@blamejs/exceptd-skills 0.15.49 → 0.15.50

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.15.50 — 2026-05-30
+
+Hardening: `--operator` validation and the operator-text sanitizer now classify and strip Unicode threat codepoints — Trojan-Source bidirectional overrides (CVE-2021-42574), zero-width/invisible marks, C0 controls, and null — through a shared vendored codepoint-threat table, and the `--operator` rejection now names the specific codepoint family (for example "bidirectional-override codepoint") instead of a generic message. Unicode General Category C remains the reject/strip backstop, so the broader control / private-use / unassigned set is still refused.
+
+Internal: a new codebase-pattern gate class, `bidi-codepoint-literal`, blocks raw bidi-override / zero-width / null codepoints embedded literally in source (invisible-in-review code reordering — the Trojan-Source class); source must escape them or route through the shared table.
+
 ## 0.15.49 — 2026-05-30
 
 Internal: a new predeploy gate, `scripts/check-codebase-patterns.js`, enforces code-shape bug classes that recurred across releases. It blocks a library-callable function that writes to stdout and then calls `process.exit()` (which truncates buffered output when the stream is piped — the class the v0.15.47 validate-cves fix addressed) and a stale or reason-less `// allow:` suppression marker, and warns on dynamic `RegExp` construction. The flagged `process.exit` sites across the catalog, playbook, package, and vendor validators were converted to the flush-safe `safeExit` form, and the dynamic-`RegExp` sites carry inline justification markers. A companion advisory, wired into the release `prepare` step, flags when the upstream pattern catalog grows a class exceptd hasn't triaged. No change to the shipped CLI surface, catalogs, or skills.

package/bin/exceptd.js

@@ -63,6 +63,7 @@ const PKG_ROOT = path.resolve(__dirname, "..");
 const { EXIT_CODES, listExitCodes } = require(path.join(PKG_ROOT, "lib", "exit-codes.js"));
 const { validateIdComponent } = require(path.join(PKG_ROOT, "lib", "id-validation.js"));
 const { suggestFlag, flagsFor, VERB_FLAG_ALLOWLIST } = require(path.join(PKG_ROOT, "lib", "flag-suggest.js"));
+const codepointClass = require(path.join(PKG_ROOT, "vendor", "blamejs", "codepoint-class.js"));
 
 // Union of every flag known to ANY verb. A flag that is valid somewhere but
 // not on the active verb (e.g. `--csaf-status` on `brief`) is cross-verb
@@ -1524,6 +1525,7 @@ function dispatchPlaybook(cmd, argv) {
     // Cc / Cf / Co / Cn — bidi overrides (U+202E "RTL OVERRIDE"),
     // zero-width joiners (U+200B-D), invisible format chars, private-use
     // codepoints, unassigned codepoints. An operator string like
+    // allow:bidi-codepoint-literal — illustrative bidi-forgery example in the --operator reject-path doc comment
     // "alice‮evilbob" renders as "alicebobevila" in any UI that respects
     // bidi — a forgery surface where the attested name looks like Bob but the
     // bytes are Alice. Reject anything outside a positive allowlist of
@@ -1552,18 +1554,27 @@ function dispatchPlaybook(cmd, argv) {
       );
     }
     if (/\p{C}/u.test(normalized)) {
-      // Find the offending codepoint to surface a useful hint without
-      // round-tripping the raw bytes into the error body.
+      // \p{C} (Cc/Cf/Cs/Co/Cn) is the reject gate — it is strictly broader
+      // than the named family regexes (bidi / C0-control / zero-width / null),
+      // so it stays the backstop and catches the divergent remainder the
+      // family tables miss (U+007F, U+0080-009F, private-use, unassigned).
+      // The vendored codepoint tables only CLASSIFY the first offending
+      // codepoint into a human family name for the hint.
       let offending = "";
+      let family = "control / format / private-use / unassigned codepoint";
       for (const cp of normalized) {
         if (/\p{C}/u.test(cp)) {
           offending = "U+" + cp.codePointAt(0).toString(16).toUpperCase().padStart(4, "0");
+          if (codepointClass.BIDI_RE.test(cp)) family = "bidirectional-override codepoint";
+          else if (codepointClass.ZERO_WIDTH_RE.test(cp)) family = "zero-width / invisible codepoint";
+          else if (cp === codepointClass.NULL_BYTE) family = "null byte";
+          else if (codepointClass.C0_CTRL_RE.test(cp)) family = "C0 control character";
           break;
         }
       }
       return emitError(
-        `${cmd}: --operator contains a Unicode control / format / private-use / unassigned codepoint (${offending}). Bidi overrides (U+202E), zero-width joiners (U+200B–D), and format marks corrupt attestation rendering and enable name-forgery. Use printable identifiers only.`,
-        { verb: cmd, provided_length: args.operator.length, offending_codepoint: offending },
+        `${cmd}: --operator contains a Unicode ${family} (${offending}). Bidi overrides, zero-width joiners, and format marks corrupt attestation rendering and enable name-forgery. Use printable identifiers only.`,
+        { verb: cmd, provided_length: args.operator.length, offending_codepoint: offending, offending_family: family },
         pretty
       );
     }

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-30T20:22:06.536Z",
+  "generated_at": "2026-05-30T22:44:21.522Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "b2d79207d42e38d82a76c13b827623baa3e951b16cfbcc05250572070eb76aed",
+    "manifest.json": "33da1072778152239ab47e8b4ef930f702678299bfa641e297a233dc9022dbfa",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
     "data/attack-techniques.json": "84fad74c8497cab922ed64b814752f54aa4620c2a938cb06642ff1510e1c5cb3",
     "data/cve-catalog.json": "7a5f4e31401505e53330cdc4b54b39f8a8b04459d6b9411676d291c583ae535f",

package/lib/collectors/scan-excludes.js

@@ -189,7 +189,7 @@ function buildEvidenceLocations(hits) {
     const uri = raw.replace(/\\/g, "/");
     const line = Number(h.line);
     const hasLine = Number.isInteger(line) && line > 0;
-    const key = hasLine ? `${uri}${line}` : uri;
+    const key = hasLine ? `${uri}\u0000${line}` : uri;
     if (seen.has(key)) continue;
     seen.add(key);
     out.push(hasLine ? { uri, startLine: line } : { uri });

package/lib/playbook-runner.js

@@ -48,6 +48,7 @@ const path = require('path');
 const os = require('os');
 const crypto = require('crypto');
 const scoring = require('./scoring');
+const codepointClass = require('../vendor/blamejs/codepoint-class.js');
 
 // cross-ref-api wraps catalog reads. If cve-catalog.json is corrupt
 // JSON, cross-ref-api's loadCatalog (post-v0.12.14) catches the parse
@@ -2184,9 +2185,20 @@ function sanitizeOperatorText(s) {
   let normalised;
   try { normalised = s.normalize('NFC'); }
   catch { return null; }
-  // Strip every Unicode codepoint matching General Category C
-  // (Cc, Cf, Cs, Co, Cn). \p{C} under the `u` flag matches all five.
-  const stripped = normalised.replace(/\p{C}/gu, '');
+  // Two-pass strip. First remove the named threat families (bidi-override /
+  // C0-control / zero-width / null) via the shared vendored codepoint tables,
+  // so the family vocabulary has a single source of truth. Then strip any
+  // remaining General Category C codepoint: \p{C} (Cc/Cf/Cs/Co/Cn) is the
+  // backstop — it is strictly broader than the family union (also catches
+  // U+007F, U+0080-009F, private-use, unassigned), so the family pass is a
+  // documented-intent superset removal and the result is identical to the
+  // single \p{C} strip.
+  const familyStripped = normalised
+    .replace(codepointClass.BIDI_RE_G, '')
+    .replace(codepointClass.C0_CTRL_RE_G, '')
+    .replace(codepointClass.ZW_RE_G, '')
+    .replace(codepointClass.NULL_RE_G, '');
+  const stripped = familyStripped.replace(/\p{C}/gu, '');
   const trimmed = stripped.trim();
   if (trimmed.length === 0) return null;
   // Cap at 256 codepoints (Array.from counts codepoints, not UTF-16 code

package/lib/verify.js

@@ -648,6 +648,7 @@ function checkExpectedFingerprint(liveFp, pinPath) {
   // Route through the shared loader so a BOM-prefixed pin file
   // (Notepad with files.encoding=utf8bom) is tolerated identically across
   // every verify site. Pre-fix the verbatim split-trim-find produced a
+  // allow:bidi-codepoint-literal — illustrative BOM-prefixed first-line in the pin-loader doc comment
   // first-line of "SHA256:..." (with leading BOM) that would never equal
   // a live fingerprint.
   const firstLine = loadExpectedFingerprintFirstLine(p) || '';

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.15.49",
+  "version": "0.15.50",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-05-30T20:11:31.183Z",
+      "signed_at": "2026-05-30T22:22:04.669Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "PHwHEsoy7ctBYOtlAfAdCDVfsq2Bpk9+qESSF+5dVkDcez2zp2v9Ihsv2vqMEs3QxMndyQ+t7NVezyt5VamSCg==",
-      "signed_at": "2026-05-30T20:11:31.184Z",
+      "signed_at": "2026-05-30T22:22:04.671Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "dD4p7lcRtMyfITOncqLkpOeMy6x6gM0V7UlWHgLEdcxqODb1s75ar1cBtTqDWPbMv6ZAzVo2HJLDK1hVjjU2AQ==",
-      "signed_at": "2026-05-30T20:11:31.185Z",
+      "signed_at": "2026-05-30T22:22:04.671Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "wsw8Mlr/gyw6S7Iaao9BVHdU5LFPWl8WVymW17Lkq9J1Mui0+fCrTg6UbrsaeE3s7EW3TVgzBuK+8EFd1+H5AA==",
-      "signed_at": "2026-05-30T20:11:31.185Z"
+      "signed_at": "2026-05-30T22:22:04.672Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "uVTc1QRKOKcIVDajBz+q2egjiEAyOQaDNsvVI2ghj5FD0VvquoUBBE5Naca2FkaZa790EHWCsVZ4hhdaSQs2DQ==",
-      "signed_at": "2026-05-30T20:11:31.186Z"
+      "signed_at": "2026-05-30T22:22:04.672Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "QuNpwnZ6HkCEAXTPC/jLbXSmMIc1JnBczqZAAIZmZj8OcEMVnw9mJYAnU3CxaEI7rvbcMkN2uS5E8yUCm/NiAg==",
-      "signed_at": "2026-05-30T20:11:31.186Z"
+      "signed_at": "2026-05-30T22:22:04.673Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "5rw2i39SxY2WphBbDLEP28wufnbPPE9+PWt54hmaGdwHXr9RLiVt5liL/5xp14sehlVgFsfpR/bg9vy//xV0DA==",
-      "signed_at": "2026-05-30T20:11:31.186Z",
+      "signed_at": "2026-05-30T22:22:04.673Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "Vqu49nzntFWjn9A/QeJzm7q/2xk/cZJ6HFQKtiNi1zgcxzXKm+MlFdkaLgYHWj5/9HJohxyIDyBJQTvcJ20eDQ==",
-      "signed_at": "2026-05-30T20:11:31.187Z",
+      "signed_at": "2026-05-30T22:22:04.673Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -440,7 +440,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "W87VdyVdAxAdcRI6P/8StaV+MS8ZSPKM9HOCK9n/bBO6BM3ZSE3uImVoyJVpAXQlUpUGN+A3lCJZXv64LuxwDg==",
-      "signed_at": "2026-05-30T20:11:31.187Z",
+      "signed_at": "2026-05-30T22:22:04.674Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "wdVX+edeNekpaIldqkhvtraV6DquLvIsKAjuZVwPQYn3l1vS99HXuFxmNsD7UeMlO3qgC6Dysfsto9EnuH0RBg==",
-      "signed_at": "2026-05-30T20:11:31.187Z",
+      "signed_at": "2026-05-30T22:22:04.674Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -513,7 +513,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-05-30T20:11:31.188Z"
+      "signed_at": "2026-05-30T22:22:04.674Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -540,7 +540,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "xbkip0AQtWQKAu+O6r/gYECNjezS6O9k9xkkJsYbMlr+j8CdqH3p5/0l+GZmDidImRC/DL07GCnKrk9HRR/yDQ==",
-      "signed_at": "2026-05-30T20:11:31.188Z",
+      "signed_at": "2026-05-30T22:22:04.675Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -604,7 +604,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "li2NnC1oeVIr22ComP5QbcQoh5xpWITuaKpza1s2SsUkH6kGnnt4wFfFAzaC1ORmH9x2cr8hN8kaNANG/eIMBQ==",
-      "signed_at": "2026-05-30T20:11:31.189Z",
+      "signed_at": "2026-05-30T22:22:04.675Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "sZHlJ7ueHPdtzVbR+yXQ5+wKgNyjWsa1LKVg9aWTmg/Onl71DvEILMyJiLpPQjseT56Mnr1DMYJE8xOGlffBAw==",
-      "signed_at": "2026-05-30T20:11:31.189Z"
+      "signed_at": "2026-05-30T22:22:04.675Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -689,7 +689,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "3AwFnEJu6DukPPNep/3SnuPWEuV060fJEQIwThFm7ujmdbFk0/Ii0XwGv1dkvbbK7ymMdOQpp35l4aLONAucDA==",
-      "signed_at": "2026-05-30T20:11:31.189Z",
+      "signed_at": "2026-05-30T22:22:04.676Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -724,7 +724,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-05-30T20:11:31.190Z"
+      "signed_at": "2026-05-30T22:22:04.676Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -796,7 +796,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "DDMzI+4En4aIkwBUCGW6nj1eEkCyLqHGn2LJ2rnwWfYatjPI1U5HrTZNAN/n9JqWtAzk8F3rmsKehaaz5iNWDA==",
-      "signed_at": "2026-05-30T20:11:31.190Z"
+      "signed_at": "2026-05-30T22:22:04.676Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -856,7 +856,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "dJB0iAstIUbyny+udl3OIkaLScEmqS97LNP73yQ8mxt+0bcqxZjpfXaWLzLuIQblGYvUvz75/H6rO2EJuGd4AQ==",
-      "signed_at": "2026-05-30T20:11:31.190Z"
+      "signed_at": "2026-05-30T22:22:04.677Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -931,7 +931,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "KEAoMji3VcPX/ZXXqVe6OStxSkTssfY9fIRPyPcDYqh50GzOFQ6koNOTBVAiWOvjDjQ38g12xun5srbqgmvRAw==",
-      "signed_at": "2026-05-30T20:11:31.191Z"
+      "signed_at": "2026-05-30T22:22:04.677Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1010,7 +1010,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "UY3tBi0n1K/OtSrWPkHcOCSuHEwKuPmRqGIf3MyPVXGWS72elGTWGXt4AN/uStLmefeEody1LuhnJR9PWjr4Cg==",
-      "signed_at": "2026-05-30T20:11:31.191Z"
+      "signed_at": "2026-05-30T22:22:04.677Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1067,7 +1067,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "Qe0Hg9BrX3Zm5pj0n2z/oiHbAXWdA2Dq461zc4izkkUjEX2CZ02rODjCI2ELbrVOU3GC7edxqAxA+5U/ObnHDQ==",
-      "signed_at": "2026-05-30T20:11:31.191Z"
+      "signed_at": "2026-05-30T22:22:04.678Z"
     },
     {
       "name": "identity-assurance",
@@ -1134,7 +1134,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-05-30T20:11:31.192Z"
+      "signed_at": "2026-05-30T22:22:04.678Z"
     },
     {
       "name": "ot-ics-security",
@@ -1190,7 +1190,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "kIVzsPsJ72PzzWQwTuvjoHHoVEDCday5I52M9ohjB3/Ak+zlA8oyWLO/BKb/XuYY4fOApjfxTErSWv5uHQ2zDw==",
-      "signed_at": "2026-05-30T20:11:31.192Z"
+      "signed_at": "2026-05-30T22:22:04.678Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1242,7 +1242,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "bWr27Q1uN9xCe1ib4QulszBa7YIDNkGqo72k5nm2cK98LyPblicD+sO9MnGckAyB22BTN/cIB+FwFMcI5IxvBw==",
-      "signed_at": "2026-05-30T20:11:31.192Z"
+      "signed_at": "2026-05-30T22:22:04.679Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1292,7 +1292,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "Q854yzLqXdOazc6EyQbZzgAlivuq2vGFDVUCrxSldSvx/HX/ZM/uzmJyP7aBG7ZsMHxj6Lmj/H82YQoo1e+NCQ==",
-      "signed_at": "2026-05-30T20:11:31.193Z"
+      "signed_at": "2026-05-30T22:22:04.679Z"
     },
     {
       "name": "webapp-security",
@@ -1366,7 +1366,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "4ccahkJpGJZtwD7EBpnGcN0sEGPMEw8eqV+tvePVS04YAkLgYVWtlkasI/8n0be9xB+77x+Sjj3kIi2j2Lf9CA==",
-      "signed_at": "2026-05-30T20:11:31.193Z",
+      "signed_at": "2026-05-30T22:22:04.679Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1419,7 +1419,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-05-30T20:11:31.193Z"
+      "signed_at": "2026-05-30T22:22:04.680Z"
     },
     {
       "name": "sector-healthcare",
@@ -1479,7 +1479,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "U04GNLyRas1VmfEsB8khH4iqFZPwx96sPY0Kw9iVsSPU+KTeEFqwgtWK1X1pzgb+T16Pc7HSrCaXDOpTFvQEDw==",
-      "signed_at": "2026-05-30T20:11:31.194Z"
+      "signed_at": "2026-05-30T22:22:04.680Z"
     },
     {
       "name": "sector-financial",
@@ -1560,7 +1560,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "xbylLqNPBuEsFE/MNVeGy/01K6yiJXMxQbzC1F4RWU5aseDGbNy5HrAv2JWI2+Aft05ozreNPjccvu66yJ5EBw==",
-      "signed_at": "2026-05-30T20:11:31.194Z"
+      "signed_at": "2026-05-30T22:22:04.681Z"
     },
     {
       "name": "sector-federal-government",
@@ -1629,7 +1629,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "C9c3JuBhUbwcb7uZpDdy+PNT8sYmYIxzD4uRHu421ePW1aSFJ8fkMvuTzSO8vD/F/jOOg5opM4kov/xSAn+qCg==",
-      "signed_at": "2026-05-30T20:11:31.195Z"
+      "signed_at": "2026-05-30T22:22:04.681Z"
     },
     {
       "name": "sector-energy",
@@ -1694,7 +1694,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "oz8Q5WVaY8au4IjbaZahx/DSaC00Q44ylSL3mDkTerCEpW/EyPUeiLeGxSrWxBCwVFEKSSJvnhJjhvX5lDPcCg==",
-      "signed_at": "2026-05-30T20:11:31.195Z"
+      "signed_at": "2026-05-30T22:22:04.681Z"
     },
     {
       "name": "sector-telecom",
@@ -1780,7 +1780,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-05-30T20:11:31.195Z"
+      "signed_at": "2026-05-30T22:22:04.682Z"
     },
     {
       "name": "api-security",
@@ -1849,7 +1849,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "1UTjZNC5Lyrgw93LAizdXVeSmv3jS8YQNT1db5OKsldub50+o1FXmAH4+3MxZozaOGDCX3yXbdDJSJaaSmfuAA==",
-      "signed_at": "2026-05-30T20:11:31.196Z",
+      "signed_at": "2026-05-30T22:22:04.682Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1935,7 +1935,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "EdsY4xe7YA8X8m+KZUbq49JwoCXgRKEz2eg3m86O37rvBmpm8ppvl9hrsekygvpBh2VmCHL2dEYiOD8OM2n7CA==",
-      "signed_at": "2026-05-30T20:11:31.196Z"
+      "signed_at": "2026-05-30T22:22:04.683Z"
     },
     {
       "name": "container-runtime-security",
@@ -1997,7 +1997,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "fnLKPLkjjRCJ/F9wdmZ1w1lXmqEJvTYkv6Uu+9OTd5vZTWKz3QMuxKOsas+ctCdOvTaeloqPUUprXx+ZZdDpCg==",
-      "signed_at": "2026-05-30T20:11:31.196Z",
+      "signed_at": "2026-05-30T22:22:04.683Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2071,7 +2071,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "t3dkdpTX04zvjitEeOJThpgjurLd1UO9GOut4LXSZgY3ULhfknI4zT7G5+m2RSZZTo7yyeZrwpg+7vEg9K6mAw==",
-      "signed_at": "2026-05-30T20:11:31.197Z"
+      "signed_at": "2026-05-30T22:22:04.683Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2133,7 +2133,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "+1kmtA6rAvIyDjjy+cJHK6BcfylyVsa5cUjRFijlFR9GsQfB93JnmkEJOqML50pdlcxtJI3yUodHpL3/YJGtCA==",
-      "signed_at": "2026-05-30T20:11:31.197Z"
+      "signed_at": "2026-05-30T22:22:04.684Z"
     },
     {
       "name": "ransomware-response",
@@ -2213,7 +2213,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "h48ASCz63aBfHzLKxMVDADMuT4atriK0iE6bJeVzZTsx/e8+hyv4fLP7+zYxT9Oe0Gss3v/Xy+t+Wd9uwzV+Aw==",
-      "signed_at": "2026-05-30T20:11:31.197Z"
+      "signed_at": "2026-05-30T22:22:04.684Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2266,7 +2266,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-05-30T20:11:31.198Z"
+      "signed_at": "2026-05-30T22:22:04.684Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2334,7 +2334,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "ZHVdGWCcfG98tSVB0b9mwrsYwv71V3uUEl+6ss7omSQhmNvqV5s6MAZM5YladBt9MK/8T/zBrTYN4gAonOP+BQ==",
-      "signed_at": "2026-05-30T20:11:31.198Z"
+      "signed_at": "2026-05-30T22:22:04.685Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2414,7 +2414,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-05-30T20:11:31.199Z",
+      "signed_at": "2026-05-30T22:22:04.685Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2508,7 +2508,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-05-30T20:11:31.199Z",
+      "signed_at": "2026-05-30T22:22:04.685Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2526,6 +2526,6 @@
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "EPKofzgR/5phyML2avuGX2UJxQdedvY18EFClXlOQKx+u+jWbDbphKZOmarLVQG1ugxACK4fr+9wfu/pzCxMCQ=="
+    "signature_base64": "xgINyQHj7n0aBdrPHpafpahet+NxaqnesUO4gQwIl13hMaS7Zw85ixlZ/dl/Znrz7vW++uTLIU0m6ZqEzMYfAg=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.15.49",
+  "version": "0.15.50",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (427 CVEs / 173 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:13afd3b0-bf06-4674-9bdc-0e8f5b1bc649",
+  "serialNumber": "urn:uuid:ede2338f-0db3-4a5c-859d-567abe4a25ef",
   "version": 1,
   "metadata": {
-    "timestamp": "2036-06-19T19:14:56.000Z",
+    "timestamp": "2152-06-21T09:55:27.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.15.49"
+        "version": "0.15.50"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.15.49",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.15.50",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.15.49",
+      "version": "0.15.50",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (427 CVEs / 173 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.15.49",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.15.50",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8014d759783bbbd62f82a8b8bf67219a267c620648529f2a7b68c699c23ca9c0"
+          "content": "332e8187d86819842a9abb646bcd8645e87c14dcaf6596cc28ca6dbb18af82c5"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.15.49"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.15.50"
         },
         {
           "type": "vcs",
@@ -70,7 +70,7 @@
       },
       {
         "name": "exceptd:vendor:count",
-        "value": "2"
+        "value": "3"
       },
       {
         "name": "exceptd:vendor:pin",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1d89e0faa87efd172ed0f37f4a78b9b1787cf3f673a4f9e344fa5a3183bffcd3"
+          "content": "127bec3e5780f53bf98eaa33157c004423edda4c0c9931018bc8d67bd690d2d7"
         },
         {
           "alg": "SHA3-512",
-          "content": "494715845aa5068286eadb8ee1edcb54f2bb8c58a76f825ad5bb1d8496a5a1de4c544256ae88e42fd7ee343c4d7c62f8b72823d841ff79ad2267fd85534d10bb"
+          "content": "aebfca6cb624dfddaee726ba8760cd3318347278a107629bd10c3266d2bb2ef132bf916b3a8d38f83f5a712b647bd770adc98d0635d9348a6f0cf940baeea75b"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ab60be520c0c63ac839fd1b2a9e09e76955542f9321c269b472dbeab67811d70"
+          "content": "cf9b74140298bdee14d4826d11ed9f7d6b1266db8a782d8dce48425e76ec9af5"
         },
         {
           "alg": "SHA3-512",
-          "content": "982f692aa088e16845b34f767a1734351ee9c86205b40473563538932806a88f36208aca306b3d46ce2864cc41b10dc0dc1ebc5dfd3c611256bc707b395dc8a6"
+          "content": "0528bbd4277fe3b8f4cb99eeaf35d5e9f310cfd48a0164fa4e4edb03154f1c7302af7d44617d7b6f1d6ab52e301a7772042e4c609693c49b8ce6eb64991419b9"
         }
       ]
     },
@@ -1106,11 +1106,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a39b8a03b89093ad02faa3d106bb65f6a42e959297add8ee4d72c1f0254aaad9"
+          "content": "17c8544a8043fd8a24aa22c1b5c061806983bc896a51b120f1976dea1c770a3d"
         },
         {
           "alg": "SHA3-512",
-          "content": "9229f5a214596e323a6c9a6984acf77e281414723558652677334d1d6d95f5f30250d110c6089425deb487dcbd3dcd29b66422dfd76444f79fbcc87bcb68a3dc"
+          "content": "fdca23d1585d169fa2dad9be3f840de556b2673fefc6406c4ad0fb6cdf4e85a98103afc125f725c2fb3146fead224e444f963c17e031d6c64581a8552da96eca"
         }
       ]
     },
@@ -1316,11 +1316,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "90b3c15de2da89e06ba82cad044bebcfcc7827ac612240e7a9f66a57d4bed696"
+          "content": "f9452a58e4916a512b61ac8c6179dff6162f3634cf766b129d521233daec3c0e"
         },
         {
           "alg": "SHA3-512",
-          "content": "e8a3b82152c6e213a074037193a4030bb0e1a16e07c301e30ebdfc3c939866a3d1db2fa0a2c23dbe6c9af44100ba3f01a1d7e2714f68fda942fa1865a19c84bf"
+          "content": "d6ebf5ffca3fee2398034f411eb477d393e8ee8a7f12ed576e72f0e785c42b37e760fb743bf47d0a4c704c71f726ba56e373fbd4149e2750c00ee89e8af74efe"
         }
       ]
     },
@@ -1661,11 +1661,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "07ba1b6db0880e09b35b6e70129807d1c77aeb273b75e81024582e58932f17ca"
+          "content": "484c2c4747699b7a32658126ade2fb498656cde204a8a30efde0730c04305a48"
         },
         {
           "alg": "SHA3-512",
-          "content": "e3c5f78c50845d7727d4c5aaf49f1e8b6d7cf6d4de5d9ae6930f3ae42f7a23df719e0169a595d55067a9d036e9248ba0bc057ac17b095bec63edab1c5513e024"
+          "content": "b9162623770ee4a9879f501417f123fe02d819cfac322ca9fde4ca86c0319a4785a6a2bd719a2b9248e531cd8eac0a79c98b5f627c69b4dfb0d5e62f69f600d5"
         }
       ]
     },
@@ -1751,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b2d79207d42e38d82a76c13b827623baa3e951b16cfbcc05250572070eb76aed"
+          "content": "33da1072778152239ab47e8b4ef930f702678299bfa641e297a233dc9022dbfa"
         },
         {
           "alg": "SHA3-512",
-          "content": "aacaf080aa59ced61686aef2fec87514b5ae34bfcbedd03614da053f0ed40cabf604b649519e75abf78df2e10892f3dd7b4241e7c5394110527f8ee6f9be4a6a"
+          "content": "3125320c4384560007a8ee89bd9bc426445f80b5db11526ec5f7c666c92ee0f6ceac1e578a09c916e6b3fc0e3e3cea364ec968223e5827e66088fdda217edbc4"
         }
       ]
     },
@@ -2201,11 +2201,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "43be3a85bb57b5ee47a0e567e6fe252ca8d41ee5e01e5614886553a473df2609"
+          "content": "576480c2ad29550a06e5a3e48b7dae04aadc1b505d76e3a5b1db9179d61263c4"
         },
         {
           "alg": "SHA3-512",
-          "content": "45a6856042bb6eed57a703c96129b31e92ad1f5b9625ca8e033e01ea8d237fa97fbdf5ccd5f661205f03adc3e28817aa93251eac8de659aa2c03d83e829cf612"
+          "content": "e3370698400f8b807680cebda861e73acedbf1602c9a7c2a8372c2285b2f88650a9d6e2931ebdb2cb229ad23e7c592787dea15a91adea5b4a854c6fc6842d38a"
         }
       ]
     },
@@ -2321,11 +2321,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fa4411b9995749454427cdde051da0567ec48df5eeba7f23410e8cbd1590d69d"
+          "content": "4622fd121015535bb0a1b47a7bf57abe3a195b02e42a0be99dfadc9d67a72160"
         },
         {
           "alg": "SHA3-512",
-          "content": "d16b768360c2553375b2ff183270ac89d3504cfa151d1178aebf8bd76f000fb17fa143ab719c2d43cfb0ec0f74969eb465e90162b55efe713296508e13f2f119"
+          "content": "85f755a9228afe24b704d39d58ee11436c8dd663df47e8c7c84da9454c5bad1cf9f166c833a9648517f9c2689730103617b41bec0739c637d91fafb041f7db63"
         }
       ]
     },
@@ -2471,11 +2471,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d01f579279f7cdc0ab9bac6e1cd50f61a37a72f768ce656eb3f53737b76b58a3"
+          "content": "a5a43d931bcc09f0e5866e5860efd373943e5ce797ff368dc009ea4161d03cd6"
         },
         {
           "alg": "SHA3-512",
-          "content": "6e990e7c3303f73cb71d98f565f2523e8e18dfbfd7ea0acced6233c7bab19e4206c3116e233c2dca97f7d33d144cb3c6794aec6c81a3a9a6aa7b546f79fb4b49"
+          "content": "dff963f00485e37546f605542d94d5e8730be9b888d98dd9bc9d256f38b4820d3c3346b1bfdbacedefc4b47d7b07afffdd1b3d7a77ba4cf71593efdd5530b9af"
         }
       ]
     },
@@ -3266,11 +3266,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "dc9e8a14d5ec7268c45b4c02d5489515c6f571f120aec56847a89eb69c912f17"
+          "content": "bb7cb7e49f82a7bb2a75ebcacc0b673d564384c0382ee7b271c32dd46fde8928"
         },
         {
           "alg": "SHA3-512",
-          "content": "202f14c7f50493a44ff3bf386cea8398035587e70a11a95f0901d659570b2ff2969ff4ef4b2c63e14bbc369e40fff53b7b1d740511828cc61fc469604a5c509a"
+          "content": "49cd6309d13cfde3a266a7a499bce75849e61b562eaba579b814bd2d553f0dc192fd987eba449e86691645a22459b3579bd32dac8bd1a50697d3bb2a2045d6a0"
         }
       ]
     },
@@ -3281,11 +3281,26 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a44aa473f7ea7f8353ad921cf198ac4bf1ff4ac9cde43aee8c79b52160436cf1"
+          "content": "31a30c4d7ea405ad1799322c02334993f7985bf922246e621b3d3e8a402654f5"
         },
         {
           "alg": "SHA3-512",
-          "content": "617266e7ee99432abb4403fa9acfa7f8d4dcbacf0ba62a8e96be7bfb2bbd9c9a44185bdf46976766077f4a5f26558491478e91c6cde0b0d044e53ea9968caea5"
+          "content": "1a33019f5533ecff0b7e97ce9d2433e83e054afd2ef3cd3902428037a4b34590820b064deeffcc4cfb92724e67f9e035fd2f2bc7f70e99128c2c7baf8d82070e"
+        }
+      ]
+    },
+    {
+      "bom-ref": "file:vendor/blamejs/codepoint-class.js",
+      "type": "file",
+      "name": "vendor/blamejs/codepoint-class.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2be79cf25de87f46b608aec98ee790f4cf1035ffee48fe70ff082d3cf6f324ba"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "8e243451500312f0836651525e31150f649b39ec34caa662bfff86f65975af91e479fd7b74a971ddb4a1fc30a379dc958b0407f7c5193c4e28a215a56a8e2bd4"
         }
       ]
     },
@@ -3319,6 +3334,46 @@
         }
       ]
     },
+    {
+      "bom-ref": "vendor:blamejs:codepoint-class.js",
+      "type": "library",
+      "name": "blamejs/codepoint-class.js",
+      "version": "1442f17758a4",
+      "description": "Vendored from blamejs/lib/codepoint-class.js (flattened + stripped). See vendor/blamejs/README.md.",
+      "licenses": [
+        {
+          "license": {
+            "id": "Apache-2.0"
+          }
+        }
+      ],
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "2be79cf25de87f46b608aec98ee790f4cf1035ffee48fe70ff082d3cf6f324ba"
+        }
+      ],
+      "externalReferences": [
+        {
+          "type": "vcs",
+          "url": "https://github.com/blamejs/blamejs"
+        },
+        {
+          "type": "distribution",
+          "url": "https://github.com/blamejs/blamejs/blob/1442f17758a4bd511c63877561c0ffa759f66a87/lib/codepoint-class.js"
+        }
+      ],
+      "properties": [
+        {
+          "name": "exceptd:vendor:upstream_sha256_at_pin",
+          "value": "2be79cf25de87f46b608aec98ee790f4cf1035ffee48fe70ff082d3cf6f324ba"
+        },
+        {
+          "name": "exceptd:vendor:strip_summary",
+          "value": ""
+        }
+      ]
+    },
     {
       "bom-ref": "vendor:blamejs:retry.js",
       "type": "library",

package/scripts/check-codebase-patterns.js

@@ -41,6 +41,7 @@ const ROOT = path.resolve(__dirname, "..");
 const VALID_ALLOW_CLASSES = Object.freeze({
   "process-exit-after-stdout-write": true,
   "dynamic-regex": true,
+  "bidi-codepoint-literal": true,
 });
 
 const EXCLUDE_DIRS = new Set([
@@ -205,6 +206,39 @@ function detectDynamicRegex(files) {
   return filterMarkers(hits, "dynamic-regex");
 }
 
+// Raw bidi-override / zero-width / invisible / null codepoints embedded as
+// literals in source — the Trojan-Source class (CVE-2021-42574). A literal
+// such codepoint is invisible in review and can reorder or hide code. Source
+// should emit them programmatically (via vendor/blamejs/codepoint-class) or
+// escape them (\uXXXX), never type them literally. The range table holds only
+// numeric codepoints + the regex is built from escapes, so this detector's own
+// source is clean (and the file self-skips below regardless).
+const _BIDI_LITERAL_RANGES = [
+  [0x202A, 0x202E], [0x2066, 0x2069], 0x200E, 0x200F, 0x061C, // bidi overrides + isolates
+  0x200B, 0x200C, 0x200D, 0x00AD, 0x2060, 0xFEFF,             // zero-width / invisible
+  0x0000,                                                      // null
+];
+function _bidiLiteralRe() {
+  const body = _BIDI_LITERAL_RANGES.map((r) =>
+    Array.isArray(r)
+      ? "\\u" + r[0].toString(16).padStart(4, "0") + "-\\u" + r[1].toString(16).padStart(4, "0")
+      : "\\u" + r.toString(16).padStart(4, "0")
+  ).join("");
+  return new RegExp("[" + body + "]"); // allow:dynamic-regex — codepoints from a static literal range table, not operator input
+}
+function detectBidiCodepointLiteral(files) {
+  const re = _bidiLiteralRe();
+  const hits = [];
+  for (const rel of (files || filesUnder(["bin/exceptd.js", "lib", "orchestrator", "scripts"]))) {
+    if (rel === "scripts/check-codebase-patterns.js") continue; // holds the range table itself
+    const lines = readLines(rel);
+    for (let i = 0; i < lines.length; i++) {
+      if (re.test(lines[i])) hits.push({ file: rel, line: i + 1, content: lines[i].trim() });
+    }
+  }
+  return filterMarkers(hits, "bidi-codepoint-literal");
+}
+
 function detectOrphanAllowClass(files) {
   const hits = [];
   for (const rel of (files || filesUnder(["bin/exceptd.js", "lib", "orchestrator", "scripts"]))) {
@@ -251,6 +285,12 @@ const CLASSES = [
     warnOnly: true, // flip to false next release once the known sites carry markers
     hint: "RegExp from operator input is a ReDoS sink — anchor + length-cap, or `// allow:dynamic-regex — <reason>` when the pattern is a trusted bundled schema",
   },
+  {
+    id: "bidi-codepoint-literal",
+    run: detectBidiCodepointLiteral,
+    warnOnly: false,
+    hint: "raw bidi/zero-width/null codepoint in source — emit it via vendor/blamejs/codepoint-class tables or a \\uXXXX escape, or `// allow:bidi-codepoint-literal — <reason>` if the literal is load-bearing test/illustrative data",
+  },
   {
     id: "orphan-allow-class",
     run: detectOrphanAllowClass,
@@ -289,6 +329,7 @@ module.exports = {
   CLASSES,
   detectProcessExitAfterStdout,
   detectDynamicRegex,
+  detectBidiCodepointLiteral,
   detectOrphanAllowClass,
   filesUnder,
 };

package/scripts/predeploy.js

@@ -244,7 +244,7 @@ const GATES = [
     // dynamic-RegExp construction is surfaced warn-only this release. The
     // exception mechanism + the "owned elsewhere" boundary are documented in
     // the script header.
-    name: "Codebase-pattern gates (process-exit-after-stdout-write, dynamic RegExp)",
+    name: "Codebase-pattern gates (stdout-flush, dynamic RegExp, bidi codepoints, orphan markers)",
     command: process.execPath,
     args: [path.join(ROOT, "scripts", "check-codebase-patterns.js")],
     ciJobName: "Data integrity (catalog + manifest snapshot)",

package/scripts/release.js

@@ -375,6 +375,22 @@ function cmdWatch() {
   // run doesn't throw before we get to inspect + rerun it.
   _run("gh", ["pr", "checks", prNum, "--watch"], { allowFail: true });
 
+  // Gate on check CONCLUSIONS, not only review threads. A red required check
+  // leaves the PR BLOCKED at merge, so surfacing failures here (the whole
+  // point of the watch phase) beats advancing to "next: merge" and letting
+  // cmdMerge reject it. Bucket is gh's normalized verdict: pass / fail /
+  // pending / skipping / cancel.
+  var checksRaw = _capture("gh", ["pr", "checks", prNum, "--json", "name,bucket,link"]).stdout;
+  var checks = [];
+  try { checks = JSON.parse(checksRaw || "[]"); } catch (_e) { checks = []; }
+  var failed = checks.filter(function (c) { return c.bucket === "fail" || c.bucket === "cancel"; });
+  if (failed.length > 0) {
+    console.log("\nfailed checks (" + failed.length + "):");
+    failed.forEach(function (c) { console.log("  ✗ " + c.name + "  " + (c.link || "")); });
+    console.log("\nFix in code, push, then re-run: node scripts/release.js watch");
+    process.exit(3);
+  }
+
   var unresolved = _unresolvedThreads(prNum);
   if (unresolved.length > 0) {
     console.log("\nunresolved review threads (" + unresolved.length + "):");

package/vendor/blamejs/README.md

@@ -9,6 +9,7 @@ upstream commit [`1442f17`](https://github.com/blamejs/blamejs/commit/1442f17758
 |---|---|---|
 | `retry.js` | `lib/retry.js` | Battle-tested exponential backoff + crypto jitter + AbortSignal + circuit-breaker. Used by `lib/job-queue.js` and `lib/refresh-external.js` for HTTP retry semantics on KEV/EPSS/NVD/IETF/GitHub fetches. |
 | `worker-pool.js` | `lib/worker-pool.js` | Generic worker_threads pool with bounded queue, per-task timeout, worker recycle. Used by `scripts/build-indexes.js --parallel` and any future CPU-bound fan-out work. |
+| `codepoint-class.js` | `lib/codepoint-class.js` | Trojan-Source (CVE-2021-42574) codepoint threat tables — bidi-override / C0-control / zero-width / null ranges + compiled regexes + `applyCharStripPolicies`. Used by the `--operator` reject path (`bin/exceptd.js`) and `sanitizeOperatorText` (`lib/playbook-runner.js`) to classify which family an offending codepoint belongs to; `\p{C}` remains the category backstop. |
 | `LICENSE` | `LICENSE` | Apache-2.0 license text (identical to exceptd's). |
 | `_PROVENANCE.json` | — | sha256 of each vendored file + upstream file at pin, plus the strip rules applied. `lib/validate-vendor.js` re-hashes on every predeploy run. |
 

package/vendor/blamejs/_PROVENANCE.json

@@ -52,6 +52,22 @@
       "exceptd_deltas": [
         "scriptPath validator rejects Windows UNC + extended-path prefixes (\\\\?\\, \\\\.\\, \\\\<server>\\) — defense-in-depth against worker-spawn from network shares on win32 platforms"
       ]
+    },
+    "codepoint-class.js": {
+      "vendored_path": "vendor/blamejs/codepoint-class.js",
+      "vendored_sha256": "2be79cf25de87f46b608aec98ee790f4cf1035ffee48fe70ff082d3cf6f324ba",
+      "upstream_path": "lib/codepoint-class.js",
+      "upstream_sha256_at_pin": "2be79cf25de87f46b608aec98ee790f4cf1035ffee48fe70ff082d3cf6f324ba",
+      "stripped": [],
+      "surface_preserved": [
+        "BIDI_RE / C0_CTRL_RE / ZERO_WIDTH_RE / NULL_BYTE (classification regexes)",
+        "BIDI_RE_G / C0_CTRL_RE_G / ZW_RE_G / NULL_RE_G (global strip regexes)",
+        "applyCharStripPolicies(text, opts)",
+        "hex4 / charClass / fromCp / range tables"
+      ],
+      "exceptd_deltas": [
+        "Used for codepoint-family CLASSIFICATION + family-strip only. The BIDI|C0|ZERO_WIDTH|NULL union is a strict subset of Unicode General Category C, so \\p{C} remains the reject/strip backstop at both consumer sites (bin/exceptd.js --operator validation, lib/playbook-runner.js sanitizeOperatorText) — it catches the divergent remainder (U+007F, U+0080-009F, U+FFF9-FFFB, private-use, unassigned) the named-family regexes miss."
+      ]
     }
   }
 }

package/vendor/blamejs/codepoint-class.js

@@ -0,0 +1,262 @@
+"use strict";
+/**
+ * codepoint-class — shared codepoint-table threat catalog and regex
+ * compiler for the guard-* family.
+ *
+ * Threat detectors that need to match Unicode bidi overrides, C0
+ * control characters, zero-width / invisible chars, etc. compose
+ * regex character classes from numeric codepoint range tables here
+ * instead of embedding the attack characters directly in their
+ * source files. Centralizing the tables means:
+ *
+ *   - Source files in lib/guard-* stay pure ASCII (zero
+ *     irregular-whitespace lint findings, no eslint-disable comments
+ *     for this category).
+ *   - Adding / removing a codepoint from the catalog is a single
+ *     edit; every guard picks up the change.
+ *   - The detector composes the way an attacker would compose the
+ *     payload (programmatic codepoint emission, not literal typing).
+ *
+ * Surface:
+ *
+ *   hex4(cp)              -> "\\uXXXX" escape for a single codepoint
+ *   charClass(ranges)     -> regex character class body for a range
+ *                            table (e.g. [0x200E, [0x202A,0x202E]])
+ *   fromCp(cp)            -> String.fromCharCode shorthand
+ *   ranges()              -> { BIDI_RANGES, C0_CTRL_RANGES,
+ *                              ZERO_WIDTH_RANGES }
+ *   compiled()            -> { BIDI_RE, BIDI_RE_G, C0_CTRL_RE,
+ *                              C0_CTRL_RE_G, ZERO_WIDTH_RE, ZW_RE_G,
+ *                              NULL_RE_G, NULL_BYTE, BOM_CHAR }
+ *
+ * The compiled() exports are RegExp instances built from the
+ * codepoint tables at module load. Consumers grab them once at boot.
+ *
+ * Codepoint tables:
+ *
+ *   BIDI_RANGES — Unicode bidi-override family (CVE-2021-42574
+ *     Trojan Source). LRM U+200E / RLM U+200F / ALM U+061C / LRE
+ *     U+202A / RLE U+202B / PDF U+202C / LRO U+202D / RLO U+202E /
+ *     LRI U+2066 / RLI U+2067 / FSI U+2068 / PDI U+2069.
+ *
+ *   C0_CTRL_RANGES — C0 control characters minus tab (U+09) / lf
+ *     (U+0A) / cr (U+0D) — those are dialect-shaped chars that
+ *     parsers handle separately. Everything else (U+00, U+01-U+08,
+ *     U+0B-U+0C, U+0E-U+1F) flagged as control-byte injection.
+ *
+ *   ZERO_WIDTH_RANGES — invisible-formatting / zero-width chars
+ *     attackers use to hide payloads:
+ *     SHY  U+00AD  ZWSP U+200B  ZWNJ U+200C  ZWJ  U+200D
+ *     WJ   U+2060  BOM  U+FEFF
+ */
+
+var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
+
+function hex4(cp) {
+  var s = cp.toString(HEX_RADIX).toUpperCase();
+  while (s.length < 4) s = "0" + s;
+  return "\\u" + s;
+}
+function charClass(rangeList) {
+  return rangeList.map(function (r) {
+    return Array.isArray(r) ? hex4(r[0]) + "-" + hex4(r[1]) : hex4(r);
+  }).join("");
+}
+function fromCp(cp) { return String.fromCharCode(cp); }
+
+var BIDI_RANGES       = [0x200E, 0x200F, 0x061C, [0x202A, 0x202E], [0x2066, 0x2069]];
+var C0_CTRL_RANGES    = [[0x0000, 0x0008], 0x000B, 0x000C, [0x000E, 0x001F]];
+var ZERO_WIDTH_RANGES = [0x00AD, [0x200B, 0x200D], 0x2060, 0xFEFF];
+
+// allow:dynamic-regex — codepoints from BIDI_RANGES literal table
+var BIDI_RE       = new RegExp("[" + charClass(BIDI_RANGES) + "]");
+// allow:dynamic-regex — codepoints from BIDI_RANGES literal table
+var BIDI_RE_G     = new RegExp("[" + charClass(BIDI_RANGES) + "]", "g");
+// allow:dynamic-regex — codepoints from C0_CTRL_RANGES literal table
+var C0_CTRL_RE    = new RegExp("[" + charClass(C0_CTRL_RANGES) + "]");
+// allow:dynamic-regex — codepoints from C0_CTRL_RANGES literal table
+var C0_CTRL_RE_G  = new RegExp("[" + charClass(C0_CTRL_RANGES) + "]", "g");
+// allow:dynamic-regex — codepoints from ZERO_WIDTH_RANGES literal table
+var ZERO_WIDTH_RE = new RegExp("[" + charClass(ZERO_WIDTH_RANGES) + "]");
+// allow:dynamic-regex — codepoints from ZERO_WIDTH_RANGES literal table
+var ZW_RE_G       = new RegExp("[" + charClass(ZERO_WIDTH_RANGES) + "]", "g");
+// allow:dynamic-regex — single literal codepoint U+0000
+var NULL_RE_G     = new RegExp(hex4(0x0000), "g");
+
+var NULL_BYTE = fromCp(0x0000);
+var BOM_CHAR  = fromCp(0xFEFF);
+
+// Unicode script-range catalog for IDN-homograph / mixed-script
+// confusable detection (UTS #39). Used by guard-domain, guard-email,
+// safe-url IDN host-label classification, and any future caller that
+// needs "is this label entirely one writing system?". Centralizing the
+// table keeps the codepoint definitions in one place — adding a script
+// is a single edit.
+var SCRIPT_RANGES = {
+  latin:    [[0x0041, 0x005A], [0x0061, 0x007A],
+             [0x00C0, 0x024F], [0x1E00, 0x1EFF]],                                 // Unicode script ranges
+  cyrillic: [[0x0400, 0x04FF], [0x0500, 0x052F]],                                 // Unicode Cyrillic + Cyrillic Supplement
+  greek:    [[0x0370, 0x03FF], [0x1F00, 0x1FFF]],                                 // Unicode Greek + Greek Extended
+  armenian: [[0x0530, 0x058F]],                                                   // Unicode Armenian
+  cherokee: [[0x13A0, 0x13FF], [0xAB70, 0xABBF]],                                 // Unicode Cherokee + Cherokee Supplement
+  han:      [[0x4E00, 0x9FFF]],                                                   // CJK Unified Ideographs
+  hiragana: [[0x3040, 0x309F]],                                                   // Hiragana
+  katakana: [[0x30A0, 0x30FF]],                                                   // Katakana
+  hangul:   [[0xAC00, 0xD7AF]],                                                   // Hangul Syllables
+  arabic:   [[0x0600, 0x06FF]],                                                   // Arabic
+  hebrew:   [[0x0590, 0x05FF]],                                                   // Hebrew
+};
+
+// scriptFor(cp) — returns the script-name string for a codepoint, or
+// null when the codepoint is in a script not in the catalog (digits,
+// punctuation, symbols, etc. are not script-classifying).
+function scriptFor(cp) {
+  var keys = Object.keys(SCRIPT_RANGES);
+  for (var i = 0; i < keys.length; i += 1) {
+    var ranges = SCRIPT_RANGES[keys[i]];
+    for (var j = 0; j < ranges.length; j += 1) {
+      if (cp >= ranges[j][0] && cp <= ranges[j][1]) return keys[i];
+    }
+  }
+  return null;
+}
+
+// detectMixedScripts(label, allowedScripts?) — returns null when the
+// label is single-script (or every script appears in the optional
+// allowedScripts allowlist), or an array of the detected script names
+// when the label mixes scripts (homograph attack shape — Cyrillic 'а'
+// inside an otherwise-Latin label, etc.). The result is the FULL set
+// of scripts seen; callers decide refuse / audit / strip.
+//
+// allowedScripts: an array of script names the caller treats as
+// acceptable; when supplied, a label whose every script is on the list
+// returns null even if multiple scripts appear (legitimate mixed-
+// script content like an English word inside a Japanese label).
+function detectMixedScripts(label, allowedScripts) {
+  if (typeof label !== "string" || label.length === 0) return null;
+  var seen = {};
+  for (var i = 0; i < label.length; i += 1) {
+    var script = scriptFor(label.charCodeAt(i));
+    if (script === null) continue;
+    seen[script] = true;
+  }
+  var scripts = Object.keys(seen);
+  if (scripts.length <= 1) return null;
+  if (!allowedScripts) return scripts;
+  for (var k = 0; k < scripts.length; k += 1) {
+    if (allowedScripts.indexOf(scripts[k]) === -1) return scripts;
+  }
+  return null;
+}
+
+// detectCharThreats — returns an array of issue objects for character-
+// class threats (bidi / null / C0-control) per the opts policy. Emits
+// at most one issue per class. Used by guard-* primitives' detection
+// pass instead of repeating the per-class match-and-push block.
+//
+// Issue shape mirrors guard-* convention:
+//   { kind, severity, ruleId, location, snippet }
+//
+//   issues.push.apply(issues,
+//     codepointClass.detectCharThreats(text, opts, "html"));
+function detectCharThreats(text, opts, codePrefix) {
+  var issues = [];
+  if (typeof text !== "string") return issues;
+  if (opts && opts.bidiPolicy !== "allow") {
+    var bidiMatch = text.match(BIDI_RE);
+    if (bidiMatch) {
+      issues.push({
+        kind: "bidi-override", severity: "critical",
+        ruleId: codePrefix + ".bidi",
+        location: bidiMatch.index,
+        snippet: "Unicode bidi override (CVE-2021-42574 Trojan Source)",
+      });
+    }
+  }
+  if (opts && opts.nullBytePolicy !== "allow") {
+    var nullIdx = text.indexOf(NULL_BYTE);
+    if (nullIdx >= 0) {
+      issues.push({
+        kind: "null-byte", severity: "critical",
+        ruleId: codePrefix + ".null-byte",
+        location: nullIdx,
+        snippet: "null byte at byte " + nullIdx,
+      });
+    }
+  }
+  if (opts && opts.controlPolicy !== "allow") {
+    var ctrlMatch = text.match(C0_CTRL_RE);
+    if (ctrlMatch) {
+      issues.push({
+        kind: "control-char", severity: "high",
+        ruleId: codePrefix + ".control",
+        location: ctrlMatch.index,
+        snippet: "C0 control char U+" + ctrlMatch[0].charCodeAt(0).toString(HEX_RADIX),
+      });
+    }
+  }
+  return issues;
+}
+
+// assertNoCharThreats — throws an instance of errorFactory(code, msg)
+// when the text contains a class that's set to "reject" in opts.
+// Opt-name vocabulary: bidiPolicy / nullBytePolicy / controlPolicy
+// (the standard guard-* family naming; older guard-csv uses different
+// names and keeps its inline checks).
+function assertNoCharThreats(text, opts, errorFactory, codePrefix) {
+  if (typeof text !== "string") return;
+  if (opts && opts.bidiPolicy === "reject" && BIDI_RE.test(text)) {           // allow:regex-no-length-cap — caller bounds length before invoking
+    throw errorFactory(codePrefix + ".bidi",
+      "input contains Unicode bidi override (CVE-2021-42574)");
+  }
+  if (opts && opts.nullBytePolicy === "reject" && text.indexOf(NULL_BYTE) !== -1) {
+    throw errorFactory(codePrefix + ".null-byte",
+      "input contains null byte");
+  }
+  if (opts && opts.controlPolicy === "reject" && C0_CTRL_RE.test(text)) {     // allow:regex-no-length-cap — caller bounds length before invoking
+    throw errorFactory(codePrefix + ".control",
+      "input contains C0 control character");
+  }
+}
+
+// applyCharStripPolicies — given a text and a policy object, apply
+// strip-mode replacements for each character-class threat. Reads:
+//   opts.bidiPolicy === "strip"      -> strip BIDI overrides
+//   opts.controlPolicy === "strip"   -> strip C0 controls
+//   opts.nullBytePolicy === "strip"  -> strip null bytes
+//   opts.zeroWidthPolicy === "strip" -> strip zero-widths
+// Returns the cleaned string. Used by every guard's sanitize path so
+// each one doesn't reinvent the same sequence of replace() calls.
+function applyCharStripPolicies(text, opts) {
+  if (typeof text !== "string") return text;
+  var out = text;
+  if (opts && opts.bidiPolicy === "strip")      out = out.replace(BIDI_RE_G, "");
+  if (opts && opts.controlPolicy === "strip")   out = out.replace(C0_CTRL_RE_G, "");
+  if (opts && opts.nullBytePolicy === "strip")  out = out.replace(NULL_RE_G, "");
+  if (opts && opts.zeroWidthPolicy === "strip") out = out.replace(ZW_RE_G, "");
+  return out;
+}
+
+module.exports = {
+  hex4:              hex4,
+  charClass:         charClass,
+  fromCp:            fromCp,
+  BIDI_RANGES:       BIDI_RANGES,
+  C0_CTRL_RANGES:    C0_CTRL_RANGES,
+  ZERO_WIDTH_RANGES: ZERO_WIDTH_RANGES,
+  BIDI_RE:           BIDI_RE,
+  BIDI_RE_G:         BIDI_RE_G,
+  C0_CTRL_RE:        C0_CTRL_RE,
+  C0_CTRL_RE_G:      C0_CTRL_RE_G,
+  ZERO_WIDTH_RE:     ZERO_WIDTH_RE,
+  ZW_RE_G:           ZW_RE_G,
+  NULL_RE_G:         NULL_RE_G,
+  NULL_BYTE:         NULL_BYTE,
+  BOM_CHAR:          BOM_CHAR,
+  applyCharStripPolicies: applyCharStripPolicies,
+  assertNoCharThreats:    assertNoCharThreats,
+  detectCharThreats:      detectCharThreats,
+  SCRIPT_RANGES:          SCRIPT_RANGES,
+  scriptFor:              scriptFor,
+  detectMixedScripts:     detectMixedScripts,
+};