@blamejs/exceptd-skills 0.18.7 → 0.18.8

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 0.18.8 — 2026-06-20
+
+Signature verification now fails closed on the two states an attacker with write access to `keys/` can engineer: a missing `keys/public.pem` makes `loadManifestValidated()` throw rather than return an unverified manifest, and a missing `keys/EXPECTED_FINGERPRINT` makes the manifest-signature check refuse rather than verify against a possibly-swapped key. The pin ships in the tarball and is committed, so its absence is treated as tampering. A missing pin fails closed unconditionally and the error directs you to restore the committed pin; `KEYS_ROTATED=1` governs a key-fingerprint mismatch (a deliberate rotation), which is the only state it applies to — a rotation updates the pin in place, it never removes it.
+
+The compliance close phase no longer crashes when a jurisdiction obligation entry is malformed: a null/non-object entry is skipped during notification enrichment and synthesis instead of throwing; an obligation whose `window_hours` is not a finite number falls back to the pending-clock sentinel instead of computing an invalid date and aborting the phase; a `notification_action` whose `obligation_ref` resolves to nothing is dropped (the unmatched ref is surfaced as a diagnostic) rather than emitted with null jurisdiction/regulation; and a notify obligation with a non-number `window_hours` is surfaced as a diagnostic and skipped rather than synthesized into a malformed record. The threat-currency gate hard-blocks a non-numeric `threat_currency_score` (absent / null / NaN) instead of letting it slip past as "not less than 50"; `forceStale` still overrides. Air-gap mode flags an artifact that has no `air_gap_alternative` so its fall-back to the original (possibly network-bound) source is visible instead of a silent bypass. A CVE marked both `not_affected` and `fixed` in a VEX statement no longer appears as fixed while absent from the matched/baseline sets.
+
+The `theater_score` exposed to `feeds_into` / escalation conditions now follows the same direction as the rest of the engine — a `theater` verdict (a compliance gap exists) scores high and a clear verdict scores low — so a condition such as `theater_score >= 50` chains exactly when a gap is found rather than the reverse.
+
+RWEP scoring is consistent across its three surfaces: the derived score counts the `reboot_required` / `patch_required_reboot` alias once (no double-count), `validateFactors` normalizes `active_exploitation` and accepts the `patch_required_reboot` alias (matching the scorer), and the `compare()` explanation lists the AI factor for `ai_assisted_weaponization`, a stray-cased confirmed exploitation, and the reboot alias.
+
+The orchestrator CSAF report emits a real `cvss_v3` block (base score + vector) for a catalogued CVE instead of a hardcoded `base_score: 0`, and never emits a null description or threat detail. The dispatch plan omits the per-entry `evidence` object when it has no content rather than emitting a bare `{}`, and it now keeps a plan entry for every distinct finding that routes to a skill — two different CVEs that route to the same skill each appear with their own evidence instead of all but the first being silently dropped; a parse-error finding routes directly to its skill rather than relying solely on the domain table. `attest diff`'s human output classifies the sidecar by tamper class first, so an unsigned-substitution attestation is not mislabeled as benign explicitly-unsigned, and prints `(no detail)` instead of `(null)` for an absent timestamp.
+
+Empty-string flag values are rejected instead of silently degrading the command: `--mode ""`, `brief --phase ""`, and `--playbook ""` error rather than running with no scope. The catalog and playbook validators fail loud when a reference catalog or the playbook schema is absent, instead of silently skipping the framework-control, attack-ref, clock-start, and frameworks-in-scope checks — a partial tree can no longer pass an unresolvable reference or an invalid closed-vocabulary value.
+
+`refresh --network`'s upstream prefetch retries a timed-out request (re-classified as a retryable network error) instead of dropping it, so a slow or rate-limiting upstream no longer pushes the scheduled refresh past its error budget. The tarball fetch builds its destination from the canonical npm URL plus a strict-semver-validated version rather than the registry-supplied `dist.tarball`, so a tampered metadata response cannot steer the download's host or path (content trust is unchanged: SHA-512/SRI + shasum + Ed25519); the vendor-source online check likewise validates every URL component (owner/repo shape, hex commit, traversal-free path) before fetching.
+
+The publish-workflow audit now flags a floating (non-SHA) action reference even when the `uses:` line carries a trailing YAML comment — previously such refs were silently missed, reading as compliant.
+
+The index gates fail closed on a degraded tree: a source that vanished between discovery and hashing, or a corrupted hash entry, is reported rather than crashing the validation; and `build-indexes --only` preserves the prior source hashes so a partial rebuild can no longer record stale outputs as fresh. Index files are written atomically.
+
+Internal: the host OS-release lookup reads the file directly instead of spawning `cat`; the orchestrator watch-lock and the playbook mutex lock files are created with an explicit owner-only mode; the evidence-dir entry is opened through a single no-follow descriptor and validated on that descriptor (no check-then-reopen window); the index-output validator and a lock-reentrancy test read through a single descriptor; and a help-text assertion uses a literal substring instead of a partially-escaped regex.
+
 ## 0.18.7 — 2026-06-20
 
 Escalation and feeds_into conditions that use an `any`/`all` quantifier prefix, a quoted `matches '…'` pattern, or a quoted `contains` member now evaluate instead of silently failing closed. Several catalog chains that depended on these forms — most visibly the compliance-theater → SBOM correlation — were dead and now fire; the feeds_into evaluation context also exposes the bare `blast_radius_score`, `theater_verdict`, and `compliance_theater_check` tokens the catalog references, so an engine-computed value is no longer lost to a `null` lookup. The SBOM → kernel / MCP / AI-API follow-ups now fire too: a matched CVE carries an `attack_class`, the analyze and close contexts expose the matched-CVE array the `any matched_cve.attack_class == …` rules quantify over, and the CVEs that map unambiguously to one of those deep-dive classes are tagged in the catalog — so an SBOM scan that surfaces an MCP-server RCE or a prompt-injection-to-RCE routes the operator into the matching deep dive, while an unclassified match routes nowhere rather than guessing. `IN […]` member lists, AND/OR joins, and outer parentheses are parsed quote-aware, so a comma, bracket, or operator inside a quoted value no longer tears the clause, and a `contains`/`IN` against a path that doesn't resolve records a diagnostic instead of evaluating to an invisible false.

package/bin/exceptd.js

@@ -1469,9 +1469,11 @@ function dispatchPlaybook(cmd, argv) {
     }
     runOpts.session_key = args["session-key"];
   }
-  if (args.mode) {
+  if (args.mode !== undefined) {
     // Bug #32: validate --mode against the accepted set. Previously
-    // `--mode garbage` was silently accepted.
+    // `--mode garbage` was silently accepted. Gate on `!== undefined` (not
+    // truthiness) so `--mode ""` is also rejected by the set check below rather
+    // than silently slipping past as a falsy value.
     const VALID_MODES = ["self_service", "authorized_pentest", "ir_response", "ctf", "research", "compliance_audit"];
     if (!VALID_MODES.includes(args.mode)) {
       // v0.13.2: did-you-mean on flag-value typos (Levenshtein ≤ 2).
@@ -2842,7 +2844,10 @@ function cmdLint(runner, args, runOpts, pretty) {
 
 function cmdBrief(runner, args, runOpts, pretty) {
   const playbookId = args._[0];
-  const onlyPhase = args.phase || null;
+  // Preserve an explicit empty string (don't coerce "" -> null) so the
+  // accepted-set check below rejects `--phase ""` instead of silently treating
+  // it as "no filter" and emitting the full brief. Only an OMITTED flag is null.
+  const onlyPhase = args.phase === undefined ? null : args.phase;
 
   // v0.12.9 (P2 #7 from production smoke): refuse garbage values to --phase.
   // Pre-v0.12.9 `brief secrets --phase foo` silently accepted any string and
@@ -2965,6 +2970,11 @@ function cmdVerifyAttestation(runner, args, runOpts, pretty) {
 }
 
 function cmdPlan(runner, args, runOpts, pretty) {
+  // Reject an empty --playbook value rather than letting the truthy gate below
+  // coerce it to null and silently plan across ALL playbooks (wrong scope).
+  if (args.playbook === "" || (Array.isArray(args.playbook) && args.playbook.some(p => p === ""))) {
+    return emitError("plan: --playbook was given an empty value; pass a playbook id, or omit --playbook to plan across all.", { verb: "plan", flag: "playbook" }, pretty);
+  }
   let playbookIds = args.playbook
     ? (Array.isArray(args.playbook) ? args.playbook : [args.playbook])
     : null;
@@ -4243,55 +4253,83 @@ function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
         return emitError(`run: --evidence-dir entry ${f} resolves outside the directory; refusing.`, null, pretty);
       }
       // The path.resolve check above only catches `..` traversal in the
-      // joined path; fs.readFileSync(entryPath) still follows symlinks, so
-      // a `<pb-id>.json -> /etc/shadow` symlink inside the dir would happily
-      // slurp the target. lstat is symlink-aware (it does NOT follow);
-      // refuse anything that's not a regular file. Defense in depth on top
-      // of the readdir filter — a junction (Windows) or bind-mount can
-      // shape-shift in between filter and read.
-      let lst;
-      try { lst = fs.lstatSync(entryPath); }
-      catch (e) {
-        return emitError(`run: --evidence-dir entry ${f}: lstat failed: ${e.message}`, null, pretty);
-      }
-      if (lst.isSymbolicLink()) {
-        return emitError(`run: --evidence-dir entry ${f} is a symbolic link; refusing (symlinks bypass the directory-confinement check).`, { entry: f }, pretty);
-      }
-      if (!lst.isFile()) {
-        return emitError(`run: --evidence-dir entry ${f} is not a regular file; refusing.`, { entry: f }, pretty);
-      }
-      // Windows directory junctions are reparse-point dirs that
-      // `lstat().isSymbolicLink()` returns FALSE for (Node treats them as
-      // ordinary directories), bypassing the symlink refusal above. Use
-      // realpathSync to resolve the entry and confirm it still lives under
-      // the resolved evidence-dir — the realpath approach is portable
-      // (catches POSIX symlinks too, defense in depth) and works regardless
-      // of whether the OS exposes reparse-point bits.
-      let realEntry;
-      try { realEntry = fs.realpathSync(entryPath); }
-      catch (e) {
-        return emitError(`run: --evidence-dir entry ${f}: realpath failed: ${e.message}`, null, pretty);
-      }
-      if (realEntry !== entryPath && !realEntry.startsWith(resolvedDir + path.sep)) {
-        return emitError(
-          `run: --evidence-dir entry ${f} resolves outside the directory (junction / reparse-point / symlink target). Refusing.`,
-          { entry: f, resolved_to: realEntry },
-          pretty
-        );
-      }
-      // Hardlink defense in depth: no clean cross-platform refusal exists —
-      // hardlinks are indistinguishable from regular files at the inode
-      // level. Surface a stderr warning when nlink > 1 so the operator is
-      // aware a second name may point at the same file. Not a refusal —
-      // legitimate use cases (atomic rename, package-manager dedup) produce
-      // nlink > 1 without malicious intent.
-      if (lst.nlink > 1) {
-        process.stderr.write(`[exceptd run --evidence-dir] WARNING: ${f} has nlink=${lst.nlink}; a hardlink to this file exists elsewhere on the filesystem. Hardlinks cannot be refused cross-platform — confirm the file content is what you expect.\n`);
+      // joined path; reading the path would still follow symlinks, so a
+      // `<pb-id>.json -> /etc/shadow` symlink inside the dir would slurp the
+      // target. Rather than lstat/realpath the PATH and then re-open it
+      // (a check-then-use TOCTOU window), open a single O_NOFOLLOW descriptor
+      // FIRST and make every subsequent decision about that exact descriptor.
+      // O_NOFOLLOW refuses a symlinked leaf at open (ELOOP) on POSIX; on
+      // Windows it is a no-op, so the fstat type check + realpath gate below
+      // carry the junction/symlink defense. Opening before any path stat means
+      // the bytes read come from the inode we validated, not a path that could
+      // be re-pointed between check and read.
+      let efd;
+      try {
+        const O_NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
+        efd = fs.openSync(entryPath, fs.constants.O_RDONLY | O_NOFOLLOW);
+      } catch (e) {
+        const why = e.code === "ELOOP"
+          ? "symbolic link refused (symlinks bypass the directory-confinement check)"
+          : e.message;
+        return emitError(`run: --evidence-dir entry ${f}: open failed: ${why}`, { entry: f }, pretty);
       }
       try {
-        bundle[pbId] = JSON.parse(fs.readFileSync(entryPath, "utf8"));
+        const st = fs.fstatSync(efd);
+        if (!st.isFile()) {
+          return emitError(`run: --evidence-dir entry ${f} is not a regular file; refusing (symlink / junction / dir / fifo bypass the directory-confinement check).`, { entry: f }, pretty);
+        }
+        // Hardlink defense in depth: no clean cross-platform refusal exists —
+        // hardlinks are indistinguishable from regular files at the inode
+        // level. Surface a stderr warning when nlink > 1 so the operator is
+        // aware a second name may point at the same file. Not a refusal —
+        // legitimate use cases (atomic rename, package-manager dedup) produce
+        // nlink > 1 without malicious intent.
+        if (st.nlink > 1) {
+          process.stderr.write(`[exceptd run --evidence-dir] WARNING: ${f} has nlink=${st.nlink}; a hardlink to this file exists elsewhere on the filesystem. Hardlinks cannot be refused cross-platform — confirm the file content is what you expect.\n`);
+        }
+        // Read the bytes from `efd` FIRST — the descriptor was opened
+        // O_NOFOLLOW and fstat-confirmed a regular file, so this reads the exact
+        // inode we validated. Reading before the realpath gate (rather than
+        // checking the path then reading) means there is no check-then-use
+        // window at all; the containment gate below decides whether to USE the
+        // bytes, and discards them otherwise.
+        const raw = fs.readFileSync(efd, "utf8");
+        // Symlink refusal. O_NOFOLLOW already rejects a symlinked leaf at open on
+        // POSIX (ELOOP), but it is a no-op on Windows, where the open follows the
+        // link. Detect and refuse a symlink explicitly via lstat — regardless of
+        // where it points — so a symlinked entry is never accepted. This runs
+        // AFTER the descriptor read (the bytes are dropped on refusal), so there
+        // is no path-check-before-read TOCTOU window.
+        let lst;
+        try { lst = fs.lstatSync(entryPath); }
+        catch (e) {
+          return emitError(`run: --evidence-dir entry ${f}: lstat failed: ${e.message}`, null, pretty);
+        }
+        if (lst.isSymbolicLink()) {
+          return emitError(`run: --evidence-dir entry ${f} is a symbolic link; refusing (symlinks bypass the directory-confinement check).`, { entry: f }, pretty);
+        }
+        // Windows directory junctions are reparse-point dirs that
+        // lstat().isSymbolicLink() returns FALSE for, and O_NOFOLLOW is a
+        // no-op there; realpath resolves the entry and confirms it still lives
+        // under the resolved evidence-dir. A target that escapes the dir is
+        // refused and the already-read bytes are dropped unused.
+        let realEntry;
+        try { realEntry = fs.realpathSync(entryPath); }
+        catch (e) {
+          return emitError(`run: --evidence-dir entry ${f}: realpath failed: ${e.message}`, null, pretty);
+        }
+        if (realEntry !== entryPath && !realEntry.startsWith(resolvedDir + path.sep)) {
+          return emitError(
+            `run: --evidence-dir entry ${f} resolves outside the directory (junction / reparse-point / symlink target). Refusing.`,
+            { entry: f, resolved_to: realEntry },
+            pretty
+          );
+        }
+        bundle[pbId] = JSON.parse(raw);
       } catch (e) {
-        return emitError(`run: failed to parse --evidence-dir entry ${f}: ${e.message}`, null, pretty);
+        return emitError(`run: failed to read --evidence-dir entry ${f}: ${e.message}`, null, pretty);
+      } finally {
+        try { fs.closeSync(efd); } catch { /* already closed / invalid fd */ }
       }
     }
   }
@@ -5641,8 +5679,8 @@ function cmdReattest(runner, args, runOpts, pretty) {
     lines.push(`attest diff: ${obj.session_id} (${obj.playbook_id})`);
     const icon = obj.status === "unchanged" ? "[ok]" : "[i  DRIFTED]";
     lines.push(`\n${icon}  status=${obj.status}`);
-    lines.push(`  prior:  ${obj.prior_evidence_hash}  (${obj.prior_captured_at})`);
-    lines.push(`  replay: ${obj.replay_evidence_hash}  (${obj.replayed_at})`);
+    lines.push(`  prior:  ${obj.prior_evidence_hash}  (${obj.prior_captured_at || '(no detail)'})`);
+    lines.push(`  replay: ${obj.replay_evidence_hash}  (${obj.replayed_at || '(no detail)'})`);
     if (obj.replay_classification) {
       lines.push(`  replay classification: ${obj.replay_classification}  RWEP=${obj.replay_rwep_adjusted ?? 0}`);
     }
@@ -5748,13 +5786,13 @@ function renderAttestDiff(obj) {
   lines.push(`  artifact diff:  ${ad.added?.length ?? 0} added, ${ad.removed?.length ?? 0} removed, ${ad.changed?.length ?? 0} changed, ${ad.unchanged_count ?? 0} unchanged (of ${ad.total_compared ?? 0})`);
   lines.push(`  signal diff:    ${sd.changed?.length ?? 0} changed, ${sd.unchanged_count ?? 0} unchanged (of ${sd.total_compared ?? 0})`);
   if (obj.sidecar_verify) {
-    const sv = obj.sidecar_verify;
-    let sidecarClass = "verified";
-    if (!sv.signed && sv.reason && sv.reason.includes("explicitly unsigned")) sidecarClass = "explicitly-unsigned";
-    else if (!sv.signed && sv.reason && sv.reason.includes("no .sig sidecar")) sidecarClass = "no-sidecar";
-    else if (sv.signed && !sv.verified) sidecarClass = "tamper-detected";
-    else if (!sv.signed) sidecarClass = "no-public-key";
-    lines.push(`  sidecar verify: ${sidecarClass}`);
+    // Use the canonical classifier, which checks tamper_class BEFORE the reason
+    // strings. The previous inline logic matched reason.includes("explicitly
+    // unsigned") first, so an unsigned-SUBSTITUTION attack (whose reason also
+    // contains "explicitly unsigned" but carries tamper_class:
+    // 'unsigned-substitution') was mislabeled as the benign 'explicitly-unsigned'
+    // — hiding the substitution signal in the human diff output.
+    lines.push(`  sidecar verify: ${classifySidecarVerify(obj.sidecar_verify)}`);
   }
   return lines.join("\n");
 }
@@ -6685,11 +6723,13 @@ function cmdDiscover(runner, args, runOpts, pretty) {
   let hostDistro = null;
   if (hostPlatform === "linux") {
     try {
-      const res = spawnSync("cat", ["/etc/os-release"], { encoding: "utf8" });
-      if (res.status === 0 && res.stdout) {
-        const idMatch = res.stdout.match(/^ID=(.+)$/m);
-        const verMatch = res.stdout.match(/^VERSION_ID=(.+)$/m);
-        const prettyMatch = res.stdout.match(/^PRETTY_NAME=(.+)$/m);
+      // Read the file directly instead of spawning `cat` (a process to do what
+      // fs does, and a static-analysis "unnecessary use of cat" flag).
+      const osRelease = fs.readFileSync("/etc/os-release", "utf8");
+      if (osRelease) {
+        const idMatch = osRelease.match(/^ID=(.+)$/m);
+        const verMatch = osRelease.match(/^VERSION_ID=(.+)$/m);
+        const prettyMatch = osRelease.match(/^PRETTY_NAME=(.+)$/m);
         hostDistro = {
           id: idMatch ? idMatch[1].replace(/^"|"$/g, "") : null,
           version_id: verMatch ? verMatch[1].replace(/^"|"$/g, "") : null,

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-20T16:35:33.578Z",
+  "generated_at": "2026-06-20T22:42:01.751Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "6e8a5ac562c706b0142ad12b07a62982bb83d500870ca33a5d865bd17a16d23a",
+    "manifest.json": "9e87cb1282ac35f2d0564d0eb4571583874e01fb74890989ced47bf50c099ab3",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",

package/lib/collectors/library-author.js

@@ -194,8 +194,11 @@ function scanPublishWorkflow(content, rel) {
     if (line.length > 4096) continue;
     // Allow optional leading `-` from a YAML list item: `- uses: ...`.
     // `^[ \t]*(?:-[ \t]*)?` anchors the indentation once, then an optional
-    // `- ` list marker — no overlapping `\s*` runs that backtrack.
-    const m = line.match(/^[ \t]*(?:-[ \t]*)?uses:\s*['"]?([^'"\s]+)['"]?\s*$/);
+    // `- ` list marker — no overlapping `\s*` runs that backtrack. Exclude `#`
+    // from the capture and drop the end anchor (mirroring the cicd collector) so
+    // a `uses: x@v1  # comment` line is still matched — the `$`-anchored pattern
+    // silently missed every floating ref that carried a trailing YAML comment.
+    const m = line.match(/^[ \t]*(?:-[ \t]*)?uses:\s*['"]?([^'"\s#]+)['"]?/);
     if (!m) continue;
     const ref = m[1];
     if (ref.startsWith("./") || ref.startsWith("./.github/")) continue; // local

package/lib/playbook-runner.js

@@ -249,15 +249,22 @@ function preflight(playbook, runOpts = {}) {
 
   // 1. Currency gate
   const score = meta.threat_currency_score;
-  if (score < 50 && !runOpts.forceStale) {
+  // A non-numeric score (absent / null / NaN from a malformed _meta) must HARD
+  // BLOCK, not slip through: `undefined < 50` is false, which would silently
+  // bypass the staleness gate on exactly the playbooks whose currency metadata
+  // is broken. Treat "no usable score" as the most-stale state.
+  const scoreUsable = typeof score === 'number' && !Number.isNaN(score);
+  if ((!scoreUsable || score < 50) && !runOpts.forceStale) {
     return {
       ok: false,
       blocked_by: 'currency',
-      reason: `threat_currency_score = ${score} (< 50). Hard-blocked. Pass forceStale=true to override.`,
+      reason: scoreUsable
+        ? `threat_currency_score = ${score} (< 50). Hard-blocked. Pass forceStale=true to override.`
+        : `threat_currency_score is absent or non-numeric (${JSON.stringify(score)}). Hard-blocked — a playbook without a usable currency score is treated as stale. Fix _meta.threat_currency_score, or pass forceStale=true to override.`,
       issues
     };
   }
-  if (score < 70) {
+  if (scoreUsable && score < 70) {
     issues.push({ kind: 'currency_warn', message: `threat_currency_score = ${score} (< 70). Threat model is stale — recommend running the skill-update-loop before relying on findings.` });
   }
 
@@ -649,7 +656,12 @@ function look(playbookId, directiveId, runOpts = {}) {
       // Surface the air-gap alternative as the primary source when air_gap_mode
       // is active, so the agent doesn't accidentally hit the network.
       source: airGap && a.air_gap_alternative ? a.air_gap_alternative : a.source,
-      _original_source: a.source
+      _original_source: a.source,
+      // In air-gap mode an artifact with NO air_gap_alternative silently keeps
+      // its original (possibly network-bound) source — defeating air-gap with no
+      // signal. Flag it so the agent treats the source as not-offline-verified
+      // and the gap is observable instead of a silent network fallback.
+      ...(airGap && !a.air_gap_alternative ? { air_gap_alternative_missing: true } : {}),
     })),
     collection_scope: l.collection_scope,
     environment_assumptions: l.environment_assumptions || [],
@@ -1019,8 +1031,12 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     : [];
   // VEX-fixed CVEs remain in matched/catalog arrays but get annotated
   // with vex_status:'fixed' downstream so consumers see them as resolved.
+  // Source from catalogBaselineCves (post-vexFilter survivors), NOT allCves: a
+  // CVE the operator marked BOTH not_affected (dropped by vexFilter) AND fixed
+  // is contradictory, and listing it as fixed while it's absent from
+  // matched/baseline would have it appear in fixed_cves but nowhere else.
   const vexFixedIds = vexFixed
-    ? allCves.filter(c => vexFixed.has(c.cve_id)).map(c => c.cve_id)
+    ? catalogBaselineCves.filter(c => vexFixed.has(c.cve_id)).map(c => c.cve_id)
     : [];
 
   // Build correlation map: cve_id -> array of "indicator_hit:<id>" / "signal:<id>" reasons.
@@ -1744,8 +1760,16 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
   };
   const enrichNotification = (na) => {
     const obligation = (g.jurisdiction_obligations || []).find(o =>
+      o && typeof o === 'object' &&
       `${o.jurisdiction}/${o.regulation} ${o.window_hours}h` === na.obligation_ref
     );
+    // A non-empty obligation_ref that resolves to nothing leaves the
+    // jurisdiction / regulation / deadline fields null below — surface it as a
+    // runtime_error so the unmatched ref is observable, not a silent null record.
+    if (!obligation && na && typeof na.obligation_ref === 'string' && na.obligation_ref &&
+        Array.isArray(runOpts && runOpts._runErrors)) {
+      pushRunError(runOpts._runErrors, { kind: 'unresolved_obligation_ref', obligation_ref: na.obligation_ref }, { dedupeKey: x => x.obligation_ref || '' });
+    }
     // Thread runOpts + the engine-computed classification through so
     // computeClockStart can check operator_consent.explicit before
     // auto-stamping detect_confirmed, and so an engine-confirmed detection
@@ -1776,9 +1800,23 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
       && autoStartEvent
       && eventReady
       && !(runOpts && runOpts.operator_consent && runOpts.operator_consent.explicit === true);
-    const deadline = obligation && clockValid
+    // window_hours must be a finite number before it enters the deadline
+    // arithmetic — a malformed obligation with an undefined/null/non-number
+    // window_hours would otherwise compute `getTime() + NaN` and crash the
+    // close phase at `new Date(NaN).toISOString()`. Runtime validation of the
+    // playbook is not enforced, so guard here independently of the schema.
+    const windowValid = obligation && typeof obligation.window_hours === 'number' && Number.isFinite(obligation.window_hours);
+    const deadline = obligation && clockValid && windowValid
       ? new Date(clockStart.getTime() + obligation.window_hours * 3600 * 1000).toISOString()
       : 'pending_clock_start_event';
+    // A notification_action whose obligation_ref was specified but resolves to
+    // no obligation is an internally-inconsistent playbook (the schema requires
+    // obligation_ref to name a real govern obligation). The unmatched ref is
+    // already surfaced as a runtime_error above; drop the record rather than
+    // emit a null-jurisdiction/regulation entry that pollutes the deadline list.
+    if (!obligation && na && typeof na.obligation_ref === 'string' && na.obligation_ref) {
+      return null;
+    }
     return {
       ...na,
       // Carry obligation metadata forward so each notification entry is
@@ -1827,7 +1865,10 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
       })(),
     };
   };
-  const notificationActions = (c.notification_actions || []).map(enrichNotification);
+  // enrichNotification returns null for an unresolved specified obligation_ref
+  // (already surfaced as a runtime_error); filter those out so the notification
+  // list never carries a null-jurisdiction record.
+  const notificationActions = (c.notification_actions || []).map(enrichNotification).filter(Boolean);
 
   // A govern obligation that declares a notification duty but has no
   // matching close.notification_actions entry would otherwise never surface
@@ -1839,15 +1880,27 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
   // can tell it apart from a playbook-authored action.
   const coveredObligationRefs = new Set((c.notification_actions || []).map(na => na.obligation_ref));
   for (const o of (g.jurisdiction_obligations || [])) {
+    if (!o || typeof o !== 'object') continue; // skip a null/malformed obligation rather than crash close() during synthesis
     if (!String(o.obligation || '').startsWith('notify')) continue;
+    // A notify obligation with a non-number window_hours is malformed: it would
+    // synthesize a "…/… undefinedh" ref and could not produce a real deadline.
+    // Surface it as a runtime_error and skip synthesis rather than emit a bogus
+    // record (the deadline guard in enrichNotification also prevents the crash).
+    if (typeof o.window_hours !== 'number' || !Number.isFinite(o.window_hours)) {
+      if (Array.isArray(runOpts && runOpts._runErrors)) {
+        pushRunError(runOpts._runErrors, { kind: 'malformed_obligation_window_hours', obligation: `${o.jurisdiction}/${o.regulation}` }, { dedupeKey: x => x.obligation || '' });
+      }
+      continue;
+    }
     const ref = `${o.jurisdiction}/${o.regulation} ${o.window_hours}h`;
     if (coveredObligationRefs.has(ref)) continue;
-    notificationActions.push(enrichNotification({
+    const synthesized = enrichNotification({
       obligation_ref: ref,
       recipient: null,
       draft_notification: null,
       synthesized_from_obligation: true,
-    }));
+    });
+    if (synthesized) notificationActions.push(synthesized);
   }
 
   // exception_generation — evaluate trigger.
@@ -1999,7 +2052,12 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     // Govern-phase jurisdiction obligations so feeds_into conditions like
     // `… AND jurisdiction_obligations contains 'EU'` (framework → sbom) resolve.
     jurisdiction_obligations: (g && g.jurisdiction_obligations) || (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [],
-    theater_score: analyzeResult.compliance_theater_check?.verdict === 'theater' ? 0 : 100,
+    // theater_score follows lib/framework-gap.js's convention: HIGH = more
+    // theater detected (worse). A 'theater' verdict (a gap exists) is the
+    // concerning case, so it scores 100; a clear verdict scores 0. (Earlier
+    // this was inverted, so a feeds_into condition like `theater_score >= 50`
+    // would have failed to fire exactly when a gap was found.)
+    theater_score: analyzeResult.compliance_theater_check?.verdict === 'theater' ? 100 : 0,
     // Top-level matched_cve array so the shipped sbom feeds_into quantifiers
     // (`any matched_cve.attack_class == 'kernel-lpe'`, … IN ['ai-c2', …]) re-root
     // at each matched CVE. Without it the quantifier head resolves null and the

package/lib/prefetch.js

@@ -289,7 +289,8 @@ Outputs:
 
 async function timedFetch(url, headers = {}) {
   const ac = new AbortController();
-  const t = setTimeout(() => ac.abort(), REQUEST_TIMEOUT_MS);
+  let timedOut = false;
+  const t = setTimeout(() => { timedOut = true; ac.abort(); }, REQUEST_TIMEOUT_MS);
   try {
     const res = await fetch(url, {
       signal: ac.signal,
@@ -309,6 +310,20 @@ async function timedFetch(url, headers = {}) {
     const lastModified = res.headers.get("last-modified") || null;
     const json = await res.json();
     return { json, etag, lastModified };
+  } catch (e) {
+    // A timeout surfaces as an AbortError with NO statusCode, which the retry
+    // classifier would not retry — so under heavy upstream load (NVD rate
+    // limiting + slow responses) timed-out fetches piled up as final errors and
+    // pushed the total past --max-errors, failing the whole scheduled refresh.
+    // Re-mark a timeout as a retryable network error (ETIMEDOUT) so the job
+    // queue backs off and retries instead of dropping it on the first slow
+    // response.
+    if (timedOut || (e && (e.name === "AbortError" || e.code === "ABORT_ERR"))) {
+      const te = new Error(`request timed out after ${REQUEST_TIMEOUT_MS}ms`);
+      te.code = "ETIMEDOUT";
+      throw te;
+    }
+    throw e;
   } finally {
     clearTimeout(t);
   }

package/lib/refresh-network.js

@@ -42,6 +42,24 @@ const os = require("os");
 
 const ROOT = path.resolve(__dirname, "..");
 const PKG_NAME = "@blamejs/exceptd-skills";
+// Unscoped basename for the npm tarball filename: @scope/name -> name.
+const PKG_UNSCOPED = PKG_NAME.includes("/") ? PKG_NAME.split("/").pop() : PKG_NAME;
+// Strict semver — the ONLY registry-metadata field embedded in the fetch URL.
+// A value that passes this guard cannot carry a path separator, URL scheme, or
+// host, so the canonical tarball URL built from it has no metadata-controlled
+// destination component.
+const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+// The canonical npm tarball URL for this package@version, built entirely from
+// string literals plus a semver-guarded version. The fetch destination is no
+// longer derived from the metadata-supplied dist.tarball, so a tampered or
+// fixture-injected /latest response cannot steer the download at an internal or
+// attacker-controlled address — strictly stronger than host-allowlisting the
+// metadata URL. Content trust still rests on the SHA-512/SRI + shasum + Ed25519
+// checks downstream.
+function canonicalTarballUrl(version) {
+  return `https://registry.npmjs.org/${PKG_NAME}/-/${PKG_UNSCOPED}-${version}.tgz`;
+}
 const REQUEST_TIMEOUT_MS = 15000;
 
 function parseArgs(argv) {
@@ -446,11 +464,25 @@ async function main() {
     process.exitCode = 3; return;
   }
 
-  progress(`fetching ${tarballUrl} (${tarballShasum?.slice(0, 12) || "no shasum"})...`, opts.json);
+  // Build the fetch destination from constants + a semver-validated version
+  // rather than from the metadata-supplied dist.tarball, so the registry
+  // response cannot steer the download's host or path. The metadata URL is
+  // still cross-checked for visibility; a divergence is noted, not fatal,
+  // because the authenticity anchor is the SHA-512/shasum/Ed25519 chain below.
+  if (!SEMVER_RE.test(String(latestVersion))) {
+    emit({ ok: false, error: `registry metadata version is not valid semver: ${String(latestVersion).slice(0, 64)}` }, opts.json);
+    process.exitCode = 2; return;
+  }
+  const canonicalUrl = canonicalTarballUrl(latestVersion);
+  if (tarballUrl !== canonicalUrl) {
+    progress(`note: registry dist.tarball (${tarballUrl}) differs from canonical npm URL; fetching ${canonicalUrl}`, opts.json);
+  }
+
+  progress(`fetching ${canonicalUrl} (${tarballShasum?.slice(0, 12) || "no shasum"})...`, opts.json);
 
   let tgzBuf;
   try {
-    tgzBuf = await getBuffer(tarballUrl, opts.timeoutMs);
+    tgzBuf = await getBuffer(canonicalUrl, opts.timeoutMs);
   } catch (e) {
     emit({ ok: false, error: `tarball fetch failed: ${e.message}` }, opts.json);
     process.exitCode = 2; return;

package/lib/scoring.js

@@ -179,10 +179,15 @@ function validateFactors(factors) {
   const boolFields = ['cisa_kev', 'poc_available', 'ai_assisted_weapon', 'ai_discovered',
                       'patch_available', 'live_patch_available', 'reboot_required'];
   for (const f of boolFields) {
-    // The catalog field `ai_assisted_weaponization` satisfies `ai_assisted_weapon`.
+    // The catalog field `ai_assisted_weaponization` satisfies `ai_assisted_weapon`,
+    // and `patch_required_reboot` satisfies `reboot_required` — the same aliasing
+    // scoreCustom/deriveRwepFromFactors honor, so validateFactors must accept a
+    // block that supplies only the alias instead of flagging it "missing".
     const present = (f === 'ai_assisted_weapon')
       ? (factors.ai_assisted_weapon ?? factors.ai_assisted_weaponization)
-      : factors[f];
+      : (f === 'reboot_required')
+        ? (factors.reboot_required ?? factors.patch_required_reboot)
+        : factors[f];
     if (present === undefined || present === null) {
       warnings.push(`${f}: missing (treated as false; explicit value recommended)`);
     } else if (typeof present !== 'boolean') {
@@ -190,10 +195,18 @@ function validateFactors(factors) {
     }
   }
   const aeAllowed = ['none', 'unknown', 'suspected', 'theoretical', 'confirmed'];
-  if (factors.active_exploitation === undefined || factors.active_exploitation === null) {
+  const aeRaw = factors.active_exploitation;
+  if (aeRaw === undefined || aeRaw === null) {
     warnings.push("active_exploitation: missing (treated as 'none')");
-  } else if (!aeAllowed.includes(factors.active_exploitation)) {
-    warnings.push(`active_exploitation: expected one of ${aeAllowed.join(', ')}, got ${JSON.stringify(factors.active_exploitation)}`);
+  } else {
+    // Normalize (trim + lowercase) before the vocab check so validateFactors
+    // accepts exactly what scoreCustom/resolveActiveExploitation accept — a
+    // stray-cased 'Confirmed' / ' confirmed ' must not be flagged here while the
+    // scorer consumes it, or the two surfaces disagree.
+    const aeNorm = typeof aeRaw === 'string' ? aeRaw.trim().toLowerCase() : aeRaw;
+    if (!aeAllowed.includes(aeNorm)) {
+      warnings.push(`active_exploitation: expected one of ${aeAllowed.join(', ')}, got ${JSON.stringify(aeRaw)}`);
+    }
   }
   // NaN diagnostics. The prior message read "expected number,
   // got number (null)" because `JSON.stringify(NaN) === 'null'` and `typeof
@@ -346,7 +359,7 @@ function deriveRwepFromFactors(factors) {
   if (values.length === 0) return 0;
   const aeAllowed = new Set(['none', 'unknown', 'suspected', 'theoretical', 'confirmed']);
   const hasBooleanOrLadder = values.some(
-    (v) => typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v)),
+    (v) => typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v.trim().toLowerCase())),
   );
   if (hasBooleanOrLadder) {
     return scoreCustom(factors);
@@ -367,6 +380,12 @@ function deriveRwepFromFactors(factors) {
   let sum = 0;
   for (const [k, v] of Object.entries(factors)) {
     if (typeof v !== 'number' || !Number.isFinite(v)) continue;
+    // reboot_required and patch_required_reboot are aliases for the SAME
+    // post-weight contribution (scoreCustom collapses them). A block carrying
+    // both must count it once; summing both double-counts the reboot weight,
+    // inflating the derived RWEP past the formula AND past the stored score the
+    // validate() divergence gate compares against.
+    if (k === 'patch_required_reboot' && Object.prototype.hasOwnProperty.call(factors, 'reboot_required')) continue;
     if (k === 'blast_radius') {
       sum += Math.max(0, Math.min(RWEP_WEIGHTS.blast_radius, v));
     } else {
@@ -447,12 +466,17 @@ function compare(cveId, catalog, opts) {
     explanation = 'CVSS absent — RWEP is the only usable score for this CVE; no CVSS comparison is possible. Backfill cvss_score in the catalog to enable the comparison.';
   } else if (delta > 10) {
     explanation = `RWEP significantly higher than CVSS equivalent. Factors driving delta: `;
+    // The explanation must list every factor scoreCustom actually counts, via
+    // the same aliases/normalization — otherwise a CVE whose RWEP is driven by
+    // ai_assisted_weaponization (not ai_discovered), a stray-cased 'Confirmed',
+    // or the patch_required_reboot alias shows a higher RWEP with no stated
+    // reason for the delta.
     const driving = [];
     if (entry.cisa_kev) driving.push('CISA KEV (+25)');
     if (entry.poc_available) driving.push('public PoC (+20)');
-    if (entry.ai_discovered) driving.push('AI-discovered (+15 weaponization)');
-    if (entry.active_exploitation === 'confirmed') driving.push('confirmed exploitation (+20)');
-    if (entry.patch_required_reboot && !entry.live_patch_available) driving.push('reboot required (+5)');
+    if (entry.ai_discovered || entry.ai_assisted_weaponization) driving.push('AI-discovered (+15 weaponization)');
+    if (String(entry.active_exploitation || '').trim().toLowerCase() === 'confirmed') driving.push('confirmed exploitation (+20)');
+    if ((entry.reboot_required || entry.patch_required_reboot) && !entry.live_patch_available) driving.push('reboot required (+5)');
     explanation += driving.join(', ');
     explanation += '. Framework patch SLAs calibrated to CVSS are insufficient for this CVE.';
   } else if (delta < -10) {
@@ -612,7 +636,10 @@ function validate(catalog) {
       blast_radius: entry.rwep_factors ? entry.rwep_factors.blast_radius : 0,
       patch_available: entry.patch_available,
       live_patch_available: entry.live_patch_available,
-      reboot_required: entry.patch_required_reboot
+      // Mirror the reboot alias scoreCustom itself honors (reboot_required OR
+      // patch_required_reboot): passing only patch_required_reboot would drop a
+      // top-level reboot_required field and compute a divergent expected RWEP.
+      reboot_required: entry.reboot_required || entry.patch_required_reboot
     });
     if (Math.abs(calculatedRwep - entry.rwep_score) > 5) {
       errors.push(`${cveId}: rwep_score ${entry.rwep_score} diverges from calculated ${calculatedRwep} by more than 5 — verify factors`);