@blamejs/exceptd-skills 0.18.15 → 0.18.17

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 0.18.17 — 2026-06-24
+
+A correctness pass across the upstream-refresh pipeline, the credential and MCP collectors, scoring and framework analysis, attestation hashing, and the release gates.
+
+The scheduled data refresh no longer fails on transient upstream throttling. The cache-warm step now separates retryable errors the upstream is asking us to back off on — a rate-limit (HTTP 429), a timeout, a 5xx — from hard data errors like a 404 or a parse failure. Only hard errors count toward the failure budget; transient throttling is surfaced in the run summary and retried on the next run. Previously a burst of NVD rate-limits failed the entire refresh and skipped the automated update PR. A feed that returns nothing at all still fails. The exported `prefetch()` API also honors `EXCEPTD_AIR_GAP=1` now, so a programmatic call from an air-gapped host no longer reaches the network.
+
+Cleartext-credential detection covers more of what it claims. An Azure, Google, or Cohere API key found in a shell dotfile now surfaces as a confirmed finding instead of being downgraded to inconclusive. An AWS profile that carries a static access key alongside a `role_arn` — the assume-role bootstrap shape — is flagged as a static-key exposure rather than treated as fully federated. On Windows, the POSIX-permission posture checks (world-writable env files, SSH key modes) report inconclusive rather than a false "clean" for a check that cannot run there.
+
+MCP integrity detection catches single-token launch commands. A server started with a whole pip invocation in one argument — `sh -c "pip install pkg==1.2.3"` — is now flagged as pinned-without-integrity; previously only the split-argument form was caught.
+
+"Rejected or disputed CVE" citations no longer false-positive. The check fired on any note that mentioned a dispute — including a CVSS *scoring* dispute, a disclosure-coordination dispute, or a different CVE the note merely referenced. It now fires only when the cited CVE's own record is rejected or disputed, and no longer attaches a false attestation that suppressed the downgrade for a valid, often actively-exploited citation.
+
+The runtime collector's `collect | run` pipe reaches analysis. The collector now attests the read-only-inventory precondition the runner cannot resolve mechanically, so `collect runtime | run runtime` no longer halts at preflight despite valid evidence.
+
+The RWEP-vs-CVSS explanation lists every factor it counts. Suspected and unknown active-exploitation (contributing +10 and +5) and the blast-radius contribution were omitted from the "driving factors" sentence, so a divergence driven by them showed a higher score with an understated — sometimes empty — reason. Both the driving and mitigating sides now enumerate the real contributions and name the structural cause when no single factor dominates.
+
+Framework gap analysis resolves frameworks whose catalog label differs from their formal name. The Australian Government ISM — and any framework in the same situation — reported zero control gaps and null metadata because its catalog labels did not match its registered name; a data-driven alias map now resolves both, and a framework that resolves to zero gaps is flagged instead of silently empty.
+
+EPSS and NVD scores are matched to the requested CVE by id. The cache-diff and KEV auto-import paths fell back to the first row or record in a payload, which could attribute one CVE's EPSS or CVSS to another when a cache entry held a different CVE's response. They now match by id and skip on a mismatch.
+
+Attestation and reattestation no longer report false drift from a relabeled observation. The evidence hash, and the deterministic session id derived from it, re-key evidence by the stable indicator it targets, so identical evidence submitted under a different observation label produces the same hash; a changed evidence value still changes it.
+
+The GHSA and OSV regression watch stops flagging editorial fields. Curated-only fields — AI-discovery, PoC availability, active-exploitation — were treated as upstream-sourced and flagged as "dropped" on every re-import; the watch now covers only fields the feed actually populates, and the diff summary counts new entries and field regressions separately rather than labeling both as new.
+
+Release gates fail closed on absent input. The version-cadence, test-subject, and code-pattern checks each had a path that passed without checking anything — an unreadable changelog, an empty playbook or module set, an empty scan universe. Each now fails rather than reporting clean when it has nothing to check.
+
+## 0.18.16 — 2026-06-22
+
+A correctness pass on the evidence-output and attestation surfaces.
+
+SARIF finding results always carry a location now. A result with no `locations` is silently dropped by GitHub Code Scanning; previously only playbooks whose look-artifact sources happened to be bare file paths got one, so most playbooks' (prose/glob/command sources) findings were emitted location-less and disappeared from the alerts list. Each finding without a concrete file now carries a rule-scoped logical location, keeping it visible and attributable; a physical file location is still used whenever the agent supplied one.
+
+`attest diff` no longer reports identical evidence as changed. The artifact diff was keyed by the operator-chosen observation key rather than the indicator the observation targeted, so two attestations with the same finding under different observation keys (a different collector run, the array vs object evidence shape, reordered observations) showed every artifact as added-and-removed with zero unchanged. The diff is now keyed by the stable indicator id, so identical evidence compares as unchanged.
+
+Risk-acceptance exception language now reports its unresolved placeholders. The auditor-ready exception text is filled from operator-supplied values that a standard run does not pre-stage, so it could ship literal `<MISSING:…>` tokens; the exception now carries a `missing_interpolation_vars` list (and surfaces a runtime error) naming exactly which values still need filling, matching the notification-draft behavior.
+
+CSAF advisories bind their per-version affected products. The product tree's per-version product entries were defined but never referenced from any vulnerability, so a dashboard correlating affected products to the tree saw only the generic synthetic product; each CVE's version entries are now bound into its `product_status`.
+
 ## 0.18.15 — 2026-06-22
 
 Indicator-gated escalations and playbook chains now fire when their indicators are detected. An escalation or `feeds_into` written as `<indicator-id> == true` (the catalog's standard form) resolved only when that id was also passed as a raw signal; the normal scan path delivers detections separately, so on a real `exceptd collect <playbook>` these escalations and downstream chains stayed silent even when the indicator was found. Fired indicators are now bound into the escalation, chain, and remediation-precondition contexts, so a detection drives the condition that gates on it. An operator can still override a specific indicator, and engine-computed values still take precedence.

package/bin/exceptd.js

@@ -6554,6 +6554,39 @@ function submissionHasData(submission) {
     || nonEmpty(submission.signal_overrides)
     || nonEmpty(submission.observations);
 }
+// attest diff compares artifacts by map key. normalizeSubmission keys
+// flat-shape artifacts by the operator-chosen OBSERVATION key (obs-kver, x1, an
+// array index, …), NOT by the stable indicator id the observation targeted — so
+// two attestations with identical (indicator, value) evidence under different
+// observation keys diffed as all-added/all-removed (unchanged_count 0), while the
+// correctly-keyed signal_override_diff on the same comparison showed the true
+// unchanged result. Re-key the artifact map by the stable indicator id (recovered
+// from normalizeSubmission's _signal_origins, which maps indicator -> obs-key)
+// before diffing, falling back to the original key when an observation carries no
+// indicator binding. Diff-only — does NOT touch normalizeSubmission's map or the
+// evidence_hash.
+function rekeyArtifactsByStableId(artifacts, signalOrigins) {
+  if (!artifacts || !signalOrigins || typeof signalOrigins !== "object") return artifacts || {};
+  const obsKeyToIndicator = {};
+  for (const [indicatorId, obsKey] of Object.entries(signalOrigins)) {
+    if (typeof obsKey === "string") obsKeyToIndicator[obsKey] = indicatorId;
+  }
+  const originalKeys = new Set(Object.keys(artifacts));
+  const out = {};
+  for (const [k, v] of Object.entries(artifacts)) {
+    const mapped = obsKeyToIndicator[k];
+    // Re-key to the stable indicator id ONLY when it won't drop an artifact: the
+    // indicator id must not already be a DISTINCT original artifact key, and must
+    // not have been claimed by an earlier re-keyed entry. On any such collision,
+    // keep the original key so no artifact is silently overwritten / lost from
+    // the diff (two observations sharing one indicator, or an artifact key that
+    // already equals an indicator id).
+    const stable = (mapped && mapped !== k && !originalKeys.has(mapped)
+      && !Object.prototype.hasOwnProperty.call(out, mapped)) ? mapped : k;
+    out[stable] = v;
+  }
+  return out;
+}
 function normalizedArtifacts(submission, runner, playbookId, applyEmptyFallback = true) {
   if (!submission || typeof submission !== "object") {
     return applyEmptyFallback ? (_playbookArtifactCatalog(runner, playbookId) || {}) : {};
@@ -6568,7 +6601,9 @@ function normalizedArtifacts(submission, runner, playbookId, applyEmptyFallback
         const pb = runner.loadPlaybook ? runner.loadPlaybook(playbookId) : null;
         if (pb) {
           const norm = runner.normalizeSubmission({ observations: submission.observations }, pb);
-          if (norm && norm.artifacts && Object.keys(norm.artifacts).length > 0) return norm.artifacts;
+          if (norm && norm.artifacts && Object.keys(norm.artifacts).length > 0) {
+            return rekeyArtifactsByStableId(norm.artifacts, norm._signal_origins);
+          }
         }
       } catch { /* fall through */ }
     }

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-22T15:58:38.839Z",
+  "generated_at": "2026-06-25T03:42:18.191Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "06e97688670822402c8878d854e06f6790969a0a8a3c119e3aa5bef7d8c7e2d3",
+    "manifest.json": "20836959eb7562901f9fb4445fa930f3e6b9890439eb97edefa00de23ff40d93",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",
@@ -14,7 +14,7 @@
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
     "data/framework-control-gaps.json": "760c2275803c6da3665ce538c5176bde6f041b68cc3d4808b8de961dfcdee6b8",
-    "data/global-frameworks.json": "9ba563a85f7f8d6c3c957de64945e20925a89d0ed6ea6fc561cf093811acf558",
+    "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
     "data/zeroday-lessons.json": "8c69eec9103eeea236ceb1a157d62b35bafcf8a5de86502e25e4587cc5931247",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",

package/data/global-frameworks.json

@@ -256,6 +256,7 @@
     "frameworks": {
       "ASD_ISM": {
         "full_name": "Australian Signals Directorate Information Security Manual",
+        "catalog_aliases": ["au-ism", "AU ISM", "ACSC ISM", "Australian Government Information Security Manual"],
         "authority": "Australian Signals Directorate (ASD)",
         "source": "https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism",
         "effective_date": "Monthly updates",

package/lib/auto-discovery.js

@@ -185,8 +185,15 @@ function readCachedJson(cacheDir, source, id) {
   return parsed;
 }
 
-function extractNvdMetrics(payload) {
-  const vuln = payload?.vulnerabilities?.[0]?.cve;
+function extractNvdMetrics(payload, id) {
+  // Resolve the NVD vuln by id, not by position. vulnerabilities[0] blindly
+  // took the first record, so a cache entry keyed under `id` that held another
+  // CVE's response would attribute that CVE's CVSS/CWE/description to this id.
+  // When no id is supplied (legacy callers), fall back to the first record.
+  const cves = (payload?.vulnerabilities || []).map((v) => v?.cve).filter(Boolean);
+  const vuln = id
+    ? cves.find((c) => c.id && String(c.id).toUpperCase() === String(id).toUpperCase())
+    : cves[0];
   if (!vuln) return null;
   // Prefer the newest CVSS version (Primary within it) and normalize a bare
   // v2 vector to its canonical prefix so an auto-imported draft never carries
@@ -238,7 +245,7 @@ function extractEpss(payload, id) {
  */
 function buildKevDraftEntry(kevEntry, nvdPayload, epssPayload) {
   const id = String(kevEntry.cveID);
-  const nvd = nvdPayload ? extractNvdMetrics(nvdPayload) : null;
+  const nvd = nvdPayload ? extractNvdMetrics(nvdPayload, id) : null;
   const epss = epssPayload ? extractEpss(epssPayload, id) : null;
 
   const knownRansomware =

package/lib/collectors/ai-api.js

@@ -63,6 +63,16 @@ const AI_KEY_VALUE_RE = {
   openai: /OPENAI_API_KEY\s*[= ]\s*['"]?(sk-[A-Za-z0-9_-]+)/,
   anthropic: /ANTHROPIC_API_KEY\s*[= ]\s*['"]?(sk-ant-[A-Za-z0-9_-]+)/,
   huggingface: /(?:HUGGINGFACE_TOKEN|HF_TOKEN)\s*[= ]\s*['"]?(hf_[A-Za-z0-9]+)/,
+  // Azure/Google/Cohere keys carry no vendor prefix, so the captured value IS
+  // the entropy body. Without these, cleartextFpIndices found no value for an
+  // azure/google/cohere-only dotfile, returned an empty attestation, and the
+  // runner downgraded a real cleartext-key hit to inconclusive — the indicator
+  // fired then vanished for half the supported vendors. The 30-char entropy
+  // floor (the `: 30` else-branch below) and PLACEHOLDER_RE both apply, since
+  // the prefix-strip leaves these values unchanged.
+  azure: /AZURE_OPENAI(?:_API)?_KEY\s*[= ]\s*['"]?([A-Za-z0-9]{20,})/,
+  google: /(?:GOOGLE_API_KEY|GOOGLE_GENAI_API_KEY|GEMINI_API_KEY)\s*[= ]\s*['"]?([A-Za-z0-9_-]{20,})/,
+  cohere: /COHERE_API_KEY\s*[= ]\s*['"]?([A-Za-z0-9-]{30,})/,
 };
 const PLACEHOLDER_RE = /placeholder|example|redacted|dummy|x{4,}|0{6,}|test-/i;
 

package/lib/collectors/citation-hygiene.js

@@ -110,8 +110,50 @@ const CVE_CANONICAL_RE = /^CVE-\d{4}-\d{4,}$/;
 // RFC citation: `RFC 9404`, `RFC9404`, `RFC-9404`. Capture the number.
 const RFC_CITATION_RE = /RFC[\s-]?(\d{1,5})\b/gi;
 
-// Words that mark a catalog note as recording a rejected / disputed status.
-const REJECT_DISPUTE_RE = /\b(reject(?:ed|s|ion)?|disputed?|withdrawn)\b/i;
+// A catalog note records a rejected/disputed RECORD for THIS CVE only when a
+// reject/dispute/withdraw word refers to the citation's own record — not to a
+// CVSS *scoring* disagreement, a disclosure-coordination dispute, or a
+// DIFFERENT CVE the note merely mentions. A bare word-anywhere scan matched all
+// three, producing a false "citation to a rejected record" hit AND a false
+// __fp_checks[1] attestation (telling the runner not to downgrade), so a valid,
+// often actively-exploited CVE surfaced as a confirmed rejected/disputed
+// citation. `selfId` is the citation's own CVE id.
+function recordRejectedOrDisputed(note, selfId) {
+  if (!note) return false;
+  const self = String(selfId || "").toUpperCase();
+  const re = /\b(reject(?:ed|s|ion)?|disputed?|withdrawn)\b/gi;
+  // Qualifier nouns that make a "dispute" a disagreement about something OTHER
+  // than the record's validity (the score, the severity, the disclosure
+  // process, …). 'rejected'/'withdrawn' are record-level words and bypass this.
+  const QUALIFIER = /\b(cvss|scoring|score|severity|coordination|disclosure|methodolog\w*|attribution|naming|assignment|priorit\w*)\b/i;
+  // A "duplicate of / superseded by / replaced by / merged into / in favour of"
+  // construction names the REPLACEMENT cve — THIS record is still the rejected
+  // one, so a different cve appearing as that replacement must NOT suppress the
+  // flag (e.g. "this record was rejected as a duplicate of CVE-Y").
+  const REPLACEMENT_OF = /\b(?:duplicate|dup)\b[\s\w-]*\bof\b|\b(?:supersed\w+|replaced|merged)\b[\s\w-]*\b(?:by|into)\b|\bin\s+favou?r\s+of\b/i;
+  const otherCve = (s) => (s.match(/CVE-\d{4}-\d{4,}/gi) || []).some((c) => c.toUpperCase() !== self);
+  let m;
+  while ((m = re.exec(note)) !== null) {
+    const word = m[1].toLowerCase();
+    const before = note.slice(Math.max(0, m.index - 60), m.index);
+    const after = note.slice(re.lastIndex, re.lastIndex + 60);
+    // (a) A different cve BEFORE the word is the subject ("CVE-Y was rejected")
+    //     — the status is about that record, not this citation.
+    if (otherCve(before)) continue;
+    // (b) A different cve AFTER the word suppresses too, UNLESS it is the
+    //     replacement target of a duplicate-of/superseded-by construction, in
+    //     which case THIS record is the rejected one — keep it flagged.
+    if (otherCve(after) && !REPLACEMENT_OF.test(after)) continue;
+    // (c) A 'dispute(d)' qualified by a non-record noun is a disagreement about
+    //     that noun, not a record rejection.
+    if (word.startsWith("disput")) {
+      const lastTokens = before.trim().split(/[\s-]+/).slice(-3).join(" ");
+      if (QUALIFIER.test(lastTokens)) continue;
+    }
+    return true;
+  }
+  return false;
+}
 
 // Draft-language proximity for the (unflipped) draft-as-RFC heuristic.
 const DRAFT_LANGUAGE_RE = /\b(draft-[a-z0-9-]+|internet[- ]draft|work[- ]in[- ]progress|i-d\b)\b/i;
@@ -356,7 +398,7 @@ function collect({ cwd = process.cwd() } = {}) {
       // Well-formed. Cross-reference the catalog.
       if (cveKeys.has(full)) {
         const note = cveNotes.get(full) || "";
-        if (REJECT_DISPUTE_RE.test(note) && !illustrative) {
+        if (recordRejectedOrDisputed(note, full) && !illustrative) {
           hits["rejected-or-disputed-cve"].push({ file: f.rel, citation: full, line: cveLine });
         }
       } else if (catalogsLoaded && !illustrative) {
@@ -603,4 +645,4 @@ async function applyResolution(submission, opts = {}) {
   return out;
 }
 
-module.exports = { playbook_id: COLLECTOR_ID, collect, applyResolution };
+module.exports = { playbook_id: COLLECTOR_ID, collect, applyResolution, recordRejectedOrDisputed };

package/lib/collectors/cred-stores.js

@@ -84,7 +84,16 @@ function parseAwsCredentials(content) {
   const staticKeys = {};
   for (const [name, kv] of Object.entries(profiles)) {
     const hasKey = !!kv["aws_access_key_id"];
-    const hasFederation = !!(kv["sso_session"] || kv["credential_process"] || kv["role_arn"]);
+    // role_arn is NOT a federation marker for this predicate. A profile that
+    // carries a static aws_access_key_id (AKIA*) alongside a role_arn is the
+    // canonical source_profile/assume-role setup where the static key IS the
+    // long-lived credential that bootstraps the assumed role — a real static-key
+    // exposure. The playbook's aws-static-key-present predicate lists only
+    // sso_session / credential_process as federation; treating role_arn as
+    // federation here suppressed a genuinely-present IAM user key. A pure
+    // assume-role profile (role_arn, no own access key) is still excluded by the
+    // hasKey gate below.
+    const hasFederation = !!(kv["sso_session"] || kv["credential_process"]);
     if (hasKey && !hasFederation) {
       staticProfiles.push(name);
       staticKeys[name] = kv["aws_access_key_id"];

package/lib/collectors/mcp.js

@@ -120,7 +120,13 @@ function isPinnedNoIntegrity(server) {
     if (typeof tok !== "string") continue;
     // npm package@version (excluding scope name@version)
     if (/@[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+@\d+\.\d+\.\d+\b/.test(tok)) return true;
-    if (/\bpip\s+install\b/.test(tok)) continue;
+    // A `==X.Y.Z` pin (pip/uvx/poetry) with no integrity is the python analog
+    // of the npm pin above. A single-token launch command like
+    // `sh -c "pip install some-mcp==1.2.3"` carries the whole pip invocation in
+    // one token, so testing the token for `pip install` and `continue`-ing here
+    // skipped the `==version` check below for exactly the shape the comment
+    // says operators care about. A bare `pip install requests` (no `==`) can't
+    // match the pin regex, so checking every token is safe.
     if (/==\d+\.\d+\.\d+/.test(tok)) return true;
   }
   return false;

package/lib/collectors/runtime.js

@@ -341,6 +341,17 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   return {
     precondition_checks: {
       "linux-platform": true,
+      // The collector performs a read-only inventory directly via fs (reads
+      // /etc/sudoers, /etc/passwd, /proc/<pid>/status) and execs no commands,
+      // so the `exec-allowed` precondition ('permitted to execute read-only
+      // inventory commands') is satisfied by construction once the collection
+      // reaches at least one inventory source. The runner cannot mechanically
+      // resolve `agent_has_command_exec == true`, so without this attestation
+      // the on_fail=halt preflight blocked the canonical `collect runtime | run
+      // runtime` pipe even with valid evidence — the sibling fs-only cred-stores
+      // collector attests its own halt precondition the same way. Gated on
+      // readability so a fully-masked /proc+/etc scope reports it false.
+      "exec-allowed": Boolean(sudoersReadable || passwdContent != null || procWalkable || anyTpReadable),
     },
     artifacts,
     signal_overrides,

package/lib/collectors/secrets.js

@@ -488,7 +488,14 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   //   any .env / .env.* / .envrc with mode 0666 or 0664 (group/world writable)
   // i.e. group-write OR world-write bit set (mode & 0o022).
   const envFilePostures = process.platform === "win32" ? [] : envFiles.map(f => ({ file: f.rel, ...statPosture(f.full) }));
-  signal_overrides["world-writable-env-file"] = envFilePostures.some(p => p.error == null && (p.mode & 0o022) !== 0) ? "hit" : "miss";
+  // POSIX mode bits are unreadable on win32, so this posture cannot be checked
+  // there. OMIT the signal on Windows (mirroring cred-stores' credentials-file-
+  // bad-perms) so the runner returns `inconclusive` rather than a deterministic
+  // false `miss` for a check that physically cannot run. (The posture array is
+  // still declared — empty on win32 — for the SARIF per-indicator locations.)
+  if (process.platform !== "win32") {
+    signal_overrides["world-writable-env-file"] = envFilePostures.some(p => p.error == null && (p.mode & 0o022) !== 0) ? "hit" : "miss";
+  }
 
   // ssh-key-bad-perms predicate (per playbook):
   //   restricted to ssh-private-keys artifact + ~/.ssh/id_* paths
@@ -499,7 +506,11 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   // (prodSshPrivateKeys) — matching ssh-private-key-block — so a fixture
   // key checked in under a test/ path doesn't raise a bad-perms posture.
   const sshKeyPostures = process.platform === "win32" ? [] : prodSshPrivateKeys.map(f => ({ file: f.rel, ...statPosture(f.full) }));
-  signal_overrides["ssh-key-bad-perms"] = sshKeyPostures.some(p => p.error == null && p.mode !== 0o600) ? "hit" : "miss";
+  // Same as world-writable-env-file: omit on win32 (mode bits unreadable) so the
+  // runner returns inconclusive instead of a forced false `miss`.
+  if (process.platform !== "win32") {
+    signal_overrides["ssh-key-bad-perms"] = sshKeyPostures.some(p => p.error == null && p.mode !== 0o600) ? "hit" : "miss";
+  }
 
   // Per-indicator file locations for every indicator flipped to "hit", so
   // a SARIF result points at the file carrying the secret / bad posture.

package/lib/cross-ref-api.js

@@ -303,13 +303,67 @@ function bySkill(skillName) {
   return { skill: skillName, summary_card: card, cve_refs: cveRefs, ttp_refs: ttpRefs };
 }
 
+// global-frameworks.json is keyed by REGION (EU/UK/AU/...), each with a nested
+// `frameworks: { SHORTKEY: {full_name, catalog_aliases?, ...} }` map. A flat
+// `global[frameworkId]` lookup therefore ALWAYS returned null — frameworkId is a
+// short key or a catalog display name, never a region — so framework_meta was
+// universally null. Walk the nested structure and match the requested id against
+// the short key, the full_name, or any catalog_alias (normalized), returning the
+// matched framework object annotated with its region + jurisdiction.
+function resolveFrameworkMeta(global, frameworkId) {
+  if (!global || frameworkId == null) return null;
+  const norm = (s) => String(s == null ? '' : s).toLowerCase().replace(/\([^)]*\)/g, '').replace(/[\s_-]/g, '');
+  const want = norm(frameworkId);
+  if (!want) return null;
+  for (const [region, rv] of Object.entries(global)) {
+    if (region === '_meta' || !rv || typeof rv !== 'object') continue;
+    const fws = rv.frameworks || {};
+    for (const [shortKey, fv] of Object.entries(fws)) {
+      if (!fv || typeof fv !== 'object') continue;
+      const aliases = Array.isArray(fv.catalog_aliases) ? fv.catalog_aliases.map(norm) : [];
+      if (shortKey === frameworkId ||
+          norm(shortKey) === want ||
+          (fv.full_name && norm(fv.full_name) === want) ||
+          aliases.some((a) => a && (a === want || a.includes(want) || want.includes(a)))) {
+        return { ...fv, _framework_key: shortKey, _region: region, _jurisdiction: rv.jurisdiction || null };
+      }
+    }
+  }
+  return null;
+}
+
 function byFramework(frameworkId) {
   const gaps = loadCatalog('framework-control-gaps.json');
   const global = loadCatalog('global-frameworks.json');
+  const fwMeta = resolveFrameworkMeta(global, frameworkId);
+  // Match gap rows by the framework's full LABEL SET, not just the literal id.
+  // The catalog stores a framework's gaps under labels (au-ism / AU ISM / ACSC
+  // ISM …) that diverge from its short key and full_name, so an exact
+  // `g.framework === frameworkId` match returned a gap set inconsistent with the
+  // (now alias-resolved) framework_meta — non-null metadata but a partial,
+  // sometimes empty, gap list. Resolve the same alias set used for the metadata
+  // and match any gap label (string or array element) against it.
+  const norm = (s) => String(s == null ? '' : s).toLowerCase().replace(/\([^)]*\)/g, '').replace(/[\s_-]/g, '');
+  const labels = new Set([norm(frameworkId)]);
+  if (fwMeta) {
+    if (fwMeta._framework_key) labels.add(norm(fwMeta._framework_key));
+    if (fwMeta.full_name) labels.add(norm(fwMeta.full_name));
+    for (const a of (Array.isArray(fwMeta.catalog_aliases) ? fwMeta.catalog_aliases : [])) labels.add(norm(a));
+  }
+  labels.delete('');
+  const labelMatch = (fw) => {
+    const n = norm(fw);
+    if (!n) return false;
+    for (const l of labels) if (n === l || n.includes(l) || l.includes(n)) return true;
+    return false;
+  };
   const matching = entries(gaps)
-    .filter(([, g]) => g.framework === frameworkId || g.framework === 'ALL')
+    .filter(([, g]) => {
+      if (g.framework === 'ALL') return true;
+      const fwList = Array.isArray(g.framework) ? g.framework : [g.framework];
+      return fwList.some(labelMatch);
+    })
     .map(([id, g]) => ({ id, ...g }));
-  const fwMeta = global[frameworkId] || null;
   return { framework: frameworkId, framework_meta: fwMeta, gaps: matching, gap_count: matching.length };
 }
 

package/lib/framework-gap.js

@@ -108,6 +108,17 @@ function lagScore(frameworkId, controlGaps, globalFrameworks) {
   const normalize = (s) => String(s).toLowerCase().replace(/[\s_-]/g, '');
   const idNorm = normalize(frameworkId);
   const nameNorm = frameworkData?.full_name ? normalize(frameworkData.full_name) : null;
+  // Data-driven aliases close the naming divergence between a framework's
+  // global-frameworks full_name and the (often different) labels the control-gap
+  // catalog uses for it — e.g. ASD_ISM's full_name is "Australian Signals
+  // Directorate Information Security Manual" but the catalog labels its 5 gaps
+  // "au-ism" / "ACSC ISM" / "Australian Government Information Security Manual",
+  // so neither nameNorm nor idNorm matched and lagScore reported 0 gaps. Aliases
+  // live in data/global-frameworks.json (catalog_aliases) so this generalizes to
+  // any future framework whose catalog label diverges from its name.
+  const aliasNorms = Array.isArray(frameworkData?.catalog_aliases)
+    ? frameworkData.catalog_aliases.map((a) => normalize(a)).filter(Boolean)
+    : [];
   const gaps = Object.entries(controlGaps).filter(([key, g]) => {
     if (key.startsWith('_')) return false;
     if (g.status !== 'open' || !g.framework) return false;
@@ -116,10 +127,17 @@ function lagScore(frameworkId, controlGaps, globalFrameworks) {
       const fwNorm = normalize(fw);
       if (nameNorm && fwNorm.includes(nameNorm)) return true;   // display-name match
       if (fwNorm.includes(idNorm)) return true;                 // short-key substring
+      if (aliasNorms.some((a) => a && (fwNorm.includes(a) || a.includes(fwNorm)))) return true; // catalog-label alias
     }
     if (normalize(key).startsWith(idNorm)) return true;         // gap-key prefix
     return false;
   });
+  // Observable backstop: a framework that EXISTS in global-frameworks resolving
+  // to zero catalog gaps is almost always a fresh naming divergence (a new
+  // catalog label not yet in catalog_aliases), not a genuinely gap-free
+  // framework. Surface it as a structured flag rather than a silent 0 so a
+  // regression is greppable in the breakdown instead of invisible.
+  const resolvedButZeroGaps = Boolean(frameworkData && gaps.length === 0);
 
   const universalGaps = Object.values(controlGaps).filter(g =>
     g.framework === 'ALL' && g.status === 'open'
@@ -149,7 +167,10 @@ function lagScore(frameworkId, controlGaps, globalFrameworks) {
       ai_coverage: { coverage: frameworkData?.ai_coverage ?? 'unknown', score: aiCoverageScore },
       pqc_coverage: { coverage: frameworkData?.pqc_coverage ?? 'unknown', score: pqcScore },
       universal_gaps: { count: universalGaps.length, score: universalGapScore },
-      framework_specific_gaps: gaps.length
+      framework_specific_gaps: gaps.length,
+      // True only when the framework resolves in global-frameworks yet matched
+      // zero catalog gaps — a likely naming divergence worth investigating.
+      framework_resolved_but_zero_gaps: resolvedButZeroGaps
     }
   };
 }