@blamejs/exceptd-skills 0.18.11 → 0.18.13

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.18.13 — 2026-06-22
+
+A correctness + robustness pass across the upstream data parsers, the validators, and the prefetch/feed paths.
+
+The OSV advisory importer keeps the HIGHEST CVSS vector and score when a record carries multiple same-version severity entries (e.g. an NVD base score alongside a CNA/vendor score), instead of whichever appeared first in the array — a 9.8 critical no longer imports as a 5.3 medium purely because of upstream array order, which previously also flipped the derived KEV-pending / active-exploitation / severity-word fields. The RSS/Atom feed tokenizer strips HTML in a single linear pass, so a malformed or hostile feed body with many unclosed `<` can no longer stall the refresh worker (the previous regex was quadratic on attacker-controlled text). An Atom `<link>` carrying element text is now selected by its `rel` the same way the attribute form is, so a non-`alternate` link cannot override the canonical `alternate`. `refresh --advisory <ghsa-id>` validates the full `GHSA-xxxx-xxxx-xxxx` token shape and URL-encodes it before building the request path.
+
+The playbook validator range-checks a partial `phase_overrides.direct.rwep_threshold` override and rejects an impossible calendar date (`2026-02-30`); the CVE-catalog validator reports an absent reference catalog as unvalidatable for ALL five reference families instead of flagging every `atlas_ref`/`cwe_ref` as unresolved; the RFC validator skips non-IETF references (CSAF, ISO) rather than reporting them as permanent drift; the version-pin validator no longer probes the two upstreams that publish no GitHub releases (reported as tracked elsewhere); the vendor inventory cross-check covers `.cjs`/`.mjs`/`.json`, not only `.js`; the package size-budget gate fails closed when `npm pack` omits the size field; and the disputed-CVE check reports the real local status. The skill linter flags a wrong-typed enum value and rejects an impossible `last_threat_review`, and the `d3fend_refs` frontmatter pattern accepts the `D3A-`/`D3F-` id families. `upstream-check` reports a clear error rather than `ok:true` with an undefined version when a fixture lacks dist-tags, and a non-parseable publish date yields a clear value instead of `NaN`. The prefetch index no longer resurrects entries a concurrent run pruned, `ttp-mapper` ignores inherited object keys, and the EPSS lookup returns not-found for an absent CVE instead of the first row.
+
+## 0.18.12 — 2026-06-22
+
+A correctness pass across the CLI, the engine, scoring, the collectors, framework-gap reporting, signature verification, and the CWE-chain index.
+
+`ci`/`run --evidence-dir` now refuses a `<playbook>.json` entry that is not a JSON object (an array, scalar, or null) with the same object-shape error the single-file and stdin paths use, instead of binding it as empty evidence and reporting a clean `not_detected` PASS at exit 0 — a mis-shaped per-playbook submission no longer produces a false-clean gate result.
+
+`verifyManifestSignature` consults the `keys/EXPECTED_FINGERPRINT` key pin before the missing-signature path, so a swapped `keys/public.pem` whose `manifest_signature` was stripped is rejected through the library API rather than treated as a benign legacy state. Escalation and `feeds_into` ordering comparisons against a duration literal — e.g. the kernel playbook's `reboot_window > 24h` raise-severity chain — normalize both sides to hours and compare numerically instead of lexicographically (so a 48-hour window escalates and a 6-hour window does not); an ordering comparison that degrades to two non-numeric, non-duration strings now surfaces a `condition_type_mismatch` diagnostic instead of evaluating silently.
+
+`compare()`'s factor explanation lists the reboot (+5) driver whenever a reboot is required, regardless of live-patch availability, matching the score it actually computes; and a post-weight RWEP block that stores `active_exploitation` as a status string is read as a post-weight block (its weighted factors, including the AI factor, are no longer dropped or mis-flagged as a mixed shape).
+
+The secrets collector's `ssh-key-bad-perms` posture and the credential-store AWS doc-fixture demotion no longer false-positive on checked-in test-path fixtures or a duplicate profile name. A single-framework `framework-gap` report scopes its theater-risk list and matching-gap count to the requested framework instead of leaking controls from frameworks the operator did not ask about. `rfc --check` no longer falsely matches an unrelated title when the claimed title repeats a token. The CWE-chains index excludes auto-imported draft CVEs, matching the by-CVE half's curated-truth invariant. A null or non-object MCP server entry (config scan) or dispatch finding is skipped with a clear marker rather than dropping the file's other findings or throwing an opaque error.
+
 ## 0.18.11 — 2026-06-22
 
 Regenerates the CycloneDX SBOM (`sbom.cdx.json`) so its recorded hash for `CHANGELOG.md` matches the shipped file.

package/bin/exceptd.js

@@ -4339,12 +4339,19 @@ function readEvidenceDir(dir, verb) {
           extra: { entry: f, resolved_to: realEntry },
         };
       }
-      bundle[pbId] = JSON.parse(raw);
+      // Apply the SAME object-shape guard the single-file / stdin path uses
+      // (asEvidenceObject): a `<pb>.json` that parses to an array, scalar, or
+      // null is not a valid evidence document. Without this an mis-shaped entry
+      // was bound verbatim and ran downstream as empty evidence, yielding a
+      // false-clean `not_detected` PASS at exit 0 — the exact hole the
+      // single-file guard closes.
+      bundle[pbId] = asEvidenceObject(JSON.parse(raw));
     } catch (e) {
-      // A refusal object thrown by JSON.parse / readFileSync lands here; surface
-      // it with the entry name. (The explicit refusals above return directly and
-      // never reach this catch.)
-      return { ok: false, error: `${verb}: failed to read --evidence-dir entry ${f}: ${e.message}`, extra: null };
+      // A JSON parse error or the asEvidenceObject shape refusal lands here;
+      // surface it with the entry name so the operator sees the real reason
+      // (e.g. "evidence must be a JSON object"). The explicit symlink/junction
+      // refusals above return directly and never reach this catch.
+      return { ok: false, error: `${verb}: --evidence-dir entry ${f}: ${e.message}`, extra: { entry: f } };
     } finally {
       try { fs.closeSync(efd); } catch { /* already closed / invalid fd */ }
     }

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-22T04:26:25.259Z",
+  "generated_at": "2026-06-22T13:09:57.368Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "c1c37465664024760c34e6c236592ee071e5347d3fb736dba3a495fee6768126",
+    "manifest.json": "04dc4d4026147da386256d462aec657b1746e9539f8d8dc3ed0ad522f437d765",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",

package/lib/auto-discovery.js

@@ -206,7 +206,16 @@ function extractNvdMetrics(payload) {
 
 function extractEpss(payload, id) {
   const data = Array.isArray(payload?.data) ? payload.data : [];
-  const row = data.find((r) => r?.cve === id) || data[0];
+  // Match the requested CVE id only. The prior `|| data[0]` fallback silently
+  // misattributed a DIFFERENT CVE's EPSS score into the draft whenever the
+  // requested id was absent from the payload — a single-row response for the
+  // wrong CVE (or a stale/mismatched sidecar) wrote that CVE's score under the
+  // discovered id. A non-matching payload now yields null (same
+  // null-mechanical-field behavior used when no cache exists). The only
+  // accepted fallback is a single-row, cve-less response shape (the requested
+  // id is implicit because the payload carries exactly one un-keyed row).
+  let row = data.find((r) => r?.cve === id);
+  if (!row && data.length === 1 && data[0]?.cve == null) row = data[0];
   if (!row) return null;
   return {
     score: row.epss != null ? Number(row.epss) : null,

package/lib/collectors/cred-stores.js

@@ -57,7 +57,7 @@ function fileExists(full) {
 // AWS credentials INI: any [profile] block carrying
 // `aws_access_key_id` AND no `sso_session` / `credential_process`.
 function parseAwsCredentials(content) {
-  if (!content) return { staticProfiles: [], federatedProfiles: [] };
+  if (!content) return { staticProfiles: [], federatedProfiles: [], staticKeys: {} };
   const lines = content.split(/\r?\n/);
   const profiles = {};
   let current = null;
@@ -77,13 +77,21 @@ function parseAwsCredentials(content) {
   }
   const staticProfiles = [];
   const federatedProfiles = [];
+  // Per-static-profile aws_access_key_id, so doc-fixture demotion can key off
+  // the exact parsed value instead of re-finding the first name-matching block.
+  // A duplicate profile name resolves to the LAST occurrence's keys here, which
+  // is the same precedence the AWS SDK applies.
+  const staticKeys = {};
   for (const [name, kv] of Object.entries(profiles)) {
     const hasKey = !!kv["aws_access_key_id"];
     const hasFederation = !!(kv["sso_session"] || kv["credential_process"] || kv["role_arn"]);
-    if (hasKey && !hasFederation) staticProfiles.push(name);
+    if (hasKey && !hasFederation) {
+      staticProfiles.push(name);
+      staticKeys[name] = kv["aws_access_key_id"];
+    }
     if (hasFederation) federatedProfiles.push(name);
   }
-  return { staticProfiles, federatedProfiles };
+  return { staticProfiles, federatedProfiles, staticKeys };
 }
 
 // kubeconfig: users[].user.token field present (non-empty) with no
@@ -247,12 +255,13 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   // unsatisfied, which is the honest outcome.
   const AWS_DOC_FIXTURE_KEY = "AKIAIOSFODNN7EXAMPLE";
   const realAwsProfiles = awsCredsParsed.staticProfiles.filter(p => {
-    // Parse the raw INI again for this profile's key value + name.
-    // For doc-fixture demotion (FP[0]) we look up the key value; for
-    // break-glass demotion (FP[2]) we check the profile name pattern.
-    const block = (awsCredsContent || "").split(/^\[/m).find(b => b.startsWith(p + "]"));
-    if (!block) return true;
-    if (block.includes(AWS_DOC_FIXTURE_KEY)) return false; // FP[0]
+    // Demote off this profile's EXACT parsed key value (FP[0]) and its name
+    // (FP[2]). Keying off the parsed value — not the first raw block whose
+    // name matches — means a duplicate profile name whose first occurrence
+    // holds the doc-fixture key cannot demote the later real key under the
+    // same name (the parser resolves the live last-occurrence value).
+    const keyVal = awsCredsParsed.staticKeys[p];
+    if (keyVal === AWS_DOC_FIXTURE_KEY) return false; // FP[0]
     if (/^breakglass-/i.test(p) || /^break-glass-/i.test(p)) return false; // FP[2]
     return true;
   });

package/lib/collectors/secrets.js

@@ -495,8 +495,10 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   //   any private-key file with mode != 0600
   // The collector scope is the cwd; ~/.ssh enumeration is outside this
   // walk root. Within cwd, flag any discovered private key whose mode
-  // is anything other than 0600 (strict).
-  const sshKeyPostures = process.platform === "win32" ? [] : sshPrivateKeys.map(f => ({ file: f.rel, ...statPosture(f.full) }));
+  // is anything other than 0600 (strict). Use the test-path-filtered set
+  // (prodSshPrivateKeys) — matching ssh-private-key-block — so a fixture
+  // key checked in under a test/ path doesn't raise a bad-perms posture.
+  const sshKeyPostures = process.platform === "win32" ? [] : prodSshPrivateKeys.map(f => ({ file: f.rel, ...statPosture(f.full) }));
   signal_overrides["ssh-key-bad-perms"] = sshKeyPostures.some(p => p.error == null && p.mode !== 0o600) ? "hit" : "miss";
 
   // Per-indicator file locations for every indicator flipped to "hit", so

package/lib/cve-regression-watcher.js

@@ -228,7 +228,11 @@ function findRegressionCandidates(diffs, catalog, opts) {
       const titleStr = (typeof d.title === 'string' && d.title) ? d.title
         : (typeof d.first_title === 'string' && d.first_title) ? d.first_title
         : '';
-      if (titleStr) slot.titles.push(titleStr);
+      // Dedupe titles before pushing — mirrors the content-only branch.
+      // Without this, duplicate titles across feeds (a common multi-feed
+      // surfacing pattern) consume distinct slots and evict genuinely
+      // distinct titles from the 5-cap below.
+      if (titleStr && !slot.titles.includes(titleStr)) slot.titles.push(titleStr);
       // Merge content signals — the strongest signal wins.
       Object.assign(slot.signals, signals);
       continue;

package/lib/framework-gap.js

@@ -211,6 +211,24 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
     };
   }
 
+  // Scope the report to what the operator actually requested. With an explicit
+  // framework filter, only gaps that survived the per-framework filter
+  // (frameworkResults[*].gaps) belong in the report; with `all`, every
+  // scenario-relevant gap does. `seen` is the de-duplicated set of surviving
+  // gap keys (a single gap can match multiple requested frameworks). Both
+  // theater_risks and the matching count derive from it so the per-framework
+  // body, the theater-risk list, and the summary footer all agree.
+  let scopedGaps;
+  if (opts.allFrameworks) {
+    scopedGaps = relevantGaps;
+  } else {
+    const seen = new Set();
+    for (const id of frameworkIds) {
+      for (const g of frameworkResults[id]?.gaps ?? []) seen.add(g.id);
+    }
+    scopedGaps = relevantGaps.filter(([key]) => seen.has(key));
+  }
+
   // Cycle 20 A P1 (v0.12.40): pre-fix this filtered on `theater_pattern`
   // (a legacy field) but the v0.12.29 backfill added a structured
   // `theater_test` block on all 118 entries while leaving most without
@@ -220,7 +238,11 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
   // the legacy field. Now: an entry is theater-risk if it's open AND
   // carries EITHER `theater_test` OR `theater_pattern`. Footer + badge
   // count agree.
-  const theaterRisks = relevantGaps
+  //
+  // theater_risks is built from scopedGaps (not the full relevantGaps) so a
+  // single-framework request cannot leak or mis-summarize theater controls
+  // from frameworks the operator never asked about.
+  const theaterRisks = scopedGaps
     .filter(([, g]) => g.status === 'open' && (g.theater_test || g.theater_pattern))
     .map(([key, g]) => ({
       control: key,
@@ -234,19 +256,8 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
   // explicit framework filter the summary must agree with the per-framework
   // body the operator actually sees — otherwise `framework-gap nist-800-53
   // <cve>` shows e.g. "2 matching control gap(s)" per-framework but "Summary:
-  // 8 matching gaps" (every framework's hits, pre-filter). Sum the per-
-  // framework gap_count so body + summary agree. De-duplicate by gap key in
-  // case a single gap matches multiple requested frameworks.
-  let matchingGapCount;
-  if (opts.allFrameworks) {
-    matchingGapCount = relevantGaps.length;
-  } else {
-    const seen = new Set();
-    for (const id of frameworkIds) {
-      for (const g of frameworkResults[id]?.gaps ?? []) seen.add(g.id);
-    }
-    matchingGapCount = seen.size;
-  }
+  // 8 matching gaps" (every framework's hits, pre-filter).
+  const matchingGapCount = scopedGaps.length;
 
   return {
     threat_scenario: threatScenario,

package/lib/job-queue.js

@@ -34,8 +34,15 @@ class TokenBucket {
     if (elapsed <= 0) return;
     const add = elapsed / this.refillIntervalMs;
     if (add >= 1) {
-      this.tokens = Math.min(this.capacity, this.tokens + Math.floor(add));
-      this.lastRefill = now;
+      const whole = Math.floor(add);
+      this.tokens = Math.min(this.capacity, this.tokens + whole);
+      // Advance lastRefill by the time the whole tokens we just granted
+      // consumed, NOT to `now`. Snapping to `now` discards the sub-interval
+      // remainder (`elapsed % refillIntervalMs`), so the bucket refills
+      // slightly slower than the configured rate and under-utilizes the
+      // budget over many refills. Crediting only the consumed time keeps
+      // the long-run refill rate exactly tokens/windowMs.
+      this.lastRefill += whole * this.refillIntervalMs;
     }
   }
   tryTake() {

package/lib/lint-skills.js

@@ -117,6 +117,26 @@ const ATLAS_ID_RE = /^AML\.T\d{4}(\.\d{3})?$/;
 const ATTACK_ID_RE = /^T\d{4}(\.\d{3})?$/;
 const SEMVER_RE = /^\d+\.\d+\.\d+$/;
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+/*
+ * Strict ISO calendar-date check. ISO_DATE_RE only proves the SHAPE
+ * (YYYY-MM-DD); Date.parse() silently rolls non-calendar dates over —
+ * 2026-02-30 becomes 2026-03-02, 2026-04-31 becomes 2026-05-01 — so a
+ * malformed review date would pass the staleness gate against a date that
+ * never existed. Round-trip through Date.UTC and require every component to
+ * survive unchanged, which rejects the rollovers while accepting real dates.
+ */
+function isStrictIsoCalendarDate(s) {
+  if (typeof s !== 'string' || !ISO_DATE_RE.test(s)) return false;
+  const [y, m, d] = s.split('-').map((n) => parseInt(n, 10));
+  if (m < 1 || m > 12 || d < 1 || d > 31) return false;
+  const dt = new Date(Date.UTC(y, m - 1, d));
+  return (
+    dt.getUTCFullYear() === y &&
+    dt.getUTCMonth() + 1 === m &&
+    dt.getUTCDate() === d
+  );
+}
 const KEBAB_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 const JSON_FILENAME_RE = /^[A-Za-z0-9._-]+\.json$/;
 
@@ -293,8 +313,17 @@ function schemaConstraintErrors(fm, schema) {
     if (!(field in fm)) continue;
     const value = fm[field];
 
-    if (Array.isArray(spec.enum) && typeof value === 'string') {
-      if (!spec.enum.includes(value)) {
+    // An enum constraint must reject a wrong-typed value, not skip it. The
+    // earlier `typeof value === 'string'` guard silently passed any non-string
+    // (e.g. `discovery_mode: [standalone]` parsed as an array, or a number),
+    // letting a malformed field bypass validation entirely. Flag the type
+    // mismatch first; only run the membership check on an actual string.
+    if (Array.isArray(spec.enum)) {
+      if (typeof value !== 'string') {
+        errors.push(
+          `frontmatter.${field} must be a string (one of ${JSON.stringify(spec.enum)}), got ${Array.isArray(value) ? 'array' : typeof value}`,
+        );
+      } else if (!spec.enum.includes(value)) {
         errors.push(
           `frontmatter.${field} "${value}" is not one of ${JSON.stringify(spec.enum)}`,
         );
@@ -433,10 +462,9 @@ function validateFrontmatter(fm, skillName) {
   }
 
   if ('last_threat_review' in fm) {
-    if (typeof fm.last_threat_review !== 'string' || !ISO_DATE_RE.test(fm.last_threat_review) ||
-        !Number.isFinite(Date.parse(fm.last_threat_review + 'T00:00:00Z'))) {
+    if (!isStrictIsoCalendarDate(fm.last_threat_review)) {
       errors.push(
-        `frontmatter.last_threat_review "${fm.last_threat_review}" is not a valid ISO date (YYYY-MM-DD). A structurally ISO but non-calendar value (e.g. 2026-13-99) is rejected so a malformed date cannot slip past the staleness gate.`,
+        `frontmatter.last_threat_review "${fm.last_threat_review}" is not a valid ISO date (YYYY-MM-DD). A structurally ISO but non-calendar value (e.g. 2026-13-99 or a rollover like 2026-02-30) is rejected so a malformed date cannot slip past the staleness gate.`,
       );
     } else {
       // v0.13.0: Hard Rule #8 forcing function — refuse skills whose
@@ -1044,6 +1072,7 @@ module.exports = {
   MIN_SECTION_BODY_WORDS,
   validateFrontmatter,
   schemaConstraintErrors,
+  isStrictIsoCalendarDate,
   FRONTMATTER_SCHEMA,
 };
 

package/lib/playbook-runner.js

@@ -4204,8 +4204,44 @@ function evalCondition(expr, ctx, playbook) {
     // would exclude it: 'critical' < 'high' lexicographically).
     const SEV = { low: 0, medium: 1, high: 2, critical: 3 };
     const lr = SEV[String(lv).toLowerCase()], rr = SEV[String(rv).toLowerCase()];
-    const a = (lr !== undefined && rr !== undefined) ? lr : lv;
-    const b = (lr !== undefined && rr !== undefined) ? rr : rv;
+    let a = (lr !== undefined && rr !== undefined) ? lr : lv;
+    let b = (lr !== undefined && rr !== undefined) ? rr : rv;
+    const isOrdering = op === '>=' || op === '<=' || op === '>' || op === '<';
+    if (isOrdering && (lr === undefined || rr === undefined)) {
+      // Duration literals carry a unit suffix (`24h`, `7d`, `30min`) — the
+      // catalog writes ordering comparisons against them (kernel.json's
+      // `reboot_window > 24h` raise_severity escalation). The RHS-coercion
+      // above only converts a BARE numeric (`/^-?\d+(\.\d+)?$/`), so a unit-
+      // suffixed literal stays a string. A numeric LHS then compares against a
+      // string RHS (`48 > '24h'` → `48 > NaN` → false: a 48h window silently
+      // fails to escalate) and a string LHS compares lexicographically
+      // (`'6h' > '24h'` → `'6' > '2'` → true: a 6h window WRONGLY escalates).
+      // Normalize both sides to canonical hours when a duration unit appears on
+      // either side: a unit-suffixed literal converts by its unit family; a
+      // bare number is taken in the same family as the duration it is compared
+      // against (hours-equivalent magnitude). The comparison is then numeric.
+      const la = parseDurationHours(a), ba = parseDurationHours(b);
+      if ((la !== null || ba !== null) && la !== null && ba !== null) {
+        a = la; b = ba;
+      } else if (
+        // Two non-numeric, non-severity, non-duration strings under an ordering
+        // operator is a silently-degraded comparison (lexicographic / NaN) — the
+        // clause PARSED so condition_unparsed never fires. Surface a distinct
+        // condition_type_mismatch so the degraded comparison is observable
+        // (the boolean result is unchanged; this is diagnostics only).
+        typeof a !== 'number' && typeof b !== 'number' &&
+        !(typeof a === 'string' && /^-?\d+(?:\.\d+)?$/.test(a.trim())) &&
+        !(typeof b === 'string' && /^-?\d+(?:\.\d+)?$/.test(b.trim()))
+      ) {
+        const target = (ctx && Array.isArray(ctx._runErrors)) ? ctx._runErrors
+          : (playbook && Array.isArray(playbook._runErrors)) ? playbook._runErrors
+          : null;
+        if (target) {
+          pushRunError(target, { kind: 'condition_type_mismatch', condition: String(expr).slice(0, 200) },
+            { dedupeKey: x => x.condition || '' });
+        }
+      }
+    }
     switch (op) {
       case '==': case '=': return lv == rv;
       case '!=': return lv != rv;
@@ -4346,6 +4382,33 @@ function resolvePath(obj, dot) {
   return dot.split('.').reduce((acc, k) => acc == null ? null : acc[k], obj);
 }
 
+/**
+ * Normalize a duration operand to canonical hours for a numeric comparison.
+ * Accepts a unit-suffixed literal (`24h`, `7d`, `2wk`, `30min`) and converts by
+ * its unit family, OR a bare number / numeric string (returned as its own
+ * magnitude — the catalog writes `reboot_window > 24h` where the LHS resolves to
+ * a bare hour count). Returns null for anything that is not a recognized
+ * duration or plain number, so the caller can detect that BOTH sides normalized
+ * before comparing numerically (and surface a type-mismatch otherwise).
+ */
+const DURATION_UNIT_HOURS = {
+  h: 1, hr: 1, hrs: 1,
+  m: 1 / 60, min: 1 / 60,
+  d: 24, day: 24, days: 24,
+  w: 168, wk: 168,
+};
+function parseDurationHours(v) {
+  if (typeof v === 'number') return Number.isFinite(v) ? v : null;
+  if (typeof v !== 'string') return null;
+  const s = v.trim();
+  // Bare numeric string (no unit) — take its magnitude as-is.
+  if (/^-?\d+(?:\.\d+)?$/.test(s)) return parseFloat(s);
+  const m = s.match(/^(\d+(?:\.\d+)?)\s*(h|hr|hrs|d|day|days|wk|w|m|min)$/i);
+  if (!m) return null;
+  const mult = DURATION_UNIT_HOURS[m[2].toLowerCase()];
+  return mult === undefined ? null : parseFloat(m[1]) * mult;
+}
+
 /**
  * Depth-aware splitter — split `expr` at occurrences of ` <sep> ` (with
  * surrounding spaces) that are at parenthesis depth 0. Returns the (trimmed)

package/lib/prefetch.js

@@ -738,8 +738,10 @@ async function prefetch(options = {}) {
             current.entries[entryKey(item.source, item.id)] = meta;
             return current;
           });
-          // Mirror the entry into the in-memory idx for callers that read
-          // it later in this run (e.g. the final saveIndex merge).
+          // Mirror the entry into the in-memory idx snapshot so any
+          // later in-run freshness check sees this entry as fresh. The
+          // authoritative on-disk write already happened under the lock
+          // above; this is the in-memory copy only.
           idx.entries[entryKey(item.source, item.id)] = meta;
         } catch (lockErr) {
           // Lock failure OR rename-inside-lock failure — unlink the staged
@@ -763,11 +765,17 @@ async function prefetch(options = {}) {
 
   await Promise.all(jobPromises);
   await queue.drain();
-  idx.generated_at = new Date().toISOString();
-  // v0.12.12 C2: saveIndex now merges under lock with whatever is on disk
-  // (another concurrent prefetch's entries). Without the merge, a sibling
-  // run's writes would be silently overwritten here at the end of our run.
-  await saveIndex(opts.cacheDir, idx);
+  // Each fetched entry was already persisted to the on-disk index under
+  // lock during the run (the per-entry withIndexLock above), so the final
+  // write only needs to stamp generated_at. Re-merging the whole
+  // start-of-run `idx` snapshot here would RESURRECT entries a concurrent
+  // run pruned between our snapshot and now — partially defeating the
+  // concurrency fix the per-entry lock provides. Bump generated_at on the
+  // CURRENT on-disk index under lock instead, touching nothing else.
+  await withIndexLock(opts.cacheDir, (current) => {
+    current.generated_at = new Date().toISOString();
+    return current;
+  });
 
   // Sign the freshly-written _index.json with the Ed25519 private key
   // (.keys/private.pem). The signature is a sidecar `_index.json.sig`;

package/lib/rfc-cli.js

@@ -86,8 +86,13 @@ function titleMatches(claimed, indexTitle) {
   // No contiguous run, but all tokens present out of order. Accept only when the
   // claim covers a strong majority of the index title's tokens (containment
   // ratio floor) — a few scattered tokens against a long title is ambiguous,
-  // not a match.
-  const ratio = claimTokens.length / titleTokens.length;
+  // not a match. Count DISTINCT claim tokens that appear in the title: counting
+  // non-distinct tokens lets a repeated-token claim (e.g. "security security
+  // security security") inflate the ratio past the floor and falsely match an
+  // unrelated title.
+  const distinct = new Set(claimTokens);
+  const present = [...distinct].filter((t) => titleSet.has(t)).length;
+  const ratio = present / titleTokens.length;
   return ratio >= 0.8;
 }
 

package/lib/schemas/skill-frontmatter.schema.json

@@ -87,9 +87,9 @@
       "type": "array",
       "items": {
         "type": "string",
-        "pattern": "^D3-[A-Z]+$"
+        "pattern": "^D3[AF]?-[A-Z0-9]+(?:-[A-Z0-9]+)*$"
       },
-      "description": "Optional. MITRE D3FEND defensive technique IDs the skill maps to. Each must resolve in data/d3fend-catalog.json."
+      "description": "Optional. MITRE D3FEND defensive technique IDs the skill maps to, across the D3-, D3A- (analysis), and D3F- (offensive/forensic) namespaces. Each must resolve in data/d3fend-catalog.json."
     },
     "dlp_refs": {
       "type": "array",

package/lib/scoring.js

@@ -367,13 +367,29 @@ function scoreCustom(factors, opts) {
  */
 function deriveRwepFromFactors(factors) {
   if (!factors || typeof factors !== 'object') return 0;
-  const values = Object.values(factors);
-  if (values.length === 0) return 0;
+  const entries = Object.entries(factors);
+  if (entries.length === 0) return 0;
+  // A boolean factor OR a string active_exploitation ladder value is Shape-A
+  // evidence — scoreCustom reads exactly those. active_exploitation's string
+  // form legitimately appears in BOTH shapes (Shape A stores it as the literal
+  // ladder string; a Shape B post-weight block can ALSO carry it as a
+  // human-readable status alongside its post-weight integers), so it is the
+  // hasPostWeightInt guard below — NOT excluding active_exploitation from this
+  // check — that disambiguates them. Excluding it here under-scored an
+  // active-exploitation-ONLY raw bag (e.g. `{ active_exploitation: 'confirmed',
+  // blast_radius: 10 }`): hasBooleanOrLadder went false, the block fell through
+  // to the Shape-B sum, and the ladder string was skipped (10 vs scoreCustom 30).
   const aeAllowed = new Set(['none', 'unknown', 'suspected', 'theoretical', 'confirmed']);
-  const hasBooleanOrLadder = values.some(
-    (v) => typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v.trim().toLowerCase())),
+  const hasBooleanOrLadder = entries.some(
+    ([, v]) => (typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v.trim().toLowerCase()))),
   );
-  if (hasBooleanOrLadder) {
+  // A boolean-named key carrying a post-weight integer (>=5) is unambiguous
+  // Shape-B evidence. When present, the block is Shape B even if it also carries
+  // a string active_exploitation — route to the post-weight sum, not scoreCustom.
+  const hasPostWeightInt = entries.some(
+    ([k, v]) => k !== 'blast_radius' && typeof v === 'number' && Number.isFinite(v) && Math.abs(v) >= 5,
+  );
+  if (hasBooleanOrLadder && !hasPostWeightInt) {
     return scoreCustom(factors);
   }
   // Shape B: catalog post-weight. Sum + clamp.
@@ -505,7 +521,14 @@ function compare(cveId, catalog, opts) {
     if (entry.poc_available) driving.push('public PoC (+20)');
     if (entry.ai_discovered || entry.ai_assisted_weaponization) driving.push('AI-discovered (+15 weaponization)');
     if (String(entry.active_exploitation || '').trim().toLowerCase() === 'confirmed') driving.push('confirmed exploitation (+20)');
-    if ((entry.reboot_required || entry.patch_required_reboot) && !entry.live_patch_available) driving.push('reboot required (+5)');
+    // Mirror scoreCustom's rebootFactor EXACTLY: the +5 reboot weight is added
+    // whenever a reboot is required, regardless of live_patch_available (a live
+    // patch is a temporary workaround; the full-remediation window still extends
+    // — see the RWEP_WEIGHTS header note). Gating this driver on
+    // !live_patch_available made the enumerated factors sum to less than the
+    // delta on any entry that both requires a reboot AND has a live patch
+    // available, hiding a driver the score actually counted.
+    if (entry.reboot_required || entry.patch_required_reboot) driving.push('reboot required (+5)');
     explanation += driving.join(', ');
     explanation += '. Framework patch SLAs calibrated to CVSS are insufficient for this CVE.';
   } else if (delta < -10) {
@@ -569,6 +592,16 @@ function detectFactorShape(factors) {
   let sawWeightedInt = false;
   for (const [k, v] of Object.entries(factors)) {
     if (k === 'blast_radius') continue; // always integer in both shapes
+    if (k === 'active_exploitation' && typeof v === 'string') {
+      // active_exploitation's string-ladder form is valid in BOTH shapes — a
+      // Shape B (post-weight) block can carry it as the human-readable status
+      // string alongside its post-weight integers, exactly the way Shape A does.
+      // So a string active_exploitation is NOT Shape-A evidence; counting it as
+      // sawBool produced a spurious 'mixed' verdict (and a validate() error) on
+      // an otherwise-clean Shape B block. Its weight, when summed, is resolved
+      // via resolveActiveExploitation in the post-weight path, not here.
+      continue;
+    }
     if (typeof v === 'boolean' || v === null) {
       sawBool = true;
     } else if (typeof v === 'number' && Math.abs(v) >= 5 && boolFields.includes(k)) {
@@ -579,7 +612,7 @@ function detectFactorShape(factors) {
       // 0/1 on a boolean-named field could be either shape; ambiguous, ignore.
       continue;
     } else if (typeof v === 'string' && boolFields.includes(k)) {
-      // String values (e.g. active_exploitation: 'confirmed') are Shape A.
+      // String values on OTHER boolean-named fields are Shape A.
       sawBool = true;
     }
   }

package/lib/source-ghsa.js

@@ -246,8 +246,14 @@ async function fetchAdvisoryById(id, opts = {}) {
     if (!match) return { ok: false, error: `${id} not in fixture`, source: "fixture" };
     return { ok: true, advisories: [match], source: "fixture" };
   }
-  if (/^GHSA-/i.test(id)) {
-    return fetchAdvisories({ ...opts, path: `/advisories/${id.toLowerCase()}` });
+  // Validate the FULL GHSA token shape (GHSA-xxxx-xxxx-xxxx) before building the
+  // request path, and encodeURIComponent the segment — symmetric with the CVE
+  // branch below. A prefix-only `/^GHSA-/i` left the remainder unconstrained, so
+  // an operator-supplied id like `GHSA-aaaa/../../meta` survived verbatim into
+  // `/advisories/...` as path-control segments; the strict shape now routes a
+  // malformed id to the unrecognized-id error envelope instead.
+  if (/^GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}$/i.test(id)) {
+    return fetchAdvisories({ ...opts, path: `/advisories/${encodeURIComponent(id.toLowerCase())}` });
   }
   if (/^CVE-\d{4}-\d+$/i.test(id)) {
     return fetchAdvisories({ ...opts, path: `/advisories?cve_id=${encodeURIComponent(id.toUpperCase())}` });

package/lib/source-osv.js

@@ -542,6 +542,16 @@ function extractCvss(rec) {
   // back from v4 -> v3 if v4 fails to compute.
   const vectorsByVersion = new Map(); // version (number) -> vector string
   let bareScore = null;
+  // Computed score for a single CVSS vector string: its trailing /N.N score if
+  // present, else the derived CVSS 3.x base score, else null (e.g. an
+  // uncomputable v4 vector). Used to keep the HIGHEST-scoring vector per major
+  // version regardless of severity[] array order.
+  const vectorScore = (vec) => {
+    const tail = vec.match(/\/(\d+(?:\.\d+)?)$/);
+    if (tail) { const t = parseFloat(tail[1]); if (t >= 0 && t <= 10) return t; }
+    if (/^CVSS:3\./.test(vec)) { const c = cvss3BaseScore(vec); if (c != null) return c; }
+    return null;
+  };
   for (const s of sev) {
     if (s == null) continue;
     let raw = null;
@@ -554,15 +564,21 @@ function extractCvss(rec) {
     // Bare numeric score (no vector prefix).
     const num = parseFloat(v);
     if (!Number.isNaN(num) && num >= 0 && num <= 10 && !v.includes("/")) {
-      if (bareScore == null) bareScore = num;
+      // HIGHEST-wins, not first-wins: an OSV record legitimately carries
+      // multiple same-version severity entries (e.g. an NVD base score plus a
+      // CNA/vendor score) and the upstream array order is not guaranteed. A
+      // first-wins guard silently downgraded a 9.8 critical to a 5.3 medium
+      // purely because the lower score appeared earlier in severity[].
+      if (bareScore == null || num > bareScore) bareScore = num;
       continue;
     }
     const m = v.match(/^CVSS:(\d+\.\d+)/);
     if (!m) continue;
     const ver = parseFloat(m[1]);
-    // Keep the highest score within each major version.
+    // Keep the HIGHEST-scoring vector within each major version (same rationale
+    // as the bare-score path above). Compare computed scores, not array order.
     const prev = vectorsByVersion.get(ver);
-    if (!prev) vectorsByVersion.set(ver, v);
+    if (!prev || (vectorScore(v) ?? -1) > (vectorScore(prev) ?? -1)) vectorsByVersion.set(ver, v);
   }
   // Try versions in descending order. CVSS 4.0 derivation is not yet
   // implemented here — if v4 was the highest but can't be computed, walk