@blamejs/exceptd-skills 0.16.17 → 0.16.19

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:8d18b72c-cb47-426d-bcda-c48809ae85ac",
+  "serialNumber": "urn:uuid:6bc84615-0603-46c8-a498-a0dc5a399034",
   "version": 1,
   "metadata": {
-    "timestamp": "2101-01-06T05:33:32.000Z",
+    "timestamp": "2083-04-21T06:00:53.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.16.17"
+        "version": "0.16.19"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.17",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.19",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.16.17",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 49 skills, 11 catalogs (439 CVEs / 176 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.16.19",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.17",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.19",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "956430b4033bf0be36d88f0f0feb2f233fc1d9d58444f914edeac5ea45e1a81d"
+          "content": "a3b2fa14f7bfa9c8fb46f2cde3b8d077ce5b31e87455aa938b788c7409e56def"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.17"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.19"
         },
         {
           "type": "vcs",
@@ -54,7 +54,7 @@
       },
       {
         "name": "exceptd:skill:count",
-        "value": "49"
+        "value": "51"
       },
       {
         "name": "exceptd:integrity:method",
@@ -86,11 +86,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a2c4712be394f75a51d707e4e9b6e1ad13812d90cc2e64d4fe7bdec172d7d5ee"
+          "content": "4740bf09effd467a73a8e83ecebab2b70ef6a3c1d67bcf8ec136acb7dcb5544c"
         },
         {
           "alg": "SHA3-512",
-          "content": "6f2a34e1f5a8d4a677605a29cb214b3b6bd6aaad1bb53cfdb81c7be8d7a94711769461becd0494b71c8ab9a6be946238104adf3cefe904e52088d7df5f42c2e9"
+          "content": "97916b726fca2bac91639fad98c8793298259cbb7a90cf4e7afcdd5a4f9fd12b48af6520e7e7d0021fb99705c213a02cf583555c4b0aa9f091c3f5d26d12da9e"
         }
       ]
     },
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a7bd7077b36d8e4e769ab756f6d66de3621bd4e6642fbe738d6734d7bbc0e8a9"
+          "content": "ca60373ee55644311ead97a32ed797b010b27bc0965c69107bac882bec7ee569"
         },
         {
           "alg": "SHA3-512",
-          "content": "21a9f1e1950d3e997adef582db4a36ca86b4a6d178f4a5104140345d2d0cb7a1e176e338424fa4873ad81e84ea7d4eecdb0047ff496a433c2283dd07ad89ee43"
+          "content": "c1afb76a548ea3a5fbc54866d15776b5501f1d04f47261491e7eeaced2945ce5e3d6977f2b3265897b3ee5bf306da2c2898e8670d0cc0f36bc0e2786dfd86139"
         }
       ]
     },
@@ -176,11 +176,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "39f76631b7601dd9843f138ca9fc3acc2321520973a5a6949eb4c107d4a27630"
+          "content": "81ca9d3388220ac98069b35a594e915e6a6c95f047467f26d75d89d0c917684c"
         },
         {
           "alg": "SHA3-512",
-          "content": "76bb403641849041b610088e1011ff53d408444d9ba1ea977569321d1181acdcbb32e2dbf9a406e607e30634c7bd937401ea592d6a7261a9caa59497fd876d90"
+          "content": "cd0bed4f8dd100c272b20d7aecad64d09b9d65dc07551aec2f61ee20aae55978cf1c300ede8bac15d10ed9bbf8ea180aa48dfe3d951497527ee17440da1a696f"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "358cb7123fe73316f4f60dee36ffee1648306859f9663639f028a1db72ba8107"
+          "content": "9bcb27a03b259ed458da11b2d8396a1cada67c3c5b3d258945ee2eb031dd3069"
         },
         {
           "alg": "SHA3-512",
-          "content": "37dcf16d413d740e37d7cfc29431da7cbc3baab08a86e3851746151e8b25e0d14e969e88cb6fe95a78559713d856d9edd31676ee49cb8f4d3ccfb1c50445e9d2"
+          "content": "08c6edcbf777a74bf40f5907a279ebbbce8a886498dfaf37700749609cae23a120061a9f86b0f700f5218d046dfed318445997099f69771ed15b40c8009536e0"
         }
       ]
     },
@@ -341,11 +341,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b786fc196243b7d4c3d1f035e0d5cfb55dad8db30c326649be3031facc7a3358"
+          "content": "feadd8497221c097d8237fb93d9557c4dbdd70434097da8debd6f5e50ede1b24"
         },
         {
           "alg": "SHA3-512",
-          "content": "eb57a22b882770d40b12b28d3902f580742024c6434212281711434e70b1c5ec86b84afcf4a77548342015f118c4cca40a3603a916f6ab746e110ed837faa620"
+          "content": "97119842846c95f910bb1b9ef9ba9b36ebe5d9abe4461c22f9d2ccfda676082d606e2348535416da6e14841ffe4173a0b7399f64adbae9829a2e00eed32ec3c2"
         }
       ]
     },
@@ -461,11 +461,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0ed3f7e7eb38c7c6c21335de82fea68a7392de298d7d407fd2ce9f41cd94d87d"
+          "content": "add0916cbecb3c4e0481a544ab1fc6d6b03627f6b2014a4165d28c5e55910cf3"
         },
         {
           "alg": "SHA3-512",
-          "content": "2199f512f25067b732318e1aa8bb4418b50800e5bd8c7cd230da991733ca7ebd388429e1ad15a84708ed0e1b958cb0257fe0c44624b90b136ce4ab73ad787949"
+          "content": "a513e1065f7c644b99eb31d8d08aa15dc3dbfce38ce0171ea121c9b9c96ed5d9086be8d6d0b096a0add570e471462c9587b46298aa9db3c9fb33a81d0d531b3a"
         }
       ]
     },
@@ -596,11 +596,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ffefadc9227587d5ac2ca864c75e817e0b701a631616a5173321cce3065b480a"
+          "content": "6f74bc9a8b5dd04a18931644101d0860b968ba13512f7d5f6b36282b4119978d"
         },
         {
           "alg": "SHA3-512",
-          "content": "824f9bfa20b9e70577f6755d56685803eebb40b9683b192d0a539198468f76b6847e8e47194452a64410e430b3e418e4fabf039f56a6213e2a8eebdef9bc1668"
+          "content": "bed2d8d1e9f210afa4ec9b101a27d9e7b7d84f4e724194bad131ef83d231c0b158c5b0dc30fcbb7415062aadd7f8568e2390c204823b8b13b96044bb324c6654"
         }
       ]
     },
@@ -694,6 +694,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:data/playbooks/log-injection-telemetry.json",
+      "type": "file",
+      "name": "data/playbooks/log-injection-telemetry.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "bf1e61d9bba54722e466d6e2d186137337379c148c82e06380dae24f24a1008b"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "09b0cc1faee50235b7d0d5d2f42f25dbbf288f1ed5310d3bb5660a2b2cefd3b868a506c30335e6b7ab3f2a4b1927b468d1c83c0388607f56aacef0639c70ea8d"
+        }
+      ]
+    },
     {
       "bom-ref": "file:data/playbooks/mail-server-hardening.json",
       "type": "file",
@@ -769,6 +784,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:data/playbooks/privacy-consent-ops.json",
+      "type": "file",
+      "name": "data/playbooks/privacy-consent-ops.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a1545f8028ffd100d8d2ab52099196a2d200d593f07916e71ba5e5a27b817a38"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "94431fca8e351cf2af3f409c4494358500087d7baade07896d4ab2b19b3c45b74ec6e50ab2e9a79bcd3a7ab54808811669dce6d6775b8eccbf4b010960e818e1"
+        }
+      ]
+    },
     {
       "bom-ref": "file:data/playbooks/ransomware.json",
       "type": "file",
@@ -821,11 +851,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1bca35c4d562eb32bf3893b3e978396fad102bdb9e2a2b28189f8940ff3e7a56"
+          "content": "468a961bf742b16acc2b0b33836d2c23cab00a137a24f52b6f3c38b10cb8e9de"
         },
         {
           "alg": "SHA3-512",
-          "content": "239148333b803245899425506b76255cfd0327bda7e0339905c62d599f59ede8cfacc37e4f75cecf5c0a8dc9f3122ce010d4bc1b409928bc1198e7e634ba545d"
+          "content": "4ce105608fefd603bb493ad2d02c24279110c39011b5392cf2f218c2db2fbc22c86e3a3d1de24af3bc6319447599557df88be6c728cf8f81af86ad028458f58a"
         }
       ]
     },
@@ -1826,11 +1856,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "af6f9c0b8f1276ef1cd33ce3eebef3154e945505b287d896c703dfa2c1af6396"
+          "content": "faa01f939b1473c436cd81d614612593e92034e1119518e4e44f61e37b35de8b"
         },
         {
           "alg": "SHA3-512",
-          "content": "88d7e454148cbd61a9821d863f073a783978aec18fd93c49e3405802b9dcda30d877bc3cdc9e20f36866801b643cee58d97a209327176982b9e8434211b59c55"
+          "content": "5b84120225b544abcbfd2e87555b71293105c843fe2595c7b0fc4f92c78e3a39291e6a92600d1bbf0fd3ce09de9968799686a8a23555ceb63d17dd56d0162f58"
         }
       ]
     },
@@ -1841,11 +1871,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4d7d636ad87d5da56f95f06c0925de1d8adc11ad1b9ccd6d5d7f81fc46a5ceb9"
+          "content": "99279ed5a5a7ddb3f00e639b956a83bb2df492288db176f4c3d55dc498949c17"
         },
         {
           "alg": "SHA3-512",
-          "content": "ba35418839bcd69af47c0956e8b053be2dbb2b70ec7b0897fbe8dc2062d9ce09f7ec876f8da1c53734a9d8e86a1e511a9146dbf4a8b0d93e5a8f880b0c988f9c"
+          "content": "3bb717a033303c961161784e1fd4da815da62106baaf62863c3f6e950b600cd36fb3faba663e49add7853f13137789ccad7884034a7638d11a15706548ec03a5"
         }
       ]
     },
@@ -1856,11 +1886,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1bf6dd331b3a42de063b0045ac65ca50ca34609a829050b6754a95490221f310"
+          "content": "7b4d7758ddd3db55f2abb0b09a2985fb7f8e99e34f5bf1c90f3e4c044aa3dfab"
         },
         {
           "alg": "SHA3-512",
-          "content": "6cd43e1f08f91c8a58aaeac75622a084ebc3b0e371fc1f4e2b5e35cf109146984197704db0800405247bac5a4ce41c5f4dcd2f2e6fd4f842a610cf045e99d6cb"
+          "content": "2546ddb0470d1f13208d983cd7b16aafa1c28da6837200abc9abd3116200f393b03fc7fa075519235a12f0132e65530a713a908f00e922f48a9187e816839431"
         }
       ]
     },
@@ -3019,6 +3049,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:skills/log-injection-telemetry/skill.md",
+      "type": "file",
+      "name": "skills/log-injection-telemetry/skill.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "69c4e65c6f78703b923c2455a5ecf5a6d79fcc28d56fff57acb2605639231104"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "5bc5fb49f8c899647a1dea53c657f96a712b7c1e2dc20416152a3a28a9573fd46201310514f4c64c0495519bf24247477fff59083e7f920dfe7ea77bfa2ff8d6"
+        }
+      ]
+    },
     {
       "bom-ref": "file:skills/mail-server-hardening/skill.md",
       "type": "file",
@@ -3139,6 +3184,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:skills/privacy-consent-ops/skill.md",
+      "type": "file",
+      "name": "skills/privacy-consent-ops/skill.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "6c14052577178f0cffc943c2d7f1ac2aca6704cca912ce7492d9eac88a1c6d88"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "8f39f408d80a2ee83d874c50308facb8722f57c8be26b01255e032949f7e40d41ce2464dd48f1b9b99adad9006c22c0254338faf6a41ee17c4fa054dee60a304"
+        }
+      ]
+    },
     {
       "bom-ref": "file:skills/rag-pipeline-security/skill.md",
       "type": "file",

package/skills/log-injection-telemetry/skill.md

@@ -0,0 +1,80 @@
+---
+name: log-injection-telemetry
+version: "1.0.0"
+description: Telemetry-pipeline integrity for mid-2026 — CR/LF log-injection neutralization across every sink, secret/PII redaction before shipping, authenticated metrics endpoints, and exporter destination allowlisting, secret-store credentials, verified TLS, and webhook SSRF guarding
+triggers:
+  - log injection
+  - crlf injection
+  - log forging
+  - telemetry integrity
+  - secrets in logs
+  - log redaction
+  - metrics endpoint exposure
+  - prometheus exposure
+  - otlp exporter
+  - cloudwatch
+  - webhook sink
+  - exporter ssrf
+  - observability security
+  - log sink
+  - telemetry exfiltration
+discovery_mode: standalone
+data_deps:
+  - cve-catalog.json
+  - atlas-ttps.json
+  - attack-techniques.json
+  - framework-control-gaps.json
+  - cwe-catalog.json
+  - rfc-references.json
+atlas_refs: []
+attack_refs:
+  - T1565.001
+  - T1530
+  - T1213
+framework_gaps:
+  - NIST-800-53-SI-2
+  - ISO-27001-2022-A.8.15
+  - NIS2-Art21-network-security
+  - UK-CAF-B4
+  - AU-ISM-1556
+cwe_refs:
+  - CWE-117
+  - CWE-532
+  - CWE-918
+  - CWE-200
+last_threat_review: "2026-06-02"
+---
+
+# Telemetry-Pipeline Integrity (Log Injection + Sink Confidentiality)
+
+## Threat Context (mid-2026)
+
+The telemetry pipeline is both an integrity target and a confidentiality leak that "we centralize all logs" does not address. Integrity: un-sanitized CR/LF in interpolated log values lets an attacker forge or split log entries — injecting fake lines, breaking the log parser, or hiding their own actions — corrupting the observability record incident response depends on. Confidentiality: secrets and PII logged without a redaction pass persist in every downstream sink (SIEM, cloud log service); an unauthenticated /metrics or debug endpoint leaks internal topology and operational state; exporters (OTLP, CloudWatch, webhook) that ship to un-inventoried or input-derived destinations become exfiltration and SSRF channels; embedded sink credentials and plaintext export widen the exposure. These are pipeline-posture gaps, not log-volume gaps.
+
+## Framework Lag Declaration
+
+Organisational logging controls require events be recorded, centralized, and access-controlled. NIST 800-53 AU-9 (protection of audit information) is attested by access controls on the log store and does not address CR/LF log injection that forges entries before they reach the store. SI-11 (error handling / output neutralization) is named generally but not operationalised as per-sink CR/LF neutralization or secret redaction. ISO 27001 A.8.15 is met with "we log and protect logs." None address telemetry-exporter egress, SSRF, or unauthenticated metrics. A clean "we centralize logs to a SIEM with access controls" audit is therefore NON-EVIDENCE for telemetry-pipeline integrity; it confirms log presence and store ACLs, not neutralization, redaction, metrics auth, or exporter posture.
+
+## TTP Mapping
+
+The telemetry-pipeline failures map to MITRE ATT&CK: **T1565.001 (Stored Data Manipulation)** for CR/LF log forging that rewrites or splits the audit record; **T1530 (Data from Cloud Storage / shipped telemetry)** for secrets/PII leaking through logs, exporter exfiltration, and webhook-sink SSRF reaching internal services; and **T1213 (Data from Information Repositories)** for an unauthenticated metrics/debug endpoint disclosing internal state. The weakness classes are CWE-117 (improper output neutralization for logs — log injection), CWE-532 (insertion of sensitive information into log files), CWE-918 (server-side request forgery — exporter/webhook egress), and CWE-200 (exposure of sensitive information — unauthenticated metrics).
+
+## Exploit Availability Matrix
+
+These are pipeline-posture gaps, so the exploit is the absent control. CR/LF log injection requires only a request field that reaches a line-oriented sink un-neutralized — trivially reproduced. Secrets in logs are harvested wherever the logs land. An unauthenticated /metrics is a single unauthenticated GET. A webhook sink pointed at the cloud metadata endpoint is an SSRF with commodity payloads. The real-world priority is set by whether secrets/PII leak across every downstream sink (credential/PII breach), whether the audit record can be forged (defeating incident response), or whether the telemetry process can be turned into an SSRF channel to the internal network or metadata service.
+
+## Analysis Procedure
+
+1. Enumerate every log/trace/metric sink and exporter, and every metrics/debug endpoint. 2. Confirm each sink neutralizes CR/LF + control characters in interpolated values (or uses a structured format that cannot be line-split) — note any sink other than syslog that does not. 3. Confirm a redaction pass strips secrets/PII before values reach any sink. 4. Confirm metrics/debug endpoints require authentication or are bound to a private scrape network. 5. Confirm exporter destinations are an inventoried allowlist (not input-derived), credentials come from a secret store, and export uses verified TLS. 6. Confirm webhook sinks allowlist their URL and refuse private/link-local/metadata addresses. Run the `log-injection-telemetry` playbook to execute these as detect indicators with false-positive checks, then score by leakage breadth, audit-record corruptibility, and SSRF reach.
+
+## Output Format
+
+Report per sink/exporter/endpoint, marking each control enforced / missing / inconclusive (visibility gap). For every missing control, state whether it leaks secrets/PII across sinks, allows forging the audit record, or enables exfil/SSRF from the telemetry process, and whether the surface is internet-reachable. Distinguish a control enforced at a lower layer (a sanitizing collector/sidecar, a private scrape network) from an absent one. Provide the prioritised remediation (neutralize CR/LF + redact per sink, authenticate/private metrics, allowlist exporters with secret-store credentials over verified TLS, SSRF-guard webhook sinks) and the negative validation tests (CR/LF neutralized, secret redacted, metrics requires auth, webhook SSRF blocked) plus a functional test that legitimate telemetry still flows.
+
+## Compliance Theater Check
+
+The recurring theater is "we centralize all logs to a SIEM, so logging is handled," "the log store has access controls, so logs are protected," and "our metrics are internal-only." Centralization is not integrity or confidentiality; store ACLs do not stop injection at write time; an "internal" /metrics is often reachable via a default all-interfaces bind or an exposed ingress. The distinguishing test: inject CR/LF into a logged value and check for a forged line; log a secret and check redaction; reach /metrics unauthenticated; inspect exporter destinations, credentials, and TLS. If forging, secret leakage, or exfil/SSRF succeeds, centralization did not protect the pipeline and the assurance is paper.
+
+## Defensive Countermeasure Mapping
+
+Map findings to MITRE D3FEND: per-sink CR/LF neutralization realises Message Encoding / Output Neutralization (countering T1565.001 log forging); secret/PII redaction realises Sensitive-Data Scrubbing (countering T1530 leakage); metrics-endpoint authentication realises Network Traffic Filtering and Authentication Enforcement (countering T1213 disclosure); exporter destination allowlisting, secret-store credentials, verified TLS, and webhook SSRF guards realise Outbound Traffic Filtering and Resolution-Trust (countering T1530 exfil / SSRF). Pair the redaction pass with the dlp-gap-analysis skill for the broader data-egress picture, without duplicating its LLM/RAG focus. The residual risk is the inherent sensitivity of telemetry held in a legitimate access-controlled store, accepted at the CISO level.

package/skills/privacy-consent-ops/skill.md

@@ -0,0 +1,80 @@
+---
+name: privacy-consent-ops
+version: "1.0.0"
+description: Privacy, consent, and sanctions operational integrity for mid-2026 — confusable/homoglyph normalization before sanctions screening, integrity-bound and re-validated consent records, evidence-gated and downstream-propagated DSR erasure, and ROPA reconciliation against actual processing
+triggers:
+  - privacy operations
+  - consent integrity
+  - sanctions screening
+  - ofac screening
+  - homoglyph evasion
+  - confusable normalization
+  - iab tcf
+  - mspa
+  - consent string
+  - dsr
+  - right to erasure
+  - right to be forgotten
+  - gdpr article 17
+  - ropa
+  - record of processing
+  - data subject request
+discovery_mode: standalone
+data_deps:
+  - cve-catalog.json
+  - atlas-ttps.json
+  - attack-techniques.json
+  - framework-control-gaps.json
+  - cwe-catalog.json
+  - rfc-references.json
+atlas_refs: []
+attack_refs:
+  - T1036
+  - T1565.001
+  - T1070
+framework_gaps:
+  - NIST-800-53-SI-2
+  - NIS2-Art21-network-security
+  - UK-CAF-B4
+  - AU-ISM-1556
+cwe_refs:
+  - CWE-807
+  - CWE-345
+  - CWE-778
+  - CWE-672
+last_threat_review: "2026-06-02"
+---
+
+# Privacy / Consent / Sanctions Operational Integrity
+
+## Threat Context (mid-2026)
+
+Privacy and sanctions controls fail operationally even when they exist on paper. A sanctions screen that compares raw strings is evaded by a listed name spelled with confusable Unicode (Cyrillic/Latin lookalikes, combining marks, zero-width characters) — or simply by an alias or transliteration the screen does not cover. A consent signal (IAB TCF / MSPA or first-party) trusted from the client with no integrity binding to a server-side consent_log is forgeable and stale-by-default, and continuing to process on a cached signal after withdrawal is unlawful. A data-subject erasure marked "completed" without per-store proof, and not propagated to backups, indexes, warehouses, and processors, leaves live personal data behind while the organisation asserts compliance. A ROPA that drifts from actual processing hides flows that escape the consent/retention/DSR analysis entirely.
+
+## Framework Lag Declaration
+
+Organisational privacy and sanctions controls are attested by having the process — a screening vendor, a consent banner, a DSR queue, a ROPA document. NIST 800-53 SI-10 (input validation) does not require Unicode confusable normalization before a sanctions-screening decision. ISO 27001 A.5.34 (privacy / PII) is met by having consent and DSR processes and does not require the consent signal be integrity-bound or the erasure be evidence-backed and propagated. A clean "we screen against OFAC, capture consent, complete DSRs, and maintain a ROPA" audit is therefore NON-EVIDENCE for operational integrity; it confirms the processes exist, not that screening normalizes confusables, consent is server-bound and re-validated, erasure is evidence-gated and propagated, and the ROPA matches reality.
+
+## TTP Mapping
+
+The privacy/sanctions failures map to MITRE ATT&CK: **T1036 (Masquerading)** for a prohibited party spelling a sanctioned name with homoglyphs or an uncovered alias to evade screening; **T1565.001 (Stored Data Manipulation)** for forging or replaying a consent signal with no authoritative record, and for an erasure status falsely marked "completed"; and **T1070 (Indicator Removal)** for claiming erasure that removes the compliance indicator while live copies survive downstream. The weakness classes are CWE-807 (reliance on untrusted inputs in a security decision — unnormalized screening input), CWE-345 (insufficient verification of data authenticity — unbound consent), CWE-778 (insufficient logging — unevidenced erasure / drifted ROPA), and CWE-672 (operation on a resource after expiration — processing on withdrawn/expired consent).
+
+## Exploit Availability Matrix
+
+These are operational-integrity gaps, so the exploit is the absent control, reproduced with trivial means. A homoglyph-spelled sanctioned name is a copy-paste with lookalike code points; an alias variant is in the sanction list's own alias data. A forged consent string is a crafted request when no server record reconciles it. A falsely-completed erasure needs no attacker at all — it surfaces on audit or a re-request. The real-world priority is set by whether a prohibited party can clear screening on a live onboarding/payment path (regulatory + legal exposure) or whether personal data is systemically unlawfully processed or un-erased across the data estate (false compliance at scale).
+
+## Analysis Procedure
+
+1. Inspect the sanctions screen: does it normalize to a confusable-folded skeleton (NFKC + Unicode confusable folding) and apply the list's aliases + transliteration + bounded fuzzy match before deciding? 2. Inspect consent: is the signal integrity-bound to a server-side consent_log and re-validated (purpose, expiry, withdrawal) at processing time, not just capture? 3. Inspect DSR erasure: is "completed" gated on per-store deletion evidence, and is erasure propagated to every downstream copy and processor on a maintained data-map? 4. Inspect the ROPA: is it reconciled against actual data flows / processors on a cadence? Run the `privacy-consent-ops` playbook to execute these as detect indicators with false-positive checks, then score by prohibited-party admission risk and the breadth of unlawful / un-erased processing.
+
+## Output Format
+
+Report per control (sanctions screening, consent, DSR erasure, ROPA), marking each enforced / missing / inconclusive (visibility gap). For every missing control, state whether a prohibited party could clear screening, whether personal data is unlawfully processed or un-erased, and the affected population. Distinguish a control enforced by a dedicated layer (a confusable-folding screen, a consent platform, an evidence-gated workflow) from an absent one. Provide the prioritised remediation (normalize + alias/fuzzy screen, server-bind + re-validate consent, evidence-gate + propagate erasure, reconcile ROPA) and the negative validation tests (homoglyph name screened, forged consent rejected, erasure-completion gated) plus a functional test that legitimate parties, consents, and erasures proceed.
+
+## Compliance Theater Check
+
+The recurring theater is "we screen all parties against OFAC," "we capture user consent," and "erasure requests are completed." The distinguishing tests: submit a Cyrillic-lookalike spelling of a listed name (if it passes, the screen compares raw strings without confusable normalization); ask whether the consent signal is server-bound and re-validated (a client-presented string with no record is forgeable and stale); ask for the per-store erasure evidence and the downstream-propagation map (a "completed" flag with no proof leaves records live in indexes, backups, and processors). If any control reports success while the obligation is unmet, the process is paper and the verdict is theater.
+
+## Defensive Countermeasure Mapping
+
+Map findings to MITRE D3FEND: confusable-folding + alias/fuzzy screening realises Input Normalization and Identifier Reputation Analysis (countering T1036 evasion); server-bound + re-validated consent realises Authentication-Token Verification and Stored-Record Integrity (countering T1565.001 forged/stale consent); evidence-gated + propagated erasure realises Verifiable Deletion and Data-Inventory Mapping (countering T1070 false-erasure claims); ROPA reconciliation realises Asset/Processing Inventory accuracy. The sanctions-normalization control reuses the vendored Unicode confusable / codepoint-class tooling. The residual risk is a novel transliteration the alias list does not cover and a processor retaining data outside the data-map, accepted at the CISO level with periodic re-reconciliation.