@blamejs/exceptd-skills 0.16.0 → 0.16.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.16.2 — 2026-05-31
+
+The default evidence bundle for the secrets, credential-store, runtime, and citation-hygiene playbooks is now a real structured-JSON document instead of an "Unknown format" placeholder, and `json` is a generally selectable bundle format for any playbook.
+
+A crypto-codebase scan of a source repository no longer emits a spurious "precondition not met" warning for its source-tree check: the collector now attests that gate from the files it walked, matching how the supply-chain and library-author collectors already self-attest.
+
+When a run is blocked on a precondition you submitted as false, the remediation now names the exact way to satisfy it — submit `precondition_checks {"<id>": true}` in your evidence, or pass the owning collector's attestation flag at collect time (for example `collect cicd-pipeline-compromise --attest-ownership`) — instead of an ambiguous hint that could be read as a flag on the wrong verb.
+
+## 0.16.1 — 2026-05-31
+
+Supply-chain, library-author, and MCP scans no longer emit a spurious "precondition not met" warning when the scanned directory clearly satisfies it: the collectors now attest the gates they can verify from what they collected (a lockfile satisfies the package-manager gate, a package manifest or publish workflow satisfies the publishable-artifact gate, a present assistant config satisfies the AI-assistant gate) — so a `collect --cwd <repo> | run` against a target directory reports them as met rather than unverified. The library-author publish-workflow detector no longer mis-classifies a CI workflow whose only mention of a publish command sits inside a comment. And a blocked run on an intent/ownership precondition (for example the CI/CD playbook's fleet-ownership gate) now states the specific gate and how to satisfy it, instead of guessing a platform mismatch.
+
 ## 0.16.0 — 2026-05-31
 
 Supply-chain playbook gains reachability-aware triage and publisher-identity detection. A CVE-reachability demoter flags a matched-CVE dependency whose vulnerable module is never imported on a path from your own code, supporting exploit-priority triage of the runtime-vs-build-only distinction — it over-approximates toward reachable (any dynamic / plugin / reflective load counts as reachable) so it only demotes a match when reachability is explicitly attested, and the CVE matcher itself is unchanged. A publisher-identity-change detector flags an account-takeover precursor: a dependency whose publishing account, maintainer set, or provenance identity changed across an update while its capability surface stayed identical — the silent ownership-handoff release that precedes a payload, which the capability-creep detector cannot see.

package/bin/exceptd.js

@@ -3570,7 +3570,7 @@ function cmdRun(runner, args, runOpts, pretty) {
         lines.push(`  → ${obj.remediation}`);
       } else {
         const hints = {
-          precondition: "→ Preconditions are not met on this host (often a platform gate, e.g. a Linux-only playbook). List playbooks that fit your platform: exceptd brief --all",
+          precondition: "→ A required precondition is unmet — the reason above names the specific gate. It may be a platform mismatch, OR an attestation/evidence the run needs (submit it in your evidence JSON's precondition_checks). For a platform mismatch, list applicable playbooks: exceptd brief --all",
           mutex: "→ Another run holds this playbook's mutex. Wait for it to finish, then retry.",
           currency: "→ Threat intel is stale. Refresh sources (exceptd refresh) or re-run with --force-stale to override.",
           catalog_corrupt: "→ The CVE catalog failed to load. Reinstall the package or run: exceptd doctor",

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-31T10:26:41.259Z",
+  "generated_at": "2026-05-31T13:45:27.995Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "b2470edc747a7cb7f4d2d31e94bccead4ac79a5b605ea67ef12757c9353c186d",
+    "manifest.json": "09e4b71506de2c73f64372d2e4359a24082402240ba86e3a34fcc6299c9e08e2",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
     "data/attack-techniques.json": "318bf8e9c5aee1d0a4a1dc37c4b211f2fbc937bf332a401a22483cc7d0547252",
     "data/cve-catalog.json": "1aac7e75eae24ece2ef09d1c63977bdd7a1f81a9f11609ebb966109be316426c",

package/lib/collectors/crypto-codebase.js

@@ -41,6 +41,17 @@ const SOURCE_EXTS = new Set([
   ".m", ".mm",
 ]);
 
+// The exact marker set the crypto-codebase playbook's `repo-has-source-tree`
+// gate evaluates (data/playbooks/crypto-codebase.json: exists_any([...])).
+// The collector attests the gate by mirroring this predicate against the
+// scanned cwd — NOT by counting SOURCE_EXTS files — so a valid package repo
+// whose only marker is a manifest or an empty src/ dir (no extension-matched
+// source yet) still attests true, matching what the gate would compute.
+const SOURCE_TREE_MARKERS = [
+  "package.json", "pyproject.toml", "go.mod", "Cargo.toml",
+  "pom.xml", "build.gradle", "src", "lib", "crates",
+];
+
 const TEST_PATH_SEGMENTS = [
   "/test/", "/tests/", "/spec/", "/specs/", "/__tests__/",
   "/fixtures/", "/fixture/", "/examples/", "/example/",
@@ -471,14 +482,23 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
 
   return {
     precondition_checks: {
-      "repo-context": sourceFiles.length > 0,
+      // Auto-attest the crypto-codebase playbook's own `repo-has-source-tree`
+      // gate by mirroring the gate's own exists_any(SOURCE_TREE_MARKERS)
+      // predicate against the scanned cwd. The runner's autoDetectPreconditions
+      // probes the run process's cwd (not the collected --cwd) and has no
+      // exists_any() branch, so a repo with a recognizable source tree would
+      // otherwise surface a spurious precondition_unverified warning. Keying to
+      // the gate's exact id + predicate mirrors the sbom / library-author
+      // collectors; `repo-context` is not a precondition this playbook
+      // references.
+      "repo-has-source-tree": SOURCE_TREE_MARKERS.some((m) => fs.existsSync(path.join(cwd, m))),
     },
     artifacts,
     signal_overrides,
     ...(Object.keys(evidence_locations).length ? { evidence_locations } : {}),
     collector_meta: {
       collector_id: COLLECTOR_ID,
-      collector_version: "2026-05-20",
+      collector_version: "2026-05-31",
       platform: process.platform,
       captured_at: new Date().toISOString(),
       cwd: root,

package/lib/collectors/library-author.js

@@ -82,33 +82,41 @@ function looksLikePublishWorkflow(name, content) {
   // Filename prefix signals: only the canonical publish words.
   if (/^(release|publish|deploy|promote|tag-and-release)/.test(lower)) return true;
 
+  // Strip YAML line-comments before the content-shape probes so a comment that
+  // merely MENTIONS a publish verb (e.g. a ci.yml line "# … matches the npm
+  // publish workflow's depth.") can't masquerade as a publish command. The
+  // filename-prefix checks above are unaffected. A `#` inside a quoted string
+  // is rare in workflow YAML and not load-bearing for these command probes
+  // (stripping can only REMOVE comment text, never create a false match).
+  const code = content.replace(/#.*$/gm, '');
+
   // Explicit publish-shape commands — these are commitments to push
   // artifacts, not setup / scaffolding.
-  if (/\bnpm\s+publish\b/.test(content)) return true;
-  if (/pypa\/gh-action-pypi-publish/.test(content)) return true;
-  if (/\bcargo\s+publish\b/.test(content)) return true;
-  if (/goreleaser/.test(content)) return true;
-  if (/softprops\/action-gh-release/.test(content)) return true;
+  if (/\bnpm\s+publish\b/.test(code)) return true;
+  if (/pypa\/gh-action-pypi-publish/.test(code)) return true;
+  if (/\bcargo\s+publish\b/.test(code)) return true;
+  if (/goreleaser/.test(code)) return true;
+  if (/softprops\/action-gh-release/.test(code)) return true;
   // `ko build` builds AND pushes container images by default (unless
   // --push=false). All four sub-commands push to a registry.
-  if (/\bko\s+(?:publish|build|apply|resolve)\b/.test(content)) return true;
+  if (/\bko\s+(?:publish|build|apply|resolve)\b/.test(code)) return true;
   // `cosign sign` (container signing — publish-shape). Exclude
   // `cosign sign-blob` which signs arbitrary artifacts and shows
   // up in verification / e2e tests as often as in publishes.
-  if (/\bcosign\s+sign\b(?!-)/.test(content)) return true;
-  if (/\bcrane\s+(?:push|copy|append)\b/.test(content)) return true;
-  if (/\boras\s+(?:push|copy)\b/.test(content)) return true;
-  if (/docker\/build-push-action/.test(content)) return true;
-  if (/\bdocker\s+push\b/.test(content)) return true;
+  if (/\bcosign\s+sign\b(?!-)/.test(code)) return true;
+  if (/\bcrane\s+(?:push|copy|append)\b/.test(code)) return true;
+  if (/\boras\s+(?:push|copy)\b/.test(code)) return true;
+  if (/docker\/build-push-action/.test(code)) return true;
+  if (/\bdocker\s+push\b/.test(code)) return true;
 
   // Registry login actions — when a workflow logs into a registry,
   // it's almost certainly publishing. Picks up Makefile / opaque
   // publish paths (cosign's build.yaml uses make sign-ci-containers
   // after docker/login-action). Does NOT match verification tests
   // because those don't authenticate to a registry.
-  if (/docker\/login-action/.test(content)) return true;
-  if (/google-github-actions\/auth/.test(content) && /gcloud auth configure-docker/.test(content)) return true;
-  if (/aws-actions\/configure-aws-credentials/.test(content) && /amazon-ecr/.test(content)) return true;
+  if (/docker\/login-action/.test(code)) return true;
+  if (/google-github-actions\/auth/.test(code) && /gcloud auth configure-docker/.test(code)) return true;
+  if (/aws-actions\/configure-aws-credentials/.test(code) && /amazon-ecr/.test(code)) return true;
 
   return false;
 }
@@ -531,6 +539,14 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   return {
     precondition_checks: {
       "publisher-context": manifests.length > 0,
+      // Auto-attest the playbook's publishable-artifact-evidence gate from what
+      // we collected (a package manifest or a publish workflow): the runner
+      // can't probe the scanned --cwd, so otherwise a repo that clearly has a
+      // manifest surfaces a spurious precondition_unverified warning. (The
+      // repo-walk-access HALT gate is intentionally NOT attested here — it is
+      // resolved host-side and attesting it from the collector would turn a
+      // currently-passing run on a non-git dir into a fail-closed halt.)
+      "publishable-artifact-evidence": manifests.length > 0 || publishWorkflows.length > 0,
     },
     artifacts,
     signal_overrides,

package/lib/collectors/mcp.js

@@ -285,10 +285,32 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
     },
   };
 
+  // Attest any-ai-coding-assistant-installed (skip_phase gate) ONLY when a
+  // client is confirmed present — an install directory the precondition itself
+  // recognises (exists($HOME/.cursor)||.codeium/windsurf||.config/claude||
+  // .config/Code||.gemini), OR a vendor config file we found. The runner can't
+  // resolve the exists() DSL against the scanned home, so without this a host
+  // that clearly has a client surfaces a spurious precondition_unverified.
+  // Crucially we NEVER submit false: the gate is skip_phase, so a false on a
+  // config-file-only absence would wrongly skip the detect phase even when an
+  // installed client directory or a project-level signal (e.g. a .vscode
+  // Copilot config) exists. When presence can't be confirmed, leave the gate
+  // unsubmitted and let the host-side resolver decide.
+  const assistantInstallDirs = [
+    ".cursor",
+    path.join(".codeium", "windsurf"),
+    path.join(".config", "claude"),
+    path.join(".config", "Code"),
+    ".gemini",
+  ];
+  const assistantPresent =
+    Object.values(configsByVendor).some((files) => files.some(fileExists)) ||
+    assistantInstallDirs.some((d) => fs.existsSync(path.join(home, d)));
+  const precondition_checks = { "home-dir-readable": fs.existsSync(home) };
+  if (assistantPresent) precondition_checks["any-ai-coding-assistant-installed"] = true;
+
   return {
-    precondition_checks: {
-      "home-dir-readable": fs.existsSync(home),
-    },
+    precondition_checks,
     artifacts,
     signal_overrides,
     collector_meta: {

package/lib/collectors/sbom.js

@@ -398,6 +398,12 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   return {
     precondition_checks: {
       "sbom-tool-available": hasAnything,
+      // Auto-attest the playbook's any-package-manager-present gate from what
+      // we actually collected: the runner's autoDetectPreconditions can't probe
+      // the scanned --cwd (it sees the run process cwd, not the collected repo),
+      // so a lockfile we found here would otherwise surface a spurious
+      // precondition_unverified warning on a repo that clearly has one.
+      "any-package-manager-present": lockfiles.length > 0,
     },
     artifacts,
     signal_overrides,

package/lib/playbook-runner.js

@@ -282,7 +282,16 @@ function preflight(playbook, runOpts = {}) {
     }
     if (submitted === false) {
       if (pc.on_fail === 'halt') {
-        return { ok: false, blocked_by: 'precondition', reason: `Precondition ${pc.id} failed: ${pc.description}`, issues };
+        return {
+          ok: false,
+          blocked_by: 'precondition',
+          reason: `Precondition ${pc.id} failed: ${pc.description}`,
+          // Explicit-false halts carry a specific remediation so the renderer
+          // prefers it over the generic platform-gate hint — an intent/ownership
+          // gate (e.g. operator-owns-ci-fleet) is not a platform mismatch.
+          remediation: `Precondition ${pc.id} was submitted as false: ${pc.description} Attest it as true and re-run — submit precondition_checks {"${pc.id}": true} in your evidence JSON, or pass the owning collector's attestation flag at collect time (for example: collect cicd-pipeline-compromise --attest-ownership).`,
+          issues
+        };
       }
       if (strict) {
         // Warn-level + skip_phase outcomes escalate to halt under strict.
@@ -2953,6 +2962,31 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
     return { format: 'markdown', body: lines.join('\n') };
   }
 
+  // Native structured-JSON bundle — a superset of `summary` carrying the full
+  // finding record. This is the declared bundle_format for the secrets /
+  // cred-stores / runtime / citation-hygiene playbooks; without an explicit
+  // branch their default bundle fell through to the Unknown-format placeholder
+  // below. Reuses the pinned `now` so multi-format builds stay
+  // timestamp-consistent, and exposes the same finding fields the supported
+  // csaf / markdown branches already surface — `json` is an intentional,
+  // operator-selectable format, not the fallback leak path.
+  if (format === 'json') {
+    return {
+      format: 'json',
+      playbook: playbook._meta.id,
+      playbook_version: playbook._meta.version,
+      session_id: sessionId,
+      generated: now,
+      verdict: analyze.compliance_theater_check?.verdict || 'pending',
+      matched_cves: analyze.matched_cves,
+      rwep_adjusted: analyze.rwep?.adjusted || 0,
+      rwep_threshold_escalate: analyze.rwep?.threshold?.escalate || null,
+      blast_radius_score: analyze.blast_radius_score || 0,
+      selected_remediation: validate.selected_remediation || null,
+      residual_risk_statement: validate.residual_risk_statement || null,
+    };
+  }
+
   // The fallback must NOT leak raw analyze + validate internals (matched
   // CVEs, framework gaps, residual-risk statements) under an arbitrary
   // "format" name — operators piping output to logging or third-party
@@ -2961,7 +2995,7 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
   return {
     format,
     note: 'Unknown format',
-    supported_formats: ['csaf-2.0', 'sarif', 'sarif-2.1.0', 'openvex', 'openvex-0.2.0', 'summary', 'markdown'],
+    supported_formats: ['csaf-2.0', 'sarif', 'sarif-2.1.0', 'openvex', 'openvex-0.2.0', 'summary', 'markdown', 'json'],
   };
 }
 

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-05-31T10:22:24.320Z",
+      "signed_at": "2026-05-31T13:44:05.263Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "PHwHEsoy7ctBYOtlAfAdCDVfsq2Bpk9+qESSF+5dVkDcez2zp2v9Ihsv2vqMEs3QxMndyQ+t7NVezyt5VamSCg==",
-      "signed_at": "2026-05-31T10:22:24.321Z",
+      "signed_at": "2026-05-31T13:44:05.265Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "dD4p7lcRtMyfITOncqLkpOeMy6x6gM0V7UlWHgLEdcxqODb1s75ar1cBtTqDWPbMv6ZAzVo2HJLDK1hVjjU2AQ==",
-      "signed_at": "2026-05-31T10:22:24.322Z",
+      "signed_at": "2026-05-31T13:44:05.265Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "wsw8Mlr/gyw6S7Iaao9BVHdU5LFPWl8WVymW17Lkq9J1Mui0+fCrTg6UbrsaeE3s7EW3TVgzBuK+8EFd1+H5AA==",
-      "signed_at": "2026-05-31T10:22:24.322Z"
+      "signed_at": "2026-05-31T13:44:05.265Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "uVTc1QRKOKcIVDajBz+q2egjiEAyOQaDNsvVI2ghj5FD0VvquoUBBE5Naca2FkaZa790EHWCsVZ4hhdaSQs2DQ==",
-      "signed_at": "2026-05-31T10:22:24.323Z"
+      "signed_at": "2026-05-31T13:44:05.266Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "QuNpwnZ6HkCEAXTPC/jLbXSmMIc1JnBczqZAAIZmZj8OcEMVnw9mJYAnU3CxaEI7rvbcMkN2uS5E8yUCm/NiAg==",
-      "signed_at": "2026-05-31T10:22:24.323Z"
+      "signed_at": "2026-05-31T13:44:05.266Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "5rw2i39SxY2WphBbDLEP28wufnbPPE9+PWt54hmaGdwHXr9RLiVt5liL/5xp14sehlVgFsfpR/bg9vy//xV0DA==",
-      "signed_at": "2026-05-31T10:22:24.323Z",
+      "signed_at": "2026-05-31T13:44:05.267Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "Vqu49nzntFWjn9A/QeJzm7q/2xk/cZJ6HFQKtiNi1zgcxzXKm+MlFdkaLgYHWj5/9HJohxyIDyBJQTvcJ20eDQ==",
-      "signed_at": "2026-05-31T10:22:24.324Z",
+      "signed_at": "2026-05-31T13:44:05.267Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -440,7 +440,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "W87VdyVdAxAdcRI6P/8StaV+MS8ZSPKM9HOCK9n/bBO6BM3ZSE3uImVoyJVpAXQlUpUGN+A3lCJZXv64LuxwDg==",
-      "signed_at": "2026-05-31T10:22:24.324Z",
+      "signed_at": "2026-05-31T13:44:05.267Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "wdVX+edeNekpaIldqkhvtraV6DquLvIsKAjuZVwPQYn3l1vS99HXuFxmNsD7UeMlO3qgC6Dysfsto9EnuH0RBg==",
-      "signed_at": "2026-05-31T10:22:24.324Z",
+      "signed_at": "2026-05-31T13:44:05.268Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -513,7 +513,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-05-31T10:22:24.325Z"
+      "signed_at": "2026-05-31T13:44:05.268Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -540,7 +540,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "xbkip0AQtWQKAu+O6r/gYECNjezS6O9k9xkkJsYbMlr+j8CdqH3p5/0l+GZmDidImRC/DL07GCnKrk9HRR/yDQ==",
-      "signed_at": "2026-05-31T10:22:24.325Z",
+      "signed_at": "2026-05-31T13:44:05.268Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -604,7 +604,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "li2NnC1oeVIr22ComP5QbcQoh5xpWITuaKpza1s2SsUkH6kGnnt4wFfFAzaC1ORmH9x2cr8hN8kaNANG/eIMBQ==",
-      "signed_at": "2026-05-31T10:22:24.325Z",
+      "signed_at": "2026-05-31T13:44:05.269Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "sZHlJ7ueHPdtzVbR+yXQ5+wKgNyjWsa1LKVg9aWTmg/Onl71DvEILMyJiLpPQjseT56Mnr1DMYJE8xOGlffBAw==",
-      "signed_at": "2026-05-31T10:22:24.326Z"
+      "signed_at": "2026-05-31T13:44:05.269Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -689,7 +689,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "3AwFnEJu6DukPPNep/3SnuPWEuV060fJEQIwThFm7ujmdbFk0/Ii0XwGv1dkvbbK7ymMdOQpp35l4aLONAucDA==",
-      "signed_at": "2026-05-31T10:22:24.326Z",
+      "signed_at": "2026-05-31T13:44:05.269Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -724,7 +724,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-05-31T10:22:24.327Z"
+      "signed_at": "2026-05-31T13:44:05.270Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -796,7 +796,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "DDMzI+4En4aIkwBUCGW6nj1eEkCyLqHGn2LJ2rnwWfYatjPI1U5HrTZNAN/n9JqWtAzk8F3rmsKehaaz5iNWDA==",
-      "signed_at": "2026-05-31T10:22:24.327Z"
+      "signed_at": "2026-05-31T13:44:05.270Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -856,7 +856,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "dJB0iAstIUbyny+udl3OIkaLScEmqS97LNP73yQ8mxt+0bcqxZjpfXaWLzLuIQblGYvUvz75/H6rO2EJuGd4AQ==",
-      "signed_at": "2026-05-31T10:22:24.327Z"
+      "signed_at": "2026-05-31T13:44:05.270Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -931,7 +931,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "KEAoMji3VcPX/ZXXqVe6OStxSkTssfY9fIRPyPcDYqh50GzOFQ6koNOTBVAiWOvjDjQ38g12xun5srbqgmvRAw==",
-      "signed_at": "2026-05-31T10:22:24.328Z"
+      "signed_at": "2026-05-31T13:44:05.271Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1010,7 +1010,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "zuW8T0EMbVV83GsUP/W20Use2gBTicBW021T0sY7qsRY/U5qsPWkXYIWp3SdiKLTIKqTEd/0T7LQebjIs2QKCA==",
-      "signed_at": "2026-05-31T10:22:24.328Z"
+      "signed_at": "2026-05-31T13:44:05.271Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1067,7 +1067,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "Qe0Hg9BrX3Zm5pj0n2z/oiHbAXWdA2Dq461zc4izkkUjEX2CZ02rODjCI2ELbrVOU3GC7edxqAxA+5U/ObnHDQ==",
-      "signed_at": "2026-05-31T10:22:24.328Z"
+      "signed_at": "2026-05-31T13:44:05.271Z"
     },
     {
       "name": "identity-assurance",
@@ -1134,7 +1134,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-05-31T10:22:24.329Z"
+      "signed_at": "2026-05-31T13:44:05.272Z"
     },
     {
       "name": "ot-ics-security",
@@ -1190,7 +1190,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "kIVzsPsJ72PzzWQwTuvjoHHoVEDCday5I52M9ohjB3/Ak+zlA8oyWLO/BKb/XuYY4fOApjfxTErSWv5uHQ2zDw==",
-      "signed_at": "2026-05-31T10:22:24.329Z"
+      "signed_at": "2026-05-31T13:44:05.272Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1242,7 +1242,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "bWr27Q1uN9xCe1ib4QulszBa7YIDNkGqo72k5nm2cK98LyPblicD+sO9MnGckAyB22BTN/cIB+FwFMcI5IxvBw==",
-      "signed_at": "2026-05-31T10:22:24.329Z"
+      "signed_at": "2026-05-31T13:44:05.272Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1292,7 +1292,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "Q854yzLqXdOazc6EyQbZzgAlivuq2vGFDVUCrxSldSvx/HX/ZM/uzmJyP7aBG7ZsMHxj6Lmj/H82YQoo1e+NCQ==",
-      "signed_at": "2026-05-31T10:22:24.330Z"
+      "signed_at": "2026-05-31T13:44:05.273Z"
     },
     {
       "name": "webapp-security",
@@ -1366,7 +1366,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "4ccahkJpGJZtwD7EBpnGcN0sEGPMEw8eqV+tvePVS04YAkLgYVWtlkasI/8n0be9xB+77x+Sjj3kIi2j2Lf9CA==",
-      "signed_at": "2026-05-31T10:22:24.330Z",
+      "signed_at": "2026-05-31T13:44:05.273Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1419,7 +1419,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-05-31T10:22:24.331Z"
+      "signed_at": "2026-05-31T13:44:05.273Z"
     },
     {
       "name": "sector-healthcare",
@@ -1479,7 +1479,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "U04GNLyRas1VmfEsB8khH4iqFZPwx96sPY0Kw9iVsSPU+KTeEFqwgtWK1X1pzgb+T16Pc7HSrCaXDOpTFvQEDw==",
-      "signed_at": "2026-05-31T10:22:24.331Z"
+      "signed_at": "2026-05-31T13:44:05.274Z"
     },
     {
       "name": "sector-financial",
@@ -1560,7 +1560,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "xbylLqNPBuEsFE/MNVeGy/01K6yiJXMxQbzC1F4RWU5aseDGbNy5HrAv2JWI2+Aft05ozreNPjccvu66yJ5EBw==",
-      "signed_at": "2026-05-31T10:22:24.331Z"
+      "signed_at": "2026-05-31T13:44:05.274Z"
     },
     {
       "name": "sector-federal-government",
@@ -1629,7 +1629,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "C9c3JuBhUbwcb7uZpDdy+PNT8sYmYIxzD4uRHu421ePW1aSFJ8fkMvuTzSO8vD/F/jOOg5opM4kov/xSAn+qCg==",
-      "signed_at": "2026-05-31T10:22:24.332Z"
+      "signed_at": "2026-05-31T13:44:05.275Z"
     },
     {
       "name": "sector-energy",
@@ -1694,7 +1694,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "oz8Q5WVaY8au4IjbaZahx/DSaC00Q44ylSL3mDkTerCEpW/EyPUeiLeGxSrWxBCwVFEKSSJvnhJjhvX5lDPcCg==",
-      "signed_at": "2026-05-31T10:22:24.332Z"
+      "signed_at": "2026-05-31T13:44:05.275Z"
     },
     {
       "name": "sector-telecom",
@@ -1780,7 +1780,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-05-31T10:22:24.332Z"
+      "signed_at": "2026-05-31T13:44:05.275Z"
     },
     {
       "name": "api-security",
@@ -1849,7 +1849,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "1UTjZNC5Lyrgw93LAizdXVeSmv3jS8YQNT1db5OKsldub50+o1FXmAH4+3MxZozaOGDCX3yXbdDJSJaaSmfuAA==",
-      "signed_at": "2026-05-31T10:22:24.333Z",
+      "signed_at": "2026-05-31T13:44:05.275Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1935,7 +1935,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "EdsY4xe7YA8X8m+KZUbq49JwoCXgRKEz2eg3m86O37rvBmpm8ppvl9hrsekygvpBh2VmCHL2dEYiOD8OM2n7CA==",
-      "signed_at": "2026-05-31T10:22:24.333Z"
+      "signed_at": "2026-05-31T13:44:05.276Z"
     },
     {
       "name": "container-runtime-security",
@@ -1997,7 +1997,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "fnLKPLkjjRCJ/F9wdmZ1w1lXmqEJvTYkv6Uu+9OTd5vZTWKz3QMuxKOsas+ctCdOvTaeloqPUUprXx+ZZdDpCg==",
-      "signed_at": "2026-05-31T10:22:24.333Z",
+      "signed_at": "2026-05-31T13:44:05.276Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2071,7 +2071,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "t3dkdpTX04zvjitEeOJThpgjurLd1UO9GOut4LXSZgY3ULhfknI4zT7G5+m2RSZZTo7yyeZrwpg+7vEg9K6mAw==",
-      "signed_at": "2026-05-31T10:22:24.334Z"
+      "signed_at": "2026-05-31T13:44:05.277Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2133,7 +2133,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "+1kmtA6rAvIyDjjy+cJHK6BcfylyVsa5cUjRFijlFR9GsQfB93JnmkEJOqML50pdlcxtJI3yUodHpL3/YJGtCA==",
-      "signed_at": "2026-05-31T10:22:24.334Z"
+      "signed_at": "2026-05-31T13:44:05.277Z"
     },
     {
       "name": "ransomware-response",
@@ -2213,7 +2213,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "h48ASCz63aBfHzLKxMVDADMuT4atriK0iE6bJeVzZTsx/e8+hyv4fLP7+zYxT9Oe0Gss3v/Xy+t+Wd9uwzV+Aw==",
-      "signed_at": "2026-05-31T10:22:24.335Z"
+      "signed_at": "2026-05-31T13:44:05.277Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2266,7 +2266,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-05-31T10:22:24.335Z"
+      "signed_at": "2026-05-31T13:44:05.278Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2334,7 +2334,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "ZHVdGWCcfG98tSVB0b9mwrsYwv71V3uUEl+6ss7omSQhmNvqV5s6MAZM5YladBt9MK/8T/zBrTYN4gAonOP+BQ==",
-      "signed_at": "2026-05-31T10:22:24.335Z"
+      "signed_at": "2026-05-31T13:44:05.278Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2414,7 +2414,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-05-31T10:22:24.336Z",
+      "signed_at": "2026-05-31T13:44:05.278Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2508,7 +2508,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-05-31T10:22:24.336Z",
+      "signed_at": "2026-05-31T13:44:05.279Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2526,6 +2526,6 @@
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "ZU/5nhmMlrcEw7gL1fKWdlP5dS70Zyejvg7NA5SbrHl6zm+Tmt6FHwpscYFECUxolA/NUF+TdiVhl0fD9eeNBw=="
+    "signature_base64": "9MIdPB08VWnw0f+NDDdxyGxHzDud1B7bKh254BjU2BiKwQJCZcPtPQW71uRis6dUEY0hw0wqO9qn22diOGW4DA=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.16.0",
+  "version": "0.16.2",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (427 CVEs / 173 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:9bd47470-c59d-4f51-b994-359ef144b4eb",
+  "serialNumber": "urn:uuid:4752c4e2-772e-4f4c-9ed6-bedf928c0044",
   "version": 1,
   "metadata": {
-    "timestamp": "2108-11-06T03:58:40.000Z",
+    "timestamp": "2063-12-02T14:44:50.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.16.0"
+        "version": "0.16.2"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.0",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.2",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.16.0",
+      "version": "0.16.2",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (427 CVEs / 173 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.0",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.2",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1fada9c18f8669821ff1c4a85f283538532fe158641f1029dbf3ddf56a4e04be"
+          "content": "9ba5f84082546fa2a8523fa41a1f5caa9ce2978d7c16c943341f35b1686b73de"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.0"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.2"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e4a1351eb6f5f70afe3ab2de9241579da509a28a4c8511b22b0ad892b49e9c94"
+          "content": "a924b909abf3a042ff642ea9ad1cfbe07577dae879ca1f512459253cd3138bf3"
         },
         {
           "alg": "SHA3-512",
-          "content": "02f1973ac20ca085fdbd22c0e15f178f72511c89eaf55acf454bbe3b03969ce96321c4ac27d2499ecdf4b8eaed46984fd4338d1239fecf1b856b4d3558dff4a2"
+          "content": "ea63d0e7fd908de2bf34f3cad9d1b9013d83eda82f16e13e5be4bc3369284a804c1577fd26675dc6c7d0cd46457e958cb5218cdfad49db70188761786f12b2ff"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d0ca92931278d72229edb9f2526157f2832df1d97cd7e8440a0a841f8b1c664d"
+          "content": "7652b6863ed764de02edbed786010c58b850cf3557424fb80b97ac59fb002b88"
         },
         {
           "alg": "SHA3-512",
-          "content": "93377a5256af65b898ffda3586e081e64f6bb3d820305b6995dd37f022857a66e929bec0c167fed5aed5c5b18a8dec7e7e4214b3d5cfacea32e93dc8065f01c0"
+          "content": "a49f8902aa16f1962c9fb174ee67d0e3498f62bd31e3cee283213a3165fe1c3ccef6ada82fa1814314181301efddd47795708c13e300d6542acea1f2f63d5b70"
         }
       ]
     },
@@ -986,11 +986,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fab85a30545da2a8c11f0f0c237d5542a5a69ed51e8247838d62194a8744be45"
+          "content": "89e1af2e38e973b4bcfbb243cb1a7d4e516b70a7532bc424ba8478b4bcefd38f"
         },
         {
           "alg": "SHA3-512",
-          "content": "d089026d4d16a36dcd20dd912ac2907d83df4ca3be31ac3d68c27a9e98de4460adb90640e4cc5ce082384fb9933f0d2b3c43b247c8247f6614086e24a6deab1c"
+          "content": "62d28a0a92cd9d9ab406f8da199da9bffecdb658e2ed3e783eab65f6451d366a5efad08f457795013b6794e404d3e0769eef24b230693a6b253baf0695138d16"
         }
       ]
     },
@@ -1046,11 +1046,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "adacaf29b1359d15de4974508b06f41da7811aa9602fc56b724ddc01b9211938"
+          "content": "abeebd15724807f2ef65f05d307ed494dc8eac0840253f609c8aca9bfca2bbeb"
         },
         {
           "alg": "SHA3-512",
-          "content": "c4d98ecbc6bc8a897a37e0ae7d5883c71816b3665e2c20a313955b3e0917f81657851c61790dc793c28bf85937d07be2623311a54cfa1c5823bcdaf9d9221c2f"
+          "content": "21a8ece085ce531dcc42ce8fcdf15af902248f1d9c3fef23ecbfa3ea3954a221094bd444ba1550a5f0a3dc1047a9f2168285448bcb07e93f8c5d5a2b3fc0006a"
         }
       ]
     },
@@ -1061,11 +1061,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1b6f614c62b528e159eb325f2e4326749d89f96add26c2133a63fb3e7746382b"
+          "content": "cf0e484c3408109e08bbffb39aa086a0aca4abc25755a9c552123932ac929732"
         },
         {
           "alg": "SHA3-512",
-          "content": "78816fe42de6d9773b91dfd68abba8c8681f099a8a12e300a3f1b0b4e63f8f43cf4c0260e9404df61bbe18c7ae4960ff61e5dc17be61e065ac576a9605b06413"
+          "content": "5dab01679ff6af54a6a0a4f99f7710c8ac1cc3a52c2f5c03276cfec864f9ff16dded4b038365542f21a23e0feb274bbdc15fd747ba75abdf4f662c3c415f7e93"
         }
       ]
     },
@@ -1091,11 +1091,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d4827e59ab53b0c578890a9b49477efdd74dbf9bec24748346bbffc3c1d6424c"
+          "content": "34fda7d5db51c9d2d7d876881718cea6c3708a6c1feac34e85d6c36b1095e77a"
         },
         {
           "alg": "SHA3-512",
-          "content": "7dd94b35e3b368dde731dcc749b7eb51be38847b0a18b80c59b12142726253acd8841c0a6cb077d0a8531d2082c5918b772a4b860643e208f6c1ba008324f933"
+          "content": "fe4c34459bf018b82f1c852c7b70b0d4d1514f879db1c2b523e0bfde015b3c0acac446825b4b25b827e5d47139146eb1f99b39ba0dd921fe82c4c0542fab709b"
         }
       ]
     },
@@ -1316,11 +1316,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f9452a58e4916a512b61ac8c6179dff6162f3634cf766b129d521233daec3c0e"
+          "content": "1c8816242c3d8457b5241f727af7dd34b7bd1e1e9b9494c8d09fe1931de19857"
         },
         {
           "alg": "SHA3-512",
-          "content": "d6ebf5ffca3fee2398034f411eb477d393e8ee8a7f12ed576e72f0e785c42b37e760fb743bf47d0a4c704c71f726ba56e373fbd4149e2750c00ee89e8af74efe"
+          "content": "01e84ca9d3b442b0c32075e5c6446b871abbb69e144c8413148074761274156706aaaac9ef8c5b78609db9f764a2d4d7cae9f10ac3502ee91dfee22da956d30c"
         }
       ]
     },
@@ -1751,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b2470edc747a7cb7f4d2d31e94bccead4ac79a5b605ea67ef12757c9353c186d"
+          "content": "09e4b71506de2c73f64372d2e4359a24082402240ba86e3a34fcc6299c9e08e2"
         },
         {
           "alg": "SHA3-512",
-          "content": "fe54afcaf4a2e0fff7b9d338f235b7d1227547f8f395b5b3b0d3d8bbf7ddb95d4ed7f08d1ef3b8ab6525c478465292597ccb0c781e1ba468f5fc15bb01fbbc08"
+          "content": "748c105082a43ae8fa7a74c776764d2ba4306ae15989417968023bfb8a91198b0ffebbe8b4bfa0227b141f4f09ffa2dff4f772e700373712d5235aade63b6201"
         }
       ]
     },