@blamejs/exceptd-skills 0.18.27 → 0.18.28

package/data/_indexes/token-budget.json

@@ -3,8 +3,8 @@
     "schema_version": "1.0.0",
     "tokenizer_note": "Character-density approximation: 1 token ≈ 4 chars. This is the canonical rule-of-thumb for OpenAI tokenizers on English+technical text. Claude's tokenizer is typically more efficient on prose; treat this as an upper-bound budget for both. Consumers with stricter precision needs should re-tokenize with their own tokenizer.",
     "approx_chars_per_token": 4,
-    "total_chars": 1744152,
-    "total_approx_tokens": 436045,
+    "total_chars": 1767897,
+    "total_approx_tokens": 441982,
     "skill_count": 51
   },
   "skills": {
@@ -650,10 +650,10 @@
     },
     "global-grc": {
       "path": "skills/global-grc/skill.md",
-      "bytes": 41090,
-      "chars": 40888,
-      "lines": 573,
-      "approx_tokens": 10222,
+      "bytes": 58154,
+      "chars": 57870,
+      "lines": 662,
+      "approx_tokens": 14468,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -662,44 +662,49 @@
           "approx_tokens": 107
         },
         "framework-registry-mid-2026-currency": {
-          "bytes": 17748,
-          "chars": 17650,
-          "approx_tokens": 4413
+          "bytes": 26614,
+          "chars": 26474,
+          "approx_tokens": 6619
         },
         "universal-gaps-no-jurisdiction-covers-these": {
           "bytes": 1104,
           "chars": 1104,
           "approx_tokens": 276
         },
+        "defensive-countermeasure-mapping": {
+          "bytes": 4445,
+          "chars": 4425,
+          "approx_tokens": 1106
+        },
         "notification-timeline-summary": {
-          "bytes": 924,
-          "chars": 924,
-          "approx_tokens": 231
+          "bytes": 1320,
+          "chars": 1316,
+          "approx_tokens": 329
         },
         "threat-context": {
-          "bytes": 2562,
-          "chars": 2542,
-          "approx_tokens": 636
+          "bytes": 3324,
+          "chars": 3298,
+          "approx_tokens": 825
         },
         "framework-lag-declaration": {
-          "bytes": 7825,
-          "chars": 7789,
-          "approx_tokens": 1947
+          "bytes": 8387,
+          "chars": 8345,
+          "approx_tokens": 2086
         },
         "ttp-mapping": {
-          "bytes": 2136,
-          "chars": 2121,
-          "approx_tokens": 530
+          "bytes": 2316,
+          "chars": 2299,
+          "approx_tokens": 575
         },
         "exploit-availability-matrix": {
-          "bytes": 2899,
-          "chars": 2887,
-          "approx_tokens": 722
+          "bytes": 3834,
+          "chars": 3820,
+          "approx_tokens": 955
         },
         "compliance-theater-check": {
-          "bytes": 1963,
-          "chars": 1953,
-          "approx_tokens": 488
+          "bytes": 2697,
+          "chars": 2687,
+          "approx_tokens": 672
         },
         "analysis-procedure": {
           "bytes": 1036,
@@ -780,10 +785,10 @@
     },
     "pqc-first": {
       "path": "skills/pqc-first/skill.md",
-      "bytes": 38036,
-      "chars": 37866,
-      "lines": 572,
-      "approx_tokens": 9467,
+      "bytes": 38292,
+      "chars": 38118,
+      "lines": 573,
+      "approx_tokens": 9530,
       "approx_chars_per_token": 4,
       "sections": {
         "threat-context": {
@@ -792,9 +797,9 @@
           "approx_tokens": 652
         },
         "framework-lag-declaration": {
-          "bytes": 7919,
-          "chars": 7895,
-          "approx_tokens": 1974
+          "bytes": 8162,
+          "chars": 8134,
+          "approx_tokens": 2034
         },
         "ttp-mapping": {
           "bytes": 2120,
@@ -940,10 +945,10 @@
     },
     "security-maturity-tiers": {
       "path": "skills/security-maturity-tiers/skill.md",
-      "bytes": 30791,
-      "chars": 30623,
-      "lines": 490,
-      "approx_tokens": 7656,
+      "bytes": 37336,
+      "chars": 37134,
+      "lines": 540,
+      "approx_tokens": 9284,
       "approx_chars_per_token": 4,
       "sections": {
         "frontmatter-scope": {
@@ -962,19 +967,19 @@
           "approx_tokens": 128
         },
         "domain-kernel-lpe-copy-fail-dirty-frag-class": {
-          "bytes": 4081,
-          "chars": 4071,
-          "approx_tokens": 1018
+          "bytes": 4340,
+          "chars": 4328,
+          "approx_tokens": 1082
         },
         "domain-ai-attack-surface": {
-          "bytes": 2706,
-          "chars": 2680,
-          "approx_tokens": 670
+          "bytes": 3426,
+          "chars": 3396,
+          "approx_tokens": 849
         },
         "domain-cryptography-pqc": {
-          "bytes": 2044,
-          "chars": 2020,
-          "approx_tokens": 505
+          "bytes": 2257,
+          "chars": 2231,
+          "approx_tokens": 558
         },
         "domain-grc-compliance": {
           "bytes": 1960,
@@ -1002,20 +1007,25 @@
           "approx_tokens": 161
         },
         "threat-context": {
-          "bytes": 1995,
-          "chars": 1993,
-          "approx_tokens": 498
+          "bytes": 2244,
+          "chars": 2238,
+          "approx_tokens": 560
         },
         "framework-lag-declaration": {
-          "bytes": 3883,
-          "chars": 3867,
-          "approx_tokens": 967
+          "bytes": 4610,
+          "chars": 4588,
+          "approx_tokens": 1147
         },
         "ttp-mapping": {
           "bytes": 2508,
           "chars": 2506,
           "approx_tokens": 627
         },
+        "defensive-countermeasure-mapping": {
+          "bytes": 4145,
+          "chars": 4129,
+          "approx_tokens": 1032
+        },
         "exploit-availability-matrix": {
           "bytes": 2665,
           "chars": 2661,

package/data/_indexes/xref.json

@@ -300,11 +300,13 @@
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
       "fuzz-testing-strategy",
+      "global-grc",
       "kernel-lpe-triage",
       "mcp-agent-trust",
       "mlops-security",
       "sector-energy",
       "sector-federal-government",
+      "security-maturity-tiers",
       "supply-chain-integrity",
       "webapp-security"
     ],
@@ -340,6 +342,7 @@
       "dlp-gap-analysis",
       "email-security-anti-phishing",
       "fuzz-testing-strategy",
+      "global-grc",
       "idp-incident-response",
       "incident-response-playbook",
       "mlops-security",
@@ -348,6 +351,7 @@
       "sector-financial",
       "sector-healthcare",
       "sector-telecom",
+      "security-maturity-tiers",
       "webapp-security"
     ],
     "D3-NTA": [
@@ -360,6 +364,7 @@
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
       "email-security-anti-phishing",
+      "global-grc",
       "idp-incident-response",
       "incident-response-playbook",
       "rag-pipeline-security",
@@ -367,12 +372,15 @@
       "sector-energy",
       "sector-financial",
       "sector-telecom",
+      "security-maturity-tiers",
       "webapp-security"
     ],
     "D3-FAPA": [
       "ai-attack-surface",
       "defensive-countermeasure-mapping",
-      "rag-pipeline-security"
+      "global-grc",
+      "rag-pipeline-security",
+      "security-maturity-tiers"
     ],
     "D3-CSPP": [
       "age-gates-child-safety",
@@ -383,12 +391,14 @@
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
       "email-security-anti-phishing",
+      "global-grc",
       "identity-assurance",
       "incident-response-playbook",
       "mcp-agent-trust",
       "rag-pipeline-security",
       "ransomware-response",
       "sector-healthcare",
+      "security-maturity-tiers",
       "webapp-security"
     ],
     "D3-CAA": [
@@ -420,11 +430,13 @@
       "cloud-iam-incident",
       "defensive-countermeasure-mapping",
       "email-security-anti-phishing",
+      "global-grc",
       "identity-assurance",
       "idp-incident-response",
       "mcp-agent-trust",
       "sector-financial",
       "sector-healthcare",
+      "security-maturity-tiers",
       "webapp-security"
     ],
     "D3-FCR": [
@@ -442,8 +454,10 @@
       "ai-c2-detection",
       "container-runtime-security",
       "defensive-countermeasure-mapping",
+      "global-grc",
       "sector-energy",
-      "sector-telecom"
+      "sector-telecom",
+      "security-maturity-tiers"
     ],
     "D3-NTPM": [
       "ai-c2-detection",
@@ -454,13 +468,35 @@
       "sector-energy",
       "sector-telecom"
     ],
+    "D3-EFA": [
+      "global-grc",
+      "security-maturity-tiers"
+    ],
     "D3-FE": [
       "defensive-countermeasure-mapping",
+      "global-grc",
       "pqc-first"
     ],
+    "D3-KBPI": [
+      "global-grc",
+      "security-maturity-tiers"
+    ],
     "D3-MENCR": [
       "defensive-countermeasure-mapping",
-      "pqc-first"
+      "global-grc",
+      "pqc-first",
+      "security-maturity-tiers"
+    ],
+    "D3-OTF": [
+      "global-grc",
+      "security-maturity-tiers"
+    ],
+    "D3-SCA": [
+      "global-grc",
+      "security-maturity-tiers"
+    ],
+    "D3-ITF": [
+      "security-maturity-tiers"
     ],
     "D3-RPA": [
       "defensive-countermeasure-mapping",
@@ -1319,6 +1355,10 @@
     "RFC-9794": [
       "pqc-first"
     ],
+    "RFC-9954": [
+      "pqc-first",
+      "security-maturity-tiers"
+    ],
     "RFC-8032": [
       "container-runtime-security",
       "identity-assurance",

package/data/d3fend-catalog.json

@@ -58,11 +58,13 @@
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
       "fuzz-testing-strategy",
+      "global-grc",
       "kernel-lpe-triage",
       "mcp-agent-trust",
       "mlops-security",
       "sector-energy",
       "sector-federal-government",
+      "security-maturity-tiers",
       "supply-chain-integrity",
       "webapp-security"
     ],
@@ -301,7 +303,9 @@
     ],
     "skills_referencing": [
       "defensive-countermeasure-mapping",
-      "pqc-first"
+      "global-grc",
+      "pqc-first",
+      "security-maturity-tiers"
     ],
     "implementation_examples": [
       "TLS 1.3 with hybrid X25519MLKEM768 key exchange (RFC 9794-class drafts)",
@@ -339,6 +343,7 @@
     ],
     "skills_referencing": [
       "defensive-countermeasure-mapping",
+      "global-grc",
       "pqc-first"
     ],
     "implementation_examples": [
@@ -427,11 +432,13 @@
       "cloud-iam-incident",
       "defensive-countermeasure-mapping",
       "email-security-anti-phishing",
+      "global-grc",
       "identity-assurance",
       "idp-incident-response",
       "mcp-agent-trust",
       "sector-financial",
       "sector-healthcare",
+      "security-maturity-tiers",
       "webapp-security"
     ],
     "implementation_examples": [
@@ -562,6 +569,7 @@
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
       "email-security-anti-phishing",
+      "global-grc",
       "idp-incident-response",
       "incident-response-playbook",
       "rag-pipeline-security",
@@ -569,6 +577,7 @@
       "sector-energy",
       "sector-financial",
       "sector-telecom",
+      "security-maturity-tiers",
       "webapp-security"
     ],
     "implementation_examples": [
@@ -666,12 +675,14 @@
       "defensive-countermeasure-mapping",
       "dlp-gap-analysis",
       "email-security-anti-phishing",
+      "global-grc",
       "identity-assurance",
       "incident-response-playbook",
       "mcp-agent-trust",
       "rag-pipeline-security",
       "ransomware-response",
       "sector-healthcare",
+      "security-maturity-tiers",
       "webapp-security"
     ],
     "implementation_examples": [
@@ -722,6 +733,7 @@
       "dlp-gap-analysis",
       "email-security-anti-phishing",
       "fuzz-testing-strategy",
+      "global-grc",
       "idp-incident-response",
       "incident-response-playbook",
       "mlops-security",
@@ -730,6 +742,7 @@
       "sector-financial",
       "sector-healthcare",
       "sector-telecom",
+      "security-maturity-tiers",
       "webapp-security"
     ],
     "implementation_examples": [
@@ -810,7 +823,9 @@
     "skills_referencing": [
       "ai-attack-surface",
       "defensive-countermeasure-mapping",
-      "rag-pipeline-security"
+      "global-grc",
+      "rag-pipeline-security",
+      "security-maturity-tiers"
     ],
     "implementation_examples": [
       "auditd FIM with behavioral rules",
@@ -850,8 +865,10 @@
       "ai-c2-detection",
       "container-runtime-security",
       "defensive-countermeasure-mapping",
+      "global-grc",
       "sector-energy",
-      "sector-telecom"
+      "sector-telecom",
+      "security-maturity-tiers"
     ],
     "implementation_examples": [
       "VPC egress allowlists with no default internet route",
@@ -1128,7 +1145,10 @@
       "cgroup",
       "LSM Profile"
     ],
-    "skills_referencing": [],
+    "skills_referencing": [
+      "global-grc",
+      "security-maturity-tiers"
+    ],
     "implementation_examples": [
       "SELinux / AppArmor confinement profiles per workload",
       "Linux user namespaces + capability dropping (CAP_SYS_ADMIN removed)",
@@ -1163,7 +1183,10 @@
       "System Call",
       "Process Behavior"
     ],
-    "skills_referencing": [],
+    "skills_referencing": [
+      "global-grc",
+      "security-maturity-tiers"
+    ],
     "implementation_examples": [
       "Linux auditd with syscall rules (ausearch -k privesc)",
       "Falco runtime rules on suspicious syscall sequences",
@@ -1240,7 +1263,10 @@
       "Firmware",
       "OS Image"
     ],
-    "skills_referencing": [],
+    "skills_referencing": [
+      "global-grc",
+      "security-maturity-tiers"
+    ],
     "implementation_examples": [
       "YARA",
       "PEStudio / PEiD",
@@ -3005,7 +3031,10 @@
     "reference_url": "https://d3fend.mitre.org/technique/D3-ITF/",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-d3fend-owl"
+    "_intake_method": "mitre-d3fend-owl",
+    "skills_referencing": [
+      "security-maturity-tiers"
+    ]
   },
   "D3-JFAPA": {
     "id": "D3-JFAPA",
@@ -3682,7 +3711,11 @@
     "reference_url": "https://d3fend.mitre.org/technique/D3-OTF/",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
-    "_intake_method": "mitre-d3fend-owl"
+    "_intake_method": "mitre-d3fend-owl",
+    "skills_referencing": [
+      "global-grc",
+      "security-maturity-tiers"
+    ]
   },
   "D3-OTP": {
     "id": "D3-OTP",

package/data/rfc-references.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "schema_version": "1.0.0",
-    "last_updated": "2026-05-27",
+    "last_updated": "2026-08-05",
     "note": "IETF RFCs and Internet-Drafts that exceptd skills depend on. RFCs are the layer beneath compliance frameworks: a control like 'TLS 1.3 required' implicitly references RFC 8446; a 'use strong KEM' control depends on whatever draft-ietf-tls-ecdhe-mlkem settles into. Frameworks lag RFCs; RFCs lag attacker innovation. This catalog tracks both kinds of lag.",
     "status_values": [
       "Internet Standard",
@@ -1337,12 +1337,15 @@
     "status": "Informational",
     "tracker": "https://datatracker.ietf.org/doc/draft-ietf-tls-hybrid-design/",
     "relevance": "General-purpose hybrid-KEM design that the ecdhe-mlkem draft instantiates. Operators evaluating the migration story should read both.",
-    "lag_notes": "IESG-approved (draft-16) for publication as an Informational RFC and in the RFC Editor queue as of mid-2026; RFC number not yet assigned. No longer status-synchronized with draft-ietf-tls-ecdhe-mlkem, which remains an active Standards-Track draft.",
+    "lag_notes": "Published as RFC 9954 (Informational, July 2026) — cite RFC-9954 rather than this draft for the hybrid construction. Retained so existing references resolve. Never status-synchronized with draft-ietf-tls-ecdhe-mlkem, which remains an active Standards-Track draft.",
     "skills_referencing": [
       "pqc-first"
     ],
-    "last_verified": "2026-05-24",
-    "abstract": "IETF Internet-Draft (TLS WG) — design rationale and security analysis for hybrid post-quantum + classical TLS 1.3 handshakes. Defines the wire format, key-derivation chain, and downgrade-resistance properties for hybrid key-exchange. Cited by RFC 9763 (ML-KEM in TLS 1.3) + RFC 9764 (ML-DSA in TLS 1.3) as the architectural foundation."
+    "last_verified": "2026-08-05",
+    "abstract": "IETF Internet-Draft (TLS WG) — design rationale and security analysis for hybrid post-quantum + classical TLS 1.3 handshakes. Defines the wire format, key-derivation chain, and downgrade-resistance properties for hybrid key-exchange. Cited by RFC 9763 (ML-KEM in TLS 1.3) + RFC 9764 (ML-DSA in TLS 1.3) as the architectural foundation.",
+    "replaced_by": [
+      "RFC-9954"
+    ]
   },
   "ISO-29147": {
     "number": null,
@@ -291829,5 +291832,21 @@
     "last_verified": "2026-05-27",
     "_auto_imported": true,
     "_intake_method": "ietf-rfc-index"
+  },
+  "RFC-9954": {
+    "number": 9954,
+    "title": "Hybrid Key Exchange in TLS 1.3",
+    "status": "Informational",
+    "published": "2026-07",
+    "errata_count": 0,
+    "tracker": "https://www.rfc-editor.org/info/rfc9954",
+    "relevance": "Publishes the concatenation-based hybrid key-exchange construction for TLS 1.3 that the PQC migration story depends on. Gives operators a citable standard for X25519MLKEM768 rather than a moving draft, which matters for a control an auditor has to verify.",
+    "lag_notes": "Informational, not Standards Track — it specifies the construction, not a mandate. No compliance framework requires it (NIST 800-53 SC-13, ISO 27001:2022 A.8.24, PCI DSS 4.0 4.2.1 and NIS2 Art. 21 name no IETF profile), and CNSA 2.0 sets a 2030 deadline without pinning one. Supersedes draft-ietf-tls-hybrid-design; draft-ietf-tls-ecdhe-mlkem remains a separate Standards-Track draft and is NOT covered by this RFC.",
+    "skills_referencing": [
+      "pqc-first",
+      "security-maturity-tiers"
+    ],
+    "last_verified": "2026-08-05",
+    "abstract": "Defines hybrid key exchange for TLS 1.3 — negotiating multiple key-exchange algorithms as a single named group and concatenating their shared secrets, so the session stays secure while at least one component algorithm is unbroken. The construction underpinning X25519MLKEM768 and the harvest-now-decrypt-later defence."
   }
 }

package/lib/currency-severity.js

@@ -0,0 +1,60 @@
+"use strict";
+
+/**
+ * lib/currency-severity.js
+ *
+ * Pure function used by the `exceptd doctor` verb to turn a currency report
+ * into a health verdict.
+ *
+ * The scoring model in orchestrator/pipeline.js grades every skill on four
+ * labels — current (score >= 90), acceptable (70-89), stale (50-69),
+ * critical_stale (< 50) — and raises `action_required` only below 70. The
+ * pre-extraction predicate in the doctor ignored that ladder and failed on
+ * `currency_label !== "current"`, which folded the acceptable tier in with
+ * genuine staleness.
+ *
+ * That made the health check a scheduled failure rather than a signal: a
+ * skill's score drops from 90 to 80 the day it crosses 90 days since
+ * `last_threat_review`, so any skill will turn `doctor` red on a fixed
+ * cadence with no code change and nothing actually wrong.
+ *
+ * The tiers now map to severity the way the model defines them:
+ *
+ *   current                     → healthy, no entry in either bucket
+ *   acceptable (drifting)       → severity:"warn", ok:true, exit 0
+ *   stale / critical_stale      → ok:false (error), exit 1
+ *
+ * `stale_skills` keeps its original meaning — every skill that is not
+ * `current` — so an existing consumer reading it still sees the full picture.
+ * `drifting_skills` and `action_required_skills` split that list along the
+ * boundary the exit code now respects.
+ */
+
+/**
+ * @param {object[]} report        currency_report rows from currencyCheck()
+ * @param {boolean}  actionRequired the report-level action_required flag
+ * @returns {{ok: boolean, severity: string|null, stale: object[], drifting: object[], actionable: object[], critical: object[]}}
+ */
+function classifyCurrency(report, actionRequired) {
+  const rows = Array.isArray(report) ? report.filter(r => r && typeof r === "object") : [];
+
+  const stale = rows.filter(s => s.action_required || s.currency_label !== "current");
+  const drifting = rows.filter(s => !s.action_required && s.currency_label !== "current");
+  const actionable = rows.filter(s => s.action_required);
+  const critical = rows.filter(s => s.currency_score !== undefined && s.currency_score < 50);
+
+  // The report-level flag is honored even when no row carries action_required,
+  // so an upstream that raises the flag some other way still fails closed.
+  const ok = actionable.length === 0 && !actionRequired;
+
+  return {
+    ok,
+    severity: ok && drifting.length > 0 ? "warn" : null,
+    stale,
+    drifting,
+    actionable,
+    critical,
+  };
+}
+
+module.exports = { classifyCurrency };