@blamejs/exceptd-skills 0.13.59 → 0.13.60

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.13.60 — 2026-05-22
+
+Final tranche of audit cycle 3 polish. `doctor` surfaces the local version; `--collectors` distinguishes policy-skipped from actually-missing collectors; `ask` confidence penalizes ties.
+
+### Features
+
+- **`doctor` surfaces `local_version`** at the top of the JSON envelope + in the text header. Operators see "which version am I running?" alongside "is my install healthy?" without invoking `exceptd version` separately. Opt-in `--registry-check` augments with the published comparison; `local_version` alone is offline-clean.
+- **`doctor --collectors` adds `unexplained_missing_collectors`** — the set difference of `without_collector` and `policy_skips`. Previously these were identical-by-coincidence; a future regression that lost an active collector or a policy-skipped playbook that gained one would have gone unnoticed. The new field surfaces the operator-actionable gaps directly.
+- **`ask` confidence is penalized by tie spread.** A 5-way tie at the top score no longer reports the same confidence as a single clear winner. `confidence_factors` surfaces `base` (raw score / token count) + `tie_count` so consumers can introspect the math. Tied scores also break alphabetically only as a last resort — direct id-match between the question and a playbook id now outranks alphabetical accident.
+
 ## 0.13.59 — 2026-05-22
 
 Air-gap mode honored by `--upstream-check` and the `collect` envelope. `doctor` subchecks surface freshness timestamps + walk-cap markers. `--collectors` text matches its JSON.

package/bin/exceptd.js

@@ -6586,16 +6586,51 @@ function cmdDoctor(runner, args, runOpts, pretty) {
         }
       }
       const ok = load_errors.length === 0;
+      // Audit 3 B.6: pre-fix `without_collector` was just "playbooks
+      // missing a collector file" — which happened to equal POLICY_SKIPS
+      // exactly because every policy-skipped playbook also has no
+      // collector. That coincidence isn't an invariant: a future
+      // playbook could lose its collector by accident OR a policy-skipped
+      // playbook could gain a collector intentionally. Distinguish the
+      // two: `without_collector` is now playbooks-missing-a-collector
+      // that are NOT in the policy-skip allowlist — i.e. actual gaps
+      // that need attention. The set-difference is what operators
+      // should remediate.
+      // Pre-fix `without_collector` was just "playbooks missing a
+      // collector file" — which happened to equal POLICY_SKIPS exactly
+      // because every policy-skipped playbook also has no collector.
+      // That coincidence isn't an invariant: a future playbook could
+      // lose its collector by accident OR a policy-skipped playbook
+      // could gain one. The new `unexplained_missing_collectors`
+      // field surfaces the operator-actionable set difference:
+      // playbooks missing a collector that are NOT in the policy
+      // allowlist. Existing `without_collector` retained for
+      // back-compat.
+      const policySkipSet = new Set(POLICY_SKIPS);
+      const unexplained_missing_collectors = without_collector.filter(p => !policySkipSet.has(p));
+      // Audit-3 codex P1 follow-up: when an unexplained missing collector
+      // appears (a playbook that SHOULD have a collector but doesn't,
+      // i.e. NOT in the policy-skip allowlist), the check fails. Without
+      // this, automation and CI health checks would miss the exact
+      // regression class that unexplained_missing_collectors exists to
+      // surface. Load errors still fail at "error" severity; unexplained
+      // missings fail at "warn" (they're a build-time gap, not a
+      // runtime crash).
+      const collectorOk = ok && unexplained_missing_collectors.length === 0;
+      const collectorSeverity = load_errors.length > 0 ? "error"
+        : unexplained_missing_collectors.length > 0 ? "warn"
+        : "info";
       checks.collectors = {
-        ok,
-        severity: ok ? "info" : "error",
+        ok: collectorOk,
+        severity: collectorSeverity,
         total_playbooks: playbookFiles.length,
         with_collector,
         without_collector,
+        unexplained_missing_collectors,
         load_errors,
         policy_skips: POLICY_SKIPS.sort(),
       };
-      if (!ok) issues.push("collectors");
+      if (!collectorOk) issues.push("collectors");
     } catch (e) {
       checks.collectors = { ok: false, severity: "error", error: e.message };
       issues.push("collectors");
@@ -6615,8 +6650,18 @@ function cmdDoctor(runner, args, runOpts, pretty) {
   const { bucketChecks } = require(path.join(PKG_ROOT, "lib", "doctor-bucketing.js"));
   const { warnList, errorList } = bucketChecks(checks);
   const allGreen = errorList.length === 0 && warnList.length === 0;
+  // Audit 3 B.11: surface the local version on the default doctor output
+  // so operators answer both "is my install healthy?" AND "which version
+  // am I running?" without having to invoke `exceptd version` separately.
+  // The opt-in --registry-check augments this with the published comparison;
+  // local_version alone is offline-clean.
+  let localVersion = null;
+  try {
+    localVersion = require(path.join(PKG_ROOT, "package.json")).version || null;
+  } catch { /* package.json unreadable — fall through */ }
   const out = {
     verb: "doctor",
+    local_version: localVersion,
     checks,
     summary: {
       all_green: allGreen,
@@ -6727,7 +6772,7 @@ function cmdDoctor(runner, args, runOpts, pretty) {
 
   // Default: human checklist. v0.11.0 redesign #5.
   const lines = [];
-  lines.push("exceptd doctor");
+  lines.push(`exceptd doctor${localVersion ? ` (v${localVersion})` : ""}`);
   function mark(c, render) {
     if (!c) return;
     // Four states: ok / warn / error / skipped. `skipped` is informational
@@ -7546,7 +7591,20 @@ function cmdAsk(runner, args, runOpts, pretty) {
     if (tokens.some(t => (pb._meta?.id || id) === t)) score += 3;
     scored.push({ id: pb._meta?.id || id, score });
   }
-  scored.sort((a, b) => b.score - a.score);
+  // Audit 3 C.6: when scores tie, fall back to a deterministic but more
+  // useful order than alphabetical playbook-id (which made the first-5
+  // playbooks dominate every vague query). Secondary sort favors
+  // playbooks whose id is referenced directly in the question (e.g.
+  // "secrets" matching playbook id "secrets" outranks an alphabetical
+  // accident). Tertiary is the original stable order.
+  scored.forEach((s, i) => { s._origIdx = i; });
+  scored.sort((a, b) => {
+    if (b.score !== a.score) return b.score - a.score;
+    const aIdMatch = tokens.includes(a.id) ? 1 : 0;
+    const bIdMatch = tokens.includes(b.id) ? 1 : 0;
+    if (aIdMatch !== bIdMatch) return bIdMatch - aIdMatch;
+    return a._origIdx - b._origIdx;
+  });
   const top = scored.filter(s => s.score > 0).slice(0, 5);
 
   // v0.11.2: default human-readable; --json for machine.
@@ -7575,11 +7633,22 @@ function cmdAsk(runner, args, runOpts, pretty) {
     t.collector_available = fs.existsSync(collectorPath);
   }
 
+  // Audit 3 C.7: penalize confidence by the tie spread at the top so a
+  // 5-way tie at score 3 doesn't claim the same confidence as a single
+  // clear winner at score 3. tieCount counts how many playbooks share
+  // the top score (1 = clean winner; >1 = tie). Confidence divided
+  // accordingly: a 5-way tie reports ~0.2x the base, a clean winner
+  // reports the full base.
+  const topScore = top[0].score;
+  const tieCount = scored.filter(s => s.score === topScore).length;
+  const baseConfidence = Math.min(1, topScore / Math.max(2, tokens.length));
+  const tiePenalty = tieCount > 1 ? 1 / tieCount : 1;
   const result = {
     verb: "ask",
     question,
     routed_to: top.map(t => t.id),
-    confidence: Math.min(1, top[0].score / Math.max(2, tokens.length)),
+    confidence: Math.round(baseConfidence * tiePenalty * 100) / 100,
+    confidence_factors: { base: Math.round(baseConfidence * 100) / 100, tie_count: tieCount },
     next_step: `exceptd run ${top[0].id}    # or: exceptd brief ${top[0].id} to learn first`,
     full_match_list: top,
   };

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-22T23:28:32.508Z",
+  "generated_at": "2026-05-22T23:59:02.374Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "020990fd6a13ea3a2a0273e80d0607c1cf0fd8887f03bb48294d2568a22d2789",
+    "manifest.json": "fc19c462b36237eeee08be520747e440f0cafdd27dcad4c7623042eec02815c2",
     "data/atlas-ttps.json": "d296c1d3e71807c9279b731f047e57796e85137f186586743a8cdad214b408f9",
     "data/attack-techniques.json": "49b6010b317edd219def135171ea8f3b1bbf1e00e9c5a08bf7237215ff54e2c3",
     "data/cve-catalog.json": "a09c83af3f9679a7ea73935726a1ff9de2cab94b4ab6321fc017fc147747d7c3",

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.13.59",
+  "version": "0.13.60",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-22T23:28:31.011Z",
+      "signed_at": "2026-05-22T23:59:01.124Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -117,7 +117,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vSVqu4wBm+d68ujZmM6Rto/HzViCkE0gPUcv/MYE/bjFiqamf/s0On4kTOo1KIveV9cOwYNxiItaGEWlVkRFDg==",
-      "signed_at": "2026-05-22T23:28:31.013Z",
+      "signed_at": "2026-05-22T23:59:01.126Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -180,7 +180,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "RIgXKvolQjgJdnlrDnVOd90IOY1B7VHHZD/YJQRzouL+wUeOLclPrdK/EgEuFyiu7lR4bi+Pl6aGB9G9tOxYCQ==",
-      "signed_at": "2026-05-22T23:28:31.013Z",
+      "signed_at": "2026-05-22T23:59:01.126Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -226,7 +226,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "RYOxeq/o3uTwTWq4H7RcdH2Aclg9UyCERfUH9Frwkzncsowg7LgxpaEDc3swTCv73HMEGbU8wVbXguZ4JxHUCQ==",
-      "signed_at": "2026-05-22T23:28:31.014Z"
+      "signed_at": "2026-05-22T23:59:01.127Z"
     },
     {
       "name": "compliance-theater",
@@ -257,7 +257,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "DneJCPKCPcoe6nQ82XptqSqNfSRdt1orKaO+o7K36YCciDrzwJb+1BuBLusPDtpcdDaGY0y0e+AqiTYJklhBAQ==",
-      "signed_at": "2026-05-22T23:28:31.014Z"
+      "signed_at": "2026-05-22T23:59:01.127Z"
     },
     {
       "name": "exploit-scoring",
@@ -286,7 +286,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-22T23:28:31.015Z"
+      "signed_at": "2026-05-22T23:59:01.128Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -323,7 +323,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "XgrzcA2brPhXrSTxrcLnJec0OpgGYJBoSTUlJ10UdePHffxqb9LTVGnfbmEk1ykQifXREZexui2bG7X/+eFfCQ==",
-      "signed_at": "2026-05-22T23:28:31.015Z",
+      "signed_at": "2026-05-22T23:59:01.128Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -380,7 +380,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "9+hZlZOqZdeACUmamQk66L5levZhhwnFXuYRhdT6Mce99eQaKT7wNfWq12hXQztkRcVRKaFH+a01zwJQwsRQCA==",
-      "signed_at": "2026-05-22T23:28:31.016Z",
+      "signed_at": "2026-05-22T23:59:01.128Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -415,7 +415,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "ciqhVloMWWXEigPZvvwoV2c54tEqsDqsoc+sS/mNTFFJk2H+tz2+XUrgfEPRuYw0FeyNB6/+27pL2NpKHzUqAg==",
-      "signed_at": "2026-05-22T23:28:31.016Z",
+      "signed_at": "2026-05-22T23:59:01.129Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-22T23:28:31.016Z"
+      "signed_at": "2026-05-22T23:59:01.129Z"
     },
     {
       "name": "global-grc",
@@ -475,7 +475,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-22T23:28:31.017Z"
+      "signed_at": "2026-05-22T23:59:01.129Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -502,7 +502,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-22T23:28:31.017Z"
+      "signed_at": "2026-05-22T23:59:01.130Z"
     },
     {
       "name": "pqc-first",
@@ -554,7 +554,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "vhc3wuQEro/86s1ro2b/KakUXg8QVnySYTBqA7ebzv9oeR2HYO5bvGEJp3oOHWtL37JDqcCAHYadSN/qxIyCCA==",
-      "signed_at": "2026-05-22T23:28:31.018Z",
+      "signed_at": "2026-05-22T23:59:01.130Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -601,7 +601,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "MS35nWm8djfJGn4OOoT0JKJ2aO+Dkbb6wOOWJYvNZlRKT3UGA59o2gxg1JOnD20hb/RwxtkmCujhl2tuYSR+AQ==",
-      "signed_at": "2026-05-22T23:28:31.018Z"
+      "signed_at": "2026-05-22T23:59:01.130Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -638,7 +638,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-22T23:28:31.018Z",
+      "signed_at": "2026-05-22T23:59:01.131Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -673,7 +673,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "WAu5fRirzSOcnnZsTx2d/JJZwa/LPpXCi+31qATTGLmoNuhyy81k3ooPe9kCM3E0CLMtvTePg9DagYqBninZDQ==",
-      "signed_at": "2026-05-22T23:28:31.019Z"
+      "signed_at": "2026-05-22T23:59:01.131Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -744,7 +744,7 @@
         "PTES revision incorporating AI-surface enumeration"
       ],
       "signature": "7eEwCXFd9pDKUw7yCUbRJSjfzozE44dwwwemCQUPm8JBPztLltibD9bL/RszSbYyCrYJmVb5Drncz2cGe62gCw==",
-      "signed_at": "2026-05-22T23:28:31.019Z"
+      "signed_at": "2026-05-22T23:59:01.131Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -804,7 +804,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-22T23:28:31.019Z"
+      "signed_at": "2026-05-22T23:59:01.132Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -879,7 +879,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "fgxG344JGYBWWWwFXZ1IzGipWKP7EyBhrsvsbsb0CCGXfv/MvNHVNI6G0zQddCsWX1JeQbhZT3Vk8v1uJKDTDA==",
-      "signed_at": "2026-05-22T23:28:31.020Z"
+      "signed_at": "2026-05-22T23:59:01.132Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -956,7 +956,7 @@
         "OpenSSF model-signing — emerging Sigstore-based signing standard for ML model weights; track for production adoption"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-22T23:28:31.020Z"
+      "signed_at": "2026-05-22T23:59:01.132Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1013,7 +1013,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "gqF8eU3VBrZhO2WnlcqKa7wm1d2mmWtvpbmx0kNCgHojNV+qEt+Ij84RO6bZvaUqhfYPWizWL79Fa4DL0curAQ==",
-      "signed_at": "2026-05-22T23:28:31.020Z"
+      "signed_at": "2026-05-22T23:59:01.133Z"
     },
     {
       "name": "identity-assurance",
@@ -1080,7 +1080,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-22T23:28:31.021Z"
+      "signed_at": "2026-05-22T23:59:01.133Z"
     },
     {
       "name": "ot-ics-security",
@@ -1136,7 +1136,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-22T23:28:31.021Z"
+      "signed_at": "2026-05-22T23:59:01.133Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1188,7 +1188,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-22T23:28:31.021Z"
+      "signed_at": "2026-05-22T23:59:01.133Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1238,7 +1238,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-22T23:28:31.022Z"
+      "signed_at": "2026-05-22T23:59:01.134Z"
     },
     {
       "name": "webapp-security",
@@ -1312,7 +1312,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-22T23:28:31.022Z"
+      "signed_at": "2026-05-22T23:59:01.134Z"
     },
     {
       "name": "ai-risk-management",
@@ -1362,7 +1362,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-22T23:28:31.022Z"
+      "signed_at": "2026-05-22T23:59:01.135Z"
     },
     {
       "name": "sector-healthcare",
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-22T23:28:31.023Z"
+      "signed_at": "2026-05-22T23:59:01.135Z"
     },
     {
       "name": "sector-financial",
@@ -1503,7 +1503,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-22T23:28:31.023Z"
+      "signed_at": "2026-05-22T23:59:01.135Z"
     },
     {
       "name": "sector-federal-government",
@@ -1572,7 +1572,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-22T23:28:31.024Z"
+      "signed_at": "2026-05-22T23:59:01.136Z"
     },
     {
       "name": "sector-energy",
@@ -1637,7 +1637,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-22T23:28:31.024Z"
+      "signed_at": "2026-05-22T23:59:01.136Z"
     },
     {
       "name": "sector-telecom",
@@ -1723,7 +1723,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-22T23:28:31.025Z"
+      "signed_at": "2026-05-22T23:59:01.136Z"
     },
     {
       "name": "api-security",
@@ -1792,7 +1792,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-22T23:28:31.025Z"
+      "signed_at": "2026-05-22T23:59:01.137Z"
     },
     {
       "name": "cloud-security",
@@ -1873,7 +1873,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-22T23:28:31.025Z"
+      "signed_at": "2026-05-22T23:59:01.137Z"
     },
     {
       "name": "container-runtime-security",
@@ -1935,7 +1935,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-22T23:28:31.026Z"
+      "signed_at": "2026-05-22T23:59:01.137Z"
     },
     {
       "name": "mlops-security",
@@ -2006,7 +2006,7 @@
         "MITRE ATLAS v5.6.0 (released February 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: ATLAS v5.5 / v6.0 — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "BGNE6ZQWBA1LmsUFe8tU0L67iGDSrFqiuqaZD2f1KqfcyqqzQfMs9PWNHFzxxaJmXeKlm87eU8lgELF0bX+RBA==",
-      "signed_at": "2026-05-22T23:28:31.026Z"
+      "signed_at": "2026-05-22T23:59:01.138Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2068,7 +2068,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "FkZQerh3VHVJAwIcCktDyMRh5KE2+Em/i0ek8zEz7JG/PXtQx8ujHWTh3VjZbOLhPNtdB2qxgXOIAYIofaVOAQ==",
-      "signed_at": "2026-05-22T23:28:31.027Z"
+      "signed_at": "2026-05-22T23:59:01.138Z"
     },
     {
       "name": "ransomware-response",
@@ -2148,7 +2148,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "n3UToNuN3A1HgLvcuqmIx8vrZY71+r/79waK92jG+rSX4uYOzkmxMUpROrE5K9bDwMezNBHdjWv8Uul6zugyDQ==",
-      "signed_at": "2026-05-22T23:28:31.027Z"
+      "signed_at": "2026-05-22T23:59:01.138Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2201,7 +2201,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-22T23:28:31.027Z"
+      "signed_at": "2026-05-22T23:59:01.139Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2269,7 +2269,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "+OO0RhQ303RJV7kaH38IuZpLeQbapep6Ds4Re/WEZu0FHBwKSlwvF7jbtP7KQ57xldJYn/xZm2jaszyOacMfDg==",
-      "signed_at": "2026-05-22T23:28:31.028Z"
+      "signed_at": "2026-05-22T23:59:01.139Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2349,7 +2349,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-22T23:28:31.028Z"
+      "signed_at": "2026-05-22T23:59:01.139Z"
     },
     {
       "name": "idp-incident-response",
@@ -2430,11 +2430,11 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-22T23:28:31.028Z"
+      "signed_at": "2026-05-22T23:59:01.140Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "jYdDFzIsg9EdwlNtBAT5NYGZYTtQzpZxo5lGAUJ4lG2hSWgmFy8dOqe4fL1o++uqDYDbUfh8tF/CkDOiGqJrCg=="
+    "signature_base64": "X4276PNS/Wai6FjgKgJ/po8QxOthqnAnXMznT2ZhyVyftftdIv8r3QF84mYOeET9ZxuxNzvONAf10JvSjsclCQ=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.13.59",
+  "version": "0.13.60",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:eb996267-363d-46e0-9a5c-f259a8c46d9b",
+  "serialNumber": "urn:uuid:97ba6fa8-d1c8-4153-8585-f1ca01cb55cc",
   "version": 1,
   "metadata": {
-    "timestamp": "2151-04-04T19:39:19.000Z",
+    "timestamp": "2106-09-01T16:58:16.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.13.59"
+        "version": "0.13.60"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.59",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.13.60",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.13.59",
+      "version": "0.13.60",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 10 catalogs (312 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 7476 RFCs), 34 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.59",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.13.60",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "97387465e487f40271bdfd6dc20958446c2772c571c9c7671e9f912e0a6b32ae"
+          "content": "4993fa8a121118c5e43b17213c8754642ad5ce537e85b996e27468097aa0630c"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.59"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.13.60"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d08eca001f3bd9547d899b0531b59b5bcf929bcc1134f5f920bc85453a96bee8"
+          "content": "483e39b534403945a2a2f17aca86ea0f38b63c89a05e2e873d29cefbd0ab81fc"
         },
         {
           "alg": "SHA3-512",
-          "content": "9b6e0d750008f8b273c44016fd002d31f38ebb95b00787cd57081c29f8afed8c9c56b94a85c17b9a1bd4edacdbf12ba602acda6459d7743ab409ff3471114932"
+          "content": "197ae502585c387f3cb41a106d97efe0cb95b1224eaebac83ba9e7cac06e6dc9a93f04d1ff26bd5a332939936c75ead350dbdd9d3c168c6e47216a4e7b97c160"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "679a543aec746f1e99d891099bd04ab88fd0b8ba6e20a3484c9d9e3a9d33fd7e"
+          "content": "5c9ce8eadb9b392d565d598bf49efadeb7e8c029c2e182ac53c9de2d8631ff3f"
         },
         {
           "alg": "SHA3-512",
-          "content": "694240b8a9268abc9ec54bdb52df56389fb115a81f99d70121ccb7e427d7bc670d7d4651fbaaec9b7be35f03c861b75b06177ba4e372890304542aa1a4615a83"
+          "content": "a358a3c9fdfc04c202f33568dcc3f046700f87b0210114a2cea8fe82178dc4c8f1d96301b0c6f34b01f675bfaf2d03ac36fdb96b45c26a9873006da099f4eb9c"
         }
       ]
     },
@@ -1661,11 +1661,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "020990fd6a13ea3a2a0273e80d0607c1cf0fd8887f03bb48294d2568a22d2789"
+          "content": "fc19c462b36237eeee08be520747e440f0cafdd27dcad4c7623042eec02815c2"
         },
         {
           "alg": "SHA3-512",
-          "content": "4bbf18c5ec14dbae987465ebca8dc06b2fcce0347eae3f834fb1fc33115289acf6484385b25f728548b70e37a7f4f2ce3d4c314b36465961cc22dbaf7c974e14"
+          "content": "593bc450ed6e145ea66fdbe7f7e37e46dbf5d04738f55a5a4d24df452f3dfe8b1e0090215bc3ce4fb84e27c36281f8217725d668e9964cb345e6e5c593c9bbae"
         }
       ]
     },