@blamejs/exceptd-skills 0.14.14 → 0.14.16

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.14.16 — 2026-05-27
+
+`collect` is dramatically faster on large repositories. The directory-walking collectors (`secrets`, `crypto-codebase`, `containers`, `citation-hygiene`) called `realpathSync` on every file for symlink-cycle detection and stat'd each file before reading it; the walk is now a single shared implementation that resolves real paths only for directories and symlinks and reads files without a pre-stat. On a 5000-file repository `collect secrets` drops from ~1.1s to ~0.18s (and `collect containers` from ~0.7s to ~0.02s), with identical results.
+
+Cheap verbs start faster. The CVE catalog (~2.6 MB) was parsed at module load on every invocation; verbs that never analyze (`brief`, `plan`, `look`, `ask`, `lint`, `discover`) no longer pay that cost — the catalog is parsed lazily on the first run that needs it (a corrupt catalog still blocks a `run` cleanly).
+
+`ask` routes a few more questions correctly: a CI/OIDC question (e.g. "my CI runner leaked an OIDC token") routes to `cicd-pipeline-compromise` instead of the supply-chain playbooks, and an "AI command and control" question routes to `ai-api`. Common two-letter English filler words ("do", "is", "to", …) no longer produce a spurious low-confidence match for nonsense questions.
+
+Removed an always-empty `recipes` field from the CVE cross-reference result. Recipes are use-case curated, never CVE-keyed, so a per-CVE recipe lookup could never populate.
+
+## 0.14.15 — 2026-05-27
+
+Emitted CSAF 2.0 and SARIF 2.1.0 documents now pass strict schema/profile validation:
+- Every CSAF vulnerability carries `notes` (CVE-keyed entries previously omitted it, failing the security-advisory profile's mandatory test).
+- A clean run's `csaf_informational_advisory` no longer carries a `/vulnerabilities` array or a `/product_tree` (both are wrong for the informational profile) and now includes the required external `/document/references` entry.
+- `tracking.version` equals the last `revision_history` number and uses the same versioning scheme as it (previously the version was the playbook semver while the revision number was the integer `1` — two violations: a version/revision mismatch and mixed versioning schemes).
+- SARIF results with `kind: "informational"` (framework-gap findings) now use `level: "none"` instead of `"note"`; the SARIF spec requires `level: "none"` whenever `kind` is not `"fail"`, so strict validators and GitHub code scanning previously rejected those results.
+- SARIF `artifactLocation.uri` values from a submission-supplied evidence location are normalized to forward slashes. A Windows operator passing a native backslash path previously produced URIs that violate the SARIF URI-reference requirement (the collector-derived locations were already normalized; submission-threaded ones were not).
+
 ## 0.14.14 — 2026-05-27
 
 Attestation durability and verification:

package/bin/exceptd.js

@@ -8186,6 +8186,18 @@ function cmdAsk(runner, args, runOpts, pretty) {
     "cred theft": ["cred-stores", "secrets"],
     "credential exfil": ["cred-stores", "llm-tool-use-exfil"],
     "developer laptop": ["cred-stores", "hardening"],
+    // CI/CD + OIDC vocabulary → the dedicated cicd-pipeline-compromise playbook
+    // (the supply-chain playbooks otherwise out-rank it on shared tokens).
+    "oidc": ["cicd-pipeline-compromise", "ci", "pipeline", "runner", "signing"],
+    "cicd": ["cicd-pipeline-compromise", "ci", "pipeline"],
+    "ci/cd": ["cicd-pipeline-compromise", "pipeline"],
+    "runner": ["cicd-pipeline-compromise", "ci"],
+    "pipeline": ["cicd-pipeline-compromise"],
+    // C2-over-AI-API → the dedicated ai-api playbook (llm-tool-use-exfil
+    // otherwise wins on a long C2 sentence).
+    "c2": ["ai-api", "ai-c2"],
+    "command and control": ["ai-api", "ai-c2"],
+    "command-and-control": ["ai-api", "ai-c2"],
   };
 
   // Audit 3 C.1: stopwords filtered after synonym expansion so common
@@ -8202,6 +8214,11 @@ function cmdAsk(runner, args, runOpts, pretty) {
     "than", "then", "them", "some", "more", "most", "very", "much", "such",
     "been", "were", "want", "well", "back", "good", "make", "made", "take",
     "took", "give", "gave", "find", "found", "know", "knew", "told", "ago",
+    // 2-char English fillers (the length>=2 token filter otherwise lets these
+    // substring-hit a haystack — "do" matched ai-api). Deliberately excludes
+    // security-meaningful 2-char tokens (ai, ml, ci, c2, k8s).
+    "do", "is", "my", "it", "me", "to", "of", "on", "or", "an", "as", "at",
+    "be", "by", "we", "up", "so", "no", "if", "in",
   ]);
 
   // Tokenize question (length >= 2, lowercase) + expand via synonyms.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-27T23:08:52.304Z",
+  "generated_at": "2026-05-28T00:40:30.346Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "008292f92fc956004d340bf314748a28ab03a6f14c88ddf7f5deabdab8b14b4d",
+    "manifest.json": "53aaca262d4df7bf007660d881cd042cec47f11bb792f3ab77bed752b875373b",
     "data/atlas-ttps.json": "d24bc02859d40ccf1615db75cca68c077585904e41e0d8f6de448121e9b1abb0",
     "data/attack-techniques.json": "fa193f0d2d248176a8beddb641e9fe56ba4faa9e15dc253ff876dbf0c5d58a77",
     "data/cve-catalog.json": "3d451dda7ac0c7d57a4075ae4bafd3148c6184b35dc1bc59d8b81d1f2641e430",

package/lib/collectors/citation-hygiene.js

@@ -30,7 +30,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 
-const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations, lineFromOffset } = require("./scan-excludes");
+const { codeExcludeSet, walkTree, buildEvidenceLocations, lineFromOffset } = require("./scan-excludes");
 
 const COLLECTOR_ID = "citation-hygiene";
 
@@ -89,43 +89,15 @@ function isIllustrativePath(rel) {
   return false;
 }
 
-function walkTree(root, opts = {}) {
-  const maxDepth = opts.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const excludes = opts.excludes ?? EXCLUDES;
-  const out = [];
-  const seen = new Set();
-
-  function walk(dir, depth) {
-    if (depth > maxDepth) return;
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-    catch { return; }
-    for (const entry of entries) {
-      if (excludes.has(entry.name)) continue;
-      const full = path.join(dir, entry.name);
-      let real;
-      try { real = fs.realpathSync(full); } catch { continue; }
-      if (seen.has(real)) continue;
-      seen.add(real);
-      if (entry.isDirectory()) {
-        // Skip detached git worktrees (agent scratch copies) — descending
-        // into them rescans unrelated repo state.
-        if (isLinkedWorktreeDir(full)) continue;
-        walk(full, depth + 1);
-      } else if (entry.isFile()) {
-        out.push({ full, rel: path.relative(root, full), name: entry.name });
-      }
-    }
-  }
-  walk(root, 0);
-  return out;
-}
-
 function readSafe(full) {
   try {
-    const s = fs.statSync(full);
-    if (s.size > MAX_FILE_BYTES) return null;
-    return fs.readFileSync(full, "utf8");
+    // Read raw bytes, enforce the 2 MB cap on the buffer length, then decode.
+    // Replaces a statSync-before-read with a single read; the cap is
+    // byte-based, so Buffer.length is the correct measure and an oversized
+    // file is rejected before any UTF-8 decode.
+    const raw = fs.readFileSync(full);
+    if (raw.length > MAX_FILE_BYTES) return null;
+    return raw.toString("utf8");
   } catch { return null; }
 }
 
@@ -288,7 +260,7 @@ function collect({ cwd = process.cwd() } = {}) {
 
   let files;
   try {
-    files = walkTree(root);
+    files = walkTree(root, { maxDepth: DEFAULT_MAX_DEPTH, excludes: EXCLUDES });
   } catch (e) {
     errors.push({ kind: "walk_failed", reason: e.message });
     files = [];

package/lib/collectors/containers.js

@@ -20,7 +20,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations } = require("./scan-excludes");
+const { codeExcludeSet, walkTree, buildEvidenceLocations } = require("./scan-excludes");
 
 const COLLECTOR_ID = "containers";
 
@@ -37,36 +37,6 @@ const COMPOSE_NAMES = new Set([
 ]);
 const COMPOSE_PREFIX = "docker-compose.";   // docker-compose.override.yml etc.
 
-function walkTree(root, opts = {}) {
-  const maxDepth = opts.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const excludes = opts.excludes ?? DEFAULT_EXCLUDES;
-  const out = [];
-  const seen = new Set();
-  function walk(dir, depth) {
-    if (depth > maxDepth) return;
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
-    for (const entry of entries) {
-      if (excludes.has(entry.name)) continue;
-      const full = path.join(dir, entry.name);
-      let real;
-      try { real = fs.realpathSync(full); } catch { continue; }
-      if (seen.has(real)) continue;
-      seen.add(real);
-      if (entry.isDirectory()) {
-        // Skip linked git worktrees (their `.git` is a gitdir pointer
-        // file) — e.g. agent-created repo copies under
-        // `.claude/worktrees/<id>/`. Walking them rescans the same
-        // Dockerfiles / compose / k8s manifests as the host tree.
-        if (isLinkedWorktreeDir(full)) continue;
-        walk(full, depth + 1);
-      } else if (entry.isFile()) out.push({ full, rel: path.relative(root, full), name: entry.name });
-    }
-  }
-  walk(root, 0);
-  return out;
-}
-
 function classify(file) {
   const name = file.name;
   const ext = path.extname(name).toLowerCase();
@@ -85,9 +55,13 @@ function classify(file) {
 
 function readSafe(full, max = 512 * 1024) {
   try {
-    const s = fs.statSync(full);
-    if (s.size > max) return null;
-    return fs.readFileSync(full, "utf8");
+    // Read raw bytes, enforce the cap on the buffer length, then decode.
+    // Replaces a statSync-before-read with a single read; the cap is
+    // byte-based, so Buffer.length is the correct measure and an oversized
+    // file is rejected before any UTF-8 decode.
+    const raw = fs.readFileSync(full);
+    if (raw.length > max) return null;
+    return raw.toString("utf8");
   } catch { return null; }
 }
 
@@ -324,7 +298,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   const root = path.resolve(cwd);
 
   let files;
-  try { files = walkTree(root); }
+  try { files = walkTree(root, { maxDepth: DEFAULT_MAX_DEPTH, excludes: DEFAULT_EXCLUDES }); }
   catch (e) { errors.push({ kind: "walk_failed", reason: e.message }); files = []; }
 
   const dockerfiles = [];

package/lib/collectors/crypto-codebase.js

@@ -16,7 +16,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations, lineFromOffset } = require("./scan-excludes");
+const { codeExcludeSet, walkTree, buildEvidenceLocations, lineFromOffset } = require("./scan-excludes");
 
 const COLLECTOR_ID = "crypto-codebase";
 
@@ -67,45 +67,15 @@ function isTestPath(rel) {
   return false;
 }
 
-function walkTree(root, opts = {}) {
-  const maxDepth = opts.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const excludes = opts.excludes ?? DEFAULT_EXCLUDES;
-  const out = [];
-  const seen = new Set();
-
-  function walk(dir, depth) {
-    if (depth > maxDepth) return;
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-    catch { return; }
-    for (const entry of entries) {
-      if (excludes.has(entry.name)) continue;
-      const full = path.join(dir, entry.name);
-      let real;
-      try { real = fs.realpathSync(full); } catch { continue; }
-      if (seen.has(real)) continue;
-      seen.add(real);
-      if (entry.isDirectory()) {
-        // Never descend into a linked git worktree (its `.git` is a
-        // gitdir pointer file). Agent tooling stamps full repo copies
-        // under `.claude/worktrees/<id>/`; walking them rescans the same
-        // source as the host tree and multiplies every hit.
-        if (isLinkedWorktreeDir(full)) continue;
-        walk(full, depth + 1);
-      } else if (entry.isFile()) {
-        out.push({ full, rel: path.relative(root, full), name: entry.name });
-      }
-    }
-  }
-  walk(root, 0);
-  return out;
-}
-
 function readSafe(full) {
   try {
-    const s = fs.statSync(full);
-    if (s.size > MAX_FILE_BYTES) return null;
-    return fs.readFileSync(full, "utf8");
+    // Read raw bytes, enforce the 1 MB cap on the buffer length, then decode.
+    // Replaces a statSync-before-read on the hot path with a single read; the
+    // cap is byte-based, so Buffer.length is the correct measure and an
+    // oversized file is rejected before any UTF-8 decode.
+    const raw = fs.readFileSync(full);
+    if (raw.length > MAX_FILE_BYTES) return null;
+    return raw.toString("utf8");
   } catch { return null; }
 }
 
@@ -246,7 +216,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
 
   let files;
   try {
-    files = walkTree(root);
+    files = walkTree(root, { maxDepth: DEFAULT_MAX_DEPTH, excludes: DEFAULT_EXCLUDES });
   } catch (e) {
     errors.push({ kind: "walk_failed", reason: e.message });
     files = [];

package/lib/collectors/secrets.js

@@ -18,7 +18,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { codeExcludeSet, isLinkedWorktreeDir, buildEvidenceLocations, lineFromOffset } = require("./scan-excludes");
+const { codeExcludeSet, walkTree, buildEvidenceLocations, lineFromOffset } = require("./scan-excludes");
 
 const COLLECTOR_ID = "secrets";
 
@@ -119,40 +119,6 @@ const TEXT_EXTENSIONS = new Set([
 const TEXT_EXACT = new Set(["Dockerfile", "Makefile", "Procfile", ".env", ".envrc"]);
 const MAX_FILE_BYTES = 1024 * 1024; // 1 MB per file content scan
 
-function walkTree(root, opts = {}) {
-  const maxDepth = opts.maxDepth ?? DEFAULT_MAX_DEPTH;
-  const excludes = opts.excludes ?? DEFAULT_EXCLUDES;
-  const out = [];
-  const seen = new Set();
-
-  function walk(dir, depth) {
-    if (depth > maxDepth) return;
-    let entries;
-    try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
-    catch { return; }
-    for (const entry of entries) {
-      if (excludes.has(entry.name)) continue;
-      const full = path.join(dir, entry.name);
-      let real;
-      try { real = fs.realpathSync(full); } catch { continue; }
-      if (seen.has(real)) continue;
-      seen.add(real);
-      if (entry.isDirectory()) {
-        // Skip linked git worktrees (their `.git` is a gitdir pointer
-        // file). Agent tooling stamps full repo copies under
-        // `.claude/worktrees/<id>/`; descending into them rescans the
-        // same files and inflates secret-carrier hit counts.
-        if (isLinkedWorktreeDir(full)) continue;
-        walk(full, depth + 1);
-      } else if (entry.isFile()) {
-        out.push({ full, rel: path.relative(root, full), name: entry.name });
-      }
-    }
-  }
-  walk(root, 0);
-  return out;
-}
-
 function classify(file) {
   const name = file.name;
   const ext = path.extname(name).toLowerCase();
@@ -200,9 +166,15 @@ function redactMatch(literal) {
 function scanContent(full, rel) {
   let buf;
   try {
-    const s = fs.statSync(full);
-    if (s.size > MAX_FILE_BYTES) return { skipped: "file_too_large", bytes: s.size, hits: [] };
-    buf = fs.readFileSync(full, "utf8");
+    // Read raw bytes first, then enforce the 1 MB cap on the buffer length.
+    // The previous statSync-before-read doubled the per-file syscall count on
+    // the hot path; reading the buffer and measuring it is byte-accurate (the
+    // cap is a byte limit) without the extra stat. Reading as a Buffer rather
+    // than decoding to a string up front means an oversized file is rejected
+    // before any UTF-8 decode work.
+    const raw = fs.readFileSync(full);
+    if (raw.length > MAX_FILE_BYTES) return { skipped: "file_too_large", bytes: raw.length, hits: [] };
+    buf = raw.toString("utf8");
   } catch (e) {
     return { skipped: "read_error", reason: e.message, hits: [] };
   }
@@ -236,7 +208,7 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
 
   let files;
   try {
-    files = walkTree(root);
+    files = walkTree(root, { maxDepth: DEFAULT_MAX_DEPTH, excludes: DEFAULT_EXCLUDES });
   } catch (e) {
     errors.push({ kind: "walk_failed", reason: e.message });
     files = [];

package/lib/cross-ref-api.js

@@ -145,15 +145,14 @@ function byCve(cveId, opts) {
   }
 
   const xref = loadIndex('xref.json');
-  const recipes = loadIndex('recipes.json');
   const theaterFp = loadIndex('theater-fingerprints.json');
   const gaps = loadCatalog('framework-control-gaps.json');
   const lessons = loadCatalog('zeroday-lessons.json');
 
   const skills = (xref[cveId] || xref.cves?.[cveId] || []).slice();
-  const matchingRecipes = entries(recipes).filter(([, r]) =>
-    Array.isArray(r.triggered_by) && r.triggered_by.includes(cveId)
-  ).map(([id]) => id);
+  // (Recipes are use-case curated, not CVE-triggered — recipes.json has no
+  // `triggered_by`/CVE keying, so a per-CVE recipe lookup was always empty.
+  // The dead `recipes:[]` field is no longer emitted.)
   const theater = entries(theaterFp).filter(([, t]) =>
     Array.isArray(t.cve_refs) && t.cve_refs.includes(cveId)
   ).map(([id, t]) => ({ id, distinguisher: t.distinguisher || t.test }));
@@ -177,7 +176,6 @@ function byCve(cveId, opts) {
     skills,
     framework_gaps,
     theater_tests: theater,
-    recipes: matchingRecipes,
     zeroday_lessons: lessons_learned
   };
 }
@@ -236,19 +234,6 @@ function byFramework(frameworkId, scenario) {
   return { framework: frameworkId, scenario: scenario || null, framework_meta: fwMeta, gaps: matching, gap_count: matching.length };
 }
 
-/**
- * Given a detected signal shape, return recipes whose triggered_by matches
- * any of the signals. Used by the analyze phase to chain into multi-step
- * workflows the agent should walk through next.
- */
-function recipesFor(signals) {
-  const recipes = loadIndex('recipes.json');
-  const sigSet = new Set(signals);
-  return entries(recipes)
-    .filter(([, r]) => Array.isArray(r.triggered_by) && r.triggered_by.some(t => sigSet.has(t)))
-    .map(([id, r]) => ({ id, name: r.name, skills: r.skills, steps: r.steps }));
-}
-
 /**
  * Theater-fingerprint lookup — given a finding shape, return the specific test
  * that distinguishes paper compliance from actual security (AGENTS.md Hard
@@ -297,7 +282,6 @@ module.exports = {
   byTtp,
   bySkill,
   byFramework,
-  recipesFor,
   theaterTestsFor,
   globalFrameworkContext,
   clearCache,

package/lib/playbook-runner.js

@@ -60,26 +60,40 @@ const scoring = require('./scoring');
 // signal regardless of submission shape.
 let xref;
 let _xrefLoadError = null;
+let _xrefProbed = false;
 try {
   xref = require('./cross-ref-api');
-  // Probe-load the catalog so any parse error is observable BEFORE the
-  // first real analyze() call. Without this, a corrupt catalog would
-  // only surface on the first byCve invocation, which could be
-  // mid-pipeline (after preflight/govern/direct phases have already
-  // emitted artifacts).
-  try { xref.byCve('__exceptd-probe__'); } catch {}
-  if (typeof xref.getLoadErrors === 'function') {
-    const errs = xref.getLoadErrors();
-    if (errs && errs.length) {
-      _xrefLoadError = `${errs.length} catalog/index load error(s): ${errs.map(e => `${e.file}: ${e.error}`).join('; ')}`;
-    }
-  }
 } catch (e) {
   _xrefLoadError = (e && e.message) ? String(e.message) : String(e);
   xref = {
     byCve: () => ({ found: false, _error: _xrefLoadError }),
     _error: _xrefLoadError,
   };
+  _xrefProbed = true; // require itself failed; nothing left to probe
+}
+
+// Probe the catalog (parse it, surface any load error) LAZILY on first need
+// rather than at module load. The probe parses the ~2.6MB CVE catalog (~8.5ms);
+// doing it eagerly charged that to every cheap verb (brief/plan/look/ask/lint/
+// discover) that never analyzes. run() calls this before the analyze path, so
+// a corrupt catalog still surfaces as blocked_by:'catalog_corrupt' before
+// analyze — just not on verbs that don't touch the catalog. Memoized: probes
+// at most once per process.
+function getXrefLoadError() {
+  if (_xrefProbed) return _xrefLoadError;
+  _xrefProbed = true;
+  try {
+    try { xref.byCve('__exceptd-probe__'); } catch { /* force the lazy catalog load */ }
+    if (typeof xref.getLoadErrors === 'function') {
+      const errs = xref.getLoadErrors();
+      if (errs && errs.length) {
+        _xrefLoadError = `${errs.length} catalog/index load error(s): ${errs.map(e => `${e.file}: ${e.error}`).join('; ')}`;
+      }
+    }
+  } catch (e) {
+    _xrefLoadError = (e && e.message) ? String(e.message) : String(e);
+  }
+  return _xrefLoadError;
 }
 
 const ROOT = path.join(__dirname, '..');
@@ -2059,10 +2073,15 @@ function sarifLocationsForIndicator(playbook, indicator) {
   if (ev && ev.length) {
     const locs = [];
     for (const e of ev) {
+      // SARIF artifactLocation.uri is a URI reference (RFC 3986) — the path
+      // separator must be `/`. Operator/agent-supplied evidence on Windows
+      // arrives with backslashes; normalize them so the emitted SARIF is
+      // valid (the collectors already normalize via buildEvidenceLocations,
+      // but submission-threaded locations bypass that path).
       if (typeof e === "string" && e.trim()) {
-        locs.push({ physicalLocation: { artifactLocation: { uri: e.trim() } } });
+        locs.push({ physicalLocation: { artifactLocation: { uri: e.trim().replace(/\\/g, "/") } } });
       } else if (e && typeof e === "object" && typeof e.uri === "string" && e.uri.trim()) {
-        const pl = { artifactLocation: { uri: e.uri.trim() } };
+        const pl = { artifactLocation: { uri: e.uri.trim().replace(/\\/g, "/") } };
         if (Number.isInteger(e.startLine) && e.startLine > 0) {
           pl.region = { startLine: e.startLine, ...(Number.isInteger(e.endLine) && e.endLine >= e.startLine ? { endLine: e.endLine } : {}) };
         }
@@ -2381,6 +2400,14 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
         }
       }] : [];
       const base = {
+        // CSAF Profile 4 (security_advisory) mandatory test 6.1.27.5 requires
+        // every /vulnerabilities[] item to carry `notes`. Without this the
+        // CVE-keyed entries failed strict validation (the indicator pseudo-CVE
+        // entries already carried notes; real-CVE entries did not).
+        notes: [{
+          category: 'description',
+          text: `${c.cve_id}: RWEP ${c.rwep}${c.active_exploitation ? `, active_exploitation=${c.active_exploitation}` : ''}${c.cisa_kev ? ', CISA KEV' : ''}.`,
+        }],
         scores,
         threats: c.active_exploitation === 'confirmed' ? [{ category: 'exploit_status', details: `Active exploitation confirmed${c.cisa_kev ? ' (CISA KEV)' : ''}.` }] : [],
         remediations,
@@ -2526,6 +2553,13 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
         publisher: publisherBlock,
         title: `exceptd finding: ${playbook.domain.name} (${analyze.matched_cves.length} CVE(s), ${indicatorHits.length} indicator hit(s), ${(analyze.framework_gap_mapping || []).length} framework gap(s))`,
         notes: [...namespaceFallbackNote, ...gapNotes],
+        // Profile 3 (csaf_informational_advisory) mandatory test 6.1.27.2
+        // requires /document/references with at least one `external` item. A
+        // security_advisory carries its references inside the vulnerabilities,
+        // so add this only for the informational (clean-run) profile.
+        ...(csafCategory === 'csaf_informational_advisory' ? {
+          references: [{ category: 'external', summary: `exceptd playbook: ${playbook._meta.id}`, url: `https://exceptd.com/playbooks/${playbook._meta.id}` }],
+        } : {}),
         ...(csafDistribution ? { distribution: csafDistribution } : {}),
         tracking: {
           // F2/F9: CSAF tracking.id binds to the run's session_id (threaded
@@ -2545,35 +2579,42 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
           },
           initial_release_date: now,
           current_release_date: now,
-          revision_history: [{ number: '1', date: now, summary: 'Initial finding emission' }]
+          // CSAF 6.1.30 requires homogeneous versioning (all version_t use the
+          // same scheme) and 6.1.16 requires tracking.version === the last
+          // revision_history number. tracking.version is the playbook semver,
+          // so the single revision entry must carry that same semver (not the
+          // integer "1", which mixed schemes AND mismatched the version).
+          revision_history: [{ number: playbook._meta.version, date: now, summary: 'Initial finding emission' }]
         }
       },
-      product_tree: (function () {
-        // Synthesize a 3-level branches tree (vendor → product → version)
-        // from catalog data. CSAF §3.1.5.1 makes branches[] strongly
-        // recommended for csaf_security_advisory documents because NVD /
-        // ENISA / Red Hat dashboards render the affected-product list off
-        // the branches tree, not full_product_names[]. The pre-fix tree
-        // emitted only the synthetic exceptd-target product and operators
-        // browsing the rendered advisory saw no real-world vendor surface.
-        const { branches } = buildCsafBranches(analyze.matched_cves || [], runOpts);
-        const tree = { full_product_names: fullProductNames };
-        if (branches.length > 0) tree.branches = branches;
-        return tree;
-      })(),
-      vulnerabilities: (function () {
-        // v0.12.27: deterministic mode sorts vulnerabilities[] by their
-        // primary identifier (cve_id for CVE entries, ids[0].text otherwise)
-        // ascending. Default mode preserves insertion order so existing
-        // operators see byte-identical output to pre-v0.12.27.
-        const all = [...cveVulns, ...indicatorVulns];
-        if (runOpts && runOpts.bundleDeterministic === true) {
-          const keyOf = (v) => (typeof v.cve === 'string' && v.cve)
-            || (Array.isArray(v.ids) && v.ids[0] && typeof v.ids[0].text === 'string' ? v.ids[0].text : '');
-          return all.slice().sort((a, b) => keyOf(a).localeCompare(keyOf(b)));
-        }
-        return all;
-      })(),
+      // CSAF Profile 3 (informational_advisory) forbids /vulnerabilities
+      // (mandatory test 6.1.27.3) and an informational advisory carrying a
+      // /product_tree is misleading (§4.3 — a reader must assume every named
+      // product is affected). Emit both ONLY for the security_advisory profile;
+      // a clean run's informational advisory carries neither.
+      ...(csafCategory === 'csaf_security_advisory' ? {
+        product_tree: (function () {
+          // Synthesize a 3-level branches tree (vendor → product → version)
+          // from catalog data. CSAF §3.1.5.1 makes branches[] strongly
+          // recommended because NVD / ENISA / Red Hat dashboards render the
+          // affected-product list off the branches tree, not full_product_names[].
+          const { branches } = buildCsafBranches(analyze.matched_cves || [], runOpts);
+          const tree = { full_product_names: fullProductNames };
+          if (branches.length > 0) tree.branches = branches;
+          return tree;
+        })(),
+        vulnerabilities: (function () {
+          // v0.12.27: deterministic mode sorts vulnerabilities[] by their
+          // primary identifier ascending; default mode preserves insertion order.
+          const all = [...cveVulns, ...indicatorVulns];
+          if (runOpts && runOpts.bundleDeterministic === true) {
+            const keyOf = (v) => (typeof v.cve === 'string' && v.cve)
+              || (Array.isArray(v.ids) && v.ids[0] && typeof v.ids[0].text === 'string' ? v.ids[0].text : '');
+            return all.slice().sort((a, b) => keyOf(a).localeCompare(keyOf(b)));
+          }
+          return all;
+        })(),
+      } : {}),
       exceptd_extension: {
         classification: analyze._detect_classification,
         rwep: analyze.rwep,
@@ -2652,9 +2693,12 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
     const gapResults = (analyze.framework_gap_mapping || []).map((g, idx) => ({
       ruleId: `${rulePrefix}framework-gap-${idx}`,
       // Framework gaps are control-design observations, not vulnerabilities —
-      // SARIF §3.27.9 `kind: informational` routes them appropriately.
+      // SARIF §3.27.9 `kind: informational` routes them appropriately. That
+      // same clause requires: when kind !== 'fail', a present `level` SHALL be
+      // 'none'. Pairing 'informational' with 'note' is a schema violation that
+      // strict validators / GitHub code-scanning reject — use 'none'.
       kind: 'informational',
-      level: 'note',
+      level: 'none',
       message: { text: `${g.framework}: ${g.claimed_control} — ${g.actual_gap}${g.required_control ? '. Required: ' + g.required_control : ''}` },
       properties: stripNulls({ kind: 'framework_gap', framework: g.framework, control: g.claimed_control }),
     }));
@@ -3092,13 +3136,16 @@ function autoDetectPreconditions(submission, playbook) {
 }
 
 function run(playbookId, directiveId, agentSubmission = {}, runOpts = {}) {
-  // Catalog corruption surfaced at module-load blocks runs cleanly.
-  if (_xrefLoadError) {
+  // Catalog corruption blocks runs cleanly. Probed lazily here (before the
+  // analyze path) rather than at module load, so cheap verbs don't pay the
+  // catalog-parse cost.
+  const xrefErr = getXrefLoadError();
+  if (xrefErr) {
     return {
       ok: false,
       blocked_by: 'catalog_corrupt',
-      error: _xrefLoadError,
-      reason: 'cve-catalog.json or an index could not be parsed at module load. Run `npm run build-indexes` to regenerate, or restore the file from git.'
+      error: xrefErr,
+      reason: 'cve-catalog.json or an index could not be parsed. Run `npm run build-indexes` to regenerate, or restore the file from git.'
     };
   }
 

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.14.14",
+  "version": "0.14.16",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "lXhZgoIrrVloO3XaTvo/43AxZn4mwErstd7DR0O/oVhD3AOGODM4HqrageYEou9WKOdMEGP5mJNTjJsXdP5NDA==",
-      "signed_at": "2026-05-27T22:43:04.125Z",
+      "signed_at": "2026-05-28T00:39:05.548Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "ztSKk/zFMFbT12qRcEeBKpydBn7fTT86KxMmor0DTCoKQWk5fJ0fSInfP1XMSB6rFk4/SuSjKVxQRMKVJ5a+Cg==",
-      "signed_at": "2026-05-27T22:43:04.127Z",
+      "signed_at": "2026-05-28T00:39:05.549Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "K6QdPHNK5c4K5QFjrW0QsUhjp71D7SOisSoulwPNSvKRdi2rY+yg0kdckijBMkLMsVPyUvcC9giu93mKJ1OZDg==",
-      "signed_at": "2026-05-27T22:43:04.127Z",
+      "signed_at": "2026-05-28T00:39:05.550Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "Qd3SBWmUAaaT++e1Ry2wBIz/dCBmNBMl0+4Rb0etvJLES0fIBEAkU1mTbgNZnT5XOg9J5twdUpymWtmKnDDQCQ==",
-      "signed_at": "2026-05-27T22:43:04.127Z"
+      "signed_at": "2026-05-28T00:39:05.550Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "F2Shxae0ua0gPtvwzTRVzzHaIgJcFDRT3/akLUAZ4aaMQhkleKkcTaTpkjp+pTVEdPfLeLGNCeAOMs+whVYOBg==",
-      "signed_at": "2026-05-27T22:43:04.128Z"
+      "signed_at": "2026-05-28T00:39:05.551Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "NA1hoQycvQhSUoG5rwlXX0mOVmGxoXRVezkELGEA2nZOdGis4gXkHT3O6Sfw7zxE4JuMrsCb65TEeOWk9WEPDg==",
-      "signed_at": "2026-05-27T22:43:04.128Z"
+      "signed_at": "2026-05-28T00:39:05.551Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "W3pS8lnaCP96TQzsJpG5d5yv5IwgaQyS4Z2Ctcz5BOJf6LbajSIgeDgTZ4f4Bhr5m4E7KsgWGjZS4x7Fwd33BQ==",
-      "signed_at": "2026-05-27T22:43:04.129Z",
+      "signed_at": "2026-05-28T00:39:05.552Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "/WDGygh1Ck4yWlBWDGtEUVCqKB8d+UaJXoAoBXujtt+GAl8JbMNpaN1TvI0WkEltQ9dTxaAzSn20/eVDqv8iDQ==",
-      "signed_at": "2026-05-27T22:43:04.129Z",
+      "signed_at": "2026-05-28T00:39:05.552Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -440,7 +440,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "za1NKBpy9LC91F/ESO/qhUfmvVr8GNItQOjR5OJLeHm+2dQ9HHiFWQK2eo53V/n/0uhubuggURA3yS6kJuWwBg==",
-      "signed_at": "2026-05-27T22:43:04.129Z",
+      "signed_at": "2026-05-28T00:39:05.552Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "xiHAhhdufm9hCKU8PLiPE0MX65ej2F4OZwtlWLGLCiie9/km+Kiqbt192LcMvr94v83C98pb9wIaqFsFWft6AQ==",
-      "signed_at": "2026-05-27T22:43:04.130Z",
+      "signed_at": "2026-05-28T00:39:05.553Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -513,7 +513,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "oYsSk35N2Uzq7MRofACykylcVwkgPhI4luWZ14vmQT+gUKLyZiKVOUJbe1+7lGl6BYPRN0sUDQ0f7S5Eu5w2Ag==",
-      "signed_at": "2026-05-27T22:43:04.130Z"
+      "signed_at": "2026-05-28T00:39:05.553Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -540,7 +540,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "igRqYyU1unRFH40BsPyAR62SPrk8QZv8dPGb8S9O9EvLCNOZAzm3t+HdT/NKqzWHwrpomOzkkkyLfYI/0qTUDA==",
-      "signed_at": "2026-05-27T22:43:04.131Z",
+      "signed_at": "2026-05-28T00:39:05.553Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -604,7 +604,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "i/17u4kJiSpcZAz7LnTyRePFugQOstQ1P4kVoe0oGf4E2/j8oIN9U9DccjUn/YHZhKWIJ2AILG/DMhvMrr3bBg==",
-      "signed_at": "2026-05-27T22:43:04.131Z",
+      "signed_at": "2026-05-28T00:39:05.554Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "QuOVaQ4E2Sl39TClbhZ7HA9XrYAyRrDL44HY3RTE7aWLue0hV2cxaBt40ALGmHS++631QGFDlZTLZI77Tr6nAA==",
-      "signed_at": "2026-05-27T22:43:04.131Z"
+      "signed_at": "2026-05-28T00:39:05.554Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -689,7 +689,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8Px1s2lDj10/Q6erwEQlXgUHM1+OTruUR8qAHPX7Oo3k/l69N6P9sm0PsafS9wDFtj9l5C/OiLiFgzMlMt6vBw==",
-      "signed_at": "2026-05-27T22:43:04.132Z",
+      "signed_at": "2026-05-28T00:39:05.554Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -724,7 +724,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "urRcataVWg6/utyEkSiOWoNxTL8sABRjPR7ShyDfZGnAozFph/yDktSoaPVxQDXwu9EfJE+qhUW5OYR/yJECBQ==",
-      "signed_at": "2026-05-27T22:43:04.132Z"
+      "signed_at": "2026-05-28T00:39:05.555Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -796,7 +796,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "C7lv65/Ecm8JJgSKxrX5lxx0YFzKWtrIQSKp+vy50I5e8945s1JmifGUUrnQwRQhq/Pkv7EmfiH5XSO8h75bDg==",
-      "signed_at": "2026-05-27T22:43:04.132Z"
+      "signed_at": "2026-05-28T00:39:05.555Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -856,7 +856,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "Z7ypCUnXx8JpLtgxxB6RHNi39w74AmrGY1N4ofAGCXhkuM2EaFVm1AU0dvl9UQ1bVLfHKEDGqMO/TwlIY7RABg==",
-      "signed_at": "2026-05-27T22:43:04.133Z"
+      "signed_at": "2026-05-28T00:39:05.556Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -931,7 +931,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "IgEnpHOhCftAyfUNdKsjbrd169T9pJkk/rRM2ZEna+H18y7p5x48+1kME2sJMZjJuyAdQFBJi8PJXZFwLGI+DQ==",
-      "signed_at": "2026-05-27T22:43:04.133Z"
+      "signed_at": "2026-05-28T00:39:05.556Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1010,7 +1010,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "pcLrM98A3vUSZRjwNAk0aZ9umvOwB41XCLLsCOy/IebB2F/06oIrGUKkMHtHwm4pTVPShMMcKdZQQ3jz30FnCg==",
-      "signed_at": "2026-05-27T22:43:04.133Z"
+      "signed_at": "2026-05-28T00:39:05.556Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1067,7 +1067,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "G5q5elh7Q7eu2xcwTVQJGDTGfvZR0OGQaLSLJPb2wjzCHFF8PWuZfCHZdjjqisiRzRWPyLlzgfHeMJqOdy7cBw==",
-      "signed_at": "2026-05-27T22:43:04.133Z"
+      "signed_at": "2026-05-28T00:39:05.557Z"
     },
     {
       "name": "identity-assurance",
@@ -1134,7 +1134,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "Wv5hGMeHjlaQK1zwicVCA7AvdKgJBgvcjdpGM9Ywahh9tagAKhbkOjybowDQZzu7OZ3bDkbh6pBYc1Sdwr6NAA==",
-      "signed_at": "2026-05-27T22:43:04.134Z"
+      "signed_at": "2026-05-28T00:39:05.557Z"
     },
     {
       "name": "ot-ics-security",
@@ -1190,7 +1190,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "8t5qKHd3yWi57dvG36YQkLN/X9bQWqtEiYjay4IfSmqhJpM/xXPaQVKNGz3wscrO8OLKUZ0OaX7Mj5kzpgBKBQ==",
-      "signed_at": "2026-05-27T22:43:04.134Z"
+      "signed_at": "2026-05-28T00:39:05.557Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1242,7 +1242,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "GDGt4UPqBa04PjlpSmpyihGzd3OgfBN7jaAK5tfwp+LRSs3ygKOdbeivUCCHNagTY1hE6hG2Ou40ADfBFuXeAg==",
-      "signed_at": "2026-05-27T22:43:04.135Z"
+      "signed_at": "2026-05-28T00:39:05.558Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1292,7 +1292,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "rFBpOQEJUPpl+v88Lw/WqVJRhTl80vy0VbPAbzQj3Q0suJRRrJg368I9uKu5LXIBKFDvKxnGIcIzbGg9NUtaCA==",
-      "signed_at": "2026-05-27T22:43:04.135Z"
+      "signed_at": "2026-05-28T00:39:05.558Z"
     },
     {
       "name": "webapp-security",
@@ -1366,7 +1366,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "ux85YI4t2mVHOyt744Yin1HHy+z11JIFygjKfFfQOBBl5QVV3A267jeIy7utix85irMcpZm/T3yx/ooqiK2tBA==",
-      "signed_at": "2026-05-27T22:43:04.135Z",
+      "signed_at": "2026-05-28T00:39:05.558Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1419,7 +1419,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "IIXnkZ5ZNqFwOto5KfytADTLLZLoyXNZACD1ORZ40P1HUAQxe6u2uyXFzzsfuob4Uy06jNkRGr2FFgCphUH1Cw==",
-      "signed_at": "2026-05-27T22:43:04.136Z"
+      "signed_at": "2026-05-28T00:39:05.559Z"
     },
     {
       "name": "sector-healthcare",
@@ -1479,7 +1479,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "AhF9KF8ZBlDteciV+F8IBSmFVYCvQOn44GmD4rZjgLoPxfIv/QE1/vSkK32zyqDKtHWkLSXExbkkPkxA/V6dDw==",
-      "signed_at": "2026-05-27T22:43:04.136Z"
+      "signed_at": "2026-05-28T00:39:05.559Z"
     },
     {
       "name": "sector-financial",
@@ -1560,7 +1560,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "HQgZvb4ReziEz5rNFr8i/O8/rJEZR+iHRROT7m/D2QUqhrcNISPkYXENsUZlG8xapzy/Ik92ehkseyj4hdmhCQ==",
-      "signed_at": "2026-05-27T22:43:04.137Z"
+      "signed_at": "2026-05-28T00:39:05.560Z"
     },
     {
       "name": "sector-federal-government",
@@ -1629,7 +1629,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "linxmsXZiOYtcs71sSWgGCrvb8xQfmxmtTY5PRvZJ0/8FgJulo0tQtejzexYG775s7XhjAmGsDP238BQTQ8ADA==",
-      "signed_at": "2026-05-27T22:43:04.137Z"
+      "signed_at": "2026-05-28T00:39:05.560Z"
     },
     {
       "name": "sector-energy",
@@ -1694,7 +1694,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "JjBfc0ovta560Clk0x3QGRM5osFJDwcvpy3rT7QEGdCIL827jzE8QCow1C8deXq+4JhY2sA/d7/8IsxikdlkCg==",
-      "signed_at": "2026-05-27T22:43:04.137Z"
+      "signed_at": "2026-05-28T00:39:05.561Z"
     },
     {
       "name": "sector-telecom",
@@ -1780,7 +1780,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "JWVxKFoKrbX4d+Tko1d4OBdwyg25MfFFKn4CT6E/CzH+YwnU3T6Y76uBQIKg3+gIGTvPduqyvQwQQ5FxKDuPBw==",
-      "signed_at": "2026-05-27T22:43:04.138Z"
+      "signed_at": "2026-05-28T00:39:05.561Z"
     },
     {
       "name": "api-security",
@@ -1849,7 +1849,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "BmCRCestWqr55+fCynEhtAl5NWLT+xLTkpwS0Icp3SaoZOw/ce3Y6TtqjHRSKn4CBJq7YDiLRWxmhO3MStvOAA==",
-      "signed_at": "2026-05-27T22:43:04.138Z",
+      "signed_at": "2026-05-28T00:39:05.561Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1935,7 +1935,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "/DV3pmZwrRySrk1OCbyI+0BQESacjupJfUX3eC2NGtXuYOBro0vndIP+z27heFxumnjU3a9sfla7/U9X+pqnDw==",
-      "signed_at": "2026-05-27T22:43:04.138Z"
+      "signed_at": "2026-05-28T00:39:05.562Z"
     },
     {
       "name": "container-runtime-security",
@@ -1997,7 +1997,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "E2UGSf9ATyYgzBr8uM/0ubOUmDqo1jVA7f9mVxv6LHfWGCNuQNXDyuNou9VAmUCeeXEeUYIi3AFjXkJqpOkxDA==",
-      "signed_at": "2026-05-27T22:43:04.139Z",
+      "signed_at": "2026-05-28T00:39:05.562Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2071,7 +2071,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IL+DlRCDJN/p08iiJCFkasKcoyjcB0uWrJ6ORLjQcS1HrUa5Xt62QxVjYPHzaevlm5y36ZdmfESqsZJmzK3lCg==",
-      "signed_at": "2026-05-27T22:43:04.139Z"
+      "signed_at": "2026-05-28T00:39:05.562Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2133,7 +2133,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "MmjLjlmOMLjhJJ4ZfR8MYlHam+ZB+eSqfh6Nv+DecaG4O5zeo9DBP/iL3cbyDVZxmhnhivgJild2ccYeWTeZAg==",
-      "signed_at": "2026-05-27T22:43:04.139Z"
+      "signed_at": "2026-05-28T00:39:05.563Z"
     },
     {
       "name": "ransomware-response",
@@ -2213,7 +2213,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "ssueL03g9fWlhXpTe+IiY5l7RqQkunN4DTN5QETKE+VOX+qggdjAR8PONxk77ol4xWYmHrM/VcH8CNtXUEvgBA==",
-      "signed_at": "2026-05-27T22:43:04.140Z"
+      "signed_at": "2026-05-28T00:39:05.563Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2266,7 +2266,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "rK+WnuS+9tqEABmwc0jO/PEmxcLjG1/tmUb897HsClQeKzf+TQOlwBE+OsbtuKxpjYNwur62Xxs3TxObkwm8Cw==",
-      "signed_at": "2026-05-27T22:43:04.140Z"
+      "signed_at": "2026-05-28T00:39:05.563Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2334,7 +2334,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "Rgho5TOFUL1txOzcVR0kASCNdovSU4yt99JlGilJlJRyg0A+BdeeQYrZrhPF6Vx2reUAVG0BeHfcZtSbi+cwCg==",
-      "signed_at": "2026-05-27T22:43:04.141Z"
+      "signed_at": "2026-05-28T00:39:05.564Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2414,7 +2414,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "e/kij7GtKaytROyIj7V5RH+FC9WtmVFzrmG2kIlNDNn29ep/CRNlIQKwXLpzo/81AIf634pmdr1qy/+vwIuUDA==",
-      "signed_at": "2026-05-27T22:43:04.141Z",
+      "signed_at": "2026-05-28T00:39:05.564Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2508,7 +2508,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "ew9Kglc9fAZzbn0ZIfGP7WSK/j4eV2VhSvpy+s5bEfNEVYIMa2kZjnGBapgUsyGDLes9H9K2ovjQyX17+GKiBw==",
-      "signed_at": "2026-05-27T22:43:04.141Z",
+      "signed_at": "2026-05-28T00:39:05.565Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2526,6 +2526,6 @@
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "VaHQUp8N+B8LWN2cE5Ma/r5QUuCeeXd1qQZRVdxMsZuywrBbCgET5iiP8miDXVAVw6I/bKVxUeBQzPDzbgTCBQ=="
+    "signature_base64": "5XgJWZief+wIcS9RkP9YY046RNPg0KgTo1qMKdaohFusNzSR56iLCWhVtjahNauI3aJEhf2lIzbAWYwB4NNJDg=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.14.14",
+  "version": "0.14.16",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:09ce22ed-cf4c-428a-b4ce-4ed39f08cf46",
+  "serialNumber": "urn:uuid:dd65cbaf-accd-4874-9598-b38d493f40ea",
   "version": 1,
   "metadata": {
-    "timestamp": "2031-03-19T23:38:21.000Z",
+    "timestamp": "2143-09-16T03:46:55.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.14.14"
+        "version": "0.14.16"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.14",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.14.16",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.14.14",
+      "version": "0.14.16",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (406 CVEs / 171 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.14",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.14.16",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c662ffd7c9591378303810e656ef236bc95461441b0e100888fe51590f04a81e"
+          "content": "2629cbd949ba4f156d636a66378b5ee16452c0a66c5e80c4108f1e00a339ce94"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.14"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.14.16"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "35200404f3ec807af037296532675b3b89d4edfde5be7906f8f51de79e64b9c1"
+          "content": "ba2a7fc91305512c7999cc4b182f380abab7f8b0c8cb85860b47d50752fc92ff"
         },
         {
           "alg": "SHA3-512",
-          "content": "791909b843163e1295f359e24b1928c2f592f33a99795a1cb0fc73c8282715b78eb4696e30b48a61f63cb5651da945fd11b1707c91a53cea80723fab7553bcec"
+          "content": "223a551cbffa38877a96d4f99154f40760251bdd0743078ff5f9d08b242ea693db45b918a40ef8d2b47ec38343af3821404469e28d1bae0625873f7b6115d161"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "447e6ba93e05120de060cca6636c8419c465034744d93606bbe6c7175be1a844"
+          "content": "2c367e9db7eef475f30986ae46c79751bc5ab240cbad256968d3784afc9371ed"
         },
         {
           "alg": "SHA3-512",
-          "content": "23f28a5eefab97d5ad447033826279f34424a728123a2a2c6e551fea601504f06fd9b2860b718e515a7e31bfa1a9cb349bffb926a91c63682753c0c979826db6"
+          "content": "deed7361c53828191123c2d2261987b823fc69b1b830329ce9c20ea065b5f96fbd955b0640da830dd56a5e7c9ddafcb62a02889e3a05c544a3b0c1cd15c9ecd7"
         }
       ]
     },
@@ -941,11 +941,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a06fe534a30436f45d9dfd6c48c31a0a23e69bb1af485e099780421d74fe5070"
+          "content": "bdb569b022a878bce913771058c93982dfb928eb12a8ecb5ef7b91eff5745f79"
         },
         {
           "alg": "SHA3-512",
-          "content": "7013e0fb0a969d472e88d589b354c08b2455a6b20e104a13d3251fa1d75b2d79bf61eb0d625fcf4a11f6d5d5322ada3a969a8c45341a7f684a8062306f881683"
+          "content": "1a3c169c1e8306034f67c73561d3ffc141bf5320bd15515ea34d2a5edd40f93e78733c6c7be48a3f2c2d69d7af046ba0767a237a4b397812b1e763f457637a7e"
         }
       ]
     },
@@ -956,11 +956,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bbf451e8828b34b6dfad052a80bb41d6d41c823d0896b7b0af88adc1bc3d0363"
+          "content": "93be4afb6c08035210b4c67a223ff8dba68ad031d8cc11c9191bc4dc60f9184f"
         },
         {
           "alg": "SHA3-512",
-          "content": "3cc1ae78ab1fd3995140adf5daad3a276c5c191e37f12183ea4cd1d05faed9b3f52bf7cc028dad36d5bfc347b081ff69f7311b91a70f9f5f235e13297e84846a"
+          "content": "2d1f0b4b959cb78746e47eeffb71af1f323fdb3c521f60d341b4878feffcc458527ea48b9cda545302e0d41427d1c286524d45239195d4d299a912aca4ddf695"
         }
       ]
     },
@@ -986,11 +986,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "745a5d013aa95ae317cf522c14a7121167903a2f2c402f9893d4b11bfce32aa0"
+          "content": "fbf7e5ded16143dea47d9fb1862a8b2367f32429e2c51a7d01e66846d264f211"
         },
         {
           "alg": "SHA3-512",
-          "content": "a74c353e98c4e52c87c7040adfcb940462d848cc3980c72201c9f4d5cd03fb7ad0a6aa6c594985bcc689eed1e68602ee91dbcabc5e9d97a3819f9e409f7e4690"
+          "content": "c588a0e877b19974033ef5c3bc98dcb4723497b0916979fa31dda2faf2b74d99d8fedfda3a911e60ce50bf4b0eaa0b9df794e9b088cfdb04e258c7c8c1ff3727"
         }
       ]
     },
@@ -1106,11 +1106,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ee834a396114c8fb409442dc704be8abe3b39f3174dd5c54367790dd4380d8c6"
+          "content": "a39b8a03b89093ad02faa3d106bb65f6a42e959297add8ee4d72c1f0254aaad9"
         },
         {
           "alg": "SHA3-512",
-          "content": "4634de496b75b163d26f652bd86b3cfd7434179b99f8b07db6029bd0eb7214ca482474c99647ae776ee8edfb1802b78a4e6cf734beef74f8c5a0d038049937ad"
+          "content": "9229f5a214596e323a6c9a6984acf77e281414723558652677334d1d6d95f5f30250d110c6089425deb487dcbd3dcd29b66422dfd76444f79fbcc87bcb68a3dc"
         }
       ]
     },
@@ -1121,11 +1121,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8154e051408a6b58f328865973c6e57666d89b8a507ebee919bb78ed68310885"
+          "content": "3fb88752e34869fec0d16bafcff3cff0f8b6391303b708b2a49269243292bd30"
         },
         {
           "alg": "SHA3-512",
-          "content": "0cd887333d4f82b2a7cb6bd71753b9db64b1776b84a2b490bf0b66e262d52f667e29ae603afb14a291f0bd39905469775a6143b495493cd01518caf59196bef2"
+          "content": "ee158088d12cb2f4dc8de6509dbfb113602b18e191ca31350787795b373bce346985649c10ff2a6d7c61b828bca5a2ffa2555403ac682ebeeb946ef3164382ca"
         }
       ]
     },
@@ -1136,11 +1136,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "430530120fad69dfa7d61925a205657eb403e21c74e1453421004f6a5e7cf165"
+          "content": "30bf5cc91adfcdec053c1680aa4d54dff4d8c74d0f2b93b03cc4f7f5a76a47d8"
         },
         {
           "alg": "SHA3-512",
-          "content": "6b91946a3c383a992170afa1f0c770701cef97c5cc9ddeb9c181e9684516c50741928f0887e4431c4f26b32f47d3cf45e602318d15df4da2d4fe957c77960e45"
+          "content": "7ad94c3de7a88a6d1e1c4671235c3aece4c911e21c7b36e42514920814dd5191110e49eec3bd2f41fd329f5fd67832b101d40cbc031dbd274fb52b8d33446df0"
         }
       ]
     },
@@ -1316,11 +1316,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9c32c19d0d16a52b1d2d9e44f5f74f27b0c68f7869373b63d1b29c9ed43c36a8"
+          "content": "529c572a1e22087e97f3f78c611bac9110519e39fedda70809b16b784b66d830"
         },
         {
           "alg": "SHA3-512",
-          "content": "d711a870f6b4a91b78efd2d883df0c1df8cd82547aedd3affce2c7ab4a16832c67a6c40b9dc478dc55cd932cde1105de42231f560f7580ba881fecd3f488945c"
+          "content": "d2f7fdee66ffd8c0fca45832654568d9fa90abc6ba4d5e6bedf513c472f3941fd6858d5af4962e6e13e7498ed89603d549ea45a2d41449bbb9b073c0e60fcb63"
         }
       ]
     },
@@ -1751,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "008292f92fc956004d340bf314748a28ab03a6f14c88ddf7f5deabdab8b14b4d"
+          "content": "53aaca262d4df7bf007660d881cd042cec47f11bb792f3ab77bed752b875373b"
         },
         {
           "alg": "SHA3-512",
-          "content": "99f7d34bc0516df27402740184eb99a961e3d8db7929187df1bab453f0a9356029753246d8efcf003bda0ccd57caa29a51c04c8e4fe2f20a6e385f743dc6f9cc"
+          "content": "69fa66c1de4f25b5f42850b498c51c476c05795d0ab1dd59b026e16f7bff455411462f0a6b66dc01de4cf079b6f9939a69aca3c4e4dcbc2e49e182e702fb60d5"
         }
       ]
     },