@blamejs/exceptd-skills 0.14.1 → 0.14.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.14.2 — 2026-05-27
+
+`exceptd collect citation-hygiene --resolve` now resolves the cited CVEs the offline catalog can't confirm — once each, through the shared resolver cache — and flips their verdicts instead of parking them as inconclusive for an agent to chase: a rejected or disputed identifier becomes a hit, a well-formed identifier NVD doesn't know becomes fabricated, and a confirmed one clears. Honors `--air-gap` (catalog and cache only, no network).
+
+The RFC index now includes obsoleted and historic RFCs (8888 entries, up from 7476). `exceptd rfc <number>` resolves a superseded RFC entirely offline — RFC 2616, for example, returns "Hypertext Transfer Protocol -- HTTP/1.1, obsoleted by RFC 7230–7235" — so confirming whether a cited RFC is still current no longer requires an IETF datatracker lookup.
+
 ## 0.14.1 — 2026-05-27
 
 Two citation resolvers — `exceptd cve <id>` and `exceptd rfc <number>` — answer "is this CVE/RFC citation valid?" so an agent gets the answer from exceptd instead of researching each identifier against NVD or the IETF datatracker by hand. A fan-out of agents auditing a codebase previously re-researched the same citations independently; these resolvers do it once and cache the result for the rest.

package/bin/exceptd.js

@@ -2337,7 +2337,7 @@ Flags (selected — see \`exceptd run --help\` for the full list):
  * its evidence JSON before going through phases 4-7. Returns a categorized
  * list: ok / missing_required / unknown_keys / type_mismatch / suggestions.
  */
-function cmdCollect(runner, args, runOpts, pretty) {
+async function cmdCollect(runner, args, runOpts, pretty) {
   const playbookId = args._[0];
   if (!playbookId) {
     return emitError(
@@ -2439,6 +2439,30 @@ function cmdCollect(runner, args, runOpts, pretty) {
   try { pbMetaAirGap = !!(runner.loadPlaybook(playbookId)?._meta?.air_gap_mode); }
   catch { /* playbook load shouldn't fail here — collector exists — but be defensive */ }
   const collectAirGap = !!(runOpts.airGap || process.env.EXCEPTD_AIR_GAP === "1" || pbMetaAirGap);
+
+  // --resolve: resolve the citations the offline catalog couldn't confirm,
+  // flipping their parked signals instead of leaving them inconclusive for the
+  // operator to research. Opt-in, collector-specific (only citation-hygiene
+  // exposes applyResolution). Honors the collect air-gap disposition.
+  if (args.resolve) {
+    if (typeof mod.applyResolution !== "function") {
+      return emitError(
+        `collect: --resolve is not supported by the "${playbookId}" collector (no resolution step).`,
+        { verb: "collect", playbook_id: playbookId },
+        pretty,
+      );
+    }
+    try {
+      submission = await mod.applyResolution(submission, { airGap: collectAirGap });
+    } catch (e) {
+      return emitError(
+        `collect: --resolve failed for "${playbookId}": ${e.message}`,
+        { verb: "collect", playbook_id: playbookId, exit_code: 2 },
+        pretty,
+      );
+    }
+  }
+
   // Spread `submission` first, then explicit fields, so a submission key
   // named `air_gap_mode` (currently always undefined but defensive against
   // future collector contracts) can't clobber the envelope marker.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-27T12:31:54.921Z",
+  "generated_at": "2026-05-27T13:10:02.958Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "cc72d668222e9cd18eaef7928e173ad17434ff4b411235bbba2b13fca722db9e",
+    "manifest.json": "e3c6dc62608d025f8f60ae232bdd54da7433eb8c1d29bdef81deee51122dae4c",
     "data/atlas-ttps.json": "d24bc02859d40ccf1615db75cca68c077585904e41e0d8f6de448121e9b1abb0",
     "data/attack-techniques.json": "fa193f0d2d248176a8beddb641e9fe56ba4faa9e15dc253ff876dbf0c5d58a77",
     "data/cve-catalog.json": "3d451dda7ac0c7d57a4075ae4bafd3148c6184b35dc1bc59d8b81d1f2641e430",
@@ -14,7 +14,7 @@
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
     "data/framework-control-gaps.json": "46094ad9b9584f454daddd28f4c5d27faf0ea0510daafd38fb60bf9d30f6a305",
     "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
-    "data/rfc-references.json": "66ef2e1f444a2cf0c2700a754f0a66030bb8a91d9e68394b9537ea1fe8b904fe",
+    "data/rfc-references.json": "b21d03b948c41bc8a854e2f057948ecf844bd8c105848aeb141d1eadf8192c31",
     "data/zeroday-lessons.json": "258252b9bff1fc11b05b76e10b659c1195971884bd44c92af5fefe17a5ca9512",
     "skills/kernel-lpe-triage/skill.md": "08b3e9815ba481c57c80f5fc0ccbf5bb7cbb41f570c235ba6ff9596b8c07354d",
     "skills/ai-attack-surface/skill.md": "c4c1eb22a38ca7a959b5725222bab8fbd4f4044a548a93f3e288e6f698334b72",

package/data/_indexes/activity-feed.json

@@ -5,6 +5,14 @@
     "event_count": 54
   },
   "events": [
+    {
+      "date": "2026-05-27",
+      "type": "catalog_update",
+      "artifact": "data/rfc-references.json",
+      "path": "data/rfc-references.json",
+      "schema_version": "1.0.0",
+      "entry_count": 8888
+    },
     {
       "date": "2026-05-22",
       "type": "skill_review",
@@ -100,14 +108,6 @@
       "schema_version": "1.0.0",
       "entry_count": 468
     },
-    {
-      "date": "2026-05-19",
-      "type": "catalog_update",
-      "artifact": "data/rfc-references.json",
-      "path": "data/rfc-references.json",
-      "schema_version": "1.0.0",
-      "entry_count": 7476
-    },
     {
       "date": "2026-05-18",
       "type": "skill_review",

package/data/_indexes/catalog-summaries.json

@@ -207,7 +207,7 @@
       "path": "data/rfc-references.json",
       "purpose": "IETF RFCs + active Internet-Drafts cited by skills (TLS, IPsec, PQ crypto migration, HTTP/3, CT). Cross-validated against IETF Datatracker via validate-rfcs.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-05-19",
+      "last_updated": "2026-05-27",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -216,7 +216,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 7476,
+      "entry_count": 8888,
       "sample_keys": [
         "RFC-4301",
         "RFC-4303",