@blamejs/exceptd-skills 0.19.1 → 0.19.3

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:e19be208-b62b-417d-a70a-e7e8964b720a",
+  "serialNumber": "urn:uuid:7f211e54-0c0b-4b04-9d54-f70a5568ac78",
   "version": 1,
   "metadata": {
-    "timestamp": "2145-12-11T21:45:44.000Z",
+    "timestamp": "2026-08-08T00:00:00.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.19.1"
+        "version": "0.19.3"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.1",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.19.3",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.19.1",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1025 CVEs / 232 CWEs / 794 ATT&CK + ICS / 171 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.19.3",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1025 CVEs / 232 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.1",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.19.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "256e9469a7058eae762bb801e2f9c146b6f25b0acce977a1804699245eb891df"
+          "content": "534717aa72715652e635959c41d58e67926743edc15a0557b8f8570a174e6e60"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.1"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.19.3"
         },
         {
           "type": "vcs",
@@ -60,6 +60,14 @@
         "name": "exceptd:integrity:method",
         "value": "Ed25519 per-skill (lib/sign.js)"
       },
+      {
+        "name": "exceptd:integrity:uncovered:prefix",
+        "value": "data/_indexes/"
+      },
+      {
+        "name": "exceptd:integrity:uncovered:rationale",
+        "value": "Regenerated by `npm run build-indexes` and mutated by the test suite, so a pinned per-file hash would race any run between generation and verification. Covered instead by the pre-computed-index freshness gate in `npm run predeploy`."
+      },
       {
         "name": "exceptd:runtime:dependency:count",
         "value": "0"
@@ -86,11 +94,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e48370d9cab02ded6ac8b122e7bee01ee3bdac0c74f669f6bb50ee62e58791ee"
+          "content": "043939a747f3262127c7ab12a689af5fe81dce394059fdba502d37936f5c5c4b"
         },
         {
           "alg": "SHA3-512",
-          "content": "7eeacfaee295039f756cb8edae05c0b92a232c4e1a336b38d264ac63a9f701ba3c141556a18801daf1430b51099229650f8058a16c953325221c290f81edfeb4"
+          "content": "c72920fd325dcc0bf50b09b20b1832cd7a48ccc60be755ba5736eab61ceed714cd1686e9bdfc8dfc4b225f616b7474ad8d2aff2f6d6b89ef39bc38991e48fd1d"
         }
       ]
     },
@@ -116,11 +124,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d1435b6a3081b63085195275aa19b388c473b4449d984ce3b6ed1b4dfe3e680e"
+          "content": "0886406bdf81bbb64f3b461d9c62d9deb53f5e5142af0fb955a90f38991d34bb"
         },
         {
           "alg": "SHA3-512",
-          "content": "ca51ac665966940fe5d8b83a189b86b74097fd5b3de5b19eed84dd5f20c6da50a405049be2dd91ad4c4773da069e00e29fcc52e6307a52b7413d5552c36afbb0"
+          "content": "5f8a142a79db22e647b8e61002361c1e94e3e41f4607d3202b7673a709dc50abc60e687639af283145cc40a3ece292dd4595b8a03683982f9ecbfb3bcfda9f52"
         }
       ]
     },
@@ -131,11 +139,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "cea1838264ccc5698be01934821b289343119c88407a8f08fe48c529463acc48"
+          "content": "ce0272bf7bfeb46ec24f2852953b5fa1cd2409e58ee4d4afab31395c566df2c3"
         },
         {
           "alg": "SHA3-512",
-          "content": "bb90481b3c3659ed69e7bcc0db27ed7cda93a20849fa5bb6ed222d561b9e812cb1bafed7d5f8cdadb723bef6356a7eb3d7fcd970705fe7b97ffce842f42e9ad3"
+          "content": "6f36bd5552bff87dcd3af1d6b38ae0a5be7cf3abc576033db7a2dcc978b3d2be9eeb98dabaf6c8d8fc1afdfb5860d595d0156e7edcebaf43b0c69fe87130d39d"
         }
       ]
     },
@@ -176,11 +184,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7ebeb736970e7e00c61b57ae814149f8f6121f2e9afeafe5e4d9ca60292d7e29"
+          "content": "0fa9b167172f104810e5ee6040f11ed741217f7a51c2552a15c69d2a15a164aa"
         },
         {
           "alg": "SHA3-512",
-          "content": "8c7f573113736b12c90b188fea72118ce0df647d684b0ac00c6b43c8cf986418795e974197fb0d2760b41686a788800b49c73b5d5faef96c8ccb244a4299b37a"
+          "content": "952e6b7436e34fc28df676c6eb81f73fe62f0c702c634acf154f2bb36145ffbae9655ab36360b99c17f9aa5b5822ff157cb0ecb8ce6151973979587c493b61c1"
         }
       ]
     },
@@ -296,11 +304,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "0e5d0ab093d284bf1551c78d4de49b8af07f699d58752341b67f39eaabbadb3d"
+          "content": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb"
         },
         {
           "alg": "SHA3-512",
-          "content": "d57fb33574f2eff8a6672959002b1358bd5757d6df69a6efcd6275bd3790021d8a937226612243eed21259edc308de335546697af9505045996e4b375eeca822"
+          "content": "b11841d54798d111d3124125a5adc0627244f0c363ae686b668ee9afc8b387d8d334f45b0c02f07b8eab14a9893456bfb16bc4b0dc81f0e5d2f26c46b88ac962"
         }
       ]
     },
@@ -311,11 +319,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "1c71336a28f5af80caf7a6d81fd723a8d3eacc0fa315d78c126ffafa50ba078e"
+          "content": "6bc0619bcccceccc8d5c12aefa6c11197c625e5d7313e70474f2831e271b23f0"
         },
         {
           "alg": "SHA3-512",
-          "content": "2fdbb72e8ac0e6fa6420db991c7a7a27d4fb71ab1026a12fc301fe4a071d55761f207f104f54c4962b1853ce1a256fd5d1c8ea497e56bc6cf0ff1150de0fefd8"
+          "content": "9a17e810705eb143ee311305c15b6b40255b5bd29e56e37af5ecfda6e6d39288b450d00fe76bd451a8822951fe334cb468da145f69e7ce98865f532e5aeb0a35"
         }
       ]
     },
@@ -326,11 +334,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "15c4011e573e20378c46c2b695885b0d056131565f40b6e21c0eb0a6d7d7caf8"
+          "content": "0f440663a16dfffa241e173eb8ba8613c790015e2eb5f81a5a33ea88975ca1d5"
         },
         {
           "alg": "SHA3-512",
-          "content": "3f0305ce360096a7725837c3ffd6b63540fc428d7b5105ef7febb8ddab14f54f1332a63de66607b475190ad0bf7e3dc0f3aa3f285873d96df8d51d77d0b24a2c"
+          "content": "7ef98f11c8d421831592481693241618c7e16c8d8f44d528fd5b10de28b75555c6fa2bd2bceb8ec4f091f652655602ce716cceece2cf2683caf989a2295950c0"
         }
       ]
     },
@@ -356,11 +364,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "64d4d2c187aa0c1f308b982da7f7fb68ebe8207ec0c4baf983c407f3ad0afd0d"
+          "content": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac"
         },
         {
           "alg": "SHA3-512",
-          "content": "20a30a23503dde65073af300adf1a2deeee8fd0e6d5e8400f0e8e0033e9d679be079383a45347f74590a3b8ecb4ec191a786e5c42bb5825808cf266af1c62d40"
+          "content": "b60ab890bb6075800ddf571976fb2ef1a563d1f187c243ac3f29b96a3355c62c9ecca40e660742ff6bc1a7ba1a5b9374a05cca2d8b6dbacf7c224e050f6ef105"
         }
       ]
     },
@@ -371,11 +379,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19"
+          "content": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19"
         },
         {
           "alg": "SHA3-512",
-          "content": "fc56489d7eb4af2d8ec1db7e6a844c00d9cdede3ce4471a574c3a40478f2efcd0d3405b2ee94c385fedbcd79238cae71474727cc0efb8d002f4ddb9661c28813"
+          "content": "06c3aa8961bb08694c07ec65e791f0005d802385145ed53db92cc88301e2d339dfe33a3934509879dc70d1a9529028b50dcc44ff5c2ccbaa5d3302a639744228"
         }
       ]
     },
@@ -941,11 +949,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e3b4ab4430aae788328f821c2fb0a93df7c12c806e2a3a4eca23f9e6bb00100b"
+          "content": "9bc4f85c15d1618ef438a9221346c6913f823c5b8368acc2b2d5756c3a07c21e"
         },
         {
           "alg": "SHA3-512",
-          "content": "3d50878405fb64eaa66d8e07c1627ed5040e63662e24984a68dea08f576f2f8d2446657f339ebbd17a5cdfdbd4c18d03156459e1768a79fb8a484c3c7aee0af6"
+          "content": "43dac02cda23b8a73d857f474fe37e7754e61c57d5c882c06af239f6262fc5505b42181a88c44ebeaf5f5e79f0d73e01f39af27c418e92371193a06f2c22e220"
         }
       ]
     },
@@ -1811,11 +1819,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "541bfb66f6dd9802e157d6d12418bb2402a1d6c66f80b3024a362bccd35d2c21"
+          "content": "5aeebc43db5477b9a342f783d72a5a28a9632205b8aab6e08ea346d3310eac47"
         },
         {
           "alg": "SHA3-512",
-          "content": "d1a8189afaeefecd6c8993b9f0739b6c2adc6058cb793051d7f6e99d9a4bda978827e81e5f37ad3384b14a5a45089a073bf8adbe85bb982d0bbc84ae6569f852"
+          "content": "08b23fc717d26133ee455690692b79c3a5bb8386cb4aaa54d6ba6f3e8705adab8e217881b3418534d38bf18b53761f76d8f6ccd1a20567ec5bc39e715a207304"
         }
       ]
     },
@@ -1946,11 +1954,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c4be0e39dec5c7da54d68164c51f2c34e41874230d82b50ed8eb8ebfdf612d47"
+          "content": "ea761dae093a3f57552dc54d1c4cda0f8a0c1c48aac6a4fbaebf6f0fb1e89416"
         },
         {
           "alg": "SHA3-512",
-          "content": "919da0f5a6e44f1dec2cf6cf4f309dede3cf4a0236b04801f27e99f7fd77d39cba1d758f2a60e0c5f431d1697af380fd1b09f86a5907dad8d92f54db6e16c4a8"
+          "content": "a399cae2a99e4a613878bfbe3de82d04604559f228bd615435ac43624671060f875641aa40d1c4978f6259b79767c42aad8d6e87a710bb33c223f97e0f9355d4"
         }
       ]
     },
@@ -2059,6 +2067,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:package.json",
+      "type": "file",
+      "name": "package.json",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "a4f0243303f43e0aff7b62082761136da51b6157a6da1d53357e9c8b41659641"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "7547730b7a85504e16231b8959b66322c79e85bf3e8629298ffccf1453a20a13eea71f27550a76d2a24c75bd90b021679eb4120d8c96db32000e57b954b3ef33"
+        }
+      ]
+    },
     {
       "bom-ref": "file:scripts/audit-catalog-gaps.js",
       "type": "file",
@@ -2419,6 +2442,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:scripts/check-epss-consistency.js",
+      "type": "file",
+      "name": "scripts/check-epss-consistency.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "6054e10941a8e397d3ec666f08e464fe4d1df1750165c0b59543d878a9474cfa"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "c787f5fb7be2bad1b62a87e90d1d69b78e6577d426e9a6d3b0f10d29035ccb2c75aeaad07fb4a019c74d4731f4570374e645a4c9884e3288c7b52d51c754952f"
+        }
+      ]
+    },
     {
       "bom-ref": "file:scripts/check-framework-gap-coverage.js",
       "type": "file",
@@ -2456,11 +2494,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "25f1498d8baa74657947cbea6aca4e9d88c2d59d7dadf534ac6c1026ff2efd5a"
+          "content": "c360d8fce5cb264662a355b05224fa2a3f16a25ff3d6199ad5db1c08919754e2"
         },
         {
           "alg": "SHA3-512",
-          "content": "995b8b7814d8d7f32bad272a44663a31dab6c4b0cbb678814f78cc731a9f9d47516f77a61519402aa4588fd0d06935fcd208b8eeff6958b37b021dda8f48eedd"
+          "content": "f364223d705ed8b4dcf6e54d234891b3508cd79c0fe5832706514c9dc3079b594322fb63e16ea9fe1d135181b93e0c153ad073fb92cdc40d59386d781006eed0"
         }
       ]
     },
@@ -2524,6 +2562,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:scripts/check-ttp-references.js",
+      "type": "file",
+      "name": "scripts/check-ttp-references.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "86861618b14f086180d32d123affe21be9d331ecc67b22fde17017f7d49aa054"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "d0bff495ccf1672f1c90bc9f8deeca57c1597c4c59d929c9a209985a140385c5ffe90e72833f607ccc18be97a7daa270d19a87e4591a3d36cdd008c3380b2fcc"
+        }
+      ]
+    },
     {
       "bom-ref": "file:scripts/check-ttp-upstream.js",
       "type": "file",
@@ -2561,11 +2614,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ab4b500e9f77095eb2903f02f4584ef05b7fea473b59d25b2c7a52063b84ea2d"
+          "content": "bc7aa74003392c3d8693ca1c9ee7c38718d96caa97e50cedff65556c26f5ceb9"
         },
         {
           "alg": "SHA3-512",
-          "content": "d8ef89ece9886fe0ebc61d40bf71d58f163751c85687982bfe59d58f1dd84be0b3746b72293743067ccf1559524573c4c1e2db2081bb79072a25585568cc4765"
+          "content": "320c1691433f81aa16761d04a20f271fd4054b5b17da2a5c2cb08d7146c8f6ad970c6cc2d7b295e2cc58f1a0abdccf6b1402d8b5b89b0ef029bdf2b01c7265c5"
         }
       ]
     },
@@ -2591,11 +2644,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "3bde5d6bc4e5670229c6fa1aa1bb5125d5c078fdd5b9c1846ad583d6be7e34d6"
+          "content": "b641f8f91c21ecda0bd35b647f1be19ca4564e4d5801467105122f262c13e973"
         },
         {
           "alg": "SHA3-512",
-          "content": "186dcc36e5ac1f9030f2ff61a66a176a2f393ebdb8534304157d0f28a56a5ad72ba517d879e452a2d4e8be72098845ec28cdfd84e690ee208296461dee0e5dab"
+          "content": "e98f5af374a1a40fc876d0d564a092ecbef2c9e93fb6653b6905c4b44332d12be78aa5ee4b550b4c1bad5270f2480cc862b02fac36b14266b74ec26abb391690"
         }
       ]
     },
@@ -2711,11 +2764,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7ddfd780bbc37f9c4d10d66eb9f620ef5f26d35c50655a753020ca3bb9b89c6a"
+          "content": "c5f38a759980ae125f1f30195abd60dae2c4d9547895ee6e8290f47c80bab0c4"
         },
         {
           "alg": "SHA3-512",
-          "content": "ab187eeeb0b8a666a0a65d80ebd792b6c477ace0da4f2d956f92d4def4caf6ead1dd32f3dcbebfbdaf422744ff449ae4a39d6c0dcb0c081f254291aa70d189af"
+          "content": "a5b7a4bed681c7c066aa51316bb1d602134721906eeada0ab6ce8a67227f09eb191dce0e530a6c15486a1f308bc71b304916d45dec15ec8fc53b6f0aebf910e3"
         }
       ]
     },
@@ -2741,11 +2794,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "f3f1b3893d805a45ecd2e887231ab25191417cc5e183c5e7005e316b3ecdc0ba"
+          "content": "7425bd4cefc0185b889e7389a1bdb952ad4f576cab03e63928ad4b991f48ccc1"
         },
         {
           "alg": "SHA3-512",
-          "content": "1f6df4143f06877cbb2f3bb8ff1245bf0f5dfec9fac7511bd4576bdbe95e4061ddd042bfd9e47bd029d4dfd07439b8d53a3e0adb64f38036ea3a7b760db5e1c0"
+          "content": "4b169deaefb58b617f0748a65409277c0592db50b7024f03cc290eda17299ec4aa4d682a294ba2f2251f015331ebbe07b3ca88549d354d5ee9b51589bd778ce7"
         }
       ]
     },
@@ -3026,11 +3079,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "48f140a265a96cd8c2d065f63a351ad02bbcbca5f75a686f3e8094e93f2d0383"
+          "content": "e182f3130fe78e403db6c81c24757bc81dfbc86997e0b5f304f05d5572f7abb2"
         },
         {
           "alg": "SHA3-512",
-          "content": "226a7f5cb3bae4d0336a9fea7efb2471fadb6b70a95b039b98c89ebe76d4dc339bb855dcb64d22cf49690f64d33deb96954f729dfc502c00f7b7a7594b02c363"
+          "content": "4c8391b78968dddfa405d7e5a4d5bac7b30c156b7d86cc44a3d9f3ab3e5cbf80c350ce2c96968b6f76eabc7c4255d03e511092c55135cee4657a2a95c111013e"
         }
       ]
     },
@@ -3161,11 +3214,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9641b8fee753172af0b646f88b35a22e0868b618d8d89977c05969771b8b013a"
+          "content": "5a4de978515f974cb88cb4dcfb69d02eefa7a0d29a22a2f8a732fb7f8dd5d107"
         },
         {
           "alg": "SHA3-512",
-          "content": "1feb83d6cc6cb35e7ada2b192ccd52bb0b5c0fa9a514248240bd44341454d6bbf7f37dd0d536a1b8ccfafdb8fe336f6e565c50189b90c0a4a26e8289c45241b2"
+          "content": "05b0c3def0635de0202bc93a54ff30acc9197e684d81c48c27cca5fa2299489ed410983d65268702fa3c467932ce89d33db3329c2b5d1788e0e5080244b1ed26"
         }
       ]
     },
@@ -3236,11 +3289,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "cfe8c7c7150f9bbf6b42f879ceed74914c0279045aa3f2603c353319cd269de4"
+          "content": "156965bdf43f8d3973ac9bc95f71d39d36a8c1a72e4833eb83faee3d4e5168eb"
         },
         {
           "alg": "SHA3-512",
-          "content": "0c7172beda7f85623d9eac1890481e91c73f0431034cdcd989a7e908bc91aa471401999f33556ddcdbe0975f0c3b94e739c49441d0681512cda56d97790f5036"
+          "content": "7381a02c760258e16513bbb3c9d7210130f49232b366b4e70e3e66d39b0a8258d72bff2410edb9fa2aae000cc66506ecda8a70fa05a136b5cf1c905a15a81911"
         }
       ]
     },
@@ -3341,11 +3394,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "4ef1bcda1c03a9027ad75dcb0d51574ae404e62466398b9f725c5540783f62a2"
+          "content": "360caa6c03913625214e4f2f8430e7306f64ce5f44e8cc3d52af1368c7d8a6b4"
         },
         {
           "alg": "SHA3-512",
-          "content": "8229d12b17b57ffcf206a0186939448839f4284636ba36c7f96d73f4ddd05dda95b312cad73f59c78b488e64309ced93df222cb0090371d273a4b77043bdd6fe"
+          "content": "4e1a8cee480cc389a3eb56ce3773b645f4d09353cfc34f65aeecc84c18aae0ccc15f6ce4665c39306b7cdcf638413d240960b641a92146ea270189ed07f63282"
         }
       ]
     },
@@ -3356,11 +3409,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ecb3fe0b8e8a03f920b3f8e187b2f79d0d0df3c46b7ab38e5e27899127ec4dad"
+          "content": "ed9855c8ce1fb2830f1cf69a4554bf7600964f32fd75898b41f8a23003ae9a6d"
         },
         {
           "alg": "SHA3-512",
-          "content": "f06ea6f1eaf60e334f6c6b406b65bac317916394fca649dfa7c485872425774aa39bdd896e806450296423d57818cfb423588874c239e20c8cf6205dca2e148f"
+          "content": "3eb5148995be926186f2ec4f61eb3b5ccb64645c0d513d74ed780ed7ed356a299632059285484a37399d64dc3f68d1d44c44ccd113e480b8d3fe2b95790b509d"
         }
       ]
     },
@@ -3589,6 +3642,21 @@
         }
       ]
     },
+    {
+      "bom-ref": "file:sources/README.md",
+      "type": "file",
+      "name": "sources/README.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "37356d40c4db4a0b5060911cd20f7a4ec3fc96c8b394308de646ba17e69493b7"
+        },
+        {
+          "alg": "SHA3-512",
+          "content": "963c00719163eedb931bcc4713be3f2aca2377f3d6492ff44c2d3e8dd37c6d6ffc4411ecfeda697c0406fffc2bb8eaeb38195b230d9e6a0ecfbfe4671ac0b7c3"
+        }
+      ]
+    },
     {
       "bom-ref": "file:sources/validators/atlas-validator.js",
       "type": "file",

package/scripts/check-epss-consistency.js

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+"use strict";
+
+/**
+ * EPSS score/percentile consistency gate.
+ *
+ * EPSS publishes a score and a percentile for every CVE, refreshed daily. The
+ * percentile is the score's RANK within that day's publication: if A scores
+ * higher than B on a given day, A's percentile is at least B's. That makes the
+ * pair self-checking with no network access — sort a day's entries by score and
+ * the percentiles must come out sorted too.
+ *
+ * The failure this catches is updating one field without the other. A refresh
+ * that writes a new score but keeps yesterday's percentile leaves a plausible
+ * entry: both numbers are in range, both look like EPSS values, and nothing
+ * downstream can tell they describe different days. The result is a CVE ranked
+ * as top-decile urgency on a score that no longer supports it, which is exactly
+ * the input the prioritisation model trusts most.
+ *
+ * What the ordering check does and does not establish. Monotonicity is a
+ * necessary condition, not a sufficient one: it catches a stale percentile that
+ * contradicts the new score's rank, which is what a partial refresh usually
+ * produces, but a stale value that happens to preserve the ordering passes.
+ * Proving two fields share a publication would require the fetched row, and
+ * that is not recoverable from the catalog offline. So this is a corruption
+ * detector, not a provenance proof — the provenance guarantee has to come from
+ * the write side, by fetching and writing score, percentile and date together.
+ *
+ * Three checks run:
+ *   - within each epss_date, sorting by score must sort by percentile;
+ *   - an entry carries both numeric fields or neither;
+ *   - epss_note, which is derived text, must restate the current fields.
+ *
+ * Entries are grouped by epss_date so each publication is checked against
+ * itself; comparing across days is meaningless because the whole distribution
+ * shifts.
+ *
+ * Exit codes: 0 consistent, 1 inconsistent.
+ */
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+const ROOT = path.resolve(__dirname, "..");
+
+/**
+ * Percentiles are published rounded to five decimals, so two scores that are
+ * adjacent in the ranking can round to percentiles that invert by a hair. That
+ * is arithmetic, not drift. Real mismatches are pairs pulled from different
+ * days, which land orders of magnitude above this: the widest rounding artifact
+ * observed in the catalog is 8e-5, while a stale-field mismatch runs 0.05-0.9.
+ * The threshold sits between the two, far enough from each that neither
+ * classification is a close call.
+ */
+const ROUNDING_TOLERANCE = 1e-3;
+
+function loadCatalog(file) {
+  return JSON.parse(fs.readFileSync(file, "utf8"));
+}
+
+function ordinal(n) {
+  const suffixes = ["th", "st", "nd", "rd"];
+  const v = n % 100;
+  return `${n}${suffixes[(v - 20) % 10] || suffixes[v] || suffixes[0]}`;
+}
+
+/**
+ * The operator-readable restatement of an entry's EPSS fields. Entries carry it
+ * as `epss_note`, and it is derived, not authored — so it must be rebuilt
+ * whenever the numbers move.
+ */
+function renderNote(entry) {
+  const pct = Math.round(entry.epss_percentile * 100);
+  return `FIRST EPSS ${entry.epss_score} (${ordinal(pct)} percentile) as of ${entry.epss_date}.`;
+}
+
+/**
+ * Group entries by publication date. Entries missing either field are reported
+ * separately rather than skipped — a half-populated pair is its own defect, and
+ * silently ignoring it would let the gate pass on the very shape it exists to
+ * catch.
+ */
+function cohorts(catalog) {
+  const groups = new Map();
+  const incomplete = [];
+
+  for (const [id, entry] of Object.entries(catalog)) {
+    const hasScore = typeof entry.epss_score === "number";
+    const hasPercentile = typeof entry.epss_percentile === "number";
+
+    if (!hasScore && !hasPercentile) continue;
+    if (!hasScore || !hasPercentile) {
+      incomplete.push({
+        id,
+        missing: hasScore ? "epss_percentile" : "epss_score",
+      });
+      continue;
+    }
+
+    const date = entry.epss_date || "(no epss_date)";
+    if (!groups.has(date)) groups.set(date, []);
+    groups.get(date).push({ id, score: entry.epss_score, percentile: entry.epss_percentile });
+  }
+
+  return { groups, incomplete };
+}
+
+/**
+ * Sort a cohort by score and report every place the percentile goes backwards
+ * by more than rounding can explain.
+ */
+function inversions(rows) {
+  const sorted = [...rows].sort((a, b) => a.score - b.score);
+  const found = [];
+
+  for (let i = 1; i < sorted.length; i++) {
+    const prev = sorted[i - 1];
+    const cur = sorted[i];
+    const delta = prev.percentile - cur.percentile;
+    if (delta > ROUNDING_TOLERANCE) {
+      found.push({ lower: cur, higher: prev, delta });
+    }
+  }
+
+  return found;
+}
+
+function check(catalogFile) {
+  const catalog = loadCatalog(catalogFile);
+  const { groups, incomplete } = cohorts(catalog);
+  const failures = [];
+
+  for (const [date, rows] of groups) {
+    for (const bad of inversions(rows)) {
+      failures.push(
+        `${date}: ${bad.lower.id} scores ${bad.lower.score} but ranks ` +
+          `${bad.lower.percentile}, below ${bad.higher.id} which scores ` +
+          `${bad.higher.score} at ${bad.higher.percentile} ` +
+          `(gap ${bad.delta.toFixed(5)}) — the two fields are from different publications`
+      );
+    }
+  }
+
+  for (const row of incomplete) {
+    failures.push(`${row.id}: has one EPSS field but not ${row.missing} — write both together or neither`);
+  }
+
+  // The prose restatement drifts the same way the percentile does: a refresh
+  // moves the numbers and leaves the sentence describing the previous
+  // publication, so the entry states two different scores as of two different
+  // dates. It is derived text, so it can be checked exactly.
+  for (const [id, entry] of Object.entries(catalog)) {
+    if (typeof entry.epss_note !== "string") continue;
+    if (typeof entry.epss_score !== "number" || typeof entry.epss_percentile !== "number") continue;
+    const expected = renderNote(entry);
+    if (entry.epss_note !== expected) {
+      failures.push(
+        `${id}: epss_note reads ${JSON.stringify(entry.epss_note)} but the fields say ` +
+          `${JSON.stringify(expected)} — regenerate the note when the numbers move`
+      );
+    }
+  }
+
+  return { failures, cohortCount: groups.size, entryCount: [...groups.values()].reduce((n, r) => n + r.length, 0) };
+}
+
+function main() {
+  const file = process.argv[2] || path.join(ROOT, "data", "cve-catalog.json");
+  const { failures, cohortCount, entryCount } = check(file);
+
+  if (failures.length) {
+    console.error("EPSS consistency: FAIL");
+    for (const f of failures) console.error(`  ${f}`);
+    console.error(
+      `\n${failures.length} inconsistent ${failures.length === 1 ? "entry" : "entries"}. ` +
+        `Re-fetch score and percentile together from api.first.org and write them in one pass.`
+    );
+    process.exitCode = 1;
+    return;
+  }
+
+  console.log(
+    `EPSS consistency: PASS — ${entryCount} entries across ${cohortCount} publication ${cohortCount === 1 ? "date" : "dates"}, every cohort ranks monotonically`
+  );
+}
+
+if (require.main === module) main();
+
+module.exports = { check, cohorts, inversions, renderNote, ROUNDING_TOLERANCE };

package/scripts/check-sbom-currency.js

@@ -59,6 +59,10 @@ function catalogEntryCount(dataDir, file) {
 // emits one for.
 const SBOM_SELF_EXCLUDED = new Set(["sbom.cdx.json"]);
 const SBOM_DERIVABLE_PREFIXES = ["data/_indexes/"];
+// Mirrors refresh-sbom's ALWAYS_SHIPPED: npm adds package.json to every tarball
+// without it appearing in `files`, so the completeness check has to expect a
+// component for it the same way the generator now emits one.
+const SBOM_ALWAYS_SHIPPED = ["package.json", "sources/README.md"];
 
 function sbomIsDerivable(rel) {
   return SBOM_DERIVABLE_PREFIXES.some(
@@ -93,7 +97,7 @@ function walkFilesAbs(absDir) {
 // module-level root.
 function expandAllowlistAt(allowlist, root) {
   const abs = [];
-  for (const entry of allowlist) {
+  for (const entry of [...allowlist, ...SBOM_ALWAYS_SHIPPED]) {
     const full = path.join(root, entry);
     let stat;
     try { stat = fs.statSync(full); }