@blamejs/exceptd-skills 0.17.0 → 0.18.1

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.18.1 — 2026-06-13
+
+A correctness pass across the playbook engine's condition evaluator, the release gates, and the CLI.
+
+Conditions that reference a hyphenated signal or indicator id — the catalog's naming convention (`no-security-md`, `kver-in-affected-range`, and many more) — now evaluate correctly. The condition mini-language's token pattern excluded hyphens, so every such escalation criterion, feeds-into chain, and remediation precondition silently evaluated to false; they now fire as authored. `finding.severity >= 'high'` compares by the severity ladder (low < medium < high < critical) instead of lexicographically, so a critical finding chains downstream where it previously did not. An operator-submitted signal can no longer override an engine-computed value (rwep, finding, analyze) in an escalation or feeds-into condition. `contains` is accepted as a synonym for `includes`, and a condition the evaluator cannot parse now surfaces a `condition_unparsed` runtime error instead of silently disabling its rule.
+
+`exceptd ci --required ""` / `--scope ""` no longer fall through to cwd auto-detection and emit a green pass for an unrequested playbook set — an empty selector is refused. `exceptd ci --required` with no value gives a clean usage error instead of an internal-error report. `exceptd report --json` (no format) emits JSON instead of failing, and `--json` now produces machine-readable output for the executive, technical, and compliance formats, not only csaf. A `--cwd` passed to a verb that does not consume it (run, ci) is refused rather than silently ignored.
+
+The release gates are hardened: the test-count gate no longer counts `test(` occurrences inside block or trailing comments (commenting a test out now registers as a removal); the SBOM currency gate fails when the aggregate bundle digest is absent rather than silently skipping it; the diff-coverage analyzer reads the full `module.exports` object across nested members; and an informational predeploy gate killed by a signal (OOM) is treated as a failure.
+
+## 0.18.0 — 2026-06-13
+
+The minimum supported Node.js is raised to 24.16.0 (`engines.node` is now `>=24.16.0`), the current Node 24 LTS patch. This makes the runtime's accumulated security fixes across the 24.x line — V8 and OpenSSL patches — the supported baseline rather than an older floor. CI, the release workflow, the daily-refresh and currency workflows, and the Docker reproduction harness are all pinned to 24.16.0 (the Docker base image is re-pinned by digest), and a `.nvmrc` is added so `nvm use` selects the supported version automatically. Installs on Node 22 will surface an `engines` warning; upgrade to Node 24 LTS.
+
 ## 0.17.0 — 2026-06-13
 
 Twenty newly-listed CISA KEV vulnerabilities are now curated into the catalog (439 → 459 CVEs). Each carries verified CVSS and vector, CWE classification, confirmed active-exploitation status, affected versions, framework-control-gap mapping, ATT&CK (and where applicable ATLAS) references, RWEP scoring, behavioral indicators of compromise, and a matching zero-day lesson — every fact sourced from NVD, the CISA KEV catalog, and the vendor advisory.

package/bin/exceptd.js

@@ -1316,6 +1316,7 @@ function dispatchPlaybook(cmd, argv) {
     "against", "since", "bundle-epoch", "attestation-root", "format",
     "cwd",  // exceptd collect <pb> --cwd <path>
     "limit",  // exceptd attest list --limit <n>
+    "required",  // exceptd ci --required <pb,pb> — value-less form must refuse, not `true.split(",")`
   ]);
   const verbAllowlist = flagsFor(cmd);
   const allowlistSet = new Set(verbAllowlist);
@@ -1767,6 +1768,10 @@ function dispatchPlaybook(cmd, argv) {
     "max-rwep": ["ci"],
     "diff-from-latest": ["run"],
     "upstream-check": ["run"],
+    // --cwd is only consumed by collect/discover (which scan a directory). On
+    // run/ci/etc. it was silently accepted-and-ignored, so `run secrets --cwd
+    // /target` returned a falsely-clean result for a directory never inspected.
+    "cwd": ["collect", "discover"],
   };
   for (const [flag, relevantVerbs] of Object.entries(SINGLE_VERB_PASSTHROUGH)) {
     // A value-less boolean flag parses as `true`; a value-bearing one as its
@@ -8704,11 +8709,12 @@ function cmdCi(runner, args, runOpts, pretty) {
       );
     }
     ids = positional;
-  } else if (args.required) {
+  } else if (args.required !== undefined) {
+    // Gate on PRESENCE, not truthiness: an empty `--required ""` is falsy and
+    // previously fell through to the cwd auto-detect branch, emitting a green
+    // PASS for an unrequested, auto-detected playbook set — a false green.
     // Refuse `--required + --all` / `--required + --scope` as ambiguous
-    // (matches the positional-args refusal at top of cmdCi). Pre-fix
-    // the runner silently picked --required and dropped --all/--scope,
-    // which is operator error — surface it loudly.
+    // (matches the positional-args refusal at top of cmdCi).
     const conflictingFlags = [];
     if (args.all) conflictingFlags.push('--all');
     if (args.scope) conflictingFlags.push('--scope');
@@ -8719,8 +8725,15 @@ function cmdCi(runner, args, runOpts, pretty) {
         pretty,
       );
     }
-    const requestedRaw = Array.isArray(args.required) ? args.required.join(",") : args.required;
+    const requestedRaw = Array.isArray(args.required) ? args.required.join(",") : String(args.required);
     const requested = requestedRaw.split(",").map(s => s.trim()).filter(Boolean);
+    if (requested.length === 0) {
+      return emitError(
+        `ci --required: empty playbook list. Pass at least one playbook id (e.g. --required secrets,containers), or use --all / --scope <type>.`,
+        null,
+        pretty,
+      );
+    }
     const all = runner.listPlaybooks();
     const unknown = requested.filter(r => !all.includes(r));
     if (unknown.length > 0) {
@@ -8732,7 +8745,10 @@ function cmdCi(runner, args, runOpts, pretty) {
     ids = runner.listPlaybooks().filter(id =>
       includeJudgementShaped || !POLICY_SKIPPED_PLAYBOOKS.has(id)
     );
-  } else if (scope) {
+  } else if (scope !== undefined) {
+    // Presence, not truthiness: an empty `--scope ""` must reach
+    // filterPlaybooksByScope (which rejects it with the accepted-set message),
+    // not silently fall through to the cwd auto-detect branch below.
     const includeJudgementShaped = args["include-judgement-shaped"] === true;
     try { ids = filterPlaybooksByScope(runner, scope, { includeJudgementShaped }); }
     catch (e) { return emitError(`ci: ${e.message}`, { provided_scope: scope }, pretty); }

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-13T17:35:41.356Z",
+  "generated_at": "2026-06-13T20:39:55.957Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "096c0f1edc68448d21c8556dea01e3461d0efa24e0ea9ebe59554a92ca8a3946",
+    "manifest.json": "76d31e7050f332fc608e48f3f4c286c8d9dfe309d2fc98ef7d5110e3e4351aac",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",

package/lib/playbook-runner.js

@@ -1402,7 +1402,7 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     findingShape = {};
   }
   for (const ec of an.escalation_criteria || []) {
-    if (evalCondition(ec.condition, { rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, analyze: result, finding: findingShape, ...agentSignals, ...evalCtxRoot }, playbook)) {
+    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, analyze: result, finding: findingShape }, playbook)) {
       escalations.push({ condition: ec.condition, action: ec.action, target_playbook: ec.target_playbook || null });
     }
   }
@@ -1920,12 +1920,16 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
   // feeds_into chaining — full analyze result is exposed so conditions can
   // reference `analyze.compliance_theater_check.verdict` etc.
   const feedsCtx = {
+    // Operator-submitted signals come FIRST so the engine-computed reserved
+    // keys below always win — otherwise a submitted signals.rwep / finding /
+    // analyze would override the engine value the feeds_into condition tests
+    // and could suppress a legitimate downstream chain.
+    ...agentSignals,
     rwep: analyzeResult.rwep?.adjusted,
     theater_score: analyzeResult.compliance_theater_check?.verdict === 'theater' ? 0 : 100,
     analyze: analyzeResult,
     validate: validateResult,
     finding: analyzeFindingShape(analyzeResult),
-    ...agentSignals,
     // Surface evalCondition regex failures from the feeds_into chain into
     // the same accumulator. Without this the regex failure happens but
     // analyze.runtime_errors[] never sees it.
@@ -3869,8 +3873,11 @@ function evalCondition(expr, ctx, playbook) {
   const andParts = splitAtTopLevel(expr, 'AND');
   if (andParts.length > 1) return andParts.every(s => evalCondition(s, ctx, playbook));
 
-  // "rwep >= 90"
-  let m = expr.match(/^(\w+(?:\.\w+)*)\s*(>=|<=|==|=|<|>|!=)\s*(['"]?)([^'"]+)\3$/);
+  // "rwep >= 90". The LHS/RHS path tokens admit hyphens because signal and
+  // indicator IDs are canonically hyphenated across the catalog (e.g.
+  // `no-security-md`, `kver-in-affected-range`); a `\w`-only token silently
+  // failed to match every hyphenated condition and fell through to `false`.
+  let m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s*(>=|<=|==|=|<|>|!=)\s*(['"]?)([^'"]+)\3$/);
   if (m) {
     const [, lhs, op, quote, rhsRaw] = m;
     const lv = resolvePath(ctx, lhs);
@@ -3880,32 +3887,42 @@ function evalCondition(expr, ctx, playbook) {
     } else if (rv === 'true') rv = true;
     else if (rv === 'false') rv = false;
     else if (!isNaN(parseFloat(rv)) && /^-?\d+(\.\d+)?$/.test(rv.trim())) rv = parseFloat(rv);
-    else if (/^[a-z_][\w.]*$/i.test(rv.trim())) {
+    else if (/^[a-z_][\w.-]*$/i.test(rv.trim())) {
       // Unquoted identifier — treat as a context path. Falls through to the
       // raw string if resolution returns undefined (matches the prior behavior
       // for literals like `theater` that aren't quoted).
       const resolved = resolvePath(ctx, rv.trim());
       if (resolved !== undefined && resolved !== null) rv = resolved;
     }
+    // Severity is an ordinal word ladder (low < medium < high < critical), not
+    // a lexically-ordered string. When both sides are severity words, compare
+    // by rank so `severity >= 'high'` includes 'critical' (raw string `>=`
+    // would exclude it: 'critical' < 'high' lexicographically).
+    const SEV = { low: 0, medium: 1, high: 2, critical: 3 };
+    const lr = SEV[String(lv).toLowerCase()], rr = SEV[String(rv).toLowerCase()];
+    const a = (lr !== undefined && rr !== undefined) ? lr : lv;
+    const b = (lr !== undefined && rr !== undefined) ? rr : rv;
     switch (op) {
       case '==': case '=': return lv == rv;
       case '!=': return lv != rv;
-      case '>=': return lv >= rv;
-      case '<=': return lv <= rv;
-      case '>':  return lv > rv;
-      case '<':  return lv < rv;
+      case '>=': return a >= b;
+      case '<=': return a <= b;
+      case '>':  return a > b;
+      case '<':  return a < b;
     }
   }
 
-  // "scope.targets includes named_remote"
-  m = expr.match(/^(\w+(?:\.\w+)*)\s+includes\s+(\w+)$/);
+  // "scope.targets includes named_remote" — `contains` is accepted as a
+  // synonym for `includes` (the catalog uses both); hyphenated paths + members
+  // are admitted for the same reason as the comparison branch above.
+  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+(?:includes|contains)\s+([\w-]+)$/);
   if (m) {
     const arr = resolvePath(ctx, m[1]);
     return Array.isArray(arr) && arr.includes(m[2]);
   }
 
   // "matched_cve.vector matches /regex/"
-  m = expr.match(/^(\w+(?:\.\w+)*)\s+matches\s+\/(.+)\/$/);
+  m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)\s+matches\s+\/(.+)\/$/);
   if (m) {
     const val = resolvePath(ctx, m[1]);
     if (typeof val !== 'string') return false;
@@ -3939,7 +3956,21 @@ function evalCondition(expr, ctx, playbook) {
     }
   }
 
+  // A condition the mini-language can't parse is a DEAD condition — it returns
+  // false for every input, silently disabling whatever escalation / feeds_into
+  // chain / precondition it gates. Surface it as a runtime_error so a dead
+  // condition is observable instead of an invisible `false` (this is how an
+  // authoring typo or an unimplemented operator gets caught at runtime).
   if (process.env.EXCEPTD_DEBUG) console.warn(`[runner] unknown condition: ${expr}`);
+  {
+    const target = (ctx && Array.isArray(ctx._runErrors)) ? ctx._runErrors
+      : (playbook && Array.isArray(playbook._runErrors)) ? playbook._runErrors
+      : null;
+    if (target) {
+      pushRunError(target, { kind: 'condition_unparsed', condition: String(expr).slice(0, 200) },
+        { dedupeKey: x => x.condition || '' });
+    }
+  }
   return false;
 }
 
@@ -4129,7 +4160,9 @@ function computeClockStart(eventName, agentSignals, runOpts = {}, engineClassifi
 
 function expressionKey(expr) {
   // For agentSignals precondition lookups — strip operators/values to leave key.
-  const m = expr.match(/^(\w+(?:\.\w+)*)/);
+  // Admits hyphens so a hyphenated precondition id (the catalog norm) resolves
+  // to the full key instead of being truncated at the first hyphen.
+  const m = expr.match(/^([A-Za-z_][\w-]*(?:\.[A-Za-z_][\w-]*)*)/);
   return m ? m[1] : expr;
 }
 

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-06-13T17:11:21.932Z",
+      "signed_at": "2026-06-13T20:32:56.044Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "WfqxU2x/feWgatYrCeO9PD3dIY0FAfs4nkVdQRac4fg5BDQPG/vhzhvYVN6Mg11oITACghbPOtZXvS37sACsCA==",
-      "signed_at": "2026-06-13T17:11:21.933Z",
+      "signed_at": "2026-06-13T20:32:56.046Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "9bNOW4MzmUlFgkXH5tIZkq8YpzhMM+r8YVcNEM39kdEZwfRNG4Bj+Dgr7v4Qgp9D4q7hGNFpK0ywX+dPd3VWAg==",
-      "signed_at": "2026-06-13T17:11:21.934Z",
+      "signed_at": "2026-06-13T20:32:56.047Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "5A08+nAu5jwNQ1+vGbFgFAJA/kYD3oiaevhCxT4/2FeW++F070Pm4MD1+oXdv8R2DbtYr+7yXnCGM7UbUPR2AA==",
-      "signed_at": "2026-06-13T17:11:21.934Z"
+      "signed_at": "2026-06-13T20:32:56.047Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "RCgbI0sMNTKAscXUtrVU25u7OuE64uQvO5JKsB8vIJFWguvT6nZyD7euKuIxIzYhLTyHBiD7Rhp70btlK+JkCg==",
-      "signed_at": "2026-06-13T17:11:21.935Z"
+      "signed_at": "2026-06-13T20:32:56.048Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "JJrs+B22/hYxvdYs+abmoire5PbQXPb2uVYyjInZ3UbT8gEjs/5SyfGKx7z86jbtvB3ItApQVAx1AuseIgdyAQ==",
-      "signed_at": "2026-06-13T17:11:21.935Z"
+      "signed_at": "2026-06-13T20:32:56.048Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "Z6WbTqG98bQVRd6+kXDb6xIEe0ZryAeGxVSuKKxdK1PoZqew7NJcMsa6sJVSq+0r7KMsFwfTEdKorp6UDdhpCA==",
-      "signed_at": "2026-06-13T17:11:21.936Z",
+      "signed_at": "2026-06-13T20:32:56.049Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "DLKcrgon+MZrqmivlFLBH4vlzZbJSW1531RsYDm9/KdW2CgcUUHwNMSzAfU1mAsFwFkAHjy/a8e1FbS9msTvDA==",
-      "signed_at": "2026-06-13T17:11:21.936Z",
+      "signed_at": "2026-06-13T20:32:56.049Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "eWCOD+mR1c6B8vKDBot8y8UkQrKPCIEBHU3JRQET9xZnYGx8hrOyeRUElcKqCO5aG/2LISs9Atg1H+ehWDNbCw==",
-      "signed_at": "2026-06-13T17:11:21.936Z",
+      "signed_at": "2026-06-13T20:32:56.049Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -477,7 +477,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "kZca725/+BFr1mpxL29+cGzjqsiYhChWScf7VjU6vCTBZrmCps6W9gYYjf4lVORXaM4DAg3UVBOXyhpTst0rAw==",
-      "signed_at": "2026-06-13T17:11:21.937Z",
+      "signed_at": "2026-06-13T20:32:56.050Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -516,7 +516,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-06-13T17:11:21.937Z"
+      "signed_at": "2026-06-13T20:32:56.050Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -543,7 +543,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "NVBY4I5a+v2/nUeCYcy3LLVKk3Tg9gmz+sCKyvnf8t2fXMNSIGtoy+P8K4Gfos1rGzRRMaU01V7L4kh/IQ8UBQ==",
-      "signed_at": "2026-06-13T17:11:21.938Z",
+      "signed_at": "2026-06-13T20:32:56.051Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -607,7 +607,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "U54OxIjPT+W9yafjpeFgY7klXMltLYBuSCtu/AAlXxOIPehJrbf/vbGgnBn58nqOd7RjoKjmKz9WQs4DMqWcDw==",
-      "signed_at": "2026-06-13T17:11:21.938Z",
+      "signed_at": "2026-06-13T20:32:56.051Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -655,7 +655,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "QsJMwvnUJXHwoBPJ4BiUx3FO9giXfos/sMbx5tyO83AJ2JxdVskeC6g/WDfO+rVkWNXRgWi4h1eSYz6T8/tpAg==",
-      "signed_at": "2026-06-13T17:11:21.939Z"
+      "signed_at": "2026-06-13T20:32:56.051Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -692,7 +692,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8KbLVVPI1QgYa+HAnEYvKf1cXnxQ3zsncqTGrAOrBP4rwUeZsxJm8KyFCwI0XytnZG35PZ830BFlG/okPW3sBQ==",
-      "signed_at": "2026-06-13T17:11:21.939Z",
+      "signed_at": "2026-06-13T20:32:56.052Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -727,7 +727,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-06-13T17:11:21.939Z"
+      "signed_at": "2026-06-13T20:32:56.052Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -799,7 +799,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "ZnFi+Rk4CWrjFEVU4hC6Q66UbDmndNL/ICLWQNA1TQYFGSTnng+nboM4tfi6h0yMbbDj7dOXYqqeHNK+M5ZiBA==",
-      "signed_at": "2026-06-13T17:11:21.940Z"
+      "signed_at": "2026-06-13T20:32:56.052Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -859,7 +859,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "45ICz7vcnmHYE1+RIDv8wQjScKj6p8hqJQ5m6I0tDdKVnGdMXCYIgZnYqFJgHBDXYAXlGx7D7UxhFz6WOCDqAQ==",
-      "signed_at": "2026-06-13T17:11:21.940Z"
+      "signed_at": "2026-06-13T20:32:56.053Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -934,7 +934,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "k6A7QcFEzgGXYWftt/elhQe7kU4F67c0ol3a8DZfj1XW4UrH99SLhPHr6ih3R3EYCl/Ey/zXt/x3a9fDT3RmAw==",
-      "signed_at": "2026-06-13T17:11:21.940Z"
+      "signed_at": "2026-06-13T20:32:56.053Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1013,7 +1013,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "5shKqNcLC8Obt0EdvKnck8OwWIuRMgZuuZd12pvWqJIltsYMyTrw2M+lgbQfqg3x2KO6qsJljGAhTew5jM58DQ==",
-      "signed_at": "2026-06-13T17:11:21.941Z"
+      "signed_at": "2026-06-13T20:32:56.054Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1070,7 +1070,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lfa5Wgep26mK3o2ZSe5qN2vVxg+xRRURRpmnqP4JdQvvecW3T2+PxHqjT48DegXJHRXJ6DPzyIElFc7no86TAg==",
-      "signed_at": "2026-06-13T17:11:21.941Z"
+      "signed_at": "2026-06-13T20:32:56.054Z"
     },
     {
       "name": "identity-assurance",
@@ -1137,7 +1137,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-06-13T17:11:21.942Z"
+      "signed_at": "2026-06-13T20:32:56.054Z"
     },
     {
       "name": "ot-ics-security",
@@ -1193,7 +1193,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "afJ00EDXgARQJrbRqN6xe1+E/kbHF7O2fxQFVvrLLXdrKfK86RK/oJU1AwpxX6mclX9f+5ivy6FvFIuRMA4dBQ==",
-      "signed_at": "2026-06-13T17:11:21.942Z"
+      "signed_at": "2026-06-13T20:32:56.055Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1245,7 +1245,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "VzivMW82mRrG9+07ZX8sj4j9O9YjE/m07m1UHgSwEgex+FLaVPvIj3y1Vk6qeFOvDURmtVaztWlpSlk7iSn0DA==",
-      "signed_at": "2026-06-13T17:11:21.943Z"
+      "signed_at": "2026-06-13T20:32:56.055Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1295,7 +1295,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "Fk5LzzeS/bH5SQJNySgZqSdeQf1udwdRs3FVLwig5kuqyyKkuIJcF4HW+xHF/1e66HR+gjgRUoqWZGsv58lLAg==",
-      "signed_at": "2026-06-13T17:11:21.943Z"
+      "signed_at": "2026-06-13T20:32:56.055Z"
     },
     {
       "name": "webapp-security",
@@ -1369,7 +1369,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "1skHJsPPOIXLQdU5MGHirP/Q07aCYTirtDmfWDO7ZNuto58NlCttW5ZjCpyh37vASlMljIZx0/R+PIl2PfwTBw==",
-      "signed_at": "2026-06-13T17:11:21.943Z",
+      "signed_at": "2026-06-13T20:32:56.055Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-06-13T17:11:21.944Z"
+      "signed_at": "2026-06-13T20:32:56.056Z"
     },
     {
       "name": "sector-healthcare",
@@ -1482,7 +1482,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "yyAGG3nUC6/XWQGRF2ufzILfiJitMFczqWNY83lZShCgYSxfFCul0UsICClOc7Xjw76052uydm8kLH9gIzhsAg==",
-      "signed_at": "2026-06-13T17:11:21.945Z"
+      "signed_at": "2026-06-13T20:32:56.057Z"
     },
     {
       "name": "sector-financial",
@@ -1563,7 +1563,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "/+df91Qhl1TIxEAqzgqB7+YJ6mneX6Dif+h6RaCbxOLGE6KRTFst1Q/Fu5SStt8Zx5JI62bkQ2BBrNOKfUlPBg==",
-      "signed_at": "2026-06-13T17:11:21.945Z"
+      "signed_at": "2026-06-13T20:32:56.057Z"
     },
     {
       "name": "sector-federal-government",
@@ -1632,7 +1632,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "k6MAPS8HJivu0DNwC1azPvyKeig2xLGz/hcqYd8T+s5GvIypPGfkeYRRKmdqMgHUe24f7bQeRZ7AxcQ9Bi6SCg==",
-      "signed_at": "2026-06-13T17:11:21.945Z"
+      "signed_at": "2026-06-13T20:32:56.057Z"
     },
     {
       "name": "sector-energy",
@@ -1697,7 +1697,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "IYKXn009jfhpKdQKiGB4xb7VgxsJXa6PZawoguP42khU6S/TTemp/YsK1YQCUyabE+2biElL/PP1Hi8zCkSSBw==",
-      "signed_at": "2026-06-13T17:11:21.946Z"
+      "signed_at": "2026-06-13T20:32:56.058Z"
     },
     {
       "name": "sector-telecom",
@@ -1783,7 +1783,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-06-13T17:11:21.946Z"
+      "signed_at": "2026-06-13T20:32:56.058Z"
     },
     {
       "name": "api-security",
@@ -1852,7 +1852,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "HUjhPGpZeZeVi1nzBIsEAYh18x5ltlIXnt1yQ5YKz+jC2Dvxw7vV/Clx1/1gDBLAuBvRW9wcNtDr4c0RxhfGDQ==",
-      "signed_at": "2026-06-13T17:11:21.947Z",
+      "signed_at": "2026-06-13T20:32:56.058Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1938,7 +1938,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "xa1kr/92/0fBds7LVtRy9aCM2tQRWAfNSFoC6ygbOU7QjamUo8Wt2h2n9W+nZT34STN3woYhXqtfmm8NSjXdBQ==",
-      "signed_at": "2026-06-13T17:11:21.947Z"
+      "signed_at": "2026-06-13T20:32:56.059Z"
     },
     {
       "name": "container-runtime-security",
@@ -2000,7 +2000,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "60hyXAiYfY9lI+EpHG3iFFxa+oF5n71c0tTMa6iXFLNjBJKPevTsdNgQlQsBEnmRJ+dWtOjb/GNBW1KiBx4XAQ==",
-      "signed_at": "2026-06-13T17:11:21.948Z",
+      "signed_at": "2026-06-13T20:32:56.059Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2074,7 +2074,7 @@
         "MITRE ATLAS v2026.05 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IEECw5lO6ZdpkE/j7Hv6/3Jg2vj9fpXlozY+h85Hrn9QYOJuI0gfBjHoBEchJ2GUTmPwUKoiBoI72PBAQw9RCQ==",
-      "signed_at": "2026-06-13T17:11:21.948Z"
+      "signed_at": "2026-06-13T20:32:56.060Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2136,7 +2136,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "pN1Qa5NRyNJ6h0pmbbqpy3xWdkMANDMUbBst5SKR5fmmqMFopmyrzwIGagiiNgqxjjCunj9J9Wbzs1sL48sMCQ==",
-      "signed_at": "2026-06-13T17:11:21.949Z"
+      "signed_at": "2026-06-13T20:32:56.060Z"
     },
     {
       "name": "ransomware-response",
@@ -2216,7 +2216,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "sXPA1lvWvZpf5sHxZXRkO0Kcs6gnXiYq0mWA53y1HeBwQGJ+viSPMt5IMobkjd5qLFYchg0CpW/nBUIvUE6/DA==",
-      "signed_at": "2026-06-13T17:11:21.949Z"
+      "signed_at": "2026-06-13T20:32:56.061Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2269,7 +2269,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-06-13T17:11:21.950Z"
+      "signed_at": "2026-06-13T20:32:56.061Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2337,7 +2337,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "7Wdii9uwYmDrzQohoWRWDa5A4aDRKOmdLPq5Jsql86O0Gm7pQANnj9tX+cHpQcQ/Ui8VLuNVP8UFdKxxHeDnBg==",
-      "signed_at": "2026-06-13T17:11:21.950Z"
+      "signed_at": "2026-06-13T20:32:56.061Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2417,7 +2417,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-06-13T17:11:21.951Z",
+      "signed_at": "2026-06-13T20:32:56.062Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2511,7 +2511,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-06-13T17:11:21.951Z",
+      "signed_at": "2026-06-13T20:32:56.062Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2583,7 +2583,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-06-13T17:11:21.952Z"
+      "signed_at": "2026-06-13T20:32:56.062Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2642,7 +2642,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-06-13T17:11:21.952Z"
+      "signed_at": "2026-06-13T20:32:56.062Z"
     },
     {
       "name": "network-trust",
@@ -2698,7 +2698,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-06-13T17:11:21.952Z"
+      "signed_at": "2026-06-13T20:32:56.063Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2753,7 +2753,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-06-13T17:11:21.953Z"
+      "signed_at": "2026-06-13T20:32:56.063Z"
     },
     {
       "name": "self-update-integrity",
@@ -2807,7 +2807,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-06-13T17:11:21.953Z"
+      "signed_at": "2026-06-13T20:32:56.063Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -2865,7 +2865,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-06-13T17:11:21.953Z"
+      "signed_at": "2026-06-13T20:32:56.063Z"
     },
     {
       "name": "decompression-dos",
@@ -2923,7 +2923,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-06-13T17:11:21.953Z"
+      "signed_at": "2026-06-13T20:32:56.064Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -2978,7 +2978,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-06-13T17:11:21.954Z"
+      "signed_at": "2026-06-13T20:32:56.064Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3033,11 +3033,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-06-13T17:11:21.954Z"
+      "signed_at": "2026-06-13T20:32:56.064Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "+mMtPuzhLEQTT0v7GfPGnLhhEr2QTH19cDXYqpb9TJPotBPW1EYc08Zh8vy5+l5/ofZBVwfN++z8eou/oomgCA=="
+    "signature_base64": "Jjbs014T8Wttzxj8RHg18ND3ASK9YudsKwKFtJRBwaFBcG1gcxDJz6vbyHNwkcLA2fND58IRE2wkGPPgBCwABw=="
   }
 }

package/orchestrator/index.js

@@ -114,7 +114,10 @@ async function main() {
       runCurrency();
       break;
     case 'report':
-      await runReport(args[0] || 'technical');
+      // Resolve the format from the first NON-FLAG positional so `report --json`
+      // (no format given) defaults to technical instead of treating "--json" as
+      // an invalid format and exiting 1.
+      await runReport(args.find((a) => typeof a === 'string' && !a.startsWith('--')) || 'technical');
       break;
     case 'watch':
       await runWatch();
@@ -581,6 +584,25 @@ async function runReport(format) {
   const plan = dispatch(scanResult.findings);
   const { currency_report } = currencyCheck();
 
+  // The help advertises `--json for machine-readable output`. Previously only
+  // `report csaf` emitted JSON; executive/technical/compliance silently
+  // rendered Markdown even with --json. Honor the flag for those formats too.
+  if (args.includes('--json')) {
+    process.stdout.write(JSON.stringify({
+      ok: true,
+      verb: 'report',
+      format,
+      generated_at: new Date().toISOString(),
+      summary: scanResult.summary,
+      priority_actions: plan.plan
+        .filter((p) => p.priority <= 2)
+        .map((p) => ({ severity: p.finding_severity, skill: p.skill_name, action_required: p.action_required })),
+      skill_currency: currency_report,
+      host: scanResult.host,
+    }, null, 2) + '\n');
+    return;
+  }
+
   // Bug #48: header now self-describes the report flavor so a piped-to-file
   // report carries its provenance internally. Previously only stderr
   // (`[orchestrator] Generating <X> report`) distinguished the three.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (459 CVEs / 181 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",
@@ -43,7 +43,7 @@
   "license": "Apache-2.0",
   "author": "blamejs contributors",
   "engines": {
-    "node": ">=22.11.0"
+    "node": ">=24.16.0"
   },
   "bin": {
     "exceptd": "bin/exceptd.js"

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:a48e92a1-ec59-4f7f-beed-28a5c2480b31",
+  "serialNumber": "urn:uuid:763b8882-5bfd-43d3-98a3-7d5bce35cfda",
   "version": 1,
   "metadata": {
-    "timestamp": "2113-06-27T18:51:13.000Z",
+    "timestamp": "2088-11-09T11:37:38.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.17.0"
+        "version": "0.18.1"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.17.0",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.1",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.17.0",
+      "version": "0.18.1",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (459 CVEs / 181 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.17.0",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.1",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "35329d2060894d8caddf3e0339f194480b5c3f19410dbd1bf85b908741f2fbf2"
+          "content": "b6d798a95882195d629316ed20d3a16ccf6c4f3d244afdb7a73c4f81047dad02"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.17.0"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.1"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "bf46918f437356885dcfad9739d101d5578221e3eca873991645126d441697b8"
+          "content": "238b86fe051241489de918c24646d341e1efc25fb165532c88719277cbc1d908"
         },
         {
           "alg": "SHA3-512",
-          "content": "5b39aa1b3b81e8cec7d5555fc16111e46baf41e2f345c8ca19329e78af65d320b9b10d5e6224453ea39f0a0d0960b2162598478817780dc6f4d0a4dcfe297357"
+          "content": "8bc3c909b8bd6d5b140a0735c6abe35e32e191b273d1862816ec2878b36359d34d3d951c2c046b98a42f3cad9d2a1577f280ad5b5b13b2f80ba6d4586b208391"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "17553af5707a5bf163f76eb28c62bca472d7d9cb74c5d2fb5eb7bf18ab63bde8"
+          "content": "379a16da41f9d9ff66c4e1d19453d6a92d71da5f4464f94440d5185e1e14b4de"
         },
         {
           "alg": "SHA3-512",
-          "content": "05a98e18e6e13d94ee77b95bcb5e22288b5780c1279d89549e9683fce3661165c2e9578ac08ef0732543fb51f59e9588fe6a0141a498a5e91e9afa07766f21f0"
+          "content": "803a6475512aea6fb1eb2f64a20ae3122398cee7408a00a0ca309ed8d41d6d70fb442603bfbdfa43b043b198c3662f2e141f73ae7729f47e4ed37750111d6dbd"
         }
       ]
     },
@@ -1466,11 +1466,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "59179357f3ebc1cae07ca63f6e53441e1f5ce001491b0a71c03b00270403a7c7"
+          "content": "0941607a18c500307bc7eb21f799f1ed752aa7ce74fca0e32807e6e1fe2845f2"
         },
         {
           "alg": "SHA3-512",
-          "content": "b2f8c4ebda7ada3125f8b6cb56fedf7b6072606130cba59c29679df22161162774d7a43e9c3a1b8860ada5320f18ee9d771cd20b48a324c4f2218afd42b0a03d"
+          "content": "8f7ddf0df4be4d5480c30769ddd1d443ab53bc49d0d8b6e2322e42fed52ad5b541e40f1d632c5e25112979a6fca93e67f9ce831a8e1d35570f062c66867f1410"
         }
       ]
     },
@@ -1901,11 +1901,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "096c0f1edc68448d21c8556dea01e3461d0efa24e0ea9ebe59554a92ca8a3946"
+          "content": "76d31e7050f332fc608e48f3f4c286c8d9dfe309d2fc98ef7d5110e3e4351aac"
         },
         {
           "alg": "SHA3-512",
-          "content": "1eda539b22b0baabfc79b681ffa9f4e36242d02f511c79017292b139552867aff7c44bb2e8e73a17dbd157d446e55dd2588adacf5dc3c1f1215cb7e6f1f85717"
+          "content": "37d22dbc0e4d2af548f889b2b8835f399f5a433b849c8005658591c4a853a1abe5121f8b96710033bfe30acb9703749ce9d248da665922ec5480099954438645"
         }
       ]
     },
@@ -1961,11 +1961,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "79ff6e5e1360099debfa00034ccf903f0b10f58dab982af180aa79ea69ee6dbd"
+          "content": "19673efb614ff862387b4d862a412851f05c8e0488f5bb4129b7798349f17502"
         },
         {
           "alg": "SHA3-512",
-          "content": "e57b550de41c42538aa0fc995bbea05f15b5a6c634fda4ec3fbba490ff520269525596f9d2cc941c4656651fae14ee4433f8b88cb4142578ea8218e2e365c47f"
+          "content": "424d8c62e8e43f4b7a22e6c3963179eaaa431f50ec2b6af12176e85331ec9b0bd651f7a535ea0fbc6d3910e22ea7140a7e90208c1d379e08788ac6b85157d221"
         }
       ]
     },
@@ -2396,11 +2396,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3fcc2abf934ee1b70674856ba937833830d45346b4f146d613e500b9a9b4d163"
+          "content": "6d8c8b1f1a412d7b0e357377359c1992cc67eb0d73d28d7f56c89347a09e2003"
         },
         {
           "alg": "SHA3-512",
-          "content": "1cc3b832434aa188fc7136feadb286c68d528e1e35406572bbaaf29a1b21be90ca59f3a8ea96d7173e7365e6c7b9248fdb45dcb6c56bbeec93ede95341ca5720"
+          "content": "8dfec6c80f9bd0bdc3a942b901d593895f9d7ee58a49b8aa1d21a48d36a73be3842efa4a965b74d6c3f72d62c4dd8c56afb134a9c1e269904f2bd087721ea8dc"
         }
       ]
     },
@@ -2411,11 +2411,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8748d74589b7cad24ca8fb7cdb8a425b16830ac1709c08e0294bb65bea218cc6"
+          "content": "2ca90dd0f7df6c21a97fa8e7bc52b6256a76eaa1cd61e4b60bcc6c5ab7cb84b0"
         },
         {
           "alg": "SHA3-512",
-          "content": "aa40992693b3a2c4d901801729858c97ec877ff249d50569cf470a2050a60ea36651456dc9b2797ca930c3faff69fb5fd1d4f28a2296bc485741287f7a804272"
+          "content": "0f33949765c4493404886832a9753eee05b01841564f7a917ce502504661fd8127a76fdb6c89d3fa09a68cc378a91785ff3298137d2664d941a1c89435f9d604"
         }
       ]
     },
@@ -2441,11 +2441,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "906735e02f452962cc221e129a9d7d08cb645f0b79b48168fea62038c35f6b71"
+          "content": "25662547fd3f91f61554605a62fa9fc56f8c23a5a675e01178320c0f7ba77582"
         },
         {
           "alg": "SHA3-512",
-          "content": "09590d90712ecec967caf198f33f0ea62b24152dcfda51b1bd0422e64add9cf2f97a5873310d11d654846b83dd92c9c82ca014973ca51888d14607e2b3092e0f"
+          "content": "b4c14dd1859c76dd35125761c57d45aee28f3cf33891269b9a7876c8bbef0e4090d8f929b2013927d2e668c5e1a8bff1276ccc0a293ab7d6926a3fece1dfba3c"
         }
       ]
     },
@@ -2486,11 +2486,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3e37c0d93dfc1ff3c6fd5e90bb65417f3ebcabd8435925c4292b4ca86bdd11c2"
+          "content": "8dbdaf22258d895c0a7d4d006bbcb6eaa40830eeedfc399851267aa4eba60f57"
         },
         {
           "alg": "SHA3-512",
-          "content": "8c1be019521e12c483cb5e71ee94e6601497c514b09080c2560ca942bb2979f0b08928866213b13fc882105f6aa6e33901fb7edb8cc7dad9a1f03d8bd8a45ce6"
+          "content": "4456979314318624a16393f94a1f4e68f371e522b95a4a001a33cb64373c32ddc3fdb86f1b8f211de5bc3fce27ac2f259a4e98504404242af2a57aaac33310ec"
         }
       ]
     },

package/scripts/check-sbom-currency.js

@@ -331,12 +331,22 @@ function checkSbomCurrency(root) {
     // pass already tied each recorded hash to live bytes).
     const compHashes = (sbom.metadata && sbom.metadata.component && sbom.metadata.component.hashes) || [];
     const recorded = (compHashes.find((h) => h && h.alg === "SHA-256") || {}).content;
-    if (recorded && fileComps.length) {
-      const recomputed = bundleDigest(fileComps);
-      if (recomputed !== recorded) {
+    if (fileComps.length) {
+      // A missing aggregate digest is NOT benign: it is the bundle-as-a-whole
+      // verification anchor. An absent one must fail the gate (symmetric with
+      // the per-file SHA3-512 hard-error that defeats downgrade/strip attacks) —
+      // previously an absent digest silently skipped the comparison entirely.
+      if (!recorded) {
         errors.push(
-          `SBOM bundle digest mismatch: metadata.component.hashes SHA-256 ${String(recorded).slice(0, 12)}… != recomputed ${recomputed.slice(0, 12)}… from file: components — run \`npm run refresh-sbom\``
+          "SBOM metadata.component.hashes lacks a SHA-256 bundle digest — the aggregate verification anchor is missing; run `npm run refresh-sbom`"
         );
+      } else {
+        const recomputed = bundleDigest(fileComps);
+        if (recomputed !== recorded) {
+          errors.push(
+            `SBOM bundle digest mismatch: metadata.component.hashes SHA-256 ${String(recorded).slice(0, 12)}… != recomputed ${recomputed.slice(0, 12)}… from file: components — run \`npm run refresh-sbom\``
+          );
+        }
       }
     }
   } catch (e) {

package/scripts/check-test-count.js

@@ -56,11 +56,17 @@ function listTestFiles(dir) {
 }
 
 function countTests(filePath) {
-  const text = fs.readFileSync(filePath, 'utf8');
-  const lines = text.split('\n');
+  let text = fs.readFileSync(filePath, 'utf8');
+  // Strip block comments first so a `/* test('x'); */`-disabled test is not
+  // counted — the most common "temporarily disable" action, which previously
+  // defeated this gate's entire purpose (it only stripped whole-line `//`).
+  text = text.replace(/\/\*[\s\S]*?\*\//g, '');
   let count = 0;
-  for (const line of lines) {
-    const stripped = line.replace(/^\s*\/\/.*$/, '').trim();
+  for (const rawLine of text.split('\n')) {
+    // Drop a trailing line comment too (`test('x'); // disabled`). Best-effort:
+    // a `//` inside a string literal would over-strip, which under-counts — the
+    // SAFE direction for a no-silent-shrinkage gate.
+    const stripped = rawLine.replace(/\/\/.*$/, '').trim();
     if (!stripped) continue;
     if (/(?<![A-Za-z0-9_$.])test(?:\.only|\.skip)?\s*\(/.test(stripped)) count++;
   }

package/scripts/check-test-coverage.js

@@ -309,11 +309,34 @@ function extractLibExports(content) {
   const stripped = content
     .replace(/\/\*[\s\S]*?\*\//g, "")
     .replace(/^\s*\/\/.*$/gm, "");
-  const m = stripped.match(/module\.exports\s*=\s*\{([^}]+)\}/);
-  if (m) {
-    for (const tok of m[1].split(",")) {
-      const id = tok.split(":")[0].trim();
-      if (/^[a-zA-Z_$][\w$]*$/.test(id)) out.add(id);
+  // Capture the `module.exports = { ... }` body with brace-balancing so a
+  // nested object/array member (e.g. `{ CONFIG: { a: 1 }, x, y }`) does not
+  // truncate the export list at the first inner `}` and hide later exports —
+  // which would let an uncovered new export ship green (the gate's blind spot).
+  const objStart = stripped.search(/module\.exports\s*=\s*\{/);
+  if (objStart !== -1) {
+    const openIdx = stripped.indexOf("{", objStart);
+    let depth = 0, end = -1;
+    for (let i = openIdx; i < stripped.length; i++) {
+      const ch = stripped[i];
+      if (ch === "{") depth++;
+      else if (ch === "}") { depth--; if (depth === 0) { end = i; break; } }
+    }
+    if (end !== -1) {
+      const body = stripped.slice(openIdx + 1, end);
+      let d = 0, cur = "";
+      const members = [];
+      for (const ch of body) {
+        if (ch === "{" || ch === "[") d++;
+        else if (ch === "}" || ch === "]") d--;
+        if (ch === "," && d === 0) { members.push(cur); cur = ""; }
+        else cur += ch;
+      }
+      members.push(cur);
+      for (const tok of members) {
+        const id = tok.split(":")[0].trim();
+        if (/^[a-zA-Z_$][\w$]*$/.test(id)) out.add(id);
+      }
     }
   }
   const re = /module\.exports\.([a-zA-Z_$][\w$]*)\s*=/g;

package/scripts/predeploy.js

@@ -308,11 +308,17 @@ function runGate(gate) {
     const ceil = typeof gate.informationalMaxExitCode === "number"
       ? gate.informationalMaxExitCode
       : Infinity;
-    if (r.status !== null && r.status > ceil) {
+    // A signal kill (spawnSync returns status:null with r.signal set — e.g. a
+    // 137 OOM kill) is a crash, not an informational soft-signal. Without this,
+    // an OOM-killed informational gate fell through to "informational" and the
+    // release proceeded as if the gate had merely produced advisory output.
+    if (r.signal || (r.status !== null && r.status > ceil)) {
       return {
         status: "failed",
         exitCode: r.status,
-        message: `informational gate crashed (exit ${r.status} > informationalMaxExitCode=${ceil})`,
+        message: r.signal
+          ? `informational gate killed by signal ${r.signal} (treated as a crash)`
+          : `informational gate crashed (exit ${r.status} > informationalMaxExitCode=${ceil})`,
         durationMs,
         warnCount,
       };