@blamejs/exceptd-skills 0.18.11 → 0.18.12

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.18.12 — 2026-06-22
+
+A correctness pass across the CLI, the engine, scoring, the collectors, framework-gap reporting, signature verification, and the CWE-chain index.
+
+`ci`/`run --evidence-dir` now refuses a `<playbook>.json` entry that is not a JSON object (an array, scalar, or null) with the same object-shape error the single-file and stdin paths use, instead of binding it as empty evidence and reporting a clean `not_detected` PASS at exit 0 — a mis-shaped per-playbook submission no longer produces a false-clean gate result.
+
+`verifyManifestSignature` consults the `keys/EXPECTED_FINGERPRINT` key pin before the missing-signature path, so a swapped `keys/public.pem` whose `manifest_signature` was stripped is rejected through the library API rather than treated as a benign legacy state. Escalation and `feeds_into` ordering comparisons against a duration literal — e.g. the kernel playbook's `reboot_window > 24h` raise-severity chain — normalize both sides to hours and compare numerically instead of lexicographically (so a 48-hour window escalates and a 6-hour window does not); an ordering comparison that degrades to two non-numeric, non-duration strings now surfaces a `condition_type_mismatch` diagnostic instead of evaluating silently.
+
+`compare()`'s factor explanation lists the reboot (+5) driver whenever a reboot is required, regardless of live-patch availability, matching the score it actually computes; and a post-weight RWEP block that stores `active_exploitation` as a status string is read as a post-weight block (its weighted factors, including the AI factor, are no longer dropped or mis-flagged as a mixed shape).
+
+The secrets collector's `ssh-key-bad-perms` posture and the credential-store AWS doc-fixture demotion no longer false-positive on checked-in test-path fixtures or a duplicate profile name. A single-framework `framework-gap` report scopes its theater-risk list and matching-gap count to the requested framework instead of leaking controls from frameworks the operator did not ask about. `rfc --check` no longer falsely matches an unrelated title when the claimed title repeats a token. The CWE-chains index excludes auto-imported draft CVEs, matching the by-CVE half's curated-truth invariant. A null or non-object MCP server entry (config scan) or dispatch finding is skipped with a clear marker rather than dropping the file's other findings or throwing an opaque error.
+
 ## 0.18.11 — 2026-06-22
 
 Regenerates the CycloneDX SBOM (`sbom.cdx.json`) so its recorded hash for `CHANGELOG.md` matches the shipped file.

package/bin/exceptd.js

@@ -4339,12 +4339,19 @@ function readEvidenceDir(dir, verb) {
           extra: { entry: f, resolved_to: realEntry },
         };
       }
-      bundle[pbId] = JSON.parse(raw);
+      // Apply the SAME object-shape guard the single-file / stdin path uses
+      // (asEvidenceObject): a `<pb>.json` that parses to an array, scalar, or
+      // null is not a valid evidence document. Without this an mis-shaped entry
+      // was bound verbatim and ran downstream as empty evidence, yielding a
+      // false-clean `not_detected` PASS at exit 0 — the exact hole the
+      // single-file guard closes.
+      bundle[pbId] = asEvidenceObject(JSON.parse(raw));
     } catch (e) {
-      // A refusal object thrown by JSON.parse / readFileSync lands here; surface
-      // it with the entry name. (The explicit refusals above return directly and
-      // never reach this catch.)
-      return { ok: false, error: `${verb}: failed to read --evidence-dir entry ${f}: ${e.message}`, extra: null };
+      // A JSON parse error or the asEvidenceObject shape refusal lands here;
+      // surface it with the entry name so the operator sees the real reason
+      // (e.g. "evidence must be a JSON object"). The explicit symlink/junction
+      // refusals above return directly and never reach this catch.
+      return { ok: false, error: `${verb}: --evidence-dir entry ${f}: ${e.message}`, extra: { entry: f } };
     } finally {
       try { fs.closeSync(efd); } catch { /* already closed / invalid fd */ }
     }

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-22T04:26:25.259Z",
+  "generated_at": "2026-06-22T06:27:15.592Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "c1c37465664024760c34e6c236592ee071e5347d3fb736dba3a495fee6768126",
+    "manifest.json": "d897efd048acdde209213af36857c5385c036a650096531408ca978590e38226",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",

package/lib/collectors/cred-stores.js

@@ -57,7 +57,7 @@ function fileExists(full) {
 // AWS credentials INI: any [profile] block carrying
 // `aws_access_key_id` AND no `sso_session` / `credential_process`.
 function parseAwsCredentials(content) {
-  if (!content) return { staticProfiles: [], federatedProfiles: [] };
+  if (!content) return { staticProfiles: [], federatedProfiles: [], staticKeys: {} };
   const lines = content.split(/\r?\n/);
   const profiles = {};
   let current = null;
@@ -77,13 +77,21 @@ function parseAwsCredentials(content) {
   }
   const staticProfiles = [];
   const federatedProfiles = [];
+  // Per-static-profile aws_access_key_id, so doc-fixture demotion can key off
+  // the exact parsed value instead of re-finding the first name-matching block.
+  // A duplicate profile name resolves to the LAST occurrence's keys here, which
+  // is the same precedence the AWS SDK applies.
+  const staticKeys = {};
   for (const [name, kv] of Object.entries(profiles)) {
     const hasKey = !!kv["aws_access_key_id"];
     const hasFederation = !!(kv["sso_session"] || kv["credential_process"] || kv["role_arn"]);
-    if (hasKey && !hasFederation) staticProfiles.push(name);
+    if (hasKey && !hasFederation) {
+      staticProfiles.push(name);
+      staticKeys[name] = kv["aws_access_key_id"];
+    }
     if (hasFederation) federatedProfiles.push(name);
   }
-  return { staticProfiles, federatedProfiles };
+  return { staticProfiles, federatedProfiles, staticKeys };
 }
 
 // kubeconfig: users[].user.token field present (non-empty) with no
@@ -247,12 +255,13 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   // unsatisfied, which is the honest outcome.
   const AWS_DOC_FIXTURE_KEY = "AKIAIOSFODNN7EXAMPLE";
   const realAwsProfiles = awsCredsParsed.staticProfiles.filter(p => {
-    // Parse the raw INI again for this profile's key value + name.
-    // For doc-fixture demotion (FP[0]) we look up the key value; for
-    // break-glass demotion (FP[2]) we check the profile name pattern.
-    const block = (awsCredsContent || "").split(/^\[/m).find(b => b.startsWith(p + "]"));
-    if (!block) return true;
-    if (block.includes(AWS_DOC_FIXTURE_KEY)) return false; // FP[0]
+    // Demote off this profile's EXACT parsed key value (FP[0]) and its name
+    // (FP[2]). Keying off the parsed value — not the first raw block whose
+    // name matches — means a duplicate profile name whose first occurrence
+    // holds the doc-fixture key cannot demote the later real key under the
+    // same name (the parser resolves the live last-occurrence value).
+    const keyVal = awsCredsParsed.staticKeys[p];
+    if (keyVal === AWS_DOC_FIXTURE_KEY) return false; // FP[0]
     if (/^breakglass-/i.test(p) || /^break-glass-/i.test(p)) return false; // FP[2]
     return true;
   });

package/lib/collectors/secrets.js

@@ -495,8 +495,10 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   //   any private-key file with mode != 0600
   // The collector scope is the cwd; ~/.ssh enumeration is outside this
   // walk root. Within cwd, flag any discovered private key whose mode
-  // is anything other than 0600 (strict).
-  const sshKeyPostures = process.platform === "win32" ? [] : sshPrivateKeys.map(f => ({ file: f.rel, ...statPosture(f.full) }));
+  // is anything other than 0600 (strict). Use the test-path-filtered set
+  // (prodSshPrivateKeys) — matching ssh-private-key-block — so a fixture
+  // key checked in under a test/ path doesn't raise a bad-perms posture.
+  const sshKeyPostures = process.platform === "win32" ? [] : prodSshPrivateKeys.map(f => ({ file: f.rel, ...statPosture(f.full) }));
   signal_overrides["ssh-key-bad-perms"] = sshKeyPostures.some(p => p.error == null && p.mode !== 0o600) ? "hit" : "miss";
 
   // Per-indicator file locations for every indicator flipped to "hit", so

package/lib/framework-gap.js

@@ -211,6 +211,24 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
     };
   }
 
+  // Scope the report to what the operator actually requested. With an explicit
+  // framework filter, only gaps that survived the per-framework filter
+  // (frameworkResults[*].gaps) belong in the report; with `all`, every
+  // scenario-relevant gap does. `seen` is the de-duplicated set of surviving
+  // gap keys (a single gap can match multiple requested frameworks). Both
+  // theater_risks and the matching count derive from it so the per-framework
+  // body, the theater-risk list, and the summary footer all agree.
+  let scopedGaps;
+  if (opts.allFrameworks) {
+    scopedGaps = relevantGaps;
+  } else {
+    const seen = new Set();
+    for (const id of frameworkIds) {
+      for (const g of frameworkResults[id]?.gaps ?? []) seen.add(g.id);
+    }
+    scopedGaps = relevantGaps.filter(([key]) => seen.has(key));
+  }
+
   // Cycle 20 A P1 (v0.12.40): pre-fix this filtered on `theater_pattern`
   // (a legacy field) but the v0.12.29 backfill added a structured
   // `theater_test` block on all 118 entries while leaving most without
@@ -220,7 +238,11 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
   // the legacy field. Now: an entry is theater-risk if it's open AND
   // carries EITHER `theater_test` OR `theater_pattern`. Footer + badge
   // count agree.
-  const theaterRisks = relevantGaps
+  //
+  // theater_risks is built from scopedGaps (not the full relevantGaps) so a
+  // single-framework request cannot leak or mis-summarize theater controls
+  // from frameworks the operator never asked about.
+  const theaterRisks = scopedGaps
     .filter(([, g]) => g.status === 'open' && (g.theater_test || g.theater_pattern))
     .map(([key, g]) => ({
       control: key,
@@ -234,19 +256,8 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
   // explicit framework filter the summary must agree with the per-framework
   // body the operator actually sees — otherwise `framework-gap nist-800-53
   // <cve>` shows e.g. "2 matching control gap(s)" per-framework but "Summary:
-  // 8 matching gaps" (every framework's hits, pre-filter). Sum the per-
-  // framework gap_count so body + summary agree. De-duplicate by gap key in
-  // case a single gap matches multiple requested frameworks.
-  let matchingGapCount;
-  if (opts.allFrameworks) {
-    matchingGapCount = relevantGaps.length;
-  } else {
-    const seen = new Set();
-    for (const id of frameworkIds) {
-      for (const g of frameworkResults[id]?.gaps ?? []) seen.add(g.id);
-    }
-    matchingGapCount = seen.size;
-  }
+  // 8 matching gaps" (every framework's hits, pre-filter).
+  const matchingGapCount = scopedGaps.length;
 
   return {
     threat_scenario: threatScenario,

package/lib/playbook-runner.js

@@ -4204,8 +4204,44 @@ function evalCondition(expr, ctx, playbook) {
     // would exclude it: 'critical' < 'high' lexicographically).
     const SEV = { low: 0, medium: 1, high: 2, critical: 3 };
     const lr = SEV[String(lv).toLowerCase()], rr = SEV[String(rv).toLowerCase()];
-    const a = (lr !== undefined && rr !== undefined) ? lr : lv;
-    const b = (lr !== undefined && rr !== undefined) ? rr : rv;
+    let a = (lr !== undefined && rr !== undefined) ? lr : lv;
+    let b = (lr !== undefined && rr !== undefined) ? rr : rv;
+    const isOrdering = op === '>=' || op === '<=' || op === '>' || op === '<';
+    if (isOrdering && (lr === undefined || rr === undefined)) {
+      // Duration literals carry a unit suffix (`24h`, `7d`, `30min`) — the
+      // catalog writes ordering comparisons against them (kernel.json's
+      // `reboot_window > 24h` raise_severity escalation). The RHS-coercion
+      // above only converts a BARE numeric (`/^-?\d+(\.\d+)?$/`), so a unit-
+      // suffixed literal stays a string. A numeric LHS then compares against a
+      // string RHS (`48 > '24h'` → `48 > NaN` → false: a 48h window silently
+      // fails to escalate) and a string LHS compares lexicographically
+      // (`'6h' > '24h'` → `'6' > '2'` → true: a 6h window WRONGLY escalates).
+      // Normalize both sides to canonical hours when a duration unit appears on
+      // either side: a unit-suffixed literal converts by its unit family; a
+      // bare number is taken in the same family as the duration it is compared
+      // against (hours-equivalent magnitude). The comparison is then numeric.
+      const la = parseDurationHours(a), ba = parseDurationHours(b);
+      if ((la !== null || ba !== null) && la !== null && ba !== null) {
+        a = la; b = ba;
+      } else if (
+        // Two non-numeric, non-severity, non-duration strings under an ordering
+        // operator is a silently-degraded comparison (lexicographic / NaN) — the
+        // clause PARSED so condition_unparsed never fires. Surface a distinct
+        // condition_type_mismatch so the degraded comparison is observable
+        // (the boolean result is unchanged; this is diagnostics only).
+        typeof a !== 'number' && typeof b !== 'number' &&
+        !(typeof a === 'string' && /^-?\d+(?:\.\d+)?$/.test(a.trim())) &&
+        !(typeof b === 'string' && /^-?\d+(?:\.\d+)?$/.test(b.trim()))
+      ) {
+        const target = (ctx && Array.isArray(ctx._runErrors)) ? ctx._runErrors
+          : (playbook && Array.isArray(playbook._runErrors)) ? playbook._runErrors
+          : null;
+        if (target) {
+          pushRunError(target, { kind: 'condition_type_mismatch', condition: String(expr).slice(0, 200) },
+            { dedupeKey: x => x.condition || '' });
+        }
+      }
+    }
     switch (op) {
       case '==': case '=': return lv == rv;
       case '!=': return lv != rv;
@@ -4346,6 +4382,33 @@ function resolvePath(obj, dot) {
   return dot.split('.').reduce((acc, k) => acc == null ? null : acc[k], obj);
 }
 
+/**
+ * Normalize a duration operand to canonical hours for a numeric comparison.
+ * Accepts a unit-suffixed literal (`24h`, `7d`, `2wk`, `30min`) and converts by
+ * its unit family, OR a bare number / numeric string (returned as its own
+ * magnitude — the catalog writes `reboot_window > 24h` where the LHS resolves to
+ * a bare hour count). Returns null for anything that is not a recognized
+ * duration or plain number, so the caller can detect that BOTH sides normalized
+ * before comparing numerically (and surface a type-mismatch otherwise).
+ */
+const DURATION_UNIT_HOURS = {
+  h: 1, hr: 1, hrs: 1,
+  m: 1 / 60, min: 1 / 60,
+  d: 24, day: 24, days: 24,
+  w: 168, wk: 168,
+};
+function parseDurationHours(v) {
+  if (typeof v === 'number') return Number.isFinite(v) ? v : null;
+  if (typeof v !== 'string') return null;
+  const s = v.trim();
+  // Bare numeric string (no unit) — take its magnitude as-is.
+  if (/^-?\d+(?:\.\d+)?$/.test(s)) return parseFloat(s);
+  const m = s.match(/^(\d+(?:\.\d+)?)\s*(h|hr|hrs|d|day|days|wk|w|m|min)$/i);
+  if (!m) return null;
+  const mult = DURATION_UNIT_HOURS[m[2].toLowerCase()];
+  return mult === undefined ? null : parseFloat(m[1]) * mult;
+}
+
 /**
  * Depth-aware splitter — split `expr` at occurrences of ` <sep> ` (with
  * surrounding spaces) that are at parenthesis depth 0. Returns the (trimmed)

package/lib/rfc-cli.js

@@ -86,8 +86,13 @@ function titleMatches(claimed, indexTitle) {
   // No contiguous run, but all tokens present out of order. Accept only when the
   // claim covers a strong majority of the index title's tokens (containment
   // ratio floor) — a few scattered tokens against a long title is ambiguous,
-  // not a match.
-  const ratio = claimTokens.length / titleTokens.length;
+  // not a match. Count DISTINCT claim tokens that appear in the title: counting
+  // non-distinct tokens lets a repeated-token claim (e.g. "security security
+  // security security") inflate the ratio past the floor and falsely match an
+  // unrelated title.
+  const distinct = new Set(claimTokens);
+  const present = [...distinct].filter((t) => titleSet.has(t)).length;
+  const ratio = present / titleTokens.length;
   return ratio >= 0.8;
 }
 

package/lib/scoring.js

@@ -367,13 +367,29 @@ function scoreCustom(factors, opts) {
  */
 function deriveRwepFromFactors(factors) {
   if (!factors || typeof factors !== 'object') return 0;
-  const values = Object.values(factors);
-  if (values.length === 0) return 0;
+  const entries = Object.entries(factors);
+  if (entries.length === 0) return 0;
+  // A boolean factor OR a string active_exploitation ladder value is Shape-A
+  // evidence — scoreCustom reads exactly those. active_exploitation's string
+  // form legitimately appears in BOTH shapes (Shape A stores it as the literal
+  // ladder string; a Shape B post-weight block can ALSO carry it as a
+  // human-readable status alongside its post-weight integers), so it is the
+  // hasPostWeightInt guard below — NOT excluding active_exploitation from this
+  // check — that disambiguates them. Excluding it here under-scored an
+  // active-exploitation-ONLY raw bag (e.g. `{ active_exploitation: 'confirmed',
+  // blast_radius: 10 }`): hasBooleanOrLadder went false, the block fell through
+  // to the Shape-B sum, and the ladder string was skipped (10 vs scoreCustom 30).
   const aeAllowed = new Set(['none', 'unknown', 'suspected', 'theoretical', 'confirmed']);
-  const hasBooleanOrLadder = values.some(
-    (v) => typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v.trim().toLowerCase())),
+  const hasBooleanOrLadder = entries.some(
+    ([, v]) => (typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v.trim().toLowerCase()))),
   );
-  if (hasBooleanOrLadder) {
+  // A boolean-named key carrying a post-weight integer (>=5) is unambiguous
+  // Shape-B evidence. When present, the block is Shape B even if it also carries
+  // a string active_exploitation — route to the post-weight sum, not scoreCustom.
+  const hasPostWeightInt = entries.some(
+    ([k, v]) => k !== 'blast_radius' && typeof v === 'number' && Number.isFinite(v) && Math.abs(v) >= 5,
+  );
+  if (hasBooleanOrLadder && !hasPostWeightInt) {
     return scoreCustom(factors);
   }
   // Shape B: catalog post-weight. Sum + clamp.
@@ -505,7 +521,14 @@ function compare(cveId, catalog, opts) {
     if (entry.poc_available) driving.push('public PoC (+20)');
     if (entry.ai_discovered || entry.ai_assisted_weaponization) driving.push('AI-discovered (+15 weaponization)');
     if (String(entry.active_exploitation || '').trim().toLowerCase() === 'confirmed') driving.push('confirmed exploitation (+20)');
-    if ((entry.reboot_required || entry.patch_required_reboot) && !entry.live_patch_available) driving.push('reboot required (+5)');
+    // Mirror scoreCustom's rebootFactor EXACTLY: the +5 reboot weight is added
+    // whenever a reboot is required, regardless of live_patch_available (a live
+    // patch is a temporary workaround; the full-remediation window still extends
+    // — see the RWEP_WEIGHTS header note). Gating this driver on
+    // !live_patch_available made the enumerated factors sum to less than the
+    // delta on any entry that both requires a reboot AND has a live patch
+    // available, hiding a driver the score actually counted.
+    if (entry.reboot_required || entry.patch_required_reboot) driving.push('reboot required (+5)');
     explanation += driving.join(', ');
     explanation += '. Framework patch SLAs calibrated to CVSS are insufficient for this CVE.';
   } else if (delta < -10) {
@@ -569,6 +592,16 @@ function detectFactorShape(factors) {
   let sawWeightedInt = false;
   for (const [k, v] of Object.entries(factors)) {
     if (k === 'blast_radius') continue; // always integer in both shapes
+    if (k === 'active_exploitation' && typeof v === 'string') {
+      // active_exploitation's string-ladder form is valid in BOTH shapes — a
+      // Shape B (post-weight) block can carry it as the human-readable status
+      // string alongside its post-weight integers, exactly the way Shape A does.
+      // So a string active_exploitation is NOT Shape-A evidence; counting it as
+      // sawBool produced a spurious 'mixed' verdict (and a validate() error) on
+      // an otherwise-clean Shape B block. Its weight, when summed, is resolved
+      // via resolveActiveExploitation in the post-weight path, not here.
+      continue;
+    }
     if (typeof v === 'boolean' || v === null) {
       sawBool = true;
     } else if (typeof v === 'number' && Math.abs(v) >= 5 && boolFields.includes(k)) {
@@ -579,7 +612,7 @@ function detectFactorShape(factors) {
       // 0/1 on a boolean-named field could be either shape; ambiguous, ignore.
       continue;
     } else if (typeof v === 'string' && boolFields.includes(k)) {
-      // String values (e.g. active_exploitation: 'confirmed') are Shape A.
+      // String values on OTHER boolean-named fields are Shape A.
       sawBool = true;
     }
   }

package/lib/verify.js

@@ -342,6 +342,39 @@ function canonicalManifestBytes(manifest) {
  * @param {object} manifest
  */
 function verifyManifestSignature(manifest) {
+  // The key-pin fingerprint check runs FIRST — independent of whether a
+  // manifest_signature is present — so library callers (refresh-network gate,
+  // verify-shipped-tarball gate, tests, downstream `require("lib/verify")`
+  // consumers) cannot bypass the pin. Previously the pin only fired AFTER the
+  // signature-present check, so a key-substitution attacker who swapped
+  // keys/public.pem AND stripped manifest_signature got the early `missing`
+  // return and never tripped the pin — authenticating against the attacker key
+  // through the library API. Consulting the pin up front closes that on the
+  // legacy/missing path too. Honors KEYS_ROTATED=1 for legitimate rotations; a
+  // MISSING pin file fails closed (keys/EXPECTED_FINGERPRINT ships in the
+  // tarball and is committed, so its absence is the signature of a tamper that
+  // stripped the pin to hide a swapped key).
+  const publicKey = loadPublicKey();
+  if (publicKey) {
+    const liveFp = publicKeyFingerprint(publicKey);
+    const pinResult = checkExpectedFingerprint(liveFp);
+    if (pinResult.status === 'mismatch' && !pinResult.rotationOverride) {
+      return {
+        status: 'invalid',
+        reason: `fingerprint-mismatch: live=${pinResult.actual} pin=${pinResult.expected} — keys/public.pem does not match keys/EXPECTED_FINGERPRINT. If this is an intentional rotation, set KEYS_ROTATED=1 and update the pin.`,
+        fingerprint_mismatch: true,
+        expected: pinResult.expected,
+        actual: pinResult.actual,
+      };
+    }
+    if (pinResult.status === 'no-pin') {
+      return {
+        status: 'invalid',
+        reason: `key-pin absent: keys/EXPECTED_FINGERPRINT is missing, so a swapped keys/public.pem cannot be detected. The pin ships in the tarball and is committed — restore it from the package or version control.`,
+        pin_absent: true,
+      };
+    }
+  }
   const sig = manifest && manifest.manifest_signature;
   if (!sig || typeof sig !== 'object') return { status: 'missing' };
   if (typeof sig.signature_base64 !== 'string') {
@@ -359,43 +392,11 @@ function verifyManifestSignature(manifest) {
       reason: `manifest_signature.algorithm must be exactly 'Ed25519' (got ${JSON.stringify(sig.algorithm)})`,
     };
   }
-  const publicKey = loadPublicKey();
   if (!publicKey) {
     return { status: 'no-key', reason: 'public key missing at keys/public.pem' };
   }
-  // consult keys/EXPECTED_FINGERPRINT BEFORE crypto.verify so
-  // library callers (refresh-network gate, verify-shipped-tarball gate, tests,
-  // downstream consumers via `require("lib/verify")`) cannot bypass the pin.
-  // Previously the pin only fired at the CLI tail of `node lib/verify.js`,
-  // letting a coordinated attacker who swapped keys/public.pem authenticate
-  // against the attacker key without any divergence surfaced through the
-  // library API. Honors KEYS_ROTATED=1 for legitimate rotations. A MISSING pin
-  // file is now rejected too: keys/EXPECTED_FINGERPRINT ships in the tarball and
-  // is committed to the repo, so its absence is not a legacy state — it is the
-  // signature a key-substitution attack leaves when it strips the pin to hide a
-  // swapped keys/public.pem.
-  const liveFp = publicKeyFingerprint(publicKey);
-  const pinResult = checkExpectedFingerprint(liveFp);
-  if (pinResult.status === 'mismatch' && !pinResult.rotationOverride) {
-    return {
-      status: 'invalid',
-      reason: `fingerprint-mismatch: live=${pinResult.actual} pin=${pinResult.expected} — keys/public.pem does not match keys/EXPECTED_FINGERPRINT. If this is an intentional rotation, set KEYS_ROTATED=1 and update the pin.`,
-      fingerprint_mismatch: true,
-      expected: pinResult.expected,
-      actual: pinResult.actual,
-    };
-  }
-  if (pinResult.status === 'no-pin') {
-    // A missing pin fails closed unconditionally — there is nothing to override.
-    // KEYS_ROTATED only applies to a fingerprint MISMATCH (a new key + a new
-    // pin); a legitimate rotation updates the pin in place, it never removes it,
-    // so an absent pin is treated as tampering and restoring it is the only fix.
-    return {
-      status: 'invalid',
-      reason: `key-pin absent: keys/EXPECTED_FINGERPRINT is missing, so a swapped keys/public.pem cannot be detected. The pin ships in the tarball and is committed — restore it from the package or version control.`,
-      pin_absent: true,
-    };
-  }
+  // The key-pin (mismatch / no-pin) was already verified up front, before any
+  // signature branching — so reaching here means the live key matches the pin.
   let signatureBytes;
   try {
     signatureBytes = Buffer.from(sig.signature_base64, 'base64');