@blamejs/exceptd-skills 0.18.12 → 0.18.14

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.18.14 — 2026-06-22
+
+Severity escalations, downstream-playbook chaining, and remediation-path preconditions now fire as authored across the playbook catalog. A number of these conditions had been written as free-text English or in a shorthand the engine does not evaluate, so they returned false for every input and silently never triggered — a raise-severity rule, a `feeds_into` chain into a deeper playbook, or a remediation precondition that looked active but never fired. Every such condition is now expressed in the engine's condition language and verified to evaluate against the indicators it gates on.
+
+The playbook validator now runs each escalation, `feeds_into`, and remediation precondition through the real evaluator and rejects any condition it cannot parse, so one that would be dead at runtime fails validation instead of shipping.
+
+`ci --format sarif` and `ci --format openvex` now emit the requested bundle for every scanned playbook. Previously only a playbook whose declared primary format already matched the request contributed a document, so the aggregated output was frequently an empty array.
+
+`evidence_hash` is no longer perturbed by the chosen output format, so attesting and reattesting the same evidence with a different `--format` yields the same hash; a supplied VEX disposition still changes the hash, because it changes which CVEs are in scope.
+
+Remediation-path preconditions can now reference the engine-computed finding — RWEP, severity, matched CVEs, blast-radius score, and compliance-theater verdict — so a precondition gated on one of those is evaluated rather than treated as unmet. The containers playbook chains into the SBOM playbook when container image layers are present.
+
+## 0.18.13 — 2026-06-22
+
+A correctness + robustness pass across the upstream data parsers, the validators, and the prefetch/feed paths.
+
+The OSV advisory importer keeps the HIGHEST CVSS vector and score when a record carries multiple same-version severity entries (e.g. an NVD base score alongside a CNA/vendor score), instead of whichever appeared first in the array — a 9.8 critical no longer imports as a 5.3 medium purely because of upstream array order, which previously also flipped the derived KEV-pending / active-exploitation / severity-word fields. The RSS/Atom feed tokenizer strips HTML in a single linear pass, so a malformed or hostile feed body with many unclosed `<` can no longer stall the refresh worker (the previous regex was quadratic on attacker-controlled text). An Atom `<link>` carrying element text is now selected by its `rel` the same way the attribute form is, so a non-`alternate` link cannot override the canonical `alternate`. `refresh --advisory <ghsa-id>` validates the full `GHSA-xxxx-xxxx-xxxx` token shape and URL-encodes it before building the request path.
+
+The playbook validator range-checks a partial `phase_overrides.direct.rwep_threshold` override and rejects an impossible calendar date (`2026-02-30`); the CVE-catalog validator reports an absent reference catalog as unvalidatable for ALL five reference families instead of flagging every `atlas_ref`/`cwe_ref` as unresolved; the RFC validator skips non-IETF references (CSAF, ISO) rather than reporting them as permanent drift; the version-pin validator no longer probes the two upstreams that publish no GitHub releases (reported as tracked elsewhere); the vendor inventory cross-check covers `.cjs`/`.mjs`/`.json`, not only `.js`; the package size-budget gate fails closed when `npm pack` omits the size field; and the disputed-CVE check reports the real local status. The skill linter flags a wrong-typed enum value and rejects an impossible `last_threat_review`, and the `d3fend_refs` frontmatter pattern accepts the `D3A-`/`D3F-` id families. `upstream-check` reports a clear error rather than `ok:true` with an undefined version when a fixture lacks dist-tags, and a non-parseable publish date yields a clear value instead of `NaN`. The prefetch index no longer resurrects entries a concurrent run pruned, `ttp-mapper` ignores inherited object keys, and the EPSS lookup returns not-found for an absent CVE instead of the first row.
+
 ## 0.18.12 — 2026-06-22
 
 A correctness pass across the CLI, the engine, scoring, the collectors, framework-gap reporting, signature verification, and the CWE-chain index.

package/bin/exceptd.js

@@ -9166,6 +9166,22 @@ function cmdCi(runner, args, runOpts, pretty) {
   let clockStartedFail = false;
   let clockStartedReasons = [];
 
+  // Thread the requested bundle output format into each per-playbook run so
+  // close() actually BUILDS it. `ci --format sarif|openvex|csaf` reads each
+  // result's evidence_package.bundles_by_format[fmt] below; the runner only
+  // builds the playbook's declared PRIMARY bundle_format unless the operator
+  // seeds signals._bundle_formats. Without this, any playbook whose primary
+  // format differs from the request emitted no bundle for that format and the
+  // aggregated `ci --format sarif/openvex` array dropped it (.filter(Boolean)),
+  // so the output was a silent empty array. Mapping mirrors the read at the
+  // emit site: csaf → csaf-2.0; sarif/openvex pass through. (_bundle_formats is
+  // a `_`-prefixed render directive, so it is excluded from evidence_hash and
+  // does not perturb attest/reattest.)
+  let ciFormatRaw = args.format;
+  if (Array.isArray(ciFormatRaw)) ciFormatRaw = ciFormatRaw[0];
+  const ciBundleFormat = (ciFormatRaw === 'csaf' || ciFormatRaw === 'csaf-2.0') ? 'csaf-2.0'
+    : (ciFormatRaw === 'sarif' || ciFormatRaw === 'openvex') ? ciFormatRaw : null;
+
   for (const id of ids) {
     // defense-in-depth — validate id even though the catalog-iter
     // upstream is trusted. A corrupt catalog returning a malformed id would
@@ -9186,6 +9202,16 @@ function cmdCi(runner, args, runOpts, pretty) {
       continue;
     }
     const submission = bundle[id] || {};
+    if (ciBundleFormat) {
+      // Clone signals before injecting so the shared evidence bundle is not
+      // mutated; merge with any operator-supplied _bundle_formats.
+      const existing = Array.isArray(submission.signals && submission.signals._bundle_formats)
+        ? submission.signals._bundle_formats : [];
+      submission.signals = {
+        ...(submission.signals || {}),
+        _bundle_formats: existing.includes(ciBundleFormat) ? existing : [...existing, ciBundleFormat],
+      };
+    }
     const perOpts = { ...runOpts, session_id: sessionId };
     if (submission.precondition_checks) perOpts.precondition_checks = submission.precondition_checks;
     let result;

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-22T06:27:15.592Z",
+  "generated_at": "2026-06-22T14:16:42.035Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "d897efd048acdde209213af36857c5385c036a650096531408ca978590e38226",
+    "manifest.json": "be5406117ede866ec4dc653cf15f9555f8fa58c254fc601800e4bacb07ddb609",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",

package/data/playbooks/ai-api.json

@@ -749,7 +749,7 @@
           "action": "page_on_call"
         },
         {
-          "condition": "any credential indicator deterministic AND blast_radius_score >= 4",
+          "condition": "(cleartext-api-key-in-dotfile == true OR long-lived-aws-keys == true OR gcp-service-account-json == true OR kubeconfig-with-static-token == true) AND blast_radius_score >= 4",
           "action": "page_on_call"
         },
         {
@@ -849,7 +849,7 @@
           "id": "policy-exception",
           "description": "Where business-critical interactive use makes egress proxying or process allowlisting infeasible, generate a defensible policy exception with compensating controls (rate quota per service account, vendor-side abuse alerting integration, weekly dotfile re-audit).",
           "preconditions": [
-            "remediation_paths[1..5] partially or fully blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 5,

package/data/playbooks/ai-discovered-cve-triage.json

@@ -857,7 +857,7 @@
           "id": "policy-exception",
           "description": "For assets that cannot reach the AI-discovered-tier SLA within the cycle: generate auditor-ready policy exception with compensating controls (live patch, network isolation, module unload, monitoring), time-bound risk acceptance, and remediation milestones.",
           "preconditions": [
-            "remediation_paths[1..5] partially blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 6,

package/data/playbooks/audit-log-integrity.json

@@ -448,11 +448,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "A single compromised identity can rewrite/delete the system-of-record trail undetected",
+          "condition": "audit-log-deletable-by-writing-identity == true AND (audit-hash-chain-not-verified == true OR audit-log-not-signed-or-key-colocated == true)",
           "action": "raise_severity"
         },
         {
-          "condition": "Records under legal hold are reachable by the retention purge",
+          "condition": "legal-hold-not-blocking-purge == true",
           "action": "trigger_playbook"
         }
       ]
@@ -463,7 +463,7 @@
           "id": "verify-chain-and-sign-off-host",
           "description": "Verify the audit hash chain on every read/replay/export and fail closed on a break; sign chain checkpoints with a key held by a separate identity / KMS / HSM, not the log-writing process.",
           "preconditions": [
-            "operator controls the audit subsystem"
+            "operator_controls_audit_subsystem == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/cicd-pipeline-compromise.json

@@ -743,7 +743,7 @@
           "id": "policy-exception",
           "description": "Generate auditor-ready policy exception when faster paths are blocked.",
           "preconditions": [
-            "remediation_paths[1..5] partially blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 6,

package/data/playbooks/citation-hygiene.json

@@ -542,7 +542,7 @@
           "target_playbook": "framework"
         },
         {
-          "condition": "rejected-or-disputed-cve fires for an identifier whose catalog active_exploitation == 'confirmed'",
+          "condition": "rejected-or-disputed-cve == true AND cited-cve-active-exploitation-confirmed == true",
           "action": "raise_severity"
         }
       ]
@@ -609,7 +609,7 @@
           "id": "policy-exception",
           "description": "If a citation cannot be resolved within the review window (e.g. an embargoed advisory not yet public, an RFC pending publication): generate an auditor-ready policy exception recording the pending citation, the verification deadline, and the interim caveat added to the documentation.",
           "preconditions": [
-            "remediation_paths[1..4] blocked for this specific citation due to external_dependency == true"
+            "prior_remediations_blocked == true AND external_dependency == true"
           ],
           "priority": 5,
           "compensating_controls": [

package/data/playbooks/containers.json

@@ -43,7 +43,7 @@
       },
       {
         "playbook_id": "sbom",
-        "condition": "container-image-layers.length > 0"
+        "condition": "container-image-layers > 0"
       }
     ]
   },
@@ -795,7 +795,7 @@
           "action": "page_on_call"
         },
         {
-          "condition": "k8s-cluster-admin-binding fired AND target_namespace not in infrastructure_namespaces",
+          "condition": "k8s-cluster-admin-binding == true AND target-namespace-outside-infra-allowlist == true",
           "action": "raise_severity"
         },
         {

package/data/playbooks/cred-stores.json

@@ -818,7 +818,7 @@
           "id": "fix-credentials-perms",
           "description": "chmod 0600 on all credential files; chmod 0700 on ~/.config/gcloud/, ~/.aws/, ~/.ssh/.",
           "preconditions": [
-            "file_owner_is_current_user"
+            "file_owner_is_current_user == true"
           ],
           "priority": 2,
           "for_signals": [

package/data/playbooks/crypto-codebase.json

@@ -1093,7 +1093,7 @@
           "id": "policy-exception",
           "description": "If a deprecated primitive cannot be removed in a minor version due to API-stability promise: generate auditor-ready policy exception. Time-bound until next major version with explicit migration roadmap, deprecation warning emitted at runtime, parallel new API published, downstream-consumer migration guide.",
           "preconditions": [
-            "remediation_paths[1..8] blocked for this specific primitive due to api_stability == true",
+            "prior_remediations_blocked == true AND api_stability == true",
             "next_major_version_window <= 12_months",
             "ciso_or_maintainer_acceptance_obtainable == true"
           ],

package/data/playbooks/crypto.json

@@ -800,7 +800,7 @@
           "id": "policy-exception",
           "description": "If a specific asset cannot reach hybrid PQC in this cycle (legacy hardware, embedded HSM without PQC firmware, vendor SaaS): generate auditor-ready policy exception with crypto-agility roadmap.",
           "preconditions": [
-            "remediation_paths[1..5] blocked for the specific asset",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 6,

package/data/playbooks/decompression-dos.json

@@ -429,11 +429,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "An internet-facing ingest accepts attacker input and a single crafted payload exhausts the instance",
+          "condition": "archive-decompression-unbounded == true OR length-field-unbounded-allocation == true OR nested-archive-bomb-uncapped == true OR xml-entity-expansion-enabled == true OR redos-catastrophic-backtracking == true OR recursive-parse-no-depth-limit == true",
           "action": "raise_severity"
         },
         {
-          "condition": "Archive extraction is vulnerable to Zip Slip on a writable path",
+          "condition": "zip-slip-path-traversal == true",
           "action": "trigger_playbook"
         }
       ]
@@ -444,7 +444,7 @@
           "id": "cap-decompression",
           "description": "Enforce a total decompressed-output size ceiling AND a per-entry compression-ratio guard, plus a cumulative cap and recursion limit for nested archives; fail closed when exceeded.",
           "preconditions": [
-            "operator controls the decompression path"
+            "operator_controls_decompression_path == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/framework.json

@@ -801,7 +801,7 @@
           "id": "board-level-acknowledgement",
           "description": "Where multiple framework-gap declarations cannot be closed within compliance windows: escalate to board-level acknowledgement of the GRC posture with documented framework-lag declaration and accepted residual risk.",
           "preconditions": [
-            "remediation_paths[1..5] cannot close all findings within compliance windows",
+            "prior_remediations_cannot_close_in_window == true",
             "board_acceptance_obtainable == true"
           ],
           "priority": 6,

package/data/playbooks/hardening.json

@@ -719,7 +719,7 @@
           "target_playbook": "kernel"
         },
         {
-          "condition": "selinux_disabled AND apparmor_no_enforcing_profiles AND blast_radius_score >= 3",
+          "condition": "selinux-not-enforcing == true AND apparmor-no-enforcing-profiles == true AND blast_radius_score >= 3",
           "action": "raise_severity"
         },
         {

package/data/playbooks/identity-sso-compromise.json

@@ -745,7 +745,7 @@
           "id": "policy-exception",
           "description": "Generate auditor-ready policy exception when faster paths are blocked.",
           "preconditions": [
-            "remediation_paths[1..4] partially blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 5,

package/data/playbooks/kernel.json

@@ -612,7 +612,7 @@
           "id": "hardening-compensation",
           "description": "When reboot impossible within compliance window: tighten hardening flags (disable unpriv-userns, disable unpriv-bpf, set kptr_restrict=2, raise yama.ptrace_scope to 2) to break the exploit's primitive without patching.",
           "preconditions": [
-            "matched_cve.vector matches userns|bpf|ptrace|kptr",
+            "any matched_cve.vector matches 'userns|bpf|ptrace|kptr'",
             "ops_authorization_for_sysctl_changes == true"
           ],
           "priority": 3,
@@ -627,7 +627,7 @@
           "id": "policy-exception",
           "description": "Generate an auditor-ready policy exception via policy-exception-gen documenting that all faster remediation paths are blocked, with compensating controls and time-bound risk acceptance.",
           "preconditions": [
-            "remediation_paths[1..3] all blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 4,

package/data/playbooks/library-author.json

@@ -1389,7 +1389,7 @@
           "id": "policy-exception",
           "description": "Where a publisher-posture gap cannot be remediated within the compliance window — typical case: API stability promise prevents removing a deprecated transitive dep before next major version; OR registry doesn't yet support Trusted Publisher; OR a Class II conformity assessment is in progress — generate an auditor-ready policy exception via policy-exception-gen with compensating controls and time-bound sunset date.",
           "preconditions": [
-            "remediation_paths[1..9] blocked for at least one finding",
+            "prior_remediations_blocked == true",
             "ciso_or_product_owner_acceptance_obtainable == true"
           ],
           "priority": 10,

package/data/playbooks/llm-tool-use-exfil.json

@@ -725,7 +725,7 @@
           "id": "policy-exception",
           "description": "Generate auditor-ready policy exception when faster paths are blocked.",
           "preconditions": [
-            "remediation_paths[1..4] partially blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 5,

package/data/playbooks/log-injection-telemetry.json

@@ -430,11 +430,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "Secrets/PII are logged without redaction, or a webhook sink reaches cloud metadata via SSRF",
+          "condition": "secrets-or-pii-logged-without-redaction == true OR webhook-log-sink-ssrf-unguarded == true",
           "action": "raise_severity"
         },
         {
-          "condition": "CR/LF log forging is possible on the audit sink incident response relies on",
+          "condition": "crlf-log-injection-unsanitized == true",
           "action": "trigger_playbook"
         }
       ]
@@ -445,7 +445,7 @@
           "id": "neutralize-and-redact",
           "description": "Neutralize CR/LF + control characters in interpolated values on every sink (or move to a structured-only format), and run a redaction pass that strips secrets/PII before any sink.",
           "preconditions": [
-            "operator controls the logging path"
+            "operator_controls_logging_path == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/mail-server-hardening.json

@@ -508,11 +508,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "An internet-facing inbound MX accepts non-standard end-of-data (smuggling) or relays for unauthenticated peers",
+          "condition": "smtp-smuggling-end-of-data-accepted == true OR inbound-open-relay == true",
           "action": "raise_severity"
         },
         {
-          "condition": "Sieve redirect is uncapped on a multi-tenant mailbox service (mail-exfil primitive)",
+          "condition": "sieve-redirect-uncapped == true",
           "action": "trigger_playbook"
         }
       ]
@@ -523,7 +523,7 @@
           "id": "enforce-standard-end-of-data",
           "description": "Reject non-standard end-of-data sequences on the inbound SMTP listener (and upgrade the MTA to the smuggling-fixed release); require canonical <CR><LF>.<CR><LF>.",
           "preconditions": [
-            "operator controls the inbound MTA configuration"
+            "operator_controls_inbound_mta == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/mcp.json

@@ -860,7 +860,7 @@
           "action": "notify_legal"
         },
         {
-          "condition": "any unsigned-mcp-manifest with cloud credentials detected",
+          "condition": "unsigned-mcp-manifest == true AND cloud-credentials-detected == true",
           "action": "trigger_playbook",
           "target_playbook": "ai-api"
         }
@@ -925,7 +925,7 @@
           "id": "policy-exception",
           "description": "Generate auditor-ready policy exception via policy-exception-gen if a business-critical MCP server cannot meet signing / allowlist / integrity-pin requirements within compliance window.",
           "preconditions": [
-            "remediation_paths[1..4] blocked for at least one MCP server",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 5,

package/data/playbooks/multitenancy-isolation.json

@@ -467,11 +467,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "A single authenticated user can access another tenant's data on a production app",
+          "condition": "tenant-id-trusted-from-client == true OR query-not-scoped-by-tenant == true OR row-policy-bypassable-by-role-context == true OR cross-tenant-cache-or-queue-key-collision == true",
           "action": "raise_severity"
         },
         {
-          "condition": "A single client can deny service to all tenants via an uncapped asymmetric DoS",
+          "condition": "http2-rapid-reset-uncapped == true OR no-per-tenant-rate-or-byte-quota == true OR unbounded-resource-allocation-per-request == true",
           "action": "trigger_playbook"
         }
       ]
@@ -482,7 +482,7 @@
           "id": "bind-tenant-and-enforce-rls",
           "description": "Derive the tenant id from the authenticated principal (never trust a client-supplied id), and enforce tenant scoping at the data layer via row-level security under a NON-bypass request role so a forgotten predicate cannot leak.",
           "preconditions": [
-            "operator controls the data layer"
+            "operator_controls_data_layer == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/network-trust.json

@@ -455,11 +455,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "An internet-facing authentication / payment path resolves names without DNSSEC and pins no peer cert (DANE/mTLS)",
+          "condition": "dnssec-validation-not-enforced == true AND (dane-tlsa-not-checked == true OR mtls-ca-not-pinned == true)",
           "action": "raise_severity"
         },
         {
-          "condition": "Unauthenticated time drives cert-validity or TOTP on production auth",
+          "condition": "unauthenticated-ntp-no-nts == true",
           "action": "trigger_playbook"
         }
       ]
@@ -470,7 +470,7 @@
           "id": "enforce-dnssec-and-rebinding-guard",
           "description": "Validate DNSSEC end-to-end (or trust a validating upstream over DoT/DoH), prefer signed answers, and pin the resolved IP for the connection lifetime while refusing private/link-local/metadata addresses.",
           "preconditions": [
-            "resolver path is operator-controlled"
+            "operator_controls_resolver_path == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/post-quantum-migration.json

@@ -939,7 +939,7 @@
           "id": "policy-exception",
           "description": "For any asset that cannot reach hybrid PQC posture within the migration cycle: generate auditor-ready policy exception with crypto-agility roadmap + compensating controls + time-bound risk acceptance + alternative-vendor or end-of-life plan.",
           "preconditions": [
-            "remediation_paths[1..6] blocked for the specific asset",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 7,

package/data/playbooks/privacy-consent-ops.json

@@ -422,11 +422,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "Sanctions screening is evadable by a homoglyph on a live onboarding/payment path",
+          "condition": "sanctions-screening-homoglyph-evasion == true OR sanctions-screening-alias-transliteration-gap == true",
           "action": "raise_severity"
         },
         {
-          "condition": "Erasure is marked complete with no per-store evidence across the data subject base",
+          "condition": "dsr-erasure-no-completion-proof == true",
           "action": "trigger_playbook"
         }
       ]
@@ -437,7 +437,7 @@
           "id": "normalize-and-fuzzy-screen",
           "description": "Normalize names to a canonical confusable-folded skeleton (NFKC + Unicode confusable folding via the vendored codepoint-class) and apply the list's aliases + transliteration + bounded edit-distance fuzzy match before deciding.",
           "preconditions": [
-            "operator performs sanctions screening"
+            "operator_performs_sanctions_screening == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/runtime.json

@@ -665,7 +665,7 @@
           "target_playbook": "cred-stores"
         },
         {
-          "condition": "orphan-privileged-process fired OR duplicate-uid-zero fired",
+          "condition": "orphan-privileged-process == true OR duplicate-uid-zero == true",
           "action": "trigger_playbook",
           "target_playbook": "kernel"
         },
@@ -740,7 +740,7 @@
           "id": "policy-exception",
           "description": "If a finding cannot be remediated within the compliance window, generate an auditor-ready exception with bounded compensating controls.",
           "preconditions": [
-            "remediation_paths[1..4] blocked OR time_to_remediate > obligation_window"
+            "prior_remediations_blocked == true OR time_to_remediate > obligation_window"
           ],
           "priority": 4,
           "compensating_controls": [

package/data/playbooks/sbom.json

@@ -1367,7 +1367,7 @@
           "id": "policy-exception",
           "description": "Where a matched CVE cannot be remediated within compliance window (vendor pending, blocker dependency, architectural impossibility): generate auditor-ready policy exception via policy-exception-gen.",
           "preconditions": [
-            "remediation_paths[1..7] blocked for at least one matched CVE",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 8,

package/data/playbooks/secrets.json

@@ -779,7 +779,7 @@
           "id": "fix-file-permissions",
           "description": "For world-writable .env / .ssh / auth-config files: chmod 0600 (private keys) or 0640 (env files). For SSH key with bad perms: chmod 0600 and re-load via ssh-add.",
           "preconditions": [
-            "file_owner_is_current_user OR has_sudo == true"
+            "file_owner_is_current_user == true OR has_sudo == true"
           ],
           "priority": 2,
           "for_signals": [

package/data/playbooks/self-update-integrity.json

@@ -444,11 +444,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "A widely-distributed self-updating client applies updates with no signature-before-apply or in-band key trust",
+          "condition": "self-update-no-signature-verification == true OR self-update-key-not-pinned == true",
           "action": "raise_severity"
         },
         {
-          "condition": "The apply step proceeds on verifier failure/timeout",
+          "condition": "update-applied-without-verifier-gate == true",
           "action": "trigger_playbook"
         }
       ]
@@ -459,7 +459,7 @@
           "id": "verify-signature-before-apply",
           "description": "Verify an artifact signature against an out-of-band-pinned root key BEFORE swapping the update in, and fail closed on any verification error — never trust a server-provided hash alone.",
           "preconditions": [
-            "operator controls the update client"
+            "operator_controls_update_client == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/supply-chain-recovery.json

@@ -874,7 +874,7 @@
           "target_playbook": "mcp"
         },
         {
-          "condition": "any_credential_class_exfil'd_includes_sso_admin == true",
+          "condition": "credential-class-exfil-includes-sso-admin == true",
           "action": "trigger_playbook",
           "target_playbook": "idp-incident"
         },
@@ -995,7 +995,7 @@
           "id": "policy-exception",
           "description": "For recovery primitives that cannot be completed within the jurisdiction's window: generate auditor-ready policy exception with compensating controls, time-bound risk acceptance, and remediation milestones. Typical blockers: legacy host without re-imaging window, vendor refuses to rotate a shared maintainer credential, downstream-consumer notification depends on third-party advisory pipeline outside operator control.",
           "preconditions": [
-            "remediation_paths[1..6] partially blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 7,

package/data/playbooks/vc-wallet-trust.json

@@ -528,11 +528,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "An internet-facing verifier accepts an unanchored issuer key OR a replayable presentation gating a high-value entitlement",
+          "condition": "issuer-key-not-pinned-to-trust-anchor == true OR presentation-no-nonce-audience-binding == true",
           "action": "raise_severity"
         },
         {
-          "condition": "Revocation is unenforced on a credential type used for ongoing authorization",
+          "condition": "credential-revocation-status-not-checked == true",
           "action": "trigger_playbook"
         }
       ]
@@ -543,7 +543,7 @@
           "id": "pin-issuer-trust-anchors",
           "description": "Replace open issuerKeyResolver acceptance with an issuer allowlist / x5c-or-federation chain validated to a configured trust anchor; reject issuer keys that do not chain to it.",
           "preconditions": [
-            "verifier owns or can configure the set of trusted issuers"
+            "verifier_controls_trusted_issuers == true"
           ],
           "priority": 1,
           "for_signals": [
@@ -557,7 +557,7 @@
           "id": "enforce-revocation-on-accept",
           "description": "Resolve the status_list on the accept path and reject on a set status bit; treat a status fetch failure as fail-closed (not \"valid\").",
           "preconditions": [
-            "credentials carry a status mechanism"
+            "credentials_carry_status_mechanism == true"
           ],
           "priority": 1,
           "for_signals": [
@@ -568,7 +568,7 @@
           "id": "bind-presentations-to-nonce-audience",
           "description": "Issue a fresh per-request nonce, require a Key-Binding JWT echoing that nonce + the verifier audience, and verify device-auth for mdoc; reject unbound presentations.",
           "preconditions": [
-            "verifier controls the request/challenge"
+            "verifier_controls_request_challenge == true"
           ],
           "priority": 1,
           "for_signals": [

package/data/playbooks/webhook-callback-abuse.json

@@ -694,7 +694,7 @@
           "id": "policy-exception",
           "description": "Generate an auditor-ready policy exception when faster paths are blocked (legacy receiver cannot be patched within window, provider does not offer state-parameter enforcement, etc.) with compensating controls and time-bound risk acceptance.",
           "preconditions": [
-            "remediation_paths[1..3] all blocked",
+            "prior_remediations_blocked == true",
             "ciso_acceptance_obtainable == true"
           ],
           "priority": 4,