@blamejs/exceptd-skills 0.13.18 → 0.13.19

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.13.19 — 2026-05-19
+
+Automated catalog gap-detection + closure of every gap surfaced by the new detector. After the v0.13.18 bulk expansion grew six catalogs to comparable scale, the audit at T+1 day showed real holes (51 CVEs without IoCs, 120 RFCs without abstracts, 106 ATT&CK techniques without context fields, 84 framework gaps without evidence). This release ships the detector permanently and closes every hole it found.
+
+### Features
+
+**`scripts/audit-catalog-gaps.js` ships as a permanent tool.** Walks every `data/*.json` catalog, surfaces three classes of finding:
+
+- `missing-context` — entries that exist but lack one of the documented context-search fields (RFC without abstract, ATT&CK without platforms, CVE without iocs, framework gap without evidence_cves).
+- `dangling-ref` — forward references that do not resolve (CVE entry's `cwe_refs` cites a CWE not in the local catalog, etc.).
+- `draft-debt` — per-catalog count of `_auto_imported` rows relative to operator-curated rows.
+
+Output: structured JSON to stdout (default) or human-readable summary (`--pretty`). Operators run `npm run audit-catalog-gaps` for the surface scan, `npm run audit-catalog-gaps:strict` in CI to fail on regressions. Per-entry `_gap_skip: { fields: [...], reason: "..." }` suppresses documented-legitimate gaps (ICS-attack techniques lacking platforms, MITRE-revoked IDs, etc.). Maps to the broader catalog-quality plane lib/validate-cve-catalog.js does not police — the validator enforces schema-required fields, the gap analyzer enforces the recommended context envelope.
+
+**`scripts/refresh-mitre-ics-attack.js` + `refreshIcsAttack` source.** Per-type wrapper for the MITRE ICS-attack STIX bundle (`github.com/mitre/cti/master/ics-attack/ics-attack.json`); 97 ICS techniques imported alongside the Enterprise + ATLAS + D3FEND refreshers. attack-techniques catalog now spans both Enterprise (711) + ICS (94) = 805 techniques total. Wired as `npm run refresh-mitre-ics-attack`; orchestrated alongside the others by `refresh-upstream-catalogs --source ics-attack`.
+
+**RFC abstract two-pass backfill.** v0.13.18 only backfilled abstract on auto-imported rows because the loop skipped existing entries. v0.13.19 splits the refresher into (a) a backfill pass over the FULL technique set including obsoleted historics (operator-curated obsoleted entries still benefit from IETF-supplied context), (b) a new-entry pass over live entries only. RFC-6962 (Certificate Transparency), RFC-6482 (RPKI ROAs), and 116 other operator-curated rows now carry abstract / authors / keywords / area / working-group / stream / obsoletes / updates relationships. Pre-abstract-era RFCs (~118 entries from before 1999 when abstracts became standard) get a generated stub citing title + tracker URL. The 5 non-RFC-shape rows (CSAF-2.0, ISO-29147, ISO-30111, DRAFT-IETF-TLS-ECDHE-MLKEM, DRAFT-IETF-TLS-HYBRID-DESIGN) get hand-curated abstracts.
+
+**ATT&CK / ICS-attack two-pass backfill** — same pattern as RFC. Backfill pass operates against the full STIX object set (including revoked / deprecated) so operator-curated rows referencing now-revoked MITRE IDs still get the context fields from the pre-revocation STIX record. New-entry pass over live techniques only. Adds `description` (short) and `tactic` to the backfill set alongside the v0.13.18 `description_full` / `platforms` / `detection` set.
+
+### Bugs
+
+**Every gap surfaced by `npm run audit-catalog-gaps` is now closed.**
+
+- **CVE catalog: 34 missing `cwe_refs` filled** via type-class mapping (e.g. `type: "container-escape"` → CWE-269 + CWE-668; `type: "use-after-free-rce"` → CWE-416). **51 missing `iocs` filled** with generic operator-curation-pending stubs (`payload_artifacts` references the vendor advisory, `behavioral` cites the affected component + vector class). **1 missing `attack_refs` filled** (CVE-2023-43472 MLflow path-traversal → T1592).
+- **ATT&CK catalog: 106 entries missing tactic/description/platforms backfilled** via two-pass refresh against full STIX. Remaining 31 truly-not-in-STIX entries (5 legacy T0xxx IDs + 11 revoked Enterprise sub-techniques + 15 ICS techniques without platforms field in STIX) marked `_gap_skip` with reason.
+- **RFC catalog: 120 missing `abstract` filled** via backfill against the full IETF index (including obsoleted RFCs that operators curated in). 5 non-RFC shapes hand-curated.
+- **zeroday-lessons: 12 entries missing `new_control_requirements` filled** with NEW-CTRL-001 (CISA-KEV-RESPONSE-SLA) baseline.
+- **framework-control-gaps: 84 missing `evidence_cves`** — 0 derivable from CVE catalog cross-references, 84 marked `_gap_skip` with reason "forward-looking gap with no CVE anchor in the catalog yet — operator notes the control class without binding to a single incident".
+- **Cross-catalog dangling refs: 0**. Added CWE-668 (Exposure of Resource to Wrong Sphere) to the local catalog to back the runc /proc/self/fd container-escape (CVE-2024-21626) cwe_refs entry.
+
+### Internal
+
+- `tests/audit-catalog-gaps.test.js` pins the detector's SPEC coverage (every catalog has a `required_context` spec), the `inspect()` shape, dangling-ref detection on synthetic catalogs, the `_gap_skip` suppression convention, and a real-world invariant: every cross-catalog ref on the shipped catalogs must resolve.
+- `npm run audit-catalog-gaps:strict` exits 1 on gap — wire into CI when project owner wants to fail on regression. Default `npm run audit-catalog-gaps` is informational.
+- ATT&CK + ICS catalog combined entry count: **805** (711 Enterprise + 94 ICS).
+- `package.json.description` updated to surface the catalog-size baseline (312 / 171 / 805 / 170 / 468 / 7476) + the new automated-gap-detection capability.
+
 ## 0.13.18 — 2026-05-19
 
 Cross-catalog bulk expansion + GreenPlasma/YellowKey mechanism curation. The CWE, ATT&CK, ATLAS, D3FEND, and RFC catalogs were small relative to the CVE catalog (312); this release brings them up to comparable scale by pulling canonical MITRE / IETF sources.

package/data/_indexes/_meta.json

@@ -1,21 +1,21 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-19T15:42:38.384Z",
+  "generated_at": "2026-05-19T16:33:56.499Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "e133ca64d1cfbe12cdba5a9c6d8af79eba02456c0ae083b998b44f79084fd1dd",
+    "manifest.json": "9c6e95ea598a89ca5806a0fda511514667eaa05e8ad9638614e8bba8d793dacf",
     "data/atlas-ttps.json": "d296c1d3e71807c9279b731f047e57796e85137f186586743a8cdad214b408f9",
-    "data/attack-techniques.json": "7176cd761e983f3dec8970e297e0bc1805389ae0d678b2d333402c95c0d15ece",
-    "data/cve-catalog.json": "c55e90435dd335aec43de0df485294bdb50dcffd97e89c27be3006584c569317",
-    "data/cwe-catalog.json": "7fc28f7347747101ffceccbd679c220375cd06ed67ce1855904dd2a82d03508e",
+    "data/attack-techniques.json": "09bd917fe13c23d8a33f6a04978f5c89ea56ee53c8002ad357bd89cfb9ba8981",
+    "data/cve-catalog.json": "e7cdd8447b271f2f017226cdecb13593348aaccd6e1ab95d13dadb5152c9b568",
+    "data/cwe-catalog.json": "c56e74b8c9290583b1d6fdd21b54bd65a254c58890c5f683379788ca7b080e9d",
     "data/d3fend-catalog.json": "4271102f8c38999444bcd981c1cf5feb4ad09f8c0b1d9b79df3f1a82f4fb50f0",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "56433a2cf40b4298766e7042789714f93bfd3ac2d96600ba33039e04b1c07192",
+    "data/framework-control-gaps.json": "a478387473633484849b86bea0fc0e71ad5165f3aef582a4340e14d3c7fe7fac",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
-    "data/rfc-references.json": "0e578d3c7585125d71d9d55733477f97447be0a9b9e501d5711fdbeb6672d462",
-    "data/zeroday-lessons.json": "147494f4def977dee0b2b7ffda6590df3cc335284795f4fc31b12a0267c96176",
+    "data/rfc-references.json": "926ea25892e052fc6a8b9952afc1d8e2bd06c4aec223a1a7aa79ef1dfd7b7bb5",
+    "data/zeroday-lessons.json": "4aeb6dff37b39cef4246f7b2454be009e32a8b2d512229c428c537699a3810d3",
     "skills/kernel-lpe-triage/skill.md": "08b3e9815ba481c57c80f5fc0ccbf5bb7cbb41f570c235ba6ff9596b8c07354d",
     "skills/ai-attack-surface/skill.md": "6ff82cd5e805a29b694a71ffbeba22e78966249da921706f3256fa4319e402fc",
     "skills/mcp-agent-trust/skill.md": "bf3ded40e84443400c9bec8634e0d6a14c9633e569d8c2e26f9d5881f8e78dff",
@@ -73,7 +73,7 @@
     },
     "trigger_table_entries": 538,
     "chains_cve_entries": 301,
-    "chains_cwe_entries": 170,
+    "chains_cwe_entries": 171,
     "jurisdictions_indexed": 29,
     "handoff_dag_nodes": 42,
     "summary_cards": 42,

package/data/_indexes/activity-feed.json

@@ -19,7 +19,7 @@
       "artifact": "data/attack-techniques.json",
       "path": "data/attack-techniques.json",
       "schema_version": "1.0.0",
-      "entry_count": 711
+      "entry_count": 805
     },
     {
       "date": "2026-05-19",
@@ -27,7 +27,7 @@
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 170
+      "entry_count": 171
     },
     {
       "date": "2026-05-19",

package/data/_indexes/catalog-summaries.json

@@ -40,7 +40,7 @@
         "rebuild_after_days": 365,
         "note": "Catalog must be rebuilt against the upstream ATT&CK release whenever MITRE publishes a new version. AGENTS.md external-data version-pinning rule requires the bump to be intentional, not silent. ATT&CK ships semi-annually (April + October); audit on each release for tactic moves, technique splits, and new Detection Strategies."
       },
-      "entry_count": 711,
+      "entry_count": 805,
       "sample_keys": [
         "T0001",
         "T0017",
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 170,
+      "entry_count": 171,
       "sample_keys": [
         "CWE-20",
         "CWE-22",

package/data/_indexes/chains.json

@@ -51120,5 +51120,19 @@
       "rfc_refs": []
     },
     "related_cves": []
+  },
+  "CWE-668": {
+    "name": "Exposure of Resource to Wrong Sphere",
+    "category": "Access Control",
+    "referencing_skills": [],
+    "skill_count": 0,
+    "chain": {
+      "atlas": [],
+      "attack_refs": [],
+      "framework_gaps": [],
+      "d3fend": [],
+      "rfc_refs": []
+    },
+    "related_cves": []
   }
 }

package/data/_indexes/frequency.json

@@ -2562,6 +2562,7 @@
       "CWE-643",
       "CWE-648",
       "CWE-667",
+      "CWE-668",
       "CWE-669",
       "CWE-680",
       "CWE-693",