==",
+      "signed_at": "2026-05-12T17:43:06.252Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -115,8 +115,8 @@
         "SOC2-CC6-logical-access"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "fg20bOXGRkPUdLmegeXpTM4hnzl/ArgcVc88rItZN5DdsnFnzPgUU1PwCI82zooyj2GfxJHYjxNkq5qd2zNPBg==",
-      "signed_at": "2026-05-12T15:59:29.390Z",
+      "signature": "nOgUu+LK9fy6ASTCoRGtx3ttgjZCl7WIkKu2wu06JEKVSpL2cKU3ex2tmVAvv11LBmpTH+b/0zvqXlzcxzHnCw==",
+      "signed_at": "2026-05-12T17:43:06.255Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -178,8 +178,8 @@
         "RFC-9700"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "6JuSzkSSFzFHEZ3ANzqjtIbKPOkwJeKhQ+8WAPB4+dTRvDSeg46n3D88XfGaNd2z7pmg/i8p9ZoImQcHFS4BCg==",
-      "signed_at": "2026-05-12T15:59:29.390Z",
+      "signature": "7FH1J9PlOyvcRCzRmggmenX9fIR0pi/veXihb3TeStcq1Rpuz1KHdOcJLqA9su4t2goYukKKCXHV6hx8hzplAA==",
+      "signed_at": "2026-05-12T17:43:06.255Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -224,8 +224,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
-      "signature": "PYSw9abiYfW+y7IkY8udJG5LSds2a4rMimlw3rrdD0zE3vunEeV/y7oTmDD4o83OqHSCKNzF/7vMhvd/noqICQ==",
-      "signed_at": "2026-05-12T15:59:29.391Z"
+      "signature": "FqTRjHfEgw56pyHnyWzNtnhzDMEePBtmuamtW/iyX+h4yqbvP4Fyr7NRjRs3EgqT4j7oHuEZhV9Jt6ZTBgN4AA==",
+      "signed_at": "2026-05-12T17:43:06.255Z"
     },
     {
       "name": "compliance-theater",
@@ -255,8 +255,8 @@
         "CMMC-2.0-Level-2"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "BMFmmJYP3HsHIjUqnhw8E3MiMGZJsI/eDq51we+nxUicZ8nFUQT9DhmRntAqOs6BUnsfiQNNLc/rrsNh8yg1CQ==",
-      "signed_at": "2026-05-12T15:59:29.392Z"
+      "signature": "3fN4yotiIIq76PVTHwozCu28TzDZvWule6vX8SXUT3XXbIBSuvAO0M/euvc3pw3TdZ2UNf78dI18lOCNdJ0aAg==",
+      "signed_at": "2026-05-12T17:43:06.256Z"
     },
     {
       "name": "exploit-scoring",
@@ -284,8 +284,8 @@
         "CIS-Controls-v8-Control7"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "VGPyDwy5BRlpn1lZthhPB6ytb4ZcU2j0KtCZbaMkyLdMugQJtK2yEuwrsDH4yEtAhTB6/A4B3eSygJckum49Ag==",
-      "signed_at": "2026-05-12T15:59:29.392Z"
+      "signature": "yZfpk4lQMRXegj2ADWjMmZTchUN6Lxpv587O/0JMzbNkXQtD6FrSAQOBWjx8S7uQ/sTntxgGN7aQQDLxL9RWAA==",
+      "signed_at": "2026-05-12T17:43:06.257Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -321,8 +321,8 @@
         "OWASP-LLM-Top-10-2025-LLM08"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "XkFGpsNnXBVslkQ48usEu9l1LjPiV2ppW+M4B63zXFBP2Puh52qYCffEPjUHYhoO5bjgTM7yCbK8XF/Dzk5wBw==",
-      "signed_at": "2026-05-12T15:59:29.392Z",
+      "signature": "ABHkoqee67KdUyDZ3bvF+/DNxjGhPR/ehT6pfOnmUIMmkcQFHpZ0OUVXKiFUANaLgKLP1vg0VEmHOoxpNA3vAA==",
+      "signed_at": "2026-05-12T17:43:06.257Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -378,8 +378,8 @@
         "RFC-9000"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "1Xqy7Kxxy6GpTvuYJPdllPzVDRFxb7N6AuxKuoaO4v91CiZLmiXt0sTIWImKJ3p9Eup6rJNDdsY71dolFhHNBA==",
-      "signed_at": "2026-05-12T15:59:29.392Z",
+      "signature": "+Nd/2tgBnW+mEGX84QvkgR2To2J7kA+lB63BsADDKeCXeebFv6Vo9H1P4vyUkKHfe4fP0ndpy3agIZcUO/e/Dg==",
+      "signed_at": "2026-05-12T17:43:06.257Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -413,8 +413,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
-      "signature": "QNLOmAL54S/Cmk4cdO4L2BCGkqZ/FgY4UBsKWtg/EEW+YXF5ev+a8XsUT8q5veuUa2VYcYna7rD1iAnE+2PDBA==",
-      "signed_at": "2026-05-12T15:59:29.393Z",
+      "signature": "VMNGFvowXLbBjZp5nvWloKkqyqHKhnSzbVRU3gX9quOZJHH56w2M4id+oDsXIjR0CfRRb7eXl/so0Hq4xLBuBQ==",
+      "signed_at": "2026-05-12T17:43:06.257Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -441,8 +441,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
-      "signature": "aFHq4cSl3CKchnVITxx+BrAEWD33WtFFJoQtwAug5g9R3/3ABtjaXYGVQaZcdcG1AIZkMoGSPywgLQWDY7ZDCw==",
-      "signed_at": "2026-05-12T15:59:29.393Z"
+      "signature": "5MaJs7gPCuFlK4oAttLulAPOA1noeV+xD/UqVWaVyRedXZgebBGKjnlE2t1qmTugvxlNIfeAnBZapk+Wz3VAAg==",
+      "signed_at": "2026-05-12T17:43:06.258Z"
     },
     {
       "name": "global-grc",
@@ -473,8 +473,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
-      "signature": "viCTUWdy6euvd2KTAo6sLvarK/FZkDtYGocxBt0H+fY94kLQGW8K5cSpqIWdUF5NUytSHBCiG4YcSze8P9Z/BQ==",
-      "signed_at": "2026-05-12T15:59:29.394Z"
+      "signature": "S/YXUpI/mcG2FpdUTgMsccWBtTaR5A4Ph4QFQw31S9w9Hn/z3sOFHLkb1B5YSwlg+mMOtSIxMdet1eLGSZkTDg==",
+      "signed_at": "2026-05-12T17:43:06.258Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -500,8 +500,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
-      "signature": "6PkUaHQi3Hxuqq/Jp4GYckvfqVEofmeT87NUH0T+pwyjlc+xZkoqNPn65f7ldciEPL86JIPi3/dDTKQbIFFBCw==",
-      "signed_at": "2026-05-12T15:59:29.394Z"
+      "signature": "AKS+JsmhhBtytY2eIMuydjkZOYprWCmQ+RqxyxcVG9XcEI29ZSM/JbVIINQHozFl7OPPrOu1ouiTnk7LOJ86Bg==",
+      "signed_at": "2026-05-12T17:43:06.258Z"
     },
     {
       "name": "pqc-first",
@@ -552,8 +552,8 @@
         "CRQC timeline estimate changes"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "ZenFTEzWx+DzrSXlNXhbZ70vOdJSXfrnKkAwqMlBf5nlDf38V1/hG4XCKj43snQXWr4mVJOX6ilqFLTYNIjnBw==",
-      "signed_at": "2026-05-12T15:59:29.394Z",
+      "signature": "oEkK5bLS/G5RIHnxlNFJYdzhTJbKZnkJv+W4iS9UJ/uszZHgZGoxygELPc4kn3FowV5eE988SQYG4WKlXtNzCg==",
+      "signed_at": "2026-05-12T17:43:06.259Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -599,8 +599,8 @@
         "Framework publication updates"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "ih0vpd2v2zS31JSJv7SnABoya8JlJdrXZXx4rBnrsV3Assj+dbjAP0pQ1HMT/5RX8yTTswRQsg0bJV3qmbJ3Bw==",
-      "signed_at": "2026-05-12T15:59:29.395Z"
+      "signature": "nPV6YTo1rsNH49qUnZpfoNLEQZXuLNyV05QMUOgXKHYeVDjotYpWhLgyVXlRhjV/fStiA2sWQ0MOnEJ4FBIfDg==",
+      "signed_at": "2026-05-12T17:43:06.259Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -636,8 +636,8 @@
         "PQC tooling maturity shifting overkill to practical"
       ],
       "last_threat_review": "2026-05-01",
-      "signature": "Lv8dHiwIqUbNsywCCB/+pYWGF+MHCvxVn1IAvR7Cnif5fy0sICv0N4SVsSb621qAAkHNshpfxqwuhbuQnE1TBA==",
-      "signed_at": "2026-05-12T15:59:29.395Z",
+      "signature": "7rirSEONz6O9Yyf46eTyuwkGizCj9FRcNHe5p7Qz6nhJoZQRW5FwW7n9opL0WlbIw8FDBYn1f22zgNUV87L5AQ==",
+      "signed_at": "2026-05-12T17:43:06.260Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -671,8 +671,8 @@
       "attack_refs": [],
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
-      "signature": "BS+wrL28HHYhBpe+v84VLoq9KPBXu6alfG968katfGIoLNYQueaHP931bRmlkrjfeb6qbDf067GWdPEh7nroAw==",
-      "signed_at": "2026-05-12T15:59:29.395Z"
+      "signature": "+evehnd2wSBb8uMTlTr5/aTN4bfLjsKzZJk/+OMLMOJrjCt+OuMU7EQC6xMUGeSc4cPEGajghDvq3xVaacV2Dw==",
+      "signed_at": "2026-05-12T17:43:06.260Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -742,8 +742,8 @@
         "OWASP WSTG v5.x AI/MCP test cases (currently in working-group draft)",
         "PTES revision incorporating AI-surface enumeration"
       ],
-      "signature": "vLhIYT/CC3IzxMRa+UPeqGSZTvthuwUeTMGNFMm37+TaEk0TtfwPrPyrBJLHw4W6Wt7+pufjHs46X3nTgzoRAg==",
-      "signed_at": "2026-05-12T15:59:29.396Z"
+      "signature": "KHOXxloAYf7xqXjm2BaL3HVAZOmb7rMiMh20H/oaIkjN0WD1CnKCrRGPJn867uSFhCh/timkXolaiqD1L/h8Dg==",
+      "signed_at": "2026-05-12T17:43:06.260Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -802,8 +802,8 @@
         "syzkaller eBPF and io_uring surface expansion as new kernel attack surfaces ship",
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
-      "signature": "TOcQLy/427cuf0Lw90J7A0oIeuhUmf9NXb6tOUS5K3SazCKTJujPgYSVAPZOYf1zZrRAY/aq0iqELd5cLyk5DA==",
-      "signed_at": "2026-05-12T15:59:29.396Z"
+      "signature": "+ELdD+1AY5DymBitH7wU65CS60NY1nDoLowJAFn7cE5Gr/5jy9BTkyxsm7PEXaSlXWMOkTf/HQ+uyzyxUVD/Bw==",
+      "signed_at": "2026-05-12T17:43:06.261Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -877,8 +877,8 @@
         "MCP gateway / proxy standardisation (Anthropic enterprise MCP gateway, Portkey MCP) — tool-call argument inspection is the missing primary control",
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
-      "signature": "u4IN7escQa5V+OgdtaJXLdvhmNiGZsdmGOvebTLZ30WoImT+WiksvaqSa0POGdbr6HzFkALe2RrZEH9Tr0U6Dg==",
-      "signed_at": "2026-05-12T15:59:29.396Z"
+      "signature": "8tFAhXAS8zZN3SUOdn+ZIu7lQ48JMOyBQ8SaObR3L/fDyFmDhufqleY2VzI3yigqlT/D4Y8FYxZHKmzXiALjDw==",
+      "signed_at": "2026-05-12T17:43:06.261Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -954,8 +954,8 @@
         "EU CRA (Regulation 2024/2847) — implementing acts for technical documentation and SBOM submission expected through 2027",
         "OpenSSF model-signing — emerging Sigstore-based signing standard for ML model weights; track for production adoption"
       ],
-      "signature": "eTGQJ3gnG24WggfwuFNNIFOWV/ttPxTa3pvx9OH28m5KDS1a4ZmOR7K8y01wk/su8bH0ClYYRfoBfKQOtRswAg==",
-      "signed_at": "2026-05-12T15:59:29.396Z"
+      "signature": "8xlk5ZfTKVYqTE2+ifkjTBu/RPqs4MIvX7SpOHl22YDHi7nzJ1ywPhSNYJzoPdPV4AUuWG518EldQJsEIuyuAA==",
+      "signed_at": "2026-05-12T17:43:06.261Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1011,8 +1011,8 @@
         "D3-SCP"
       ],
       "last_threat_review": "2026-05-11",
-      "signature": "q7gFLPoqf/8bqATR6gt/nj0EoyUOlfzi+bZ0bT3pC9KW7O6M/ji9fT+AXSGNp6PKd+70ACb3mkMGmWgjLpQXCg==",
-      "signed_at": "2026-05-12T15:59:29.397Z"
+      "signature": "AMdLkDx/e3ESI4NAnJhhcaas+Ru8VjrSn6v6RBbmmzoLCGo/vFxGraa1p/qF9udhVG+DdkbwHfbfKK5Im19KDw==",
+      "signed_at": "2026-05-12T17:43:06.262Z"
     },
     {
       "name": "identity-assurance",
@@ -1078,8 +1078,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
-      "signature": "pX8rhrrzuyG3iRrPORLqTZAjzGdWK/bKPUGJG5WHSZcv4LB0kQXOit4sHG0exdXxI6HY8jyX67QY4r5vEHHACw==",
-      "signed_at": "2026-05-12T15:59:29.397Z"
+      "signature": "pSMHKkyWoZvRIuVtN7Vue51sP5MIy9lSaQa2YSAMhxjptx81cUnPt3S11/Tb9Ea1/eluMNQ+5F25eF2njr4mBQ==",
+      "signed_at": "2026-05-12T17:43:06.262Z"
     },
     {
       "name": "ot-ics-security",
@@ -1134,8 +1134,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
-      "signature": "ypb8kNZQRdyu5mWeveB7sjCjNKXS1yXvjDJv88muzwhOs/a4Fu/Gb532js5NKyy+eCw/emrphpTZaL8R9a2lBA==",
-      "signed_at": "2026-05-12T15:59:29.397Z"
+      "signature": "qjky+ZTX1DP7uRRMQZq7S7P9/uaJEoB1dy4RZ1l37Q4OO3k2ryfL+7o0Cgm/piuafJfH+dqUeNCRrVefj4r8Dw==",
+      "signed_at": "2026-05-12T17:43:06.262Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1186,8 +1186,8 @@
         "UK NCSC Vulnerability Disclosure Toolkit revisions and AU ISM CVD guidance updates",
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
-      "signature": "346Lt+277ycRNsyAOGwLSONi4awgxKy3hP9G+BWjwaa8ySmTeqbYsbyyhtxjeohk9bV2SF+Hl2q4JdSvc/2qCQ==",
-      "signed_at": "2026-05-12T15:59:29.398Z"
+      "signature": "F86Zl/I+dBzHYRUuGWsjDQI2F/I/vhzwZUFMqhNfKUzRbMf6mafOX2APCPYTp3eP1DvvvfL3Yc0hb1R5Q4nOAg==",
+      "signed_at": "2026-05-12T17:43:06.262Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1236,8 +1236,8 @@
         "LINDDUN-GO and LINDDUN-PRO updates incorporating LLM privacy threats",
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
-      "signature": "ewTvG5vu3ngFHyXgBur5vSKDFQsOZx0x79djGMricl7LCvQf5//OG6LZKXa+AOuEq58prRS+HgzrFA1DiTfeCQ==",
-      "signed_at": "2026-05-12T15:59:29.398Z"
+      "signature": "D/4d5NcJScNH58ADXsSrVzTmLSWZpUZTdyhtDkJlC0twSMNczOiDsXgYFitBaZgGdv5nVd00viR45mNrsaZ4BQ==",
+      "signed_at": "2026-05-12T17:43:06.263Z"
     },
     {
       "name": "webapp-security",
@@ -1310,8 +1310,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
-      "signature": "ZHjbKu0Em92Kimr2esL1g93mf9TmcsChBhVEMWf/lFrjeLcg8nyHEIcDstIZ3FWYgc6MQNHnc3Rup3Xp/Za1Cw==",
-      "signed_at": "2026-05-12T15:59:29.398Z"
+      "signature": "UOXaUtpcFjXyDQ70z2PaGu6K3pABtXp+7YzO6eGVGpN1CxXpPq/xW/CnTng6B7wk9WSsqD0OORBJp4VCjiVfAQ==",
+      "signed_at": "2026-05-12T17:43:06.263Z"
     },
     {
       "name": "ai-risk-management",
@@ -1360,8 +1360,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
-      "signature": "1KRxjCbAX0Rs5NTOioi1w/f1SOzDQrtRoXjTDtzEwJ+d1QzFf9cqmBlp0uXmGpL0bzEaHWIctjigSychmoL2Dw==",
-      "signed_at": "2026-05-12T15:59:29.399Z"
+      "signature": "IVKygsrFjiM64fQVbd2PT6jDjs6fm5nKwJSqGfK53gG0S9wdHC4QYuh+LWlI/2ftvIKjjedLQ6FRyTrqpDEuDw==",
+      "signed_at": "2026-05-12T17:43:06.263Z"
     },
     {
       "name": "sector-healthcare",
@@ -1420,8 +1420,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
-      "signature": "eiajFh7w7d4g+/crGalTtw9Qsu0deVsdHkdthZSy595ifGmgu0zaFD8usKThbPhOdUCCclTYkZYz5GalQmkhCw==",
-      "signed_at": "2026-05-12T15:59:29.399Z"
+      "signature": "P+CdSu8ZJCNUU4nTa09Voh2PcYF3y/AFJn4v7cjVIGo9FbbqO7MwvGN7cJ+aSRs2/3NMUXX4eupcODslxYyJDw==",
+      "signed_at": "2026-05-12T17:43:06.264Z"
     },
     {
       "name": "sector-financial",
@@ -1501,8 +1501,8 @@
         "OSFI B-13 (Technology and Cyber Risk Management) post-2024 examination findings",
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
-      "signature": "iSZR/fYESQVyjkcqj+O+yzU0BQfaELH5s7WizzUTWvDPDTD2ZyOnZTT1r/Zfx2l4mbPmVeFGWdYnnVFTk/i3Aw==",
-      "signed_at": "2026-05-12T15:59:29.399Z"
+      "signature": "zpEfh181Sc0b0cvRf/31Ir1f8lD4V5tehTogO3TJMxdKmXu06IAK7hrhBcLA/jFBv3xDDwrWW3sHzChVhWDeDA==",
+      "signed_at": "2026-05-12T17:43:06.264Z"
     },
     {
       "name": "sector-federal-government",
@@ -1570,8 +1570,8 @@
         "EU Cybersecurity Certification Scheme on Common Criteria (EUCC) operational — first certificates issued 2024; high-assurance level for government use cases ramping",
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
-      "signature": "Wjdo5YXEL8XeNZkaEueG1DOUoyalstNPzQkxD/cwP5iMrJWg/Ly+sC0Oluuqm3aU7d63z55PrbGQCJD0XVZqBg==",
-      "signed_at": "2026-05-12T15:59:29.400Z"
+      "signature": "7NpQlPu1DkpY9f+Frv/LLBHWUUe/qTM80c+xeYDxOzweXhvJGE/dnDCjglYHTjxT82L9cVxzBezvLEne20UpBg==",
+      "signed_at": "2026-05-12T17:43:06.264Z"
     },
     {
       "name": "sector-energy",
@@ -1635,8 +1635,8 @@
         "MadIoT-class research on consumer-IoT-driven grid frequency manipulation moving from proof-of-concept to attributed campaigns",
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
-      "signature": "c/l7dOHe0Zj6Ag3abUaEie6o0f8M4rhY5aPI9/wG4z6FDue9PzCVw8vUGoITFgg89g97lMfy2C3CE2PegQoFCw==",
-      "signed_at": "2026-05-12T15:59:29.400Z"
+      "signature": "4rhyHN5HykK7MQUmhvaTeDGj6Qf5swDd5ry8foh4KBvTkRKxTI/XyxconFGm5FASnySGPLMxX6m4JZAq5wiNBg==",
+      "signed_at": "2026-05-12T17:43:06.265Z"
     },
     {
       "name": "api-security",
@@ -1704,8 +1704,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
-      "signature": "9FgcJvYeo07QxQ+mnVRQk4jYLDMO/AVSXMs8cueO2f/qMOTQmrhBMVhj5ze7hzvXpGkp7EK/3Q1XKqde61JMAg==",
-      "signed_at": "2026-05-12T15:59:29.400Z"
+      "signature": "hS1izPhETclITK7fp6R67dhy+wFDti/YsJ2M5I1gDjeWZYK41WuxeYSyt5xEHbCr3WCGDFJe77jkK1MWkxk2BA==",
+      "signed_at": "2026-05-12T17:43:06.265Z"
     },
     {
       "name": "cloud-security",
@@ -1785,8 +1785,8 @@
         "eBPF-based runtime detection coverage of confidential-computing enclaves (AWS Nitro Enclaves, Azure Confidential VMs, GCP Confidential Space) — partial visibility is a tracked detection gap",
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
-      "signature": "xRA0XZf7VPtuBtbsm41bay9yBLphw/hlL3YxIUrpko5g9ldM3oJe9o1qSwzIj/wSnQSI29qqPpNsnlks+HEOCA==",
-      "signed_at": "2026-05-12T15:59:29.401Z"
+      "signature": "kuatqNZoRnv+oeyrxbnk+m37JRBIgRAWnDp0/IYLnoBOybiG09RzLILJraxjhvdSNCgo7WXTeBO3Y6a3Ji9MAA==",
+      "signed_at": "2026-05-12T17:43:06.265Z"
     },
     {
       "name": "container-runtime-security",
@@ -1847,8 +1847,8 @@
       ],
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
-      "signature": "GcU50DStuN1gU/Evm/sFRgeieQbqffVp12rgbGnasRX89Q7kM4ltFXB+bgCXHIvICzYb78hPIifWQb9UVupWBQ==",
-      "signed_at": "2026-05-12T15:59:29.401Z"
+      "signature": "Btb3/7fjPFopFVdxP7+E6n322gnAAwd7OPrnuqatq6c1rXTD9aXKxiBeCmWxs8zYbIbE/lFoe9R2g6uTp8ZDBg==",
+      "signed_at": "2026-05-12T17:43:06.266Z"
     },
     {
       "name": "mlops-security",
@@ -1918,8 +1918,8 @@
         "EU AI Act high-risk technical-file implementing acts (2026-2027) — operational requirements for Article 10 / 13 / 15 documentation may pin ML-BOM or model-signing",
         "MITRE ATLAS v5.2 — track AML.T0010 sub-technique expansion and any new MLOps-pipeline-specific TTPs"
       ],
-      "signature": "onIazpFoL1t4PMNRsoF06ggnl7BzCKjt0x+ZmVfWfyt1V06DgllsrbN3AAz4+g4jW2Sc71q0vIFKfwEUWpGVAQ==",
-      "signed_at": "2026-05-12T15:59:29.401Z"
+      "signature": "TBWnlgdllW7K1F10HCJ7p4dbLeS3lyNWm+7mNNtyZu7jB1V5AauG1P7sb1nLLqwKqeGlHS1F0eh/BNiuAvkABg==",
+      "signed_at": "2026-05-12T17:43:06.266Z"
     },
     {
       "name": "incident-response-playbook",
@@ -1980,8 +1980,8 @@
         "IL INCD Incident Response Process v4 (slated for 2026-2027) consolidating AI-incident sub-class",
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
-      "signature": "P0Yv4CtqbnBNP6nSIxQUYYHL7T7ci+iE7iE2UXVfnMPeWVdKG2nvRePjBXc3JZTLima1Txn/I5ocDNhLTIeUAQ==",
-      "signed_at": "2026-05-12T15:59:29.402Z"
+      "signature": "FVAXpD6sIoOLQSPtZSLLsXQnc2o2hRwiFj4xK8zEWJVkUWGqvAWRrngie7O2DRKIbWqjO5h9EevVYSzhwYHCAA==",
+      "signed_at": "2026-05-12T17:43:06.267Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2033,8 +2033,8 @@
       "cwe_refs": [],
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
-      "signature": "2pv81lLRbazpHqundCANb3YiLB4lkVsYctIDvI8rxSvHxhPS9jYXqmAoB5APSdDuOaew6XqpfZOehQUj9WmyBw==",
-      "signed_at": "2026-05-12T15:59:29.402Z"
+      "signature": "0HDt3Qklee4FQeKoZfwr+8qdq2pVDS0a+c7JxVw1hV/bl8+YTPaPjPTAhQUnbhUCa5cGo7G4MBQ1AifQTMJdDA==",
+      "signed_at": "2026-05-12T17:43:06.267Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2101,8 +2101,8 @@
         "France SREN (Securing and Regulating the Digital Space) Act 2024 — ARCOM age-verification referential for adult content services; double-anonymity model under deployment",
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
-      "signature": "BJ/YYnGVXeSBaR9oWAVrcNX7Wz+kE8R4CghX6+XEI/qY89fyrkKNNwo2veqqf49wffJhHVJ1wTp8ZDECjNp+Dw==",
-      "signed_at": "2026-05-12T15:59:29.402Z"
+      "signature": "UyPSKUztZI/daHCRTnAh6ryoKLX4xyjuG+EaNMPRVuCz2gANGl1F/NozDsw7R2koMUwSFoiYTzwqDvo1tpuKAg==",
+      "signed_at": "2026-05-12T17:43:06.267Z"
     }
   ]
 }

package/orchestrator/index.js

@@ -305,6 +305,19 @@ function runCurrency() {
 }
 
 async function runReport(format) {
+  // v0.11.6 (#98): validate format positional. Pre-0.11.6 unknown formats
+  // emitted a generic "# exceptd Report" header — silently accepted any
+  // string. Now: reject with structured JSON error matching other verbs.
+  const VALID_REPORT_FORMATS = ['executive', 'technical', 'compliance', 'csaf'];
+  if (!VALID_REPORT_FORMATS.includes(format)) {
+    process.stderr.write(JSON.stringify({
+      ok: false,
+      error: `report: format "${format}" not in accepted set ${JSON.stringify(VALID_REPORT_FORMATS)}.`,
+      verb: 'report',
+    }) + '\n');
+    process.exit(2);
+  }
+
   // v0.11.1 feature #55: `report csaf` emits a CSAF 2.0 envelope covering
   // every scanned finding + dispatched plan + currency posture. Useful for
   // VEX downstreams that ingest CSAF JSON.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.11.4",
+  "version": "0.11.7",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 38 skills, 10 catalogs, 34 jurisdictions, pre-computed indexes, Ed25519-signed.",
   "keywords": [
     "ai-security",
@@ -84,7 +84,7 @@
     "validate-package": "node lib/validate-package.js",
     "refresh-sbom": "node scripts/refresh-sbom.js",
     "predeploy": "node scripts/predeploy.js",
-    "prepublishOnly": "node scripts/predeploy.js && node lib/validate-package.js",
+    "prepublishOnly": "node -e \"if(process.env.EXCEPTD_SKIP_PREPUBLISH_PREDEPLOY!=='1'){const r=require('child_process').spawnSync(process.execPath,['scripts/predeploy.js'],{stdio:'inherit'});if(r.status){process.exit(r.status)}}\" && node lib/validate-package.js",
     "test:docker": "docker build --target predeploy -t exceptd-test:predeploy -f docker/test.Dockerfile . && docker run --rm exceptd-test:predeploy",
     "test:docker:fresh": "docker build --target fresh-bootstrap -t exceptd-test:fresh-bootstrap -f docker/test.Dockerfile . && docker run --rm exceptd-test:fresh-bootstrap",
     "scan": "node orchestrator/index.js scan",

package/sbom.cdx.json

@@ -1,10 +1,10 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:057eee67-86e4-4750-80f8-8dfdf5b5c9d3",
+  "serialNumber": "urn:uuid:ff8b6540-9c5a-497c-90cb-0b6a012bab82",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-12T15:59:30.308Z",
+    "timestamp": "2026-05-12T17:43:07.123Z",
     "tools": [
       {
         "name": "hand-written",
@@ -13,10 +13,10 @@
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.11.4",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.11.7",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.11.4",
+      "version": "0.11.7",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 38 skills, 10 catalogs, 34 jurisdictions, pre-computed indexes, Ed25519-signed.",
       "licenses": [
         {
@@ -25,11 +25,11 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.11.4",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.11.7",
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.11.4"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.11.7"
         },
         {
           "type": "vcs",