@blamejs/exceptd-skills 0.16.4 → 0.16.6

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog
 
+## 0.16.6 — 2026-05-31
+
+`collect --help` now documents the `--attest-ownership` flag — it attests that you own (or hold written authorisation for) the asset being scanned, satisfying an ownership precondition such as the CI/CD playbook's fleet-ownership gate so a run does not block at preflight. The flag already worked and is what the precondition-block remediation points to; it was simply missing from the help text.
+
+## 0.16.5 — 2026-05-31
+
+`selected_remediation` now matches the finding. Each `remediation_path` can declare an optional `for_signals` linkage naming the detect indicators it addresses; when no remediation's preconditions are verified (the common static-scan case), the recommendation is the highest-priority path that addresses a fired indicator instead of always defaulting to priority-1. So a FIPS-claim-without-runtime-activation finding now recommends activating the FIPS provider rather than an unrelated post-quantum migration. The linkage is populated across the playbook set, and each entry in `remediation_options_considered` gains an `addresses_fired_signal` flag.
+
+A blocked-preflight `summary_line` is now truncated on a word boundary with an ellipsis instead of cut mid-word.
+
 ## 0.16.4 — 2026-05-31
 
 A `collect | run` result now surfaces non-fatal collector notices as a `collector_warnings` field — for example a file skipped for exceeding the scan size limit — so a consumer can see what the collector could not scan. The verdict and evidence completeness are unchanged; the field is omitted when the collector reported nothing.

package/bin/exceptd.js

@@ -2312,7 +2312,7 @@ Exit codes:
 Output: verb, session_id, playbooks_run, summary{total, detected,
 max_rwep_observed, jurisdiction_clocks_started, verdict, fail_reasons[]},
 results[].`,
-    collect: `collect <playbook> [--cwd <dir>] [--resolve] [--air-gap] [--json]
+    collect: `collect <playbook> [--cwd <dir>] [--attest-ownership] [--resolve] [--air-gap] [--json]
 
 Scan the working directory (or --cwd <dir>) and emit an evidence submission
 for <playbook>, ready to pipe into \`run\`:
@@ -2321,6 +2321,10 @@ for <playbook>, ready to pipe into \`run\`:
 
 Flags:
   --cwd <dir>             Scan <dir> instead of the current directory.
+  --attest-ownership      Attest that you own (or hold written authorisation
+                          for) the asset being scanned, satisfying an ownership
+                          precondition (e.g. cicd-pipeline-compromise's
+                          operator-owns-ci-fleet gate) so run does not block.
   --resolve               (citation-hygiene) resolve uncatalogued CVE/RFC
                           citations found during the scan.
   --air-gap               Do not touch the network during collection.

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-31T14:52:41.465Z",
+  "generated_at": "2026-05-31T22:44:53.285Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 54,
   "source_hashes": {
-    "manifest.json": "a9da205a5c4d8847eb3c0d36b5b610cdc54d4347ffb9b03b8d9b5d740a6434ab",
+    "manifest.json": "6c371111138f37f9dcfbfc2b385e629ea7243806f58d1b21837865d897f641e7",
     "data/atlas-ttps.json": "878b4a08bb73c8d20396d85cf433a88f2bc5e7a8cbf7f6ab773ce7ede0a11251",
     "data/attack-techniques.json": "318bf8e9c5aee1d0a4a1dc37c4b211f2fbc937bf332a401a22483cc7d0547252",
     "data/cve-catalog.json": "1aac7e75eae24ece2ef09d1c63977bdd7a1f81a9f11609ebb966109be316426c",

package/data/playbooks/ai-api.json

@@ -780,6 +780,7 @@
             "operator_authorized_for_key_rotation == true"
           ],
           "priority": 1,
+          "for_signals": ["cleartext-api-key-in-dotfile","long-lived-aws-keys","gcp-service-account-json","kubeconfig-with-static-token"],
           "compensating_controls": [
             "service_disruption_window_acknowledged",
             "rotation_audit_trail"
@@ -794,6 +795,7 @@
             "incident_response_authorized == true"
           ],
           "priority": 1,
+          "for_signals": ["ai-api-egress-from-unexpected-process","ai-api-anomalous-volume","ai-api-beaconing-cadence","base64-or-encoded-payload-in-prompts"],
           "compensating_controls": [
             "forensic_preservation",
             "vendor_abuse_team_notification"
@@ -807,6 +809,7 @@
             "broker_available_for_each_credential_class == true"
           ],
           "priority": 2,
+          "for_signals": ["cleartext-api-key-in-dotfile","long-lived-aws-keys","gcp-service-account-json","kubeconfig-with-static-token"],
           "compensating_controls": [
             "legacy_dotfile_still_present_until_keychain_validated",
             "developer_workflow_regression_test"
@@ -821,6 +824,7 @@
             "tls_termination_acceptable_per_policy == true"
           ],
           "priority": 3,
+          "for_signals": ["ai-api-egress-from-unexpected-process","ai-api-anomalous-volume","ai-api-beaconing-cadence","base64-or-encoded-payload-in-prompts"],
           "compensating_controls": [
             "proxy_failure_mode_defined",
             "developer_traffic_baseline_collection"
@@ -834,6 +838,7 @@
             "host-level_firewall_or_endpoint_egress_control_available == true"
           ],
           "priority": 4,
+          "for_signals": ["ai-api-egress-from-unexpected-process","ai-api-anomalous-volume","ai-api-beaconing-cadence"],
           "compensating_controls": [
             "allowlist_change_management",
             "monitoring_for_blocked_attempts"

package/data/playbooks/ai-discovered-cve-triage.json

@@ -788,6 +788,7 @@
             "operator_can_add_feed_sources == true"
           ],
           "priority": 1,
+          "for_signals": ["ai-discovery-feed-coverage-incomplete"],
           "compensating_controls": [
             "ai_discovery_aggregator_subscription_as_interim",
             "manual_weekly_triage_against_named_sources_during_pipeline_buildout"
@@ -802,6 +803,7 @@
             "deployment_cadence_supports_sla_tightening == true"
           ],
           "priority": 1,
+          "for_signals": ["policy-no-ai-discovered-tier","deployment-tempo-equal-ai-vs-non-ai","asset-unpatched-past-rwep-sla"],
           "compensating_controls": [
             "interim_compensating_controls_for_assets_unable_to_meet_sla",
             "live_patch_subscription_for_kernel_assets"
@@ -816,6 +818,7 @@
             "operator_assigns_verification_owner == true"
           ],
           "priority": 2,
+          "for_signals": ["ai-discovery-attribution-band-c-unverified","no-ai-discovery-verification-process"],
           "compensating_controls": [
             "weekly_attribution_corroboration_review",
             "automated_secondary_source_polling"
@@ -829,6 +832,7 @@
             "deployment_metric_pipeline_operational == true"
           ],
           "priority": 3,
+          "for_signals": ["deployment-tempo-equal-ai-vs-non-ai"],
           "compensating_controls": [
             "monthly_metric_review_with_security_leadership"
           ],
@@ -842,6 +846,7 @@
             "operator_holds_live_patch_subscription == true"
           ],
           "priority": 3,
+          "for_signals": ["asset-unpatched-past-rwep-sla","ai-discovered-cve-applicable"],
           "compensating_controls": [
             "module_unload_mitigation_where_applicable",
             "host_isolation_during_window_pending_reboot"

package/data/playbooks/cicd-pipeline-compromise.json

@@ -672,6 +672,7 @@
             "deploy_window_within_72h == true"
           ],
           "priority": 1,
+          "for_signals": ["workflow-injection-sink","pull-request-target-with-pr-checkout","secret-exposed-to-fork-pr"],
           "compensating_controls": [
             "env_pinning_lint_added_to_ci",
             "fork_pr_workflow_blocked_until_remediated"
@@ -686,6 +687,7 @@
             "ci_throughput_can_absorb_pin_updates == true"
           ],
           "priority": 2,
+          "for_signals": ["actions-floating-tag-pin"],
           "compensating_controls": [
             "sha_pin_drift_alert_configured",
             "maintenance_cadence_recorded_in_change_management"
@@ -700,6 +702,7 @@
             "production_environments_can_be_introduced_to_ci_workflow == true"
           ],
           "priority": 3,
+          "for_signals": ["wildcarded-oidc-sub-claim"],
           "compensating_controls": [
             "oidc_trust_policy_recorded_in_iac",
             "environment_approval_gate_active"
@@ -714,6 +717,7 @@
             "downstream_consumers_can_verify_keyless_or_developer_signature == true"
           ],
           "priority": 3,
+          "for_signals": ["runner-scoped-signing-key"],
           "compensating_controls": [
             "signing_trust_documented_in_release_runbook",
             "verification_step_added_to_runner_workflow"
@@ -728,6 +732,7 @@
             "ci_throughput_can_absorb_per_job_startup_cost == true"
           ],
           "priority": 3,
+          "for_signals": ["self-hosted-runner-non-ephemeral"],
           "compensating_controls": [
             "ephemeral_runner_orchestration_recorded_in_iac",
             "runner_image_provenance_tracked"

package/data/playbooks/citation-hygiene.json

@@ -556,6 +556,7 @@
             "fabricated_citations_inventoried == true"
           ],
           "priority": 1,
+          "for_signals": ["fabricated-cve-id"],
           "compensating_controls": [
             "lint_rule_rejecting_non_canonical_cve_form_in_comments_and_docs",
             "ci_check_cross_referencing_cited_cves_against_an_authoritative_catalog"
@@ -569,6 +570,7 @@
             "rejected_disputed_citations_inventoried == true"
           ],
           "priority": 2,
+          "for_signals": ["rejected-or-disputed-cve"],
           "compensating_controls": [
             "ci_check_flagging_citations_to_catalog_rejected_disputed_entries",
             "documentation_review_step_requiring_status_disclosure"
@@ -582,6 +584,7 @@
             "rfc_title_mismatches_inventoried == true"
           ],
           "priority": 3,
+          "for_signals": ["rfc-number-title-mismatch"],
           "compensating_controls": [
             "ci_check_matching_cited_rfc_numbers_to_index_titles",
             "implementation_re_review_against_corrected_rfc"
@@ -595,6 +598,7 @@
             "external_lookup_available == true"
           ],
           "priority": 4,
+          "for_signals": ["cve-citation-needs-external-verification","draft-mislabeled-as-rfc"],
           "compensating_controls": [
             "scheduled_re_verification_when_catalog_refreshes",
             "needs_verification_register_maintained_until_resolved"

package/data/playbooks/cloud-iam-incident.json

@@ -976,6 +976,7 @@
             "rotation_ownership_identified == true"
           ],
           "priority": 1,
+          "for_signals": ["root_login_from_new_asn","iam_access_key_created_no_iac_ticket","mass_iam_user_creation_outside_iac","cross_account_assume_role_anomaly","kms_key_policy_self_grant","s3_bucket_policy_public_grant","cloudtrail_logging_disabled_event"],
           "compensating_controls": [
             "session-revocation",
             "audit-log-review-for-misuse-window",
@@ -991,6 +992,7 @@
             "iam_read_only_across_org == true"
           ],
           "priority": 2,
+          "for_signals": ["cross_account_assume_role_anomaly","mass_iam_user_creation_outside_iac","iam_access_key_created_no_iac_ticket","kms_key_policy_self_grant","s3_bucket_policy_public_grant","gpu_instance_creation_spike","unused_region_resource_creation"],
           "compensating_controls": [
             "iam-event-review-completed",
             "scp-tightened",
@@ -1005,6 +1007,7 @@
             "imdsv2_migration_blocker_inventory_complete == true"
           ],
           "priority": 2,
+          "for_signals": ["imds_v1_legacy_access"],
           "compensating_controls": [
             "imdsv2-enforced-org-wide",
             "scp-deny-imdsv1-launch"
@@ -1018,6 +1021,7 @@
             "federated_trust_inventory_complete == true"
           ],
           "priority": 2,
+          "for_signals": ["cross_account_assume_role_anomaly"],
           "compensating_controls": [
             "federated-trust-tightened",
             "conditional-access-mfa-required-on-admin"

package/data/playbooks/containers.json

@@ -819,6 +819,7 @@
             "alternative_capability_path_identified == true"
           ],
           "priority": 1,
+          "for_signals": ["compose-privileged","k8s-privileged","compose-cap-add-sys-admin"],
           "compensating_controls": [
             "pod-security-baseline-enforced",
             "admission-controller-blocks-privileged"
@@ -833,6 +834,7 @@
             "host_namespace_requirement_documented_or_invalid == true"
           ],
           "priority": 1,
+          "for_signals": ["k8s-host-namespaces","compose-host-network"],
           "compensating_controls": [
             "pod-security-baseline-enforced",
             "namespace-isolation-tightened"
@@ -846,6 +848,7 @@
             "ci_supports_digest_resolution == true OR manual_digest_pinning_accepted == true"
           ],
           "priority": 2,
+          "for_signals": ["dockerfile-from-latest","dockerfile-no-digest-pin","k8s-image-latest"],
           "compensating_controls": [
             "image-signature-verified",
             "registry-immutability-enforced"
@@ -859,6 +862,7 @@
             "image_supports_non_root == true"
           ],
           "priority": 2,
+          "for_signals": ["dockerfile-runs-as-root","k8s-run-as-root"],
           "compensating_controls": [
             "pod-security-restricted-enforced"
           ],
@@ -871,6 +875,7 @@
             "cluster_supports_seccomp_profile == true"
           ],
           "priority": 2,
+          "for_signals": ["k8s-no-seccomp-profile"],
           "compensating_controls": [
             "seccomp-profile-active"
           ],
@@ -883,6 +888,7 @@
             "alternative_path_identified == true"
           ],
           "priority": 1,
+          "for_signals": ["compose-docker-sock-mount","k8s-hostpath-sensitive"],
           "compensating_controls": [
             "bounded-rbac-applied",
             "sysbox-or-kata-deployed"
@@ -896,6 +902,7 @@
             "sa_usage_audit_complete == true"
           ],
           "priority": 1,
+          "for_signals": ["k8s-cluster-admin-binding"],
           "compensating_controls": [
             "scoped-role-applied",
             "audit2rbac-output-attached"

package/data/playbooks/cred-stores.json

@@ -739,6 +739,7 @@
             "user_enrolled_in_sso == true"
           ],
           "priority": 1,
+          "for_signals": ["aws-static-key-present"],
           "compensating_controls": [
             "iam-key-deactivated",
             "cloudtrail-monitor-on-old-key-for-residual-use"
@@ -752,6 +753,7 @@
             "org_has_workforce_identity_pool == true OR user_has_authorized_user_credentials == true"
           ],
           "priority": 1,
+          "for_signals": ["gcp-service-account-json-adc"],
           "compensating_controls": [
             "gcp-key-deleted",
             "gcp-audit-log-monitor-on-old-key"
@@ -765,6 +767,7 @@
             "cluster_supports_oidc == true OR cluster_is_managed_cloud_k8s == true"
           ],
           "priority": 1,
+          "for_signals": ["kube-static-token"],
           "compensating_controls": [
             "kube-token-revoked",
             "k8s-audit-log-monitor-on-old-token"
@@ -778,6 +781,7 @@
             "target_registry_supports_cred_helper == true"
           ],
           "priority": 1,
+          "for_signals": ["docker-cleartext-auth"],
           "compensating_controls": [
             "docker-token-rotated"
           ],
@@ -790,6 +794,7 @@
             "org_authority_to_rotate == true"
           ],
           "priority": 2,
+          "for_signals": ["npm-pat-present","pypi-token-present"],
           "compensating_controls": [
             "token-scope-tightened",
             "publish-mfa-required"
@@ -803,6 +808,7 @@
             "file_owner_is_current_user"
           ],
           "priority": 2,
+          "for_signals": ["credentials-file-bad-perms"],
           "compensating_controls": [],
           "estimated_time_hours": 0.25
         },
@@ -813,6 +819,7 @@
             "all_authorized_hosts_known == true"
           ],
           "priority": 2,
+          "for_signals": ["ssh-key-rsa-short-bits","ssh-key-old"],
           "compensating_controls": [
             "ssh-key-inventory-updated"
           ],

package/data/playbooks/crypto-codebase.json

@@ -959,6 +959,7 @@
             "api_stability_promise_permits_default_change == true OR major_version_bump_planned == true"
           ],
           "priority": 1,
+          "for_signals": ["no-ml-kem-implementation","rsa-1024-anywhere","tls-old-protocol"],
           "compensating_controls": [
             "config_flag_for_classical_only_fallback_with_deprecation_warning",
             "downstream_consumer_migration_guide_published"
@@ -973,6 +974,7 @@
             "downstream_consumer_compat_path_planned == true"
           ],
           "priority": 2,
+          "for_signals": ["ecdsa-without-pqc-roadmap"],
           "compensating_controls": [
             "dual_signature_envelope_during_migration",
             "explicit_algorithm_identifier_in_signed_payload"
@@ -986,6 +988,7 @@
             "weak_hash_call_sites_inventoried == true"
           ],
           "priority": 3,
+          "for_signals": ["weak-hash-import","weak-cipher-mode"],
           "compensating_controls": [
             "deprecation_warning_emitted_when_legacy_hash_method_invoked",
             "telemetry_to_track_legacy_method_consumer_usage"
@@ -1000,6 +1003,7 @@
             "performance_regression_acceptable_in_current_release == true"
           ],
           "priority": 4,
+          "for_signals": ["pbkdf2-under-iterated","bcrypt-cost-low"],
           "compensating_controls": [
             "kdf_parameter_floor_enforced_at_runtime_not_just_default",
             "consumer_documentation_about_password_rehash_on_login_for_legacy_storage"
@@ -1013,6 +1017,7 @@
             "rng_call_sites_inventoried == true"
           ],
           "priority": 5,
+          "for_signals": ["math-random-in-security-path"],
           "compensating_controls": [
             "linter_rule_added_to_ci",
             "data_flow_analysis_for_residual_paths"
@@ -1026,6 +1031,7 @@
             "fips_provider_available_in_target_dep == true"
           ],
           "priority": 6,
+          "for_signals": ["fips-claim-without-runtime-activation"],
           "compensating_controls": [
             "fips_runtime_assertion_in_init_path",
             "ci_job_running_against_fips_provider_config"
@@ -1039,6 +1045,7 @@
             "vendored_crypto_inventoried == true"
           ],
           "priority": 7,
+          "for_signals": ["vendored-pqc-no-provenance"],
           "compensating_controls": [
             "vendored_copy_pinned_to_release_tag_not_branch",
             "automated_upstream_security_advisory_subscription"
@@ -1052,6 +1059,7 @@
             "api_change_acceptable_in_next_major == true"
           ],
           "priority": 8,
+          "for_signals": ["no-crypto-agility-abstraction"],
           "compensating_controls": [
             "deprecation_path_for_old_api",
             "migration_guide_published"

package/data/playbooks/crypto.json

@@ -716,6 +716,7 @@
             "system_libssl_upgrade_safe == true"
           ],
           "priority": 1,
+          "for_signals": ["ml-kem-absent","ml-dsa-slh-dsa-absent","openssl-pre-3-5"],
           "compensating_controls": [
             "pin classical-only group fallback for legacy peers via per-service override"
           ],
@@ -729,6 +730,7 @@
             "ops_authorization_for_service_restart == true"
           ],
           "priority": 2,
+          "for_signals": ["tls-no-hybrid-group"],
           "compensating_controls": [
             "client_compat_canary_for_each_service",
             "monitoring_for_negotiation_failures"
@@ -743,6 +745,7 @@
             "operator_authorized_for_sshd_change == true"
           ],
           "priority": 3,
+          "for_signals": ["sshd-no-pqc-kex"],
           "compensating_controls": [
             "bastion_session_recording_for_legacy_kex_fallback",
             "monitoring_for_kex_negotiation_downgrades"
@@ -756,6 +759,7 @@
             "ca_supports_hybrid_signatures == true OR internal_ca_can_be_extended == true"
           ],
           "priority": 4,
+          "for_signals": ["rsa-2048-cert-long-life"],
           "compensating_controls": [
             "legacy_chain_for_pre-PQC_client_compat",
             "transparency_log_entries_for_hybrid_certs"
@@ -769,6 +773,7 @@
             "asset_inventory_baseline_exists == true"
           ],
           "priority": 5,
+          "for_signals": ["no-crypto-inventory"],
           "compensating_controls": [],
           "estimated_time_hours": 40
         },

package/data/playbooks/framework.json

@@ -723,6 +723,7 @@
             "upstream_findings_actionable == true"
           ],
           "priority": 1,
+          "for_signals": ["audit-clean-with-active-finding","compound-theater"],
           "compensating_controls": [],
           "estimated_time_hours": 16
         },
@@ -733,6 +734,7 @@
             "compensating_control_design_feasible == true"
           ],
           "priority": 2,
+          "for_signals": ["framework-lag-no-compensating-control"],
           "compensating_controls": [
             "test_cadence_recorded_in_change_management"
           ],
@@ -745,6 +747,7 @@
             "exception_register_exists == true"
           ],
           "priority": 3,
+          "for_signals": ["exception-missing-expiry-or-owner"],
           "compensating_controls": [
             "exception_review_cadence_documented"
           ],
@@ -757,6 +760,7 @@
             "jurisdictional_footprint_documented == true"
           ],
           "priority": 4,
+          "for_signals": ["jurisdiction-without-framework"],
           "compensating_controls": [
             "mapping_review_cadence_documented"
           ],
@@ -769,6 +773,7 @@
             "ai_in_production == true"
           ],
           "priority": 5,
+          "for_signals": ["ai-use-without-ai-controls"],
           "compensating_controls": [],
           "estimated_time_hours": 80
         },

package/data/playbooks/hardening.json

@@ -742,6 +742,7 @@
             "ops_authorization_for_sysctl_changes == true"
           ],
           "priority": 1,
+          "for_signals": ["kptr-restrict-disabled","unprivileged-userns-enabled","unprivileged-bpf-allowed","yama-ptrace-permissive","core-pid-dumpable"],
           "compensating_controls": [
             "change-management-ticket",
             "regression-test-suite-passed"
@@ -756,6 +757,7 @@
             "reboot_window_within_72h == true"
           ],
           "priority": 2,
+          "for_signals": ["kaslr-disabled-at-boot","mitigations-off","kernel-lockdown-none"],
           "compensating_controls": [
             "change-management-ticket",
             "post-boot-cmdline-verification"
@@ -770,6 +772,7 @@
             "workload_compatible_with_enforcing == true"
           ],
           "priority": 1,
+          "for_signals": ["selinux-not-enforcing"],
           "compensating_controls": [
             "audit-log-baseline-captured",
             "regression-test-suite-passed"
@@ -784,6 +787,7 @@
             "ssh_key_or_mfa_already_deployed == true"
           ],
           "priority": 1,
+          "for_signals": ["sshd-permitrootlogin-yes","sshd-password-auth-enabled"],
           "compensating_controls": [
             "second-session-verified",
             "break-glass-console-access-confirmed"

package/data/playbooks/identity-sso-compromise.json

@@ -672,6 +672,7 @@
             "rule_authoring_capacity_within_72h == true"
           ],
           "priority": 1,
+          "for_signals": ["out-of-window-global-admin-grant","high-impact-oauth-consent-grant","conditional-access-exclusion-membership-change","federation-signing-cert-added","refresh-token-hoarding-by-sp","prt-claim-anomaly","okta-class-support-session"],
           "compensating_controls": [
             "rule_set_recorded_in_iac",
             "rule_test_suite_in_ci"
@@ -686,6 +687,7 @@
             "break_glass_inventory_complete == true"
           ],
           "priority": 2,
+          "for_signals": ["conditional-access-exclusion-membership-change"],
           "compensating_controls": [
             "exclusion_group_membership_alert_active",
             "quarterly_attestation_recorded"
@@ -700,6 +702,7 @@
             "business_owner_engagement_secured == true"
           ],
           "priority": 2,
+          "for_signals": ["high-impact-oauth-consent-grant"],
           "compensating_controls": [
             "consent_revocation_recorded",
             "re_grant_requires_documented_justification"
@@ -714,6 +717,7 @@
             "downstream_dependent_apps_can_tolerate_rotation_window == true"
           ],
           "priority": 1,
+          "for_signals": ["federation-signing-cert-added"],
           "compensating_controls": [
             "rotation_recorded_in_change_management",
             "old_cert_signed_assertions_quarantined_for_review"

package/data/playbooks/idp-incident.json

@@ -905,6 +905,7 @@
             "downstream_relying_party_inventory_complete == true"
           ],
           "priority": 1,
+          "for_signals": ["anomalous-federated-trust-addition","session-token-forgery-evidence","mfa-factor-swap-without-password-reset","recent-high-privilege-role-assignment"],
           "compensating_controls": [
             "session-revocation-attestation",
             "downstream-saas-audit-log-baseline-captured",
@@ -920,6 +921,7 @@
             "cross_tenant_inventory_complete == true"
           ],
           "priority": 2,
+          "for_signals": ["unauthorized-consent-grant-from-non-corp-tenant","oauth-app-publisher-unverified","cross-tenant-assumption-anomaly","anomalous-federated-trust-addition"],
           "compensating_controls": [
             "consent-grant-attestation",
             "federated-trust-attestation"
@@ -934,6 +936,7 @@
             "break_glass_inventory_complete == true"
           ],
           "priority": 3,
+          "for_signals": ["service-account-unused-then-active","break-glass-account-authentication"],
           "compensating_controls": [
             "service-account-rotation-attestation",
             "break-glass-drill-calendar"

package/data/playbooks/kernel.json

@@ -589,6 +589,7 @@
             "host_supports_livepatch == true"
           ],
           "priority": 1,
+          "for_signals": ["kver-in-affected-range"],
           "compensating_controls": [],
           "estimated_time_hours": 1
         },
@@ -600,6 +601,7 @@
             "reboot_window_within_72h == true"
           ],
           "priority": 2,
+          "for_signals": ["kver-in-affected-range"],
           "compensating_controls": [
             "MAC_policy_tightened_until_reboot",
             "ssh_access_restricted_to_admins_until_reboot"
@@ -614,6 +616,7 @@
             "ops_authorization_for_sysctl_changes == true"
           ],
           "priority": 3,
+          "for_signals": ["unpriv-userns-enabled","unpriv-bpf-allowed"],
           "compensating_controls": [
             "sysctl_changes_recorded_in_change_management",
             "exploit_replay_negative_test_passed"