@blamejs/exceptd-skills 0.13.51 → 0.13.52

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.13.52 — 2026-05-21
+
+README jurisdiction-count normalization; collect-verb + collector-pipe docs; new predeploy gate verifying AGENTS.md collector enumeration matches `lib/collectors/`.
+
+### Bugs
+
+- **README jurisdiction count normalized to 35 across all three locations.** The preamble previously claimed "38 jurisdictions", the `jurisdiction-clocks.json` description claimed "29 jurisdictions", and the `global-frameworks.json` description claimed "35 jurisdictions" — three different numbers in the same file. The actual count in `data/global-frameworks.json` (top-level keys excluding `_meta` + the two `_*_summary` entries) is 35; all three README mentions now match.
+
+### Features
+
+- **`exceptd collect <playbook>` documented in the CLI command reference.** The verb has shipped since v0.13.34 and now backs 13 of 23 playbooks, but the README only documented `discover` / `brief` / `run` / `ci` / `attest` / `doctor` / `ask` / `refresh` / `lint`. The reference now describes `collect` + the canonical `discover → collect → run --evidence -` pipe + the `--attest-ownership` flag (cicd-pipeline-compromise specific) + the pointer to `exceptd doctor --collectors` for the live list.
+- **New predeploy gate: `scripts/check-agents-md-collectors.js`.** Verifies that AGENTS.md's "<N> reference collectors ship today (...)" paragraph stays in sync with the actual contents of `lib/collectors/`. Checks the spelled-out count word (Eleven / Twelve / ...) matches the on-disk count AND every collector path in the parenthesized list exists on disk AND every on-disk collector appears in the list. Predeploy gate count: 17 → 18.
+
 ## 0.13.51 — 2026-05-21
 
 `doctor` signing-check renders by severity; `crypto-codebase` weak-hash predicate demotes content-integrity files; `collect` no-arg hint points at operator-facing verbs.

package/README.md

@@ -30,7 +30,7 @@ This platform surfaces what is actually happening right now. Every skill explici
 
 ## Status
 
-Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 42 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 10 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons) covering 38 jurisdictions — the CVE catalog grew from 68 to 312 entries in v0.13.17 via a CISA KEV bulk-intake of `dateAdded >= 2024-01-01` actively-exploited vulnerabilities. 23 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, and more), a CLI for discovery and seven-phase investigation runs (`govern → direct → look → detect → analyze → validate → close`), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory + research-blog + tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, The Hacker News, and a GitHub public-events tracker for the Nightmare-Eclipse researcher handle that anchors NEW-CTRL-073) into auto-PRs for editorial review. v0.13.17 also ships `lib/cve-regression-watcher.js` (NEW-CTRL-074) — a complementary detection method that surfaces poller-diff historical-CVE references as candidate silent-regression cases, the class anchored by MiniPlasma (a 2026 PoC drop that re-broke CVE-2020-17103 without any new ID being assigned).
+Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 42 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 10 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons) covering 35 jurisdictions — the CVE catalog grew from 68 to 312 entries in v0.13.17 via a CISA KEV bulk-intake of `dateAdded >= 2024-01-01` actively-exploited vulnerabilities. 23 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, and more), a CLI for discovery and seven-phase investigation runs (`govern → direct → look → detect → analyze → validate → close`), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory + research-blog + tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, The Hacker News, and a GitHub public-events tracker for the Nightmare-Eclipse researcher handle that anchors NEW-CTRL-073) into auto-PRs for editorial review. v0.13.17 also ships `lib/cve-regression-watcher.js` (NEW-CTRL-074) — a complementary detection method that surfaces poller-diff historical-CVE references as candidate silent-regression cases, the class anchored by MiniPlasma (a 2026 PoC drop that re-broke CVE-2020-17103 without any new ID being assigned).
 
 ---
 
@@ -257,6 +257,25 @@ exceptd ai-run <playbook>             JSONL streaming variant of run. AI emits
                                       file handoff.
   --no-stream                         Single-shot mode (emit one combined JSON).
 
+exceptd collect <playbook>            Walk cwd + invoke the companion collector
+                                      under lib/collectors/<playbook>.js. Emits
+                                      a submission JSON ready to pipe into
+                                      `exceptd run <playbook> --evidence -`.
+                                      13/23 playbooks have collectors; the rest
+                                      are AI-driven by design (incident /
+                                      governance / pure-analyze — see
+                                      AGENTS.md).
+  --cwd <path>                        Collect against a different repo / host.
+  --pretty                            Indented JSON.
+  --attest-ownership                  cicd-pipeline-compromise only — opt-in to
+                                      the operator-owns-ci-fleet precondition
+                                      so the runner doesn't halt at preflight.
+
+# Canonical operator flow on a freshly-cloned repo:
+exceptd discover                      # which playbooks apply here?
+exceptd collect <pb> | exceptd run <pb> --evidence -   # full pipe to verdict
+exceptd doctor --collectors           # list every collector + which are skipped
+
 exceptd attest <subverb> [<sid>]      Auditor-facing operations.
   attest list                         Inventory all sessions across both
                                       ~/.exceptd and cwd-legacy roots.
@@ -483,7 +502,7 @@ If your tool has a conventional auto-load filename not listed here and you'd lik
 - **`recipes.json`** — 8 curated skill sequences for common use cases (AI red team prep, PCI audit defense, federal IR, DORA TLPT, K-12 EdTech review, ransomware tabletop, new-CVE triage, OSS dep triage).
 - **`chains.json`** — pre-hydrated cross-walks per CVE and per CWE: which skills cite this, which framework gaps it surfaces, which D3FEND countermeasures back it.
 - **`token-budget.json`** — approximate token cost per skill + per section for context budgeting.
-- **`jurisdiction-clocks.json`** — normalized jurisdiction × obligation × hours matrix (breach notification, patch SLA) across 29 jurisdictions.
+- **`jurisdiction-clocks.json`** — normalized jurisdiction × obligation × hours matrix (breach notification, patch SLA) across 35 jurisdictions.
 - **`did-ladders.json`** — canonical defense-in-depth ladders per attack class (prompt injection, kernel LPE, AI-as-C2, ransomware, supply chain, BOLA, model exfiltration, BEC).
 - **`theater-fingerprints.json`** — structured records for the 7 compliance theater patterns: claim, audit evidence, reality, fast detection test, controls implicated.
 - **`_meta.json`** — sha256 of every source file. The `validate-indexes` predeploy gate fails if any source changed after the last build; `build-indexes --changed` reads this to know what to rebuild.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-21T21:52:47.561Z",
+  "generated_at": "2026-05-21T22:16:05.918Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "8b7d17485a799593f74506f92ad8f129155ac52d40f508e90b4adf15cb11916d",
+    "manifest.json": "5669cbc5596276b0e2679e97e59a6066db2d7492b6e4d0c97aa13715015f41e9",
     "data/atlas-ttps.json": "d296c1d3e71807c9279b731f047e57796e85137f186586743a8cdad214b408f9",
     "data/attack-techniques.json": "49b6010b317edd219def135171ea8f3b1bbf1e00e9c5a08bf7237215ff54e2c3",
     "data/cve-catalog.json": "a09c83af3f9679a7ea73935726a1ff9de2cab94b4ab6321fc017fc147747d7c3",

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.13.51",
+  "version": "0.13.52",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-21T21:27:15.938Z",
+      "signed_at": "2026-05-21T22:13:20.523Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -117,7 +117,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vSVqu4wBm+d68ujZmM6Rto/HzViCkE0gPUcv/MYE/bjFiqamf/s0On4kTOo1KIveV9cOwYNxiItaGEWlVkRFDg==",
-      "signed_at": "2026-05-21T21:27:15.940Z",
+      "signed_at": "2026-05-21T22:13:20.524Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -180,7 +180,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "RIgXKvolQjgJdnlrDnVOd90IOY1B7VHHZD/YJQRzouL+wUeOLclPrdK/EgEuFyiu7lR4bi+Pl6aGB9G9tOxYCQ==",
-      "signed_at": "2026-05-21T21:27:15.940Z",
+      "signed_at": "2026-05-21T22:13:20.525Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -226,7 +226,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "RYOxeq/o3uTwTWq4H7RcdH2Aclg9UyCERfUH9Frwkzncsowg7LgxpaEDc3swTCv73HMEGbU8wVbXguZ4JxHUCQ==",
-      "signed_at": "2026-05-21T21:27:15.940Z"
+      "signed_at": "2026-05-21T22:13:20.525Z"
     },
     {
       "name": "compliance-theater",
@@ -257,7 +257,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "DneJCPKCPcoe6nQ82XptqSqNfSRdt1orKaO+o7K36YCciDrzwJb+1BuBLusPDtpcdDaGY0y0e+AqiTYJklhBAQ==",
-      "signed_at": "2026-05-21T21:27:15.941Z"
+      "signed_at": "2026-05-21T22:13:20.525Z"
     },
     {
       "name": "exploit-scoring",
@@ -286,7 +286,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-21T21:27:15.941Z"
+      "signed_at": "2026-05-21T22:13:20.526Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -323,7 +323,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "XgrzcA2brPhXrSTxrcLnJec0OpgGYJBoSTUlJ10UdePHffxqb9LTVGnfbmEk1ykQifXREZexui2bG7X/+eFfCQ==",
-      "signed_at": "2026-05-21T21:27:15.942Z",
+      "signed_at": "2026-05-21T22:13:20.527Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -380,7 +380,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "9+hZlZOqZdeACUmamQk66L5levZhhwnFXuYRhdT6Mce99eQaKT7wNfWq12hXQztkRcVRKaFH+a01zwJQwsRQCA==",
-      "signed_at": "2026-05-21T21:27:15.942Z",
+      "signed_at": "2026-05-21T22:13:20.527Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -415,7 +415,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "ciqhVloMWWXEigPZvvwoV2c54tEqsDqsoc+sS/mNTFFJk2H+tz2+XUrgfEPRuYw0FeyNB6/+27pL2NpKHzUqAg==",
-      "signed_at": "2026-05-21T21:27:15.942Z",
+      "signed_at": "2026-05-21T22:13:20.527Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-21T21:27:15.943Z"
+      "signed_at": "2026-05-21T22:13:20.528Z"
     },
     {
       "name": "global-grc",
@@ -475,7 +475,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-21T21:27:15.943Z"
+      "signed_at": "2026-05-21T22:13:20.528Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -502,7 +502,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-21T21:27:15.943Z"
+      "signed_at": "2026-05-21T22:13:20.528Z"
     },
     {
       "name": "pqc-first",
@@ -554,7 +554,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vhc3wuQEro/86s1ro2b/KakUXg8QVnySYTBqA7ebzv9oeR2HYO5bvGEJp3oOHWtL37JDqcCAHYadSN/qxIyCCA==",
-      "signed_at": "2026-05-21T21:27:15.944Z",
+      "signed_at": "2026-05-21T22:13:20.529Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -601,7 +601,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "MS35nWm8djfJGn4OOoT0JKJ2aO+Dkbb6wOOWJYvNZlRKT3UGA59o2gxg1JOnD20hb/RwxtkmCujhl2tuYSR+AQ==",
-      "signed_at": "2026-05-21T21:27:15.944Z"
+      "signed_at": "2026-05-21T22:13:20.529Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -638,7 +638,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-21T21:27:15.944Z",
+      "signed_at": "2026-05-21T22:13:20.529Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -673,7 +673,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "WAu5fRirzSOcnnZsTx2d/JJZwa/LPpXCi+31qATTGLmoNuhyy81k3ooPe9kCM3E0CLMtvTePg9DagYqBninZDQ==",
-      "signed_at": "2026-05-21T21:27:15.945Z"
+      "signed_at": "2026-05-21T22:13:20.530Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -744,7 +744,7 @@
         "PTES revision incorporating AI-surface enumeration"
       ],
       "signature": "7eEwCXFd9pDKUw7yCUbRJSjfzozE44dwwwemCQUPm8JBPztLltibD9bL/RszSbYyCrYJmVb5Drncz2cGe62gCw==",
-      "signed_at": "2026-05-21T21:27:15.945Z"
+      "signed_at": "2026-05-21T22:13:20.530Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -804,7 +804,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-21T21:27:15.945Z"
+      "signed_at": "2026-05-21T22:13:20.530Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -879,7 +879,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "fgxG344JGYBWWWwFXZ1IzGipWKP7EyBhrsvsbsb0CCGXfv/MvNHVNI6G0zQddCsWX1JeQbhZT3Vk8v1uJKDTDA==",
-      "signed_at": "2026-05-21T21:27:15.946Z"
+      "signed_at": "2026-05-21T22:13:20.531Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -956,7 +956,7 @@
         "OpenSSF model-signing — emerging Sigstore-based signing standard for ML model weights; track for production adoption"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-21T21:27:15.946Z"
+      "signed_at": "2026-05-21T22:13:20.531Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1013,7 +1013,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "gqF8eU3VBrZhO2WnlcqKa7wm1d2mmWtvpbmx0kNCgHojNV+qEt+Ij84RO6bZvaUqhfYPWizWL79Fa4DL0curAQ==",
-      "signed_at": "2026-05-21T21:27:15.946Z"
+      "signed_at": "2026-05-21T22:13:20.531Z"
     },
     {
       "name": "identity-assurance",
@@ -1080,7 +1080,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-21T21:27:15.947Z"
+      "signed_at": "2026-05-21T22:13:20.532Z"
     },
     {
       "name": "ot-ics-security",
@@ -1136,7 +1136,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-21T21:27:15.947Z"
+      "signed_at": "2026-05-21T22:13:20.532Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1188,7 +1188,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-21T21:27:15.947Z"
+      "signed_at": "2026-05-21T22:13:20.532Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1238,7 +1238,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-21T21:27:15.948Z"
+      "signed_at": "2026-05-21T22:13:20.533Z"
     },
     {
       "name": "webapp-security",
@@ -1312,7 +1312,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-21T21:27:15.948Z"
+      "signed_at": "2026-05-21T22:13:20.533Z"
     },
     {
       "name": "ai-risk-management",
@@ -1362,7 +1362,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-21T21:27:15.948Z"
+      "signed_at": "2026-05-21T22:13:20.533Z"
     },
     {
       "name": "sector-healthcare",
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-21T21:27:15.949Z"
+      "signed_at": "2026-05-21T22:13:20.534Z"
     },
     {
       "name": "sector-financial",
@@ -1503,7 +1503,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-21T21:27:15.949Z"
+      "signed_at": "2026-05-21T22:13:20.534Z"
     },
     {
       "name": "sector-federal-government",
@@ -1572,7 +1572,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-21T21:27:15.950Z"
+      "signed_at": "2026-05-21T22:13:20.535Z"
     },
     {
       "name": "sector-energy",
@@ -1637,7 +1637,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-21T21:27:15.950Z"
+      "signed_at": "2026-05-21T22:13:20.535Z"
     },
     {
       "name": "sector-telecom",
@@ -1723,7 +1723,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-21T21:27:15.950Z"
+      "signed_at": "2026-05-21T22:13:20.535Z"
     },
     {
       "name": "api-security",
@@ -1792,7 +1792,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-21T21:27:15.951Z"
+      "signed_at": "2026-05-21T22:13:20.536Z"
     },
     {
       "name": "cloud-security",
@@ -1873,7 +1873,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-21T21:27:15.951Z"
+      "signed_at": "2026-05-21T22:13:20.536Z"
     },
     {
       "name": "container-runtime-security",
@@ -1935,7 +1935,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-21T21:27:15.951Z"
+      "signed_at": "2026-05-21T22:13:20.536Z"
     },
     {
       "name": "mlops-security",
@@ -2006,7 +2006,7 @@
         "MITRE ATLAS v5.6.0 (released February 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: ATLAS v5.5 / v6.0 — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "BGNE6ZQWBA1LmsUFe8tU0L67iGDSrFqiuqaZD2f1KqfcyqqzQfMs9PWNHFzxxaJmXeKlm87eU8lgELF0bX+RBA==",
-      "signed_at": "2026-05-21T21:27:15.952Z"
+      "signed_at": "2026-05-21T22:13:20.537Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2068,7 +2068,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "FkZQerh3VHVJAwIcCktDyMRh5KE2+Em/i0ek8zEz7JG/PXtQx8ujHWTh3VjZbOLhPNtdB2qxgXOIAYIofaVOAQ==",
-      "signed_at": "2026-05-21T21:27:15.952Z"
+      "signed_at": "2026-05-21T22:13:20.537Z"
     },
     {
       "name": "ransomware-response",
@@ -2148,7 +2148,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "n3UToNuN3A1HgLvcuqmIx8vrZY71+r/79waK92jG+rSX4uYOzkmxMUpROrE5K9bDwMezNBHdjWv8Uul6zugyDQ==",
-      "signed_at": "2026-05-21T21:27:15.953Z"
+      "signed_at": "2026-05-21T22:13:20.538Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2201,7 +2201,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-21T21:27:15.953Z"
+      "signed_at": "2026-05-21T22:13:20.538Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2269,7 +2269,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "+OO0RhQ303RJV7kaH38IuZpLeQbapep6Ds4Re/WEZu0FHBwKSlwvF7jbtP7KQ57xldJYn/xZm2jaszyOacMfDg==",
-      "signed_at": "2026-05-21T21:27:15.953Z"
+      "signed_at": "2026-05-21T22:13:20.538Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2349,7 +2349,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-21T21:27:15.954Z"
+      "signed_at": "2026-05-21T22:13:20.539Z"
     },
     {
       "name": "idp-incident-response",
@@ -2430,11 +2430,11 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-21T21:27:15.954Z"
+      "signed_at": "2026-05-21T22:13:20.539Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "8vEIMaf7hdCLMYxi4u0T4fyLB98qLcEXuuvqCp3DkSkNpQadJnTW/Ltb34oFKnS0QIsWHEGiWzZqZMpc5o3tBQ=="
+    "signature_base64": "XPyZYuvZ6ZadQHOUo2H104at1NSCz08u3NQM3ku7dyUQb4RVBoV5o0P0yGBZTTJz3MNBru7LoT1hieQDsaozCg=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.13.51",
+  "version": "0.13.52",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:7b988e1d-2c04-4011-b873-b729271dd830",
+  "serialNumber": "urn:uuid:d604c466-a7a8-4410-b40c-65d2cfd134cc",
   "version": 1,
   "metadata": {
-    "timestamp": "2091-09-16T22:43:41.000Z",
+    "timestamp": "2139-10-14T07:04:06.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.13.51"
+        "version": "0.13.52"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.51",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.52",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.13.51",
+      "version": "0.13.52",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.51",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.52",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a5eab2f190d93f11fd0fa5713f7fdaad2798742857a0e08e17d0113efb5a538d"
+          "content": "ed0fc0c7c5216c0c146e8b75810099742acb0f1401b76ba84f7210b4ee284d45"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.51"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.52"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9990b9daf55ba5b8eb1fb583e7af94a999e0c7acabaa979981448eaa972c421f"
+          "content": "3418688a9ac77cd6c23ccde3ded29a9486815b43040c16128fb6259706fdd937"
         },
         {
           "alg": "SHA3-512",
-          "content": "6664a26adf0d7a9da2b5345603b18150f3acb7b8660b40c580701c68cc9ad24ea0b672213ed78a03aabefeacf97abecd6be34613c8b82bf13591c0bf88ce5ebb"
+          "content": "d611f2d5177e607482fd5cc9c07a5d4bb52c12457bd3a978730de58922bce4150fb0c37d10422ff2f99a355a99c37e4f764745d8ffd5b09e7720d98d428e904c"
         }
       ]
     },
@@ -176,11 +176,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "31af6cab873ca74dab6f9f05b32054b2926911575f5ee88554474798f3aa0792"
+          "content": "388583ac16dd05926491495aec3f95348894eda7910642563356780d6f46ccb4"
         },
         {
           "alg": "SHA3-512",
-          "content": "6510ae240e80bcc21dd75ae4a1202ad88e9a8e29fd45b5b6d1d240a5f552689eb968c13399a6b3e77600ce4776f48f63876b787bd99703d9afe44e73c91567c4"
+          "content": "b3172f5647002df6d9924a28b03355f3d028f74a93646cc118a9b3d6133e64c2b0c79bd5cd86269011c872f9774ca008cbd35eb073de187fde9382dcd07cd668"
         }
       ]
     },
@@ -1661,11 +1661,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8b7d17485a799593f74506f92ad8f129155ac52d40f508e90b4adf15cb11916d"
+          "content": "5669cbc5596276b0e2679e97e59a6066db2d7492b6e4d0c97aa13715015f41e9"
         },
         {
           "alg": "SHA3-512",
-          "content": "44a2515c3e8ac6dfc8e23b906c5be4dbd79d598932f2454b82a61202911994d52a2956787ed0abce086092a78f2a1d20df801ceedf6aea5ca749839c0b8873c6"
+          "content": "706418ddb58d05f436663742e84871113435a1d3f776489c7477189d7294279723eeab2b308582369419e7f110960a0636ecaf9cf73ead1bbea7f8ec66746a42"
         }
       ]
     },
@@ -2059,6 +2059,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:scripts/check-agents-md-collectors.js",
+      "type": "file",
+      "name": "scripts/check-agents-md-collectors.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a79fcefca5c48f5fb21b8b397861e317ef77a615cf00a867619ba5ed52bb3604"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "54a59929bebe5fc10e11e7cb8d89b08a2ea119a0cbeb228f8a1eacfdb771698582ae9243b87cf6163b6e119930fcc54b63c2aa3c858c805934148363c925bfe2"
+        }
+      ]
+    },
     {
       "bom-ref": "file:scripts/check-catalog-gap-budget.js",
       "type": "file",
@@ -2186,11 +2201,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b1edfc22514b633f9932382d5d0fa091fa28b83535b4f0dac764ea2f4aebc85d"
+          "content": "81967862730d2fcfd6b42442031d584cf9718939305d40f7b5ae2ab590f7c85c"
         },
         {
           "alg": "SHA3-512",
-          "content": "f2b2d68424127b87e0f6a5a7cd2e64e4910d26af9ef4279f0aac49c81fdd9a47617013cde0165066a7678db1bee3a3a4c75882228befb94cad5219125dbb8fd9"
+          "content": "f8d0179cf645f05b3838ebf8ac024689a21bdd7b5a22a824ac47db866ce1246d3fb256dcf71eaa2c8e177dccd9447478dc655edc01f043f7532ac403c6b181fa"
         }
       ]
     },

package/scripts/check-agents-md-collectors.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+"use strict";
+
+/**
+ * scripts/check-agents-md-collectors.js
+ *
+ * Predeploy gate. Verifies that AGENTS.md's "<N> reference collectors
+ * ship today" paragraph stays in sync with the actual contents of
+ * lib/collectors/. Drift is silent today - AGENTS.md gets bumped by
+ * hand each release; a missed bump produces inaccurate count + stale
+ * enumeration that downstream AI consumers parse.
+ *
+ * Checks:
+ *   1. The numeric count word in the paragraph (Eleven / Twelve /
+ *      Thirteen / ...) matches the actual count of
+ *      lib/collectors/*.js modules.
+ *   2. Every collector named in the parenthesized list exists at
+ *      lib/collectors/<name>.js.
+ *   3. Every lib/collectors/<name>.js module appears in the
+ *      parenthesized list.
+ *
+ * Exit codes: 0 ok, 1 drift, 2 parse error.
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const ROOT = path.join(__dirname, "..");
+const AGENTS = path.join(ROOT, "AGENTS.md");
+const COLLECTOR_DIR = path.join(ROOT, "lib", "collectors");
+
+const WORD_TO_NUMBER = {
+  one: 1, two: 2, three: 3, four: 4, five: 5, six: 6, seven: 7,
+  eight: 8, nine: 9, ten: 10, eleven: 11, twelve: 12, thirteen: 13,
+  fourteen: 14, fifteen: 15, sixteen: 16, seventeen: 17, eighteen: 18,
+  nineteen: 19, twenty: 20,
+};
+
+function fail(msg) {
+  console.error(`[check-agents-md-collectors] FAIL - ${msg}`);
+  process.exitCode = 1;
+}
+
+function ok(msg) {
+  console.log(`[check-agents-md-collectors] ok - ${msg}`);
+}
+
+function main() {
+  let agents;
+  try { agents = fs.readFileSync(AGENTS, "utf8"); }
+  catch (e) {
+    console.error(`[check-agents-md-collectors] cannot read AGENTS.md: ${e.message}`);
+    process.exitCode = 2;
+    return;
+  }
+
+  let collectorFiles;
+  try {
+    collectorFiles = fs.readdirSync(COLLECTOR_DIR)
+      .filter(f => f.endsWith(".js"))
+      .map(f => `lib/collectors/${f}`)
+      .sort();
+  } catch (e) {
+    console.error(`[check-agents-md-collectors] cannot read ${COLLECTOR_DIR}: ${e.message}`);
+    process.exitCode = 2;
+    return;
+  }
+  const onDiskCount = collectorFiles.length;
+
+  const para = agents.match(/(\b[A-Z][a-z]+)\s+reference collectors ship today\s*\(([^)]+)\)/);
+  if (!para) {
+    fail("could not locate the 'N reference collectors ship today (...)' paragraph in AGENTS.md");
+    return;
+  }
+  const word = para[1].toLowerCase();
+  const listed = para[2];
+  const claimedCount = WORD_TO_NUMBER[word];
+  if (!claimedCount) {
+    fail(`unrecognized count word '${para[1]}' - extend WORD_TO_NUMBER in scripts/check-agents-md-collectors.js`);
+    return;
+  }
+  if (claimedCount !== onDiskCount) {
+    fail(`claimed count ${para[1]} (${claimedCount}) != on-disk count ${onDiskCount}`);
+    return;
+  }
+
+  const claimedPaths = [];
+  const pathRe = /`lib\/collectors\/([a-z0-9-]+\.js)`/g;
+  let m;
+  while ((m = pathRe.exec(listed)) !== null) {
+    claimedPaths.push(`lib/collectors/${m[1]}`);
+  }
+  claimedPaths.sort();
+
+  const onDiskSet = new Set(collectorFiles);
+  const claimedSet = new Set(claimedPaths);
+
+  const missingFromAgents = collectorFiles.filter(f => !claimedSet.has(f));
+  const extraInAgents = claimedPaths.filter(f => !onDiskSet.has(f));
+
+  if (missingFromAgents.length > 0) {
+    fail(`on-disk but not in AGENTS.md list: ${missingFromAgents.join(", ")}`);
+  }
+  if (extraInAgents.length > 0) {
+    fail(`in AGENTS.md list but not on disk: ${extraInAgents.join(", ")}`);
+  }
+
+  if (process.exitCode !== 1) {
+    ok(`${onDiskCount}/${onDiskCount} collectors enumerated correctly in AGENTS.md`);
+  }
+}
+
+main();

package/scripts/predeploy.js

@@ -221,6 +221,17 @@ const GATES = [
     args: [path.join(ROOT, "scripts", "check-version-tags.js")],
     ciJobName: "Data integrity (catalog + manifest snapshot)",
   },
+  {
+    // AGENTS.md collector enumeration drift gate. Catches the case
+    // where lib/collectors/ gets a new module but AGENTS.md's
+    // "<N> reference collectors ship today (...)" paragraph isn't
+    // bumped (or vice versa). The paragraph is the canonical source
+    // for AI-agent consumers; drift produces stale enumeration.
+    name: "AGENTS.md collector enumeration drift",
+    command: process.execPath,
+    args: [path.join(ROOT, "scripts", "check-agents-md-collectors.js")],
+    ciJobName: "Data integrity (catalog + manifest snapshot)",
+  },
 ];
 
 function runGate(gate) {