@blamejs/exceptd-skills 0.16.20 → 0.16.22

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.16.22 — 2026-06-05
+
+When the automated external-data refresh applies a CISA KEV listing change to a catalog entry, it now updates the entry's RWEP factor and score in the same write, honouring whichever factor shape the entry stores. Previously only the flag flipped, leaving the stored score failing the factor-sum invariant the catalog enforces — the first real KEV listing the refresh applied surfaced this as a 25-point mismatch. A first listing also now carries its KEV date: the drift check emitted a date change only when the local entry already had one, so a newly listed CVE arrived dated null. The refresh workflow's post-apply gate now runs structural validation (catalog schema and RWEP coherence, cross-references, index freshness, skill lint) instead of the full test suite: the suite's curation-completeness checks assert guarantees that human curation supplies after import, so they gate the automated data PR's merge rather than its creation. The workflow also regenerates the SBOM over freshly applied data and consumes its own just-built prefetch cache on runners that have no signing key.
+
+## 0.16.21 — 2026-06-04
+
+The deprecation pointer for `prefetch` — on the help screen and in the README alias table — named `refresh --no-network`, which is a report-only dry run: an operator following it got a list of what would be fetched instead of a populated cache. Both now point at `refresh --prefetch`, which runs the same cache population as `prefetch` itself. The two scheduled repository workflows (external-data refresh, ATLAS currency) are also repaired: an upstream action tag had been re-pointed so its pinned commit no longer existed, and the Node setup step requested npm caching in a repo that intentionally ships no lock file — both workflows now run again, and the refresh job installs with `--no-package-lock` so a generated lock file can never ride along in its automated data PRs.
+
 ## 0.16.20 — 2026-06-02
 
 CVE curation now accepts three operator-supplied fields it previously dropped or rejected: `ai_discovery_source` (the AI-discovery provenance category — vendor research, AI-augmented bug bounty, academic fuzzing, threat-actor-built, human, or unknown), `vendor_update_paths` (the restart-required vendor remediation steps), and the `theoretical` value of `active_exploitation` (a published proof-of-concept with no observed in-the-wild use). All three are already valid in the catalog and factored by RWEP scoring, so a curated entry that supplies them is no longer stripped of its provenance or remediation detail before being written.

package/README.md

@@ -522,7 +522,7 @@ The remaining v0.10.x verbs are still functional, no banner, no removal schedule
 | `validate-rfcs` | `doctor --rfcs` | matches canonical |
 | `list-attestations` | `attest list` | matches canonical |
 | `reattest <sid>` | `attest diff <sid>` | matches canonical |
-| `prefetch` | `refresh --no-network` | matches canonical |
+| `prefetch` | `refresh --prefetch` | matches canonical |
 | `build-indexes` | `refresh --indexes-only` | matches canonical |
 
 **Legacy passthrough verbs** — dispatch to the v0.10.x orchestrator script. The output shape is **NOT** identical to the canonical verb — it's the legacy `{timestamp, host, findings}` envelope. Use the canonical verb when you want the v0.11+ structured envelope contract; the passthrough is kept only for scripts that depend on the legacy output:

package/bin/exceptd.js

@@ -243,21 +243,6 @@ const REMOVED_VERBS = {
   ingest: "run",
 };
 
-// Renamed but functionally-routed verbs (orchestrator-side dispatch still
-// handles them as of v0.13). Distinct from REMOVED_VERBS — these aren't
-// refused; they're just a soft hint that the rename happened. No banner
-// is emitted post-v0.13.
-const RENAMED_VERBS_HINT = {
-  scan: "discover --scan-only",
-  dispatch: "discover",
-  currency: "doctor --currency",
-  verify: "doctor --signatures",
-  "validate-cves": "doctor --cves",
-  "validate-rfcs": "doctor --rfcs",
-  prefetch: "refresh --no-network",
-  "build-indexes": "refresh --indexes-only",
-};
-
 /**
  * v0.13.5: Windows ACL audit helper for `doctor --ai-config`. Replaces
  * the v0.13.3 "manual review" placeholder with a real check.
@@ -515,7 +500,7 @@ surfaces.
   [DEPRECATED] verify            → doctor --signatures
   [DEPRECATED] validate-cves     → doctor --cves
   [DEPRECATED] validate-rfcs     → doctor --rfcs
-  [DEPRECATED] prefetch          → refresh --no-network
+  [DEPRECATED] prefetch          → refresh --prefetch
   [DEPRECATED] build-indexes     → refresh --indexes-only
 
 Accepted short forms (canonical — not deprecated):

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-02T22:35:32.691Z",
+  "generated_at": "2026-06-05T14:37:44.664Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 63,
   "source_hashes": {
-    "manifest.json": "7907552767ac9017929f434124666fa32c6b68d3f9b0ccbbe66f897c553ee6e3",
+    "manifest.json": "0d633a546c8d60d593625a6ddc140c6bd6a8c1f940ea29cf0dc4dfddb72b6b39",
     "data/atlas-ttps.json": "f66b456cf82a3c20575d8479de41f7b11b7ee5693eb1fcf64a67e162ae1b88a2",
     "data/attack-techniques.json": "c39f28e3402ef13ad9b7076819f63fda67a22f97e3e375cfe01c4a4e0beff7c9",
     "data/cve-catalog.json": "8264da4534d39c9493cfcd18acf7e38ed47ce2a81be15afd5a3f4baf1d504929",

package/lib/refresh-external.js

@@ -294,6 +294,24 @@ const KEV_SOURCE = {
           continue;
         }
         catalog[d.id][d.field] = d.after;
+        // A cisa_kev flip changes the entry's RWEP: the KEV factor carries
+        // RWEP_WEIGHTS.cisa_kev points, and the catalog invariant requires
+        // rwep_score to equal the factor sum. Writing the flag without the
+        // factor + score left entries failing scoring.validate() (stored 45
+        // vs computed 70 on the first real KEV listing the refresh applied).
+        if (d.field === "cisa_kev") {
+          const entry = catalog[d.id];
+          if (entry.rwep_factors && typeof entry.rwep_factors === "object") {
+            const scoring = require("./scoring");
+            // Match the stored factor shape: Shape A keeps the boolean,
+            // Shape B (the catalog norm) stores the post-weight contribution.
+            entry.rwep_factors.cisa_kev =
+              typeof entry.rwep_factors.cisa_kev === "boolean"
+                ? !!d.after
+                : (d.after ? scoring.RWEP_WEIGHTS.cisa_kev : 0);
+            entry.rwep_score = scoring.deriveRwepFromFactors(entry.rwep_factors);
+          }
+        }
         catalog[d.id].last_verified = TODAY;
         updated++;
       }
@@ -830,8 +848,12 @@ function kevDiffFromCache(ctx) {
       diffs.push({ id, field: "cisa_kev", before: entry.cisa_kev, after: upstream, severity: "high" });
     }
     const upDate = kevDates.get(id) || null;
-    if (upDate && entry.cisa_kev_date && entry.cisa_kev_date !== upDate) {
-      diffs.push({ id, field: "cisa_kev_date", before: entry.cisa_kev_date, after: upDate, severity: "low" });
+    // First listings arrive with a null local date — emit the date diff
+    // whenever upstream has one that the local entry lacks or contradicts,
+    // so the flag flip and its listing date apply together (the strict
+    // catalog validator requires KEV-listed entries to carry the date).
+    if (upDate && (entry.cisa_kev_date || null) !== upDate) {
+      diffs.push({ id, field: "cisa_kev_date", before: entry.cisa_kev_date ?? null, after: upDate, severity: "low" });
     }
   }
   return { status: "ok", diffs, errors: 0, summary: `${diffs.length} KEV diffs (from cache)` };

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.16.20",
+  "version": "0.16.22",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-06-02T22:31:37.617Z",
+      "signed_at": "2026-06-05T14:36:05.079Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "PHwHEsoy7ctBYOtlAfAdCDVfsq2Bpk9+qESSF+5dVkDcez2zp2v9Ihsv2vqMEs3QxMndyQ+t7NVezyt5VamSCg==",
-      "signed_at": "2026-06-02T22:31:37.619Z",
+      "signed_at": "2026-06-05T14:36:05.081Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "dD4p7lcRtMyfITOncqLkpOeMy6x6gM0V7UlWHgLEdcxqODb1s75ar1cBtTqDWPbMv6ZAzVo2HJLDK1hVjjU2AQ==",
-      "signed_at": "2026-06-02T22:31:37.619Z",
+      "signed_at": "2026-06-05T14:36:05.081Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "wsw8Mlr/gyw6S7Iaao9BVHdU5LFPWl8WVymW17Lkq9J1Mui0+fCrTg6UbrsaeE3s7EW3TVgzBuK+8EFd1+H5AA==",
-      "signed_at": "2026-06-02T22:31:37.620Z"
+      "signed_at": "2026-06-05T14:36:05.082Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "uVTc1QRKOKcIVDajBz+q2egjiEAyOQaDNsvVI2ghj5FD0VvquoUBBE5Naca2FkaZa790EHWCsVZ4hhdaSQs2DQ==",
-      "signed_at": "2026-06-02T22:31:37.620Z"
+      "signed_at": "2026-06-05T14:36:05.082Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "QuNpwnZ6HkCEAXTPC/jLbXSmMIc1JnBczqZAAIZmZj8OcEMVnw9mJYAnU3CxaEI7rvbcMkN2uS5E8yUCm/NiAg==",
-      "signed_at": "2026-06-02T22:31:37.621Z"
+      "signed_at": "2026-06-05T14:36:05.083Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "5rw2i39SxY2WphBbDLEP28wufnbPPE9+PWt54hmaGdwHXr9RLiVt5liL/5xp14sehlVgFsfpR/bg9vy//xV0DA==",
-      "signed_at": "2026-06-02T22:31:37.621Z",
+      "signed_at": "2026-06-05T14:36:05.083Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-05-17",
       "signature": "Vqu49nzntFWjn9A/QeJzm7q/2xk/cZJ6HFQKtiNi1zgcxzXKm+MlFdkaLgYHWj5/9HJohxyIDyBJQTvcJ20eDQ==",
-      "signed_at": "2026-06-02T22:31:37.622Z",
+      "signed_at": "2026-06-05T14:36:05.084Z",
       "d3fend_refs": [
         "D3-CA",
         "D3-CSPP",
@@ -440,7 +440,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-22",
       "signature": "W87VdyVdAxAdcRI6P/8StaV+MS8ZSPKM9HOCK9n/bBO6BM3ZSE3uImVoyJVpAXQlUpUGN+A3lCJZXv64LuxwDg==",
-      "signed_at": "2026-06-02T22:31:37.622Z",
+      "signed_at": "2026-06-05T14:36:05.084Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -474,7 +474,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "wdVX+edeNekpaIldqkhvtraV6DquLvIsKAjuZVwPQYn3l1vS99HXuFxmNsD7UeMlO3qgC6Dysfsto9EnuH0RBg==",
-      "signed_at": "2026-06-02T22:31:37.622Z",
+      "signed_at": "2026-06-05T14:36:05.084Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -513,7 +513,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-06-02T22:31:37.623Z"
+      "signed_at": "2026-06-05T14:36:05.085Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -540,7 +540,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-18",
       "signature": "xbkip0AQtWQKAu+O6r/gYECNjezS6O9k9xkkJsYbMlr+j8CdqH3p5/0l+GZmDidImRC/DL07GCnKrk9HRR/yDQ==",
-      "signed_at": "2026-06-02T22:31:37.623Z",
+      "signed_at": "2026-06-05T14:36:05.085Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -604,7 +604,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "li2NnC1oeVIr22ComP5QbcQoh5xpWITuaKpza1s2SsUkH6kGnnt4wFfFAzaC1ORmH9x2cr8hN8kaNANG/eIMBQ==",
-      "signed_at": "2026-06-02T22:31:37.623Z",
+      "signed_at": "2026-06-05T14:36:05.085Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "sZHlJ7ueHPdtzVbR+yXQ5+wKgNyjWsa1LKVg9aWTmg/Onl71DvEILMyJiLpPQjseT56Mnr1DMYJE8xOGlffBAw==",
-      "signed_at": "2026-06-02T22:31:37.624Z"
+      "signed_at": "2026-06-05T14:36:05.086Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -689,7 +689,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "3AwFnEJu6DukPPNep/3SnuPWEuV060fJEQIwThFm7ujmdbFk0/Ii0XwGv1dkvbbK7ymMdOQpp35l4aLONAucDA==",
-      "signed_at": "2026-06-02T22:31:37.624Z",
+      "signed_at": "2026-06-05T14:36:05.086Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -724,7 +724,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-06-02T22:31:37.625Z"
+      "signed_at": "2026-06-05T14:36:05.086Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -796,7 +796,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "DDMzI+4En4aIkwBUCGW6nj1eEkCyLqHGn2LJ2rnwWfYatjPI1U5HrTZNAN/n9JqWtAzk8F3rmsKehaaz5iNWDA==",
-      "signed_at": "2026-06-02T22:31:37.625Z"
+      "signed_at": "2026-06-05T14:36:05.087Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -856,7 +856,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "dJB0iAstIUbyny+udl3OIkaLScEmqS97LNP73yQ8mxt+0bcqxZjpfXaWLzLuIQblGYvUvz75/H6rO2EJuGd4AQ==",
-      "signed_at": "2026-06-02T22:31:37.625Z"
+      "signed_at": "2026-06-05T14:36:05.087Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -931,7 +931,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "KEAoMji3VcPX/ZXXqVe6OStxSkTssfY9fIRPyPcDYqh50GzOFQ6koNOTBVAiWOvjDjQ38g12xun5srbqgmvRAw==",
-      "signed_at": "2026-06-02T22:31:37.626Z"
+      "signed_at": "2026-06-05T14:36:05.088Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1010,7 +1010,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "zuW8T0EMbVV83GsUP/W20Use2gBTicBW021T0sY7qsRY/U5qsPWkXYIWp3SdiKLTIKqTEd/0T7LQebjIs2QKCA==",
-      "signed_at": "2026-06-02T22:31:37.626Z"
+      "signed_at": "2026-06-05T14:36:05.088Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1067,7 +1067,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "Qe0Hg9BrX3Zm5pj0n2z/oiHbAXWdA2Dq461zc4izkkUjEX2CZ02rODjCI2ELbrVOU3GC7edxqAxA+5U/ObnHDQ==",
-      "signed_at": "2026-06-02T22:31:37.627Z"
+      "signed_at": "2026-06-05T14:36:05.088Z"
     },
     {
       "name": "identity-assurance",
@@ -1134,7 +1134,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-06-02T22:31:37.627Z"
+      "signed_at": "2026-06-05T14:36:05.089Z"
     },
     {
       "name": "ot-ics-security",
@@ -1190,7 +1190,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "kIVzsPsJ72PzzWQwTuvjoHHoVEDCday5I52M9ohjB3/Ak+zlA8oyWLO/BKb/XuYY4fOApjfxTErSWv5uHQ2zDw==",
-      "signed_at": "2026-06-02T22:31:37.627Z"
+      "signed_at": "2026-06-05T14:36:05.089Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1242,7 +1242,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "bWr27Q1uN9xCe1ib4QulszBa7YIDNkGqo72k5nm2cK98LyPblicD+sO9MnGckAyB22BTN/cIB+FwFMcI5IxvBw==",
-      "signed_at": "2026-06-02T22:31:37.628Z"
+      "signed_at": "2026-06-05T14:36:05.089Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1292,7 +1292,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "Q854yzLqXdOazc6EyQbZzgAlivuq2vGFDVUCrxSldSvx/HX/ZM/uzmJyP7aBG7ZsMHxj6Lmj/H82YQoo1e+NCQ==",
-      "signed_at": "2026-06-02T22:31:37.628Z"
+      "signed_at": "2026-06-05T14:36:05.090Z"
     },
     {
       "name": "webapp-security",
@@ -1366,7 +1366,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "4ccahkJpGJZtwD7EBpnGcN0sEGPMEw8eqV+tvePVS04YAkLgYVWtlkasI/8n0be9xB+77x+Sjj3kIi2j2Lf9CA==",
-      "signed_at": "2026-06-02T22:31:37.628Z",
+      "signed_at": "2026-06-05T14:36:05.090Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1419,7 +1419,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-06-02T22:31:37.629Z"
+      "signed_at": "2026-06-05T14:36:05.090Z"
     },
     {
       "name": "sector-healthcare",
@@ -1479,7 +1479,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "U04GNLyRas1VmfEsB8khH4iqFZPwx96sPY0Kw9iVsSPU+KTeEFqwgtWK1X1pzgb+T16Pc7HSrCaXDOpTFvQEDw==",
-      "signed_at": "2026-06-02T22:31:37.629Z"
+      "signed_at": "2026-06-05T14:36:05.091Z"
     },
     {
       "name": "sector-financial",
@@ -1560,7 +1560,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "xbylLqNPBuEsFE/MNVeGy/01K6yiJXMxQbzC1F4RWU5aseDGbNy5HrAv2JWI2+Aft05ozreNPjccvu66yJ5EBw==",
-      "signed_at": "2026-06-02T22:31:37.630Z"
+      "signed_at": "2026-06-05T14:36:05.091Z"
     },
     {
       "name": "sector-federal-government",
@@ -1629,7 +1629,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "C9c3JuBhUbwcb7uZpDdy+PNT8sYmYIxzD4uRHu421ePW1aSFJ8fkMvuTzSO8vD/F/jOOg5opM4kov/xSAn+qCg==",
-      "signed_at": "2026-06-02T22:31:37.630Z"
+      "signed_at": "2026-06-05T14:36:05.092Z"
     },
     {
       "name": "sector-energy",
@@ -1694,7 +1694,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "oz8Q5WVaY8au4IjbaZahx/DSaC00Q44ylSL3mDkTerCEpW/EyPUeiLeGxSrWxBCwVFEKSSJvnhJjhvX5lDPcCg==",
-      "signed_at": "2026-06-02T22:31:37.630Z"
+      "signed_at": "2026-06-05T14:36:05.092Z"
     },
     {
       "name": "sector-telecom",
@@ -1780,7 +1780,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-06-02T22:31:37.631Z"
+      "signed_at": "2026-06-05T14:36:05.092Z"
     },
     {
       "name": "api-security",
@@ -1849,7 +1849,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "1UTjZNC5Lyrgw93LAizdXVeSmv3jS8YQNT1db5OKsldub50+o1FXmAH4+3MxZozaOGDCX3yXbdDJSJaaSmfuAA==",
-      "signed_at": "2026-06-02T22:31:37.631Z",
+      "signed_at": "2026-06-05T14:36:05.093Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1935,7 +1935,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "EdsY4xe7YA8X8m+KZUbq49JwoCXgRKEz2eg3m86O37rvBmpm8ppvl9hrsekygvpBh2VmCHL2dEYiOD8OM2n7CA==",
-      "signed_at": "2026-06-02T22:31:37.631Z"
+      "signed_at": "2026-06-05T14:36:05.093Z"
     },
     {
       "name": "container-runtime-security",
@@ -1997,7 +1997,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "fnLKPLkjjRCJ/F9wdmZ1w1lXmqEJvTYkv6Uu+9OTd5vZTWKz3QMuxKOsas+ctCdOvTaeloqPUUprXx+ZZdDpCg==",
-      "signed_at": "2026-06-02T22:31:37.632Z",
+      "signed_at": "2026-06-05T14:36:05.093Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2071,7 +2071,7 @@
         "MITRE ATLAS v5.6.0 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "t3dkdpTX04zvjitEeOJThpgjurLd1UO9GOut4LXSZgY3ULhfknI4zT7G5+m2RSZZTo7yyeZrwpg+7vEg9K6mAw==",
-      "signed_at": "2026-06-02T22:31:37.632Z"
+      "signed_at": "2026-06-05T14:36:05.094Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2133,7 +2133,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "+1kmtA6rAvIyDjjy+cJHK6BcfylyVsa5cUjRFijlFR9GsQfB93JnmkEJOqML50pdlcxtJI3yUodHpL3/YJGtCA==",
-      "signed_at": "2026-06-02T22:31:37.633Z"
+      "signed_at": "2026-06-05T14:36:05.094Z"
     },
     {
       "name": "ransomware-response",
@@ -2213,7 +2213,7 @@
       ],
       "last_threat_review": "2026-05-22",
       "signature": "h48ASCz63aBfHzLKxMVDADMuT4atriK0iE6bJeVzZTsx/e8+hyv4fLP7+zYxT9Oe0Gss3v/Xy+t+Wd9uwzV+Aw==",
-      "signed_at": "2026-06-02T22:31:37.633Z"
+      "signed_at": "2026-06-05T14:36:05.095Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2266,7 +2266,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-06-02T22:31:37.633Z"
+      "signed_at": "2026-06-05T14:36:05.095Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2334,7 +2334,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "ZHVdGWCcfG98tSVB0b9mwrsYwv71V3uUEl+6ss7omSQhmNvqV5s6MAZM5YladBt9MK/8T/zBrTYN4gAonOP+BQ==",
-      "signed_at": "2026-06-02T22:31:37.634Z"
+      "signed_at": "2026-06-05T14:36:05.095Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2414,7 +2414,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-06-02T22:31:37.634Z",
+      "signed_at": "2026-06-05T14:36:05.096Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2508,7 +2508,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-06-02T22:31:37.634Z",
+      "signed_at": "2026-06-05T14:36:05.096Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2580,7 +2580,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-06-02T22:31:37.635Z"
+      "signed_at": "2026-06-05T14:36:05.097Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2639,7 +2639,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-06-02T22:31:37.635Z"
+      "signed_at": "2026-06-05T14:36:05.097Z"
     },
     {
       "name": "network-trust",
@@ -2695,7 +2695,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-06-02T22:31:37.635Z"
+      "signed_at": "2026-06-05T14:36:05.097Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2750,7 +2750,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-06-02T22:31:37.635Z"
+      "signed_at": "2026-06-05T14:36:05.097Z"
     },
     {
       "name": "self-update-integrity",
@@ -2804,7 +2804,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-06-02T22:31:37.636Z"
+      "signed_at": "2026-06-05T14:36:05.098Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -2862,7 +2862,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-06-02T22:31:37.636Z"
+      "signed_at": "2026-06-05T14:36:05.098Z"
     },
     {
       "name": "decompression-dos",
@@ -2920,7 +2920,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-06-02T22:31:37.636Z"
+      "signed_at": "2026-06-05T14:36:05.098Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -2975,7 +2975,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-06-02T22:31:37.637Z"
+      "signed_at": "2026-06-05T14:36:05.098Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3030,11 +3030,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-06-02T22:31:37.637Z"
+      "signed_at": "2026-06-05T14:36:05.099Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "ayWe0Adi8H/d9St1+wgqOfUF3bCg4TIWw92AsdiW0pYJJQbpiWunCNUN6oXFaqqgU/H4jGdKvwVHzjVdOwzoCQ=="
+    "signature_base64": "M6/54yATUpoQoKpa2XTdQtrhRJFf7lf/3i6uQa3i/f3dGXNEc8zENbjYEr7C0xt13cto2oMT/5zxeRQzrCc4BQ=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.16.20",
+  "version": "0.16.22",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:27c29f93-ac9c-4df6-a278-6b1b3e4556df",
+  "serialNumber": "urn:uuid:46b4a92a-bd7d-4757-ba07-6c352346da2f",
   "version": 1,
   "metadata": {
-    "timestamp": "2047-02-20T16:10:59.000Z",
+    "timestamp": "2063-08-04T16:28:26.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.16.20"
+        "version": "0.16.22"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.20",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.22",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.16.20",
+      "version": "0.16.22",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (439 CVEs / 177 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.20",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.22",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fe9dfa8a600bd9c4d238c64204f365fb966650fe535b4dd9840f0957432e8117"
+          "content": "6cb5d96bc4b20597400be2b7a74dee0b32cec947f95827b86cab9c6d84af3a52"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.20"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.22"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "da8e1908f872d2aa27e4b5815a954bac34156d92c17aea421b65d984be050d85"
+          "content": "427a300d2504f88006479c1a06fa09df4af0b8cc6bd28951b2c721b3f41d4d42"
         },
         {
           "alg": "SHA3-512",
-          "content": "6ab25dbfbf14dd5d33fc9ed12ae31eea40611ac9c45a6a9d39f59fc9bb3d0574e03edf1dba7580129d9fac832df599bb0aeb94d235aee564cba0cf2d229acfe8"
+          "content": "d74dea4228b60326186f0c96398cc6095c17a8ee69a2ee2a4768e56e1a3246fab54200f9de18afc501d2f7273e4bd2fafda779e50d2d639d275076c6e956f23f"
         }
       ]
     },
@@ -176,11 +176,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "81ca9d3388220ac98069b35a594e915e6a6c95f047467f26d75d89d0c917684c"
+          "content": "6e6a604ad389643aa456c1fc4ef799ec68ecd4a565918630b194d7873182d128"
         },
         {
           "alg": "SHA3-512",
-          "content": "cd0bed4f8dd100c272b20d7aecad64d09b9d65dc07551aec2f61ee20aae55978cf1c300ede8bac15d10ed9bbf8ea180aa48dfe3d951497527ee17440da1a696f"
+          "content": "e46a828d192fa0aba4ec6f8589d8d6aa4dc03f7d238bb1ac418d3f9076350a164e81bbe8de0d01e21a28f231954d65a57770715c6f64ae001466cdea315b9e81"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9bcb27a03b259ed458da11b2d8396a1cada67c3c5b3d258945ee2eb031dd3069"
+          "content": "76c366c043c6c66fa91601bfd2187163a92b1aef069d41fd7a86bb42f7391683"
         },
         {
           "alg": "SHA3-512",
-          "content": "08c6edcbf777a74bf40f5907a279ebbbce8a886498dfaf37700749609cae23a120061a9f86b0f700f5218d046dfed318445997099f69771ed15b40c8009536e0"
+          "content": "a87357eaaea985def5ec8a41af76b9dc4a142a7042f382177e02f7158a63f4d9f2f745921c0c2c5e2ccb6b89b6f36258ccdd6d923183b51ee7d730c20e9ddadc"
         }
       ]
     },
@@ -1481,11 +1481,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4d50b95ac5732a5236e208f6ad1b1deb2654cc38aa0c29ca62a659874694c04d"
+          "content": "d776211b708863ccc221c9bb4ed90954158c15e24bd1781e92533dd17899b795"
         },
         {
           "alg": "SHA3-512",
-          "content": "953e338a5a20fb65c6e93e78225c292eecfeb8a4a7cfe76d5c6c6b9ed5f13c9fd074dfb1d30d0c75dc8940fa118dfee652a1125af68c2bacfa597c64cefaf4e1"
+          "content": "e95febc356efbfa8b4c5a444ea44b41a34a3dc6d01f091b0d56a357969358e32fbcd4f87e1d7836aaf0bcccca03fcd57703b362831fbed051770ea21d679a592"
         }
       ]
     },
@@ -1886,11 +1886,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7907552767ac9017929f434124666fa32c6b68d3f9b0ccbbe66f897c553ee6e3"
+          "content": "0d633a546c8d60d593625a6ddc140c6bd6a8c1f940ea29cf0dc4dfddb72b6b39"
         },
         {
           "alg": "SHA3-512",
-          "content": "2a1ab5a93e7ade12930932811d8082d4ea9f757caeed62a1f2fb6fffb2e4a0aebf8e411ccc0433b87e76b6aec96ccb4ad98e1740eb4197c2f25ef338cbde1687"
+          "content": "750c1040ba0b4e3cbe53eea6f4be171be72178a73189bb34322bbf9082291daf31f7849f25cf6de372673df2cda837b919a26c8e98b68a38c8516cde79628d55"
         }
       ]
     },
@@ -3476,11 +3476,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "eadeff28bc343c7f7c270a6bc1a7593449cd1d238e49e4e3f74817d07b91de9a"
+          "content": "c96c23ae03353ed1c7ebf3a31be2cc3fe9caaa7c35762ae5b1f3a371744b4eaa"
         },
         {
           "alg": "SHA3-512",
-          "content": "920540ecd16f41814cf345ebfe505093efb1501c58aa81cd3dfb58237ac2d25264b6c33331d0989d22944df2edbcfa1d656bb177ab5af98d928f3838e954a5ae"
+          "content": "b95a1b4b43a94a8f20e9d0e5454d5da290cd0b66be60e3ffb9f9c8d80af51bd081b44fd974f49171d3a02279a4560c4c675190b2aea1d6c3a26d5fda14877523"
         }
       ]
     },

package/sources/validators/cve-validator.js

@@ -286,7 +286,12 @@ async function validateCve(cveId, localEntry) {
     if (typeof local.cisa_kev === 'boolean' && local.cisa_kev !== fetched.in_kev) {
       pushDiscrepancy(discrepancies, 'cisa_kev', local.cisa_kev, fetched.in_kev, 'high');
     }
-    if (local.cisa_kev_date && fetched.kev_date && local.cisa_kev_date !== fetched.kev_date) {
+    // Emit whenever upstream carries a listing date the local entry lacks or
+    // contradicts — a first listing arrives as cisa_kev_date:null locally, and
+    // requiring a truthy local date here meant the flag flipped without its
+    // date, which the strict catalog validator rejects (KEV-listed entries
+    // must carry their listing date).
+    if (fetched.kev_date && local.cisa_kev_date !== fetched.kev_date) {
       pushDiscrepancy(discrepancies, 'cisa_kev_date', local.cisa_kev_date, fetched.kev_date, 'low');
     }
   }