@blamejs/exceptd-skills 0.13.21 → 0.13.22

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.13.22 — 2026-05-19
+
+`ci` is now usable at the terminal without piping through `jq`.
+
+### Features
+
+- **Human-readable `ci` output by default.** Pre-0.13.22 the default `ci` output was 1000+ lines of indented JSON on every run. Now the default is a one-screen digest: verdict line, per-playbook table (id / verdict / rwep / evidence-completeness / top-finding), session-level warnings, scope-selection rules, framework gap rollup, and fail reasons. Pass `--json` or `--pretty` to get the structured body for automation.
+- **Per-result hoisted summary fields.** Every `run()` result now carries `verdict`, `rwep_score`, `top_finding`, `summary_line`, and `evidence_completeness` (one of `complete` / `partial` / `missing` / `unknown` / `not-evaluated`) at the top level. Machine-readable consumers no longer walk `phases.analyze.rwep.adjusted` and `phases.detect.classification` separately to extract the headline numbers.
+- **`indicators_evaluated` + `indicators_known` per result.** Surface how many of the playbook's known indicators were actually exercised by the operator's evidence, so a result that returns `verdict=inconclusive` with `indicators_evaluated=0` is distinguishable from one that evaluated every indicator and found no hits.
+- **Session-level warning de-duplication.** `ci` runs that span N playbooks no longer emit the same `bundle_publisher_unclaimed` warning N times. The summary now carries `runtime_warnings` and `runtime_warnings_count` with one entry per unique (kind, reason) across the session.
+- **Scope-inclusion transparency.** When `ci --scope <type>` is used, the summary now lists `scope_request` plus `scope_inclusion_rules` explaining that cross-cutting playbooks are always added and (for `--scope code`) that `sbom` is auto-included on repos with a lockfile.
+
+### Bugs
+
+- **Blocked results now carry `playbook_id`.** Previously, a playbook that halted at preflight returned `{ ok:false, blocked_by, reason }` with no playbook identifier — operators iterating `results[]` for failure rows had to correlate by array index. Now every result, blocked or not, carries `playbook_id` at the top level.
+
 ## 0.13.21 — 2026-05-19
 
 Seven new catalog-gap detection classes wired into the predeploy gate. The v0.13.19 detector covered missing-context / dangling-ref / draft-debt; the v0.13.20 audit confirmed that left genuine gap classes unsurfaced. v0.13.21 adds the seven cross-cutting classes the prior detector missed and wires them into a budget gate that runs alongside the existing tests + predeploy gates.

package/bin/exceptd.js

@@ -6814,6 +6814,46 @@ function cmdCi(runner, args, runOpts, pretty) {
     clock_started_reasons: clockStartedReasons,
   };
 
+  // v0.13.22 B5: Each `run()` call independently surfaces session-level
+  // runtime conditions (e.g. bundle_publisher_unclaimed) into its own
+  // phases.analyze.runtime_errors. On a ci run that spans 9 playbooks, the
+  // operator saw the same warning 9 times. Dedupe across results by
+  // (kind, reason) so a session-level condition surfaces once at the ci
+  // summary level — operators read one row, not N copies.
+  const warningSeen = new Set();
+  const runtimeWarningsDedup = [];
+  for (const r of results) {
+    const errs = r?.phases?.analyze?.runtime_errors || [];
+    for (const e of errs) {
+      const key = `${e.kind || ""}::${e.reason || ""}`;
+      if (warningSeen.has(key)) continue;
+      warningSeen.add(key);
+      runtimeWarningsDedup.push({
+        kind: e.kind || null,
+        reason: e.reason || null,
+        remediation: e.remediation || null,
+      });
+    }
+  }
+  summary.runtime_warnings = runtimeWarningsDedup;
+  summary.runtime_warnings_count = runtimeWarningsDedup.length;
+
+  // v0.13.22 B8 (transparency): document why each playbook was selected.
+  // --scope <s> always adds cross-cutting; --scope code on a repo with a
+  // lockfile also adds sbom. The selection rule was buried in code; surface
+  // it in the summary so operators reading the JSON / pretty trailer can
+  // see what was scoped vs. auto-included.
+  if (scope) {
+    summary.scope_request = scope;
+    summary.scope_inclusion_rules = [
+      `--scope ${scope} selected playbooks with _meta.scope === "${scope}"`,
+      `cross-cutting playbooks are always added (apply to every scope by design)`,
+    ];
+    if (scope === "code") {
+      summary.scope_inclusion_rules.push("--scope code also adds sbom when the cwd is a git repo with a lockfile");
+    }
+  }
+
   // v0.11.4 (#72): ci --format <fmt> previously emitted the full bundle
   // regardless of flag. Now honors the same shortcuts as `run --format`:
   //   summary  → one-line JSON of session + verdict + counts
@@ -6856,7 +6896,106 @@ function cmdCi(runner, args, runOpts, pretty) {
     );
     return;
   } else {
-    emit({ verb: "ci", session_id: sessionId, playbooks_run: ids, summary, results }, pretty);
+    // v0.13.22 B3+B4+B6: human renderer for `ci` default output. Pre-0.13.22
+    // the only output was indented JSON (or compact JSON when not TTY) —
+    // operators running `exceptd ci` at the terminal saw 1000+ lines of JSON
+    // for a 9-playbook scan and had to grep for the verdict by hand.
+    //
+    // Renderer shape (one screen for a typical 9-playbook scope):
+    //   - one verdict line (PASS/FAIL/BLOCKED + counts)
+    //   - per-playbook row: id | verdict | rwep | evidence | top_finding
+    //   - deduped session-level runtime warnings (B5)
+    //   - scope inclusion rules (B8 transparency) when --scope was used
+    //   - footer pointing at --json / --format for the structured body
+    emit({ verb: "ci", session_id: sessionId, playbooks_run: ids, summary, results }, pretty, (obj) => {
+      const s = obj.summary;
+      const lines = [];
+      lines.push(`ci: ${obj.playbooks_run.length} playbook(s)  session-id: ${obj.session_id}`);
+      const verdictIcon = s.verdict === "PASS"
+        ? "[ok]"
+        : s.verdict === "BLOCKED"
+          ? "[!! BLOCKED]"
+          : s.verdict === "CLOCK_STARTED"
+            ? "[!! CLOCK]"
+            : s.verdict === "NO_EVIDENCE"
+              ? "[i  NO_EVIDENCE]"
+              : "[!! FAIL]";
+      lines.push(`\n${verdictIcon}  verdict=${s.verdict}  detected=${s.detected}  inconclusive=${s.inconclusive}  clean=${s.not_detected}  blocked=${s.blocked}  max_rwep=${s.max_rwep_observed}`);
+
+      // Per-playbook table.
+      const rows = (obj.results || []).map(r => {
+        if (r && r.ok === false) {
+          return {
+            id: r.playbook_id || "?",
+            verdict: "blocked",
+            rwep: "-",
+            evidence: r.evidence_completeness || "not-evaluated",
+            top: r.blocked_by || r.reason || r.error || "",
+          };
+        }
+        const cls = r?.phases?.detect?.classification || r?.verdict || "?";
+        return {
+          id: r.playbook_id || "?",
+          verdict: cls,
+          rwep: (r?.rwep_score != null) ? String(r.rwep_score) : "-",
+          evidence: r?.evidence_completeness || "unknown",
+          top: r?.top_finding || "",
+        };
+      });
+      const wId = Math.max(8, ...rows.map(r => r.id.length));
+      const wV = Math.max(8, ...rows.map(r => r.verdict.length));
+      const wR = Math.max(4, ...rows.map(r => r.rwep.length));
+      const wE = Math.max(8, ...rows.map(r => r.evidence.length));
+      const pad = (s, w) => (s + " ".repeat(w)).slice(0, w);
+      lines.push("");
+      lines.push(`  ${pad("playbook", wId)}  ${pad("verdict", wV)}  ${pad("rwep", wR)}  ${pad("evidence", wE)}  finding`);
+      lines.push(`  ${"-".repeat(wId)}  ${"-".repeat(wV)}  ${"-".repeat(wR)}  ${"-".repeat(wE)}  -------`);
+      for (const row of rows) {
+        const finding = row.top.length > 80 ? row.top.slice(0, 77) + "..." : row.top;
+        lines.push(`  ${pad(row.id, wId)}  ${pad(row.verdict, wV)}  ${pad(row.rwep, wR)}  ${pad(row.evidence, wE)}  ${finding}`);
+      }
+
+      // Session-level deduped runtime warnings (B5).
+      if (s.runtime_warnings && s.runtime_warnings.length) {
+        lines.push(`\nSession warnings (${s.runtime_warnings_count}):`);
+        for (const w of s.runtime_warnings) {
+          const reason = (w.reason || "").length > 200 ? (w.reason || "").slice(0, 197) + "..." : (w.reason || "");
+          lines.push(`  [${w.kind || "warning"}] ${reason}`);
+          if (w.remediation) lines.push(`    → ${w.remediation}`);
+        }
+      }
+
+      // Scope inclusion (B8 transparency).
+      if (s.scope_inclusion_rules && s.scope_inclusion_rules.length) {
+        lines.push(`\nScope selection (${s.scope_request}):`);
+        for (const rule of s.scope_inclusion_rules) lines.push(`  - ${rule}`);
+      }
+
+      // Jurisdiction clocks.
+      if (s.jurisdiction_clocks_started > 0) {
+        lines.push(`\nJurisdiction clocks started: ${s.jurisdiction_clocks_started}`);
+        for (const n of (s.jurisdiction_clock_rollup || []).slice(0, 5)) {
+          lines.push(`  ${n.jurisdiction || "?"}/${n.regulation || "?"} → deadline ${n.deadline || "?"}`);
+        }
+      }
+
+      // Framework gap rollup.
+      if (s.framework_gap_count > 0) {
+        lines.push(`\nFramework gaps (${s.framework_gap_count}):`);
+        for (const g of (s.framework_gap_rollup || []).slice(0, 5)) {
+          lines.push(`  ${g.framework || "?"} :: ${g.claimed_control || "?"}  (${g.playbooks.length} playbook(s))`);
+        }
+      }
+
+      // Fail reasons.
+      if (s.fail_reasons && s.fail_reasons.length) {
+        lines.push(`\nFail reasons:`);
+        for (const r of s.fail_reasons) lines.push(`  - ${r}`);
+      }
+
+      lines.push(`\nFull structured result: --json (or --pretty for indented JSON).`);
+      return lines.join("\n");
+    });
   }
   // v0.11.14 (#134): exit-code matrix with BLOCKED before FAIL.
   // Pre-0.11.14 the `if (fail)` check fired first for blocked runs (because

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-19T20:58:49.735Z",
+  "generated_at": "2026-05-19T22:22:02.165Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "b8676a67b642f623974dccf3ba0f1df95836541b7c1dcd0c63cef2b71fa1a88a",
+    "manifest.json": "068eb6c464d8999f41906bd3ea080b6b579d6dc15c3c1b05c1caf94adb72cd27",
     "data/atlas-ttps.json": "d296c1d3e71807c9279b731f047e57796e85137f186586743a8cdad214b408f9",
     "data/attack-techniques.json": "49b6010b317edd219def135171ea8f3b1bbf1e00e9c5a08bf7237215ff54e2c3",
     "data/cve-catalog.json": "a09c83af3f9679a7ea73935726a1ff9de2cab94b4ab6321fc017fc147747d7c3",

package/lib/playbook-runner.js

@@ -3058,7 +3058,28 @@ function run(playbookId, directiveId, agentSubmission = {}, runOpts = {}) {
   }
   const pre = preflight(playbook, { ...runOpts, precondition_checks: mergedPCs });
   if (!pre.ok) {
-    return { ok: false, phase: 'preflight', blocked_by: pre.blocked_by, reason: pre.reason, issues: pre.issues, precondition_check_source: pcSource };
+    // v0.13.22 (B7 fix): blocked results MUST carry playbook_id +
+    // directive_id at the result root. Pre-v0.13.22 a `ci --scope code`
+    // run produced 9 results where the 3 blocked rows had no
+    // playbook_id, so operators iterating results[] couldn't tell
+    // which playbook produced which preflight failure without joining
+    // against playbooks_run[] by index. Also include `verdict:"blocked"`
+    // and a one-line `summary_line` for B2 + B6 flat-result-shape fixes.
+    const summaryLine = `${playbookId}: blocked at preflight (${pre.blocked_by || 'unknown'}) — ${pre.reason || ''}`.slice(0, 240);
+    return {
+      ok: false,
+      playbook_id: playbookId,
+      directive_id: directiveId,
+      verdict: 'blocked',
+      summary_line: summaryLine,
+      phase: 'preflight',
+      blocked_by: pre.blocked_by,
+      reason: pre.reason,
+      remediation: pre.remediation,
+      issues: pre.issues,
+      precondition_check_source: pcSource,
+      evidence_completeness: 'not-evaluated'
+    };
   }
 
   _activeRuns.add(playbookId);
@@ -3205,11 +3226,66 @@ function run(playbookId, directiveId, agentSubmission = {}, runOpts = {}) {
       }))
       .digest('hex');
 
+    // v0.13.22 — hoist the operator-facing summary to the result root
+    // (B2). Pre-v0.13.22 a `ci` consumer had to spelunk into
+    // phases.detect.classification + phases.analyze.rwep.adjusted to
+    // find the answer; the most common ops question ("did this
+    // playbook detect anything?") needs a one-line answer at the top.
+    //
+    // Verdict source: phases.detect.classification is the canonical
+    // verdict signal — one of detected / not_detected / inconclusive /
+    // pending / skipped. validate() does NOT carry a `verdict` field;
+    // an earlier draft of this hoist read phases.validate.verdict and
+    // therefore degraded every non-blocked result to "inconclusive"
+    // (codex P1 on PR #62).
+    const verdict = (phases.detect && phases.detect.classification) || 'inconclusive';
+    const rwepScore = phases.analyze && phases.analyze.rwep && typeof phases.analyze.rwep.adjusted === 'number'
+      ? phases.analyze.rwep.adjusted : null;
+    // Top finding = first matched CVE-id when present; otherwise the
+    // dominant indicator classification. The full set lives in phases.
+    let topFinding = null;
+    if (phases.analyze && Array.isArray(phases.analyze.matched_cves) && phases.analyze.matched_cves.length) {
+      topFinding = phases.analyze.matched_cves[0].cve_id;
+    } else if (phases.detect && phases.detect.classification
+        && phases.detect.classification !== 'not-detected'
+        && phases.detect.classification !== 'not_detected'
+        && phases.detect.classification !== 'inconclusive'
+        && phases.detect.classification !== 'pending') {
+      topFinding = phases.detect.classification;
+    }
+    // Evidence completeness (B9): the indicators-evaluated count vs
+    // the indicators-known count distinguishes "ran fully and found
+    // nothing" from "couldn't actually evaluate". Pre-v0.13.22 the two
+    // states looked identical at the result-root level.
+    const indicatorsKnown = (playbook.phases && playbook.phases.detect && playbook.phases.detect.indicators)
+      ? playbook.phases.detect.indicators.length : null;
+    const indicatorsEvaluated = phases.detect && typeof phases.detect.indicators_evaluated_count === 'number'
+      ? phases.detect.indicators_evaluated_count : null;
+    let evidenceCompleteness;
+    if (indicatorsKnown == null) evidenceCompleteness = 'unknown';
+    else if (indicatorsEvaluated == null) evidenceCompleteness = 'not-evaluated';
+    else if (indicatorsEvaluated === 0) evidenceCompleteness = 'missing';
+    else if (indicatorsEvaluated < indicatorsKnown) evidenceCompleteness = 'partial';
+    else evidenceCompleteness = 'complete';
+    const summaryLine = (rwepScore != null && rwepScore > 0)
+      ? `${playbookId}: ${verdict} (rwep=${rwepScore}${topFinding ? `, ${topFinding}` : ''}, evidence=${evidenceCompleteness})`
+      : `${playbookId}: ${verdict} (evidence=${evidenceCompleteness}${topFinding ? `, ${topFinding}` : ''})`;
     return {
       ok: true,
       playbook_id: playbookId,
       directive_id: directiveId,
       session_id: sessionId,
+      // Flat top-level fields (B2 + B6 + B9). Operators no longer need
+      // to spelunk through phases.* to get the answer to the most
+      // common question. The phases tree is still present below for
+      // anyone who needs the full CSAF / analyze / detect dumps.
+      verdict,
+      rwep_score: rwepScore,
+      top_finding: topFinding,
+      summary_line: summaryLine,
+      evidence_completeness: evidenceCompleteness,
+      indicators_evaluated: indicatorsEvaluated,
+      indicators_known: indicatorsKnown,
       evidence_hash: evidenceHash,
       submission_digest: submissionDigest,
       preflight_issues: pre.issues,

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.13.21",
+  "version": "0.13.22",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-19T20:58:00.287Z",
+      "signed_at": "2026-05-19T22:21:07.815Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -117,7 +117,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vSVqu4wBm+d68ujZmM6Rto/HzViCkE0gPUcv/MYE/bjFiqamf/s0On4kTOo1KIveV9cOwYNxiItaGEWlVkRFDg==",
-      "signed_at": "2026-05-19T20:58:00.289Z",
+      "signed_at": "2026-05-19T22:21:07.817Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -180,7 +180,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "RIgXKvolQjgJdnlrDnVOd90IOY1B7VHHZD/YJQRzouL+wUeOLclPrdK/EgEuFyiu7lR4bi+Pl6aGB9G9tOxYCQ==",
-      "signed_at": "2026-05-19T20:58:00.289Z",
+      "signed_at": "2026-05-19T22:21:07.817Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -226,7 +226,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "RYOxeq/o3uTwTWq4H7RcdH2Aclg9UyCERfUH9Frwkzncsowg7LgxpaEDc3swTCv73HMEGbU8wVbXguZ4JxHUCQ==",
-      "signed_at": "2026-05-19T20:58:00.290Z"
+      "signed_at": "2026-05-19T22:21:07.818Z"
     },
     {
       "name": "compliance-theater",
@@ -257,7 +257,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "DneJCPKCPcoe6nQ82XptqSqNfSRdt1orKaO+o7K36YCciDrzwJb+1BuBLusPDtpcdDaGY0y0e+AqiTYJklhBAQ==",
-      "signed_at": "2026-05-19T20:58:00.290Z"
+      "signed_at": "2026-05-19T22:21:07.818Z"
     },
     {
       "name": "exploit-scoring",
@@ -286,7 +286,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-19T20:58:00.291Z"
+      "signed_at": "2026-05-19T22:21:07.819Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -323,7 +323,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "XgrzcA2brPhXrSTxrcLnJec0OpgGYJBoSTUlJ10UdePHffxqb9LTVGnfbmEk1ykQifXREZexui2bG7X/+eFfCQ==",
-      "signed_at": "2026-05-19T20:58:00.291Z",
+      "signed_at": "2026-05-19T22:21:07.819Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -380,7 +380,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "9+hZlZOqZdeACUmamQk66L5levZhhwnFXuYRhdT6Mce99eQaKT7wNfWq12hXQztkRcVRKaFH+a01zwJQwsRQCA==",
-      "signed_at": "2026-05-19T20:58:00.291Z",
+      "signed_at": "2026-05-19T22:21:07.819Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -415,7 +415,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "ciqhVloMWWXEigPZvvwoV2c54tEqsDqsoc+sS/mNTFFJk2H+tz2+XUrgfEPRuYw0FeyNB6/+27pL2NpKHzUqAg==",
-      "signed_at": "2026-05-19T20:58:00.292Z",
+      "signed_at": "2026-05-19T22:21:07.819Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-19T20:58:00.292Z"
+      "signed_at": "2026-05-19T22:21:07.820Z"
     },
     {
       "name": "global-grc",
@@ -475,7 +475,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-19T20:58:00.292Z"
+      "signed_at": "2026-05-19T22:21:07.820Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -502,7 +502,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-19T20:58:00.293Z"
+      "signed_at": "2026-05-19T22:21:07.820Z"
     },
     {
       "name": "pqc-first",
@@ -554,7 +554,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vhc3wuQEro/86s1ro2b/KakUXg8QVnySYTBqA7ebzv9oeR2HYO5bvGEJp3oOHWtL37JDqcCAHYadSN/qxIyCCA==",
-      "signed_at": "2026-05-19T20:58:00.293Z",
+      "signed_at": "2026-05-19T22:21:07.821Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -601,7 +601,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "MS35nWm8djfJGn4OOoT0JKJ2aO+Dkbb6wOOWJYvNZlRKT3UGA59o2gxg1JOnD20hb/RwxtkmCujhl2tuYSR+AQ==",
-      "signed_at": "2026-05-19T20:58:00.293Z"
+      "signed_at": "2026-05-19T22:21:07.821Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -638,7 +638,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-19T20:58:00.294Z",
+      "signed_at": "2026-05-19T22:21:07.821Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -673,7 +673,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "WAu5fRirzSOcnnZsTx2d/JJZwa/LPpXCi+31qATTGLmoNuhyy81k3ooPe9kCM3E0CLMtvTePg9DagYqBninZDQ==",
-      "signed_at": "2026-05-19T20:58:00.294Z"
+      "signed_at": "2026-05-19T22:21:07.822Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -744,7 +744,7 @@
         "PTES revision incorporating AI-surface enumeration"
       ],
       "signature": "7eEwCXFd9pDKUw7yCUbRJSjfzozE44dwwwemCQUPm8JBPztLltibD9bL/RszSbYyCrYJmVb5Drncz2cGe62gCw==",
-      "signed_at": "2026-05-19T20:58:00.294Z"
+      "signed_at": "2026-05-19T22:21:07.822Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -804,7 +804,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-19T20:58:00.295Z"
+      "signed_at": "2026-05-19T22:21:07.822Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -879,7 +879,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "fgxG344JGYBWWWwFXZ1IzGipWKP7EyBhrsvsbsb0CCGXfv/MvNHVNI6G0zQddCsWX1JeQbhZT3Vk8v1uJKDTDA==",
-      "signed_at": "2026-05-19T20:58:00.295Z"
+      "signed_at": "2026-05-19T22:21:07.822Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -956,7 +956,7 @@
         "OpenSSF model-signing — emerging Sigstore-based signing standard for ML model weights; track for production adoption"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-19T20:58:00.295Z"
+      "signed_at": "2026-05-19T22:21:07.823Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1013,7 +1013,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "gqF8eU3VBrZhO2WnlcqKa7wm1d2mmWtvpbmx0kNCgHojNV+qEt+Ij84RO6bZvaUqhfYPWizWL79Fa4DL0curAQ==",
-      "signed_at": "2026-05-19T20:58:00.295Z"
+      "signed_at": "2026-05-19T22:21:07.823Z"
     },
     {
       "name": "identity-assurance",
@@ -1080,7 +1080,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-19T20:58:00.296Z"
+      "signed_at": "2026-05-19T22:21:07.823Z"
     },
     {
       "name": "ot-ics-security",
@@ -1136,7 +1136,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-19T20:58:00.296Z"
+      "signed_at": "2026-05-19T22:21:07.824Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1188,7 +1188,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-19T20:58:00.296Z"
+      "signed_at": "2026-05-19T22:21:07.824Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1238,7 +1238,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-19T20:58:00.297Z"
+      "signed_at": "2026-05-19T22:21:07.824Z"
     },
     {
       "name": "webapp-security",
@@ -1312,7 +1312,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-19T20:58:00.297Z"
+      "signed_at": "2026-05-19T22:21:07.825Z"
     },
     {
       "name": "ai-risk-management",
@@ -1362,7 +1362,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-19T20:58:00.297Z"
+      "signed_at": "2026-05-19T22:21:07.825Z"
     },
     {
       "name": "sector-healthcare",
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-19T20:58:00.298Z"
+      "signed_at": "2026-05-19T22:21:07.825Z"
     },
     {
       "name": "sector-financial",
@@ -1503,7 +1503,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-19T20:58:00.298Z"
+      "signed_at": "2026-05-19T22:21:07.826Z"
     },
     {
       "name": "sector-federal-government",
@@ -1572,7 +1572,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-19T20:58:00.299Z"
+      "signed_at": "2026-05-19T22:21:07.826Z"
     },
     {
       "name": "sector-energy",
@@ -1637,7 +1637,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-19T20:58:00.299Z"
+      "signed_at": "2026-05-19T22:21:07.827Z"
     },
     {
       "name": "sector-telecom",
@@ -1723,7 +1723,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-19T20:58:00.299Z"
+      "signed_at": "2026-05-19T22:21:07.827Z"
     },
     {
       "name": "api-security",
@@ -1792,7 +1792,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-19T20:58:00.299Z"
+      "signed_at": "2026-05-19T22:21:07.827Z"
     },
     {
       "name": "cloud-security",
@@ -1873,7 +1873,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-19T20:58:00.300Z"
+      "signed_at": "2026-05-19T22:21:07.827Z"
     },
     {
       "name": "container-runtime-security",
@@ -1935,7 +1935,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-19T20:58:00.300Z"
+      "signed_at": "2026-05-19T22:21:07.828Z"
     },
     {
       "name": "mlops-security",
@@ -2006,7 +2006,7 @@
         "MITRE ATLAS v5.6.0 (released February 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: ATLAS v5.5 / v6.0 — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "BGNE6ZQWBA1LmsUFe8tU0L67iGDSrFqiuqaZD2f1KqfcyqqzQfMs9PWNHFzxxaJmXeKlm87eU8lgELF0bX+RBA==",
-      "signed_at": "2026-05-19T20:58:00.300Z"
+      "signed_at": "2026-05-19T22:21:07.828Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2068,7 +2068,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "FkZQerh3VHVJAwIcCktDyMRh5KE2+Em/i0ek8zEz7JG/PXtQx8ujHWTh3VjZbOLhPNtdB2qxgXOIAYIofaVOAQ==",
-      "signed_at": "2026-05-19T20:58:00.301Z"
+      "signed_at": "2026-05-19T22:21:07.829Z"
     },
     {
       "name": "ransomware-response",
@@ -2148,7 +2148,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "n3UToNuN3A1HgLvcuqmIx8vrZY71+r/79waK92jG+rSX4uYOzkmxMUpROrE5K9bDwMezNBHdjWv8Uul6zugyDQ==",
-      "signed_at": "2026-05-19T20:58:00.301Z"
+      "signed_at": "2026-05-19T22:21:07.829Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2201,7 +2201,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-19T20:58:00.301Z"
+      "signed_at": "2026-05-19T22:21:07.829Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2269,7 +2269,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "+OO0RhQ303RJV7kaH38IuZpLeQbapep6Ds4Re/WEZu0FHBwKSlwvF7jbtP7KQ57xldJYn/xZm2jaszyOacMfDg==",
-      "signed_at": "2026-05-19T20:58:00.302Z"
+      "signed_at": "2026-05-19T22:21:07.830Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2349,7 +2349,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-19T20:58:00.302Z"
+      "signed_at": "2026-05-19T22:21:07.830Z"
     },
     {
       "name": "idp-incident-response",
@@ -2430,11 +2430,11 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-19T20:58:00.302Z"
+      "signed_at": "2026-05-19T22:21:07.830Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "EF8rdCmuUPJcyaBWGybS3mVEFH5OfQIz9PwmoySOh9OQtSKk3s23EnUcJlVZ9hU1kpdUM2Duv1at/PbwZprOCg=="
+    "signature_base64": "6RWl1bUtDhlyizAkvu6GBBmMFW7EvtD68X552wCliURN1GsvyvercoB2JDdXJFwR2rNZdlFuhxpWa7UR+4vGAg=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.13.21",
+  "version": "0.13.22",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:e9cd326f-3ca4-4e4f-987e-2d0206d0d1ac",
+  "serialNumber": "urn:uuid:7f62a713-9c4b-42e1-bfdf-a445644dcc1a",
   "version": 1,
   "metadata": {
-    "timestamp": "2150-04-20T18:11:59.000Z",
+    "timestamp": "2093-09-21T18:48:51.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.13.21"
+        "version": "0.13.22"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.21",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.22",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.13.21",
+      "version": "0.13.22",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.21",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.22",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0008dc2b26d4e59fc6986791da6277d43639c811ac5af5aa10f9b234a155921e"
+          "content": "dfcb0e018fbcbd75bfe5b68c68f21a46b30eb98e9663a6ca8a2b3318a447abbd"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.21"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.22"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c06c6600a1d4cbf20f87d080d9441658f0b4444023a565e1c3fe478fa35edab4"
+          "content": "f8f20d7d8a9c4a826dfe21240752016c9ddaa6e02c16b0c37fa04461dbb78c2b"
         },
         {
           "alg": "SHA3-512",
-          "content": "7b16e8b3b6d2a68892f336bd7b07159c2750e9fca29539cba437bdcae3be48e10c66c1c529c7f9a4fe71f0eab9a79d0a596f740ab5bc9f9d20fb6e51d555f17e"
+          "content": "fd4d4db63a2eae9d1cac3e745d53e3ec0af66bf7847cdba8922a9044d9c7658d348e0f82334e4642e06409c766493dd69ae16e78593e3e1fe2882a1025d1a33a"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1b86a9695a7438b4b87d90b1a0240daf0a2dc3e780761c0d73e53e3bbdc58cd9"
+          "content": "41c11c8960c05923ed4650f2a451029bd41f4149f24baf9f8d77dc5a5974bd12"
         },
         {
           "alg": "SHA3-512",
-          "content": "d79eabbafc3bce52e718c0f13603a133ac90107303a2266d02ad4041256e7d591c93389b1cbdffff1cbd80c73d178f6c5903d9e4064cdd1a1803c9979c00bb03"
+          "content": "27d6e17884c3a8e18a42a424086ebaaf48f1cfb9f8da0b83f91b16af7fb36cc3e1de9f05b39176310ecdbd8b84eb6e627134f64a4c37df9d32fededd72c14d80"
         }
       ]
     },
@@ -1031,11 +1031,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f5395b0e858ba67d5c78fe61dcb50ebbe8cff01ce38d7fdbf3cab6b30aa84afd"
+          "content": "34b9a8ed6d468fe83422e7fa1aae30d205ccd01e8f9e9e3f4a2273ab10f5cfc5"
         },
         {
           "alg": "SHA3-512",
-          "content": "1158047605ad81345d4899a29341be469f0f643bf16e7fd4455750d9934902ec6e1313968aca0cbba77224c35c37283b1683822760bf1042bc754d3940ea81b0"
+          "content": "fa5b647c27f0252d9ae1eae179a1b9e10c3186a87328f428c716c7adc74eac347aea5c6094fb7997295d32b3bfd18536709e1dba9659a4b807a274a233d227d8"
         }
       ]
     },
@@ -1451,11 +1451,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b8676a67b642f623974dccf3ba0f1df95836541b7c1dcd0c63cef2b71fa1a88a"
+          "content": "068eb6c464d8999f41906bd3ea080b6b579d6dc15c3c1b05c1caf94adb72cd27"
         },
         {
           "alg": "SHA3-512",
-          "content": "fc5556bf27093bda786f564caaba523dec5d39f92e1b09ce9e5011f8411cf3add4892cd28330ec4f0b08e8bb6ba61c7a1849cc4ecdad64bd8df7b03afc58650d"
+          "content": "258f9d6343d5b9a2d983ed483e8038d2442d7830fe1d5a8b84541bd8fbae9a2dbd23a682c7e34cc769fea48ca22bd7cfc49ed21ba8f3dab7bac384f77ea24490"
         }
       ]
     },