@blamejs/exceptd-skills 0.16.9 → 0.16.11

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:7cbe47c5-3d4f-4160-a176-1967c9b23f78",
+  "serialNumber": "urn:uuid:29d1b932-e4db-4aac-b562-a8b3727c1da6",
   "version": 1,
   "metadata": {
-    "timestamp": "2092-04-26T17:49:57.000Z",
+    "timestamp": "2048-03-26T11:44:50.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.16.9"
+        "version": "0.16.11"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.9",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.16.11",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.16.9",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 42 skills, 11 catalogs (427 CVEs / 173 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.16.11",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 43 skills, 11 catalogs (439 CVEs / 174 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.9",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.16.11",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a878765de519ea80b2e3045ac8934e38b30d87bbc11eb7b3ad1f63bfdf6b9b74"
+          "content": "70d9f0f41bcba23f227253df9e54fd9f7712bc3b14f7ab15414a19fe96727339"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.9"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.16.11"
         },
         {
           "type": "vcs",
@@ -54,7 +54,7 @@
       },
       {
         "name": "exceptd:skill:count",
-        "value": "42"
+        "value": "43"
       },
       {
         "name": "exceptd:integrity:method",
@@ -86,11 +86,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "fdab001b18df6526870f2cb552a2b9ad1afbddc8f6337dd137d72bb3667ec947"
+          "content": "fb74fd144663792dc340deb3a714fc36fca41d5c8c5ac144308763c84aa89458"
         },
         {
           "alg": "SHA3-512",
-          "content": "c3f12b8e7acb761b94e3c1f42681ef166c863f3b351dec8681b4143b87a5b914e430772dfaebb72efb3933a2846f7cd8b573903d9c6689f9d4c67a0dd1c25a1f"
+          "content": "ee990d784984d065bf2a29a074a9d23ef2f8687c03214e6150a492076ec8f09d79ee09a11127bb7fd59da8653dc4860678d5767dafcd48031fb2b0cb1adbe768"
         }
       ]
     },
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4e6bb9d2ecea4da80bb73e0d5f3540dbe1d5eb6f7fa4e3671d04080930b55b0e"
+          "content": "96f0a921259e60d698b848dad1f62f9556d30aa993b1bb4354393de8ca384258"
         },
         {
           "alg": "SHA3-512",
-          "content": "da628d1b4e0df048c16efdd0fc3c6be5699c1a425bfa03be4fa00d0483850398270d47f991757c77ac1971dc9677d1c37141a372adb3bd0f58f28bc27fed478a"
+          "content": "83a9e972e8f6d67063be8b7df88f5668acca4115195897469a9f1a358eb17756132ded3b4c775fb2608c9ab5a82c30bbb207e55e1d4f1779dee1225d788f3fb2"
         }
       ]
     },
@@ -176,11 +176,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d7188263d12b82440a9f6c076ae86455bcaea55f628b1549de22b0ad745afa3e"
+          "content": "ffa417f75487e002c2b7ea829c24b2ae3d4b9861feb9b796960498cd11039501"
         },
         {
           "alg": "SHA3-512",
-          "content": "c637ea0ed8932251bbd55ef044d8140f61a63672e4404fa247b68a81812e88c532af47c8c35c92340ae3ab46b36bdb9fe0423ea65706888682ba4a96a10dde7b"
+          "content": "3ddf859b5a55ac7fbff422672c8edaf33fc8b96a75d8d4fa89dafa074f9f43c30a60104d0255c9564da33d7f98bc5c6f7cc6c9ea3fdc67fa1d702b6b302aaa72"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b6c45954bc8d5956d9efe91cedf2806873824539547809af1f254879e3fc3a99"
+          "content": "81fbed0c2e511d190486fab7b73f80ae3f49f2fa7b1d9737e36108dbaaf15a15"
         },
         {
           "alg": "SHA3-512",
-          "content": "2541ea2dcfd5336b5f431e7d86158706e6199eb54cf65e0d3e7d84e26a3421867c88dd7b61478e5ec415a9b54b31600fda8495274688e764faeaef0dc9083557"
+          "content": "1fce92382805e2d8f8ff1698bcfc150c2a46f862befe705694b7fc67dc68ecc9a703288b95c636e7031f992fb1e4923ebf418285771f84efb783efe0b0948758"
         }
       ]
     },
@@ -341,11 +341,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5def8d82bbe51382ec55fc7186722974077e1289194e4ea002df0e3c52c6a017"
+          "content": "6fa292e00da31186d66d58cd11ee960c56d1fa7f1f6113c3b66625732a79f412"
         },
         {
           "alg": "SHA3-512",
-          "content": "59c7a63a85811aa46842b2a7888998e61983752bc3975ac65b69cf54ebea5a16d4f553690b4c2bc8afadf995d32435cdcbe5b77dc9825de2f7fccf0bb4c02fe7"
+          "content": "6ab606c53a4b568f7bb21e5f48c49359c8b23285096e9608ff682f28c8b2321c1e2857271e7698dc162dc6685a2e1286187758596e8f49f3b9d84f28f958117b"
         }
       ]
     },
@@ -521,11 +521,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f601e0354731d59069b2c34e39631b092073a25b2b92c4db9ddb2c231776c955"
+          "content": "ece18e05860fdd763645ca246d076ed2fe7e61d738412c6a69a2ce651cd6c1aa"
         },
         {
           "alg": "SHA3-512",
-          "content": "2bb266b64514534a082ad9daaa29a5ac9a2d058d0a5f2ccc134b1711a9d0349e47db775ec9f17cee8d4f3d3f317c25d7f29e9d86e8ac731e08a9f003dfcf78fa"
+          "content": "f0927574bfc2f0233a617fb93c4ad2cce5287d9a0876ae49f339f646782141f51fd1b452e7e4ec7fd4d6a7bd2d3f5b84012b4051d34a3cd76dea1016cec7886e"
         }
       ]
     },
@@ -566,11 +566,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "62ab09df198bbafba6c488bfc23cf730aec88369e957eba70b4bb228a0019619"
+          "content": "bdd51b48ddc83601a05d4d5e81a96a37095741914bc9db7905f4835a2b3e5805"
         },
         {
           "alg": "SHA3-512",
-          "content": "e1c532d6911b6b07a704f510e09129306b2becdbc72306d9ad26f218b19561565f2a720889af0d8a0cef5d15ba64525e755684c34452cbb70895e30a49acf297"
+          "content": "0db71ad4349b31179818fbff41608c828845c3f26ab4545772e9ee304e186e732bf89b454d7a3559e891c17e93396602db343577ff09e9fd524b2d21577a9c17"
         }
       ]
     },
@@ -596,11 +596,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6ae4aa2bf71486c1dede4bae72303f54baa0de51b0b66e89381109d167ff006b"
+          "content": "93603ece19e3d299ba7130f3b69c826646172cdbea0ddf91f4dddb9efcbde53c"
         },
         {
           "alg": "SHA3-512",
-          "content": "704ee26183d72c3119a4c8942b0ad7cc06caafe5317cf284486bad8ce0ffa87a130fc87090442087faac392c19b4d1521ceafec6f0401263d421de1b0aa9585f"
+          "content": "cdc1cd7166e5558588a2173ae6551c73c265c1a693993caa786a8f33921d879c12d456a2f8e2f795af7596cec1ad0b15f94d0cede1d6b197322f8c670a99f506"
         }
       ]
     },
@@ -769,6 +769,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:data/playbooks/vc-wallet-trust.json",
+      "type": "file",
+      "name": "data/playbooks/vc-wallet-trust.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "67663610d7fe7fd711dc6dc3a5f6963654263b5f979009faf44e5c60e1135431"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "af609c3248471f5a75cb70f79ffc14042ab8456d78aba70dea4fab7e2ac7a17f42a9997f309db796a372a0fb70a2b6cd6798a13c6c51ced89c5f182c4f1fd0d7"
+        }
+      ]
+    },
     {
       "bom-ref": "file:data/playbooks/webhook-callback-abuse.json",
       "type": "file",
@@ -1166,11 +1181,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3af0fa9ef45578fb8eb63f448c20ef5a6f347fbbee948e812de8e03960ef0efa"
+          "content": "069a323205aa0ee280661b9bd1b85bb4d35ea547f7f5dfdd24ea545d14ef492f"
         },
         {
           "alg": "SHA3-512",
-          "content": "51304eff2510afd251adbf0a16b6ef049d9df7d9e8670a6412443b083fb68559ed63666df8486a1e1c044c00ace4735237d227ab0c4a264fe6edcc1467462e44"
+          "content": "ff9b24c9197e80129933c1f2b89e820ebdbd401ef50b9e255723de04c959f81b0abef396bca24f0e8236b9048ff7fd516219a12f753d8297120d7ebe1af1c9de"
         }
       ]
     },
@@ -1226,11 +1241,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "601eedde3731699669bd3b99f53ea1c06bf50c43f09ce49f68da86339d1eaae3"
+          "content": "eb1a3820bba3203967c6057f12cd594e18f3044d966e1c7c1ba17757d902559f"
         },
         {
           "alg": "SHA3-512",
-          "content": "5e2ec6e21f88650c45a802486027091c95e4f4f9a1b8c43af15eaf2ac3b38fe632e7f9fcafde417705693c58587e17228fcec606459596792b168191fca2401a"
+          "content": "1a0acc79ebea7cb9d80cde43503c14f14342ccffda834752c2f29215aacfba46a9d120e78c544cd389e6023ccaa519b829dc82eb4f4de6ed1d4ca2ce2ee06e97"
         }
       ]
     },
@@ -1301,11 +1316,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "aa2c68cf9479becaaf9583f8a36c257f0d7550a49a8ecb9d1ddcdfede76d21af"
+          "content": "0ce41dee14acf7998866f5adb63502b614b5501acf8f88c37cd277c96b91a87c"
         },
         {
           "alg": "SHA3-512",
-          "content": "1f3c09e2469da54138c896a25807a3ee1ca74813670d0e14b7adb151466fc3e391227a535779379d59c681225747685081f3a38a9a9a64d021c8ac961d2d16d0"
+          "content": "58f6d75ff97f64633937bef489fdfefd6cf331115109cab30b2064cf3aebfaaddde6c973fa71b31bb44f06ecb485751ee9137e11f528a61b329b4699d53a4041"
         }
       ]
     },
@@ -1316,11 +1331,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "279c195af8a5c5304e4e3b99a06deb8c96b6de037b7df218f1426a3a3dd31328"
+          "content": "68bc62828f28047b5f09da9e5fa3c2cc3ed98d965c1a43dbf51b9fa7e45ec1a1"
         },
         {
           "alg": "SHA3-512",
-          "content": "62c93cead7f0749b9ec8462735a16ebef7ba85f8bd1a88e583e68a78486d96baa1372aabc1f958d5fb3237a9d82d05d05ba449ea94110c540f36fbee8c720a4e"
+          "content": "c05800e93846fb755ded51be74047d84d032eeff9f5a0b818b1abc16f76c7032181ded4d5cf054d0387c3d7f2d71095f55a7a42c7f4c2764ec0115300ce75c85"
         }
       ]
     },
@@ -1451,11 +1466,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ed49d69da4ef5acb4fd827deaaaf280bd6317a5defa96f6fa5696dc96c2929b4"
+          "content": "70fda3a2033d461f3ef1ac7e4bf259c9fe78090f1a1f5c09eb72dbf927e59955"
         },
         {
           "alg": "SHA3-512",
-          "content": "cee40245e9bb979c399942241faf038e95adb38ad66b6f3e70ba6034b78f774241310369773bd9ab36ceb0af1fe92e8f8b7e9b9965b3f629ab2847152f892530"
+          "content": "8547b087e1881cf58a55fd0aab186441f508ad226be0ab4aa3efd13a0e864af776f29576e25df9b4324ec7a4712bb3476faac5ed63a226a6ff71d225c297c969"
         }
       ]
     },
@@ -1631,11 +1646,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b6a9cc3871cd272304fe55c7b979b8efe4d458217f7faadd750b3235a23cd986"
+          "content": "fe42cfd0758cb2709dc7dad91c4e47b495d6ebf984b00ace2422de34e744d35f"
         },
         {
           "alg": "SHA3-512",
-          "content": "a0e8c965e7cfbfa5d6db032579de719d0aec55536f9c9fa734c0deef5367298b67b89f809fe34d9049bf3dda03834212865d95df4c1aeda23c1653483d67046e"
+          "content": "a06a61b0f278a5973c0e4d6398d1688a574dec3442ca9823d0b4c5f37d1cb1cab47e8575580051b56e34829f8e22195ded1f4f57bdc3925ca32edae3e4c8839f"
         }
       ]
     },
@@ -1721,11 +1736,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f9823302d0ebe26ddd017b2cee3e01d2fa3e9803c34b49014574fe009c962a6d"
+          "content": "3d9a53fa10f7c9842903252192f1f838bec422b99ed9562be9fd7aef88dacf20"
         },
         {
           "alg": "SHA3-512",
-          "content": "6122021e2df34e9e554db364cbdf5a2ee964180fcd5dffc02a67c86933072824ffb562d8e300d89e965d0688b06a81089a00494f9a0a757f01afe05001481a8f"
+          "content": "62cef0d1915cd4f3a63f952c2fa42c7e0279c15828ae83e5cdd8b6490767400fa7cdfbf5ecedca6fe16859ccfd72ff7acffec7209ae806a4bf6748c63d25bfc7"
         }
       ]
     },
@@ -1736,11 +1751,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d207390e8899078b09143fdf8d6642a8e0589533fc043fabf0db57f24ff39e81"
+          "content": "a774939dc7902765bf4be36cd308c34b66a3bb105f4404fa06992b79d5ac3dee"
         },
         {
           "alg": "SHA3-512",
-          "content": "91091870ab10f0d31db9ad572089b1496530ed561e6de173ad806d368a939da787386bddf20da5a7b50db79288a185afbef597af38d775438546151c835f1267"
+          "content": "dd9a282b83be1929330b58def5c377eec93fcb0fb23401c484d81a639c0e5c0df0ff6b151aaf73b720345e88c45f68f47da83ef0114f3520f6b5040f3b64f27b"
         }
       ]
     },
@@ -1751,11 +1766,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3dab3ebc6c86b2318f956da3e343ad7b470f05dd30e2afbee5a8e3b3a845a926"
+          "content": "cdd4fb5f74a72b662c5db992bb3de8d484c9c87951a40762f2b5198453747dba"
         },
         {
           "alg": "SHA3-512",
-          "content": "21f67b36206d0202a8c25045ded464d5cc36d7d97e5e4146ccce28ca08e31609fd579a4c65cbec27b10a03b61a84e80172c20886e1890052e92b80d306126f4b"
+          "content": "678e0257b4a71322194c65cc2258c0c76d0f2ec83152ef1bd3a3e453aab360da8550a4430b67eb5f8b03d8314cd283be47bd779cd22087b7855dd90129916168"
         }
       ]
     },
@@ -2201,11 +2216,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7cb063cd9a7179fa0e279273766be15011ea977e9b6601dd3cd4ca696d27abe1"
+          "content": "7ef5ed5d9a6dd68b2d43419d7fa2d0408eb8b57b69588e51db136aa0f29e82a6"
         },
         {
           "alg": "SHA3-512",
-          "content": "d96a6d849df087061fde018299c2c1c96f3c92738a8f650c53bdef1148e10a92f77be29568a0145f4eaa522489843ac84a43d96bd48e4b66a5ab02d8d3c3c5f7"
+          "content": "b96dad01e1385bc17bb1fa54d2f0d86558063856c12401fca1d96a01869de984b87cf5c54ded025a5f93762c109385ef6aed5552abff36070e281810ae063db8"
         }
       ]
     },
@@ -2216,11 +2231,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "576480c2ad29550a06e5a3e48b7dae04aadc1b505d76e3a5b1db9179d61263c4"
+          "content": "bd449efbfde0263c17aa1d2cf4ff57f39f8221e78a7f8eb62392b522acc7f3b8"
         },
         {
           "alg": "SHA3-512",
-          "content": "e3370698400f8b807680cebda861e73acedbf1602c9a7c2a8372c2285b2f88650a9d6e2931ebdb2cb229ad23e7c592787dea15a91adea5b4a854c6fc6842d38a"
+          "content": "1a7ecda566d16f89d15d721ca491962344fe9f011c27126f48cde5fb887405d5be5a28dac1892add97fd7316ab2204aa69020ede2bc1c43db4d988b45c1f1dea"
         }
       ]
     },
@@ -2486,11 +2501,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f199cc754f202fa994c1769af5e02a4ef995ee02e87221422b00f945b03e99db"
+          "content": "1e140b2a035043d72cfb1a46e57751bbb2d4b3d39ecc73b48c28625b260e17f3"
         },
         {
           "alg": "SHA3-512",
-          "content": "d504c65cda545acda811997487ca8b6fef3ee5b5447b537f502295d5f6f4266cb2ecb743389b04aa2b6118b021af6f2ce9c6f00e44cf60bd7c06b72456a500f8"
+          "content": "f027c768c24cd0c5a4aff871afe82482a7ee655a56a69ab0d95662609a95fb28a31a3b4aa1108f879bdbf59ce097a6536e931c128105a7d93436e6eed59bfd82"
         }
       ]
     },
@@ -3154,6 +3169,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:skills/vc-wallet-trust/skill.md",
+      "type": "file",
+      "name": "skills/vc-wallet-trust/skill.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "802dada75d934c9ab322246f650eb2eac9e2f72c1f094b0cebcfa605b56108a5"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "bce19482404831b9706509aace15cf36c6a6d10028a26b7d232b4f359a7d7ade3e3fbeac015ed32af4e5ab4410ec4f5c12f1635bd1f2b8687f9ed3d8c5fdd587"
+        }
+      ]
+    },
     {
       "bom-ref": "file:skills/webapp-security/skill.md",
       "type": "file",

package/scripts/check-codebase-patterns-currency.js

@@ -30,7 +30,7 @@ const ROOT = path.resolve(__dirname, "..");
 // Every key here was classified (adopted / already-owned / helper-dependent /
 // out-of-scope). A class appearing upstream but absent here is NEW and wants
 // triage. Refresh this list (and re-triage the delta) when this check fires.
-const UPSTREAM_TRIAGED = Object.freeze([
+const UPSTREAM_TRIAGED = Object.freeze([ // keep-sorted
   "ai-disclosure-on-request-without-requested-gate",
   "archive-gz-without-safedecompress",
   "archive-wrap-partial-recipient",
@@ -59,7 +59,6 @@ const UPSTREAM_TRIAGED = Object.freeze([
   "math-random-noncrypto",
   "nfinity",
   "no-number-money-arithmetic",
-  "numeric-opt-no-bounds-check",
   "primitive-unreachable",
   "process-exit",
   "raw-byte-literal",

package/scripts/check-codebase-patterns.js

@@ -19,6 +19,11 @@
  *       VALID_ALLOW_CLASSES, or is missing the `— <reason>` tail. A typo'd
  *       marker suppresses nothing, so the underlying violation would ship
  *       unflagged — this meta-guard keeps the marker mechanism trustworthy.
+ *   - unsorted-marked-array : a flat string array tagged `// keep-sorted` that
+ *       drifted out of alphabetical order. Opt-in — only marked arrays are
+ *       checked, so a one-time allowlist sort becomes a standing guarantee.
+ *   - misaligned-marked-run : a `// keep-aligned` const/weight table whose
+ *       `=`/`:` assignment columns are not all equal. Opt-in, same shape.
  *
  * Exceptions live at the violation site, not in this file:
  *   - file-level, in the first 50 lines:  // codebase-patterns:allow-file <class> — <reason>
@@ -42,6 +47,8 @@ const VALID_ALLOW_CLASSES = Object.freeze({
   "process-exit-after-stdout-write": true,
   "dynamic-regex": true,
   "bidi-codepoint-literal": true,
+  "unsorted-marked-array": true,
+  "misaligned-marked-run": true,
 });
 
 const EXCLUDE_DIRS = new Set([
@@ -272,6 +279,91 @@ function detectOrphanAllowClass(files) {
   return hits;
 }
 
+// ---- opt-in readability detectors (preventative) -------------------------
+// These fire ONLY on sites that explicitly opt in via a marker, so unmarked
+// code is never flagged. They turn a one-time cleanup (sorting an allowlist,
+// aligning a const table) into a standing guarantee: mark the cleaned site and
+// the gate keeps it clean.
+
+// `// keep-sorted` marks a flat string-literal array that must stay
+// alphabetically sorted (e.g. an allowlist). Only arrays whose opening line
+// carries the marker are checked; arrays containing object/nested elements are
+// skipped (not a flat string list).
+function scanUnsortedMarkedArray(rel, lines) {
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!/\/\/\s*keep-sorted\b/.test(lines[i])) continue;
+    const openIdx = lines[i].indexOf("[");
+    if (openIdx === -1) continue;
+    let depth = 0, started = false, body = "";
+    for (let j = i; j < lines.length; j++) {
+      const seg = (j === i) ? lines[j].slice(openIdx) : lines[j];
+      for (const ch of seg) {
+        if (ch === "[") { depth++; started = true; }
+        else if (ch === "]") { depth--; }
+      }
+      body += " " + seg;
+      if (started && depth <= 0) break;
+    }
+    if (/[{]/.test(body)) continue; // object/nested elements — not a flat string array
+    const strs = [];
+    const re = /(['"])((?:\\.|(?!\1).)*)\1/g;
+    let m;
+    while ((m = re.exec(body)) !== null) strs.push(m[2]);
+    if (strs.length < 2) continue;
+    const sorted = [...strs].sort((a, b) => (a < b ? -1 : a > b ? 1 : 0));
+    if (strs.join("") !== sorted.join("")) {
+      const k = strs.findIndex((s, idx) => idx > 0 && strs[idx - 1] > s);
+      hits.push({ file: rel, line: i + 1, content: lines[i].trim(), why: `marked // keep-sorted but "${strs[k]}" is out of alphabetical order` });
+    }
+  }
+  return hits;
+}
+function detectUnsortedMarkedArray(files) {
+  const hits = [];
+  for (const rel of (files || filesUnder(["bin/exceptd.js", "lib", "orchestrator", "scripts"]))) {
+    if (rel === "scripts/check-codebase-patterns.js") continue; // holds the detector + its own marker prose
+    hits.push(...scanUnsortedMarkedArray(rel, readLines(rel)));
+  }
+  return hits;
+}
+
+// `// keep-aligned` marks a contiguous run of `IDENT = value` / `IDENT: value`
+// lines (a const/weight table) whose assignment columns must all line up. The
+// run is the lines immediately after the marker, until a blank or non-assignment
+// line. Opt-in, so only deliberately-aligned tables are enforced.
+function scanMisalignedMarkedRun(rel, lines) {
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!/\/\/\s*keep-aligned\b/.test(lines[i])) continue;
+    const run = [];
+    for (let j = i + 1; j < lines.length; j++) {
+      if (/^\s*$/.test(lines[j])) break;
+      const code = stripLineComment(lines[j]).replace(/\s+$/, "");
+      const m = code.match(/^(\s*[A-Za-z_$][\w$.'"-]*\s*)([:=])\s/);
+      if (!m) break;
+      run.push({ lineNo: j + 1, col: m[1].length, op: m[2], content: lines[j].trim() });
+    }
+    if (run.length < 2) continue;
+    const op = run[0].op;
+    const cols = run.filter((r) => r.op === op).map((r) => r.col);
+    const target = Math.max(...cols);
+    const bad = run.find((r) => r.op === op && r.col !== target);
+    if (bad) {
+      hits.push({ file: rel, line: bad.lineNo, content: bad.content, why: `marked // keep-aligned but the '${op}' columns are not all equal` });
+    }
+  }
+  return hits;
+}
+function detectMisalignedMarkedRun(files) {
+  const hits = [];
+  for (const rel of (files || filesUnder(["bin/exceptd.js", "lib", "orchestrator", "scripts"]))) {
+    if (rel === "scripts/check-codebase-patterns.js") continue;
+    hits.push(...scanMisalignedMarkedRun(rel, readLines(rel)));
+  }
+  return hits;
+}
+
 const CLASSES = [
   {
     id: "process-exit-after-stdout-write",
@@ -282,9 +374,21 @@ const CLASSES = [
   {
     id: "dynamic-regex",
     run: detectDynamicRegex,
-    warnOnly: true, // flip to false next release once the known sites carry markers
+    warnOnly: false,
     hint: "RegExp from operator input is a ReDoS sink — anchor + length-cap, or `// allow:dynamic-regex — <reason>` when the pattern is a trusted bundled schema",
   },
+  {
+    id: "unsorted-marked-array",
+    run: detectUnsortedMarkedArray,
+    warnOnly: false,
+    hint: "a flat string array tagged `// keep-sorted` drifted out of alphabetical order — re-sort it, or drop the marker if the order is intentional",
+  },
+  {
+    id: "misaligned-marked-run",
+    run: detectMisalignedMarkedRun,
+    warnOnly: false,
+    hint: "a `// keep-aligned` const/weight table has uneven assignment columns — realign the `=`/`:` columns, or drop the marker",
+  },
   {
     id: "bidi-codepoint-literal",
     run: detectBidiCodepointLiteral,
@@ -331,6 +435,10 @@ module.exports = {
   detectDynamicRegex,
   detectBidiCodepointLiteral,
   detectOrphanAllowClass,
+  detectUnsortedMarkedArray,
+  detectMisalignedMarkedRun,
+  scanUnsortedMarkedArray,
+  scanMisalignedMarkedRun,
   filesUnder,
 };
 

package/scripts/release.js

@@ -11,7 +11,7 @@
  *
  * Usage:
  *   node scripts/release.js prepare [--minor]   # bump + sign + indexes + snapshot + sbom + baseline
- *   node scripts/release.js gates               # npm test + 18-gate predeploy
+ *   node scripts/release.js gates               # npm test + 20-gate predeploy
  *   node scripts/release.js commit              # release branch + signed commit
  *   node scripts/release.js push                # push branch + open PR
  *   node scripts/release.js watch               # CI watch + flag unresolved review threads
@@ -576,7 +576,7 @@ function cmdHelp() {
   console.log("");
   console.log("Usage:");
   console.log("  node scripts/release.js prepare [--minor]   # bump + sign + indexes + snapshot + sbom + baseline");
-  console.log("  node scripts/release.js gates               # npm test + 18-gate predeploy");
+  console.log("  node scripts/release.js gates               # npm test + 20-gate predeploy");
   console.log("  node scripts/release.js commit              # release branch + signed commit");
   console.log("  node scripts/release.js push                # push branch + open PR");
   console.log("  node scripts/release.js watch               # CI watch + flag unresolved review threads");

package/skills/vc-wallet-trust/skill.md

@@ -0,0 +1,84 @@
+---
+name: vc-wallet-trust
+version: "1.0.0"
+description: Verifiable-credential / digital-wallet verifier trust for mid-2026 — SD-JWT-VC, OID4VCI/OID4VP, mdoc (ISO 18013-5), DID resolution, OAuth Token Status List revocation, OpenID Federation trust anchors, and the EUDI wallet (eIDAS 2.0) acceptance path
+triggers:
+  - verifiable credential
+  - digital wallet
+  - sd-jwt-vc
+  - oid4vp
+  - oid4vci
+  - mdoc
+  - mdl
+  - iso 18013-5
+  - eudi wallet
+  - eidas 2.0
+  - did:web
+  - status list
+  - credential revocation
+  - openid federation
+  - trust anchor
+  - credential verifier
+  - presentation exchange
+  - dcql
+discovery_mode: standalone
+data_deps:
+  - cve-catalog.json
+  - atlas-ttps.json
+  - attack-techniques.json
+  - framework-control-gaps.json
+  - cwe-catalog.json
+  - rfc-references.json
+atlas_refs: []
+attack_refs:
+  - T1556
+  - T1606
+  - T1550
+framework_gaps:
+  - NIST-800-63B-rev4
+  - NIST-800-53-IA-5-Federated
+  - ISO-27001-2022-A.5.16-Federated
+  - NIS2-Art-21-Federated-Identity
+  - UK-CAF-B2
+cwe_refs:
+  - CWE-347
+  - CWE-290
+  - CWE-863
+  - CWE-200
+  - CWE-672
+last_threat_review: "2026-06-02"
+---
+
+# Verifiable-Credential / Digital-Wallet Verifier Trust
+
+## Threat Context (mid-2026)
+
+A credential verifier is a trust boundary: every verifiable credential it accepts grants whatever the credential asserts — age, residency, employment, professional licence, payment authority. With the EU Digital Identity Wallet (eIDAS 2.0) rolling out and ISO 18013-5 mobile driving licences in production, verifiers across payments, age-gating, and onboarding now accept SD-JWT-VC, OID4VP, and mdoc presentations from wallets they do not control. The dominant abuse is not breaking the cryptography but exploiting a missing trust check: an issuer key the verifier never pinned to an anchor, a revocation status it never read, a presentation it never bound to a fresh challenge, or a device signature it never verified. Each lets an attacker present a forged, revoked, or replayed credential that the verifier treats as authentic.
+
+## Framework Lag Declaration
+
+Organisational identity controls were written for service-to-service and human-credential authentication and are silent on the verifiable-credential acceptance path. NIST 800-53 IA-9 (service identification) and IA-5 (authenticator management) do not require credential issuer trust-anchor pinning or presentation replay-binding. ISO 27001:2022 A.5.16 governs the lifecycle of internal identities, not the trust model for externally-issued credentials a verifier accepts. NIS2 Art.21 names supply-chain trust of entities but not the cryptographic anchor model for the credentials those entities present. A clean identity-control audit is therefore NON-EVIDENCE for verifier trust posture; the controls predate the wallet ecosystem and do not exercise it.
+
+## TTP Mapping
+
+The verifier-trust failure modes map to MITRE ATT&CK: **T1606 (Forge Web Credentials)** for accepting a credential from an unanchored or algorithm-substituted issuer key; **T1556 (Modify Authentication Process)** for trusting an unpinned did:web document, an unverified key attestation, or an unanchored federation chain; and **T1550 (Use Alternate Authentication Material)** for replaying a presentation that lacks nonce/audience binding, replaying issuer-signed mdoc data without device-auth, or presenting a revoked credential whose status was never checked. The weakness classes are CWE-347 (improper signature verification), CWE-290 (authentication bypass by spoofing), CWE-672 (operation on a resource after expiration/revocation), CWE-863 (incorrect authorization), and CWE-200 (over-disclosure of personal claims).
+
+## Exploit Availability Matrix
+
+These are configuration and code-posture gaps, not single-CVE exploits, so weaponisation cost is low and reusable. Forging an unanchored issuer requires only standing up an OID4VCI issuer or serving a crafted did:web document — commodity tooling. Replaying an unbound presentation requires capturing one valid presentation and resubmitting it. Presenting a revoked credential requires nothing beyond holding a credential whose authorisation was withdrawn. Algorithm-substitution requires the verifier library to accept an unexpected alg. None require a published CVE; the exploit is the absence of the check. Real-world priority is driven by reachability (internet-facing verifier) and the value of the entitlement the credential gates, not by a CVSS score.
+
+## Analysis Procedure
+
+1. Inventory every service that ACCEPTS credentials (issuer-only services are out of scope for the verifier checks). 2. For each accepted format (SD-JWT-VC, OID4VP, mdoc, DID-identified), read the verifier accept-path and answer: is the issuer key validated against a pinned trust anchor or issuer allowlist? 3. Is the revocation / status-list resolved and enforced fail-closed? 4. Are presentations bound to a fresh verifier-issued nonce and audience (key-binding required, device-auth verified for mdoc)? 5. Is an explicit signature-algorithm allowlist enforced with "none" and unexpected symmetric algorithms refused? 6. Are disclosed claims filtered to the requested query (no over-disclosure)? Run the `vc-wallet-trust` playbook to execute these as detect indicators with false-positive checks, then score by reachability and entitlement value.
+
+## Output Format
+
+Report per accepted credential format, listing each trust check as enforced / missing / inconclusive (visibility gap). For every missing check, state the credential types and downstream entitlements it gates, whether the verifier is internet-facing, and the resulting blast radius. Distinguish a production-reachable gap from a test-only resolver. Provide the prioritised remediation (pin issuer anchors, enforce revocation fail-closed, bind presentations to nonce+audience, verify mdoc device-auth, enforce an algorithm allowlist, filter to requested claims) and the negative validation tests that prove each fix (forged-issuer rejected, revoked rejected, replayed rejected) plus the positive test that the legitimate path still accepts.
+
+## Compliance Theater Check
+
+The recurring theater is "we accept a certified wallet, so acceptance is trustworthy" and "the signature verified, so the credential is trusted." Wallet certification covers the wallet, not the verifier; a valid signature only proves some key signed the credential, not that the issuer is authentic. The distinguishing test: ask for the verifier's trust-anchor / issuer-allowlist configuration, the revocation check on the accept path, and the presentation nonce/audience binding. If acceptance succeeds against an unpinned issuer key, a never-read status list, or an unbound presentation, the assurance is paper. "Our credentials support a status list" is theater unless the verifier accept-path actually fetches and enforces it.
+
+## Defensive Countermeasure Mapping
+
+Map findings to MITRE D3FEND: trust-anchor pinning and issuer-allowlist validation realise Credential Hardening and Certificate Pinning (countering T1606/T1556); presentation nonce/audience binding and mdoc device-auth verification realise Authentication Event Thresholding and Message Authentication (countering T1550 replay); fail-closed revocation enforcement realises Credential Revoking. Pair the verifier checks with issuer key-rotation monitoring and a fast anchor-revocation path so a compromised-but-trusted issuer can be removed quickly. The residual risk after pinning is a trusted issuer's own key compromise, which trust-anchor pinning does not address — accept it at the CISO level with compensating issuer-key monitoring.