@blamejs/exceptd-skills 0.13.56 → 0.13.57

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## 0.13.57 — 2026-05-22
+
+`attest list` populates the signed field. README + verb help document the ai-run JSONL event grammar. `--block-on-jurisdiction-clock` clarifies pending-vs-started semantics.
+
+### Bugs
+
+- **`attest list --json` reports `signed: true|false`** for every attestation by reading the .sig sidecar (Ed25519 + `signature_base64` → signed; `algorithm: "unsigned"` → unsigned). Previously the field was `undefined`, forcing operators to `attest verify` each session individually to learn its signing state.
+
+### Features
+
+- **README + verb help document the `ai-run` JSONL event grammar.** The canonical stdin event shape (`{ "event": "evidence", "payload": { precondition_checks, observations, verdict } }`) plus the phase emission order are now in the README's CLI command reference. The doc also flags the two-shapes-don't-mix rule: if `signal_overrides` is present, the runner takes the nested shape and ignores `observations`/`verdict`. Previously the contract was discoverable only at runtime via the `await_evidence` event's `submission_shape.note` field.
+- **`--block-on-jurisdiction-clock` help text clarifies pending-vs-started semantics.** Most playbooks declare `clock_starts: "detect_confirmed"`. The clock stays `pending_clock_start_event` until two things align: (a) the submission's verdict classifies as `detected`, AND (b) the operator passes `--ack` (records `operator_consent.explicit = true`). Alternatively, the submission can stamp `clock_started_at_detect_confirmed: "<ISO>"` directly in the signals. Without one of those paths the clocks stay pending and the flag is a no-op. The help text now documents the exact contract instead of pointing at a `verdict.detect_confirmed` field the runner never consumed.
+
 ## 0.13.56 — 2026-05-22
 
 `attest diff <sid>` (without `--against`) emits the v0.11+ envelope and surfaces granular drift.

package/README.md

@@ -256,9 +256,27 @@ exceptd run [playbook]                Phases 4-7. Auto-detects cwd context when
 exceptd ai-run <playbook>             JSONL streaming variant of run. AI emits
                                       evidence events on stdin; runner streams
                                       phase events on stdout. One pipe, no
-                                      file handoff.
+                                      file handoff. See `exceptd ai-run --help`
+                                      for the full stdin event grammar.
   --no-stream                         Single-shot mode (emit one combined JSON).
 
+# Stdin event the host emits (one JSON object per line):
+#   {"event":"evidence","payload":{
+#     "precondition_checks": {...},  // per-precondition boolean assertions
+#     "observations":       {...},   // per-artifact + per-indicator captures
+#     "verdict":            {...}    // optional operator-supplied verdict
+#   }}
+# observations[<key>] carries both artifact captures
+# ({ captured: true, value: "..." }) AND indicator overrides
+# ({ indicator: "<id>", result: "hit"|"miss" }) — the runner normalises
+# both branches from a single map. The alternative nested shape
+# ({ artifacts, signal_overrides, signals }) is also accepted, but do not
+# mix the two — if `signal_overrides` is present, `observations` and
+# `verdict` are ignored.
+# Phases emitted on stdout (in order): govern → direct → look →
+# await_evidence → detect → analyze → validate → close → done.
+# Errors emit {"event":"error","reason":"..."} and exit non-zero.
+
 exceptd collect <playbook>            Walk cwd + invoke the companion collector
                                       under lib/collectors/<playbook>.js. Emits
                                       a submission JSON ready to pipe into

package/bin/exceptd.js

@@ -2035,7 +2035,18 @@ Exit codes:
   9  STORAGE_EXHAUSTED     Disk/quota/RO filesystem on attestation write.
 
 Stdin event grammar (one JSON object per line):
-  {"event":"evidence","payload":{"observations":{},"verdict":{}}}
+  {"event":"evidence","payload":{
+    "precondition_checks": {...},  // per-precondition boolean assertions
+    "observations":        {...},  // per-artifact + per-indicator captures
+    "verdict":             {...}   // optional operator-supplied verdict
+  }}
+  observations[<key>] carries both artifact captures
+  ({ captured: true, value: "..." }) AND indicator overrides
+  ({ indicator: "<id>", result: "hit"|"miss" }) — the runner normalises
+  both branches from a single map. The alternative nested shape
+  ({ artifacts, signal_overrides, signals }) is also accepted; do not mix
+  the two — if signal_overrides is present, observations/verdict are
+  ignored.
 
 Stdin acceptance contract:
   In streaming mode, ai-run reads JSON-Lines from stdin until the FIRST
@@ -2088,6 +2099,18 @@ Flags:
   --block-on-jurisdiction-clock
                           Fail when any close.notification_actions started a
                           regulatory clock (GDPR 72h, HIPAA breach, etc.).
+                          Clocks are STARTED, not pending — most playbooks
+                          declare clock_starts: "detect_confirmed", which
+                          stays pending_clock_start_event until two things
+                          align: (a) the submission's verdict.classification
+                          (signals.detection_classification) is "detected",
+                          AND (b) the operator passes --ack (records
+                          operator_consent.explicit = true). Alternatively,
+                          stamp it directly with
+                          verdict.clock_started_at_detect_confirmed: "<ISO>"
+                          in the submission's signals. Without one of those
+                          paths the clocks stay pending and the flag is a
+                          no-op.
   --format <fmt>          Output shape. Supported: json (default, single-line),
                           summary (5-field digest), markdown (human digest).
                           Bundles (csaf-2.0/sarif/openvex) live on per-run
@@ -6723,6 +6746,26 @@ function cmdListAttestations(runner, args, runOpts, pretty) {
           // v0.12.14: normalized array-set filter (see top of fn).
           if (playbookFilter && !playbookFilter.has(j.playbook_id)) continue;
           if (args.since && (j.captured_at || "") < args.since) continue;
+          // Populate the `signed` field by reading the .sig sidecar.
+          // The sidecar payload either carries algorithm: "Ed25519"
+          // + signature_base64 (true signature) or algorithm: "unsigned"
+          // (unsigned-fallback marker — written when no private key
+          // was available at run time). Both forms ARE a .sig file on
+          // disk; the field distinguishes them so operators can scan
+          // the list for unsigned attestations without verifying every
+          // one individually.
+          const sigPath = path.join(sdir, f + ".sig");
+          let signed = false;
+          if (fs.existsSync(sigPath)) {
+            try {
+              const sigDoc = JSON.parse(fs.readFileSync(sigPath, "utf8"));
+              signed =
+                !!sigDoc &&
+                sigDoc.algorithm === "Ed25519" &&
+                typeof sigDoc.signature_base64 === "string" &&
+                sigDoc.signature_base64.length > 0;
+            } catch { /* unreadable sidecar treated as unsigned */ }
+          }
           entries.push({
             session_id: sid,
             playbook_id: j.playbook_id,
@@ -6731,6 +6774,7 @@ function cmdListAttestations(runner, args, runOpts, pretty) {
             captured_at: j.captured_at || null,
             attestation_root: root,
             file: path.join(sdir, f),
+            signed,
           });
         } catch { /* skip malformed */ }
       }

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-22T06:51:14.019Z",
+  "generated_at": "2026-05-22T07:28:48.846Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "f47dfe67b4c270d0e4c8ec9cabdefafdce901ced92c4c234b23fdf65cf8df66a",
+    "manifest.json": "f02056365a264901e95631245efa002968acee2e6432ab2e5131b6b53eadcd81",
     "data/atlas-ttps.json": "d296c1d3e71807c9279b731f047e57796e85137f186586743a8cdad214b408f9",
     "data/attack-techniques.json": "49b6010b317edd219def135171ea8f3b1bbf1e00e9c5a08bf7237215ff54e2c3",
     "data/cve-catalog.json": "a09c83af3f9679a7ea73935726a1ff9de2cab94b4ab6321fc017fc147747d7c3",

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.13.56",
+  "version": "0.13.57",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-22T06:38:55.158Z",
+      "signed_at": "2026-05-22T07:13:12.339Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -117,7 +117,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vSVqu4wBm+d68ujZmM6Rto/HzViCkE0gPUcv/MYE/bjFiqamf/s0On4kTOo1KIveV9cOwYNxiItaGEWlVkRFDg==",
-      "signed_at": "2026-05-22T06:38:55.159Z",
+      "signed_at": "2026-05-22T07:13:12.341Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -180,7 +180,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "RIgXKvolQjgJdnlrDnVOd90IOY1B7VHHZD/YJQRzouL+wUeOLclPrdK/EgEuFyiu7lR4bi+Pl6aGB9G9tOxYCQ==",
-      "signed_at": "2026-05-22T06:38:55.159Z",
+      "signed_at": "2026-05-22T07:13:12.341Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -226,7 +226,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "RYOxeq/o3uTwTWq4H7RcdH2Aclg9UyCERfUH9Frwkzncsowg7LgxpaEDc3swTCv73HMEGbU8wVbXguZ4JxHUCQ==",
-      "signed_at": "2026-05-22T06:38:55.160Z"
+      "signed_at": "2026-05-22T07:13:12.341Z"
     },
     {
       "name": "compliance-theater",
@@ -257,7 +257,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "DneJCPKCPcoe6nQ82XptqSqNfSRdt1orKaO+o7K36YCciDrzwJb+1BuBLusPDtpcdDaGY0y0e+AqiTYJklhBAQ==",
-      "signed_at": "2026-05-22T06:38:55.160Z"
+      "signed_at": "2026-05-22T07:13:12.342Z"
     },
     {
       "name": "exploit-scoring",
@@ -286,7 +286,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-22T06:38:55.161Z"
+      "signed_at": "2026-05-22T07:13:12.342Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -323,7 +323,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "XgrzcA2brPhXrSTxrcLnJec0OpgGYJBoSTUlJ10UdePHffxqb9LTVGnfbmEk1ykQifXREZexui2bG7X/+eFfCQ==",
-      "signed_at": "2026-05-22T06:38:55.161Z",
+      "signed_at": "2026-05-22T07:13:12.343Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -380,7 +380,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "9+hZlZOqZdeACUmamQk66L5levZhhwnFXuYRhdT6Mce99eQaKT7wNfWq12hXQztkRcVRKaFH+a01zwJQwsRQCA==",
-      "signed_at": "2026-05-22T06:38:55.162Z",
+      "signed_at": "2026-05-22T07:13:12.343Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -415,7 +415,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "ciqhVloMWWXEigPZvvwoV2c54tEqsDqsoc+sS/mNTFFJk2H+tz2+XUrgfEPRuYw0FeyNB6/+27pL2NpKHzUqAg==",
-      "signed_at": "2026-05-22T06:38:55.162Z",
+      "signed_at": "2026-05-22T07:13:12.343Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-22T06:38:55.162Z"
+      "signed_at": "2026-05-22T07:13:12.344Z"
     },
     {
       "name": "global-grc",
@@ -475,7 +475,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-22T06:38:55.163Z"
+      "signed_at": "2026-05-22T07:13:12.344Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -502,7 +502,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-22T06:38:55.163Z"
+      "signed_at": "2026-05-22T07:13:12.344Z"
     },
     {
       "name": "pqc-first",
@@ -554,7 +554,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vhc3wuQEro/86s1ro2b/KakUXg8QVnySYTBqA7ebzv9oeR2HYO5bvGEJp3oOHWtL37JDqcCAHYadSN/qxIyCCA==",
-      "signed_at": "2026-05-22T06:38:55.163Z",
+      "signed_at": "2026-05-22T07:13:12.345Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -601,7 +601,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "MS35nWm8djfJGn4OOoT0JKJ2aO+Dkbb6wOOWJYvNZlRKT3UGA59o2gxg1JOnD20hb/RwxtkmCujhl2tuYSR+AQ==",
-      "signed_at": "2026-05-22T06:38:55.164Z"
+      "signed_at": "2026-05-22T07:13:12.345Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -638,7 +638,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-22T06:38:55.164Z",
+      "signed_at": "2026-05-22T07:13:12.346Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -673,7 +673,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "WAu5fRirzSOcnnZsTx2d/JJZwa/LPpXCi+31qATTGLmoNuhyy81k3ooPe9kCM3E0CLMtvTePg9DagYqBninZDQ==",
-      "signed_at": "2026-05-22T06:38:55.164Z"
+      "signed_at": "2026-05-22T07:13:12.346Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -744,7 +744,7 @@
         "PTES revision incorporating AI-surface enumeration"
       ],
       "signature": "7eEwCXFd9pDKUw7yCUbRJSjfzozE44dwwwemCQUPm8JBPztLltibD9bL/RszSbYyCrYJmVb5Drncz2cGe62gCw==",
-      "signed_at": "2026-05-22T06:38:55.165Z"
+      "signed_at": "2026-05-22T07:13:12.346Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -804,7 +804,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-22T06:38:55.165Z"
+      "signed_at": "2026-05-22T07:13:12.347Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -879,7 +879,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "fgxG344JGYBWWWwFXZ1IzGipWKP7EyBhrsvsbsb0CCGXfv/MvNHVNI6G0zQddCsWX1JeQbhZT3Vk8v1uJKDTDA==",
-      "signed_at": "2026-05-22T06:38:55.165Z"
+      "signed_at": "2026-05-22T07:13:12.347Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -956,7 +956,7 @@
         "OpenSSF model-signing — emerging Sigstore-based signing standard for ML model weights; track for production adoption"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-22T06:38:55.166Z"
+      "signed_at": "2026-05-22T07:13:12.347Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1013,7 +1013,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "gqF8eU3VBrZhO2WnlcqKa7wm1d2mmWtvpbmx0kNCgHojNV+qEt+Ij84RO6bZvaUqhfYPWizWL79Fa4DL0curAQ==",
-      "signed_at": "2026-05-22T06:38:55.166Z"
+      "signed_at": "2026-05-22T07:13:12.347Z"
     },
     {
       "name": "identity-assurance",
@@ -1080,7 +1080,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-22T06:38:55.167Z"
+      "signed_at": "2026-05-22T07:13:12.348Z"
     },
     {
       "name": "ot-ics-security",
@@ -1136,7 +1136,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-22T06:38:55.167Z"
+      "signed_at": "2026-05-22T07:13:12.348Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1188,7 +1188,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-22T06:38:55.167Z"
+      "signed_at": "2026-05-22T07:13:12.348Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1238,7 +1238,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-22T06:38:55.167Z"
+      "signed_at": "2026-05-22T07:13:12.349Z"
     },
     {
       "name": "webapp-security",
@@ -1312,7 +1312,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-22T06:38:55.168Z"
+      "signed_at": "2026-05-22T07:13:12.349Z"
     },
     {
       "name": "ai-risk-management",
@@ -1362,7 +1362,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-22T06:38:55.168Z"
+      "signed_at": "2026-05-22T07:13:12.349Z"
     },
     {
       "name": "sector-healthcare",
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-22T06:38:55.169Z"
+      "signed_at": "2026-05-22T07:13:12.350Z"
     },
     {
       "name": "sector-financial",
@@ -1503,7 +1503,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-22T06:38:55.169Z"
+      "signed_at": "2026-05-22T07:13:12.350Z"
     },
     {
       "name": "sector-federal-government",
@@ -1572,7 +1572,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-22T06:38:55.169Z"
+      "signed_at": "2026-05-22T07:13:12.351Z"
     },
     {
       "name": "sector-energy",
@@ -1637,7 +1637,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-22T06:38:55.170Z"
+      "signed_at": "2026-05-22T07:13:12.352Z"
     },
     {
       "name": "sector-telecom",
@@ -1723,7 +1723,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-22T06:38:55.170Z"
+      "signed_at": "2026-05-22T07:13:12.352Z"
     },
     {
       "name": "api-security",
@@ -1792,7 +1792,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-22T06:38:55.170Z"
+      "signed_at": "2026-05-22T07:13:12.352Z"
     },
     {
       "name": "cloud-security",
@@ -1873,7 +1873,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-22T06:38:55.171Z"
+      "signed_at": "2026-05-22T07:13:12.352Z"
     },
     {
       "name": "container-runtime-security",
@@ -1935,7 +1935,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-22T06:38:55.171Z"
+      "signed_at": "2026-05-22T07:13:12.353Z"
     },
     {
       "name": "mlops-security",
@@ -2006,7 +2006,7 @@
         "MITRE ATLAS v5.6.0 (released February 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: ATLAS v5.5 / v6.0 — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "BGNE6ZQWBA1LmsUFe8tU0L67iGDSrFqiuqaZD2f1KqfcyqqzQfMs9PWNHFzxxaJmXeKlm87eU8lgELF0bX+RBA==",
-      "signed_at": "2026-05-22T06:38:55.171Z"
+      "signed_at": "2026-05-22T07:13:12.353Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2068,7 +2068,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "FkZQerh3VHVJAwIcCktDyMRh5KE2+Em/i0ek8zEz7JG/PXtQx8ujHWTh3VjZbOLhPNtdB2qxgXOIAYIofaVOAQ==",
-      "signed_at": "2026-05-22T06:38:55.172Z"
+      "signed_at": "2026-05-22T07:13:12.354Z"
     },
     {
       "name": "ransomware-response",
@@ -2148,7 +2148,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "n3UToNuN3A1HgLvcuqmIx8vrZY71+r/79waK92jG+rSX4uYOzkmxMUpROrE5K9bDwMezNBHdjWv8Uul6zugyDQ==",
-      "signed_at": "2026-05-22T06:38:55.172Z"
+      "signed_at": "2026-05-22T07:13:12.354Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2201,7 +2201,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-22T06:38:55.172Z"
+      "signed_at": "2026-05-22T07:13:12.354Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2269,7 +2269,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "+OO0RhQ303RJV7kaH38IuZpLeQbapep6Ds4Re/WEZu0FHBwKSlwvF7jbtP7KQ57xldJYn/xZm2jaszyOacMfDg==",
-      "signed_at": "2026-05-22T06:38:55.173Z"
+      "signed_at": "2026-05-22T07:13:12.355Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2349,7 +2349,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-22T06:38:55.173Z"
+      "signed_at": "2026-05-22T07:13:12.355Z"
     },
     {
       "name": "idp-incident-response",
@@ -2430,11 +2430,11 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-22T06:38:55.174Z"
+      "signed_at": "2026-05-22T07:13:12.355Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "PCl9rAksJj30GAsmsgbeOiouVEB3291Zmvn5XY5plQsSkuauHB82+/tu4q9LY7cM/YUTsOIuycFV5xy/9oPQAw=="
+    "signature_base64": "Mqdh4G/iwFRFGu8rZzRnFr9lRtUZuHwTLJhvCMik7tfut7rHh2YKeGKojYcQ//dM7KISIHkkq3wnC+zJzWcpCw=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.13.56",
+  "version": "0.13.57",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:72d89829-2c27-4af0-88f6-741ebe584f04",
+  "serialNumber": "urn:uuid:b0a6b327-121e-40c6-8092-871c7183b709",
   "version": 1,
   "metadata": {
-    "timestamp": "2087-01-21T21:29:13.000Z",
+    "timestamp": "2119-12-02T06:07:35.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.13.56"
+        "version": "0.13.57"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.56",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.57",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.13.56",
+      "version": "0.13.57",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.56",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.57",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4a06094a20bdfa7dea6e2e922c0c071e66419893b61cf0f398c710bd671c698e"
+          "content": "699e406210e768c36fb8c34f9c860c744a6e34e39eb3e2faec853b870a65a0b4"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.56"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.57"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "59ce8e492c0950c174ac8b69c3a6e6b486e084a1ae14f69c8f39e2b3cc26759f"
+          "content": "95bd558e91d2239599d30e889edd3313493776362fb57cb4b76b153b6ee2792a"
         },
         {
           "alg": "SHA3-512",
-          "content": "d81bd980ea256b4068136f69e805cd209b944ec07ce5f270a3a7fcd9e83e5d96ccec3db9931ec30ea0de732fbada1a295c0376a4dd21568a256d84f4f864d8ef"
+          "content": "585290d78871e4effc0465ddbfdf5316466c6a1719d2df68faa8521d0445b759269ec27f12726943ef10eb5ce463702d1d883aa53ca82743dda335c416af4ec9"
         }
       ]
     },
@@ -176,11 +176,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dec21940a1c2ceb4f43ce70a0a150b9b9e00581d43c9fa23d2a03f5f4d018f7d"
+          "content": "2ee761d26b36caeae8a4910ffab81f6a38e59cbbb6133d075bac2a1e7254a7ea"
         },
         {
           "alg": "SHA3-512",
-          "content": "0bd13c9424ededac057a1ee4bc2606e80d46eeeffea3ca3c1971dbac555b03dcf70bc0d44df914028a4abbd3a5ffafc0a3939d7a6cd6950cee40a56a5c99695b"
+          "content": "649d84489b66407b76467cb90033a4a4f02d5ce3dae7b3385fa3d80e09d2d012d63bcb994a7cb442dbc2435b0eb5914e17e77ae272fe8277b01ab5be1d4e81ab"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ce993eab2736b33affa80fc3381cdafcb151dc0d7163862cd0bef391a2b8276a"
+          "content": "75b10d80c2b634e132427542056cd2ca67dba954141e6d767677a1ab18ffac9d"
         },
         {
           "alg": "SHA3-512",
-          "content": "55fab14a94b4df41e840f2b7009139376e50fe683b0b1c68a95cf177df8c36253d35a1c55717e6452627ccfca0acbe54fe5b9db8ba328d63d5cfb62b7faa58db"
+          "content": "70e8c7016d5be30a646de75e7f2aaa7b9999277ecbfbaea660ff546ece14e4dfe513af956ccacbe56f67ae3cf052148e863526a72ac93ccd0e3d76b888aa503b"
         }
       ]
     },
@@ -1661,11 +1661,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f47dfe67b4c270d0e4c8ec9cabdefafdce901ced92c4c234b23fdf65cf8df66a"
+          "content": "f02056365a264901e95631245efa002968acee2e6432ab2e5131b6b53eadcd81"
         },
         {
           "alg": "SHA3-512",
-          "content": "1cee2a3947de852c43c8d6f4686efb35a7c7594682b64fe2642e6101c5600b4ad20e37e3dc5b93962d7f857b0c5a5f093be5b42581999696ef33363552a7aa7e"
+          "content": "3f2f83b42aceb51653aa005f11404db852ca9d043536eb626cd03240f15ef92ec5a353fea1024518e149a59ac2e2b38623417c7b49907240d484686975d1e95f"
         }
       ]
     },