@blamejs/exceptd-skills 0.18.3 → 0.18.4

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.18.4 — 2026-06-14
+
+Correctness fixes in the skill linter, attestation diffing, and the jurisdiction index. The required-section check no longer accepts a heading that appears only inside a fenced code example, nor a deeper sub-heading standing in for a top-level section — both previously let a non-compliant skill pass. `attest diff` no longer reports an object-valued signal override (the per-indicator false-positive-check maps) as changed when its content is identical, so the field-level diff agrees with the overall evidence verdict. ENISA references now index under the dedicated EU_ENISA jurisdiction instead of collapsing into the generic EU bucket, and the indexed-jurisdiction count in the index metadata reflects every mapped jurisdiction.
+
 ## 0.18.3 — 2026-06-14
 
 The release pipeline now enforces the project's patch-only version cadence as a predeploy gate: a minor or major version bump fails the gates unless it carries an explicit, committed authorization. A release-engineering safeguard; the CLI surface is unchanged.

package/bin/exceptd.js

@@ -6410,7 +6410,11 @@ function diffSignalOverrides(a, b) {
   const allIds = new Set([...Object.keys(a), ...Object.keys(b)]);
   const out = { total_compared: allIds.size, changed: [], unchanged_count: 0 };
   for (const id of allIds) {
-    if (a[id] !== b[id]) out.changed.push({ id, a: a[id] || null, b: b[id] || null });
+    // Deep, order-insensitive compare — signal_overrides hold OBJECT values
+    // (the `<indicator-id>__fp_checks` maps), so a reference-strict `!==` would
+    // report byte-identical FP-check content as "changed", contradicting the
+    // evidence_hash verdict. Reuse the same comparator diffArtifacts uses.
+    if (artifactsDiffer(a[id], b[id])) out.changed.push({ id, a: a[id] ?? null, b: b[id] ?? null });
     else out.unchanged_count++;
   }
   return out;
@@ -9316,5 +9320,6 @@ module.exports = {
   _verifyAttestationSidecar: verifyAttestationSidecar,
   _emit: emit,
   _diffArtifacts: diffArtifacts,
+  _diffSignalOverrides: diffSignalOverrides,
   _resolveSelfAttestation: resolveSelfAttestation,
 };

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-14T14:15:46.628Z",
+  "generated_at": "2026-06-14T15:16:04.134Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "58e3b2b80b32fb30a31db9857fcbd356ddd6c61da6dbc3a762c85a4d212dc787",
+    "manifest.json": "bc6692b16f3c9205bcda124347d3dc0ba400939ba86bfd860fad5b3b33cad1ed",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",
@@ -84,7 +84,7 @@
     "trigger_table_entries": 688,
     "chains_cve_entries": 446,
     "chains_cwe_entries": 181,
-    "jurisdictions_indexed": 29,
+    "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,
     "summary_cards": 51,
     "section_offsets_skills": 51,

package/data/_indexes/jurisdiction-map.json

@@ -488,8 +488,23 @@
     "skill_count": 2
   },
   "EU_ENISA": {
-    "skills": [],
+    "skills": [
+      "ai-c2-detection",
+      "cloud-security",
+      "compliance-theater",
+      "container-runtime-security",
+      "coordinated-vuln-disclosure",
+      "incident-response-playbook",
+      "pqc-first",
+      "researcher",
+      "sector-energy",
+      "sector-federal-government",
+      "sector-financial",
+      "sector-healthcare",
+      "sector-telecom",
+      "skill-update-loop"
+    ],
     "example_excerpts": {},
-    "skill_count": 0
+    "skill_count": 14
   }
 }

package/lib/lint-skills.js

@@ -474,9 +474,16 @@ function validateFrontmatter(fm, skillName) {
 function findMissingSections(body, requiredSections) {
   const sections = requiredSections || REQUIRED_SECTIONS;
   const lines = body.split(/\r?\n/);
-  // Index every heading line (any depth) so we know where each section ends.
+  // Index heading lines so we know where each section ends. Skip lines inside
+  // fenced code blocks: a heading inside a ```markdown example block is
+  // documentation, not a real section, and must not satisfy a required-section
+  // check (otherwise a skill whose required sections appear only inside a fence
+  // passes the gate vacuously).
   const headings = [];
+  let inFence = false;
   for (let i = 0; i < lines.length; i++) {
+    if (/^\s*(?:```|~~~)/.test(lines[i])) { inFence = !inFence; continue; }
+    if (inFence) continue;
     const m = lines[i].match(/^(#{1,6})\s+(.+?)\s*$/);
     if (m) {
       headings.push({ line: i, depth: m[1].length, title: m[2].trim() });
@@ -490,6 +497,10 @@ function findMissingSections(body, requiredSections) {
   const findHeading = (title) => {
     const t = title.toLowerCase();
     return headings.find((h) => {
+      // Required sections are top-level (H1/H2). A deeper heading — e.g. the H3
+      // "### Compliance Theater Check Result" inside Output Format — must NOT
+      // satisfy the standalone "## Compliance Theater Check" requirement.
+      if (h.depth > 2) return false;
       const lower = h.title.toLowerCase();
       if (lower === t) return true;
       if (lower.startsWith(t)) {

package/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "exceptd-security",
-  "version": "0.18.3",
+  "version": "0.18.4",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation",
   "homepage": "https://exceptd.com",
   "license": "Apache-2.0",
@@ -53,7 +53,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "0H+JfyUVmo/pVFEi5rLENATHjlukPVUqnOWmNPEH77wm8svKGK0aNJ46k6QU5GdHb8c9X9pVJKiuhON6AxDjDw==",
-      "signed_at": "2026-06-14T13:48:50.059Z",
+      "signed_at": "2026-06-14T15:13:59.422Z",
       "cwe_refs": [
         "CWE-125",
         "CWE-362",
@@ -123,7 +123,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "WfqxU2x/feWgatYrCeO9PD3dIY0FAfs4nkVdQRac4fg5BDQPG/vhzhvYVN6Mg11oITACghbPOtZXvS37sACsCA==",
-      "signed_at": "2026-06-14T13:48:50.061Z",
+      "signed_at": "2026-06-14T15:13:59.424Z",
       "cwe_refs": [
         "CWE-1039",
         "CWE-1426",
@@ -196,7 +196,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "9bNOW4MzmUlFgkXH5tIZkq8YpzhMM+r8YVcNEM39kdEZwfRNG4Bj+Dgr7v4Qgp9D4q7hGNFpK0ywX+dPd3VWAg==",
-      "signed_at": "2026-06-14T13:48:50.062Z",
+      "signed_at": "2026-06-14T15:13:59.425Z",
       "cwe_refs": [
         "CWE-22",
         "CWE-345",
@@ -248,7 +248,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "5A08+nAu5jwNQ1+vGbFgFAJA/kYD3oiaevhCxT4/2FeW++F070Pm4MD1+oXdv8R2DbtYr+7yXnCGM7UbUPR2AA==",
-      "signed_at": "2026-06-14T13:48:50.062Z"
+      "signed_at": "2026-06-14T15:13:59.425Z"
     },
     {
       "name": "compliance-theater",
@@ -279,7 +279,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "RCgbI0sMNTKAscXUtrVU25u7OuE64uQvO5JKsB8vIJFWguvT6nZyD7euKuIxIzYhLTyHBiD7Rhp70btlK+JkCg==",
-      "signed_at": "2026-06-14T13:48:50.063Z"
+      "signed_at": "2026-06-14T15:13:59.426Z"
     },
     {
       "name": "exploit-scoring",
@@ -308,7 +308,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "JJrs+B22/hYxvdYs+abmoire5PbQXPb2uVYyjInZ3UbT8gEjs/5SyfGKx7z86jbtvB3ItApQVAx1AuseIgdyAQ==",
-      "signed_at": "2026-06-14T13:48:50.064Z"
+      "signed_at": "2026-06-14T15:13:59.426Z"
     },
     {
       "name": "rag-pipeline-security",
@@ -345,7 +345,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "Z6WbTqG98bQVRd6+kXDb6xIEe0ZryAeGxVSuKKxdK1PoZqew7NJcMsa6sJVSq+0r7KMsFwfTEdKorp6UDdhpCA==",
-      "signed_at": "2026-06-14T13:48:50.064Z",
+      "signed_at": "2026-06-14T15:13:59.426Z",
       "cwe_refs": [
         "CWE-1395",
         "CWE-1426"
@@ -405,7 +405,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "DLKcrgon+MZrqmivlFLBH4vlzZbJSW1531RsYDm9/KdW2CgcUUHwNMSzAfU1mAsFwFkAHjy/a8e1FbS9msTvDA==",
-      "signed_at": "2026-06-14T13:48:50.064Z",
+      "signed_at": "2026-06-14T15:13:59.427Z",
       "cwe_refs": [
         "CWE-918"
       ],
@@ -443,7 +443,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "eWCOD+mR1c6B8vKDBot8y8UkQrKPCIEBHU3JRQET9xZnYGx8hrOyeRUElcKqCO5aG/2LISs9Atg1H+ehWDNbCw==",
-      "signed_at": "2026-06-14T13:48:50.065Z",
+      "signed_at": "2026-06-14T15:13:59.427Z",
       "cwe_refs": [
         "CWE-1188"
       ],
@@ -477,7 +477,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "kZca725/+BFr1mpxL29+cGzjqsiYhChWScf7VjU6vCTBZrmCps6W9gYYjf4lVORXaM4DAg3UVBOXyhpTst0rAw==",
-      "signed_at": "2026-06-14T13:48:50.065Z",
+      "signed_at": "2026-06-14T15:13:59.427Z",
       "forward_watch": [
         "New AI attack classes as ATLAS v6 publishes",
         "Post-quantum adversary capability timeline",
@@ -516,7 +516,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-01",
       "signature": "b5miTiY0cnxETd2btxorfZBdJKt/fLnQx20sGYUb9zEqGqtm0LMLpghkW68j4/9k48KNyuGMtNWiKTSnodUGBw==",
-      "signed_at": "2026-06-14T13:48:50.066Z"
+      "signed_at": "2026-06-14T15:13:59.428Z"
     },
     {
       "name": "zeroday-gap-learn",
@@ -543,7 +543,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-06-10",
       "signature": "NVBY4I5a+v2/nUeCYcy3LLVKk3Tg9gmz+sCKyvnf8t2fXMNSIGtoy+P8K4Gfos1rGzRRMaU01V7L4kh/IQ8UBQ==",
-      "signed_at": "2026-06-14T13:48:50.066Z",
+      "signed_at": "2026-06-14T15:13:59.428Z",
       "forward_watch": [
         "New CISA KEV entries",
         "New ATLAS TTP additions in each ATLAS release",
@@ -607,7 +607,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "U54OxIjPT+W9yafjpeFgY7klXMltLYBuSCtu/AAlXxOIPehJrbf/vbGgnBn58nqOd7RjoKjmKz9WQs4DMqWcDw==",
-      "signed_at": "2026-06-14T13:48:50.067Z",
+      "signed_at": "2026-06-14T15:13:59.429Z",
       "cwe_refs": [
         "CWE-327"
       ],
@@ -655,7 +655,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "QsJMwvnUJXHwoBPJ4BiUx3FO9giXfos/sMbx5tyO83AJ2JxdVskeC6g/WDfO+rVkWNXRgWi4h1eSYz6T8/tpAg==",
-      "signed_at": "2026-06-14T13:48:50.067Z"
+      "signed_at": "2026-06-14T15:13:59.429Z"
     },
     {
       "name": "security-maturity-tiers",
@@ -692,7 +692,7 @@
       ],
       "last_threat_review": "2026-05-01",
       "signature": "8KbLVVPI1QgYa+HAnEYvKf1cXnxQ3zsncqTGrAOrBP4rwUeZsxJm8KyFCwI0XytnZG35PZ830BFlG/okPW3sBQ==",
-      "signed_at": "2026-06-14T13:48:50.067Z",
+      "signed_at": "2026-06-14T15:13:59.429Z",
       "cwe_refs": [
         "CWE-1188"
       ]
@@ -727,7 +727,7 @@
       "framework_gaps": [],
       "last_threat_review": "2026-05-11",
       "signature": "iJWevUBurLvt2v8X+Ch2eHmZkPWpKeAtIpxTIP4MwbUHyco3igDeBywJCyaR2vURYRx8LkzzIMM8DxQM4LAXBQ==",
-      "signed_at": "2026-06-14T13:48:50.068Z"
+      "signed_at": "2026-06-14T15:13:59.430Z"
     },
     {
       "name": "attack-surface-pentest",
@@ -799,7 +799,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — Microsoft Edge 4-bug sandbox escape by Orange Tsai (DEVCORE); forward-watch only (browser sandbox, out of current playbook scope); track Microsoft Edge security advisory and KEV add"
       ],
       "signature": "ZnFi+Rk4CWrjFEVU4hC6Q66UbDmndNL/ICLWQNA1TQYFGSTnng+nboM4tfi6h0yMbbDj7dOXYqqeHNK+M5ZiBA==",
-      "signed_at": "2026-06-14T13:48:50.068Z"
+      "signed_at": "2026-06-14T15:13:59.430Z"
     },
     {
       "name": "fuzz-testing-strategy",
@@ -859,7 +859,7 @@
         "OSS-Fuzz-Gen / AI-assisted harness generation becoming the default expectation for OSS maintainers"
       ],
       "signature": "45ICz7vcnmHYE1+RIDv8wQjScKj6p8hqJQ5m6I0tDdKVnGdMXCYIgZnYqFJgHBDXYAXlGx7D7UxhFz6WOCDqAQ==",
-      "signed_at": "2026-06-14T13:48:50.068Z"
+      "signed_at": "2026-06-14T15:13:59.430Z"
     },
     {
       "name": "dlp-gap-analysis",
@@ -934,7 +934,7 @@
         "Quebec Law 25, India DPDPA, KSA PDPL enforcement actions naming AI-tool prompt data as in-scope personal information"
       ],
       "signature": "k6A7QcFEzgGXYWftt/elhQe7kU4F67c0ol3a8DZfj1XW4UrH99SLhPHr6ih3R3EYCl/Ey/zXt/x3a9fDT3RmAw==",
-      "signed_at": "2026-06-14T13:48:50.069Z"
+      "signed_at": "2026-06-14T15:13:59.431Z"
     },
     {
       "name": "supply-chain-integrity",
@@ -1013,7 +1013,7 @@
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Megatron Bridge path traversal by haehae; AI training-stack file-system trust boundary; track patch and SBOM-attestation impact"
       ],
       "signature": "5shKqNcLC8Obt0EdvKnck8OwWIuRMgZuuZd12pvWqJIltsYMyTrw2M+lgbQfqg3x2KO6qsJljGAhTew5jM58DQ==",
-      "signed_at": "2026-06-14T13:48:50.069Z"
+      "signed_at": "2026-06-14T15:13:59.431Z"
     },
     {
       "name": "defensive-countermeasure-mapping",
@@ -1070,7 +1070,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "lfa5Wgep26mK3o2ZSe5qN2vVxg+xRRURRpmnqP4JdQvvecW3T2+PxHqjT48DegXJHRXJ6DPzyIElFc7no86TAg==",
-      "signed_at": "2026-06-14T13:48:50.069Z"
+      "signed_at": "2026-06-14T15:13:59.431Z"
     },
     {
       "name": "identity-assurance",
@@ -1137,7 +1137,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-11",
       "signature": "UV3458QXSkEpenzrOmdlTTfPHUD4hNyKMDHoeZDq/kiFb4mAG0ghQGTTgI9Ru8cJbSmYM1++m9N5TFIJ6JJPBg==",
-      "signed_at": "2026-06-14T13:48:50.070Z"
+      "signed_at": "2026-06-14T15:13:59.432Z"
     },
     {
       "name": "ot-ics-security",
@@ -1193,7 +1193,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "afJ00EDXgARQJrbRqN6xe1+E/kbHF7O2fxQFVvrLLXdrKfK86RK/oJU1AwpxX6mclX9f+5ivy6FvFIuRMA4dBQ==",
-      "signed_at": "2026-06-14T13:48:50.070Z"
+      "signed_at": "2026-06-14T15:13:59.432Z"
     },
     {
       "name": "coordinated-vuln-disclosure",
@@ -1245,7 +1245,7 @@
         "NYDFS 23 NYCRR 500 amendments potentially adding explicit CVD program requirements"
       ],
       "signature": "VzivMW82mRrG9+07ZX8sj4j9O9YjE/m07m1UHgSwEgex+FLaVPvIj3y1Vk6qeFOvDURmtVaztWlpSlk7iSn0DA==",
-      "signed_at": "2026-06-14T13:48:50.070Z"
+      "signed_at": "2026-06-14T15:13:59.432Z"
     },
     {
       "name": "threat-modeling-methodology",
@@ -1295,7 +1295,7 @@
         "PASTA v2 updates incorporating AI/ML application threats"
       ],
       "signature": "Fk5LzzeS/bH5SQJNySgZqSdeQf1udwdRs3FVLwig5kuqyyKkuIJcF4HW+xHF/1e66HR+gjgRUoqWZGsv58lLAg==",
-      "signed_at": "2026-06-14T13:48:50.071Z"
+      "signed_at": "2026-06-14T15:13:59.433Z"
     },
     {
       "name": "webapp-security",
@@ -1369,7 +1369,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "1skHJsPPOIXLQdU5MGHirP/Q07aCYTirtDmfWDO7ZNuto58NlCttW5ZjCpyh37vASlMljIZx0/R+PIl2PfwTBw==",
-      "signed_at": "2026-06-14T13:48:50.071Z",
+      "signed_at": "2026-06-14T15:13:59.433Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; AI-assisted discovery angle; track for active-exploitation confirmation and patch advisory affecting front-door web app deployments"
       ]
@@ -1422,7 +1422,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-15",
       "signature": "SBB7c3wNYfIdkyOp4g4nW0WP7xS+YokMzg32aaeJdbf14LTGQRzQUvSqb2TCj2HFUSHESOyKT1JpkAfyHLSQBQ==",
-      "signed_at": "2026-06-14T13:48:50.072Z"
+      "signed_at": "2026-06-14T15:13:59.434Z"
     },
     {
       "name": "sector-healthcare",
@@ -1482,7 +1482,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "yyAGG3nUC6/XWQGRF2ufzILfiJitMFczqWNY83lZShCgYSxfFCul0UsICClOc7Xjw76052uydm8kLH9gIzhsAg==",
-      "signed_at": "2026-06-14T13:48:50.072Z"
+      "signed_at": "2026-06-14T15:13:59.434Z"
     },
     {
       "name": "sector-financial",
@@ -1563,7 +1563,7 @@
         "TIBER-EU framework v2.0 alignment with DORA TLPT RTS (JC 2024/40); cross-recognition with CBEST and iCAST"
       ],
       "signature": "/+df91Qhl1TIxEAqzgqB7+YJ6mneX6Dif+h6RaCbxOLGE6KRTFst1Q/Fu5SStt8Zx5JI62bkQ2BBrNOKfUlPBg==",
-      "signed_at": "2026-06-14T13:48:50.073Z"
+      "signed_at": "2026-06-14T15:13:59.434Z"
     },
     {
       "name": "sector-federal-government",
@@ -1632,7 +1632,7 @@
         "Australia PSPF 2024 revision and ISM quarterly updates — track for Essential Eight Maturity Level requirements for federal entities"
       ],
       "signature": "k6MAPS8HJivu0DNwC1azPvyKeig2xLGz/hcqYd8T+s5GvIypPGfkeYRRKmdqMgHUe24f7bQeRZ7AxcQ9Bi6SCg==",
-      "signed_at": "2026-06-14T13:48:50.073Z"
+      "signed_at": "2026-06-14T15:13:59.435Z"
     },
     {
       "name": "sector-energy",
@@ -1697,7 +1697,7 @@
         "ICS-CERT advisory feed (https://www.cisa.gov/news-events/cybersecurity-advisories/ics-advisories) for vendor CVEs in Siemens, Rockwell, Schneider Electric, ABB, GE Vernova, Hitachi Energy, AVEVA / OSIsoft PI"
       ],
       "signature": "IYKXn009jfhpKdQKiGB4xb7VgxsJXa6PZawoguP42khU6S/TTemp/YsK1YQCUyabE+2biElL/PP1Hi8zCkSSBw==",
-      "signed_at": "2026-06-14T13:48:50.073Z"
+      "signed_at": "2026-06-14T15:13:59.435Z"
     },
     {
       "name": "sector-telecom",
@@ -1783,7 +1783,7 @@
         "O-RAN SFG / WG11 security specifications"
       ],
       "signature": "NAtyzfLPXlUuB78Snb9nWmbZalC1CNlIYN9rYhdEmtB/xQGC6vVnThgrEAHlm7v/jMCFuknvEpUHKdscUnUADw==",
-      "signed_at": "2026-06-14T13:48:50.074Z"
+      "signed_at": "2026-06-14T15:13:59.435Z"
     },
     {
       "name": "api-security",
@@ -1852,7 +1852,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "HUjhPGpZeZeVi1nzBIsEAYh18x5ltlIXnt1yQ5YKz+jC2Dvxw7vV/Clx1/1gDBLAuBvRW9wcNtDr4c0RxhfGDQ==",
-      "signed_at": "2026-06-14T13:48:50.074Z",
+      "signed_at": "2026-06-14T15:13:59.436Z",
       "forward_watch": [
         "NGINX Rift CVE-2026-42945 (disclosed 2026-05-13, source depthfirst) — KEV-watch predicted CISA KEV listing by 2026-05-29; track for active-exploitation confirmation and patch advisory affecting API gateway / reverse-proxy deployments",
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — LiteLLM 3-bug SSRF + Code Injection chain by k3vg3n; LLM-proxy API surface; track upstream patch and CVE assignments",
@@ -1938,7 +1938,7 @@
         "CISA KEV additions for cloud-control-plane CVEs (IMDSv1 abuses, federation token mishandling, cross-tenant boundary failures); CISA Cybersecurity Advisories for cross-cloud advisories"
       ],
       "signature": "xa1kr/92/0fBds7LVtRy9aCM2tQRWAfNSFoC6ygbOU7QjamUo8Wt2h2n9W+nZT34STN3woYhXqtfmm8NSjXdBQ==",
-      "signed_at": "2026-06-14T13:48:50.074Z"
+      "signed_at": "2026-06-14T15:13:59.436Z"
     },
     {
       "name": "container-runtime-security",
@@ -2000,7 +2000,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-10",
       "signature": "60hyXAiYfY9lI+EpHG3iFFxa+oF5n71c0tTMa6iXFLNjBJKPevTsdNgQlQsBEnmRJ+dWtOjb/GNBW1KiBx4XAQ==",
-      "signed_at": "2026-06-14T13:48:50.075Z",
+      "signed_at": "2026-06-14T15:13:59.436Z",
       "forward_watch": [
         "Pwn2Own Berlin 2026 (disclosed 2026-05-14, embargo ends 2026-08-12) — NVIDIA Container Toolkit container escape ($50K award) by chompie / IBM X-Force XOR; high-severity container/hypervisor boundary break; track patch and KEV add post-embargo"
       ]
@@ -2074,7 +2074,7 @@
         "MITRE ATLAS v2026.05 (released May 2026) shipped the AML.T0010 sub-technique expansion this forecast tracked plus new techniques (\"Publish Poisoned AI Agent Tool\", \"Escape to Host\"); inventory now 16 tactics, 84 techniques, 56 sub-techniques. Forward watch: subsequent ATLAS minor and major releases — track next-cadence updates to agentic-AI TTPs and MLOps-pipeline-specific techniques"
       ],
       "signature": "IEECw5lO6ZdpkE/j7Hv6/3Jg2vj9fpXlozY+h85Hrn9QYOJuI0gfBjHoBEchJ2GUTmPwUKoiBoI72PBAQw9RCQ==",
-      "signed_at": "2026-06-14T13:48:50.075Z"
+      "signed_at": "2026-06-14T15:13:59.437Z"
     },
     {
       "name": "incident-response-playbook",
@@ -2136,7 +2136,7 @@
         "NYDFS 23 NYCRR 500.17 amendments tightening ransom-payment 24h disclosure operationalization"
       ],
       "signature": "pN1Qa5NRyNJ6h0pmbbqpy3xWdkMANDMUbBst5SKR5fmmqMFopmyrzwIGagiiNgqxjjCunj9J9Wbzs1sL48sMCQ==",
-      "signed_at": "2026-06-14T13:48:50.076Z"
+      "signed_at": "2026-06-14T15:13:59.437Z"
     },
     {
       "name": "ransomware-response",
@@ -2216,7 +2216,7 @@
       ],
       "last_threat_review": "2026-06-10",
       "signature": "sXPA1lvWvZpf5sHxZXRkO0Kcs6gnXiYq0mWA53y1HeBwQGJ+viSPMt5IMobkjd5qLFYchg0CpW/nBUIvUE6/DA==",
-      "signed_at": "2026-06-14T13:48:50.076Z"
+      "signed_at": "2026-06-14T15:13:59.438Z"
     },
     {
       "name": "email-security-anti-phishing",
@@ -2269,7 +2269,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-05-18",
       "signature": "FVBn4ex2qPIo9SHMVJ6tntoz4tVwjbIq3m6wDjjZyv2JODlS+90GBYCOkNamxxkmw/6de6SMs0YHQiF/xjo/DQ==",
-      "signed_at": "2026-06-14T13:48:50.076Z"
+      "signed_at": "2026-06-14T15:13:59.438Z"
     },
     {
       "name": "age-gates-child-safety",
@@ -2337,7 +2337,7 @@
         "US state adult-site age-verification laws — 19+ states by mid-2026 (TX HB 18 upheld by SCOTUS June 2025 in Free Speech Coalition v. Paxton); track ongoing challenges in remaining states"
       ],
       "signature": "7Wdii9uwYmDrzQohoWRWDa5A4aDRKOmdLPq5Jsql86O0Gm7pQANnj9tX+cHpQcQ/Ui8VLuNVP8UFdKxxHeDnBg==",
-      "signed_at": "2026-06-14T13:48:50.077Z"
+      "signed_at": "2026-06-14T15:13:59.438Z"
     },
     {
       "name": "cloud-iam-incident",
@@ -2417,7 +2417,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "r9ii4nb3HJELdtKCGF5qy9PHOiot3GC24yfxfGAKlLENHkdRvRkvvL99eV/6RXyfUaMyrnc2Te8tPQcNu5bsDg==",
-      "signed_at": "2026-06-14T13:48:50.077Z",
+      "signed_at": "2026-06-14T15:13:59.439Z",
       "forward_watch": [
         "AWS IAM Identity Center session-policy refresh and step-up-on-admin enforcement (anticipated 2026-H2 release)",
         "GCP Workload Identity Federation principal-set attribute mapping tightening (post-2026 Q3 Federation hardening guide)",
@@ -2511,7 +2511,7 @@
       ],
       "last_threat_review": "2026-05-15",
       "signature": "9mfDtMApMAg9V/lmwpniNxo/6gNZoOEoYDfyFvyWvKrPMtc7H9F8uz06FVoARe/J49saAKTVXOurNE1D/KtpCQ==",
-      "signed_at": "2026-06-14T13:48:50.077Z",
+      "signed_at": "2026-06-14T15:13:59.439Z",
       "forward_watch": [
         "Entra ID conditional access evolution post-Midnight Blizzard — Microsoft's 2025-2026 commitments on legacy-tenant MFA enforcement and OAuth-app consent gating",
         "Okta IPSIE (Interoperability Profile for Secure Identity in the Enterprise) OpenID Foundation working-group output and adoption timeline",
@@ -2583,7 +2583,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "dOFgANMtHm64uSFRjMfeA0fWZS9ISwMTt59I2CbjaF1PgTtbtb8yg/f+3pC4eXcXIET0KPGxRRmENycfIz3rAw==",
-      "signed_at": "2026-06-14T13:48:50.078Z"
+      "signed_at": "2026-06-14T15:13:59.439Z"
     },
     {
       "name": "mail-server-hardening",
@@ -2642,7 +2642,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "5x8RGzKo/T2IbYnFkYMZs16ThD9a5FEdrKHsnwvtMuGxdyyfZsKNIJVWw2I8O0um0UOXwwkl17Z3zhch26ymCQ==",
-      "signed_at": "2026-06-14T13:48:50.078Z"
+      "signed_at": "2026-06-14T15:13:59.440Z"
     },
     {
       "name": "network-trust",
@@ -2698,7 +2698,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "C/RdmnGjXKreKiGkwJfUESIxUwQzisGJ9A7KBdE9cBRBHBYHkAcScV89L+Z3kOG032Qax6LeIQai7Lr3nrQBCA==",
-      "signed_at": "2026-06-14T13:48:50.078Z"
+      "signed_at": "2026-06-14T15:13:59.440Z"
     },
     {
       "name": "audit-log-integrity",
@@ -2753,7 +2753,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "LvUAq+rXCA8PgNy9lTKOmFqa8T9EJg4JEH0axXvEAf9MIHqbR51ergUkFMLaTuvFuApwsPu0r1C30QgScZbiAw==",
-      "signed_at": "2026-06-14T13:48:50.078Z"
+      "signed_at": "2026-06-14T15:13:59.440Z"
     },
     {
       "name": "self-update-integrity",
@@ -2807,7 +2807,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "BOQZ8G9LdyG/tfpz6rCU4THz5Dq2HGJkUV7uCqSTCMrqnXH6seNXKM41FWawYo0s2VUlXtRgaO7ETp5qgxw+CQ==",
-      "signed_at": "2026-06-14T13:48:50.079Z"
+      "signed_at": "2026-06-14T15:13:59.440Z"
     },
     {
       "name": "multitenancy-isolation",
@@ -2865,7 +2865,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "bncN0VE4ns0lxtPe48xDR33lerw54BPVkSwX7XlrLQcMHTrV94lmjO8z4ZP4Ko61n+KpuP2SNU8v9JT0bGMmAA==",
-      "signed_at": "2026-06-14T13:48:50.079Z"
+      "signed_at": "2026-06-14T15:13:59.440Z"
     },
     {
       "name": "decompression-dos",
@@ -2923,7 +2923,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "03i0ZO5ScHIOjGvDKUEsws6m+20fnlJrEhSBtMU7PJzQutrPpmW9gULE0wbayTD5H9URh5nSKZuuVjvjVhZNCg==",
-      "signed_at": "2026-06-14T13:48:50.079Z"
+      "signed_at": "2026-06-14T15:13:59.441Z"
     },
     {
       "name": "log-injection-telemetry",
@@ -2978,7 +2978,7 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "twTmA2l+Am2k2PCzB2DNxDQwoYlGopJp/3QgQwBsP7h2LF+uNudisqfuOVV/bYnWfrUhuYZUWbsR3mhzbJCUBw==",
-      "signed_at": "2026-06-14T13:48:50.079Z"
+      "signed_at": "2026-06-14T15:13:59.441Z"
     },
     {
       "name": "privacy-consent-ops",
@@ -3033,11 +3033,11 @@
       "d3fend_refs": [],
       "last_threat_review": "2026-06-02",
       "signature": "0sfKSVrIf555c9bDGkXB96fUClN52fMAMYoQsNQ9eUUSzDiWUwdou+q0gYt43nObtj3m9Yb9X6q3oCXDVMgUDg==",
-      "signed_at": "2026-06-14T13:48:50.079Z"
+      "signed_at": "2026-06-14T15:13:59.441Z"
     }
   ],
   "manifest_signature": {
     "algorithm": "Ed25519",
-    "signature_base64": "3ElMjYBjWQ9qY57UTOZO77XJuK4SzIjIEVUMgXc+hOxL34RETEjH4ZIBGzyLrYQ4WCi13JqncrNuEgO2kL8wBw=="
+    "signature_base64": "dRZMYMwRVCbidNKFnB6ap1W1x1nLXU14aI54XF2x80n2AcP81dZtJSrUdUIc4iUztHcelqTNHFgLf+fR67pyAw=="
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/exceptd-skills",
-  "version": "0.18.3",
+  "version": "0.18.4",
   "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (459 CVEs / 181 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
   "keywords": [
     "ai-security",

package/sbom.cdx.json

@@ -1,22 +1,22 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:d2bad09b-5970-48a7-87df-4a4313ccbaca",
+  "serialNumber": "urn:uuid:dc680191-e8c5-40a3-b3c0-89a26e83721a",
   "version": 1,
   "metadata": {
-    "timestamp": "2138-01-13T15:47:39.000Z",
+    "timestamp": "2143-03-07T15:41:05.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.18.3"
+        "version": "0.18.4"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.3",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.18.4",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.18.3",
+      "version": "0.18.4",
       "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (459 CVEs / 181 CWEs / 805 ATT&CK + ICS / 170 ATLAS / 468 D3FEND / 8888 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.3",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.18.4",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "85527924576e3ea8a9342642693d8e2c561a0992a623338c30998ba5fc8ccfad"
+          "content": "91948444fdff651aafbcb4d944a1df628cd43dc8fbd85f88f858937666680ed1"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.3"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.18.4"
         },
         {
           "type": "vcs",
@@ -116,11 +116,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "19ed87890304e9384dd1dbed4d9e659d1239ced5e8901a8529d7af76c81ed9d7"
+          "content": "c7731312578169872836c510c94dcfcc4acfb8337d11780a792d806d6860e956"
         },
         {
           "alg": "SHA3-512",
-          "content": "4a4d31c667079f161c4d980ff80a2f8e214b748e709177bd9942bd3da2e7dd6a96d0fd0d15d374c55455054b531ebb095ff6a2149a8861c1464bb3f19131204c"
+          "content": "cd092814db2785a957737258ed30eecc0db40c719fd105141d2fe166c0399967bf6b917c390dede80d36438c1dad14d4954027d86a20be3a79f0a4cd24464967"
         }
       ]
     },
@@ -281,11 +281,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "379a16da41f9d9ff66c4e1d19453d6a92d71da5f4464f94440d5185e1e14b4de"
+          "content": "0d599c924d9ac9e30a21ee25cf1a9f7bed60205c56074857505ae3b358890692"
         },
         {
           "alg": "SHA3-512",
-          "content": "803a6475512aea6fb1eb2f64a20ae3122398cee7408a00a0ca309ed8d41d6d70fb442603bfbdfa43b043b198c3662f2e141f73ae7729f47e4ed37750111d6dbd"
+          "content": "02154658c71159036f94d0bcd2116d39783e26a4a0199d82540a5e73b7bca154bbfadece13453af3e701fcebbe2a3d31845a803e33f5a65d5ec1c5013dc4b39e"
         }
       ]
     },
@@ -1451,11 +1451,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2a488a8dcbb25e0e46dd04e6c8294406f3f75833ff3b2e59fdc9ba3e589df5c8"
+          "content": "e8abd49962816b5d4aa1ef5d37072f467cff47ffc241c963fb6c0811fc0a7e60"
         },
         {
           "alg": "SHA3-512",
-          "content": "39ec71547e6c9c9823749ae0248f886af234358e6937da59001ae5cd3bb846a7134b0cbf15f5a086f80b2eec1d0a9ebee96d01568559930a5ac560235b19a246"
+          "content": "7e0d3ecc78cc37247d2a3c917258a3d35ac1a1aadfe3fae058239bc11791b50f6bc9cc8075728413ec99fa5d22e4b8158f5afe0a75a49ca63ebd949d8d8c3158"
         }
       ]
     },
@@ -1901,11 +1901,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "58e3b2b80b32fb30a31db9857fcbd356ddd6c61da6dbc3a762c85a4d212dc787"
+          "content": "bc6692b16f3c9205bcda124347d3dc0ba400939ba86bfd860fad5b3b33cad1ed"
         },
         {
           "alg": "SHA3-512",
-          "content": "59ef7ad1198a2a969e8b5e3fe8b07f65441898a481f6f23f4860dcb7a4a48bae0242c03046a4fb79d31c0d2509a096c3346bb2bc9078ce11b9a6aee9c20ce3ba"
+          "content": "a93bc54feddd92f8d43da3232be796ed26a7a687951930d37ac7e26f850c0c200439984f32e839c8ad74780ed786bf6b337f0a73d190eedb2c6902f35922afd0"
         }
       ]
     },
@@ -2096,11 +2096,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9f54c09e25593d82ba36bffcf5ee6b8137eab9e1f5408b7cf6cb681a69806d4c"
+          "content": "b13367b33e18784be5f0afb08348f83d392943c008cab9b3ca95410331f41281"
         },
         {
           "alg": "SHA3-512",
-          "content": "9711d20338cd19da03cb50d089aa42ce5c8f45513d92523a84572494337d88654a29bedc991009ba4522346d3b04506621974707a537c1e24ee1d985017d113f"
+          "content": "b4b493cc6fc6fd2f60cb67e0667c3ba2885e04d8a018d22e82a636a14c33ebcc720dfc3ad0680bf7717e7fb223dbbf8c4307f7e74f934142d483188cdad344cb"
         }
       ]
     },

package/scripts/build-indexes.js

@@ -235,7 +235,7 @@ const OUTPUTS = [
     build: (ctx) => {
       const codes = Object.keys(ctx.globalFrameworks).filter((k) => !k.startsWith("_") && k !== "GLOBAL");
       const NAME_TO_CODE = {
-        "GDPR": "EU", "NIS2": "EU", "DORA": "EU", "EU AI Act": "EU", "ENISA": "EU",
+        "GDPR": "EU", "NIS2": "EU", "DORA": "EU", "EU AI Act": "EU", "ENISA": "EU_ENISA",
         "NCSC": "UK", "Children's Code": "UK", "Online Safety Act": "UK",
         "ISM": "AU", "Essential 8": "AU", "APRA": "AU", "eSafety": "AU",
         "MAS TRM": "SG", "CSA Singapore": "SG",
@@ -336,8 +336,10 @@ const OUTPUTS = [
           entry_types: ["CVE", "CWE"],
         },
       };
-      // CVE half
-      for (const cveId of Object.keys(ctx.cveCatalog).filter((k) => !k.startsWith("_"))) {
+      // CVE half. Skip draft (_draft) CVEs so this derivation agrees with the
+      // reverse-ref index (refresh-reverse-refs.js excludes drafts) — both must
+      // reflect the same operator-queryable, curated truth.
+      for (const cveId of Object.keys(ctx.cveCatalog).filter((k) => !k.startsWith("_") && ctx.cveCatalog[k] && ctx.cveCatalog[k]._draft !== true)) {
         const cve = ctx.cveCatalog[cveId];
         const referencingSkills = ctx.skills
           .filter((s) => {
@@ -692,7 +694,11 @@ function writeMeta(ctx, results) {
       trigger_table_entries: Object.keys(trigger).length,
       chains_cve_entries: cveChainCount,
       chains_cwe_entries: cweChainCount,
-      jurisdictions_indexed: Object.keys(jurisdictionClocks.by_jurisdiction || {}).length || Object.keys(readBack("jurisdiction-map") || {}).length,
+      // The jurisdiction-map indexes EVERY jurisdiction code (including those
+      // with no breach/patch clocks), so it — not the clocks table — is the
+      // count of jurisdictions actually indexed. (`jurisdiction_clocks` below
+      // reports the clocks-only subset.)
+      jurisdictions_indexed: Object.keys(readBack("jurisdiction-map") || {}).length || Object.keys(jurisdictionClocks.by_jurisdiction || {}).length,
       handoff_dag_nodes: handoff.nodes?.length || 0,
       summary_cards: Object.keys(summaryCards.skills || {}).length,
       section_offsets_skills: Object.keys(sectionOffsets.skills || {}).length,