@blamejs/exceptd-skills 0.18.27 → 0.18.29

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.18.29 — 2026-08-06
+
+CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (923 → 1023), covering KEV additions from August 2022 through March 2023 plus five from July and August 2026, and spanning CVE publication years 2010 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. Thirty-two carry known ransomware use.
+
+The batch centers on the late-2022 enterprise-edge and mail-infrastructure wave — the Exchange OWASSRF chain that bypassed the ProxyNotShell URL rewrite (CVE-2022-41080, CVE-2022-41082, CVE-2022-41040), the Fortinet FortiOS SSL-VPN heap overflow behind the BOLDMOVE and COATHANGER implants (CVE-2022-42475), the Fortinet management-interface authentication bypass (CVE-2022-40684), the Citrix ADC and Gateway SAML bypass attributed to APT5 (CVE-2022-27518), the Fortra GoAnywhere MFT deserialization RCE Cl0p weaponized as a zero-day (CVE-2023-0669), the Veeam Backup & Replication unauthenticated internal-API pair used by Cuba, Conti and Yanluowang (CVE-2022-26500, CVE-2022-26501), the Zoho ManageEngine SAML RCE (CVE-2022-47966, CVE-2022-35405), the Zimbra path traversal chained through cpio (CVE-2022-41352), the SAP Internet Communication Manager request-smuggling flaw (CVE-2022-22536), the Oracle E-Business Suite and Fusion Middleware pre-auth flaws (CVE-2022-21587, CVE-2021-35587), and the Sophos Firewall code injection Sophos disclosed alongside its own targeted-exploitation notice (CVE-2022-3236).
+
+Windows kernel and platform escalation is the other center of gravity: the CLFS driver overflows used ahead of ransomware deployment (CVE-2023-23376, CVE-2022-37969), the ALPC and COM+ Event System escalations (CVE-2023-21674, CVE-2022-41033), the CNG Key Isolation flaw reachable inside LSA (CVE-2022-41125), the Print Spooler activation-context escape (CVE-2022-41073), the JScript9 type confusion delivered through Office remote templates by APT37 (CVE-2022-41128), both Mark-of-the-Web bypasses (CVE-2022-41049, CVE-2022-41091), the Defender SmartScreen bypass (CVE-2022-44698), the Active Directory Certificate Services escalation known as Certifried (CVE-2022-26923), and the LNK shortcut flaw Stuxnet used (CVE-2010-2568). Client-side and mobile exploitation covers the Samsung clipboard-provider chain into the Mali and DPU drivers (CVE-2021-25337, CVE-2021-25369, CVE-2021-25370), Apple WebKit and kernel zero-days across iOS, iPadOS and macOS (CVE-2023-23529, CVE-2022-42856, CVE-2022-42827, CVE-2022-32917, CVE-2022-32893, CVE-2022-32894, CVE-2021-31010, CVE-2020-9934), Chromium V8, GPU, Mojo and Intents zero-days (CVE-2022-4262, CVE-2022-4135, CVE-2022-3723, CVE-2022-3075, CVE-2022-2856), and the WebRTC heap overflow Candiru used to deliver DevilsTongue (CVE-2022-2294). A long tail of Linux and Android privilege escalation (CVE-2021-3493, CVE-2013-6282, CVE-2013-2596, CVE-2013-2094, CVE-2011-1823, CVE-2013-2597), signed-driver escalation primitives suitable for bring-your-own-vulnerable-driver (CVE-2018-19320 through CVE-2018-19323, CVE-2015-2291), and internet-facing devices recruited into botnets (CVE-2018-6530, CVE-2022-26258, CVE-2011-4723, CVE-2017-5521, CVE-2018-7445) rounds out the set.
+
+Eight weakness classes backing these entries are new to the CWE catalog: CWE-197 (numeric truncation), CWE-259 (hard-coded password), CWE-270 (privilege context switching error), CWE-311 (missing encryption of sensitive data), CWE-406 (network amplification), CWE-664 (improper control of a resource through its lifetime), CWE-824 (access of uninitialized pointer), and CWE-1285 (improper validation of a specified index, position or offset). CVE-2013-2094 now maps to CWE-1285 rather than the CWE-189 category, which MITRE prohibits using to map real-world vulnerabilities.
+
+## 0.18.28 — 2026-08-05
+
+`doctor` no longer reports a healthy install as failed once a skill passes ninety days since its last threat review. The skill-currency check treated every skill outside the "current" tier as an error, while the currency model itself raises `action_required` only below the "acceptable" tier — so a maintained skill crossing the ninety-day mark turned the whole health check red and `doctor --json` exited 1, on a fixed cadence, with nothing actually wrong. Review-date drift is now advisory: the check reports `severity: "warn"`, `all_green` stays false so the drift is still visible, and the exit code stays 0. A skill genuinely past its review window still fails with exit 1, and a critically stale one is still counted critical. The check reports `drifting_skills` and `action_required_skills` alongside the existing `stale_skills` list, which keeps its meaning, so a consumer can distinguish an advisory state from a failure. Human output distinguishes the three states rather than printing "all green" under a warning icon.
+
+The `global-grc` skill carries a refreshed threat review. The EU AI Act entry now follows the application timeline as amended by Regulation (EU) 2026/1744: Art. 50 transparency obligations and Commission supervision of GPAI providers are in force from 2026-08-02, the high-risk requirements including Art. 9 risk management and Art. 15 cybersecurity are deferred to 2027-12-02 for Annex III systems and 2028-08-02 for Annex I product-embedded systems, and two new Art. 5 prohibitions covering non-consensual intimate imagery and child sexual abuse material apply from 2026-12-02. Art. 73's serious-incident clocks are corrected — 2 days for widespread infringement or critical-infrastructure disruption, 10 days for death of a person, 15 days otherwise — having previously been transposed. The compliance-theater test that keyed off the superseded August 2026 deadline is replaced by one testing Art. 50 transparency, which is enforceable now, and one testing high-risk classification against the deferred dates, on the ground that a deferral is not a withdrawal while the attack surface stays live. NIS2 no longer claims enforcement across all 27 Member States: transposition remains incomplete, and four Member States were referred to the CJEU in July 2026, so entities scope by Member State of establishment rather than by the directive text. CRA manufacturer reporting under Art. 14 is now covered in the notification and exploit-availability tables — 24-hour early warning, 72-hour notification, 14-day final report from 2026-09-11 — a clock triggered by active exploitation and therefore driven directly by KEV state. UK coverage is corrected: NCSC CAF v4.0 does carry AI-relevant content in Principle B4's automated-decision-making outcomes and its ETSI Securing AI reference, so the claim that no UK framework addressed AI is withdrawn and replaced with the narrower residual gap, and the Cyber Security and Resilience Bill is recorded as not yet in force. Canada gains the Critical Cyber Systems Protection Act enacted by Bill C-8, with its 72-hour incident report to the Communications Security Establishment, and the lapsed Bill C-27 is replaced by Bill C-36. Australia gains the Enhanced Critical Infrastructure Risk Management Program Rules and their supply-chain mapping obligation, the most specific such requirement in the registry. Japan's active-cyber-defence legislation is corrected to the 2025 Acts and the 2026 APPI amendment is recorded. CSA CCM is updated to v4.1.
+
+The `security-maturity-tiers` skill carries a refreshed threat review. Its MVP tier adds an inventory step for self-hosted LLM gateways and flow builders, a product class that has produced repeated KEV-listed pre-authentication remote code execution against default deployments, and the tier's completion criterion now requires that none be reachable from the internet. The US federal remediation baseline is updated: CISA BOD 26-04 replaced BOD 22-01's uniform KEV due dates with risk-tiered ones, so the framework-lag table records a 3-day top band against the tier's hours-scale live-patch prescription. EU CRA dates are corrected — Annex I product requirements apply from 2027-12-11, while Art. 14 reporting starts 2026-09-11 — and the EU AI Act Art. 15 row reflects the deferral, with the tier's rationale sharpened: the obligation does not bind for another 16 to 24 months while the attack surface is live today. Post-quantum TLS now cites RFC 9954 and notes that X25519MLKEM768 is offered by default from OpenSSL 3.5 onward, making the Practical-tier step a version upgrade and a config assertion rather than a migration project.
+
+RFC 9954 (Hybrid Key Exchange in TLS 1.3, Informational, July 2026) is now carried in the offline RFC catalog, so `exceptd rfc 9954` resolves without network access instead of reporting an unknown reference. Its predecessor `draft-ietf-tls-hybrid-design` records the transition rather than still describing itself as queued for a number, and `pqc-first` no longer describes the hybrid construction as a draft — while noting that `draft-ietf-tls-ecdhe-mlkem`, the Standards-Track profile naming the concrete groups, remains one, so the construction reaching RFC status does not standardise the named groups.
+
+Both skills gain a Defensive Countermeasure Mapping section routing each finding to a D3FEND technique and the downstream skill that owns its implementation, and both now declare the D3FEND catalog and the techniques they cite so the mappings reach the index and cross-reference surfaces rather than reporting zero.
+
 ## 0.18.27 — 2026-07-30
 
 CVE catalog currency: one hundred more CISA-KEV-listed, actively-exploited CVEs are now curated in the offline catalog (823 → 923), covering additions to the CISA Known Exploited Vulnerabilities catalog from March through August 2023 (plus four July 2026 additions) and spanning CVE publication years 2004 through 2026. Each entry carries a verified NVD CVSS vector and CWE, ATT&CK technique mappings, real-world exploitation status, primary-source indicators where public exploit code exists, global-first framework-control-gap declarations (NIST, EU NIS2/DORA, UK CAF, AU ISM/Essential 8, ISO 27001), an RWEP score, and a paired zero-day lesson. The batch centers on the 2023 mass-exploitation wave against file-transfer, email-security, and enterprise-edge infrastructure — the Progress MOVEit Transfer SQL-injection abused by Cl0p in the largest data-theft campaign of the year (CVE-2023-34362), the Barracuda Email Security Gateway command injection exploited by UNC4841 (CVE-2023-2868), the PaperCut MF/NG authentication-bypass RCE used by Cl0p and LockBit affiliates (CVE-2023-27350), the Adobe ColdFusion access-control and deserialization chain (CVE-2023-26359, CVE-2023-26360, CVE-2023-29298, CVE-2023-38205), the Ivanti EPMM/MobileIron authentication bypass and Sentry chain (CVE-2023-35078, CVE-2023-35081, CVE-2023-38035), the Citrix ShareFile storage-zones RCE (CVE-2023-24489), the Oracle WebLogic deserialization RCE (CVE-2023-21839), the Zyxel firewall command injection recruited into Mirai (CVE-2023-28771), and the VMware Aria/Tools flaws tied to UNC3886 (CVE-2023-20867, CVE-2023-20887). It also covers client and mobile exploitation heavily used by commercial-spyware and state actors — the Apple "Operation Triangulation" kernel flaw and the June-2023 iOS WebKit/kernel zero-day chain (CVE-2023-38606, CVE-2023-37450, CVE-2023-32409, CVE-2023-32434, CVE-2023-32435, CVE-2023-32439, CVE-2023-28204, CVE-2023-32373), the Microsoft Outlook NTLM-relay privilege escalation used by APT28/Forest Blizzard (CVE-2023-23397), the Microsoft Office RCE deployed by Storm-0978/RomCom (CVE-2023-36884) and the Windows SmartScreen bypass used by Magniber (CVE-2023-24880), the Samsung mobile-chipset chain surfaced in spyware exploitation (CVE-2021-25487, CVE-2021-25489, CVE-2021-25394, CVE-2021-25395, CVE-2021-25371, CVE-2021-25372), the Arm Mali GPU kernel driver flaws chained in Android spyware (CVE-2022-22706, CVE-2022-38181, CVE-2021-29256, CVE-2023-26083), and multiple Google Chrome V8 and Skia zero-days (CVE-2023-2033, CVE-2023-3079, CVE-2023-2136). A long tail of internet-facing devices recruited into botnets rounds out the set — TP-Link Archer (CVE-2023-1389), Ruckus wireless (CVE-2023-25717), D-Link routers (CVE-2019-17621, CVE-2019-20500), the end-of-life Zyxel P660HN (CVE-2017-18368), SolarView Compact (CVE-2022-29303) — alongside the Ignite Realtime Openfire path traversal mined by Kinsing (CVE-2023-32315), the Veeam Backup & Replication credential disclosure (CVE-2023-27532), the Samba "SambaCry" RCE (CVE-2017-7494), the Apache Log4j 2.15 follow-up (CVE-2021-45046), and older but still-exploited Linux privilege escalations and Cisco IOS flaws. Two weakness classes backing these entries are new to the CWE catalog: CWE-294 (authentication bypass by capture-replay, the mechanism behind the Outlook NTLM-relay flaw) and CWE-401 (missing release of memory after effective lifetime).

package/bin/exceptd.js

@@ -7209,9 +7209,13 @@ function cmdDoctor(runner, args, runOpts, pretty) {
         }
       }
       if (parsed && Array.isArray(parsed.currency_report)) {
-        const stale = parsed.currency_report.filter(s => s.action_required || s.currency_label !== "current");
-        const critical = parsed.currency_report.filter(s => s.currency_score !== undefined && s.currency_score < 50);
-        const ok = stale.length === 0 && !parsed.action_required;
+        // Severity tracks the scoring model's own tiers; see
+        // lib/currency-severity.js for why the drift tier warns instead of
+        // failing. Extracted so the tier boundary is testable without a
+        // manifest whose dates move under the test.
+        const { classifyCurrency } = require(path.join(PKG_ROOT, "lib", "currency-severity.js"));
+        const { ok, severity, stale, drifting, actionable, critical } =
+          classifyCurrency(parsed.currency_report, parsed.action_required);
         // Audit 3 B.7: surface the freshest + stalest last_threat_review
         // so operators can answer "is my data stale?" without parsing the
         // full report. Falls back gracefully when the upstream report
@@ -7223,8 +7227,14 @@ function cmdDoctor(runner, args, runOpts, pretty) {
         const minDaysSince = dates.length ? Math.floor((Date.now() - new Date(dates[0]).getTime()) / 86400000) : null;
         checks.currency = {
           ok,
+          // Drift with nothing past its review window is advisory: bucket it
+          // as a warning so `all_green:false` still surfaces it while the
+          // exit code stays 0 (same contract the registry check uses).
+          ...(severity ? { severity } : {}),
           total_skills: parsed.currency_report.length,
           stale_skills: stale.map(s => s.skill),
+          drifting_skills: drifting.map(s => s.skill),
+          action_required_skills: actionable.map(s => s.skill),
           critical_stale: critical.map(s => s.skill),
           critical_count: parsed.critical_count || 0,
           oldest_last_threat_review: dates[0] || null,
@@ -7956,11 +7966,18 @@ function cmdDoctor(runner, args, runOpts, pretty) {
       ? `skill signatures verified (${c.skills_passed ?? "?"}/${c.skills_total ?? "?"})`
       : `skill signatures FAILED (exit=${c.exit_code ?? "?"})`
   );
-  mark(checks.currency, c =>
-    c.ok
-      ? `skill currency: all green (${c.total_skills ?? "?"} skills)`
-      : `skill currency: ${c.stale_skills?.length || "?"} stale, ${c.critical_count ?? 0} critical`
-  );
+  mark(checks.currency, c => {
+    // Three states, not two: the drift tier renders under a [!! warn] icon,
+    // so "all green" here would contradict the icon the way the signing
+    // check's text once did.
+    if (c.ok && c.severity === "warn") {
+      const n = c.drifting_skills?.length ?? "?";
+      const names = (c.drifting_skills || []).join(", ");
+      return `skill currency: ${n} approaching review window${names ? ` (${names})` : ""}, 0 past it`;
+    }
+    if (c.ok) return `skill currency: all green (${c.total_skills ?? "?"} skills)`;
+    return `skill currency: ${c.action_required_skills?.length ?? c.stale_skills?.length ?? "?"} past review window, ${c.critical_count ?? 0} critical`;
+  });
   mark(checks.cves, c => {
     if (!c.ok) return `CVE catalog FAILED (exit=${c.exit_code ?? "?"})`;
     const total = c.total ?? "?";

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-07-30T08:22:39.863Z",
+  "generated_at": "2026-08-08T00:13:19.714Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "4d556e78e703a795b45d3cc85e53e00e5d017649804adac667df6dabb9636e93",
+    "manifest.json": "839bcf37cf7551affca5e013e2201220cb48fe8dd5d5c640e85859ec372a8271",
     "README.md": "2d2f4ac4e7934e730fc88502b6f19c986c1a059dbae1eb3b5c3f672b9e0a4d7a",
     "data/atlas-ttps.json": "a414f3957956762a7f5aec07d36391b6579f45d1491b2a3db27eee38a4fad503",
-    "data/attack-techniques.json": "0f9d29c33502294e383da8c747d491ee972d1d6923695cecd110e8c9f6d53522",
-    "data/cve-catalog.json": "85afca7bff24a802ddd15b3b9f3b0951c35ab3232e79307718e6bad1d6f75c4c",
-    "data/cwe-catalog.json": "2075d9e36a95656817389ae5cc671ddc396ac532077a3b1c2eda20730c93c87d",
-    "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
+    "data/attack-techniques.json": "dd42496983df0e69993c14c2b8b53bbd06ebf0c1193fef4bf8aad2bae7e990de",
+    "data/cve-catalog.json": "7cd922abf720e5b0b84878eb33e84c6b3c8c68a579c9ae76793f56723a4de82c",
+    "data/cwe-catalog.json": "0066d80fbb4551e6678948c1ba9dde888aca6cc097a356e5725e7b3d8f9b4b48",
+    "data/d3fend-catalog.json": "64d4d2c187aa0c1f308b982da7f7fb68ebe8207ec0c4baf983c407f3ad0afd0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
-    "data/framework-control-gaps.json": "2490bffb1511f5157de8c8894267c509e6e8e27cd40e47df455f7550c06de866",
+    "data/framework-control-gaps.json": "37849a64a83e8d12176dad0a165017e9b7107caeba2da968f0d0411295a1970b",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
-    "data/rfc-references.json": "5db2f7006a1d7f2b8642a3e393213394e92798604576df973d0a0b8550f4b5ac",
-    "data/zeroday-lessons.json": "5d293b1e2240dd40df948cb8fe40fd4637cda8d625a3b29d1d2731f36cbcbdf4",
+    "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
+    "data/zeroday-lessons.json": "f88d344e8400051bcfcd13ba116326e02fb188cf451c48bc4115fd3f9a7143b7",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "9a1fca96c27803506a9ebe98ffb1eb17206278b0aba39ecc5cd19d74f3a32fbf",
     "skills/mcp-agent-trust/skill.md": "fae25ffa7680b9ba66c86bb0aead7ea01f497c93ad9c1d04c6fdcdc42987b209",
@@ -27,11 +27,11 @@
     "skills/ai-c2-detection/skill.md": "6503b57a793885b73aabfef6d336fd2717af33b1228571a2fb732dc9f5f475dc",
     "skills/policy-exception-gen/skill.md": "4c368d05875cbb4a7f008e627a7452a176db21b9ac5f08f813ac8007ddd17bbc",
     "skills/threat-model-currency/skill.md": "11be4c065cab1bdd5230b03869850651b61478aa8fd690ca47373bcf205af5f6",
-    "skills/global-grc/skill.md": "8d1dfbae79153d403d543b3481f463260a89a35d068db0fa9eeda21c01c78e09",
+    "skills/global-grc/skill.md": "cbbc37475a6bfabde26ee0f064bb853088d4e004691af92d6fa007f6bfb8ddfd",
     "skills/zeroday-gap-learn/skill.md": "b9216006195d7db2e2f66e55b8b9e99702c7e6a36100dea641709101027b2825",
-    "skills/pqc-first/skill.md": "803b3dc39eba4caa4f08980806b5fd02fb20b3655625cf014adccd85e4320e16",
+    "skills/pqc-first/skill.md": "794e53921d5d8b0bfcd512f6c28b1fecf2ef3bb5a9ccd83826bb0b79cae4aef4",
     "skills/skill-update-loop/skill.md": "fbcc0786ebbc2d2735944269f82ded10affd9f4efa29c2f6cdc4c283024837de",
-    "skills/security-maturity-tiers/skill.md": "7b8c0b3d5924b57a1bf6bb61faf23a0869ed034dcfcdf1b5fcb5566dac87ee6e",
+    "skills/security-maturity-tiers/skill.md": "708094f0ca32b33cf8593a29f3d6f9c63f1b6421233c5d5bfe8039de56bc85aa",
     "skills/researcher/skill.md": "9f1211d177c64e4c465407a45ad9e2901c5c6c0af410a0d0a51cc8fb780420d4",
     "skills/attack-surface-pentest/skill.md": "5b1f96ae23825c0a1eb77d2ede29143308b7219e10f99c5b657fb6f788fad3b8",
     "skills/fuzz-testing-strategy/skill.md": "632b4004ae953fbea3ede136557dc044395ea8aa7b49b220e7d1e5d0c5cb676f",
@@ -93,21 +93,21 @@
   "index_stats": {
     "xref_entries": {
       "cwe_refs": 53,
-      "d3fend_refs": 22,
+      "d3fend_refs": 27,
       "framework_gaps": 96,
       "atlas_refs": 10,
       "attack_refs": 51,
-      "rfc_refs": 35,
+      "rfc_refs": 36,
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 910,
-    "chains_cwe_entries": 220,
+    "chains_cve_entries": 1010,
+    "chains_cwe_entries": 232,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,
     "section_offsets_skills": 51,
-    "token_budget_total_approx": 436045,
+    "token_budget_total_approx": 441982,
     "recipes": 8,
     "jurisdiction_clocks": 29,
     "did_ladders": 8,

package/data/_indexes/activity-feed.json

@@ -6,28 +6,57 @@
   },
   "events": [
     {
-      "date": "2026-07-30",
+      "date": "2026-08-06",
       "type": "catalog_update",
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 923
+      "entry_count": 1023
     },
     {
-      "date": "2026-07-30",
+      "date": "2026-08-06",
       "type": "catalog_update",
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 220
+      "entry_count": 232
     },
     {
-      "date": "2026-07-22",
+      "date": "2026-08-06",
       "type": "catalog_update",
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 923
+      "entry_count": 1023
+    },
+    {
+      "date": "2026-08-05",
+      "type": "skill_review",
+      "artifact": "global-grc",
+      "path": "skills/global-grc/skill.md",
+      "note": "Multi-jurisdiction GRC mapping — EU (GDPR/NIS2/DORA/EU AI Act/CRA), UK, AU, SG, JP, IN, CA, ISO 27001:2022, CSA CCM v4"
+    },
+    {
+      "date": "2026-08-05",
+      "type": "skill_review",
+      "artifact": "pqc-first",
+      "path": "skills/pqc-first/skill.md",
+      "note": "Post-quantum cryptography first mentality — hard version gates, algorithm sunset tracking, loopback learning for NIST/IETF standards evolution"
+    },
+    {
+      "date": "2026-08-05",
+      "type": "skill_review",
+      "artifact": "security-maturity-tiers",
+      "path": "skills/security-maturity-tiers/skill.md",
+      "note": "Three-tier implementation roadmap — MVP you can ship today, practical best practices useable now, overkill gold standard for defense-in-depth"
+    },
+    {
+      "date": "2026-08-05",
+      "type": "catalog_update",
+      "artifact": "data/rfc-references.json",
+      "path": "data/rfc-references.json",
+      "schema_version": "1.0.0",
+      "entry_count": 8889
     },
     {
       "date": "2026-07-03",
@@ -107,13 +136,6 @@
       "path": "skills/zeroday-gap-learn/skill.md",
       "note": "Run the zero-day learning loop — CVE to attack vector to control gap to framework gap to new control requirement"
     },
-    {
-      "date": "2026-06-10",
-      "type": "skill_review",
-      "artifact": "pqc-first",
-      "path": "skills/pqc-first/skill.md",
-      "note": "Post-quantum cryptography first mentality — hard version gates, algorithm sunset tracking, loopback learning for NIST/IETF standards evolution"
-    },
     {
       "date": "2026-06-10",
       "type": "skill_review",
@@ -332,14 +354,6 @@
       "path": "skills/privacy-consent-ops/skill.md",
       "note": "Privacy, consent, and sanctions operational integrity for mid-2026 — confusable/homoglyph normalization before sanctions screening, integrity-bound and re-validated consent records, evidence-gated and downstream-propagated DSR erasure, and ROPA reconciliation against actual processing"
     },
-    {
-      "date": "2026-05-27",
-      "type": "catalog_update",
-      "artifact": "data/rfc-references.json",
-      "path": "data/rfc-references.json",
-      "schema_version": "1.0.0",
-      "entry_count": 8888
-    },
     {
       "date": "2026-05-19",
       "type": "catalog_update",
@@ -442,20 +456,6 @@
       "path": "data/dlp-controls.json",
       "schema_version": "1.0.0",
       "entry_count": 22
-    },
-    {
-      "date": "2026-05-01",
-      "type": "skill_review",
-      "artifact": "global-grc",
-      "path": "skills/global-grc/skill.md",
-      "note": "Multi-jurisdiction GRC mapping — EU (GDPR/NIS2/DORA/EU AI Act/CRA), UK, AU, SG, JP, IN, CA, ISO 27001:2022, CSA CCM v4"
-    },
-    {
-      "date": "2026-05-01",
-      "type": "skill_review",
-      "artifact": "security-maturity-tiers",
-      "path": "skills/security-maturity-tiers/skill.md",
-      "note": "Three-tier implementation roadmap — MVP you can ship today, practical best practices useable now, overkill gold standard for defense-in-depth"
     }
   ]
 }

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-30",
+      "last_updated": "2026-08-06",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -62,7 +62,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 923,
+      "entry_count": 1023,
       "sample_keys": [
         "CVE-2025-68686",
         "CVE-2026-16812",
@@ -75,7 +75,7 @@
       "path": "data/cwe-catalog.json",
       "purpose": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-07-30",
+      "last_updated": "2026-08-06",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -84,7 +84,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 220,
+      "entry_count": 232,
       "sample_keys": [
         "CWE-20",
         "CWE-22",
@@ -207,7 +207,7 @@
       "path": "data/rfc-references.json",
       "purpose": "IETF RFCs + active Internet-Drafts cited by skills (TLS, IPsec, PQ crypto migration, HTTP/3, CT). Cross-validated against IETF Datatracker via validate-rfcs.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-05-27",
+      "last_updated": "2026-08-05",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -216,7 +216,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 8888,
+      "entry_count": 8889,
       "sample_keys": [
         "RFC-4301",
         "RFC-4303",
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-07-22",
+      "last_updated": "2026-08-06",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {
@@ -238,7 +238,7 @@
         "rebuild_after_days": 365,
         "note": "Per-entry last_verified governs decay. Skills depending on this catalog must check entry freshness before high-stakes use."
       },
-      "entry_count": 923,
+      "entry_count": 1023,
       "sample_keys": [
         "CVE-2026-31431",
         "CVE-2025-53773",