@blamejs/exceptd-skills 0.18.26 → 0.18.28

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.18.28 — 2026-08-05
+
+`doctor` no longer reports a healthy install as failed once a skill passes ninety days since its last threat review. The skill-currency check treated every skill outside the "current" tier as an error, while the currency model itself raises `action_required` only below the "acceptable" tier — so a maintained skill crossing the ninety-day mark turned the whole health check red and `doctor --json` exited 1, on a fixed cadence, with nothing actually wrong. Review-date drift is now advisory: the check reports `severity: "warn"`, `all_green` stays false so the drift is still visible, and the exit code stays 0. A skill genuinely past its review window still fails with exit 1, and a critically stale one is still counted critical. The check reports `drifting_skills` and `action_required_skills` alongside the existing `stale_skills` list, which keeps its meaning, so a consumer can distinguish an advisory state from a failure. Human output distinguishes the three states rather than printing "all green" under a warning icon.
+
+The `global-grc` skill carries a refreshed threat review. The EU AI Act entry now follows the application timeline as amended by Regulation (EU) 2026/1744: Art. 50 transparency obligations and Commission supervision of GPAI providers are in force from 2026-08-02, the high-risk requirements including Art. 9 risk management and Art. 15 cybersecurity are deferred to 2027-12-02 for Annex III systems and 2028-08-02 for Annex I product-embedded systems, and two new Art. 5 prohibitions covering non-consensual intimate imagery and child sexual abuse material apply from 2026-12-02. Art. 73's serious-incident clocks are corrected — 2 days for widespread infringement or critical-infrastructure disruption, 10 days for death of a person, 15 days otherwise — having previously been transposed. The compliance-theater test that keyed off the superseded August 2026 deadline is replaced by one testing Art. 50 transparency, which is enforceable now, and one testing high-risk classification against the deferred dates, on the ground that a deferral is not a withdrawal while the attack surface stays live. NIS2 no longer claims enforcement across all 27 Member States: transposition remains incomplete, and four Member States were referred to the CJEU in July 2026, so entities scope by Member State of establishment rather than by the directive text. CRA manufacturer reporting under Art. 14 is now covered in the notification and exploit-availability tables — 24-hour early warning, 72-hour notification, 14-day final report from 2026-09-11 — a clock triggered by active exploitation and therefore driven directly by KEV state. UK coverage is corrected: NCSC CAF v4.0 does carry AI-relevant content in Principle B4's automated-decision-making outcomes and its ETSI Securing AI reference, so the claim that no UK framework addressed AI is withdrawn and replaced with the narrower residual gap, and the Cyber Security and Resilience Bill is recorded as not yet in force. Canada gains the Critical Cyber Systems Protection Act enacted by Bill C-8, with its 72-hour incident report to the Communications Security Establishment, and the lapsed Bill C-27 is replaced by Bill C-36. Australia gains the Enhanced Critical Infrastructure Risk Management Program Rules and their supply-chain mapping obligation, the most specific such requirement in the registry. Japan's active-cyber-defence legislation is corrected to the 2025 Acts and the 2026 APPI amendment is recorded. CSA CCM is updated to v4.1.
+
+The `security-maturity-tiers` skill carries a refreshed threat review. Its MVP tier adds an inventory step for self-hosted LLM gateways and flow builders, a product class that has produced repeated KEV-listed pre-authentication remote code execution against default deployments, and the tier's completion criterion now requires that none be reachable from the internet. The US federal remediation baseline is updated: CISA BOD 26-04 replaced BOD 22-01's uniform KEV due dates with risk-tiered ones, so the framework-lag table records a 3-day top band against the tier's hours-scale live-patch prescription. EU CRA dates are corrected — Annex I product requirements apply from 2027-12-11, while Art. 14 reporting starts 2026-09-11 — and the EU AI Act Art. 15 row reflects the deferral, with the tier's rationale sharpened: the obligation does not bind for another 16 to 24 months while the attack surface is live today. Post-quantum TLS now cites RFC 9954 and notes that X25519MLKEM768 is offered by default from OpenSSL 3.5 onward, making the Practical-tier step a version upgrade and a config assertion rather than a migration project.
+
+RFC 9954 (Hybrid Key Exchange in TLS 1.3, Informational, July 2026) is now carried in the offline RFC catalog, so `exceptd rfc 9954` resolves without network access instead of reporting an unknown reference. Its predecessor `draft-ietf-tls-hybrid-design` records the transition rather than still describing itself as queued for a number, and `pqc-first` no longer describes the hybrid construction as a draft — while noting that `draft-ietf-tls-ecdhe-mlkem`, the Standards-Track profile naming the concrete groups, remains one, so the construction reaching RFC status does not standardise the named groups.
+
+Both skills gain a Defensive Countermeasure Mapping section routing each finding to a D3FEND technique and the downstream skill that owns its implementation, and both now declare the D3FEND catalog and the techniques they cite so the mappings reach the index and cross-reference surfaces rather than reporting zero.
+
+## 0.18.27 — 2026-07-30
+
+CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (823 → 923), covering additions to the CISA Known Exploited Vulnerabilities catalog from March through August 2023 (plus four July 2026 additions) and spanning CVE publication years 2004 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch centers on the 2023 mass-exploitation wave against file-transfer, email-security, and enterprise-edge infrastructure — the Progress MOVEit Transfer SQL-injection abused by Cl0p in the largest data-theft campaign of the year (CVE-2023-34362), the Barracuda Email Security Gateway command injection exploited by UNC4841 (CVE-2023-2868), the PaperCut MF/NG authentication-bypass RCE used by Cl0p and LockBit affiliates (CVE-2023-27350), the Adobe ColdFusion access-control and deserialization chain (CVE-2023-26359, CVE-2023-26360, CVE-2023-29298, CVE-2023-38205), the Ivanti EPMM/MobileIron authentication bypass and Sentry chain (CVE-2023-35078, CVE-2023-35081, CVE-2023-38035), the Citrix ShareFile storage-zones RCE (CVE-2023-24489), the Oracle WebLogic deserialization RCE (CVE-2023-21839), the Zyxel firewall command injection recruited into Mirai (CVE-2023-28771), and the VMware Aria/Tools flaws tied to UNC3886 (CVE-2023-20867, CVE-2023-20887). It also covers client and mobile exploitation heavily used by commercial-spyware and state actors — the Apple "Operation Triangulation" kernel flaw and the June-2023 iOS WebKit/kernel zero-day chain (CVE-2023-38606, CVE-2023-37450, CVE-2023-32409, CVE-2023-32434, CVE-2023-32435, CVE-2023-32439, CVE-2023-28204, CVE-2023-32373), the Microsoft Outlook NTLM-relay privilege escalation used by APT28/Forest Blizzard (CVE-2023-23397), the Microsoft Office RCE deployed by Storm-0978/RomCom (CVE-2023-36884) and the Windows SmartScreen bypass used by Magniber (CVE-2023-24880), the Samsung mobile-chipset chain surfaced in spyware exploitation (CVE-2021-25487, CVE-2021-25489, CVE-2021-25394, CVE-2021-25395, CVE-2021-25371, CVE-2021-25372), the Arm Mali GPU kernel driver flaws chained in Android spyware (CVE-2022-22706, CVE-2022-38181, CVE-2021-29256, CVE-2023-26083), and multiple Google Chrome V8 and Skia zero-days (CVE-2023-2033, CVE-2023-3079, CVE-2023-2136). A long tail of internet-facing devices recruited into botnets rounds out the set — TP-Link Archer (CVE-2023-1389), Ruckus wireless (CVE-2023-25717), D-Link routers (CVE-2019-17621, CVE-2019-20500), the end-of-life Zyxel P660HN (CVE-2017-18368), SolarView Compact (CVE-2022-29303) — alongside the Ignite Realtime Openfire path traversal mined by Kinsing (CVE-2023-32315), the Veeam Backup & Replication credential disclosure (CVE-2023-27532), the Samba "SambaCry" RCE (CVE-2017-7494), the Apache Log4j 2.15 follow-up (CVE-2021-45046), and older but still-exploited Linux privilege escalations and Cisco IOS flaws. Two weakness classes backing these entries are new to the CWE catalog: CWE-294 (authentication bypass by capture-replay, the mechanism behind the Outlook NTLM-relay flaw) and CWE-401 (missing release of memory after effective lifetime).
+
 ## 0.18.26 — 2026-07-22
 
 Every CVE in the offline catalog now declares a framework-control-gap statement for all five jurisdiction buckets — NIST, EU (NIS2/DORA), UK (CAF), AU (Essential 8/ISM), and ISO 27001:2022. Previously two-thirds of the catalog mapped only a subset, so operators subject to multiple regimes reading the framework-gap output got US- or EU-centric coverage on most entries. The remaining partial entries have been completed with vulnerability-specific gap statements — each tied to that CVE's own exploitation profile (exploitation window, attack vector, end-of-life status, blast radius) and resolving to a real control in the framework-control-gap catalog — bringing the whole catalog to full multi-jurisdiction coverage. A new predeploy gate enforces this, so a newly-curated CVE can no longer ship with a partial jurisdiction set.

package/README.md

@@ -30,7 +30,7 @@ This platform surfaces what is actually happening right now. Every skill explici
 
 ## Status
 
-Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 819 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
+Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 923 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
 
 ---
 

package/bin/exceptd.js

@@ -7209,9 +7209,13 @@ function cmdDoctor(runner, args, runOpts, pretty) {
         }
       }
       if (parsed && Array.isArray(parsed.currency_report)) {
-        const stale = parsed.currency_report.filter(s => s.action_required || s.currency_label !== "current");
-        const critical = parsed.currency_report.filter(s => s.currency_score !== undefined && s.currency_score < 50);
-        const ok = stale.length === 0 && !parsed.action_required;
+        // Severity tracks the scoring model's own tiers; see
+        // lib/currency-severity.js for why the drift tier warns instead of
+        // failing. Extracted so the tier boundary is testable without a
+        // manifest whose dates move under the test.
+        const { classifyCurrency } = require(path.join(PKG_ROOT, "lib", "currency-severity.js"));
+        const { ok, severity, stale, drifting, actionable, critical } =
+          classifyCurrency(parsed.currency_report, parsed.action_required);
         // Audit 3 B.7: surface the freshest + stalest last_threat_review
         // so operators can answer "is my data stale?" without parsing the
         // full report. Falls back gracefully when the upstream report
@@ -7223,8 +7227,14 @@ function cmdDoctor(runner, args, runOpts, pretty) {
         const minDaysSince = dates.length ? Math.floor((Date.now() - new Date(dates[0]).getTime()) / 86400000) : null;
         checks.currency = {
           ok,
+          // Drift with nothing past its review window is advisory: bucket it
+          // as a warning so `all_green:false` still surfaces it while the
+          // exit code stays 0 (same contract the registry check uses).
+          ...(severity ? { severity } : {}),
           total_skills: parsed.currency_report.length,
           stale_skills: stale.map(s => s.skill),
+          drifting_skills: drifting.map(s => s.skill),
+          action_required_skills: actionable.map(s => s.skill),
           critical_stale: critical.map(s => s.skill),
           critical_count: parsed.critical_count || 0,
           oldest_last_threat_review: dates[0] || null,
@@ -7956,11 +7966,18 @@ function cmdDoctor(runner, args, runOpts, pretty) {
       ? `skill signatures verified (${c.skills_passed ?? "?"}/${c.skills_total ?? "?"})`
       : `skill signatures FAILED (exit=${c.exit_code ?? "?"})`
   );
-  mark(checks.currency, c =>
-    c.ok
-      ? `skill currency: all green (${c.total_skills ?? "?"} skills)`
-      : `skill currency: ${c.stale_skills?.length || "?"} stale, ${c.critical_count ?? 0} critical`
-  );
+  mark(checks.currency, c => {
+    // Three states, not two: the drift tier renders under a [!! warn] icon,
+    // so "all green" here would contradict the icon the way the signing
+    // check's text once did.
+    if (c.ok && c.severity === "warn") {
+      const n = c.drifting_skills?.length ?? "?";
+      const names = (c.drifting_skills || []).join(", ");
+      return `skill currency: ${n} approaching review window${names ? ` (${names})` : ""}, 0 past it`;
+    }
+    if (c.ok) return `skill currency: all green (${c.total_skills ?? "?"} skills)`;
+    return `skill currency: ${c.action_required_skills?.length ?? c.stale_skills?.length ?? "?"} past review window, ${c.critical_count ?? 0} critical`;
+  });
   mark(checks.cves, c => {
     if (!c.ok) return `CVE catalog FAILED (exit=${c.exit_code ?? "?"})`;
     const total = c.total ?? "?";

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-07-23T13:14:46.671Z",
+  "generated_at": "2026-08-06T01:23:34.879Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "4207cec11036cf109667a54673ac7de7aa7ef4110a3193a09c0879699c64369f",
-    "README.md": "71a9a2a74d6da9508da6c9b2027a17d5e60869d124cfbe194f094667766da14d",
+    "manifest.json": "b33b921f81ee69e65fcc3cda6480e50e726c3a1846817e7409ed2f5d63178d6c",
+    "README.md": "2d2f4ac4e7934e730fc88502b6f19c986c1a059dbae1eb3b5c3f672b9e0a4d7a",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "15110923850a8873f41d4d85612a63736279389b9567b1446dd88b8398f73457",
-    "data/cve-catalog.json": "662031d56c6ab7364328176339ae8f474c6312f288ca3d5154c8c31c7f5c86dd",
-    "data/cwe-catalog.json": "7c91d37ee96dea56047a368c6ca86399ef2c3d92385019f94a3613a0c257e634",
-    "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
+    "data/attack-techniques.json": "0f9d29c33502294e383da8c747d491ee972d1d6923695cecd110e8c9f6d53522",
+    "data/cve-catalog.json": "85afca7bff24a802ddd15b3b9f3b0951c35ab3232e79307718e6bad1d6f75c4c",
+    "data/cwe-catalog.json": "2075d9e36a95656817389ae5cc671ddc396ac532077a3b1c2eda20730c93c87d",
+    "data/d3fend-catalog.json": "64d4d2c187aa0c1f308b982da7f7fb68ebe8207ec0c4baf983c407f3ad0afd0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "f0bfc430eebdc5818179805f73b236fbbbc73763e5f11c4905aade9cacd41fd4",
+    "data/framework-control-gaps.json": "2490bffb1511f5157de8c8894267c509e6e8e27cd40e47df455f7550c06de866",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
-    "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "1712c3efebbe89e387105575be739ece9ac500a91b46fdd2b45c78f15ec5746b",
+    "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
+    "data/zeroday-lessons.json": "5d293b1e2240dd40df948cb8fe40fd4637cda8d625a3b29d1d2731f36cbcbdf4",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
     "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -27,11 +27,11 @@
     "skills/ai-c2-detection/skill.md": "6503b57a793885b73aabfef6d336fd2717af33b1228571a2fb732dc9f5f475dc",
     "skills/policy-exception-gen/skill.md": "4c368d05875cbb4a7f008e627a7452a176db21b9ac5f08f813ac8007ddd17bbc",
     "skills/threat-model-currency/skill.md": "11be4c065cab1bdd5230b03869850651b61478aa8fd690ca47373bcf205af5f6",
-    "skills/global-grc/skill.md": "8d1dfbae79153d403d543b3481f463260a89a35d068db0fa9eeda21c01c78e09",
+    "skills/global-grc/skill.md": "cbbc37475a6bfabde26ee0f064bb853088d4e004691af92d6fa007f6bfb8ddfd",
     "skills/zeroday-gap-learn/skill.md": "b9216006195d7db2e2f66e55b8b9e99702c7e6a36100dea641709101027b2825",
-    "skills/pqc-first/skill.md": "803b3dc39eba4caa4f08980806b5fd02fb20b3655625cf014adccd85e4320e16",
+    "skills/pqc-first/skill.md": "794e53921d5d8b0bfcd512f6c28b1fecf2ef3bb5a9ccd83826bb0b79cae4aef4",
     "skills/skill-update-loop/skill.md": "fbcc0786ebbc2d2735944269f82ded10affd9f4efa29c2f6cdc4c283024837de",
-    "skills/security-maturity-tiers/skill.md": "7b8c0b3d5924b57a1bf6bb61faf23a0869ed034dcfcdf1b5fcb5566dac87ee6e",
+    "skills/security-maturity-tiers/skill.md": "708094f0ca32b33cf8593a29f3d6f9c63f1b6421233c5d5bfe8039de56bc85aa",
     "skills/researcher/skill.md": "9f1211d177c64e4c465407a45ad9e2901c5c6c0af410a0d0a51cc8fb780420d4",
     "skills/attack-surface-pentest/skill.md": "5b1f96ae23825c0a1eb77d2ede29143308b7219e10f99c5b657fb6f788fad3b8",
     "skills/fuzz-testing-strategy/skill.md": "632b4004ae953fbea3ede136557dc044395ea8aa7b49b220e7d1e5d0c5cb676f",
@@ -93,21 +93,21 @@
   "index_stats": {
     "xref_entries": {
       "cwe_refs": 53,
-      "d3fend_refs": 22,
+      "d3fend_refs": 27,
       "framework_gaps": 96,
       "atlas_refs": 10,
       "attack_refs": 51,
-      "rfc_refs": 35,
+      "rfc_refs": 36,
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 810,
-    "chains_cwe_entries": 218,
+    "chains_cve_entries": 910,
+    "chains_cwe_entries": 220,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,
     "section_offsets_skills": 51,
-    "token_budget_total_approx": 436045,
+    "token_budget_total_approx": 441982,
     "recipes": 8,
     "jurisdiction_clocks": 29,
     "did_ladders": 8,

package/data/_indexes/activity-feed.json

@@ -6,28 +6,57 @@
   },
   "events": [
     {
-      "date": "2026-07-22",
+      "date": "2026-08-05",
+      "type": "skill_review",
+      "artifact": "global-grc",
+      "path": "skills/global-grc/skill.md",
+      "note": "Multi-jurisdiction GRC mapping — EU (GDPR/NIS2/DORA/EU AI Act/CRA), UK, AU, SG, JP, IN, CA, ISO 27001:2022, CSA CCM v4"
+    },
+    {
+      "date": "2026-08-05",
+      "type": "skill_review",
+      "artifact": "pqc-first",
+      "path": "skills/pqc-first/skill.md",
+      "note": "Post-quantum cryptography first mentality — hard version gates, algorithm sunset tracking, loopback learning for NIST/IETF standards evolution"
+    },
+    {
+      "date": "2026-08-05",
+      "type": "skill_review",
+      "artifact": "security-maturity-tiers",
+      "path": "skills/security-maturity-tiers/skill.md",
+      "note": "Three-tier implementation roadmap — MVP you can ship today, practical best practices useable now, overkill gold standard for defense-in-depth"
+    },
+    {
+      "date": "2026-08-05",
       "type": "catalog_update",
-      "artifact": "data/cve-catalog.json",
-      "path": "data/cve-catalog.json",
+      "artifact": "data/rfc-references.json",
+      "path": "data/rfc-references.json",
       "schema_version": "1.0.0",
-      "entry_count": 823
+      "entry_count": 8889
     },
     {
-      "date": "2026-07-22",
+      "date": "2026-07-30",
       "type": "catalog_update",
-      "artifact": "data/zeroday-lessons.json",
-      "path": "data/zeroday-lessons.json",
-      "schema_version": "1.1.0",
-      "entry_count": 823
+      "artifact": "data/cve-catalog.json",
+      "path": "data/cve-catalog.json",
+      "schema_version": "1.0.0",
+      "entry_count": 923
     },
     {
-      "date": "2026-07-18",
+      "date": "2026-07-30",
       "type": "catalog_update",
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 218
+      "entry_count": 220
+    },
+    {
+      "date": "2026-07-22",
+      "type": "catalog_update",
+      "artifact": "data/zeroday-lessons.json",
+      "path": "data/zeroday-lessons.json",
+      "schema_version": "1.1.0",
+      "entry_count": 923
     },
     {
       "date": "2026-07-03",
@@ -107,13 +136,6 @@
       "path": "skills/zeroday-gap-learn/skill.md",
       "note": "Run the zero-day learning loop — CVE to attack vector to control gap to framework gap to new control requirement"
     },
-    {
-      "date": "2026-06-10",
-      "type": "skill_review",
-      "artifact": "pqc-first",
-      "path": "skills/pqc-first/skill.md",
-      "note": "Post-quantum cryptography first mentality — hard version gates, algorithm sunset tracking, loopback learning for NIST/IETF standards evolution"
-    },
     {
       "date": "2026-06-10",
       "type": "skill_review",
@@ -332,14 +354,6 @@
       "path": "skills/privacy-consent-ops/skill.md",
       "note": "Privacy, consent, and sanctions operational integrity for mid-2026 — confusable/homoglyph normalization before sanctions screening, integrity-bound and re-validated consent records, evidence-gated and downstream-propagated DSR erasure, and ROPA reconciliation against actual processing"
     },
-    {
-      "date": "2026-05-27",
-      "type": "catalog_update",
-      "artifact": "data/rfc-references.json",
-      "path": "data/rfc-references.json",
-      "schema_version": "1.0.0",
-      "entry_count": 8888
-    },
     {
       "date": "2026-05-19",
       "type": "catalog_update",
@@ -442,20 +456,6 @@
       "path": "data/dlp-controls.json",
       "schema_version": "1.0.0",
       "entry_count": 22
-    },
-    {
-      "date": "2026-05-01",
-      "type": "skill_review",
-      "artifact": "global-grc",
-      "path": "skills/global-grc/skill.md",
-      "note": "Multi-jurisdiction GRC mapping — EU (GDPR/NIS2/DORA/EU AI Act/CRA), UK, AU, SG, JP, IN, CA, ISO 27001:2022, CSA CCM v4"
-    },
-    {
-      "date": "2026-05-01",
-      "type": "skill_review",
-      "artifact": "security-maturity-tiers",
-      "path": "skills/security-maturity-tiers/skill.md",
-      "note": "Three-tier implementation roadmap — MVP you can ship today, practical best practices useable now, overkill gold standard for defense-in-depth"
     }
   ]
 }

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-22",
+      "last_updated": "2026-07-30",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,20 +62,20 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 823,
+      "entry_count": 923,
       "sample_keys": [
-        "CVE-2024-27198",
-        "CVE-2024-23225",
-        "CVE-2024-23296",
-        "CVE-2023-21237",
-        "CVE-2021-36380"
+        "CVE-2025-68686",
+        "CVE-2026-16812",
+        "CVE-2026-16232",
+        "CVE-2026-50522",
+        "CVE-2023-32315"
       ]
     },
     "cwe-catalog.json": {
       "path": "data/cwe-catalog.json",
       "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-18",
+      "last_updated": "2026-07-30",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 218,
+      "entry_count": 220,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -207,7 +207,7 @@
       "path": "data/rfc-references.json",
       "purpose": "IETF RFCs + active Internet-Drafts cited by skills (TLS, IPsec, PQ crypto migration, HTTP/3, CT). Cross-validated against IETF Datatracker via validate-rfcs.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-05-27",
+      "last_updated": "2026-08-05",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -216,7 +216,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 8888,
+      "entry_count": 8889,
       "sample_keys": [
         "RFC-4301",
         "RFC-4303",
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 823,
+      "entry_count": 923,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",