@blamejs/exceptd-skills 0.13.126 → 0.14.1

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:32f2fea7-594e-4f57-8918-9672fc443ace",
+  "serialNumber": "urn:uuid:f314cd42-a14d-460d-8188-2c921279d9fa",
   "version": 1,
   "metadata": {
-    "timestamp": "2053-02-01T08:28:23.000Z",
+    "timestamp": "2155-03-27T16:45:54.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.13.126"
+        "version": "0.14.1"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.126",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.1",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.13.126",
+      "version": "0.14.1",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.126",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.1",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d54248255d700efd5903c8a5f92b3a40251dccad40c7bdd078f7d5c74d9674df"
+          "content": "6ea7d61c6ae7aba517340fd82e5b67162f72facb5a4e197fffeeab4f484f6f69"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.126"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.1"
         },
         {
           "type": "vcs",
@@ -86,11 +86,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0ec673f44c7b80e8b775b3e6db07a679a12177e2245a0068e393352671a5b841"
+          "content": "6327718cdd949622fbd4af0846fab9a0a5a8f501e173f014534fe8ff4ba22110"
         },
         {
           "alg": "SHA3-512",
-          "content": "7a6a6b8c606e30804b1e2452124b824d50a174e67c9470814f1c541c1db7cc3bd9b5f6ff03980f8c2c0add8526710a8c82654c934f1a89df608c49cd910f57b1"
+          "content": "146c237d4f022c4a9819ad11d0328b592bc234d38dbcb7e5cf78149fe5497ed81769e68520e91a9600767200119594ed3a7234add92d1c12a087bd9b1fa7a116"
         }
       ]
     },
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d9eb5981e8c9c549deaf8142e82ea0eb67fdbb15e08f16a573f12c6c305a5aab"
+          "content": "30c671180052f66a71168c21beec9a1d5c8487a739317e29b5d7228c2b0ab218"
         },
         {
           "alg": "SHA3-512",
-          "content": "6a6fefb7ba11176fb7ad5a80ffaa6f0b87b328b244174c01aa96abc8d5f091c5989f8c4bd04ff9520c620e0867476242fe601c788a8c62b8bab8e7ef377de1fd"
+          "content": "5a7f8489061b1dfece4f08d2cfbce2188e83f7083eac4589db730af01d6e5ebbf1aae138bcb0a8648bd253bacc4d03e19042927cefad09d35a5081086767a00f"
         }
       ]
     },
@@ -176,11 +176,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2d16cbfc6ff8e1c2a435bcb3903445792a2fb794a595a63fdb9fe6ac4c1fd644"
+          "content": "ae39088caf4e044bf0449b97c99acfe76ad30b8a9d8e008b438f1cbda0dc16d5"
         },
         {
           "alg": "SHA3-512",
-          "content": "93b6d2a34c7560b23232e05ab349bd13c10110100cc32dc670301a9d794f247008603d9e2824541aa6b637a6e90e7e03726341e6dcad2f5a79f274676379d46d"
+          "content": "21a01dee170f40b3b5d77360fb209c89b60a8decbbf4c0a871d72176fed03cfb7b45698830741802a903deee84c601ab25a47db6d600679e259368a4ce4c171d"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "80af79165a79ce43ed0acf5e9b49f0087814457d4ed486466d75c7746794ce7f"
+          "content": "348586ab0d2d6ffecb4d5533451cb4135e60f21340cd4a1147790390504d7f09"
         },
         {
           "alg": "SHA3-512",
-          "content": "5e7e4f9b67c4bbb1db9435cf7af7f11b689722129768bf60320b2aea6dc072e69208733a46f043357c279bc9eb3982b0c6ad06745dab7998a96d299fcf842137"
+          "content": "33e828f638074f2066143cd8f3e6b5728a15b9d9601297f92bf02d131a975adbc4b5c5b1101ffbfe6172806949de1a87bd81fb15039d17456db0e3a1cee6770e"
         }
       ]
     },
@@ -469,6 +469,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:data/playbooks/citation-hygiene.json",
+      "type": "file",
+      "name": "data/playbooks/citation-hygiene.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "69b25f892979583d886409379562b9a1a97f27f1dc0094480155b8086fec6798"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "62a1b38da1c1865a18d1fe585e8a57cf0f346a3999e91df9dd1a4e52e942ec892b16dcf5af8f726e921f3297044ed54f627cf8549f6b78c6e71520e68f1d93aa"
+        }
+      ]
+    },
     {
       "bom-ref": "file:data/playbooks/cloud-iam-incident.json",
       "type": "file",
@@ -859,6 +874,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:lib/citation-resolve.js",
+      "type": "file",
+      "name": "lib/citation-resolve.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "cbfe304f39dfcc2a889171ff92c17b0c8590ccf69f2883cf630499ef4e89d04f"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "92057e0bfc5e24cdac6251fd35aaab415afe3ea9a5a31623016779d0e7ad3d56fc607dea815c6cd7fd21ccbcc9294ecfe8817486c6611611b0ca4f9113d4178c"
+        }
+      ]
+    },
     {
       "bom-ref": "file:lib/collectors/README.md",
       "type": "file",
@@ -896,11 +926,26 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5441b080f37a284a89b8a7d8c490d9ef9a98556ecc48f824bea43e8d691e0d15"
+          "content": "863401bc0695c24ff874651a7c1accf4f64bcce041cb38beccc4f0264d2ca2dc"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "2b522780fb1a08f9cd3485ce2d0b7f1789ee82fbb24ebab96eea3485b17815213bbbaba26d84a24bc522b813069288f27212b575205ebe423e9e5c3c31844643"
+        }
+      ]
+    },
+    {
+      "bom-ref": "file:lib/collectors/citation-hygiene.js",
+      "type": "file",
+      "name": "lib/collectors/citation-hygiene.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "8968e632e4e77d7e13bce63579cebae448f2fe5aacb11984203891771bcc75f7"
         },
         {
           "alg": "SHA3-512",
-          "content": "a27460bf3bd23ed5544925c4263c26af54cbd870e7e7244fdae9e645a3103e108c11df52fbcd789cfc24706b68301ca88e329b9ae5fc5727a95a6a018d1847e8"
+          "content": "575dd30aab3a6568d9b4f351df493b64bf740edf6c99e3db0003685f6851e286ac7c6b2bb3d7d94ad05a562d690c2c7a951c7176fbe586a518ecad65fe6f1e91"
         }
       ]
     },
@@ -911,11 +956,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a274c03349d64dd08d9e8b5451cbe03e28ca6ab83f52b1bab7ab131f889dd4d2"
+          "content": "262c2f130934dc1b6ebc913022c22416e5831d5a5d6edc561b76c238effce55a"
         },
         {
           "alg": "SHA3-512",
-          "content": "b92163edbb677305ed8f870deb4e69b8ec9a7f51caff692355ec612ba497e0bb3a739b5cd1d0663f02302fd9625306750dd8fe22fd999c44775571989c496af8"
+          "content": "cf58367fe3110bce44331acd279984e58a8eab417bd97afe12a48b68064234b3786a843294de17a90ae5c3f81bb60d9663b002bc84d03372e133a243c2fcdd7a"
         }
       ]
     },
@@ -941,11 +986,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0c72aa5cdcd81fbf2c963a8a7203b3cdc89d5295a13cfbcde6d2ad3a1b37f873"
+          "content": "0a787c60af275a8333087569725a61fdefc0baf2b76076689c2f0a84751b0f95"
         },
         {
           "alg": "SHA3-512",
-          "content": "e0c5d01e04a1e4ffd0d186b8228e51148b1cb355d9b1c860a4a4ff3f050233a8c5f4ccadf1a867aa785e6c37c030c321627cef6af76040cdc69e580cba72caf2"
+          "content": "98b61cb38b79aaa556c6b34243fbdd798f1307ecebab09ffdee647f92a7ad388d8110f47ba1e3bff0a01e833c306fb3b9ed243c945e4eb4d448a314bff042571"
         }
       ]
     },
@@ -1001,11 +1046,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e28a1aff9926086e6d14f7c00a4dc5282a30027da948f7f03ca8edb4139f3ee5"
+          "content": "6a40b3d23b3e524064e8fa4499f1a81e28238d08e3c2f91e6c2127ce6809f21a"
         },
         {
           "alg": "SHA3-512",
-          "content": "032695579e142f988017d0ce3f9f1c06ee92ac1bd0d82b6a2cfd967d246e6d5657d0fc9c7f636f8abc6820f2439736d75f1e321329f5a2942d9c857e8ad15892"
+          "content": "b097b4de51845a2f1d88ea8d4d891568f9a76e9b9bdd4d280e962ec84af57c5136a47804d0cd005e4e8fbdd50513d0666409463b5958a03da4520f20f750cfa9"
         }
       ]
     },
@@ -1054,6 +1099,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:lib/collectors/scan-excludes.js",
+      "type": "file",
+      "name": "lib/collectors/scan-excludes.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "329a31ed657b2fc57b51a5e66e5bed05ada149b48e1c469ae02ed2242794efa9"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "c5024081f23b7d72c8b5287e2392f840b525bcba855d6a555ab9ed562fb84668eaacc801ae0b420b49439ad83f48dd1f653bcbb1f9aa6cf898c99ecc560a61ff"
+        }
+      ]
+    },
     {
       "bom-ref": "file:lib/collectors/secrets.js",
       "type": "file",
@@ -1061,11 +1121,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "33456838e7363a51fcd69738fc1aa286ee30e53ed7049d64d672ca1994008e71"
+          "content": "40541ea833836853ab38775d6c840680c36da15a374508acd5710dc7f04a4181"
         },
         {
           "alg": "SHA3-512",
-          "content": "f310033529ffa980515daa40c155b309a56263a05214723df5567db709e22372a5caa772ba1ff0a4cd4e4ff1e398ecf4f81f15c186729fbe7c3d0e123ba16be9"
+          "content": "d63e298bd5c38e5c5a6b55770611df01d1a12ad46863875b2625a5b5dba29fd0d25e492c606d3a6e1bab3b56554555b44d2ef00714fcdded4ed495fb07fab8c4"
         }
       ]
     },
@@ -1084,6 +1144,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:lib/cve-cli.js",
+      "type": "file",
+      "name": "lib/cve-cli.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "b1012dac78542a9c7fad7945ee1c15671d710a39d054ab9a6ef0a8f78c9282f2"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "6b2892048c6338da5ea68a490bd861d71e7ff31affb2fdbe13b48202d7b71b6b9ea453692f4cdca6c756725b747f4310fc174e21cf2700fda32022ab57955e20"
+        }
+      ]
+    },
     {
       "bom-ref": "file:lib/cve-curation.js",
       "type": "file",
@@ -1151,11 +1226,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9e412eb83d9416b34b89ad33565d984588a5d8055a3e61774be274b7aa5526f6"
+          "content": "37998843b3fce6b56fd7f18124302ee21335e43174aa445e307c578b0cfcf8ea"
         },
         {
           "alg": "SHA3-512",
-          "content": "4abeb57900856853b7b2eb6ae3099efc14acbd6319747eecffab915ee000172ee64583950753ab245a477f5f4fc5800173907e4bf81098943a128d1b9c3c4742"
+          "content": "6953bae9370604540ecefb1434d622524e57083ec8afba76cf431f8b41f5a48ee948208667bc2677fcebb301440df74029fa3e075f366ecb915567de25079282"
         }
       ]
     },
@@ -1271,11 +1346,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f769111b2412cd0ae3ff6f2adc54002355a271262d79a2c645a4e0f41e2a1c1a"
+          "content": "15ad90a0ad6522d51f1e76b3ad9f7d6853f0545a9c26b9bd5571ce13273b1a36"
         },
         {
           "alg": "SHA3-512",
-          "content": "5f58125b5706702ad3c6f1c4738772d8a61f6183426af178ae3666f16c8201c623920f668f0b83075484bfd1b100b83563161b7e36e6ffba7c073af5dadbb4b9"
+          "content": "6ac2fed3aae167c69b9d06ead294a7dd6e9848c034ac65319ad1da6f7839dee852b85f36e9ab1e1bef3e63e386139ea092b79228d055d71573142f2f28d2a0cc"
         }
       ]
     },
@@ -1294,6 +1369,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:lib/rfc-cli.js",
+      "type": "file",
+      "name": "lib/rfc-cli.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "53800bf89522a15e0f8f6f888c5f04410f6c17a2c6537738dc74d5e173a9d43c"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "170bbfd54710e1834f1d6e64d6c22c15f6e884bd874053c42c7d1dbbb42effa937572ba8d6617af7c0f698776e13b9a350ad020ebe06bac6a3f9cb972a30ec6c"
+        }
+      ]
+    },
     {
       "bom-ref": "file:lib/schemas/cve-catalog.schema.json",
       "type": "file",
@@ -1301,11 +1391,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bb1ad0a64b9e05c39d4bc3bd31615938f77510fd61a0c48b735386043a9ace22"
+          "content": "8ed8c965f9f1725313333abbc032b0d85a03653cc979781948cc770b88c11659"
         },
         {
           "alg": "SHA3-512",
-          "content": "78a5e6c3b66098f70f5b8801ec50f35d2b238f96c79111ced74ba210d1779bc703f342c2b17f76a0b43c2b385d0f6ae6475c9e51e44ac019f903570339285b03"
+          "content": "91b4583a35b86beecc84f6c217b5b3bc5a432f4b6c56667c9d83aad774b44fedc00d42186394084828abe7978f1bc645dc213a8aeccfe714f5b6dcdb3273b1fa"
         }
       ]
     },
@@ -1406,11 +1496,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b2d732410344770094eaa11d0918d434e6123caafa468099fff025940ee91531"
+          "content": "06dc58abb5ed96d7e85c625e5fca1a49ccb23451771104de8ea1fbb097a484e1"
         },
         {
           "alg": "SHA3-512",
-          "content": "4f3f3f4e3fa302a60a8cd8e6a5ee43c7c615f8ada41da92ce219e280a4d0e370903c80cc621d707232f8fe541c9d70943ff3028c24d0dbba01a05003f806b268"
+          "content": "900372a6681d99d2dba8ce3bc1a575f0a5225f6ae34808fe96cf6b7b988a728b82bc1a2c798a7225915009d55115276f58e8b877be23b3a773e8d3548846e0ab"
         }
       ]
     },
@@ -1421,11 +1511,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1e26aaae86262153a0ffca56cde65a8ddab6cb1c9061ca318fe542855c1dc0d8"
+          "content": "73a41241f2b425aebada9ea641590cb8d596390f93f9e87d07c35f3cb1b1421c"
         },
         {
           "alg": "SHA3-512",
-          "content": "a27f70e507c9eef93d749ea999a52fc5202490893c4ad04d24188c908a7e1e3773c1964430db93ef69f2013b59054e9987352a2f5493dcb6c648cf2ae6dd5a84"
+          "content": "53728b018b92ab98300b76b097884c2984a2c7b56f4bf059c5be7b84c37eb8084fd90673588aba7f2f02b14b0e9959010026aa4684d3d6660e705f41308439cc"
         }
       ]
     },
@@ -1526,11 +1616,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5de9a1f65caca9bbc38fb669bc571de4f9d0855b6cd316044792411d1f30399c"
+          "content": "fa34eff1166720bc4f2f72bb6b1cd2d98c1e803fd7e5b192631ae0f2fcba48dd"
         },
         {
           "alg": "SHA3-512",
-          "content": "30446655bdc888b3313153f565856f8e0dd70916d0c48971565e9ffead975efe779fa08c583e44637a0a359f17b05a8dbd5fca67654edf49f9ef65cc6106f514"
+          "content": "062707a2721ff3b9f38a4220d377eae456ac28ca6765fd10ede310959fd62ec078649fea9fd21f826f041b84353cd4549c5a3f90004c7949a70b9aa128910707"
         }
       ]
     },
@@ -1661,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "13900334f14a87189b4cda1d1357f2efc6075283f24eb1c149ec4309db01a400"
+          "content": "cc72d668222e9cd18eaef7928e173ad17434ff4b411235bbba2b13fca722db9e"
         },
         {
           "alg": "SHA3-512",
-          "content": "2cf2fa246e0c4cafe3870f0d8c1bbb70c34e781bf8a4fcf6e46a18bf34fda5af02c76b60f0b552d351007958bf05eab1b65bdfee8f58d2c1610a137837c9fd17"
+          "content": "3103116d6bd5207b8850de36cbd1b4d2495b7b2be19429731f5232356058aaefb78e6aff2f9fdba80f1f3cc89759c10a8c4aa9ec30b7220e96263b10beb2697b"
         }
       ]
     },
@@ -2066,11 +2156,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a79fcefca5c48f5fb21b8b397861e317ef77a615cf00a867619ba5ed52bb3604"
+          "content": "5f7978dd042ae7c80e98610c6f26a9eade31618357c4611926023bba2483f2c4"
         },
         {
           "alg": "SHA3-512",
-          "content": "54a59929bebe5fc10e11e7cb8d89b08a2ea119a0cbeb228f8a1eacfdb771698582ae9243b87cf6163b6e119930fcc54b63c2aa3c858c805934148363c925bfe2"
+          "content": "bec0430494961404b184d09d8271ebbe7c9145b5782cff7c6f5c0d66e5b68255019179177d00d8f12a201f67353e7c9d3cbf36eb9351b3b3ceb32dba47e56e37"
         }
       ]
     },
@@ -3056,11 +3146,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "85543a2f2305c95d4d881769885b12c45107ea61e60f6bd2fd26c6a5bd068bf7"
+          "content": "eadeff28bc343c7f7c270a6bc1a7593449cd1d238e49e4e3f74817d07b91de9a"
         },
         {
           "alg": "SHA3-512",
-          "content": "726a0c0ef9da2fa7dd9b5de8bed5c12926fa1f7bd9b3ccee0a275014b3f2f056db82d41b8c3e53f65fa82def8f9a7d9a90fa9985ceb3446a1b6c253a4db53d4c"
+          "content": "920540ecd16f41814cf345ebfe505093efb1501c58aa81cd3dfb58237ac2d25264b6c33331d0989d22944df2edbcfa1d656bb177ab5af98d928f3838e954a5ae"
         }
       ]
     },

package/scripts/check-agents-md-collectors.js

@@ -58,6 +58,14 @@ function main() {
   try {
     collectorFiles = fs.readdirSync(COLLECTOR_DIR)
       .filter(f => f.endsWith(".js"))
+      // A collector is a module exporting a collect() function. Shared
+      // helpers under lib/collectors/ (e.g. scan-excludes.js, the directory-
+      // walk exclusion policy) are not collectors and must not inflate the
+      // count or be required in the AGENTS.md enumeration.
+      .filter(f => {
+        try { return typeof require(path.join(COLLECTOR_DIR, f)).collect === "function"; }
+        catch { return false; }
+      })
       .map(f => `lib/collectors/${f}`)
       .sort();
   } catch (e) {

package/sources/validators/cve-validator.js

@@ -112,6 +112,27 @@ function extractNvdCvss(nvdJson) {
   };
 }
 
+// NVD carries the authoritative assignment lifecycle in `vulnStatus`
+// ("Rejected", "Disputed", "Analyzed", "Awaiting Analysis", "Modified", …)
+// and dispute/quality flags in `cveTags[].tags` (e.g. "disputed",
+// "unsupported-when-assigned"). Both live on the same vuln object the CVSS
+// extractor already reads — surfacing them is what lets exceptd answer
+// "is this CVE rejected/disputed?" instead of leaving an agent to look it up.
+function extractNvdStatus(nvdJson) {
+  const vuln = nvdJson?.vulnerabilities?.[0]?.cve;
+  if (!vuln) return { vulnStatus: null, tags: [] };
+  const tags = [];
+  for (const ct of (Array.isArray(vuln.cveTags) ? vuln.cveTags : [])) {
+    for (const t of (Array.isArray(ct?.tags) ? ct.tags : [])) {
+      if (typeof t === 'string') tags.push(t);
+    }
+  }
+  return {
+    vulnStatus: typeof vuln.vulnStatus === 'string' ? vuln.vulnStatus : null,
+    tags,
+  };
+}
+
 function pushDiscrepancy(list, field, local, fetched, severity = 'warning') {
   list.push({ field, local, fetched, severity });
 }
@@ -153,6 +174,9 @@ async function validateCve(cveId, localEntry) {
     in_kev: null,
     kev_date: null,
     epss: null,
+    nvd_vuln_status: null,   // NVD's authoritative status string, e.g. "Rejected"
+    cve_tags: [],            // NVD cveTags, e.g. ["disputed"]
+    description: null,       // NVD English description — the product/scope claim a citation must match
     sources: { nvd: null, kev: null, epss: null },
   };
   const discrepancies = [];
@@ -175,6 +199,12 @@ async function validateCve(cveId, localEntry) {
       fetched.sources.nvd = { reachable: true, found: false };
     } else {
       cveFoundInNvd = true;
+      const st = extractNvdStatus(nvdResult.json);
+      fetched.nvd_vuln_status = st.vulnStatus;
+      fetched.cve_tags = st.tags;
+      const vuln = nvdResult.json?.vulnerabilities?.[0]?.cve;
+      const enDesc = (Array.isArray(vuln?.descriptions) ? vuln.descriptions : []).find(d => d?.lang === "en");
+      fetched.description = (enDesc && typeof enDesc.value === "string") ? enDesc.value : null;
       const cvss = extractNvdCvss(nvdResult.json);
       if (cvss) {
         fetched.cvss_score = cvss.score;
@@ -224,6 +254,21 @@ async function validateCve(cveId, localEntry) {
     return { cve_id: cveId, status: 'missing', discrepancies, fetched, local, drift };
   }
 
+  // --- Rejected / disputed short-circuit ---
+  // A MITRE/NVD-REJECTED record still returns totalResults:1, so without this
+  // a rejected CVE would fall through and be CVSS-drift-checked as if valid.
+  // Surface it as its own status — this is the signal that catches a cited
+  // CVE that was withdrawn after assignment (the class an agent otherwise has
+  // to confirm by hand against NVD).
+  if (cveFoundInNvd && /^rejected$/i.test(fetched.nvd_vuln_status || '')) {
+    return { cve_id: cveId, status: 'rejected', discrepancies, fetched, local, drift };
+  }
+  const disputed = (fetched.cve_tags || []).some(t => /disputed/i.test(t)) ||
+    /disputed/i.test(fetched.nvd_vuln_status || '');
+  if (cveFoundInNvd && disputed) {
+    pushDiscrepancy(discrepancies, 'cve_status', local?.status ?? null, 'disputed', 'high');
+  }
+
   // --- Compare CVSS (only if NVD reachable & has data) ---
   if (cveFoundInNvd && fetched.cvss_score !== null && local.cvss_score !== null) {
     if (Math.abs(fetched.cvss_score - local.cvss_score) > 0.05) {
@@ -274,4 +319,4 @@ async function validateCve(cveId, localEntry) {
   return { cve_id: cveId, status, discrepancies, fetched, local, drift };
 }
 
-module.exports = { validateCve, getKevCache, resetKevCache };
+module.exports = { validateCve, getKevCache, resetKevCache, extractNvdStatus };