@blamejs/exceptd-skills 0.18.26 → 0.18.28

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:17a665c7-0250-4aa5-a6f8-3fc5f08db9f8",
+  "serialNumber": "urn:uuid:7f58a137-7f00-4f3c-8ec3-33af958a0331",
   "version": 1,
   "metadata": {
-    "timestamp": "2038-07-29T08:56:39.000Z",
+    "timestamp": "2093-09-14T04:21:11.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.18.26"
+        "version": "0.18.28"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.26",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.28",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.18.26",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (823 CVEs / 218 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.18.28",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (923 CVEs / 220 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.26",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.28",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3e96aad34572b9d0bd661caddf3365a2381b47204d75450962dd869573164841"
+          "content": "e745ab417f9a592f3b8537cddc401104b118182490cca087be547ef21ddc1944"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.26"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.28"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ec67d2c158d8a12f3109b8095d9e4f6b1c806e1139ec40f475d605a34faf39b1"
+          "content": "655ac010329753b78843c66f95c548d2ecc79c651aa935bd04775fa24dd1977a"
         },
         {
           "alg": "SHA3-512",
-          "content": "fcd1c4b9f2790011111926b9be44178565bf4252fa77f62f3e4ed66249b489c437f4c5ee27ef14daa4a314d16fd75010a317d21bdcda40459fe2a9e8bfa88334"
+          "content": "68f2c7ccd8ce491f582f306d501fee07c01c550b6b59d7c9d5cb618f5352a657afeeb32f0a41432c58b2ba26340105949326e2a0eebb067f2c57b35de4e4b1d5"
         }
       ]
     },
@@ -176,11 +176,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "71a9a2a74d6da9508da6c9b2027a17d5e60869d124cfbe194f094667766da14d"
+          "content": "2d2f4ac4e7934e730fc88502b6f19c986c1a059dbae1eb3b5c3f672b9e0a4d7a"
         },
         {
           "alg": "SHA3-512",
-          "content": "c4275a8933990ff7860cb8025379c033200a570bb58a3a04f4736f2159fb8bae63f6369fdaefac5b26fb0038f06f5bc0d917e1f8be46623d765dc2c7bf02af9f"
+          "content": "63b05bfbf5bcbd86aaab66ddb766f7bb3d37212d137606b003d63d755979c99ef2fe396e6635466b69b8eae5ffb589bdf268c0add915913db40abf8a270179ec"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3cdb0ad9cb9b2ef36424d9a20df0e03fc44e53128ceee244042c7bf5c28c22b8"
+          "content": "6883befd805e9af371b147672c754aaa11b639e50fba0f7d025064ce2039126a"
         },
         {
           "alg": "SHA3-512",
-          "content": "b218e2778147802babe9796d2de3efc265af11bdac570ad2ac7dc842fa8f92e99eb6f3e31191fc9962b8cce54940a5937c7327782c0b32d6a2ac7d6b1c624a1a"
+          "content": "115fc6de47b61b3efd9ea3fb3bc0679edfaf82644a279d0baa888610d22af88ed062572b4caa5dbd4defb441bf1910d0b0c5f341cdfc96fb807641535f1fe703"
         }
       ]
     },
@@ -311,11 +311,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "15110923850a8873f41d4d85612a63736279389b9567b1446dd88b8398f73457"
+          "content": "0f9d29c33502294e383da8c747d491ee972d1d6923695cecd110e8c9f6d53522"
         },
         {
           "alg": "SHA3-512",
-          "content": "8e99a9a2733aebd96f8e363a20dbc4cbc52f714bac65601a982b3992e0e9e2d50ab3d95b2a1e189bf9782ecb070c535be838d44a1bf3759ff7f18f2babb7f18d"
+          "content": "84ed8fdc995899f7699474b0b676ffcafd21d82ec7a371e78d9ab4ef05ca7d5ceb46f4192e4aa2b57764c494f661d8b59c9f16d7032f32b3a42c1bfe9e011dd4"
         }
       ]
     },
@@ -326,11 +326,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "662031d56c6ab7364328176339ae8f474c6312f288ca3d5154c8c31c7f5c86dd"
+          "content": "85afca7bff24a802ddd15b3b9f3b0951c35ab3232e79307718e6bad1d6f75c4c"
         },
         {
           "alg": "SHA3-512",
-          "content": "ff261e1f0b867a25162d45d54a4ae078a131af011364dcc5894244a1f5a3bd1c804ce08389d695638fd60501b4f62b8f2227edbfbc949db80e6abecc6f42e863"
+          "content": "43c798823290f3188cd51aec2478716a0300e4acacac3b4573d48d26f8692f883bbea3b88944aded39c83648a7098bfce5484d0fa199cf361754718904942998"
         }
       ]
     },
@@ -341,11 +341,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7c91d37ee96dea56047a368c6ca86399ef2c3d92385019f94a3613a0c257e634"
+          "content": "2075d9e36a95656817389ae5cc671ddc396ac532077a3b1c2eda20730c93c87d"
         },
         {
           "alg": "SHA3-512",
-          "content": "0b7bdfd5ceb6f21d40e5e864aa6a6383e060e5d2fa223696682fa83a60106d39ad3e6d4bd983db44cf7f78b199c04ef99493cb61f0a13108f0b5886af05cfd4f"
+          "content": "b088003edab3e9c3b166e73a9e4c069f19d3a364f223ac24c6918d2f4b2fe82d3eff78993024aa899be023b7694dea657d5b3e5aa6416b561ef9c7de6c0a62e3"
         }
       ]
     },
@@ -356,11 +356,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d"
+          "content": "64d4d2c187aa0c1f308b982da7f7fb68ebe8207ec0c4baf983c407f3ad0afd0d"
         },
         {
           "alg": "SHA3-512",
-          "content": "2152a8a3859d21a421e3e3322b5f002a89a6f8af2bb25259d5b1b9fb178a24c15c28a2ad5cbcd03b29fabfbbd88972386d453ecafb8f2381135df9228837ca0e"
+          "content": "20a30a23503dde65073af300adf1a2deeee8fd0e6d5e8400f0e8e0033e9d679be079383a45347f74590a3b8ecb4ec191a786e5c42bb5825808cf266af1c62d40"
         }
       ]
     },
@@ -401,11 +401,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f0bfc430eebdc5818179805f73b236fbbbc73763e5f11c4905aade9cacd41fd4"
+          "content": "2490bffb1511f5157de8c8894267c509e6e8e27cd40e47df455f7550c06de866"
         },
         {
           "alg": "SHA3-512",
-          "content": "b387ab676625be6a74f87f637bd54ed12d585f639ae5eef1e4298d81ccf6025a4a79f62c3a012fc02a112cd537ffb548abfe9669426d56f6feec67b4af77e68d"
+          "content": "2c9ae8142c741e1109456597743ebba2eb1c6c7c5394df362fe8df34a2571054b108a085db1791db2f62a59559297cab373988681b6e839985a95261a8c33715"
         }
       ]
     },
@@ -926,11 +926,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac"
+          "content": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a"
         },
         {
           "alg": "SHA3-512",
-          "content": "93ee274979c14a6869359e434677396b3157470460bd9c3ef3091573d5c60e208f4600a526ff1404e224844bc2fc734f3db67217d57c8ec8ce728ea7c5240027"
+          "content": "65abfd494118d6fd71a35c18b820a12adc49a6b557f838af816b2b34909ac37321644f485538c1bff3f0997717899e8a999781d84c7fcce3da3dc05f3f8bec64"
         }
       ]
     },
@@ -941,11 +941,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1712c3efebbe89e387105575be739ece9ac500a91b46fdd2b45c78f15ec5746b"
+          "content": "5d293b1e2240dd40df948cb8fe40fd4637cda8d625a3b29d1d2731f36cbcbdf4"
         },
         {
           "alg": "SHA3-512",
-          "content": "6b230aa4fdcaec9596381e6c904def8971ff42c79294e2228a655ec74caba3069407b177f9ff766865120c1f04658df6b66f05bb23bf1eacb03b1fee4585d805"
+          "content": "c8cc13f057f5f19a3aaeb275bbc99b290d203e8e36791bb8a41ef49a9584382c2766f66e521fca2c2160c9ebecd7cbd98dda7552cca13d60e1c3a8563835e79f"
         }
       ]
     },
@@ -1279,6 +1279,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:lib/currency-severity.js",
+      "type": "file",
+      "name": "lib/currency-severity.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "dce717b9e1b898a98184152a119d5c21dd83ea1456932cb2243ec039253082d7"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "91e758eeb15588f2a3ed354291148340f48283322b0a6a2925961b5be13b003f21fa60bc8829b52ea820b11bc0e1bbbd6125ad74eabd4fd4817863706a281030"
+        }
+      ]
+    },
     {
       "bom-ref": "file:lib/cve-batch.js",
       "type": "file",
@@ -1931,11 +1946,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4207cec11036cf109667a54673ac7de7aa7ef4110a3193a09c0879699c64369f"
+          "content": "b33b921f81ee69e65fcc3cda6480e50e726c3a1846817e7409ed2f5d63178d6c"
         },
         {
           "alg": "SHA3-512",
-          "content": "615a770c6beb260fd421102be17f99439f4c4364cf4d175dde74fc422a62cdcdc3d93713226c6bdfce5a73c945ed9c04206afe93e57e9c69c6cfc22a7b4f3534"
+          "content": "b14b967f743c8788e0cba1f8a9b62a8d0314c24550e6b7937cb7b0a013aa8e512a49206154d2473b12a0eed11d2138a6381989c94028059263567184147a3f5f"
         }
       ]
     },
@@ -3086,11 +3101,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8d1dfbae79153d403d543b3481f463260a89a35d068db0fa9eeda21c01c78e09"
+          "content": "cbbc37475a6bfabde26ee0f064bb853088d4e004691af92d6fa007f6bfb8ddfd"
         },
         {
           "alg": "SHA3-512",
-          "content": "eb070623b32a28af5bf7a0e98e29b33d072b2181f50a0a6ab5248bb5cfda4e40a13a049c198316b26362e8157c9b2f8faad555ac211bee1e755022ae3f61ba4a"
+          "content": "2b06acd53d172d19616c482bd7793d3e53ca746aa94acadea3d725fa458b12ea9d6d735face129fbfa30b6430a07366c362555d23810bdd1c4423b507186bd6d"
         }
       ]
     },
@@ -3281,11 +3296,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "803b3dc39eba4caa4f08980806b5fd02fb20b3655625cf014adccd85e4320e16"
+          "content": "794e53921d5d8b0bfcd512f6c28b1fecf2ef3bb5a9ccd83826bb0b79cae4aef4"
         },
         {
           "alg": "SHA3-512",
-          "content": "025bf8e7799ddf6f08cb31b33762c9ac8df18a8b020be5e22ed2742c136ea7d99eba1c6151dad725ac70cc18f9d4bc4b04e6c1af3760bee9e5f55acfe3a06bb8"
+          "content": "9492d541e50d697339ab2bf47170258cb728a5e2381d1b446ec6bb8a21cddad456ca2f34edef0c4ef58f1aa677ba2371a9df46b2d0daa3f78a53f220ec16635a"
         }
       ]
     },
@@ -3431,11 +3446,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7b8c0b3d5924b57a1bf6bb61faf23a0869ed034dcfcdf1b5fcb5566dac87ee6e"
+          "content": "708094f0ca32b33cf8593a29f3d6f9c63f1b6421233c5d5bfe8039de56bc85aa"
         },
         {
           "alg": "SHA3-512",
-          "content": "5be074731437bfebe71b3248120a65235f439fda39e30d207ad95a39eae3f32a3b66f5796fd776daafd839d2c8f9538447873d100b80dd66f294c9f477fb2c97"
+          "content": "486b3df1f3e6856379c9696df4fed220e4d1ddfb32bb06aa38b56cca1fb5ec22bd7a6ad7f7d55bc680b7fff293d96922591aa6ecc2deb8be59ff42b4887311c3"
         }
       ]
     },

package/skills/global-grc/skill.md

@@ -18,13 +18,28 @@ triggers:
   - global compliance
 data_deps:
   - atlas-ttps.json
+  - d3fend-catalog.json
   - exploit-availability.json
   - framework-control-gaps.json
   - global-frameworks.json
 atlas_refs: []
 attack_refs: []
 framework_gaps: []
-last_threat_review: "2026-05-01"
+d3fend_refs:
+  - D3-EAL
+  - D3-EFA
+  - D3-FAPA
+  - D3-FE
+  - D3-IOPR
+  - D3-KBPI
+  - D3-MENCR
+  - D3-MFA
+  - D3-NI
+  - D3-NTA
+  - D3-OTF
+  - D3-SCA
+  - D3-CSPP
+last_threat_review: "2026-08-05"
 ---
 
 # Global GRC Assessment
@@ -113,10 +128,20 @@ Art. 32 is intentionally technology-neutral. For 2026 threat reality, DPAs (part
 
 ---
 
-#### EU AI Act (2024/1689) — Fully Applicable August 2026
+#### EU AI Act (2024/1689, amended by Regulation (EU) 2026/1744) — staged application through 2028
+
+**Application timeline** (Art. 113 as amended by the Digital Omnibus on AI, in force 2026-07-27):
+- 2025-02-02 — Chapters I–II: prohibitions (Art. 5) and AI literacy
+- 2025-08-02 — GPAI model obligations (Chapter V), governance, penalties regime
+- 2026-08-02 — general application date: Art. 50 transparency obligations bind, and the Commission / AI Office holds supervision and enforcement powers over GPAI model providers
+- 2026-12-02 — new Art. 5(1)(ba)/(bb) prohibitions; Art. 50(2) compliance deadline for systems placed on the market before 2026-08-02
+- **2027-12-02 — Chapter III Sections 1–3 (high-risk requirements, including Art. 9 risk management and Art. 15 cybersecurity) for Annex III / Art. 6(2) systems**
+- **2028-08-02 — Chapter III Sections 1–3 for Annex I / Art. 6(1) product-embedded systems**
+
+The high-risk obligations below are therefore 16 months (Annex III) to 24 months (Annex I) away. Do not scope remediation against an August 2026 high-risk deadline — and do not read the deferral as a withdrawal, because the attack surface those obligations address is live now.
 
 **Risk tiers for AI systems:**
-- **Unacceptable risk** (Art. 5): Prohibited (social scoring, real-time biometric identification in public, etc.)
+- **Unacceptable risk** (Art. 5): Prohibited (social scoring, real-time remote biometric identification in publicly accessible spaces for law enforcement, etc.). Two prohibitions added by Regulation (EU) 2026/1744 apply from 2026-12-02: Art. 5(1)(ba), AI systems generating or manipulating non-consensual intimate imagery of an identifiable person; Art. 5(1)(bb), AI systems generating or manipulating child sexual abuse material within the meaning of Directive 2011/93/EU. Unlike the Chapter III deferral these are near-term, and they carry Art. 99 penalties.
 - **High risk** (Annex III): Critical infrastructure, biometric, employment, education, law enforcement, etc.
 - **Limited risk** (Art. 50): Transparency obligations (chatbots must disclose they're AI)
 - **Minimal risk**: No specific requirements
@@ -146,6 +171,11 @@ Art. 9 requires identifying reasonably foreseeable misuse. For any high-risk AI
 - Limited attack surface
 - Security updates for the support lifetime
 
+**Manufacturer reporting obligations (Art. 14) — apply from 2026-09-11:**
+- Actively exploited vulnerabilities and severe incidents affecting the security of a product with digital elements must be reported: **24-hour** early warning, **72-hour** full notification, final report within **14 days** of a corrective measure becoming available (actively exploited vulnerability) or **one month** (severe incident).
+- Filed once through the CRA Single Reporting Platform to the CSIRT of the manufacturer's main establishment; ENISA receives it simultaneously.
+- The statutory trigger is *actively exploited* — Art. 14(1) covers a vulnerability the manufacturer becomes aware of being actively exploited in its product. Test it against `active_exploitation: confirmed` for a version of the product the manufacturer actually ships, not against proof-of-concept availability. A public PoC is exploit *capability*, not exploitation, and does not start the clock; KEV listing is strong evidence of active exploitation but is scoped to CISA's own affected-product determination, so it still needs applicability confirmed against the manufacturer's shipped versions. The catalog tracks `poc_available`, `cisa_kev` and `active_exploitation` as separate fields precisely because collapsing them here would tell a manufacturer a statutory clock is running when it is not. The Annex I product requirements themselves apply from 2027-12-11.
+
 **CRA relevance to 2026 threats:**
 - MCP servers distributed as software products fall under CRA if sold to EU market
 - "No known exploitable vulnerabilities" requirement means MCP servers must have a coordinated disclosure and patch process
@@ -181,7 +211,15 @@ Art. 9 requires identifying reasonably foreseeable misuse. For any high-risk AI
 
 **CAF strength vs. 2026:** CAF Principle B6 (Vulnerability Management) and C1 (Security Monitoring) are principle-based, allowing more flexibility than control-based frameworks. An assessor applying CAF B6 can reasonably require CISA KEV-aligned response times. CAF C1 can be interpreted to require AI API behavioral monitoring.
 
-**CAF gap:** The principle-based approach requires assessors to interpret current threats into each principle. There is no NCSC-published CAF guidance specifically for AI attack surfaces as of mid-2026.
+**CAF currency (v4.0):** v4.0 is the current version and closed part of this gap. NCSC added a section on developing and maintaining software used in essential services securely, and improved AI-risk coverage across the framework. Principle B4 System Security now carries assessable automated-decision-making outcomes: B4.a requires designed restrictions preventing actions by automated decision-making technologies that could adversely affect the systems supporting an essential function, and B4.b requires their operation to be well understood and their decisions replicable. B4 cites ETSI *Securing Artificial Intelligence (SAI): Baseline Cyber Security Requirements for AI Models and Systems* as an external resource.
+
+**Residual CAF gap:** the outcomes are framed around "automated decision-making technologies", not around LLM-specific attack surfaces. No contributing outcome names prompt injection, MCP/agent tool trust boundaries, RAG pipeline integrity, or AI-as-C2, and the principle-based approach still leaves currency of interpretation to the individual assessor.
+
+#### Cyber Security and Resilience (Network and Information Systems) Bill — not yet in force
+
+Introduced to the House of Commons on 2025-11-12; through Lords stages during July 2026, with no Royal Assent as of 2026-08-05. It reforms the Network and Information Systems Regulations 2018 and is the UK's answer to the NIS2 divergence created at EU exit. Commencement is phased — some measures on or shortly after Royal Assent, others by secondary legislation.
+
+**Scoping consequence today:** a UK-regulated entity's obligations still flow from NIS 2018 plus sector regulators applying CAF v4.0. Do not model NIS2-equivalent duties into a UK gap analysis until commencement. Watch for the Royal Assent date, the commencement regulations, and whether the resulting incident-reporting clocks displace UK GDPR's 72h as the binding UK timeline.
 
 ---
 
@@ -221,6 +259,14 @@ Requires financial entities to maintain information security capabilities commen
 
 **CPS 234 + AI:** No specific guidance for AI/ML systems. "Commensurate with threats" requires current threat awareness — a CPS 234-compliant entity should be assessing AI attack surfaces as part of threat landscape monitoring.
 
+#### SOCI Act — Enhanced Critical Infrastructure Risk Management Program Rules 2026
+
+The Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (F2026L00701) were registered 2026-06-09, amending the CIRMP Rules (LIN 23/006) 2023. Enhanced CIRMP obligations apply to nine critical asset classes (broadcasting, DNS, electricity, energy market operators, freight infrastructure, freight services, gas, liquid fuel, water).
+
+**What is new:** s.10A requires a documented system or process for mapping the supply chain covering major suppliers and critical components — the most specific supply-chain-mapping obligation in this registry. s.8A(2)(b) makes unmitigated legacy, unsupported or obsolete technology an addressed hazard. s.9A addresses personnel hazards and access management.
+
+**Gap:** the instrument does not name artificial intelligence, machine learning, model providers or agent tooling. Australia therefore has a mandatory supplier-mapping obligation an assessor can reasonably extend to AI plugins and MCP servers, but no text requiring it.
+
 ---
 
 ### Singapore
@@ -259,7 +305,9 @@ Japan's national cybersecurity framework closely mirrors NIST CSF with adaptatio
 
 **Key gaps for 2026:** Japanese frameworks lag US equivalents by 12–18 months in AI-specific guidance. The METI AI Governance Guidelines (2023) address AI ethics and governance but not AI attack surfaces. No equivalent to EU AI Act security requirements in Japanese law as of mid-2026.
 
-**Active Cyber Defense Law (2024):** Japan enacted limited offensive cyber capability legislation — relevant for understanding Japan's cyber threat posture and incident response coordination.
+**Active cyber defence legislation (2025):** the Act on Prevention of Damage Caused by Unauthorised Acts against Critical Electronic Computers (Act No. 42 of 2025) and its implementing Act (No. 43 of 2025) passed the Diet on 2025-05-16 and were promulgated on 2025-05-23; commencement is phased by cabinet order. Relevant for understanding Japan's cyber posture, government access to communications information, and critical-infrastructure incident-response coordination — not a control framework in itself.
+
+**APPI amendment (promulgated 2026-07-17):** the Act partially amending the Act on the Protection of Personal Information passed the Diet on 2026-07-10 and was promulgated on 2026-07-17, commencing on a date set by cabinet order within two years; implementing ordinances and guidelines are pending. Headline changes: PPC power to impose surcharges where unlawful handling produced financial gain, an expanded suspension-of-use right covering personal information containing biometric data, and relaxed consent rules for third-party provision for statistical purposes. Nothing in it addresses AI attack surfaces — Japan's AI-security gap is unchanged — but the enforcement ceiling for a personal-data leak moves from guidance-and-order to monetary penalty once the commencement order is made.
 
 ---
 
@@ -299,9 +347,19 @@ Japan's national cybersecurity framework closely mirrors NIST CSF with adaptatio
 
 **B-10 + AI:** No specific AI guidance as of mid-2026. "Technology risk" is interpreted broadly enough to include AI systems. OSFI published draft AI guidance for consultation in 2025 — final guidance expected late 2026.
 
-#### Bill C-27 / CPPA (Consumer Privacy Protection Act) — Proposed
+#### Bill C-36 — Protecting Privacy and Consumer Data Act (proposed; supersedes the former Bill C-27 / CPPA)
+
+Bill C-27 (44th Parliament) did not pass. The current federal privacy bill is C-36 (45-1), first reading 2026-06-15, at second reading in the House of Commons. Nothing in it is in force. PIPEDA remains the operative federal private-sector privacy statute, with breach notification to the OPC "as soon as feasible" where there is a real risk of significant harm. Verify penalty and notification figures against the C-36 text before relying on them — the former C-27 numbers ($25M or 5%, 72 hours) do not carry over automatically.
+
+#### Critical Cyber Systems Protection Act (CCSPA) — enacted by Bill C-8, Royal Assent 2026-06-15
 
-Not yet in force as of mid-2026 (legislative delay). When enacted: 72-hour breach notification, $25M or 5% of global revenue penalties.
+**Scope:** designated operators of the vital services and vital systems listed in Schedule 1, by operator class in Schedule 2 (regulators include the Minister of Industry, the Minister of Transport, OSFI, the Bank of Canada, the Canadian Nuclear Safety Commission and the Canadian Energy Regulator). Schedules and regulations are set by the Governor in Council.
+
+**Key obligations:** establish and implement a cyber security programme; mitigate supply-chain and third-party product/service risks; report a cyber security incident affecting a critical cyber system to the Communications Security Establishment within a period prescribed by regulation, not to exceed 72 hours, then immediately notify the appropriate regulator and provide a copy; comply with cyber security directions.
+
+**Status:** the CCSPA comes into force by order in council — obligations bind once proclaimed and the regulations and schedules are made.
+
+**CCSPA + AI:** no AI-specific requirement. The supply-chain provision is product/service-generic and does not name AI tooling, model providers or MCP servers.
 
 ---
 
@@ -326,7 +384,7 @@ Not yet in force as of mid-2026 (legislative delay). When enacted: 72-hour breac
 
 #### CSA Cloud Controls Matrix (CCM) v4
 
-**17 domains, 197 control specifications.** Cloud-specific but applicable to any cloud-native or cloud-using organization.
+**17 domains, 207 control specifications (CCM v4.1, released 2026-01-27, superseding v4.0.x).** Cloud-specific but applicable to any cloud-native or cloud-using organization. v4.1 adds net-new controls in domains including Logging and Monitoring and Security Incident Management; the AI control surface remains in the separate AI Controls Matrix rather than in CCM core.
 
 **AI relevance:**
 - AIS domain (Application & Interface Security) covers some AI risk areas
@@ -367,6 +425,32 @@ These gaps exist across all 14 jurisdictions and both global standards:
 
 ---
 
+## Defensive Countermeasure Mapping
+
+D3FEND references from `data/d3fend-catalog.json`. This skill produces jurisdictional gap findings, not control prescriptions — its subject is which regulator requires what, and the answer for every row in the Universal Gaps table above is "none". A gap that no framework mandates still has a defensive technique that closes it; the mapping below routes each universal gap to that technique and to the downstream skill that owns the implementation guidance. Operators converting a gap into a remediation plan consume the cited downstream skill rather than reading the D3FEND ID in isolation, because that skill carries the AI-pipeline applicability notes, least-privilege scoping, and deployment posture.
+
+| Universal gap | Offensive TTP class | D3FEND ID | Defensive technique | Owning downstream skill |
+|---|---|---|---|---|
+| Prompt injection as access-control failure | AML.T0051 (LLM Prompt Injection) | `D3-IOPR` + `D3-CSPP` | Input/Output Profiling + Client-server Payload Profiling | `ai-attack-surface` |
+| MCP/agent tool trust boundaries | AML.T0010 (ML Supply Chain Compromise) | `D3-EAL` + `D3-EFA` | Executable Allowlisting + Executable File Analysis | `mcp-agent-trust` |
+| AI pipeline integrity (model versioning + behavioural regression) | AML.T0018 (Backdoor ML Model), AML.T0020 (Poison Training Data) | `D3-FAPA` + `D3-EFA` | File Access Pattern Analysis + Executable File Analysis | `mlops-security` |
+| AI-as-C2 detection | AML.T0096 (LLM Integration Abuse — C2) | `D3-NTA` + `D3-OTF` | Network Traffic Analysis + Outbound Traffic Filtering | `ai-c2-detection` |
+| Live kernel patching as required capability | T1068 (Exploitation for Privilege Escalation) | `D3-KBPI` + `D3-SCA` | Kernel-Based Process Isolation + System Call Analysis | `kernel-lpe-triage` |
+| CISA KEV-indexed patch SLAs | T1190 (Exploit Public-Facing Application) | `D3-NI` | Network Isolation for the unpatched window | `exploit-scoring` + `kernel-lpe-triage` |
+| AI-generated phishing detection update requirement | T1566 (Phishing), AML.T0016 (Develop Capabilities) | `D3-MFA` + `D3-CSPP` | Multi-factor Authentication (passkey class) + Client-server Payload Profiling | `email-security-anti-phishing` |
+| RAG pipeline security | AML.T0051, AML.T0020 | `D3-IOPR` + `D3-FAPA` | Input/Output Profiling + File Access Pattern Analysis | `rag-pipeline-security` |
+| Post-quantum cryptography migration mandate | T1040 (Network Sniffing), T1557 (Adversary-in-the-Middle) — harvest-now-decrypt-later | `D3-MENCR` + `D3-FE` | Message Encryption (PQC-hybrid KEM) + File Encryption (PQC-wrapped envelope) | `pqc-first` |
+
+**Defense-in-depth posture:** a jurisdictional gap finding from this skill closes only when the downstream skill's technique is deployed and tested — never when a policy document cites the regulation. Because no jurisdiction mandates any row above, there is no compliance-driven forcing function for these controls: an org that implements only what a regulator can cite will have none of them. That is the entire operational point of the Universal Gaps table, and the reason each row must carry a routing target.
+
+**Least-privilege scope:** the downstream-skill citation is the boundary. This skill does not re-scope D3FEND techniques per principal class; that scoping is owned by the cited downstream skill's own Defensive Countermeasure Mapping section, which is authoritative for principal-class breakdowns (human operator ≠ agent identity ≠ MCP server ≠ model-serving process).
+
+**Zero-trust posture:** jurisdiction is not a trust boundary. An entity established in a Member State that has not yet notified NIS2 transposition, or operating under a framework whose AI obligations are deferred to 2027–2028, faces the same attacker as one in the strictest jurisdiction. Scope controls to the threat, then map the jurisdictional obligation onto them — never the reverse, which produces a control set shaped by the weakest applicable regulator.
+
+**AI-pipeline applicability:** every row whose TTP class is `AML.*` applies to AI workloads specifically and has no jurisdictional mandate anywhere in this registry until EU AI Act Art. 15 applies (2027-12-02 Annex III, 2028-08-02 Annex I). UK NCSC CAF v4.0 B4.a/B4.b is the only in-force obligation touching any of them, and only for automated decision-making — not for prompt injection, tool trust, RAG integrity, or AI-as-C2.
+
+---
+
 ## Notification Timeline Summary
 
 | Jurisdiction | Framework | Notification Trigger | Timeline |
@@ -374,6 +458,7 @@ These gaps exist across all 14 jurisdictions and both global standards:
 | EU | GDPR | Personal data breach | 72h to SA |
 | EU | NIS2 | Significant incident | 24h early warning, 72h notification |
 | EU | DORA | Major ICT-related incident | 4h initial, 72h intermediate, 1 month final |
+| EU | CRA (manufacturer reporting, from 2026-09-11) | Actively exploited vulnerability or severe incident in a product with digital elements | 24h early warning, 72h notification, 14 days final |
 | UK | GDPR/UK DPA | Personal data breach | 72h to ICO |
 | AU | Notifiable Data Breaches | Eligible data breach | ASAP (no fixed window), practicable |
 | SG | PDPA | Data breach | 3 days to PDPC |
@@ -383,6 +468,7 @@ These gaps exist across all 14 jurisdictions and both global standards:
 | IN | SEBI | Cyber incident | 6 hours |
 | CA | PIPEDA | Real risk of significant harm | Asap to OPC |
 | CA | OSFI B-10 | High/critical tech/cyber incident | 24 hours |
+| CA | CCSPA (Bill C-8) | Cyber security incident affecting a critical cyber system | ≤72h to CSE (period set by regulation), then immediate notice to the regulator — binds on order in council |
 | Global | ISO 27001 | No notification requirement | Framework-only |
 
 ---
@@ -391,9 +477,9 @@ These gaps exist across all 14 jurisdictions and both global standards:
 
 US-only GRC posture is structurally incomplete for any organisation operating across EU, UK, AU, SG, IN, JP, or CA in mid-2026. The following regulatory instruments are in force or about to be, and have no direct US-framework equivalent:
 
-- **NIS2 Directive (EU 2022/2555)** — transposition deadline 2024-10-17; enforcement now active across all 27 Member States. Imposes obligations on essential and important entities that NIST CSF / SOC 2 do not mirror, including: 24-hour early-warning notification, mandatory MFA, supply-chain security including AI-tool plugins, board-level accountability with personal liability for senior management.
+- **NIS2 Directive (EU 2022/2555)** — transposition deadline 2024-10-17; transposition is still incomplete. The Commission issued reasoned opinions to 19 Member States on 2025-05-07 and on 2026-07-08 referred Ireland, Spain, France and the Netherlands to the CJEU for failing to notify transposing measures. Scope an entity by its Member State of establishment rather than by the directive text — obligations bite through national law, and in the referred Member States that law is not yet notified. Imposes obligations on essential and important entities that NIST CSF / SOC 2 do not mirror, including: 24-hour early-warning notification, mandatory MFA, supply-chain security including AI-tool plugins, board-level accountability with personal liability for senior management.
 - **DORA (EU 2022/2554)** — fully applicable 2025-01-17. Imposes a 4-hour initial incident notification, mandatory Threat-Led Penetration Testing (TLPT) for significant financial entities, and direct ESA oversight of Critical Third-Party Providers (CTPs). LLM API providers used by EU financial entities are candidate CTPs.
-- **EU AI Act (Regulation 2024/1689)** — staged application; full application 2026-08-02 (less than three months from this skill's review date). High-risk AI systems must operate under Art. 9 risk management, Art. 15 cybersecurity, and post-market monitoring. No NIST or SOC 2 control maps to Art. 15 cybersecurity requirements for AI systems.
+- **EU AI Act (Regulation 2024/1689, amended by Regulation (EU) 2026/1744)** — staged application. The general application date passed on 2026-08-02: Art. 50 transparency obligations now bind and the Commission / AI Office now supervises GPAI model providers. The high-risk obligations — Art. 9 risk management, Art. 15 cybersecurity, post-market monitoring — were deferred by the Digital Omnibus on AI to 2027-12-02 for Annex III systems and 2028-08-02 for Annex I product-embedded systems. No NIST or SOC 2 control maps to Art. 15 cybersecurity requirements for AI systems, and the deferral widens that gap rather than closing it: no binding AI-cybersecurity obligation is in force in any jurisdiction until December 2027.
 - **EU Cyber Resilience Act (Regulation 2024/2847)** — phased application; reporting obligations apply from 2026-09-11, full obligations from 2027-12-11. "Products with digital elements" placed on the EU market — including MCP servers, AI agent tooling, IoT — must satisfy Annex I essential cybersecurity requirements with vendor liability for the support lifetime.
 - **CERT-In Directions (India, 2022)** — 6-hour breach notification, mandatory log retention in-jurisdiction. No US framework imposes a comparable timeline.
 - **MAS TRM (Singapore)** and **CSA CCoP (Singapore CII)** — 1-hour critical-incident notification for CCoP CII, 14-day patch SLA. Stricter than any US framework.
@@ -414,7 +500,7 @@ Every applicable framework has at least one structural gap against mid-2026 thre
 | EU | DORA Art. 28–30 (ICT third-party risk) | Register of information for ICT third-party arrangements is mandated but there is no unified attestation regime yet; CTP designation for LLM/AI API providers is being clarified through ESA Joint Committee guidance. |
 | EU | EU AI Act Art. 9 / Art. 15 (high-risk AI risk management and cybersecurity) | Transparency-obligation enforcement is left to Member-State competent authorities. As of mid-2026 the operational test of "appropriate level of accuracy, robustness, and cybersecurity" is being interpreted differently in DE, FR, IT, NL — uniform enforcement is not yet observed. |
 | EU | EU CRA Annex I | "No known exploitable vulnerabilities" is a strict obligation but the conformity-assessment regime is new; market-surveillance authorities have limited tooling to test against ATLAS or KEV catalogs. |
-| UK | NCSC CAF Principles A–D | Principle-based, deliberately not prescriptive. Currency of interpretation depends on the individual assessor. No NCSC-published AI-attack-surface guidance integrated into CAF as of mid-2026. |
+| UK | NCSC CAF v4.0 Principles A–D | Principle-based, deliberately not prescriptive; currency of interpretation depends on the individual assessor. v4.0 added secure software development/maintenance coverage and automated-decision-making outcomes under B4.a/B4.b, plus an ETSI Securing AI reference — the first AI-relevant content in any UK regulatory assessment framework. Still no contributing outcome naming prompt injection, MCP/agent tool trust, RAG pipeline integrity, or AI-as-C2. |
 | UK | Cyber Essentials Plus | 14-day high-risk patch SLA — better than NIST but still insufficient for KEV-class deterministic LPE. No AI-tool coverage. |
 | AU | ASD ISM-1623 / Essential 8 ML3 | 48-hour patch window for known-exploit vulnerabilities is the best operational standard in any national framework — but does not mandate live-patching capability and has no AI-pipeline controls. |
 | AU | APRA CPS 234 | "Commensurate with vulnerabilities and threats" — requires the regulated entity to keep its own threat catalog current. No CPS 234 controls mention AI surfaces explicitly. |
@@ -426,7 +512,7 @@ Every applicable framework has at least one structural gap against mid-2026 thre
 | Global | CSA CCM v4 AIS / STA | AIS controls predate the LLM/MCP attack surface; STA covers supply chain but not AI-plugin trust boundaries. AI Controls supplement (2025) is not yet integrated into CCM v4 core. |
 | US (for contrast) | NIST 800-53 SI-2, AC-2, SC-7 | 30-day patch window; no prompt-injection control; perimeter-centric SC-7 boundary protection misses AI-API egress. Cited here only to show parity with the global frameworks — US controls are not adequate either. |
 
-Universal lag: every jurisdiction except Australia (ISM-1623) lacks an operationally testable patch-SLA for KEV-class deterministic LPE. Every jurisdiction lacks AI-pipeline-integrity controls in force as of mid-2026; the EU AI Act will be the first when Art. 15 becomes operationally enforced.
+Universal lag: every jurisdiction except Australia (ISM-1623) lacks an operationally testable patch-SLA for KEV-class deterministic LPE. Every jurisdiction lacks AI-pipeline-integrity controls in force as of mid-2026. The EU AI Act will be the first, but not until Art. 15 applies — 2027-12-02 for Annex III systems, 2028-08-02 for Annex I — following the Digital Omnibus deferral. The UK is marginally ahead in practice: NCSC CAF v4.0 B4.a/B4.b carry automated-decision-making outcomes a regulator can assess today, though they are not AI-pipeline-integrity controls in the full sense.
 
 **Expanded jurisdictional coverage (per `data/global-frameworks.json`).** The EU/UK/AU/ISO baseline is no longer sufficient — the catalog tracks 21+ jurisdictions and the cross-border data-flow obligations are where most of the operational lag now lives:
 
@@ -454,7 +540,7 @@ A summary of the multi-jurisdiction control surface vs. the high-priority TTPs f
 
 | TTP | ATLAS / ATT&CK ID | Jurisdiction with most specific obligation | Jurisdictions with no mapped control |
 |---|---|---|---|
-| Prompt injection | AML.T0051 | EU AI Act Art. 15 (interpretive, post 2026-08-02) | US (NIST/SOC2), UK CAF, AU ISM, SG TRM, IN CERT-In, JP, CA |
+| Prompt injection | AML.T0051 | EU AI Act Art. 15 (interpretive; not applicable until 2027-12-02 Annex III / 2028-08-02 Annex I). UK CAF v4.0 B4.a/B4.b is the only obligation in force today, and only for automated decision-making | US (NIST/SOC2), AU ISM, SG TRM, IN CERT-In, JP, CA — and the EU until the deferred dates |
 | ML supply chain (MCP, models) | AML.T0010 | EU CRA Annex I (post 2026-09-11 reporting) | All others — supply-chain controls do not name AI plugins |
 | LLM C2 abuse (SesameOp) | AML.T0096 | None | All — no jurisdiction has a control for AI-API as C2 |
 | Poison Training Data | AML.T0020 | EU AI Act Art. 10 (data and data governance for high-risk AI) | All others |
@@ -478,7 +564,8 @@ Per-jurisdiction breach- and incident-notification clocks. When a KEV-listed exp
 | EU | GDPR Art. 33 | Personal-data breach | Awareness | 72h to SA | Same legal clock; practical detection-to-classification window shrinks with confirmed active exploitation |
 | EU | NIS2 Art. 23 | Significant incident | Awareness | 24h early warning / 72h notification / 1 month final | Early-warning trigger fires immediately on confirmed PoC affecting deployed asset |
 | EU | DORA Art. 19 | Major ICT-related incident | Classification | 4h initial / 72h intermediate / 1 month final | 4h clock is unforgiving; KEV+PoC events likely auto-classify as major |
-| EU | EU AI Act Art. 73 (post 2026-08-02) | Serious incident for high-risk AI | Provider awareness | 15 days for serious incidents; 10 days for widespread infringement; 2 days for serious incidents involving deceased person | KEV-class exploit chain in a high-risk AI deployment triggers the 2/10/15 cascade |
+| EU | EU AI Act Art. 73 (high-risk providers; applies from 2027-12-02 Annex III / 2028-08-02 Annex I) | Serious incident for high-risk AI | Provider awareness / establishment of a causal link | 2 days for widespread infringement or a serious incident under Art. 3(49)(b) (critical-infrastructure disruption); 10 days for death of a person; 15 days default | KEV-class exploit chain in a high-risk AI deployment triggers the 2/10/15 cascade once the obligation applies |
+| EU | EU CRA Art. 14 (manufacturers, from 2026-09-11) | Actively exploited vulnerability / severe incident in a product with digital elements | Manufacturer awareness of active exploitation | 24h early warning / 72h notification / 14 days after a corrective measure (1 month for severe incidents) | Active exploitation is the statutory trigger itself, not an aggravating factor — but it is `active_exploitation: confirmed` against a shipped version, not PoC availability. A public PoC does not start this clock; a KEV listing does once product applicability is confirmed |
 | UK | UK GDPR | Personal-data breach | Awareness | 72h to ICO | Same as GDPR |
 | AU | Notifiable Data Breaches | Eligible data breach | Awareness | "As soon as practicable" — typically interpreted ≤ 30 days | Active KEV exploitation collapses "practicable" to hours |
 | SG | PDPA | Notifiable data breach | Awareness | 3 days to PDPC | Same |
@@ -491,7 +578,7 @@ Per-jurisdiction breach- and incident-notification clocks. When a KEV-listed exp
 | CA | PIPEDA | Real risk of significant harm | Awareness | As soon as feasible | Same |
 | Global | ISO 27001 | n/a — framework only | n/a | Framework imposes no notification obligation | n/a |
 
-Operational implication: an organisation subject to MAS Notice 644, CSA CCoP, CERT-In, and DORA simultaneously has a 1-hour effective notification floor — the tightest applicable clock governs. A single "we notify within 72h" runbook fails three of those four obligations.
+Operational implication: an organisation subject to MAS Notice 644, CSA CCoP, CERT-In, and DORA simultaneously has a 1-hour effective notification floor — the tightest applicable clock governs. A single "we notify within 72h" runbook fails three of those four obligations. From 2026-09-11 an org that also manufactures a product with digital elements for the EU market carries a parallel 24-hour product-side vulnerability clock that most IR runbooks do not model at all.
 
 Refer to `data/exploit-availability.json` for per-CVE PoC and KEV state; the matrix above tightens whenever any catalog entry's `active_exploitation` is `confirmed` or `cisa_kev` is `true`.
 
@@ -503,11 +590,13 @@ The single most reliable test for global-GRC theater:
 
 > "Open your incident-response runbook. For each jurisdiction your organisation is subject to — EU (NIS2, DORA, GDPR, EU AI Act), UK, AU, SG (MAS, CSA), IN (CERT-In, SEBI), JP, CA — show the per-jurisdiction notification clock with the clock-start trigger documented. A single global '72-hour notification' policy fails this test by definition for any org subject to DORA (4h), MAS Notice 644 (1h critical), CSA CCoP (2h), CERT-In (6h), or NIS2 (24h early warning). If your runbook does not list jurisdiction-specific clocks with trigger criteria, the global-GRC compliance claim is theatre — you do not have operational notification capability for at least one jurisdiction you are subject to."
 
-Two follow-up tests:
+Three follow-up tests:
 
 > "Your DORA Art. 28 register of information for ICT third-party arrangements: does it include the LLM/AI API providers your business lines use? If `provider=openai` or `provider=anthropic` or `provider=google-cloud-vertex-ai` is absent and any business line uses these providers, the register is incomplete. ESA Joint Committee guidance on CTP designation for AI providers is evolving — your register must include them now and be updated as the CTP designation crystallises."
 
-> "Your EU AI Act readiness for 2026-08-02 full application: identify every system in your inventory that would be a high-risk AI system under Annex III. For each, show the Art. 9 risk management documentation and the Art. 15 cybersecurity controls (including resilience to prompt injection per the Commission's Q&A). If the inventory does not exist or shows zero high-risk systems despite the org operating AI in employment, education, law enforcement, critical infrastructure, biometric, or essential-services contexts, the readiness claim is theatre — you have not classified your own systems against the regulation that takes full effect in under three months."
+> "Your EU AI Act Art. 50 transparency compliance, live since 2026-08-02: for every deployed system that interacts with humans, generates synthetic audio/image/video/text, or performs emotion recognition or biometric categorisation, show the disclosure to the user and the machine-readable marking of generated content. Systems placed on the market before 2026-08-02 have until 2026-12-02 to meet Art. 50(2). If you cannot produce the marking implementation, the transparency claim is theatre — this obligation is enforceable now, not in 2027."
+
+> "Your EU AI Act high-risk readiness against the deferred deadlines: identify every system in your inventory that would be a high-risk AI system under Annex III (obligations from 2027-12-02) or Annex I (from 2028-08-02). For each, show the Art. 9 risk management documentation and the Art. 15 cybersecurity controls (including resilience to prompt injection per the Commission's Q&A). If the inventory does not exist or shows zero high-risk systems despite the org operating AI in employment, education, law enforcement, critical infrastructure, biometric, or essential-services contexts, the readiness claim is theatre. A deferral is not a withdrawal: an org that stood its AI Act programme down when Regulation (EU) 2026/1744 landed will re-enter the same gap in 2027 with the same absent inventory, while the attack surface stays live throughout."
 
 ---
 

package/skills/pqc-first/skill.md

@@ -34,6 +34,7 @@ rfc_refs:
   - RFC-9180
   - RFC-9420
   - RFC-9794
+  - RFC-9954
   - RFC-8032
   - RFC-9106
 forward_watch:
@@ -53,7 +54,7 @@ cwe_refs:
 d3fend_refs:
   - D3-FE
   - D3-MENCR
-last_threat_review: "2026-06-10"
+last_threat_review: "2026-08-05"
 ---
 
 # PQC-First Mentality
@@ -127,7 +128,7 @@ PQC migration is the clearest example of why a global-first lens matters: the la
 
 ### IETF Tracking — The IETF Lag IS the Framework Lag for PQC
 
-FIPS 203/204/205 are NIST publications, but the operational PQC migration story is IETF-tracked. TLS 1.3 (RFC 8446) is not PQC-ready on its own; hybrid groups arrive via `draft-ietf-tls-ecdhe-mlkem` and the general `draft-ietf-tls-hybrid-design` framework. Both are drafts as of mid-2026. HPKE (RFC 9180, classical-only today) is the substrate for TLS ECH and MLS (RFC 9420); PQC composition for HPKE is being worked at IETF CFRG. Terminology pins on RFC 9794 (Terminology for PQC, September 2025). EdDSA (RFC 8032) — what exceptd uses for skill integrity signing — is not PQC-safe; SLH-DSA / ML-DSA migration applies here too. Compliance frameworks (NIST 800-53 SC-13, ISO 27001:2022 A.8.24, PCI DSS 4.0 §4.2.1, NIS2 Art. 21) do not yet require any specific RFC or draft. CNSA 2.0 requires PQC migration by 2030 but does not specify which IETF profile. See `data/rfc-references.json` for the tracked entries.
+FIPS 203/204/205 are NIST publications, but the operational PQC migration story is IETF-tracked. TLS 1.3 (RFC 8446) is not PQC-ready on its own; hybrid groups arrive via `draft-ietf-tls-ecdhe-mlkem` and the general hybrid-design framework, which was published as RFC 9954 (Informational, July 2026). `draft-ietf-tls-ecdhe-mlkem` — the Standards-Track profile that names the concrete groups — is still a draft; the two were never status-synchronized, so the construction being an RFC does not make the named groups standardised. HPKE (RFC 9180, classical-only today) is the substrate for TLS ECH and MLS (RFC 9420); PQC composition for HPKE is being worked at IETF CFRG. Terminology pins on RFC 9794 (Terminology for PQC, September 2025). EdDSA (RFC 8032) — what exceptd uses for skill integrity signing — is not PQC-safe; SLH-DSA / ML-DSA migration applies here too. Compliance frameworks (NIST 800-53 SC-13, ISO 27001:2022 A.8.24, PCI DSS 4.0 §4.2.1, NIS2 Art. 21) do not yet require any specific RFC or draft. CNSA 2.0 requires PQC migration by 2030 but does not specify which IETF profile. See `data/rfc-references.json` for the tracked entries.
 
 ---