@blamejs/exceptd-skills 0.18.14 → 0.18.16

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.18.16 — 2026-06-22
+
+A correctness pass on the evidence-output and attestation surfaces.
+
+SARIF finding results always carry a location now. A result with no `locations` is silently dropped by GitHub Code Scanning; previously only playbooks whose look-artifact sources happened to be bare file paths got one, so most playbooks' (prose/glob/command sources) findings were emitted location-less and disappeared from the alerts list. Each finding without a concrete file now carries a rule-scoped logical location, keeping it visible and attributable; a physical file location is still used whenever the agent supplied one.
+
+`attest diff` no longer reports identical evidence as changed. The artifact diff was keyed by the operator-chosen observation key rather than the indicator the observation targeted, so two attestations with the same finding under different observation keys (a different collector run, the array vs object evidence shape, reordered observations) showed every artifact as added-and-removed with zero unchanged. The diff is now keyed by the stable indicator id, so identical evidence compares as unchanged.
+
+Risk-acceptance exception language now reports its unresolved placeholders. The auditor-ready exception text is filled from operator-supplied values that a standard run does not pre-stage, so it could ship literal `<MISSING:…>` tokens; the exception now carries a `missing_interpolation_vars` list (and surfaces a runtime error) naming exactly which values still need filling, matching the notification-draft behavior.
+
+CSAF advisories bind their per-version affected products. The product tree's per-version product entries were defined but never referenced from any vulnerability, so a dashboard correlating affected products to the tree saw only the generic synthetic product; each CVE's version entries are now bound into its `product_status`.
+
+## 0.18.15 — 2026-06-22
+
+Indicator-gated escalations and playbook chains now fire when their indicators are detected. An escalation or `feeds_into` written as `<indicator-id> == true` (the catalog's standard form) resolved only when that id was also passed as a raw signal; the normal scan path delivers detections separately, so on a real `exceptd collect <playbook>` these escalations and downstream chains stayed silent even when the indicator was found. Fired indicators are now bound into the escalation, chain, and remediation-precondition contexts, so a detection drives the condition that gates on it. An operator can still override a specific indicator, and engine-computed values still take precedence.
+
+Six more compound escalations now fire. Each combined a working clause (`rwep >= 90`, `blast_radius_score >= 4`, a theater verdict) with a second clause written in prose or shorthand the engine cannot evaluate; because the working clause came first and evaluation stopped at the first clause that resolved, the dead second clause went unnoticed. The compound conditions are now fully expressed in the condition language and gate on the playbook's real indicators.
+
+The validator's condition gate now checks every sub-clause of an AND/OR condition independently, so a dead clause hidden behind a clause that happens to resolve first can no longer ship.
+
 ## 0.18.14 — 2026-06-22
 
 Severity escalations, downstream-playbook chaining, and remediation-path preconditions now fire as authored across the playbook catalog. A number of these conditions had been written as free-text English or in a shorthand the engine does not evaluate, so they returned false for every input and silently never triggered — a raise-severity rule, a `feeds_into` chain into a deeper playbook, or a remediation precondition that looked active but never fired. Every such condition is now expressed in the engine's condition language and verified to evaluate against the indicators it gates on.

package/bin/exceptd.js

@@ -6554,6 +6554,39 @@ function submissionHasData(submission) {
     || nonEmpty(submission.signal_overrides)
     || nonEmpty(submission.observations);
 }
+// attest diff compares artifacts by map key. normalizeSubmission keys
+// flat-shape artifacts by the operator-chosen OBSERVATION key (obs-kver, x1, an
+// array index, …), NOT by the stable indicator id the observation targeted — so
+// two attestations with identical (indicator, value) evidence under different
+// observation keys diffed as all-added/all-removed (unchanged_count 0), while the
+// correctly-keyed signal_override_diff on the same comparison showed the true
+// unchanged result. Re-key the artifact map by the stable indicator id (recovered
+// from normalizeSubmission's _signal_origins, which maps indicator -> obs-key)
+// before diffing, falling back to the original key when an observation carries no
+// indicator binding. Diff-only — does NOT touch normalizeSubmission's map or the
+// evidence_hash.
+function rekeyArtifactsByStableId(artifacts, signalOrigins) {
+  if (!artifacts || !signalOrigins || typeof signalOrigins !== "object") return artifacts || {};
+  const obsKeyToIndicator = {};
+  for (const [indicatorId, obsKey] of Object.entries(signalOrigins)) {
+    if (typeof obsKey === "string") obsKeyToIndicator[obsKey] = indicatorId;
+  }
+  const originalKeys = new Set(Object.keys(artifacts));
+  const out = {};
+  for (const [k, v] of Object.entries(artifacts)) {
+    const mapped = obsKeyToIndicator[k];
+    // Re-key to the stable indicator id ONLY when it won't drop an artifact: the
+    // indicator id must not already be a DISTINCT original artifact key, and must
+    // not have been claimed by an earlier re-keyed entry. On any such collision,
+    // keep the original key so no artifact is silently overwritten / lost from
+    // the diff (two observations sharing one indicator, or an artifact key that
+    // already equals an indicator id).
+    const stable = (mapped && mapped !== k && !originalKeys.has(mapped)
+      && !Object.prototype.hasOwnProperty.call(out, mapped)) ? mapped : k;
+    out[stable] = v;
+  }
+  return out;
+}
 function normalizedArtifacts(submission, runner, playbookId, applyEmptyFallback = true) {
   if (!submission || typeof submission !== "object") {
     return applyEmptyFallback ? (_playbookArtifactCatalog(runner, playbookId) || {}) : {};
@@ -6568,7 +6601,9 @@ function normalizedArtifacts(submission, runner, playbookId, applyEmptyFallback
         const pb = runner.loadPlaybook ? runner.loadPlaybook(playbookId) : null;
         if (pb) {
           const norm = runner.normalizeSubmission({ observations: submission.observations }, pb);
-          if (norm && norm.artifacts && Object.keys(norm.artifacts).length > 0) return norm.artifacts;
+          if (norm && norm.artifacts && Object.keys(norm.artifacts).length > 0) {
+            return rekeyArtifactsByStableId(norm.artifacts, norm._signal_origins);
+          }
         }
       } catch { /* fall through */ }
     }

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-22T14:16:42.035Z",
+  "generated_at": "2026-06-22T17:11:04.498Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "be5406117ede866ec4dc653cf15f9555f8fa58c254fc601800e4bacb07ddb609",
+    "manifest.json": "c8376cbda42a9657b6a5d50f75d8c08a0bcab7c8456340042be7998133922ecb",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",

package/data/playbooks/citation-hygiene.json

@@ -533,11 +533,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "blast_radius_score >= 3 AND any deterministic indicator fires",
+          "condition": "blast_radius_score >= 3 AND fabricated-cve-id == true",
           "action": "raise_severity"
         },
         {
-          "condition": "compliance_theater_check.verdict == 'theater' AND citation appears in published disclosure surface",
+          "condition": "compliance_theater_check.verdict == 'theater' AND (fabricated-cve-id == true OR rejected-or-disputed-cve == true)",
           "action": "trigger_playbook",
           "target_playbook": "framework"
         },

package/data/playbooks/crypto-codebase.json

@@ -930,11 +930,11 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "blast_radius_score >= 4 AND any deterministic indicator fires",
+          "condition": "blast_radius_score >= 4 AND (weak-hash-import == true OR weak-cipher-mode == true OR rsa-1024-anywhere == true OR math-random-in-security-path == true OR pbkdf2-under-iterated == true OR bcrypt-cost-low == true OR no-ml-kem-implementation == true OR fips-claim-without-runtime-activation == true OR hardcoded-key-material == true OR tls-old-protocol == true)",
           "action": "raise_severity"
         },
         {
-          "condition": "rwep >= 75 AND library is published_to_registry == true",
+          "condition": "rwep >= 75 AND blast_radius_score >= 4",
           "action": "page_on_call"
         },
         {

package/data/playbooks/idp-incident.json

@@ -877,7 +877,7 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "rwep >= 90 AND any deterministic indicator fires",
+          "condition": "rwep >= 90 AND anomalous-federated-trust-addition == true",
           "action": "page_on_call"
         },
         {

package/data/playbooks/mcp.json

@@ -847,7 +847,7 @@
           "action": "page_on_call"
         },
         {
-          "condition": "mcp-typosquat-candidate == true AND no benign_match",
+          "condition": "mcp-typosquat-candidate == true",
           "action": "raise_severity"
         },
         {

package/lib/playbook-runner.js

@@ -953,6 +953,31 @@ function detect(playbookId, directiveId, agentSubmission = {}, runOpts = {}) {
 
 // --- phase 5: analyze ---
 
+/**
+ * Mirror the FIRED detect indicators (verdict === 'hit') into a flat
+ * `{ <indicator-id>: true }` map for the escalation / feeds_into / precondition
+ * eval contexts. Indicator hits arrive from the collector / AI evidence path as
+ * `signal_overrides` (which detect() reads); the condition contexts spread
+ * `agentSubmission.signals`, NOT signal_overrides — so an escalation written as
+ * `<indicator-id> == true` (the catalog's canonical form) stayed false even when
+ * that indicator DETECTED, unless the operator redundantly re-submitted the id
+ * under `signals`. The standard `exceptd collect <playbook>` path never does
+ * that, so the entire indicator-gated escalation/chain layer was dead on the
+ * real evidence path. Mirroring fired indicators here binds the condition layer
+ * to the detect layer. Only verdict 'hit' (FP-checks satisfied) is mirrored — an
+ * 'inconclusive' indicator is unconfirmed and must not fire an escalation. The
+ * map is spread with the LOWEST precedence (before agentSignals, which is before
+ * the engine roots) so an operator can still override a specific id and the
+ * engine-computed values always win.
+ */
+function firedIndicatorSignals(detectIndicators) {
+  const out = {};
+  for (const ind of (detectIndicators || [])) {
+    if (ind && ind.verdict === 'hit' && typeof ind.id === 'string') out[ind.id] = true;
+  }
+  return out;
+}
+
 /**
  * RWEP composition + blast-radius scoring + theater check + framework gap
  * mapping + escalation evaluation. Inputs are the detect result + any
@@ -1490,7 +1515,7 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     findingShape = {};
   }
   for (const ec of an.escalation_criteria || []) {
-    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [],
+    if (evalCondition(ec.condition, { ...firedIndicatorSignals(detectResult.indicators), ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [],
         // finding.* is two-sourced: the engine computes the CVE/severity-derived
         // keys (severity, rwep_adjusted, matched_cve_*, blast_radius_score,
         // active_exploitation, framework/control_id_first) via analyzeFindingShape,
@@ -1596,6 +1621,10 @@ function validate(playbookId, directiveId, analyzeResult, agentSignals = {}, run
   let findingShape = {};
   try { findingShape = analyzeFindingShape(analyzeResult || {}); } catch { findingShape = {}; }
   const evalCtx = {
+    // Fired detect indicators mirrored in (lowest precedence) so a precondition
+    // referencing an indicator id resolves on the collector path. See
+    // firedIndicatorSignals.
+    ...firedIndicatorSignals(analyzeResult && analyzeResult._detect_indicators),
     ...agentSignals,
     rwep: analyzeResult && analyzeResult.rwep ? analyzeResult.rwep.adjusted : undefined,
     blast_radius_score: analyzeResult ? analyzeResult.blast_radius_score : undefined,
@@ -1965,14 +1994,26 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     const triggered = evalCondition(c.exception_generation.trigger_condition, closeEvalCtx, playbook);
     if (triggered) {
       const t = c.exception_generation.exception_template;
+      // Track unresolved ${placeholder} tokens the SAME way the draft_notification
+      // render does (missing_interpolation_vars). Exception-template tokens are
+      // operator-fill values (affected_host_count, compensating_controls,
+      // patch_available_status, …) that analyzeFindingShape does NOT supply and
+      // that operators rarely pre-stage on the standard `exceptd run` path, so the
+      // auditor-ready risk-acceptance language otherwise ships literal
+      // `<MISSING:…>` tokens with no machine-readable signal of which placeholders
+      // failed. Surface them as exception.missing_interpolation_vars (empty when
+      // all resolved) so a `ci`/JSON consumer — and the operator filling the
+      // exception — sees exactly what still needs a value.
+      const exMissing = [];
+      const findingShape = (() => { try { return analyzeFindingShape(analyzeResult); } catch { return {}; } })();
       exception = {
-        scope: interpolate(t.scope, { ...agentSignals, ...analyzeFindingShape(analyzeResult) }),
+        scope: interpolate(t.scope, { ...agentSignals, ...findingShape }, exMissing),
         duration: t.duration,
         compensating_controls: t.compensating_controls,
         risk_acceptance_owner: t.risk_acceptance_owner,
         auditor_ready_language: interpolate(t.auditor_ready_language, {
           ...agentSignals,
-          ...analyzeFindingShape(analyzeResult),
+          ...findingShape,
           framework_id: playbook.domain.frameworks_in_scope[0] || 'unspecified',
           control_id: analyzeResult.framework_gap_mapping?.[0]?.claimed_control || 'unspecified',
           ciso_name: agentSignals.ciso_name || '<CISO NAME>',
@@ -1981,8 +2022,16 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
           // same auditor-facing date.
           acceptance_date: (deterministic ? frozenEpoch : new Date().toISOString()).slice(0, 10),
           duration_expiry: agentSignals.duration_expiry || 'until vendor patch'
-        })
+        }, exMissing),
+        missing_interpolation_vars: exMissing,
       };
+      // Make the unresolved-placeholder gap observable to JSON/ci consumers, not
+      // just present on the exception object.
+      if (exMissing.length && Array.isArray(runOpts._runErrors)) {
+        pushRunError(runOpts._runErrors,
+          { kind: 'exception_unresolved_placeholders', placeholders: exMissing.slice() },
+          { dedupeKey: e => (e.placeholders || []).join(',') });
+      }
     }
   }
 
@@ -2083,6 +2132,11 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
   // feeds_into chaining — full analyze result is exposed so conditions can
   // reference `analyze.compliance_theater_check.verdict` etc.
   const feedsCtx = {
+    // Fired detect indicators (verdict 'hit') mirrored in so a feeds_into
+    // condition written as `<indicator-id> == true` resolves on the standard
+    // collector path (signal_overrides), not only when the id is re-submitted
+    // under signals. Lowest precedence — operator signals and engine values win.
+    ...firedIndicatorSignals(analyzeResult && analyzeResult._detect_indicators),
     // Operator-submitted signals come FIRST so the engine-computed reserved
     // keys below always win — otherwise a submitted signals.rwep / finding /
     // analyze would override the engine value the feeds_into condition tests
@@ -2296,12 +2350,23 @@ function vulnIdToUrn(id) {
 function buildCsafBranches(matchedCves, runOpts) {
   // Build a (vendor → product → Set<version>) map.
   const tree = new Map();
-  const addLeaf = (vendor, product, version) => {
+  // Track which CVE contributed each leaf so the emitted CSAFPID-N product_ids
+  // can be bound back into that CVE's vulnerabilities[].product_status — without
+  // this the branch tree's per-version products are referenced by nothing and a
+  // CSAF consumer correlating product_status to the tree resolves only the
+  // generic synthetic product. leafKey = vendor\0product\0version.
+  const leafKey = (vendor, product, version) => JSON.stringify([vendor, product, version]);
+  const cveLeaves = new Map(); // cve_id → Set<leafKey>
+  const addLeaf = (vendor, product, version, cveId) => {
     if (!vendor || !product || !version) return;
     if (!tree.has(vendor)) tree.set(vendor, new Map());
     const products = tree.get(vendor);
     if (!products.has(product)) products.set(product, new Set());
     products.get(product).add(version);
+    if (cveId) {
+      if (!cveLeaves.has(cveId)) cveLeaves.set(cveId, new Set());
+      cveLeaves.get(cveId).add(leafKey(vendor, product, version));
+    }
   };
 
   // Comparison / range operators that appear between a package name and a
@@ -2352,7 +2417,7 @@ function buildCsafBranches(matchedCves, runOpts) {
     if (Array.isArray(c.affected_products) && c.affected_products.length > 0) {
       for (const ap of c.affected_products) {
         if (ap && typeof ap === 'object' && ap.vendor && ap.product && ap.version) {
-          addLeaf(String(ap.vendor), String(ap.product), String(ap.version));
+          addLeaf(String(ap.vendor), String(ap.product), String(ap.version), c.cve_id);
         }
       }
       continue;
@@ -2362,7 +2427,7 @@ function buildCsafBranches(matchedCves, runOpts) {
     for (const comp of components) {
       const parsed = parseComponentString(comp);
       if (parsed) {
-        addLeaf(parsed.vendor, parsed.product, parsed.version);
+        addLeaf(parsed.vendor, parsed.product, parsed.version, c.cve_id);
       } else if (typeof comp === 'string' && comp.trim() && runOpts && Array.isArray(runOpts._runErrors)) {
         pushRunError(runOpts._runErrors, {
           kind: 'csaf_branch_unparseable',
@@ -2375,6 +2440,7 @@ function buildCsafBranches(matchedCves, runOpts) {
 
   // Sort + emit.
   const productIds = [];
+  const leafKeyToPid = new Map();
   let pidCounter = 0;
   const vendors = Array.from(tree.keys()).sort();
   const branches = vendors.map(vendor => {
@@ -2391,6 +2457,7 @@ function buildCsafBranches(matchedCves, runOpts) {
           branches: versions.map(version => {
             const pid = `CSAFPID-${pidCounter++}`;
             productIds.push({ vendor, product, version, product_id: pid });
+            leafKeyToPid.set(leafKey(vendor, product, version), pid);
             return {
               category: 'product_version',
               name: version,
@@ -2404,7 +2471,15 @@ function buildCsafBranches(matchedCves, runOpts) {
       }),
     };
   });
-  return { branches, productIds };
+  // Per-CVE CSAFPID binding so the caller can add the version leaves to each
+  // vulnerability's product_status.known_affected.
+  const cveProductIds = {};
+  for (const [cveId, keys] of cveLeaves.entries()) {
+    const pids = [];
+    for (const k of keys) { const pid = leafKeyToPid.get(k); if (pid) pids.push(pid); }
+    if (pids.length) cveProductIds[cveId] = pids.sort();
+  }
+  return { branches, productIds, cveProductIds };
 }
 
 // Slugify a string into a URN-safe segment (RFC 8141 NSS). Empty input →
@@ -2511,6 +2586,24 @@ function sarifLocationsForIndicator(playbook, indicator) {
   return [{ physicalLocation: { artifactLocation: { uri: candidates[0] } } }];
 }
 
+// Locations for a finding-class SARIF result, with a guaranteed non-empty
+// fallback. sarifLocationsForIndicator returns a PHYSICAL location only when the
+// agent supplied evidence_locations or the playbook's look-artifact source is a
+// bare path token; the dominant catalog shape is a prose / glob / shell-command
+// source (which carries whitespace and is rejected by looksLikePath), so the
+// physical fallback is null for ~most playbooks. A SARIF result with no
+// `locations[]` is silently DROPPED by GitHub Code Scanning — so a result with
+// no concrete file still gets a `logicalLocations` entry naming its rule, which
+// is SARIF-conformant (§3.33), keeps the finding attributable + visible in the
+// alerts list and in SARIF viewers, and is honest (there is no physical file to
+// point at when the agent supplied no evidence location). Physical location is
+// always preferred when available.
+function sarifResultLocations(playbook, indicator, fqRuleId) {
+  const phys = sarifLocationsForIndicator(playbook, indicator);
+  if (phys && phys.length) return phys;
+  return [{ logicalLocations: [{ name: fqRuleId, fullyQualifiedName: fqRuleId, kind: 'rule' }] }];
+}
+
 // Resolve the package version once per process so CSAF tracking.generator
 // can name the engine that emitted the advisory. Best-effort read — bundle
 // emission must not crash if package.json is missing (e.g. exotic install).
@@ -2749,6 +2842,11 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
     };
     const CSAF_CVE_RE = /^CVE-\d{4}-\d{4,}$/;
 
+    // Build the product-tree branches up front so each CVE's per-version CSAFPID
+    // leaves can be bound into its product_status.known_affected (and the same
+    // tree reused for product_tree below — buildCsafBranches is not re-run).
+    const csafProductTree = buildCsafBranches(analyze.matched_cves || [], runOpts);
+
     const cveVulns = analyze.matched_cves.map(c => {
       const isFixed = c.vex_status === 'fixed';
       const remediations = [{
@@ -2833,7 +2931,17 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
         scores,
         threats: c.active_exploitation === 'confirmed' ? [{ category: 'exploit_status', details: `Active exploitation confirmed${c.cisa_kev ? ' (CISA KEV)' : ''}.` }] : [],
         remediations,
-        product_status: isFixed ? { fixed: [productId] } : { known_affected: [productId] }
+        // Bind this CVE's per-version CSAFPID leaves (from the product tree) into
+        // known_affected, so a CSAF consumer correlating product_status back to
+        // the branches tree resolves the real affected versions, not only the
+        // opaque synthetic product. The leaves are parsed from affected_products
+        // / affected_versions — VULNERABLE version ranges — so they belong ONLY
+        // under known_affected. The VEX-fixed disposition keeps just the synthetic
+        // target product under `fixed`; adding affected ranges there would
+        // mislabel vulnerable versions as fixed releases.
+        product_status: isFixed
+          ? { fixed: [productId] }
+          : { known_affected: [productId, ...(csafProductTree.cveProductIds[c.cve_id] || [])] }
       };
       // route by id shape.
       if (idIsCve) {
@@ -3020,7 +3128,7 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
           // from catalog data. CSAF §3.1.5.1 makes branches[] strongly
           // recommended because NVD / ENISA / Red Hat dashboards render the
           // affected-product list off the branches tree, not full_product_names[].
-          const { branches } = buildCsafBranches(analyze.matched_cves || [], runOpts);
+          const branches = csafProductTree.branches;
           const tree = { full_product_names: fullProductNames };
           if (branches.length > 0) tree.branches = branches;
           return tree;
@@ -3075,7 +3183,6 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
     // (passing a null indicator skips the per-indicator evidence-locations
     // branch). Without any `locations`, GitHub Code Scanning silently DROPS
     // these results — the highest-severity result class would never surface.
-    const cveFallbackLocs = sarifLocationsForIndicator(playbook, null);
     const cveResults = analyze.matched_cves.map(c => {
       const result = {
         ruleId: `${rulePrefix}${c.cve_id}`,
@@ -3091,12 +3198,15 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
           blast_radius_score: analyze.blast_radius_score,
         }),
       };
-      if (cveFallbackLocs) result.locations = cveFallbackLocs;
+      // Always carry a location (physical when known, else a rule-scoped
+      // logicalLocations fallback) so GitHub Code Scanning does not drop the
+      // highest-severity result class.
+      result.locations = sarifResultLocations(playbook, null, result.ruleId);
       return result;
     });
     const indicatorHits = (analyze._detect_indicators || []).filter(i => i.verdict === 'hit');
     const indicatorResults = indicatorHits.map(i => {
-      const locs = sarifLocationsForIndicator(playbook, i);
+      const locs = sarifResultLocations(playbook, i, `${rulePrefix}${i.id}`);
       const result = {
         ruleId: `${rulePrefix}${i.id}`,
         level: i.deterministic ? 'error' : (i.confidence === 'high' ? 'warning' : 'note'),
@@ -3109,7 +3219,7 @@ function buildEvidenceBundle(format, playbook, analyze, validate, agentSignals,
           attack_ref: i.attack_ref,
         }),
       };
-      if (locs) result.locations = locs;
+      result.locations = locs; // always present (physical or logical fallback)
       return result;
     });
     const gapResults = (analyze.framework_gap_mapping || []).map((g, idx) => ({

package/lib/validate-playbooks.js

@@ -95,6 +95,55 @@ const { safeExit } = require('./exit-codes');
 let _evalCondition = null;
 try { ({ _evalCondition } = require('./playbook-runner')); } catch { /* warned at the gate */ }
 
+// Decompose a condition into its leaf atoms the SAME way evalCondition does —
+// strip wrapping parens, split on top-level OR (lowest precedence), then on
+// top-level AND, quote- and depth-aware. This exists because evalCondition
+// evaluates AND via `.every` / OR via `.some`, which SHORT-CIRCUIT: a dead
+// (unparseable) sub-clause behind a leading clause that resolves false (AND) or
+// true (OR) in the empty validation context is never reached, so running the
+// whole condition once never surfaces its condition_unparsed. Atomizing and
+// parse-checking each leaf independently catches a dead sub-clause regardless of
+// short-circuit (e.g. `blast_radius_score >= 3 AND any deterministic indicator
+// fires` — the first clause is false with no signals, so the dead prose second
+// clause never parsed). Mirrors evalCondition's splitAtTopLevel / stripOuterParens.
+function _splitTopLevel(expr, sep) {
+  const parts = []; const needle = ' ' + sep + ' ';
+  let depth = 0, buf = '', i = 0, quote = null;
+  while (i < expr.length) {
+    const ch = expr[i];
+    if (quote) { if (ch === '\\' && i + 1 < expr.length) { buf += ch + expr[i + 1]; i += 2; continue; } if (ch === quote) quote = null; buf += ch; i++; continue; }
+    if (ch === "'" || ch === '"') { quote = ch; buf += ch; i++; continue; }
+    if (ch === '(') { depth++; buf += ch; i++; continue; }
+    if (ch === ')') { depth--; buf += ch; i++; continue; }
+    if (depth === 0 && expr.startsWith(needle, i)) { parts.push(buf.trim()); buf = ''; i += needle.length; continue; }
+    buf += ch; i++;
+  }
+  parts.push(buf.trim());
+  return parts;
+}
+function _stripWrappingParens(e) {
+  e = e.trim();
+  while (e.startsWith('(') && e.endsWith(')')) {
+    let d = 0, wraps = true;
+    for (let i = 0; i < e.length; i++) {
+      if (e[i] === '(') d++;
+      else if (e[i] === ')') { d--; if (d === 0 && i < e.length - 1) { wraps = false; break; } }
+    }
+    if (wraps) e = e.slice(1, -1).trim(); else break;
+  }
+  return e;
+}
+function atomizeCondition(cond) {
+  const atoms = [];
+  (function rec(e) {
+    e = _stripWrappingParens(e);
+    const ors = _splitTopLevel(e, 'OR'); if (ors.length > 1) { ors.forEach(rec); return; }
+    const ands = _splitTopLevel(e, 'AND'); if (ands.length > 1) { ands.forEach(rec); return; }
+    atoms.push(e);
+  })(cond);
+  return atoms;
+}
+
 const REPO_ROOT = path.resolve(__dirname, '..');
 const SCHEMA_PATH = path.join(REPO_ROOT, 'lib', 'schemas', 'playbook.schema.json');
 const PLAYBOOKS_DIR = path.join(REPO_ROOT, 'data', 'playbooks');
@@ -597,10 +646,16 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
   const conditionParses = (cond) => {
     if (typeof cond !== 'string' || !cond.trim()) return true;
     if (!_evalCondition) return true; // engine unavailable — warned above, never a silent error-skip
-    const runErrors = [];
-    try { _evalCondition(cond, { _runErrors: runErrors }, { _runErrors: runErrors }); }
-    catch { return true; } // an evaluator throw is a separate concern, not "unparseable"
-    return !runErrors.some((e) => e && e.kind === 'condition_unparsed');
+    // Check EACH atomic leaf, not the whole condition once: evalCondition's
+    // AND/OR short-circuit hides a dead sub-clause behind a leading clause that
+    // resolves false (AND) / true (OR) in the empty validation context.
+    for (const atom of atomizeCondition(cond)) {
+      const runErrors = [];
+      try { _evalCondition(atom, { _runErrors: runErrors }, { _runErrors: runErrors }); }
+      catch { continue; } // an evaluator throw is a separate concern, not "unparseable"
+      if (runErrors.some((e) => e && e.kind === 'condition_unparsed')) return false;
+    }
+    return true;
   };
   for (const [i, ec] of (((phases.analyze || {}).escalation_criteria) || []).entries()) {
     if (ec && typeof ec === 'object' && !conditionParses(ec.condition)) {

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.18.14",
+  "version": "0.18.16",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -57,7 +57,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-06-22T14:16:29.795Z",
+      "signed_at": "2026-06-22T17:11:02.747Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -133,7 +133,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "WfqxU2x/feWgatYrCeO9PD3dIY0FAfs4nkVdQRac4fg5BDQPG/vhzhvYVN6Mg11oITACghbPOtZXvS37sACsCA==",
-      "signed_at": "2026-06-22T14:16:29.797Z",
+      "signed_at": "2026-06-22T17:11:02.749Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -215,7 +215,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "9bNOW4MzmUlFgkXH5tIZkq8YpzhMM+r8YVcNEM39kdEZwfRNG4Bj+Dgr7v4Qgp9D4q7hGNFpK0ywX+dPd3VWAg==",
-      "signed_at": "2026-06-22T14:16:29.798Z",
+      "signed_at": "2026-06-22T17:11:02.751Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -269,7 +269,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "5A08+nAu5jwNQ1+vGbFgFAJA/kYD3oiaevhCxT4/2FeW++F070Pm4MD1+oXdv8R2DbtYr+7yXnCGM7UbUPR2AA==",
-      "signed_at": "2026-06-22T14:16:29.798Z"
+      "signed_at": "2026-06-22T17:11:02.752Z"
     },
     {
       "name": "compliance-theater",
@@ -301,7 +301,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "RCgbI0sMNTKAscXUtrVU25u7OuE64uQvO5JKsB8vIJFWguvT6nZyD7euKuIxIzYhLTyHBiD7Rhp70btlK+JkCg==",
-      "signed_at": "2026-06-22T14:16:29.799Z"
+      "signed_at": "2026-06-22T17:11:02.753Z"
     },
     {
       "name": "exploit-scoring",
@@ -332,7 +332,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "JJrs+B22/hYxvdYs+abmoire5PbQXPb2uVYyjInZ3UbT8gEjs/5SyfGKx7z86jbtvB3ItApQVAx1AuseIgdyAQ==",
-      "signed_at": "2026-06-22T14:16:29.799Z"
+      "signed_at": "2026-06-22T17:11:02.754Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -374,7 +374,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "Z6WbTqG98bQVRd6+kXDb6xIEe0ZryAeGxVSuKKxdK1PoZqew7NJcMsa6sJVSq+0r7KMsFwfTEdKorp6UDdhpCA==",
-      "signed_at": "2026-06-22T14:16:29.799Z",
+      "signed_at": "2026-06-22T17:11:02.755Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -441,7 +441,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "DLKcrgon+MZrqmivlFLBH4vlzZbJSW1531RsYDm9/KdW2CgcUUHwNMSzAfU1mAsFwFkAHjy/a8e1FbS9msTvDA==",
-      "signed_at": "2026-06-22T14:16:29.800Z",
+      "signed_at": "2026-06-22T17:11:02.756Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -482,7 +482,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "eWCOD+mR1c6B8vKDBot8y8UkQrKPCIEBHU3JRQET9xZnYGx8hrOyeRUElcKqCO5aG/2LISs9Atg1H+ehWDNbCw==",
-      "signed_at": "2026-06-22T14:16:29.800Z",
+      "signed_at": "2026-06-22T17:11:02.757Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -517,7 +517,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "kZca725/+BFr1mpxL29+cGzjqsiYhChWScf7VjU6vCTBZrmCps6W9gYYjf4lVORXaM4DAg3UVBOXyhpTst0rAw==",
-      "signed_at": "2026-06-22T14:16:29.801Z",
+      "signed_at": "2026-06-22T17:11:02.758Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -557,7 +557,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-06-22T14:16:29.801Z"
+      "signed_at": "2026-06-22T17:11:02.759Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -584,7 +584,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "NVBY4I5a+v2/nUeCYcy3LLVKk3Tg9gmz+sCKyvnf8t2fXMNSIGtoy+P8K4Gfos1rGzRRMaU01V7L4kh/IQ8UBQ==",
-      "signed_at": "2026-06-22T14:16:29.801Z",
+      "signed_at": "2026-06-22T17:11:02.760Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -652,7 +652,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "U54OxIjPT+W9yafjpeFgY7klXMltLYBuSCtu/AAlXxOIPehJrbf/vbGgnBn58nqOd7RjoKjmKz9WQs4DMqWcDw==",
-      "signed_at": "2026-06-22T14:16:29.802Z",
+      "signed_at": "2026-06-22T17:11:02.762Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -702,7 +702,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "QsJMwvnUJXHwoBPJ4BiUx3FO9giXfos/sMbx5tyO83AJ2JxdVskeC6g/WDfO+rVkWNXRgWi4h1eSYz6T8/tpAg==",
-      "signed_at": "2026-06-22T14:16:29.803Z"
+      "signed_at": "2026-06-22T17:11:02.763Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -740,7 +740,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8KbLVVPI1QgYa+HAnEYvKf1cXnxQ3zsncqTGrAOrBP4rwUeZsxJm8KyFCwI0XytnZG35PZ830BFlG/okPW3sBQ==",
-      "signed_at": "2026-06-22T14:16:29.803Z",
+      "signed_at": "2026-06-22T17:11:02.764Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -776,7 +776,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-06-22T14:16:29.803Z"
+      "signed_at": "2026-06-22T17:11:02.766Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -852,7 +852,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "ZnFi+Rk4CWrjFEVU4hC6Q66UbDmndNL/ICLWQNA1TQYFGSTnng+nboM4tfi6h0yMbbDj7dOXYqqeHNK+M5ZiBA==",
-      "signed_at": "2026-06-22T14:16:29.804Z"
+      "signed_at": "2026-06-22T17:11:02.767Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -913,7 +913,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "45ICz7vcnmHYE1+RIDv8wQjScKj6p8hqJQ5m6I0tDdKVnGdMXCYIgZnYqFJgHBDXYAXlGx7D7UxhFz6WOCDqAQ==",
-      "signed_at": "2026-06-22T14:16:29.804Z"
+      "signed_at": "2026-06-22T17:11:02.768Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -991,7 +991,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "k6A7QcFEzgGXYWftt/elhQe7kU4F67c0ol3a8DZfj1XW4UrH99SLhPHr6ih3R3EYCl/Ey/zXt/x3a9fDT3RmAw==",
-      "signed_at": "2026-06-22T14:16:29.804Z"
+      "signed_at": "2026-06-22T17:11:02.770Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1075,7 +1075,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "5shKqNcLC8Obt0EdvKnck8OwWIuRMgZuuZd12pvWqJIltsYMyTrw2M+lgbQfqg3x2KO6qsJljGAhTew5jM58DQ==",
-      "signed_at": "2026-06-22T14:16:29.805Z"
+      "signed_at": "2026-06-22T17:11:02.771Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1132,7 +1132,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lfa5Wgep26mK3o2ZSe5qN2vVxg+xRRURRpmnqP4JdQvvecW3T2+PxHqjT48DegXJHRXJ6DPzyIElFc7no86TAg==",
-      "signed_at": "2026-06-22T14:16:29.805Z"
+      "signed_at": "2026-06-22T17:11:02.772Z"
     },
     {
       "name": "identity-assurance",
@@ -1206,7 +1206,7 @@
       ],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-06-22T14:16:29.805Z"
+      "signed_at": "2026-06-22T17:11:02.773Z"
     },
     {
       "name": "ot-ics-security",
@@ -1265,7 +1265,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "afJ00EDXgARQJrbRqN6xe1+E/kbHF7O2fxQFVvrLLXdrKfK86RK/oJU1AwpxX6mclX9f+5ivy6FvFIuRMA4dBQ==",
-      "signed_at": "2026-06-22T14:16:29.806Z"
+      "signed_at": "2026-06-22T17:11:02.774Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1325,7 +1325,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "VzivMW82mRrG9+07ZX8sj4j9O9YjE/m07m1UHgSwEgex+FLaVPvIj3y1Vk6qeFOvDURmtVaztWlpSlk7iSn0DA==",
-      "signed_at": "2026-06-22T14:16:29.806Z"
+      "signed_at": "2026-06-22T17:11:02.776Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1379,7 +1379,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "Fk5LzzeS/bH5SQJNySgZqSdeQf1udwdRs3FVLwig5kuqyyKkuIJcF4HW+xHF/1e66HR+gjgRUoqWZGsv58lLAg==",
-      "signed_at": "2026-06-22T14:16:29.807Z"
+      "signed_at": "2026-06-22T17:11:02.778Z"
     },
     {
       "name": "webapp-security",
@@ -1462,7 +1462,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "1skHJsPPOIXLQdU5MGHirP/Q07aCYTirtDmfWDO7ZNuto58NlCttW5ZjCpyh37vASlMljIZx0/R+PIl2PfwTBw==",
-      "signed_at": "2026-06-22T14:16:29.807Z",
+      "signed_at": "2026-06-22T17:11:02.778Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1522,7 +1522,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-06-22T14:16:29.808Z"
+      "signed_at": "2026-06-22T17:11:02.780Z"
     },
     {
       "name": "sector-healthcare",
@@ -1589,7 +1589,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "yyAGG3nUC6/XWQGRF2ufzILfiJitMFczqWNY83lZShCgYSxfFCul0UsICClOc7Xjw76052uydm8kLH9gIzhsAg==",
-      "signed_at": "2026-06-22T14:16:29.808Z"
+      "signed_at": "2026-06-22T17:11:02.781Z"
     },
     {
       "name": "sector-financial",
@@ -1678,7 +1678,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "/+df91Qhl1TIxEAqzgqB7+YJ6mneX6Dif+h6RaCbxOLGE6KRTFst1Q/Fu5SStt8Zx5JI62bkQ2BBrNOKfUlPBg==",
-      "signed_at": "2026-06-22T14:16:29.808Z"
+      "signed_at": "2026-06-22T17:11:02.782Z"
     },
     {
       "name": "sector-federal-government",
@@ -1755,7 +1755,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "k6MAPS8HJivu0DNwC1azPvyKeig2xLGz/hcqYd8T+s5GvIypPGfkeYRRKmdqMgHUe24f7bQeRZ7AxcQ9Bi6SCg==",
-      "signed_at": "2026-06-22T14:16:29.809Z"
+      "signed_at": "2026-06-22T17:11:02.783Z"
     },
     {
       "name": "sector-energy",
@@ -1829,7 +1829,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "IYKXn009jfhpKdQKiGB4xb7VgxsJXa6PZawoguP42khU6S/TTemp/YsK1YQCUyabE+2biElL/PP1Hi8zCkSSBw==",
-      "signed_at": "2026-06-22T14:16:29.809Z"
+      "signed_at": "2026-06-22T17:11:02.785Z"
     },
     {
       "name": "sector-telecom",
@@ -1915,7 +1915,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-06-22T14:16:29.810Z"
+      "signed_at": "2026-06-22T17:11:02.786Z"
     },
     {
       "name": "api-security",
@@ -1994,7 +1994,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "HUjhPGpZeZeVi1nzBIsEAYh18x5ltlIXnt1yQ5YKz+jC2Dvxw7vV/Clx1/1gDBLAuBvRW9wcNtDr4c0RxhfGDQ==",
-      "signed_at": "2026-06-22T14:16:29.810Z",
+      "signed_at": "2026-06-22T17:11:02.789Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -2089,7 +2089,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "xa1kr/92/0fBds7LVtRy9aCM2tQRWAfNSFoC6ygbOU7QjamUo8Wt2h2n9W+nZT34STN3woYhXqtfmm8NSjXdBQ==",
-      "signed_at": "2026-06-22T14:16:29.811Z"
+      "signed_at": "2026-06-22T17:11:02.790Z"
     },
     {
       "name": "container-runtime-security",
@@ -2161,7 +2161,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "60hyXAiYfY9lI+EpHG3iFFxa+oF5n71c0tTMa6iXFLNjBJKPevTsdNgQlQsBEnmRJ+dWtOjb/GNBW1KiBx4XAQ==",
-      "signed_at": "2026-06-22T14:16:29.811Z",
+      "signed_at": "2026-06-22T17:11:02.791Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2242,7 +2242,7 @@
         "MITRE ATLAS v2026.05 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IEECw5lO6ZdpkE/j7Hv6/3Jg2vj9fpXlozY+h85Hrn9QYOJuI0gfBjHoBEchJ2GUTmPwUKoiBoI72PBAQw9RCQ==",
-      "signed_at": "2026-06-22T14:16:29.812Z"
+      "signed_at": "2026-06-22T17:11:02.793Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2316,7 +2316,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "pN1Qa5NRyNJ6h0pmbbqpy3xWdkMANDMUbBst5SKR5fmmqMFopmyrzwIGagiiNgqxjjCunj9J9Wbzs1sL48sMCQ==",
-      "signed_at": "2026-06-22T14:16:29.812Z"
+      "signed_at": "2026-06-22T17:11:02.795Z"
     },
     {
       "name": "ransomware-response",
@@ -2396,7 +2396,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "sXPA1lvWvZpf5sHxZXRkO0Kcs6gnXiYq0mWA53y1HeBwQGJ+viSPMt5IMobkjd5qLFYchg0CpW/nBUIvUE6/DA==",
-      "signed_at": "2026-06-22T14:16:29.812Z"
+      "signed_at": "2026-06-22T17:11:02.796Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2464,7 +2464,7 @@
       ],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-06-22T14:16:29.813Z"
+      "signed_at": "2026-06-22T17:11:02.797Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2539,7 +2539,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "7Wdii9uwYmDrzQohoWRWDa5A4aDRKOmdLPq5Jsql86O0Gm7pQANnj9tX+cHpQcQ/Ui8VLuNVP8UFdKxxHeDnBg==",
-      "signed_at": "2026-06-22T14:16:29.813Z"
+      "signed_at": "2026-06-22T17:11:02.799Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2619,7 +2619,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-06-22T14:16:29.814Z",
+      "signed_at": "2026-06-22T17:11:02.800Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2713,7 +2713,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-06-22T14:16:29.814Z",
+      "signed_at": "2026-06-22T17:11:02.801Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2785,7 +2785,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-06-22T14:16:29.814Z"
+      "signed_at": "2026-06-22T17:11:02.803Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2844,7 +2844,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-06-22T14:16:29.814Z"
+      "signed_at": "2026-06-22T17:11:02.803Z"
     },
     {
       "name": "network-trust",
@@ -2900,7 +2900,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-06-22T14:16:29.815Z"
+      "signed_at": "2026-06-22T17:11:02.804Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2955,7 +2955,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-06-22T14:16:29.815Z"
+      "signed_at": "2026-06-22T17:11:02.805Z"
     },
     {
       "name": "self-update-integrity",
@@ -3009,7 +3009,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-06-22T14:16:29.815Z"
+      "signed_at": "2026-06-22T17:11:02.806Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -3067,7 +3067,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-06-22T14:16:29.815Z"
+      "signed_at": "2026-06-22T17:11:02.807Z"
     },
     {
       "name": "decompression-dos",
@@ -3125,7 +3125,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-06-22T14:16:29.816Z"
+      "signed_at": "2026-06-22T17:11:02.807Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -3180,7 +3180,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-06-22T14:16:29.816Z"
+      "signed_at": "2026-06-22T17:11:02.808Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3235,11 +3235,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-06-22T14:16:29.816Z"
+      "signed_at": "2026-06-22T17:11:02.809Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "M9BUq5cgR8+SjFVD09FDEKLySxzP4ooYVi99hZkybLUt22e4Nw/uZ4frEUvHrxUSbvG2Wej+J5GR1lRdhM4+AA=="
+    "signature_base64": "n5BM7fxzNpnPWaoIaoKOReV3hdZ6095VSvxHN9nOq5mtPMmQ3RZCkF7DXwHgQYjgTsF4wfc4Qjua3vqNpZ3sAQ=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.18.14",
+  "version": "0.18.16",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (459 CVEs / 181 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:067abada-564e-42a3-b5d4-c0f82acd46c2",
+  "serialNumber": "urn:uuid:0b112883-81a5-4ba8-8e61-746f26fe6ffc",
   "version": 1,
   "metadata": {
-    "timestamp": "2029-06-12T04:15:22.000Z",
+    "timestamp": "2031-11-20T00:04:19.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.18.14"
+        "version": "0.18.16"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.14",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.16",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.18.14",
+      "version": "0.18.16",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (459 CVEs / 181 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.14",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.16",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5229acc52d6c7f075290e6f99516cbc8a832a9a94ba8e421c093d181922db250"
+          "content": "e9468ce3b3ced06212212f4d673fd48029af7da454f706b27f808087a9dabb59"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.14"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.16"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b78694e78efb23ab479560c09f0e08169c646718a4f924dc63c516f7342d8988"
+          "content": "5fa37969557300b07eb36f4c82162ffd75f626d93c5b86c25bd6afb0c0c4e196"
         },
         {
           "alg": "SHA3-512",
-          "content": "c708aa3f4649f7d9675364a253a8de1eebc668a3c10e595c062e5e44f072c36be1ba55e85aef5a9d2a9bda909107800f869310f8451e79bb693d8350d969dbb6"
+          "content": "74cc119ea3fafd51b551119855282a14786fd1514ab6a777ceb57e4e352098222840ddbbb5e7eeb1b3ee4b3d5b9e47ada3b34ef85b432922d61d53408ebd3b33"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c92e6b3bda1e17776ad8d0bd2f6ae122fe7b4e2a59fc026fb5ee1d1d2bd5a103"
+          "content": "d2c715002ff57fe0896b994d946a379e2e11258b6df2080c2241247dd9cbe39e"
         },
         {
           "alg": "SHA3-512",
-          "content": "3fb30c0cde51d1aefe3178a6d589597deef8ea474e3337609b245bd7a3dd5e80d41d21956d753fe8947d1ed9bc74147ada7d53ba4d4c7a50f9990a5f2abe9c9f"
+          "content": "1aa590b60e4e66a34e882b216fa1862b83a96260859feea15a5bdb263299486e78cdf17ee79e9529936349ab6fef07a294f19ad765f56481fbb211ccbdea02a9"
         }
       ]
     },
@@ -491,11 +491,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3e3563a1b737f9e9afe4bdee10247ffbacb971be6e56ee281458ba2e8bd579cf"
+          "content": "d346a9fdd0dc289cee02cdbd2355eb61bd31231fa3c7745af6e071de5e85f747"
         },
         {
           "alg": "SHA3-512",
-          "content": "59d6f29f868301e2879ed3bbe3d76d5a4396ac7ce5e5b2e0812f5372db10e1f022404db653c6ea3b441c6d8dbef4902a82b7c7169fe3dc2607fc204507965010"
+          "content": "ee9681ac0aef46f77dc3537eee23b472dac68d4977d700896d341338498c567b1a3323b7b80586a6956f068c8e7128b950a393ff90ebf29f4d84debb25b59d61"
         }
       ]
     },
@@ -551,11 +551,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8cb21531b4648f2fe534984adc70cf86962f1c8821732452ded8ad7853835bb7"
+          "content": "4734aa4636acf4f5cefb4c086ca8d64d6d5c2875b5f6ec23c7304a50166f41ba"
         },
         {
           "alg": "SHA3-512",
-          "content": "bce87020e5e9edb5628ecb10580cc04d02d8cd5b89110e2d3e477970a615b9b68ea3ef085d612ccf488b8cdb0441bed1ca14a80140e8c70cfd668f099efb4c29"
+          "content": "a82387ab591eec1dff1e63c88ae0a06c6e422d98631c23ba854eb074234ae5aeb2f7de98aa9813de07c3b9769047f9ac254a9cee53f9f8d95dc20a1b17aae38e"
         }
       ]
     },
@@ -641,11 +641,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d4a30c75da45a354b6f8d4da6df9496c964c92d6c7223369902b27f52391c481"
+          "content": "5a21e14c0c1e59f28f530f7121b7a94f096766751b01fbfa4c82c9a4ed819a4c"
         },
         {
           "alg": "SHA3-512",
-          "content": "f1eb1c5c4d15006e169afa3e88e7bd04c7fb9aadeeb70caa0572a3ca10fc5df8e16b7a1993f545c98374b70b667f007d0f8ec162531c744316c375d5d6768afa"
+          "content": "f6facca12c0e27387d8c7b10064b30272782150ba7cc3cc404d52a6b4090e6b8c43aa34498454194a2230aea7a2c3fbd473dfe09ec40b6b5b2ae9ce5afdd8254"
         }
       ]
     },
@@ -731,11 +731,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d477ed782fa2688b2f01dff8a911df6dfddbe9b6dba02eefda5917bc10b39676"
+          "content": "78d4e0b31bf3eb161cd343df2c6f87945bb5df3dafa59fc9ec68229a2d2d2ee1"
         },
         {
           "alg": "SHA3-512",
-          "content": "d3f453f264e65cc7d0df4f1c61b683caeb86dcdff1b5fdf56aa8a30c5e91764046c6a5341e171a9931e2f1ec11a37b1b096d65e67c836e501600582823c82a30"
+          "content": "b81137055a740d1b4504409b098b5190ff6860b0e1306425801abc0d6279c6bc327730bcc7bf65aa96b6c089ce7d7b167d5106e5b7ff08543ee1b6b93b9da9fd"
         }
       ]
     },
@@ -1466,11 +1466,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7a80237a0efc67ef1c5356cfe2cb01682f2bdbd1c482c01f803bbcadeb2bd43d"
+          "content": "c33e749b67d2d1ff19a4f5e6aac4947c97b9ef03d44f0f273cd44eb7a1a76cd1"
         },
         {
           "alg": "SHA3-512",
-          "content": "f48be7bb4286626dbc5a813850d7995d0eb370eae0933d990adf67de4dd0b11328ca1ade31f1d1db6cc8945fd56fa3c64da79fbd67456996c1c2c71a2f19b708"
+          "content": "84c2b2d74d4fa8b88430a3c2bb662143bb580c7b7b42f2203a01a1384ad0cada0c51bd45f7d2697ba278715c9fd7ed37f3e1c0a3fcb1d6f4479d43386c285a2a"
         }
       ]
     },
@@ -1781,11 +1781,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6e330602c96826afef6d678cb981f7e8b6dc2f85e347157a4fbd31d13b18c423"
+          "content": "67a4ea6652f8be1602acf415461ce22536b4fe07245cbb577a237709f49d1b7f"
         },
         {
           "alg": "SHA3-512",
-          "content": "01df582251e0616594050f2c93ac513aaa18be01c330159b429cc775f868da2f4c766d4c6988c869374e0318e0dfb91551b3fa3df109430a238236ce89bdc8be"
+          "content": "2127dba695f401dcbae912b54e57fcea387dbd716974f807ab9a942cb43bc7cbe97a10f35d8a0daa0f8deb2aef3f82be5c651c3eeb0a46de8d546cb87a0a4598"
         }
       ]
     },
@@ -1901,11 +1901,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "be5406117ede866ec4dc653cf15f9555f8fa58c254fc601800e4bacb07ddb609"
+          "content": "c8376cbda42a9657b6a5d50f75d8c08a0bcab7c8456340042be7998133922ecb"
         },
         {
           "alg": "SHA3-512",
-          "content": "ce5d386778093686cec9cea5bf274ed1b557c03e617d9c6538fbb05debc81cabdeffbb46879b00de2479fd6a76395cea1a4e08182899d34ce6f7220ce2b25321"
+          "content": "eb932bc21fa7e5c210f265b6e7a5eaebae58354c5a4f8cd61c66b4e35939c65a02ea9e1d84e0f44975c1e582217a3e8dae2172e1824b26b4f05d2555c54562e2"
         }
       ]
     },