@blamejs/exceptd-skills 0.18.12 → 0.18.14

package/lib/auto-discovery.js

@@ -206,7 +206,16 @@ function extractNvdMetrics(payload) {
 
 function extractEpss(payload, id) {
   const data = Array.isArray(payload?.data) ? payload.data : [];
-  const row = data.find((r) => r?.cve === id) || data[0];
+  // Match the requested CVE id only. The prior `|| data[0]` fallback silently
+  // misattributed a DIFFERENT CVE's EPSS score into the draft whenever the
+  // requested id was absent from the payload — a single-row response for the
+  // wrong CVE (or a stale/mismatched sidecar) wrote that CVE's score under the
+  // discovered id. A non-matching payload now yields null (same
+  // null-mechanical-field behavior used when no cache exists). The only
+  // accepted fallback is a single-row, cve-less response shape (the requested
+  // id is implicit because the payload carries exactly one un-keyed row).
+  let row = data.find((r) => r?.cve === id);
+  if (!row && data.length === 1 && data[0]?.cve == null) row = data[0];
   if (!row) return null;
   return {
     score: row.epss != null ? Number(row.epss) : null,

package/lib/cve-regression-watcher.js

@@ -228,7 +228,11 @@ function findRegressionCandidates(diffs, catalog, opts) {
       const titleStr = (typeof d.title === 'string' && d.title) ? d.title
         : (typeof d.first_title === 'string' && d.first_title) ? d.first_title
         : '';
-      if (titleStr) slot.titles.push(titleStr);
+      // Dedupe titles before pushing — mirrors the content-only branch.
+      // Without this, duplicate titles across feeds (a common multi-feed
+      // surfacing pattern) consume distinct slots and evict genuinely
+      // distinct titles from the 5-cap below.
+      if (titleStr && !slot.titles.includes(titleStr)) slot.titles.push(titleStr);
       // Merge content signals — the strongest signal wins.
       Object.assign(slot.signals, signals);
       continue;

package/lib/job-queue.js

@@ -34,8 +34,15 @@ class TokenBucket {
     if (elapsed <= 0) return;
     const add = elapsed / this.refillIntervalMs;
     if (add >= 1) {
-      this.tokens = Math.min(this.capacity, this.tokens + Math.floor(add));
-      this.lastRefill = now;
+      const whole = Math.floor(add);
+      this.tokens = Math.min(this.capacity, this.tokens + whole);
+      // Advance lastRefill by the time the whole tokens we just granted
+      // consumed, NOT to `now`. Snapping to `now` discards the sub-interval
+      // remainder (`elapsed % refillIntervalMs`), so the bucket refills
+      // slightly slower than the configured rate and under-utilizes the
+      // budget over many refills. Crediting only the consumed time keeps
+      // the long-run refill rate exactly tokens/windowMs.
+      this.lastRefill += whole * this.refillIntervalMs;
     }
   }
   tryTake() {

package/lib/lint-skills.js

@@ -117,6 +117,26 @@ const ATLAS_ID_RE = /^AML\.T\d{4}(\.\d{3})?$/;
 const ATTACK_ID_RE = /^T\d{4}(\.\d{3})?$/;
 const SEMVER_RE = /^\d+\.\d+\.\d+$/;
 const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+
+/*
+ * Strict ISO calendar-date check. ISO_DATE_RE only proves the SHAPE
+ * (YYYY-MM-DD); Date.parse() silently rolls non-calendar dates over —
+ * 2026-02-30 becomes 2026-03-02, 2026-04-31 becomes 2026-05-01 — so a
+ * malformed review date would pass the staleness gate against a date that
+ * never existed. Round-trip through Date.UTC and require every component to
+ * survive unchanged, which rejects the rollovers while accepting real dates.
+ */
+function isStrictIsoCalendarDate(s) {
+  if (typeof s !== 'string' || !ISO_DATE_RE.test(s)) return false;
+  const [y, m, d] = s.split('-').map((n) => parseInt(n, 10));
+  if (m < 1 || m > 12 || d < 1 || d > 31) return false;
+  const dt = new Date(Date.UTC(y, m - 1, d));
+  return (
+    dt.getUTCFullYear() === y &&
+    dt.getUTCMonth() + 1 === m &&
+    dt.getUTCDate() === d
+  );
+}
 const KEBAB_RE = /^[a-z0-9][a-z0-9-]*[a-z0-9]$/;
 const JSON_FILENAME_RE = /^[A-Za-z0-9._-]+\.json$/;
 
@@ -293,8 +313,17 @@ function schemaConstraintErrors(fm, schema) {
     if (!(field in fm)) continue;
     const value = fm[field];
 
-    if (Array.isArray(spec.enum) && typeof value === 'string') {
-      if (!spec.enum.includes(value)) {
+    // An enum constraint must reject a wrong-typed value, not skip it. The
+    // earlier `typeof value === 'string'` guard silently passed any non-string
+    // (e.g. `discovery_mode: [standalone]` parsed as an array, or a number),
+    // letting a malformed field bypass validation entirely. Flag the type
+    // mismatch first; only run the membership check on an actual string.
+    if (Array.isArray(spec.enum)) {
+      if (typeof value !== 'string') {
+        errors.push(
+          `frontmatter.${field} must be a string (one of ${JSON.stringify(spec.enum)}), got ${Array.isArray(value) ? 'array' : typeof value}`,
+        );
+      } else if (!spec.enum.includes(value)) {
         errors.push(
           `frontmatter.${field} "${value}" is not one of ${JSON.stringify(spec.enum)}`,
         );
@@ -433,10 +462,9 @@ function validateFrontmatter(fm, skillName) {
   }
 
   if ('last_threat_review' in fm) {
-    if (typeof fm.last_threat_review !== 'string' || !ISO_DATE_RE.test(fm.last_threat_review) ||
-        !Number.isFinite(Date.parse(fm.last_threat_review + 'T00:00:00Z'))) {
+    if (!isStrictIsoCalendarDate(fm.last_threat_review)) {
       errors.push(
-        `frontmatter.last_threat_review "${fm.last_threat_review}" is not a valid ISO date (YYYY-MM-DD). A structurally ISO but non-calendar value (e.g. 2026-13-99) is rejected so a malformed date cannot slip past the staleness gate.`,
+        `frontmatter.last_threat_review "${fm.last_threat_review}" is not a valid ISO date (YYYY-MM-DD). A structurally ISO but non-calendar value (e.g. 2026-13-99 or a rollover like 2026-02-30) is rejected so a malformed date cannot slip past the staleness gate.`,
       );
     } else {
       // v0.13.0: Hard Rule #8 forcing function — refuse skills whose
@@ -1044,6 +1072,7 @@ module.exports = {
   MIN_SECTION_BODY_WORDS,
   validateFrontmatter,
   schemaConstraintErrors,
+  isStrictIsoCalendarDate,
   FRONTMATTER_SCHEMA,
 };
 

package/lib/playbook-runner.js

@@ -1579,9 +1579,34 @@ function capSummary(s, max = 240) {
 
 function validate(playbookId, directiveId, analyzeResult, agentSignals = {}, runOpts = {}) {
   const playbook = runOpts._playbookCache || loadPlaybook(playbookId);
-  // Surface evalCondition regex errors raised here into the same
-  // run-wide accumulator that analyze() reads.
-  const evalCtx = runOpts._runErrors ? { ...agentSignals, _runErrors: runOpts._runErrors } : agentSignals;
+  // Remediation-path preconditions are evaluated through the SAME evalCondition
+  // the analyze/close phases use, so the precondition context must expose the
+  // SAME engine-computed roots those phases thread in — otherwise a precondition
+  // that gates on `rwep`, `finding.severity`, `matched_cve.*`,
+  // `blast_radius_score`, or `theater_verdict` resolves null and can NEVER be
+  // satisfied, so its remediation path is only ever reachable as the priority
+  // fallback (kernel's `any matched_cve.vector matches 'userns|bpf|ptrace|kptr'`
+  // hardening-compensation path was permanently unsatisfiable for this reason).
+  // agentSignals spread FIRST so the engine-computed values WIN on collision (a
+  // poisoning signals.rwep can't override the engine value) — mirrors the
+  // escalation (analyze) and feeds_into (close) contexts. finding.* merges the
+  // host-AI-asserted descriptive keys UNDER the engine shape with the same
+  // !Array.isArray guard used there.
+  const govern = (playbook.phases && playbook.phases.govern) || {};
+  let findingShape = {};
+  try { findingShape = analyzeFindingShape(analyzeResult || {}); } catch { findingShape = {}; }
+  const evalCtx = {
+    ...agentSignals,
+    rwep: analyzeResult && analyzeResult.rwep ? analyzeResult.rwep.adjusted : undefined,
+    blast_radius_score: analyzeResult ? analyzeResult.blast_radius_score : undefined,
+    theater_verdict: analyzeResult && analyzeResult.compliance_theater_check ? analyzeResult.compliance_theater_check.verdict : undefined,
+    compliance_theater_check: analyzeResult ? analyzeResult.compliance_theater_check : undefined,
+    jurisdiction_obligations: govern.jurisdiction_obligations || [],
+    matched_cve: (analyzeResult && analyzeResult.matched_cves) || [],
+    analyze: analyzeResult,
+    finding: { ...(agentSignals.finding && typeof agentSignals.finding === 'object' && !Array.isArray(agentSignals.finding) ? agentSignals.finding : {}), ...findingShape },
+    ...(runOpts._runErrors ? { _runErrors: runOpts._runErrors } : {}),
+  };
   const v = resolvedPhase(playbook, directiveId, 'validate');
 
   // Pick the highest-priority remediation_path whose preconditions are all
@@ -4035,10 +4060,32 @@ function extractSubmissionForHash(sub) {
     // canonicalStringify can serialize them.
     const signals = {};
     for (const [k, v] of Object.entries(sub.signals)) {
+      // Underscore-prefixed signal keys are runner-internal / output-rendering
+      // directives, NOT operator evidence: `_bundle_formats` (the CLI sets it
+      // from `--format sarif|openvex|csaf`) only chooses which bundle close()
+      // renders — the analyzed posture is identical. Hashing it broke the
+      // "same evidence → same evidence_hash" contract: two runs over identical
+      // evidence that differ only in `--format` produced different digests and
+      // a self-contradicting attest diff. Exclude every `_`-prefixed signal key
+      // (matches the file-wide "underscore = internal" convention). vex_filter /
+      // vex_fixed are deliberately NOT excluded — they DROP CVEs from
+      // matched_cves and change the finding, so they are posture-affecting
+      // evidence; excluding them would make reattest blind to a VEX-driven
+      // posture change (a real drift hidden behind an unchanged hash).
+      if (k.startsWith('_')) continue;
       if (v instanceof Set) signals[k] = Array.from(v).sort();
       else signals[k] = v;
     }
-    pick.signals = signals;
+    // Omit an empty signals bag rather than recording `signals: {}`. A
+    // submission whose ONLY signal was a `_`-prefixed render directive
+    // (`{ _bundle_formats: [...] }`, injected by `ci`/`run --format`) reduces to
+    // {} after the filter above; the baseline no-format submission carries no
+    // `signals` key at all. Recording `{}` vs omitting it would hash identical
+    // evidence as `{signals:{}}` vs no-signals and reintroduce the exact
+    // --format-driven evidence_hash / session-id drift this exclusion exists to
+    // prevent. Only attach signals when at least one operator-meaningful key
+    // survived.
+    if (Object.keys(signals).length > 0) pick.signals = signals;
   }
   if (sub.precondition_checks && typeof sub.precondition_checks === 'object') {
     pick.precondition_checks = sub.precondition_checks;

package/lib/prefetch.js

@@ -738,8 +738,10 @@ async function prefetch(options = {}) {
             current.entries[entryKey(item.source, item.id)] = meta;
             return current;
           });
-          // Mirror the entry into the in-memory idx for callers that read
-          // it later in this run (e.g. the final saveIndex merge).
+          // Mirror the entry into the in-memory idx snapshot so any
+          // later in-run freshness check sees this entry as fresh. The
+          // authoritative on-disk write already happened under the lock
+          // above; this is the in-memory copy only.
           idx.entries[entryKey(item.source, item.id)] = meta;
         } catch (lockErr) {
           // Lock failure OR rename-inside-lock failure — unlink the staged
@@ -763,11 +765,17 @@ async function prefetch(options = {}) {
 
   await Promise.all(jobPromises);
   await queue.drain();
-  idx.generated_at = new Date().toISOString();
-  // v0.12.12 C2: saveIndex now merges under lock with whatever is on disk
-  // (another concurrent prefetch's entries). Without the merge, a sibling
-  // run's writes would be silently overwritten here at the end of our run.
-  await saveIndex(opts.cacheDir, idx);
+  // Each fetched entry was already persisted to the on-disk index under
+  // lock during the run (the per-entry withIndexLock above), so the final
+  // write only needs to stamp generated_at. Re-merging the whole
+  // start-of-run `idx` snapshot here would RESURRECT entries a concurrent
+  // run pruned between our snapshot and now — partially defeating the
+  // concurrency fix the per-entry lock provides. Bump generated_at on the
+  // CURRENT on-disk index under lock instead, touching nothing else.
+  await withIndexLock(opts.cacheDir, (current) => {
+    current.generated_at = new Date().toISOString();
+    return current;
+  });
 
   // Sign the freshly-written _index.json with the Ed25519 private key
   // (.keys/private.pem). The signature is a sidecar `_index.json.sig`;

package/lib/schemas/skill-frontmatter.schema.json

@@ -87,9 +87,9 @@
       "type": "array",
       "items": {
         "type": "string",
-        "pattern": "^D3-[A-Z]+$"
+        "pattern": "^D3[AF]?-[A-Z0-9]+(?:-[A-Z0-9]+)*$"
       },
-      "description": "Optional. MITRE D3FEND defensive technique IDs the skill maps to. Each must resolve in data/d3fend-catalog.json."
+      "description": "Optional. MITRE D3FEND defensive technique IDs the skill maps to, across the D3-, D3A- (analysis), and D3F- (offensive/forensic) namespaces. Each must resolve in data/d3fend-catalog.json."
     },
     "dlp_refs": {
       "type": "array",

package/lib/source-ghsa.js

@@ -246,8 +246,14 @@ async function fetchAdvisoryById(id, opts = {}) {
     if (!match) return { ok: false, error: `${id} not in fixture`, source: "fixture" };
     return { ok: true, advisories: [match], source: "fixture" };
   }
-  if (/^GHSA-/i.test(id)) {
-    return fetchAdvisories({ ...opts, path: `/advisories/${id.toLowerCase()}` });
+  // Validate the FULL GHSA token shape (GHSA-xxxx-xxxx-xxxx) before building the
+  // request path, and encodeURIComponent the segment — symmetric with the CVE
+  // branch below. A prefix-only `/^GHSA-/i` left the remainder unconstrained, so
+  // an operator-supplied id like `GHSA-aaaa/../../meta` survived verbatim into
+  // `/advisories/...` as path-control segments; the strict shape now routes a
+  // malformed id to the unrecognized-id error envelope instead.
+  if (/^GHSA-[0-9a-z]{4}-[0-9a-z]{4}-[0-9a-z]{4}$/i.test(id)) {
+    return fetchAdvisories({ ...opts, path: `/advisories/${encodeURIComponent(id.toLowerCase())}` });
   }
   if (/^CVE-\d{4}-\d+$/i.test(id)) {
     return fetchAdvisories({ ...opts, path: `/advisories?cve_id=${encodeURIComponent(id.toUpperCase())}` });

package/lib/source-osv.js

@@ -542,6 +542,16 @@ function extractCvss(rec) {
   // back from v4 -> v3 if v4 fails to compute.
   const vectorsByVersion = new Map(); // version (number) -> vector string
   let bareScore = null;
+  // Computed score for a single CVSS vector string: its trailing /N.N score if
+  // present, else the derived CVSS 3.x base score, else null (e.g. an
+  // uncomputable v4 vector). Used to keep the HIGHEST-scoring vector per major
+  // version regardless of severity[] array order.
+  const vectorScore = (vec) => {
+    const tail = vec.match(/\/(\d+(?:\.\d+)?)$/);
+    if (tail) { const t = parseFloat(tail[1]); if (t >= 0 && t <= 10) return t; }
+    if (/^CVSS:3\./.test(vec)) { const c = cvss3BaseScore(vec); if (c != null) return c; }
+    return null;
+  };
   for (const s of sev) {
     if (s == null) continue;
     let raw = null;
@@ -554,15 +564,21 @@ function extractCvss(rec) {
     // Bare numeric score (no vector prefix).
     const num = parseFloat(v);
     if (!Number.isNaN(num) && num >= 0 && num <= 10 && !v.includes("/")) {
-      if (bareScore == null) bareScore = num;
+      // HIGHEST-wins, not first-wins: an OSV record legitimately carries
+      // multiple same-version severity entries (e.g. an NVD base score plus a
+      // CNA/vendor score) and the upstream array order is not guaranteed. A
+      // first-wins guard silently downgraded a 9.8 critical to a 5.3 medium
+      // purely because the lower score appeared earlier in severity[].
+      if (bareScore == null || num > bareScore) bareScore = num;
       continue;
     }
     const m = v.match(/^CVSS:(\d+\.\d+)/);
     if (!m) continue;
     const ver = parseFloat(m[1]);
-    // Keep the highest score within each major version.
+    // Keep the HIGHEST-scoring vector within each major version (same rationale
+    // as the bare-score path above). Compare computed scores, not array order.
     const prev = vectorsByVersion.get(ver);
-    if (!prev) vectorsByVersion.set(ver, v);
+    if (!prev || (vectorScore(v) ?? -1) > (vectorScore(prev) ?? -1)) vectorsByVersion.set(ver, v);
   }
   // Try versions in descending order. CVSS 4.0 derivation is not yet
   // implemented here — if v4 was the highest but can't be computed, walk

package/lib/ttp-mapper.js

@@ -5,7 +5,16 @@
  * and surfaces gaps where controls fail to cover attacker techniques.
  */
 
+const hasOwn = (obj, key) => Object.prototype.hasOwnProperty.call(obj, key);
+
 function map(controlId, gapCatalog) {
+  // hasOwnProperty guard: a bare gapCatalog[controlId] dereferences inherited
+  // Object.prototype members, so controlId='__proto__' / 'toString' /
+  // 'constructor' returned found:true for a key that is not a real catalog
+  // entry. Only own enumerable keys are catalog controls.
+  if (!gapCatalog || !hasOwn(gapCatalog, controlId)) {
+    return { control_id: controlId, found: false, message: 'Control not in gap catalog' };
+  }
   const entry = gapCatalog[controlId];
   if (!entry) return { control_id: controlId, found: false, message: 'Control not in gap catalog' };
   return {
@@ -47,6 +56,12 @@ function coverage(frameworkId, ttpId, gapCatalog, atlasCatalog) {
     return { ttp_id: ttpId, found: false, error: 'frameworkId required', partially_covered_by: null, not_covered_by: null };
   }
 
+  // hasOwnProperty guard: ttpId='__proto__' / 'toString' / 'constructor'
+  // would otherwise resolve to an inherited Object.prototype member and be
+  // treated as a real ATLAS technique. Only own keys are catalog techniques.
+  if (!atlasCatalog || !hasOwn(atlasCatalog, ttpId)) {
+    return { ttp_id: ttpId, found: false };
+  }
   const ttp = atlasCatalog[ttpId];
   if (!ttp) return { ttp_id: ttpId, found: false };
 

package/lib/upstream-check.js

@@ -47,7 +47,15 @@ async function fetchLatestPublished({ timeoutMs = REQUEST_TIMEOUT_MS, pkgName =
       const fs = require("fs");
       const fixture = JSON.parse(fs.readFileSync(process.env.EXCEPTD_REGISTRY_FIXTURE, "utf8"));
       const version = fixture["dist-tags"]?.latest || fixture.version;
-      const published = fixture.time?.[version] || fixture.time?.modified;
+      // Same guard the network branch applies: a fixture with neither
+      // dist-tags.latest nor a top-level version yields no freshness signal.
+      // Returning ok:true with version:undefined would let an undefined
+      // version leak into buildFreshnessReport's semver compare and the
+      // operator-facing hint. Degrade to an explicit offline refusal.
+      if (!version) {
+        return { ok: false, error: "fixture missing dist-tags.latest / version", source: "offline" };
+      }
+      const published = fixture.time?.[version] || fixture.time?.modified || null;
       return { ok: true, version, published_at: published, source: "fixture" };
     } catch (e) {
       return { ok: false, error: `fixture: ${e.message}`, source: "offline" };
@@ -120,8 +128,14 @@ function buildFreshnessReport({ localVersion, registry, localManifest }) {
     };
   }
   const cmp = semverCmp(localVersion, registry.version);
-  const daysBehind = registry.published_at
-    ? Math.max(0, Math.floor((Date.now() - new Date(registry.published_at).getTime()) / (24 * 3600 * 1000)))
+  // Parse the publish timestamp once and validate it. A non-empty but
+  // unparseable date string (e.g. a malformed registry `time` value) makes
+  // `new Date(...).getTime()` return NaN, which would otherwise propagate
+  // NaN into days_since_latest_publish. Degrade an unparseable date to the
+  // explicit null (signal-absent) branch instead of emitting NaN.
+  const publishedTs = registry.published_at ? new Date(registry.published_at).getTime() : NaN;
+  const daysBehind = Number.isFinite(publishedTs)
+    ? Math.max(0, Math.floor((Date.now() - publishedTs) / (24 * 3600 * 1000)))
     : null;
   // Manifest's last_threat_review (per-skill) — surface the most stale.
   let oldestReview = null;

package/lib/validate-cve-catalog.js

@@ -384,8 +384,16 @@ function main() {
   const schema = readJson(SCHEMA_PATH);
   const catalog = readJson(CATALOG_PATH);
   const lessons = readJson(LESSONS_PATH);
-  const atlas = fs.existsSync(ATLAS_PATH) ? readJson(ATLAS_PATH) : {};
-  const cwe = fs.existsSync(CWE_PATH) ? readJson(CWE_PATH) : {};
+  // All five reference catalogs default to null when absent so the
+  // "cannot validate — catalog absent" branch in additionalChecks fires
+  // uniformly for every ref family. atlas/cwe previously defaulted to {},
+  // which built an EMPTY Set (never null) — so an absent atlas/cwe catalog
+  // silently FLAGGED every ref as unresolved (false positive) instead of
+  // surfacing the catalog-absent warning, the asymmetric opposite of how
+  // attack/d3fend/framework behaved. Uniform null makes the absence
+  // observable rather than misclassified.
+  const atlas = fs.existsSync(ATLAS_PATH) ? readJson(ATLAS_PATH) : null;
+  const cwe = fs.existsSync(CWE_PATH) ? readJson(CWE_PATH) : null;
   const attack = fs.existsSync(ATTACK_PATH) ? readJson(ATTACK_PATH) : null;
   const d3fend = fs.existsSync(D3FEND_PATH) ? readJson(D3FEND_PATH) : null;
   const frameworks = fs.existsSync(FRAMEWORK_GAPS_PATH)
@@ -393,8 +401,12 @@ function main() {
     : null;
 
   const ctx = {
-    atlasKeys: new Set(Object.keys(atlas).filter((k) => !k.startsWith('_'))),
-    cweKeys: new Set(Object.keys(cwe).filter((k) => !k.startsWith('_'))),
+    atlasKeys: atlas
+      ? new Set(Object.keys(atlas).filter((k) => !k.startsWith('_')))
+      : null,
+    cweKeys: cwe
+      ? new Set(Object.keys(cwe).filter((k) => !k.startsWith('_')))
+      : null,
     attackKeys: attack
       ? new Set(Object.keys(attack).filter((k) => !k.startsWith('_')))
       : null,

package/lib/validate-package.js

@@ -150,8 +150,15 @@ function main() {
     }
   }
 
-  // Size budget
-  if (typeof packInfo.size === "number" && packInfo.size > SIZE_BUDGET_BYTES) {
+  // Size budget. An absent/non-numeric `size` field is NOT a pass — it means
+  // the gate cannot evaluate the budget at all. Fail loudly instead of
+  // silently skipping (the absent-field-fails-open class, symmetric with the
+  // license_sha256 / vendored_sha256 guards in validate-vendor.js): a future
+  // npm-pack output shape change that drops or renames `size` must not turn the
+  // size budget into a no-op.
+  if (typeof packInfo.size !== "number") {
+    issues.push(`npm pack output missing numeric size — cannot enforce size budget`);
+  } else if (packInfo.size > SIZE_BUDGET_BYTES) {
     issues.push(`tarball size ${(packInfo.size / 1024 / 1024).toFixed(2)} MB exceeds budget ${(SIZE_BUDGET_BYTES / 1024 / 1024).toFixed(0)} MB`);
   }
 

package/lib/validate-playbooks.js

@@ -79,6 +79,21 @@ const fs = require('node:fs');
 const path = require('node:path');
 const process = require('node:process');
 const { safeExit } = require('./exit-codes');
+// _evalCondition is the SAME parser the runner uses at analyze/validate/close
+// time. Exercising every escalation / feeds_into / remediation-precondition
+// condition through the real evaluator lets the validator reject a condition the
+// engine cannot parse (condition_unparsed) — a prose / bare-token /
+// unimplemented-syntax condition that would silently return false for every
+// input and disable the escalation it gates. No cycle: playbook-runner does not
+// require this validator. Loaded defensively: the engine carries a dependency
+// closure (scoring / cross-ref-api / id-validation) that a stripped test mirror
+// staging only the validator + schema does not copy, so a hard top-level require
+// would crash the validator there. In the real repo and the shipped tarball the
+// engine is always present, so the parse-gate always runs; when it is genuinely
+// unresolvable the gate surfaces a WARNING (never a silent error-skip — see
+// checkCrossRefs) so the degradation is observable rather than a false pass.
+let _evalCondition = null;
+try { ({ _evalCondition } = require('./playbook-runner')); } catch { /* warned at the gate */ }
 
 const REPO_ROOT = path.resolve(__dirname, '..');
 const SCHEMA_PATH = path.join(REPO_ROOT, 'lib', 'schemas', 'playbook.schema.json');
@@ -129,6 +144,25 @@ function typeOf(value) {
   return typeof value;
 }
 
+// Strict ISO calendar-date check for format:date fields. The shape regex alone
+// accepts impossible dates — `new Date('2026-02-30T00:00:00Z')` does NOT throw,
+// it silently rolls over to March 2 and reports a valid getTime() — so a
+// malformed _meta.last_threat_review or changelog `date` (2026-02-30,
+// 2026-13-40) would pass with only the YYYY-MM-DD shape test. Require the
+// parsed Y-M-D to round-trip back to the input components, mirroring
+// parseIsoDateStrict in lib/validate-catalog-meta.js.
+function isStrictIsoDate(value) {
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}$/.test(value)) return false;
+  const d = new Date(value + 'T00:00:00Z');
+  if (Number.isNaN(d.getTime())) return false;
+  const [y, m, day] = value.split('-').map(Number);
+  return (
+    d.getUTCFullYear() === y &&
+    d.getUTCMonth() + 1 === m &&
+    d.getUTCDate() === day
+  );
+}
+
 function typeMatches(value, expected) {
   if (Array.isArray(expected)) return expected.some((t) => typeMatches(value, t));
   const actual = typeOf(value);
@@ -185,7 +219,7 @@ function validate(value, schema, schemaName, pathStr) {
       }
     }
     if (schema.format === 'date') {
-      if (!/^\d{4}-\d{2}-\d{2}$/.test(value)) {
+      if (!isStrictIsoDate(value)) {
         err(`${here}: value ${JSON.stringify(value)} is not an ISO date (YYYY-MM-DD)`);
       }
     }
@@ -531,6 +565,68 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
     }
   }
 
+  // Condition PARSEABILITY gate. The path-root check above only catches a
+  // dotted path rooted at an unavailable phase; the broader and far more common
+  // dead-condition shape is a condition the evaluator cannot parse AT ALL —
+  // free-text prose ("A single compromised identity can rewrite the trail"), a
+  // bare-truthiness token without `== true`, an unimplemented keyword
+  // (`<tok> fired`, `not in`, `is`), or an apostrophe-bearing token that fails
+  // the LHS pattern. Every such condition falls through evalCondition to a
+  // silent `false` for every input, so the raise_severity / trigger_playbook /
+  // remediation-precondition it gates never fires — and nothing flagged it,
+  // because the validator never ran the actual evaluator. Run each condition in
+  // the THREE locations the runner threads through evalCondition (analyze
+  // escalation_criteria, _meta.feeds_into, validate remediation_paths
+  // preconditions) and hard-fail on condition_unparsed. Scoped to exactly those
+  // three: scoring_rubric entries are descriptive blast-level prose (never
+  // evaluated — the score comes from agentSignals.blast_radius_score) and
+  // regression_trigger conditions are consumed by computeRegressionNextRun's own
+  // cadence/event parser, so neither is in scope here. Gate ONLY on
+  // condition_unparsed — a genuine PARSE failure is input-independent;
+  // condition_path_unresolved / condition_type_mismatch are runtime data
+  // diagnostics that would false-positive against this empty validation context
+  // (a dotted path legitimately resolves null when no run has populated it).
+  if (!_evalCondition) {
+    // Engine module not resolvable from this validator location (a stripped
+    // test mirror). Surface it as a WARNING so the skip is observable — in the
+    // real repo + shipped tarball the engine always loads and this never fires.
+    warn(
+      'escalation/feeds_into/precondition parse-gate skipped: lib/playbook-runner.js (the condition evaluator) was not resolvable from this validator location, so condition parseability was not checked',
+    );
+  }
+  const conditionParses = (cond) => {
+    if (typeof cond !== 'string' || !cond.trim()) return true;
+    if (!_evalCondition) return true; // engine unavailable — warned above, never a silent error-skip
+    const runErrors = [];
+    try { _evalCondition(cond, { _runErrors: runErrors }, { _runErrors: runErrors }); }
+    catch { return true; } // an evaluator throw is a separate concern, not "unparseable"
+    return !runErrors.some((e) => e && e.kind === 'condition_unparsed');
+  };
+  for (const [i, ec] of (((phases.analyze || {}).escalation_criteria) || []).entries()) {
+    if (ec && typeof ec === 'object' && !conditionParses(ec.condition)) {
+      err(
+        `phases.analyze.escalation_criteria[${i}].condition: not parseable by the runner's evalCondition (${JSON.stringify(String(ec.condition).slice(0, 80))}) — it returns false for every input, so action "${ec.action || '?'}" never fires. Rewrite into the mini-language (<indicator-id> == true [AND/OR …], engine roots rwep/blast_radius_score/matched_cve/finding.*, membership IN [...], quantifier any/all, matches '…').`,
+      );
+    }
+  }
+  for (const [i, f] of (meta.feeds_into || []).entries()) {
+    if (f && typeof f === 'object' && !conditionParses(f.condition)) {
+      err(
+        `_meta.feeds_into[${i}].condition: not parseable by the runner's evalCondition (${JSON.stringify(String(f.condition).slice(0, 80))}) — the chain to "${f.playbook_id || '?'}" never fires. Rewrite into the mini-language.`,
+      );
+    }
+  }
+  for (const [i, rp] of (validatePhase.remediation_paths || []).entries()) {
+    if (!rp || typeof rp !== 'object' || !Array.isArray(rp.preconditions)) continue;
+    for (const [j, pc] of rp.preconditions.entries()) {
+      if (!conditionParses(pc)) {
+        err(
+          `phases.validate.remediation_paths[${i}] (${rp.id || 'unknown'}).preconditions[${j}]: not parseable by the runner's evalCondition (${JSON.stringify(String(pc).slice(0, 80))}) — it is never satisfiable, so the path can only be selected as the priority fallback. Rewrite into the mini-language (bare token → "<token> == true", prose gate → an operator-signalable "<snake_token> == true").`,
+        );
+      }
+    }
+  }
+
   // Air-gap completeness. When _meta.air_gap_mode is true the runner refuses
   // to touch the network, so every artifact whose source is a network call
   // (https://, http://, gh api, gh release, curl, wget, fetch) MUST carry a
@@ -669,6 +765,21 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
   // the source is the base phase or a directive override.
   function checkRwepThreshold(rwepObj, pathPrefix) {
     const rwep = rwepObj || {};
+    // Range check is PER-KEY and independent of the others. A directive's
+    // phase_overrides.direct.rwep_threshold is a partial fragment the runner
+    // deep-merges, so it may carry only one of the three keys — gating the
+    // whole check on all-three-present let an out-of-range single-key override
+    // (e.g. {escalate: 150} or {close: -5}) ship unchecked and reach the
+    // runner. Validate each present numeric key on its own.
+    for (const k of ['close', 'monitor', 'escalate']) {
+      const v = rwep[k];
+      if (typeof v === 'number' && (v < 0 || v > 100)) {
+        err(`${pathPrefix}.${k}: ${v} outside 0..100`);
+      }
+    }
+    // Ordering is only meaningful when the full triple is present (a partial
+    // override inherits the missing edges from the base phase, so close <=
+    // monitor <= escalate can't be evaluated on the fragment alone).
     if (
       typeof rwep.close === 'number' &&
       typeof rwep.monitor === 'number' &&
@@ -679,15 +790,6 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
           `${pathPrefix}: ordering violation — expected close <= monitor <= escalate, got close=${rwep.close} monitor=${rwep.monitor} escalate=${rwep.escalate}`,
         );
       }
-      for (const [k, v] of [
-        ['close', rwep.close],
-        ['monitor', rwep.monitor],
-        ['escalate', rwep.escalate],
-      ]) {
-        if (v < 0 || v > 100) {
-          err(`${pathPrefix}.${k}: ${v} outside 0..100`);
-        }
-      }
     }
   }
 

package/lib/validate-vendor.js

@@ -111,17 +111,23 @@ function main() {
   }
 
   // On-disk inventory cross-check (BJS-04): the loop above is one-directional
-  // (manifest → disk). A .js file PRESENT in vendor/blamejs/ but ABSENT from
-  // _PROVENANCE.json would ship in the tarball and be require()'d by lib code
-  // while NOTHING verifies its integrity — an unregistered or smuggled-in
-  // vendored module. Flag every on-disk .js that the manifest does not record.
+  // (manifest → disk). A loadable JS module PRESENT in vendor/blamejs/ but
+  // ABSENT from _PROVENANCE.json would ship in the tarball and be require()'d
+  // by lib code while NOTHING verifies its integrity — an unregistered or
+  // smuggled-in vendored module. Node executes `.js`, `.cjs`, and `.mjs` as
+  // code, so a `.cjs`/`.mjs` smuggled module carries the same arbitrary-code
+  // risk as a `.js` one — checking only `.js` let a renamed extension slip the
+  // gate. `.json`/`.node` are deliberately NOT swept here: `_PROVENANCE.json`
+  // itself lives in this directory and is the manifest, not a registered
+  // vendored module, so sweeping `.json` would false-positive on the manifest.
+  const LOADABLE_MODULE = /\.(c|m)?js$/;
   const registered = new Set(
     Object.values(prov.files || {}).map((info) => path.basename(info.vendored_path))
   );
   const vendorDir = path.join(ROOT, "vendor", "blamejs");
   try {
     for (const f of fs.readdirSync(vendorDir)) {
-      if (!f.endsWith(".js")) continue;
+      if (!LOADABLE_MODULE.test(f)) continue;
       if (!registered.has(f)) {
         issues.push(`unregistered vendored file: vendor/blamejs/${f} is on disk but absent from _PROVENANCE.json — its integrity is not verified`);
       }