@blamejs/exceptd-skills 0.18.27 → 0.18.29

package/lib/currency-severity.js

@@ -0,0 +1,60 @@
+"use strict";
+
+/**
+ * lib/currency-severity.js
+ *
+ * Pure function used by the `exceptd doctor` verb to turn a currency report
+ * into a health verdict.
+ *
+ * The scoring model in orchestrator/pipeline.js grades every skill on four
+ * labels — current (score >= 90), acceptable (70-89), stale (50-69),
+ * critical_stale (< 50) — and raises `action_required` only below 70. The
+ * pre-extraction predicate in the doctor ignored that ladder and failed on
+ * `currency_label !== "current"`, which folded the acceptable tier in with
+ * genuine staleness.
+ *
+ * That made the health check a scheduled failure rather than a signal: a
+ * skill's score drops from 90 to 80 the day it crosses 90 days since
+ * `last_threat_review`, so any skill will turn `doctor` red on a fixed
+ * cadence with no code change and nothing actually wrong.
+ *
+ * The tiers now map to severity the way the model defines them:
+ *
+ *   current                     → healthy, no entry in either bucket
+ *   acceptable (drifting)       → severity:"warn", ok:true, exit 0
+ *   stale / critical_stale      → ok:false (error), exit 1
+ *
+ * `stale_skills` keeps its original meaning — every skill that is not
+ * `current` — so an existing consumer reading it still sees the full picture.
+ * `drifting_skills` and `action_required_skills` split that list along the
+ * boundary the exit code now respects.
+ */
+
+/**
+ * @param {object[]} report        currency_report rows from currencyCheck()
+ * @param {boolean}  actionRequired the report-level action_required flag
+ * @returns {{ok: boolean, severity: string|null, stale: object[], drifting: object[], actionable: object[], critical: object[]}}
+ */
+function classifyCurrency(report, actionRequired) {
+  const rows = Array.isArray(report) ? report.filter(r => r && typeof r === "object") : [];
+
+  const stale = rows.filter(s => s.action_required || s.currency_label !== "current");
+  const drifting = rows.filter(s => !s.action_required && s.currency_label !== "current");
+  const actionable = rows.filter(s => s.action_required);
+  const critical = rows.filter(s => s.currency_score !== undefined && s.currency_score < 50);
+
+  // The report-level flag is honored even when no row carries action_required,
+  // so an upstream that raises the flag some other way still fails closed.
+  const ok = actionable.length === 0 && !actionRequired;
+
+  return {
+    ok,
+    severity: ok && drifting.length > 0 ? "warn" : null,
+    stale,
+    drifting,
+    actionable,
+    critical,
+  };
+}
+
+module.exports = { classifyCurrency };

package/lib/validate-package.js

@@ -29,9 +29,11 @@ const ABS = (p) => path.join(ROOT, p);
 // index spans the full series. Packed size crossed 5 MB through that gradual
 // growth; 7 MB restored headroom. Completing five-jurisdiction framework-gap
 // coverage across the whole catalog added ~1,100 curated statements plus their
-// reverse-reference index, crossing 7 MB; 8 MB restores headroom while still
-// catching a gross-bloat accident.
-const SIZE_BUDGET_BYTES = 8 * 1024 * 1024;
+// reverse-reference index, crossing 7 MB; 8 MB restored headroom. Curating a
+// further hundred KEV CVEs — each with its indicators, five framework-gap
+// statements and a paired zero-day lesson — crossed 8 MB; 9 MB restores
+// headroom while still catching a gross-bloat accident.
+const SIZE_BUDGET_BYTES = 9 * 1024 * 1024;
 
 const REQUIRED_PATHS = [
   "package.json",

package/manifest-snapshot.json

@@ -1,6 +1,6 @@
 {
   "_comment": "Auto-generated by scripts/refresh-manifest-snapshot.js — do not hand-edit. Public skill surface used by check-manifest-snapshot.js to detect breaking removals.",
-  "_generated_at": "2026-07-03T23:19:50.905Z",
+  "_generated_at": "2026-08-07T01:15:16.284Z",
   "atlas_version": "2026.06",
   "skill_count": 51,
   "skills": [
@@ -1093,6 +1093,7 @@
       ],
       "data_deps": [
         "atlas-ttps.json",
+        "d3fend-catalog.json",
         "exploit-availability.json",
         "framework-control-gaps.json",
         "global-frameworks.json"
@@ -1102,7 +1103,21 @@
       "framework_gaps": [],
       "rfc_refs": [],
       "cwe_refs": [],
-      "d3fend_refs": [],
+      "d3fend_refs": [
+        "D3-CSPP",
+        "D3-EAL",
+        "D3-EFA",
+        "D3-FAPA",
+        "D3-FE",
+        "D3-IOPR",
+        "D3-KBPI",
+        "D3-MENCR",
+        "D3-MFA",
+        "D3-NI",
+        "D3-NTA",
+        "D3-OTF",
+        "D3-SCA"
+      ],
       "dlp_refs": []
     },
     {
@@ -1847,7 +1862,8 @@
         "RFC-9106",
         "RFC-9180",
         "RFC-9420",
-        "RFC-9794"
+        "RFC-9794",
+        "RFC-9954"
       ],
       "cwe_refs": [
         "CWE-327"
@@ -2403,17 +2419,35 @@
       "data_deps": [
         "atlas-ttps.json",
         "cve-catalog.json",
+        "d3fend-catalog.json",
         "framework-control-gaps.json",
-        "global-frameworks.json"
+        "global-frameworks.json",
+        "rfc-references.json"
       ],
       "atlas_refs": [],
       "attack_refs": [],
       "framework_gaps": [],
-      "rfc_refs": [],
+      "rfc_refs": [
+        "RFC-9954"
+      ],
       "cwe_refs": [
         "CWE-1188"
       ],
-      "d3fend_refs": [],
+      "d3fend_refs": [
+        "D3-CSPP",
+        "D3-EAL",
+        "D3-EFA",
+        "D3-FAPA",
+        "D3-IOPR",
+        "D3-ITF",
+        "D3-KBPI",
+        "D3-MENCR",
+        "D3-MFA",
+        "D3-NI",
+        "D3-NTA",
+        "D3-OTF",
+        "D3-SCA"
+      ],
       "dlp_refs": []
     },
     {

package/manifest-snapshot.sha256

@@ -1 +1 @@
-40e7936868a38317067bbb0fef5ec1d7b3b09b7bbbdf0af236fffb95bcf1d3fd  manifest-snapshot.json
+6e9e98ec4fdb230cabdb7493dd35490de7e8f20cbc840886e339cfa1bf7507e2  manifest-snapshot.json