@blamejs/exceptd-skills 0.18.9 → 0.18.12

package/lib/collectors/cred-stores.js

@@ -57,7 +57,7 @@ function fileExists(full) {
 // AWS credentials INI: any [profile] block carrying
 // `aws_access_key_id` AND no `sso_session` / `credential_process`.
 function parseAwsCredentials(content) {
-  if (!content) return { staticProfiles: [], federatedProfiles: [] };
+  if (!content) return { staticProfiles: [], federatedProfiles: [], staticKeys: {} };
   const lines = content.split(/\r?\n/);
   const profiles = {};
   let current = null;
@@ -77,13 +77,21 @@ function parseAwsCredentials(content) {
   }
   const staticProfiles = [];
   const federatedProfiles = [];
+  // Per-static-profile aws_access_key_id, so doc-fixture demotion can key off
+  // the exact parsed value instead of re-finding the first name-matching block.
+  // A duplicate profile name resolves to the LAST occurrence's keys here, which
+  // is the same precedence the AWS SDK applies.
+  const staticKeys = {};
   for (const [name, kv] of Object.entries(profiles)) {
     const hasKey = !!kv["aws_access_key_id"];
     const hasFederation = !!(kv["sso_session"] || kv["credential_process"] || kv["role_arn"]);
-    if (hasKey && !hasFederation) staticProfiles.push(name);
+    if (hasKey && !hasFederation) {
+      staticProfiles.push(name);
+      staticKeys[name] = kv["aws_access_key_id"];
+    }
     if (hasFederation) federatedProfiles.push(name);
   }
-  return { staticProfiles, federatedProfiles };
+  return { staticProfiles, federatedProfiles, staticKeys };
 }
 
 // kubeconfig: users[].user.token field present (non-empty) with no
@@ -247,12 +255,13 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   // unsatisfied, which is the honest outcome.
   const AWS_DOC_FIXTURE_KEY = "AKIAIOSFODNN7EXAMPLE";
   const realAwsProfiles = awsCredsParsed.staticProfiles.filter(p => {
-    // Parse the raw INI again for this profile's key value + name.
-    // For doc-fixture demotion (FP[0]) we look up the key value; for
-    // break-glass demotion (FP[2]) we check the profile name pattern.
-    const block = (awsCredsContent || "").split(/^\[/m).find(b => b.startsWith(p + "]"));
-    if (!block) return true;
-    if (block.includes(AWS_DOC_FIXTURE_KEY)) return false; // FP[0]
+    // Demote off this profile's EXACT parsed key value (FP[0]) and its name
+    // (FP[2]). Keying off the parsed value — not the first raw block whose
+    // name matches — means a duplicate profile name whose first occurrence
+    // holds the doc-fixture key cannot demote the later real key under the
+    // same name (the parser resolves the live last-occurrence value).
+    const keyVal = awsCredsParsed.staticKeys[p];
+    if (keyVal === AWS_DOC_FIXTURE_KEY) return false; // FP[0]
     if (/^breakglass-/i.test(p) || /^break-glass-/i.test(p)) return false; // FP[2]
     return true;
   });

package/lib/collectors/secrets.js

@@ -495,8 +495,10 @@ function collect({ cwd = process.cwd(), env = process.env, args = {} } = {}) {
   //   any private-key file with mode != 0600
   // The collector scope is the cwd; ~/.ssh enumeration is outside this
   // walk root. Within cwd, flag any discovered private key whose mode
-  // is anything other than 0600 (strict).
-  const sshKeyPostures = process.platform === "win32" ? [] : sshPrivateKeys.map(f => ({ file: f.rel, ...statPosture(f.full) }));
+  // is anything other than 0600 (strict). Use the test-path-filtered set
+  // (prodSshPrivateKeys) — matching ssh-private-key-block — so a fixture
+  // key checked in under a test/ path doesn't raise a bad-perms posture.
+  const sshKeyPostures = process.platform === "win32" ? [] : prodSshPrivateKeys.map(f => ({ file: f.rel, ...statPosture(f.full) }));
   signal_overrides["ssh-key-bad-perms"] = sshKeyPostures.some(p => p.error == null && p.mode !== 0o600) ? "hit" : "miss";
 
   // Per-indicator file locations for every indicator flipped to "hit", so

package/lib/cross-ref-api.js

@@ -119,6 +119,16 @@ function entries(catalog) {
   return Object.entries(catalog).filter(([k]) => !k.startsWith('_'));
 }
 
+// Auto-imported drafts carry conservative-default mechanical fields and
+// null analytical fields pending curation. byCve() excludes them by
+// default; every transitive enumeration that walks the same catalog
+// (byCwe / byTtp / bySkill) must apply the identical contract so a draft
+// never surfaces as a curated cross-reference. Keyed on `_auto_imported`
+// to match byCve's exact predicate, so all four entry points agree.
+function _isDraftEntry(c) {
+  return !!c && c._auto_imported === true;
+}
+
 // Single source of truth for the xref sub-maps the skill-correlation
 // queries read. These names MUST stay identical to the keys the index
 // builder emits into data/_indexes/xref.json; reading under a name the
@@ -179,7 +189,7 @@ function byCve(cveId, opts) {
   const catalog = loadCatalog('cve-catalog.json');
   const entry = catalog[cveId];
   if (!entry) return { found: false, cve_id: cveId };
-  if (!includeDrafts && entry._auto_imported === true) {
+  if (!includeDrafts && _isDraftEntry(entry)) {
     return { found: false, cve_id: cveId, _draft_excluded: true };
   }
 
@@ -235,24 +245,36 @@ function byCwe(cweId) {
   const xref = loadIndex('xref.json');
   const skills = skillsForCwe(xref, cweId).slice();
   const relatedCves = entries(loadCatalog('cve-catalog.json'))
-    .filter(([, c]) => Array.isArray(c.cwe_refs) && c.cwe_refs.includes(cweId))
+    .filter(([, c]) => !_isDraftEntry(c) && Array.isArray(c.cwe_refs) && c.cwe_refs.includes(cweId))
     .map(([id]) => id);
   return { found: true, cwe_id: cweId, entry, skills, related_cves: relatedCves };
 }
 
 function byTtp(ttpId) {
+  // TTP ids span two disjoint catalogs (ATLAS AML.* vs ATT&CK T*).
+  // Resolve the record from whichever owns the id — namespaces never
+  // collide, so order is irrelevant. Previously only atlas-ttps.json was
+  // consulted, so every ATT&CK technique reported found:false / entry:null
+  // even though skills + related_cves correctly unioned both spaces.
   const atlas = loadCatalog('atlas-ttps.json');
+  const attack = loadCatalog('attack-techniques.json');
   const xref = loadIndex('xref.json');
-  const entry = atlas[ttpId] || null;
+  const entry = atlas[ttpId] || attack[ttpId] || null;
   const skills = skillsForTtp(xref, ttpId).slice();
   const relatedCves = entries(loadCatalog('cve-catalog.json'))
     .filter(([, c]) =>
-      (Array.isArray(c.atlas_refs) && c.atlas_refs.includes(ttpId)) ||
-      (Array.isArray(c.attack_refs) && c.attack_refs.includes(ttpId))
+      !_isDraftEntry(c) && (
+        (Array.isArray(c.atlas_refs) && c.atlas_refs.includes(ttpId)) ||
+        (Array.isArray(c.attack_refs) && c.attack_refs.includes(ttpId))
+      )
     )
     .map(([id]) => id);
+  // D3FEND maps countermeasures to the techniques they defeat through the
+  // `counters_attack_techniques` field. The earlier `counters` field is
+  // empty across every catalog entry, so this correlation was structurally
+  // dead (a non-existent field .includes() is always false).
   const d3fend = entries(loadCatalog('d3fend-catalog.json'))
-    .filter(([, d]) => Array.isArray(d.counters) && d.counters.includes(ttpId))
+    .filter(([, d]) => Array.isArray(d.counters_attack_techniques) && d.counters_attack_techniques.includes(ttpId))
     .map(([id]) => id);
   return { found: !!entry, ttp_id: ttpId, entry, skills, related_cves: relatedCves, d3fend_countermeasures: d3fend };
 }
@@ -275,7 +297,7 @@ function bySkill(skillName) {
   // to this skill.
   const cveCatalog = loadCatalog('cve-catalog.json');
   const cveRefs = entries(cveCatalog)
-    .filter(([, c]) => (c.cwe_refs || []).some(cwe => skillsForCwe(xref, cwe).includes(skillName)))
+    .filter(([, c]) => !_isDraftEntry(c) && (c.cwe_refs || []).some(cwe => skillsForCwe(xref, cwe).includes(skillName)))
     .map(([cve]) => cve)
     .sort();
   return { skill: skillName, summary_card: card, cve_refs: cveRefs, ttp_refs: ttpRefs };

package/lib/cve-regression-watcher.js

@@ -187,8 +187,12 @@ function findRegressionCandidates(diffs, catalog, opts) {
   // Group historical-CVE refs by id so multi-feed surfacing collapses.
   const byHistoricalId = new Map();
   // Content-only candidates — surfaced by language/component pattern
-  // matching even when no CVE ID was extracted from the diff text.
-  const contentCandidates = [];
+  // matching even when no CVE ID was extracted from the diff text. Grouped
+  // by a stable key (the diff id when present, else a composite of the
+  // matched signal) so N duplicate rows for the same regression claim
+  // across feeds collapse to one candidate with a merged surfaced_by — the
+  // same group-by-merge-sources pattern the historical-CVE branch uses.
+  const byContentKey = new Map();
   for (const d of (diffs || [])) {
     if (!d || typeof d.id !== 'string') continue;
     // Title field name depends on input shape:
@@ -231,16 +235,25 @@ function findRegressionCandidates(diffs, catalog, opts) {
     }
     // No historical CVE-ID in this diff. If content signals fire, still
     // surface as a content-only candidate so an operator can triage.
+    // Group by a stable key so duplicate rows for the same claim across
+    // multiple feeds merge their surfaced_by — mirrors byHistoricalId.
+    // The diff id (a current-year / non-historical CVE id) is the cleanest
+    // key when present; ID-less prose rows key off the matched signal
+    // (regression phrase + researcher + sorted component tokens).
     if (hasRegressionSignal) {
+      const key = (typeof d.id === 'string' && d.id)
+        ? `id:${d.id}`
+        : `sig:${signals.regression_language || ''}|${signals.researcher || ''}|${(signals.components || []).slice().sort().join(',')}`;
+      if (!byContentKey.has(key)) byContentKey.set(key, { sources: new Set(), titles: [], signals: {} });
+      const slot = byContentKey.get(key);
+      if (Array.isArray(d.sources)) {
+        for (const s of d.sources) slot.sources.add(s);
+      } else if (typeof d.source === 'string') {
+        slot.sources.add(d.source);
+      }
       const titleStr = d.title || d.first_title || '';
-      contentCandidates.push({
-        historical_cve: null,
-        surfaced_by: Array.isArray(d.sources) ? d.sources.slice().sort() : (d.source ? [d.source] : []),
-        first_seen_titles: titleStr ? [titleStr] : [],
-        existing_regression_key: null,
-        action: 'content-only-investigate',
-        signals,
-      });
+      if (titleStr && !slot.titles.includes(titleStr)) slot.titles.push(titleStr);
+      Object.assign(slot.signals, signals);
     }
   }
 
@@ -267,6 +280,20 @@ function findRegressionCandidates(diffs, catalog, opts) {
   }
 
   candidates.sort((a, b) => a.historical_cve.localeCompare(b.historical_cve));
+  // Emit one content-only candidate per grouped key, with surfaced_by as
+  // the sorted union of every feed that surfaced the same regression claim
+  // and the title list capped at 5 (matching the historical branch).
+  const contentCandidates = [];
+  for (const slot of byContentKey.values()) {
+    contentCandidates.push({
+      historical_cve: null,
+      surfaced_by: Array.from(slot.sources).sort(),
+      first_seen_titles: slot.titles.slice(0, 5),
+      existing_regression_key: null,
+      action: 'content-only-investigate',
+      signals: slot.signals,
+    });
+  }
   candidates.push(...contentCandidates);
 
   return {
@@ -291,11 +318,16 @@ function findRegressionCandidates(diffs, catalog, opts) {
  * falls back to ctx.advisoriesDiffs when the advisories source ran on a
  * pre-v0.13.17 build that did not emit observations.
  *
- * Chaining is explicit — the watcher does not poll feeds itself.
- * lib/refresh-external.js#loadCtx wires the prior advisories run output
- * onto ctx.advisoriesObservations + ctx.advisoriesDiffs so order matters:
- * advisories must run before cve-regression-watcher in a multi-source
- * invocation.
+ * Chaining is explicit — the watcher does not poll feeds itself. The
+ * refresh orchestrator's sequential runner (lib/refresh-external.js#main)
+ * threads the resolved advisories fetchDiff() result onto
+ * ctx.advisoriesObservations + ctx.advisoriesDiffs immediately after the
+ * advisories source resolves and BEFORE the next source's fetchDiff is
+ * invoked, so order matters: advisories must run before
+ * cve-regression-watcher in a multi-source invocation. Under --swarm
+ * (Promise.all) the two sources cannot share ctx mid-flight, so the
+ * orchestrator runs the watcher in a second pass after the parallel batch
+ * resolves, reading observations from the resolved advisories outcome.
  */
 const REGRESSION_WATCHER_SOURCE = {
   name: 'cve-regression-watcher',

package/lib/framework-gap.js

@@ -93,16 +93,38 @@ const OPTIMAL = {
  * @returns {{ score: number, breakdown: object, label: string }}
  */
 function lagScore(frameworkId, controlGaps, globalFrameworks) {
-  const gaps = Object.values(controlGaps).filter(g =>
-    g.framework?.includes(frameworkId) && g.status === 'open'
-  );
+  const frameworkData = _findFrameworkData(frameworkId, globalFrameworks);
+
+  // global-frameworks uses short KEYS (EU_AI_ACT, NCSC_CAF) while
+  // framework-control-gaps stores human-readable framework strings ("EU
+  // Artificial Intelligence Act (2024/1689)"). A naive
+  // `g.framework.includes(frameworkId)` only accidentally matched the few
+  // frameworks whose key happens to be a substring of the catalog string
+  // (DORA, GDPR, NIS2); every other framework reported
+  // framework_specific_gaps:0. Resolve the framework's display name first,
+  // then match the catalog with the SAME normalized scheme gapReport() and
+  // the orchestrator use, so the two paths converge. g.framework may be a
+  // string or an array — iterate either form.
+  const normalize = (s) => String(s).toLowerCase().replace(/[\s_-]/g, '');
+  const idNorm = normalize(frameworkId);
+  const nameNorm = frameworkData?.full_name ? normalize(frameworkData.full_name) : null;
+  const gaps = Object.entries(controlGaps).filter(([key, g]) => {
+    if (key.startsWith('_')) return false;
+    if (g.status !== 'open' || !g.framework) return false;
+    const fwList = Array.isArray(g.framework) ? g.framework : [g.framework];
+    for (const fw of fwList) {
+      const fwNorm = normalize(fw);
+      if (nameNorm && fwNorm.includes(nameNorm)) return true;   // display-name match
+      if (fwNorm.includes(idNorm)) return true;                 // short-key substring
+    }
+    if (normalize(key).startsWith(idNorm)) return true;         // gap-key prefix
+    return false;
+  });
 
   const universalGaps = Object.values(controlGaps).filter(g =>
     g.framework === 'ALL' && g.status === 'open'
   );
 
-  const frameworkData = _findFrameworkData(frameworkId, globalFrameworks);
-
   const patchSlaScore = _scorePatchSla(frameworkData?.patch_sla);
   const notifSlaScore = _scoreNotifSla(frameworkData?.notification_sla);
   const aiCoverageScore = _scoreAiCoverage(frameworkData?.ai_coverage);
@@ -189,6 +211,24 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
     };
   }
 
+  // Scope the report to what the operator actually requested. With an explicit
+  // framework filter, only gaps that survived the per-framework filter
+  // (frameworkResults[*].gaps) belong in the report; with `all`, every
+  // scenario-relevant gap does. `seen` is the de-duplicated set of surviving
+  // gap keys (a single gap can match multiple requested frameworks). Both
+  // theater_risks and the matching count derive from it so the per-framework
+  // body, the theater-risk list, and the summary footer all agree.
+  let scopedGaps;
+  if (opts.allFrameworks) {
+    scopedGaps = relevantGaps;
+  } else {
+    const seen = new Set();
+    for (const id of frameworkIds) {
+      for (const g of frameworkResults[id]?.gaps ?? []) seen.add(g.id);
+    }
+    scopedGaps = relevantGaps.filter(([key]) => seen.has(key));
+  }
+
   // Cycle 20 A P1 (v0.12.40): pre-fix this filtered on `theater_pattern`
   // (a legacy field) but the v0.12.29 backfill added a structured
   // `theater_test` block on all 118 entries while leaving most without
@@ -198,7 +238,11 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
   // the legacy field. Now: an entry is theater-risk if it's open AND
   // carries EITHER `theater_test` OR `theater_pattern`. Footer + badge
   // count agree.
-  const theaterRisks = relevantGaps
+  //
+  // theater_risks is built from scopedGaps (not the full relevantGaps) so a
+  // single-framework request cannot leak or mis-summarize theater controls
+  // from frameworks the operator never asked about.
+  const theaterRisks = scopedGaps
     .filter(([, g]) => g.status === 'open' && (g.theater_test || g.theater_pattern))
     .map(([key, g]) => ({
       control: key,
@@ -212,19 +256,8 @@ function gapReport(frameworkIds, threatScenario, controlGaps, cveCatalog = {}, o
   // explicit framework filter the summary must agree with the per-framework
   // body the operator actually sees — otherwise `framework-gap nist-800-53
   // <cve>` shows e.g. "2 matching control gap(s)" per-framework but "Summary:
-  // 8 matching gaps" (every framework's hits, pre-filter). Sum the per-
-  // framework gap_count so body + summary agree. De-duplicate by gap key in
-  // case a single gap matches multiple requested frameworks.
-  let matchingGapCount;
-  if (opts.allFrameworks) {
-    matchingGapCount = relevantGaps.length;
-  } else {
-    const seen = new Set();
-    for (const id of frameworkIds) {
-      for (const g of frameworkResults[id]?.gaps ?? []) seen.add(g.id);
-    }
-    matchingGapCount = seen.size;
-  }
+  // 8 matching gaps" (every framework's hits, pre-filter).
+  const matchingGapCount = scopedGaps.length;
 
   return {
     threat_scenario: threatScenario,

package/lib/gap-detectors.js

@@ -409,11 +409,16 @@ function operatorActionSlaFindings(loaded, opts = {}) {
 // sets internally when the caller doesn't supply them.
 //
 // The regex is permissive — any CWE-NNN / T1234[.456] / AML.TNNNN /
-// D3-XX / RFC-NNN token in a skill body or playbook JSON counts as a
+// D3[AF]-XX / RFC-NNN token in a skill body or playbook JSON counts as a
 // reference. We deliberately scan the FULL text, not just structured
 // fields, because skill bodies cite IDs in prose ("see CWE-79") as
-// often as in frontmatter.
-const REFERENCE_TOKEN_RE = /\b(?:CWE-\d+|T\d{4}(?:\.\d{3})?|AML\.T\d{4}(?:\.\d{3})?|D3-[A-Z]+(?:-[A-Z]+)*|RFC-\d+)\b/g;
+// often as in frontmatter. The D3FEND alternative covers all three
+// namespaces — D3- techniques, D3A- digital artifacts, and D3F-
+// fingerprints — with alphanumeric segments; the prior `D3-[A-Z]+`
+// pattern matched neither the D3A-/D3F- prefixes nor digit-bearing
+// segments, so a D3A-* citation in a skill body went unrecognized and
+// the entry it referenced was mis-flagged as an unused orphan.
+const REFERENCE_TOKEN_RE = /\b(?:CWE-\d+|T\d{4}(?:\.\d{3})?|AML\.T\d{4}(?:\.\d{3})?|D3[AF]?-[A-Z0-9]+(?:-[A-Z0-9]+)*|RFC-\d+)\b/g;
 
 function buildExternalRefs(rootPath) {
   // Lazy require — `path` + `fs` are already in scope at module level.

package/lib/lint-skills.js

@@ -433,9 +433,10 @@ function validateFrontmatter(fm, skillName) {
   }
 
   if ('last_threat_review' in fm) {
-    if (typeof fm.last_threat_review !== 'string' || !ISO_DATE_RE.test(fm.last_threat_review)) {
+    if (typeof fm.last_threat_review !== 'string' || !ISO_DATE_RE.test(fm.last_threat_review) ||
+        !Number.isFinite(Date.parse(fm.last_threat_review + 'T00:00:00Z'))) {
       errors.push(
-        `frontmatter.last_threat_review "${fm.last_threat_review}" is not an ISO date (YYYY-MM-DD)`,
+        `frontmatter.last_threat_review "${fm.last_threat_review}" is not a valid ISO date (YYYY-MM-DD). A structurally ISO but non-calendar value (e.g. 2026-13-99) is rejected so a malformed date cannot slip past the staleness gate.`,
       );
     } else {
       // v0.13.0: Hard Rule #8 forcing function — refuse skills whose

package/lib/playbook-runner.js

@@ -1179,7 +1179,6 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
   // Aliasing: playbooks ship rwep_factor values `public_poc` and
   // `ai_weaponization` for what F5 calls `poc_available` and `ai_factor`.
   // Both spellings resolve here.
-  const _activeExploitationLadder = scoring.ACTIVE_EXPLOITATION_LADDER;
   const _factorScale = (factorName, cve, blastScore) => {
     if (!cve) return 0;
     switch (factorName) {
@@ -1187,7 +1186,16 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
         return cve.cisa_kev === true ? 1 : 0;
       case 'active_exploitation': {
         const v = cve.active_exploitation || (cve.entry && cve.entry.active_exploitation);
-        return _activeExploitationLadder[v] ?? 0;
+        // Route through the shared scoring resolver instead of an inline
+        // `ladder[v] ?? 0` lookup so a stray-cased value ('Confirmed') scales
+        // identically to the catalog scorer AND an out-of-vocabulary value
+        // ('in-the-wild') surfaces the RWEP_AE_UNRECOGNISED warning rather than
+        // silently zeroing the active-exploitation weight. activeExploitationMultiplier
+        // (not the bare resolveActiveExploitation().multiplier) is used precisely so
+        // the no-match path is OBSERVABLE — the "out-of-vocab token must surface,
+        // not silently default" class. For every canonical catalog value the
+        // returned multiplier is identical to the prior inline lookup.
+        return scoring.activeExploitationMultiplier(v);
       }
       case 'poc_available':
       case 'public_poc': {
@@ -1435,6 +1443,15 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     // Prefixed with underscore to signal "for internal/render use".
     _detect_indicators: detectResult.indicators || [],
     _detect_classification: detectResult.classification,
+    // Non-underscore alias so catalog feeds_into / escalation conditions that
+    // reference the natural `analyze.classification` path resolve (the
+    // underscore-prefixed key was render-internal only, so those conditions
+    // resolved undefined and were silently dead — e.g. citation-hygiene →
+    // sbom, crypto-codebase → secrets). The underscore key stays for the
+    // SARIF/CSAF render consumers. On the detect-skip path run() re-sets
+    // analyze.classification to 'skipped', which is the same value
+    // detectResult.classification already carries there, so this is benign.
+    classification: detectResult.classification,
     vex: vexFilter ? {
       filter_applied: true,
       dropped_cve_count: vexDropped.length,
@@ -1473,7 +1490,20 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     findingShape = {};
   }
   for (const ec of an.escalation_criteria || []) {
-    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [], finding: findingShape }, playbook)) {
+    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [],
+        // finding.* is two-sourced: the engine computes the CVE/severity-derived
+        // keys (severity, rwep_adjusted, matched_cve_*, blast_radius_score,
+        // active_exploitation, framework/control_id_first) via analyzeFindingShape,
+        // while the DESCRIPTIVE keys the catalog conditions gate on
+        // (finding.includes_*, finding.cve_class, finding.tool_surface, …) are
+        // host-AI-asserted — the agent knows whether the finding includes a
+        // cloud-role-assumption path. Merge agent-supplied finding sub-fields
+        // UNDER the engine shape so the descriptive keys survive while engine-owned
+        // keys still WIN on collision (a poisoning signals.finding.severity can't
+        // override the engine-computed severity). The !Array.isArray guard rejects
+        // an array (typeof [] === 'object') that would inject numeric-index noise;
+        // null is already excluded by the leading &&.
+        finding: { ...(agentSignals.finding && typeof agentSignals.finding === 'object' && !Array.isArray(agentSignals.finding) ? agentSignals.finding : {}), ...findingShape } }, playbook)) {
       escalations.push({ condition: ec.condition, action: ec.action, target_playbook: ec.target_playbook || null });
     }
   }
@@ -2057,7 +2087,12 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     // concerning case, so it scores 100; a clear verdict scores 0. (Earlier
     // this was inverted, so a feeds_into condition like `theater_score >= 50`
     // would have failed to fire exactly when a gap was found.)
-    theater_score: analyzeResult.compliance_theater_check?.verdict === 'theater' ? 100 : 0,
+    // 'present' is an allowlisted theater-equivalent verdict (the same
+    // gap-present set verdict_text uses at line 1426 and the allowlist comment
+    // names at line 1352-1353), so it must score 100 (gap detected = worse), not
+    // 0. Scoring only the 'theater' spelling left a 'present' verdict scored as
+    // clear — inverted for any future feeds_into condition gating on theater_score.
+    theater_score: (analyzeResult.compliance_theater_check?.verdict === 'theater' || analyzeResult.compliance_theater_check?.verdict === 'present') ? 100 : 0,
     // Top-level matched_cve array so the shipped sbom feeds_into quantifiers
     // (`any matched_cve.attack_class == 'kernel-lpe'`, … IN ['ai-c2', …]) re-root
     // at each matched CVE. Without it the quantifier head resolves null and the
@@ -2067,7 +2102,14 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     matched_cve: analyzeResult.matched_cves || [],
     analyze: analyzeResult,
     validate: validateResult,
-    finding: analyzeFindingShape(analyzeResult),
+    // finding.* is two-sourced: the engine computes the CVE/severity-derived keys
+    // via analyzeFindingShape; the DESCRIPTIVE keys the catalog feeds_into
+    // conditions gate on (finding.includes_*, cve_class, tool_surface,
+    // mcp_server_location, pipeline_credentials_in_scope, …) are host-AI-asserted.
+    // Merge the agent-supplied finding sub-fields UNDER the engine shape so the
+    // descriptive keys survive while engine-owned keys WIN on collision. Same
+    // shape + guards as the escalation ctx above.
+    finding: { ...(agentSignals.finding && typeof agentSignals.finding === 'object' && !Array.isArray(agentSignals.finding) ? agentSignals.finding : {}), ...analyzeFindingShape(analyzeResult) },
     // Surface evalCondition regex failures from the feeds_into chain into
     // the same accumulator. Without this the regex failure happens but
     // analyze.runtime_errors[] never sees it.
@@ -4130,6 +4172,19 @@ function evalCondition(expr, ctx, playbook) {
   if (m) {
     const [, lhs, op, quote, rhsRaw] = m;
     const lv = resolvePath(ctx, lhs);
+    // A DOTTED (multi-segment) LHS that resolves absent is a suspicious dead
+    // condition (authoring typo / wrong-shape ctx) — the same silent-false class
+    // the contains/includes/IN branches already surface. Surface it as
+    // condition_path_unresolved (observability only; the boolean result is
+    // unchanged). Use `== null` (not strict undefined): resolvePath returns
+    // `null` for a missing INTERMEDIATE parent and `undefined` for a missing
+    // LEAF, so a strict-undefined gate would miss `analyze.classification` when
+    // `analyze` itself is absent. Bare single-segment flags
+    // (agent_has_filesystem_read, operator-submitted signals) are legitimately
+    // absent and do NOT push. A present-but-null flag is a legitimate false:
+    // single-segment, so the dot guard already excludes it. pushPathUnresolved
+    // dedupes on the condition string and is per-kind capped, so it can't spam.
+    if (lhs.includes('.') && lv == null) pushPathUnresolved();
     let rv = rhsRaw;
     if (quote) {
       // Explicit quoted string literal — keep as-is.
@@ -4149,8 +4204,44 @@ function evalCondition(expr, ctx, playbook) {
     // would exclude it: 'critical' < 'high' lexicographically).
     const SEV = { low: 0, medium: 1, high: 2, critical: 3 };
     const lr = SEV[String(lv).toLowerCase()], rr = SEV[String(rv).toLowerCase()];
-    const a = (lr !== undefined && rr !== undefined) ? lr : lv;
-    const b = (lr !== undefined && rr !== undefined) ? rr : rv;
+    let a = (lr !== undefined && rr !== undefined) ? lr : lv;
+    let b = (lr !== undefined && rr !== undefined) ? rr : rv;
+    const isOrdering = op === '>=' || op === '<=' || op === '>' || op === '<';
+    if (isOrdering && (lr === undefined || rr === undefined)) {
+      // Duration literals carry a unit suffix (`24h`, `7d`, `30min`) — the
+      // catalog writes ordering comparisons against them (kernel.json's
+      // `reboot_window > 24h` raise_severity escalation). The RHS-coercion
+      // above only converts a BARE numeric (`/^-?\d+(\.\d+)?$/`), so a unit-
+      // suffixed literal stays a string. A numeric LHS then compares against a
+      // string RHS (`48 > '24h'` → `48 > NaN` → false: a 48h window silently
+      // fails to escalate) and a string LHS compares lexicographically
+      // (`'6h' > '24h'` → `'6' > '2'` → true: a 6h window WRONGLY escalates).
+      // Normalize both sides to canonical hours when a duration unit appears on
+      // either side: a unit-suffixed literal converts by its unit family; a
+      // bare number is taken in the same family as the duration it is compared
+      // against (hours-equivalent magnitude). The comparison is then numeric.
+      const la = parseDurationHours(a), ba = parseDurationHours(b);
+      if ((la !== null || ba !== null) && la !== null && ba !== null) {
+        a = la; b = ba;
+      } else if (
+        // Two non-numeric, non-severity, non-duration strings under an ordering
+        // operator is a silently-degraded comparison (lexicographic / NaN) — the
+        // clause PARSED so condition_unparsed never fires. Surface a distinct
+        // condition_type_mismatch so the degraded comparison is observable
+        // (the boolean result is unchanged; this is diagnostics only).
+        typeof a !== 'number' && typeof b !== 'number' &&
+        !(typeof a === 'string' && /^-?\d+(?:\.\d+)?$/.test(a.trim())) &&
+        !(typeof b === 'string' && /^-?\d+(?:\.\d+)?$/.test(b.trim()))
+      ) {
+        const target = (ctx && Array.isArray(ctx._runErrors)) ? ctx._runErrors
+          : (playbook && Array.isArray(playbook._runErrors)) ? playbook._runErrors
+          : null;
+        if (target) {
+          pushRunError(target, { kind: 'condition_type_mismatch', condition: String(expr).slice(0, 200) },
+            { dedupeKey: x => x.condition || '' });
+        }
+      }
+    }
     switch (op) {
       case '==': case '=': return lv == rv;
       case '!=': return lv != rv;
@@ -4291,6 +4382,33 @@ function resolvePath(obj, dot) {
   return dot.split('.').reduce((acc, k) => acc == null ? null : acc[k], obj);
 }
 
+/**
+ * Normalize a duration operand to canonical hours for a numeric comparison.
+ * Accepts a unit-suffixed literal (`24h`, `7d`, `2wk`, `30min`) and converts by
+ * its unit family, OR a bare number / numeric string (returned as its own
+ * magnitude — the catalog writes `reboot_window > 24h` where the LHS resolves to
+ * a bare hour count). Returns null for anything that is not a recognized
+ * duration or plain number, so the caller can detect that BOTH sides normalized
+ * before comparing numerically (and surface a type-mismatch otherwise).
+ */
+const DURATION_UNIT_HOURS = {
+  h: 1, hr: 1, hrs: 1,
+  m: 1 / 60, min: 1 / 60,
+  d: 24, day: 24, days: 24,
+  w: 168, wk: 168,
+};
+function parseDurationHours(v) {
+  if (typeof v === 'number') return Number.isFinite(v) ? v : null;
+  if (typeof v !== 'string') return null;
+  const s = v.trim();
+  // Bare numeric string (no unit) — take its magnitude as-is.
+  if (/^-?\d+(?:\.\d+)?$/.test(s)) return parseFloat(s);
+  const m = s.match(/^(\d+(?:\.\d+)?)\s*(h|hr|hrs|d|day|days|wk|w|m|min)$/i);
+  if (!m) return null;
+  const mult = DURATION_UNIT_HOURS[m[2].toLowerCase()];
+  return mult === undefined ? null : parseFloat(m[1]) * mult;
+}
+
 /**
  * Depth-aware splitter — split `expr` at occurrences of ` <sep> ` (with
  * surrounding spaces) that are at parenthesis depth 0. Returns the (trimmed)