@blamejs/exceptd-skills 0.13.44 → 0.13.46

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.13.46 — 2026-05-21
+
+`doctor` now health-checks the collector layer.
+
+### Features
+
+- **`doctor --collectors` (and folded into the default `doctor` pass).** Walks every `data/playbooks/<id>.json`, looks up `lib/collectors/<id>.js`, requires the module, verifies `playbook_id` matches the file name AND `collect` is exported as a function. Reports counts via a new `checks.collectors: { ok, total_playbooks, with_collector, without_collector, load_errors, policy_skips }` envelope field. `policy_skips` enumerates the ten judgement-shaped playbooks (incident / governance / pure-analyze) that are intentionally without a collector per AGENTS.md — operators see "10 missing is by design, not regression." Any `load_errors` (require fails, `playbook_id` mismatch, missing `collect` export) fail the gate. Closes the deterministic-collector layer: 13/23 playbooks have collectors, the remaining 10 are policy-skipped.
+- **Human renderer** prints `[ok] collector layer: <with>/<total> playbooks have collectors (N judgement-shaped playbooks intentionally without a collector — see AGENTS.md)`. Per-collector load errors render as `[!!] <id>: <error>` lines.
+
+## 0.13.45 — 2026-05-21
+
+`discover` surfaces collector availability per recommendation.
+
+### Features
+
+- **`discover` recommendations now include `collector_available: bool` + `collect_cmd: string|null`.** Each entry in `recommended_playbooks[]` is enriched with on-disk lookup of `lib/collectors/<id>.js`. Operators who discover a relevant playbook for their cwd no longer need to guess whether running it requires manual evidence translation — the next-step command is right there. Playbooks without a collector show the recommendation line unchanged; `exceptd brief <id>` remains the path for manual evidence.
+- **Human renderer** prints `[collector]` after the playbook id and a `→ exceptd collect <id> | exceptd run <id> --evidence -` pipe-pointer line for entries where the collector exists. Entries without a collector render unchanged. Padding widened from 20 to 32 columns to accommodate the tag.
+
 ## 0.13.44 — 2026-05-21
 
 Thirteenth reference collector.

package/bin/exceptd.js

@@ -1114,6 +1114,8 @@ function dispatchPlaybook(cmd, argv) {
             // were already accepted; explicit registration removes the silent
             // "unknown bool flag" surface in parseArgs.
             "shipped-tarball", "registry-check", "signatures", "currency", "cves", "rfcs",
+            // doctor --collectors health-checks the collector layer.
+            "collectors",
             // doctor --exit-codes dumps the canonical exit-code table.
             "exit-codes"],
     multi: ["playbook", "format"],
@@ -1162,7 +1164,7 @@ function dispatchPlaybook(cmd, argv) {
   // through without a refusal.
   const PASSTHROUGH_FLAGS = new Set([
     "directive", "domain", "phase", "signal-list", "explain",
-    "signatures", "currency", "cves", "rfcs", "shipped-tarball",
+    "signatures", "currency", "cves", "rfcs", "shipped-tarball", "collectors",
     "human", "json-stdout-only", "max-rwep", "diff-from-latest",
     "upstream-check", "latest", "force-replay", "flat", "directives",
     "fix", "session-key", "all", "scope", "playbook",
@@ -5572,6 +5574,19 @@ function cmdDiscover(runner, args, runOpts, pretty) {
   // Always include cross-cutting framework correlation.
   recommend("framework", "cross-cutting: framework correlation always applicable");
 
+  // Enrich each recommendation with whether a companion collector
+  // exists for the playbook. Operators who discover a relevant
+  // playbook for their cwd should see one pipe away from running
+  // it (rather than having to translate the playbook's look phase
+  // into a filesystem walk by hand).
+  const collectorsDir = path.join(PKG_ROOT, "lib", "collectors");
+  for (const rec of recs) {
+    const collectorPath = path.join(collectorsDir, rec.id + ".js");
+    const hasCollector = fs.existsSync(collectorPath);
+    rec.collector_available = hasCollector;
+    rec.collect_cmd = hasCollector ? `exceptd collect ${rec.id}` : null;
+  }
+
   const nextSteps = [
     "exceptd brief <playbook>       # learn what a playbook checks",
     "exceptd run <playbook>          # run it",
@@ -5634,7 +5649,11 @@ function cmdDiscover(runner, args, runOpts, pretty) {
   lines.push("");
   lines.push(`Recommended playbooks (${recs.length}):`);
   for (const r of recs) {
-    lines.push(`  - ${r.id.padEnd(20)} ${r.reason}`);
+    const tag = r.collector_available ? " [collector]" : "";
+    lines.push(`  - ${(r.id + tag).padEnd(32)} ${r.reason}`);
+    if (r.collector_available) {
+      lines.push(`      → ${r.collect_cmd} | exceptd run ${r.id} --evidence -`);
+    }
   }
   lines.push("");
   lines.push("Next steps:");
@@ -5675,11 +5694,13 @@ function cmdDoctor(runner, args, runOpts, pretty) {
   const onlyCves = !!args.cves;
   const onlyRfcs = !!args.rfcs;
   const onlyAiConfig = !!args["ai-config"];
-  const anySelected = onlySigs || onlyCurrency || onlyCves || onlyRfcs || onlyAiConfig;
+  const onlyCollectors = !!args.collectors;
+  const anySelected = onlySigs || onlyCurrency || onlyCves || onlyRfcs || onlyAiConfig || onlyCollectors;
   const runSigs = !anySelected || onlySigs;
   const runCurrency = !anySelected || onlyCurrency;
   const runCves = !anySelected || onlyCves;
   const runRfcs = !anySelected || onlyRfcs;
+  const runCollectors = !anySelected || onlyCollectors;
   const runSigning = !anySelected;
   // --ai-config is opt-in — never runs as part of the default no-flag
   // doctor pass. Operators ask for it explicitly.
@@ -6119,6 +6140,64 @@ function cmdDoctor(runner, args, runOpts, pretty) {
     if (errorFindings.length > 0 && (!args.fix || fixesFailed > 0)) issues.push('ai_config');
   }
 
+  // Collector-layer health gate. Walks every playbook, looks up the
+  // matching `lib/collectors/<id>.js`, requires the module, verifies
+  // `playbook_id` matches the file name AND `collect` is exported.
+  // policy_skips is the catalogued set of judgement-shaped playbooks
+  // (incident / governance / pure-analyze) that intentionally have no
+  // collector per AGENTS.md — operators see "10 missing is by design,
+  // not regression."
+  if (runCollectors) {
+    try {
+      const playbookDir = path.join(PKG_ROOT, "data", "playbooks");
+      const collectorDir = path.join(PKG_ROOT, "lib", "collectors");
+      const POLICY_SKIPS = [
+        "framework", "ransomware", "ai-discovered-cve-triage",
+        "cloud-iam-incident", "idp-incident", "identity-sso-compromise",
+        "llm-tool-use-exfil", "supply-chain-recovery",
+        "post-quantum-migration", "webhook-callback-abuse",
+      ];
+      const playbookFiles = fs.readdirSync(playbookDir)
+        .filter(f => f.endsWith(".json") && !f.startsWith("_"))
+        .map(f => f.replace(/\.json$/, ""))
+        .sort();
+      const without_collector = [];
+      const load_errors = [];
+      let with_collector = 0;
+      for (const pid of playbookFiles) {
+        const collectorPath = path.join(collectorDir, pid + ".js");
+        if (!fs.existsSync(collectorPath)) { without_collector.push(pid); continue; }
+        try {
+          delete require.cache[require.resolve(collectorPath)];
+          const mod = require(collectorPath);
+          if (mod.playbook_id !== pid) {
+            load_errors.push({ id: pid, error: `playbook_id mismatch: module exports "${mod.playbook_id}"` });
+          } else if (typeof mod.collect !== "function") {
+            load_errors.push({ id: pid, error: "collect is not a function" });
+          } else {
+            with_collector++;
+          }
+        } catch (e) {
+          load_errors.push({ id: pid, error: `require failed: ${e.message}` });
+        }
+      }
+      const ok = load_errors.length === 0;
+      checks.collectors = {
+        ok,
+        severity: ok ? "info" : "error",
+        total_playbooks: playbookFiles.length,
+        with_collector,
+        without_collector,
+        load_errors,
+        policy_skips: POLICY_SKIPS.sort(),
+      };
+      if (!ok) issues.push("collectors");
+    } catch (e) {
+      checks.collectors = { ok: false, severity: "error", error: e.message };
+      issues.push("collectors");
+    }
+  }
+
   // Walk every check and split: errors (severity error/missing/fail) vs warnings
   // (severity warn). all_green is true ONLY when zero errors AND zero warnings.
   // v0.13.11: bucketing logic extracted to lib/doctor-bucketing.js so the
@@ -6300,6 +6379,21 @@ function cmdDoctor(runner, args, runOpts, pretty) {
       lines.push(`  [!!] attestation signing: private key MISSING (.keys/private.pem) — run \`exceptd doctor --fix\` to enable`);
     }
   }
+  if (checks.collectors) {
+    const c = checks.collectors;
+    const icon = c.ok ? "[ok]" : "[!!]";
+    const skipNote = Array.isArray(c.policy_skips) && c.policy_skips.length > 0
+      ? ` (${c.policy_skips.length} judgement-shaped playbooks intentionally without a collector — see AGENTS.md)`
+      : "";
+    lines.push(`  ${icon} collector layer: ${c.with_collector ?? "?"}/${c.total_playbooks ?? "?"} playbooks have collectors${skipNote}`);
+    if (Array.isArray(c.load_errors) && c.load_errors.length > 0) {
+      lines.push(`       ${c.load_errors.length} collector(s) failed to load:`);
+      for (const e of c.load_errors.slice(0, 5)) {
+        lines.push(`       [!!] ${e.id}: ${e.error}`);
+      }
+      if (c.load_errors.length > 5) lines.push(`       … and ${c.load_errors.length - 5} more (use --json for full list)`);
+    }
+  }
   if (checks.ai_config) {
     const c = checks.ai_config;
     const findings = Array.isArray(c.findings) ? c.findings : [];

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-21T14:25:45.130Z",
+  "generated_at": "2026-05-21T14:53:58.627Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "eee433070d0e766d2ea4810837835afd85d8a36b8307c3b4d66051b083c35f0a",
+    "manifest.json": "1d66eceec3346e24947e121ac2252dcc16c31d02a98d6c81f1b05e0bdce847bc",
     "data/atlas-ttps.json": "d296c1d3e71807c9279b731f047e57796e85137f186586743a8cdad214b408f9",
     "data/attack-techniques.json": "49b6010b317edd219def135171ea8f3b1bbf1e00e9c5a08bf7237215ff54e2c3",
     "data/cve-catalog.json": "a09c83af3f9679a7ea73935726a1ff9de2cab94b4ab6321fc017fc147747d7c3",

package/lib/flag-suggest.js

@@ -109,7 +109,7 @@ const VERB_FLAG_ALLOWLIST = Object.freeze({
   reattest: [
     'playbook', 'since', 'latest', 'force-replay', 'attestation-root',
   ],
-  doctor: ['signatures', 'cves', 'rfcs', 'fix', 'registry-check', 'exit-codes', 'shipped-tarball', 'ai-config', 'currency'],
+  doctor: ['signatures', 'cves', 'rfcs', 'fix', 'registry-check', 'exit-codes', 'shipped-tarball', 'ai-config', 'currency', 'collectors'],
   lint: ['evidence'],
   collect: ['cwd'],
   refresh: [

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.13.44",
+  "version": "0.13.46",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-21T14:14:25.595Z",
+      "signed_at": "2026-05-21T14:50:53.773Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -117,7 +117,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vSVqu4wBm+d68ujZmM6Rto/HzViCkE0gPUcv/MYE/bjFiqamf/s0On4kTOo1KIveV9cOwYNxiItaGEWlVkRFDg==",
-      "signed_at": "2026-05-21T14:14:25.597Z",
+      "signed_at": "2026-05-21T14:50:53.775Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -180,7 +180,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "RIgXKvolQjgJdnlrDnVOd90IOY1B7VHHZD/YJQRzouL+wUeOLclPrdK/EgEuFyiu7lR4bi+Pl6aGB9G9tOxYCQ==",
-      "signed_at": "2026-05-21T14:14:25.598Z",
+      "signed_at": "2026-05-21T14:50:53.776Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -226,7 +226,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "RYOxeq/o3uTwTWq4H7RcdH2Aclg9UyCERfUH9Frwkzncsowg7LgxpaEDc3swTCv73HMEGbU8wVbXguZ4JxHUCQ==",
-      "signed_at": "2026-05-21T14:14:25.598Z"
+      "signed_at": "2026-05-21T14:50:53.776Z"
     },
     {
       "name": "compliance-theater",
@@ -257,7 +257,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "DneJCPKCPcoe6nQ82XptqSqNfSRdt1orKaO+o7K36YCciDrzwJb+1BuBLusPDtpcdDaGY0y0e+AqiTYJklhBAQ==",
-      "signed_at": "2026-05-21T14:14:25.599Z"
+      "signed_at": "2026-05-21T14:50:53.777Z"
     },
     {
       "name": "exploit-scoring",
@@ -286,7 +286,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-21T14:14:25.599Z"
+      "signed_at": "2026-05-21T14:50:53.778Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -323,7 +323,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "XgrzcA2brPhXrSTxrcLnJec0OpgGYJBoSTUlJ10UdePHffxqb9LTVGnfbmEk1ykQifXREZexui2bG7X/+eFfCQ==",
-      "signed_at": "2026-05-21T14:14:25.600Z",
+      "signed_at": "2026-05-21T14:50:53.778Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -380,7 +380,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "9+hZlZOqZdeACUmamQk66L5levZhhwnFXuYRhdT6Mce99eQaKT7wNfWq12hXQztkRcVRKaFH+a01zwJQwsRQCA==",
-      "signed_at": "2026-05-21T14:14:25.600Z",
+      "signed_at": "2026-05-21T14:50:53.778Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -415,7 +415,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "ciqhVloMWWXEigPZvvwoV2c54tEqsDqsoc+sS/mNTFFJk2H+tz2+XUrgfEPRuYw0FeyNB6/+27pL2NpKHzUqAg==",
-      "signed_at": "2026-05-21T14:14:25.600Z",
+      "signed_at": "2026-05-21T14:50:53.779Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-21T14:14:25.601Z"
+      "signed_at": "2026-05-21T14:50:53.779Z"
     },
     {
       "name": "global-grc",
@@ -475,7 +475,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-21T14:14:25.601Z"
+      "signed_at": "2026-05-21T14:50:53.780Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -502,7 +502,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-21T14:14:25.602Z"
+      "signed_at": "2026-05-21T14:50:53.780Z"
     },
     {
       "name": "pqc-first",
@@ -554,7 +554,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vhc3wuQEro/86s1ro2b/KakUXg8QVnySYTBqA7ebzv9oeR2HYO5bvGEJp3oOHWtL37JDqcCAHYadSN/qxIyCCA==",
-      "signed_at": "2026-05-21T14:14:25.602Z",
+      "signed_at": "2026-05-21T14:50:53.780Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -601,7 +601,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "MS35nWm8djfJGn4OOoT0JKJ2aO+Dkbb6wOOWJYvNZlRKT3UGA59o2gxg1JOnD20hb/RwxtkmCujhl2tuYSR+AQ==",
-      "signed_at": "2026-05-21T14:14:25.603Z"
+      "signed_at": "2026-05-21T14:50:53.781Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -638,7 +638,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-21T14:14:25.604Z",
+      "signed_at": "2026-05-21T14:50:53.781Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -673,7 +673,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "WAu5fRirzSOcnnZsTx2d/JJZwa/LPpXCi+31qATTGLmoNuhyy81k3ooPe9kCM3E0CLMtvTePg9DagYqBninZDQ==",
-      "signed_at": "2026-05-21T14:14:25.604Z"
+      "signed_at": "2026-05-21T14:50:53.781Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -744,7 +744,7 @@
         "PTES revision incorporating AI-surface enumeration"
       ],
       "signature": "7eEwCXFd9pDKUw7yCUbRJSjfzozE44dwwwemCQUPm8JBPztLltibD9bL/RszSbYyCrYJmVb5Drncz2cGe62gCw==",
-      "signed_at": "2026-05-21T14:14:25.604Z"
+      "signed_at": "2026-05-21T14:50:53.782Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -804,7 +804,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-21T14:14:25.605Z"
+      "signed_at": "2026-05-21T14:50:53.782Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -879,7 +879,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "fgxG344JGYBWWWwFXZ1IzGipWKP7EyBhrsvsbsb0CCGXfv/MvNHVNI6G0zQddCsWX1JeQbhZT3Vk8v1uJKDTDA==",
-      "signed_at": "2026-05-21T14:14:25.605Z"
+      "signed_at": "2026-05-21T14:50:53.782Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -956,7 +956,7 @@
         "OpenSSF model-signing — emerging Sigstore-based signing standard for ML model weights; track for production adoption"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-21T14:14:25.605Z"
+      "signed_at": "2026-05-21T14:50:53.783Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1013,7 +1013,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "gqF8eU3VBrZhO2WnlcqKa7wm1d2mmWtvpbmx0kNCgHojNV+qEt+Ij84RO6bZvaUqhfYPWizWL79Fa4DL0curAQ==",
-      "signed_at": "2026-05-21T14:14:25.606Z"
+      "signed_at": "2026-05-21T14:50:53.783Z"
     },
     {
       "name": "identity-assurance",
@@ -1080,7 +1080,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-21T14:14:25.606Z"
+      "signed_at": "2026-05-21T14:50:53.783Z"
     },
     {
       "name": "ot-ics-security",
@@ -1136,7 +1136,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-21T14:14:25.606Z"
+      "signed_at": "2026-05-21T14:50:53.784Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1188,7 +1188,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-21T14:14:25.607Z"
+      "signed_at": "2026-05-21T14:50:53.784Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1238,7 +1238,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-21T14:14:25.607Z"
+      "signed_at": "2026-05-21T14:50:53.784Z"
     },
     {
       "name": "webapp-security",
@@ -1312,7 +1312,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-21T14:14:25.607Z"
+      "signed_at": "2026-05-21T14:50:53.785Z"
     },
     {
       "name": "ai-risk-management",
@@ -1362,7 +1362,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-21T14:14:25.608Z"
+      "signed_at": "2026-05-21T14:50:53.785Z"
     },
     {
       "name": "sector-healthcare",
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-21T14:14:25.609Z"
+      "signed_at": "2026-05-21T14:50:53.786Z"
     },
     {
       "name": "sector-financial",
@@ -1503,7 +1503,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-21T14:14:25.610Z"
+      "signed_at": "2026-05-21T14:50:53.786Z"
     },
     {
       "name": "sector-federal-government",
@@ -1572,7 +1572,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-21T14:14:25.610Z"
+      "signed_at": "2026-05-21T14:50:53.786Z"
     },
     {
       "name": "sector-energy",
@@ -1637,7 +1637,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-21T14:14:25.611Z"
+      "signed_at": "2026-05-21T14:50:53.787Z"
     },
     {
       "name": "sector-telecom",
@@ -1723,7 +1723,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-21T14:14:25.611Z"
+      "signed_at": "2026-05-21T14:50:53.787Z"
     },
     {
       "name": "api-security",
@@ -1792,7 +1792,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-21T14:14:25.611Z"
+      "signed_at": "2026-05-21T14:50:53.787Z"
     },
     {
       "name": "cloud-security",
@@ -1873,7 +1873,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-21T14:14:25.612Z"
+      "signed_at": "2026-05-21T14:50:53.788Z"
     },
     {
       "name": "container-runtime-security",
@@ -1935,7 +1935,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-21T14:14:25.612Z"
+      "signed_at": "2026-05-21T14:50:53.788Z"
     },
     {
       "name": "mlops-security",
@@ -2006,7 +2006,7 @@
         "MITRE ATLAS v5.6.0 (released February 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: ATLAS v5.5 / v6.0 — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "BGNE6ZQWBA1LmsUFe8tU0L67iGDSrFqiuqaZD2f1KqfcyqqzQfMs9PWNHFzxxaJmXeKlm87eU8lgELF0bX+RBA==",
-      "signed_at": "2026-05-21T14:14:25.613Z"
+      "signed_at": "2026-05-21T14:50:53.789Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2068,7 +2068,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "FkZQerh3VHVJAwIcCktDyMRh5KE2+Em/i0ek8zEz7JG/PXtQx8ujHWTh3VjZbOLhPNtdB2qxgXOIAYIofaVOAQ==",
-      "signed_at": "2026-05-21T14:14:25.613Z"
+      "signed_at": "2026-05-21T14:50:53.789Z"
     },
     {
       "name": "ransomware-response",
@@ -2148,7 +2148,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "n3UToNuN3A1HgLvcuqmIx8vrZY71+r/79waK92jG+rSX4uYOzkmxMUpROrE5K9bDwMezNBHdjWv8Uul6zugyDQ==",
-      "signed_at": "2026-05-21T14:14:25.614Z"
+      "signed_at": "2026-05-21T14:50:53.789Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2201,7 +2201,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-21T14:14:25.614Z"
+      "signed_at": "2026-05-21T14:50:53.790Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2269,7 +2269,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "+OO0RhQ303RJV7kaH38IuZpLeQbapep6Ds4Re/WEZu0FHBwKSlwvF7jbtP7KQ57xldJYn/xZm2jaszyOacMfDg==",
-      "signed_at": "2026-05-21T14:14:25.615Z"
+      "signed_at": "2026-05-21T14:50:53.790Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2349,7 +2349,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-21T14:14:25.615Z"
+      "signed_at": "2026-05-21T14:50:53.790Z"
     },
     {
       "name": "idp-incident-response",
@@ -2430,11 +2430,11 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-21T14:14:25.615Z"
+      "signed_at": "2026-05-21T14:50:53.791Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "yzoa4nQKqqtR5YIwboVmjqBZe16FBPqLjiMLIlnOfPwls5DkBUnZVrClvq04gc7nWDyzxrSkj0ZDhT3WkMc7CA=="
+    "signature_base64": "qeGyiPf8B6xvnsv7kqWuG5RdUhyupPI1GjmlvRyTonv+UERIhReiJ0YBDSeYkUBiv1wJGZhtUcFbnkJo7luJCA=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.13.44",
+  "version": "0.13.46",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:b68630e1-862f-416e-9970-9a04675a7b54",
+  "serialNumber": "urn:uuid:23307b47-15b6-44f7-80ff-3ecb498f1f5b",
   "version": 1,
   "metadata": {
-    "timestamp": "2123-01-15T16:20:49.000Z",
+    "timestamp": "2044-09-16T02:24:07.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.13.44"
+        "version": "0.13.46"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.44",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.46",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.13.44",
+      "version": "0.13.46",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.44",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.46",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "06a310132e91fa95c1f50c6e78a4f2f2916cc22f46b49eb58b8644d2d27c49ef"
+          "content": "5707e12be85db574d08e64cbe00c55289006daf83f137ba135bfef1bf906d825"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.44"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.46"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3268d2f2fe6cf4ee67c0c07df0daffc94499c37c5dd2d1225d7a853af7e70808"
+          "content": "bd67c34d0c6e58058ae7929d50f8a3b15b8d41ba5175df5f969422ee5eef4253"
         },
         {
           "alg": "SHA3-512",
-          "content": "35a0de028e257c7ff3541ef4d4015e7ebe0e4c89b772348e7fc6908203ef94b97cdf1eca7981ebdaa7396b791e86de1edfa71d1183750d1ae8138e05d52b56e3"
+          "content": "07a9d6eaa63b6324bc8b10f0cf790e12413f9258c582bb9ca50f5031979e55a30d5b8b8dcce1920f6531a20cdb9fe030d4759da3abf6a4642d426dec59e7ff03"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "76aecc836dad63889202f49bc3d334e72ac7b9914409fb1f03ec190551f3c822"
+          "content": "0f798de4d3727d4cb33993a35c370557f9068e1cf2a32a2e850b54c606028751"
         },
         {
           "alg": "SHA3-512",
-          "content": "cb176021ed33780f7a08e21bd90e9edef803eeced38bae0b819229a93fb542d7e8ee569eb59cebafcdf1d767c712396678fd3592856c3f24cf10cf79621f48c5"
+          "content": "d592cb61c7cf31c447657b35010d7d2c54b04e56da63b4beba7307324e68ccd6e97bbd88b72dd2c88fb83041f0ac93c58da7000bbc59ecf0d3f3a2c4436cf1f5"
         }
       ]
     },
@@ -1151,11 +1151,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "71a19b83b657e4aff23b70c886cfde3d6a76f5b6fc3933777c7ed58258129aaf"
+          "content": "a0ad8c87a353086a451e3b2e99376807333131a1599018d1d35eaeee43eb1993"
         },
         {
           "alg": "SHA3-512",
-          "content": "2098a2940004c8d97fa21a410a4b972d14933bdd9e7e79f9570d03c3a4a7d44f489f6bbec860b2c8f9732d57a661ef757a2416023d7f43f6cc6bc2d7993cf9bc"
+          "content": "28c70cc18289fecb5076f064d2b2d1bd2f24b87724c8888dd38fee0d9d784b6581b1b86ed294e429143027069bd7dda36f6ff86751fad5dfd5e28053d2c58410"
         }
       ]
     },
@@ -1661,11 +1661,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "eee433070d0e766d2ea4810837835afd85d8a36b8307c3b4d66051b083c35f0a"
+          "content": "1d66eceec3346e24947e121ac2252dcc16c31d02a98d6c81f1b05e0bdce847bc"
         },
         {
           "alg": "SHA3-512",
-          "content": "30ef6fac362e41a84b9828fe29664016259352b56aad18d79c14ef21944473f303fc2aa4904ad8e2bb39e25490fd0ee1c95335e627237a14ec4cdd9bbdb581c4"
+          "content": "cb8d7e691e48139212ff2543b8928721384cea847d82f7610d1e5c8b8ef8993f8c42c423d47cfc0f83cbb5c665c81b44441b342d73790deb72de8787ea63cdff"
         }
       ]
     },