@blamejs/exceptd-skills 0.19.30 → 0.19.32

package/ARCHITECTURE.md

@@ -6,7 +6,7 @@ exceptd Security is a skills repository. Each skill is a `.md` file with YAML fr
 
 The repository has three layers:
 
-```
+```text
 skills/          Instruction layer — tells the AI what to analyze, how to score, what to output
 data/            Intelligence layer — CVE metadata, ATLAS TTPs, framework gap mappings
 lib/             Logic layer — scoring algorithms, TTP mapper, framework gap analyzer
@@ -16,7 +16,7 @@ lib/             Logic layer — scoring algorithms, TTP mapper, framework gap a
 
 ## Skill File Anatomy
 
-```
+```text
 skills/
 └── <skill-name>/
     └── skill.md          Single file per skill. Frontmatter + body.
@@ -42,7 +42,7 @@ attack_refs:
   - T1068                     # MITRE ATT&CK TTP IDs
 framework_gaps:
   - NIST-800-53-SI-2          # control IDs documented as insufficient in this skill
-  - ISO-27001-A.12.6.1
+  - ISO-27001-2022-A.8.8      # must resolve against data/framework-control-gaps.json
 last_threat_review: "2026-05-01"
 ---
 ```
@@ -84,7 +84,7 @@ Schema per entry:
     "poc_description": "Public PoC description — no direct exploit links",
     "ai_discovered": false,
     "ai_assisted_weaponization": false,
-    "active_exploitation": true,
+    "active_exploitation": "confirmed | suspected | theoretical | none | unknown",
     "affected": "Human-readable scope description",
     "affected_versions": ["kernel >= 4.14", "kernel < 6.8.10"],
     "vector": "Attack vector description",
@@ -95,26 +95,33 @@ Schema per entry:
     "live_patch_tools": ["kpatch", "livepatch", "kGraft"],
     "framework_control_gaps": {
       "NIST-800-53-SI-2": "Why this control is insufficient for this CVE",
-      "ISO-27001-A.12.6.1": "Why this control is insufficient"
+      "ISO-27001-2022-A.8.8": "Why this control is insufficient"
     },
     "atlas_refs": ["AML.T0043"],
     "attack_refs": ["T1068"],
-    "rwep_score": 96,
+    "rwep_score": 85,
     "rwep_factors": {
       "cisa_kev": 25,
       "poc_available": 20,
-      "ai_assisted": 0,
+      "ai_factor": 0,
       "active_exploitation": 20,
-      "blast_radius": 15,
-      "patch_available": -7,
-      "live_patch": -5,
-      "reboot_required": 5
+      "blast_radius": 20,
+      "patch_available": 0,
+      "live_patch_available": 0,
+      "reboot_required": 0
     },
     "last_updated": "YYYY-MM-DD"
   }
 }
 ```
 
+Two invariants the schema cannot express and the validator enforces:
+`rwep_factors` must sum to `rwep_score`, and every key must match the weight
+names in `lib/scoring.js` — `ai_factor` and `live_patch_available`, not
+`ai_assisted` and `live_patch`. The weights are `cisa_kev` 25, `poc_available`
+20, `ai_factor` 15, `active_exploitation` 20, `blast_radius` 0–30,
+`patch_available` −15, `live_patch_available` −10, `reboot_required` +5.
+
 ### `data/atlas-ttps.json`
 
 Schema per entry:
@@ -176,7 +183,7 @@ Tracks PoC status, weaponization stage, and AI-assist factor per CVE. Updated wh
 
 ### `data/cwe-catalog.json`
 
-233 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE.
+236 CWE entries pinned to **CWE v4.20**. Covers the Top 25 Most Dangerous Software Weaknesses (2024 release) plus AI- and supply-chain-relevant weakness classes (prompt-injection-as-trust-boundary failure, training data integrity, dependency confusion, untrusted artifact ingestion). Each entry records root-cause description, common consequences, mitigation patterns, and the CVEs in `cve-catalog.json` that instantiate the weakness. Skills cite CWE IDs in `cwe_refs` to anchor a finding to a stable weakness taxonomy rather than to a single CVE.
 
 `_meta.cwe_version` pins the version; on a CWE release, audit IDs for renames or deprecations, bump `last_threat_review` on affected skills, and update `_meta`.
 
@@ -207,16 +214,18 @@ RWEP (Real-World Exploit Priority) scoring engine.
 - `validate()` — Schema validation: check all skill data_deps resolve, all CVE entries are complete, all ATLAS refs are valid v2026.07 IDs
 - `compare(cveId)` — Return CVSS vs. RWEP comparison with explanation of the delta
 
-RWEP factor weights:
-```
-cisa_kev              +25  (binary)
-poc_available         +20  (binary)
-ai_assisted_weapon    +15  (binary)
-active_exploitation   +20  (binary)
-blast_radius          +30  (0–30 scaled)
-patch_available       -15  (binary)
-live_patch_available  -10  (binary: additional reduction if no reboot required)
-reboot_required       +5   (binary penalty: patch exists but requires reboot)
+RWEP factor weights. The key names here are the ones a catalog entry's
+`rwep_factors` must use, and the factors must sum to `rwep_score`:
+
+```text
+cisa_kev              +25  binary
+poc_available         +20  binary
+ai_factor             +15  binary — ai_discovered OR ai_assisted_weaponization
+active_exploitation   +20  graded — confirmed 20, suspected 10, unknown 5, none 0
+blast_radius          0-30 scaled
+patch_available       -15  binary
+live_patch_available  -10  binary
+reboot_required        +5  binary — the patch exists but needs a reboot
 ```
 
 ### `lib/ttp-mapper.js`
@@ -277,7 +286,7 @@ Skills can be composed. `framework-gap-analysis` calls out to `threat-model-curr
 
 Composition is explicit: skills declare which other skills they depend on in their frontmatter `skill_deps` field. Circular dependencies are not permitted.
 
-```
+```text
 zeroday-gap-learn  →  framework-control-gaps.json (writes)
 framework-gap-analysis  →  framework-control-gaps.json (reads)
 compliance-theater  →  exploit-scoring (depends on RWEP)

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # Changelog
 
+## 0.19.32 — 2026-08-21
+
+A KEV entry stores four fields from CISA's record and the refresh compared two of them. The listing flag and its date tracked upstream; the remediation deadline and the ransomware designation were written once, at curation, and never looked at again. Both now reconcile on every refresh, on the live path and the cached one alike, which closes a gap that had been widening since the fields were first stored.
+
+The catalog is corrected accordingly. Fifty-one entries carried no ransomware designation where CISA now records one, and forty-three of those had no such field at all — which every consumer reads as a denial rather than as an absence. All 1,167 KEV-listed entries now carry the boolean explicitly, and the catalog validator refuses one that does not, so the field cannot go back to being sometimes-absent. Four entries stated a remediation deadline of twenty-one days after listing where CISA required three or fourteen; that date is rendered into remediation output and regulator notification drafts, so it was telling operators they had time the directive does not give them. Eleven more had no deadline stored at all.
+
+Six entries said in prose that CISA recorded no ransomware association while their own corrected flag said otherwise. An entry that contradicts itself is worse than one that is simply wrong, because the reader cannot tell which half to believe; those sentences now state what the record states.
+
+A designation no longer outlives the listing it came from. When CISA removes a CVE, the refresh already cleared the listing dates but left the ransomware flag standing on a record that no longer exists; it is cleared to unknown rather than to false, since false would assert something upstream is no longer there to say.
+
+`refresh --drift-only` reconciles the entries the catalog already holds and skips discovery of new ones. Discovery imports drafts that still need curation, so correcting stale fields on shipped entries previously meant either taking that work in the same change or leaving the fields stale.
+
+The repository documentation describes the repository again. `ARCHITECTURE.md` carried a CVE schema example — the block a contributor copies — whose `active_exploitation` was a boolean where the schema defines a five-value string, whose factor keys were `ai_assisted` and `live_patch` where the scorer reads `ai_factor` and `live_patch_available`, and whose patch weights were −7 and −5 against the real −15 and −10. It also cited an ISO control under its superseded 2013 numbering, which resolves against nothing. `CONTEXT.md` wrote the RWEP formula with a minus in front of two already-negative weights, turning both mitigating factors into penalties. `MAINTAINERS.md` told a maintainer to commit and push to `main`, which requires a pull request and rejects the push, and restated upstream version pins that had drifted from the catalogs that own them. `SECURITY.md` told reporters not to open a public issue without naming the private advisory channel that is enabled. Counts across all six files now match the data they describe.
+
+Comment volume is down across the scoring engine and the curation modules, with every surviving comment either a contract the signature cannot state or a trap worth naming. No behavior changed.
+
+## 0.19.31 — 2026-08-19
+
+The catalog reaches 1,323 CVEs with 98 additions from CISA KEV, spanning 2005 to 2025 with the weight in the middle years: 15 from 2019, 11 from 2016, 10 each from 2018 and 2020. Microsoft accounts for 29, with Adobe, Cisco, D-Link, Oracle, Apache, Citrix, NETGEAR and VMware behind it. Twenty-four carry CISA's ransomware designation and 76 have an obtainable public exploit.
+
+Fifty-one need a restart before the fix is running, and the entries keep that separate from the update being installed. A browser engine, a kernel extension or a service DLL keeps serving the vulnerable code until the process or the host restarts, so a remediation record keyed to the deployed version reports hosts as done while the pre-patch code executes. For nine of the additions CISA's required action is removal rather than patching, and five have no vendor fix at all; those entries name removal as the remediation instead of describing an upgrade path that does not exist.
+
+Where sources disagree, the entries carry the disagreement. A Metasploit module frames CVE-2013-2551 as an integer overflow while NVD and Microsoft classify it as a use-after-free, and the entry leads with the vendor classification while describing the path the public tooling drives. Where a vendor publishes an unspecified-vulnerability row and nothing more, as Oracle does for CVE-2012-0518, the entry says the mechanism is not on the public record rather than inventing one.
+
+Public-exploit availability is recorded as a finding in both directions, and a negative names the check that produced it: which index was searched, and a public CVE whose entries that same search returns, so a reader can tell a real absence from a broken query. Several entries record a near miss explicitly — a Metasploit module belonging to an adjacent CVE, a write-up with no code, an exploit whose author withheld it.
+
+Framework-gap statements now rest on each CVE's own dates, versions, KB numbers and vendor wording. Claims about what organisations typically do — which patches get deferred, which assets sit outside an inventory, what a monitoring programme usually collects — are gone, because none of them could be sourced and each was load-bearing for the conclusion it supported.
+
 ## 0.19.30 — 2026-08-18
 
 Three CISA KEV entries join the catalog, taking it to 1,225. Each of them turns on a question its sources answer differently, which is why they landed a release later than the rest of their set.

package/CONTEXT.md

@@ -115,14 +115,14 @@ Skills and playbooks read from `data/`. Authoritative catalog inventory:
 
 | File | Entries | Purpose |
 |------|---------|---------|
-| `cve-catalog.json` | 1125 | CVEs with CVSS, RWEP score, EPSS estimates, CISA KEV flags, PoC and live-patch availability |
+| `cve-catalog.json` | 1323 | CVEs with CVSS, RWEP score, EPSS estimates, CISA KEV flags, PoC and live-patch availability |
 | `atlas-ttps.json` | 174 | MITRE ATLAS v2026.07 (August 2026) techniques with framework gap flags |
 | `attack-techniques.json` | 794 | MITRE ATT&CK techniques with framework coverage mappings |
 | `framework-control-gaps.json` | 194 | Framework control gap entries: designed-for vs. what each control misses |
 | `exploit-availability.json` | 28 | Per-CVE PoC locations, weaponization stage, AI-acceleration factor, live-patch status |
 | `global-frameworks.json` | 35 jurisdictions | Patch SLAs and notification windows across global regulatory regimes |
-| `zeroday-lessons.json` | 1125 | Learning-loop entries: zero-day → attack vector → control gap → framework gap → new control |
-| `cwe-catalog.json` | 233 | CWE v4.20 entries (Top 25 2024 plus AI- and supply-chain-relevant weaknesses) |
+| `zeroday-lessons.json` | 1323 | Learning-loop entries: zero-day → attack vector → control gap → framework gap → new control |
+| `cwe-catalog.json` | 236 | CWE v4.20 entries (Top 25 2024 plus AI- and supply-chain-relevant weaknesses) |
 | `d3fend-catalog.json` | 468 | MITRE D3FEND v1.3.0 defensive techniques for offensive → defensive mapping |
 | `rfc-references.json` | 8889 | IETF RFC / Internet-Draft references with status, errata count, replaces / replaced-by, `last_verified` dates |
 | `dlp-controls.json` | 22 | DLP control entries indexed by channel, classifier, surface, enforcement mode, evidence type |
@@ -154,16 +154,24 @@ researcher                  — front-door dispatcher for raw threat intel
 
 The repository uses Real-World Exploit Priority (RWEP) scoring, not CVSS alone. CVSS is reported alongside RWEP but never as the sole score.
 
-RWEP formula (0–100):
-```
-base = cisa_kev(+25) + poc_public(+20) + ai_factor(+15)
-     + active_exploitation(+20) + blast_radius(0-30)
-     - patch_available(-15) - live_patch(-10) + reboot_required(+5)
+RWEP is the sum of eight weighted factors, clamped to 0–100. The two mitigating
+factors carry negative weights, so every term is added:
 
-ai_factor = ai_discovered OR ai_assisted_weaponization
-blast_radius = 0-30 scale (30 = all-Linux or 150M+ installations)
-reboot_required = +5 always when patch requires reboot
 ```
+rwep_score = cisa_kev(+25) + poc_available(+20) + ai_factor(+15)
+           + active_exploitation(+20) + blast_radius(0..+30)
+           + patch_available(-15) + live_patch_available(-10)
+           + reboot_required(+5)
+
+ai_factor            = ai_discovered OR ai_assisted_weaponization
+blast_radius         = 0-30 (30 = all-Linux, or an install base in the 150M range)
+active_exploitation  = +20 confirmed, +10 suspected, +5 unknown
+reboot_required      = +5 whenever the patch needs a reboot
+```
+
+The stored `rwep_factors` must sum to the stored `rwep_score`; the catalog
+validator fails the entry when they disagree. `lib/scoring.js` holds the weights,
+and its key names are the ones the catalog must use.
 
 Example: CVE-2026-31431 (Copy Fail) — CVSS 7.8 / **RWEP 90**
 - CVSS 7.8 suggests "high, patch within 30 days"

package/README.md

@@ -28,9 +28,27 @@
 
 Every skill explicitly flags where a compliance framework's control is insufficient for current attack patterns. The framework is often the problem, not the org.
 
-## Status
+## What ships
 
-Pre-1.0. Latest release lives on [GitHub Releases](https://github.com/blamejs/exceptd-skills/releases) and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills) with signed npm provenance attestation and Ed25519-signed skill bodies. The package ships 51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection, post-quantum crypto, SBOM integrity, identity-incident response, and 35 other AI/security domains, plus 11 intelligence catalogs (CVE / ATLAS / ATT&CK / CWE / D3FEND / DLP / RFC / framework gaps / global frameworks / zero-day lessons / exploit availability) covering 35 jurisdictions; the CVE catalog holds 1025 actively-exploited and high-priority entries, each carrying behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson. 33 investigation playbooks (kernel, MCP, AI-API, framework, SBOM, runtime, hardening, secrets, cred-stores, containers, crypto, plus `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil`, `post-quantum-migration`, `ai-discovered-cve-triage`, `supply-chain-recovery`, `citation-hygiene`, `vc-wallet-trust`, `mail-server-hardening`, `network-trust`, `audit-log-integrity`, `self-update-integrity`, `multitenancy-isolation`, `decompression-dos`, `log-injection-telemetry`, `privacy-consent-ops`, and more), a CLI for discovery and investigation built around `discover → brief → run → attest` (each run executes the playbook's seven-phase contract), and a nightly auto-refresh job that pulls KEV / NVD / EPSS / GHSA / OSV / IETF deltas plus 15 primary-source advisory, research-blog, and tech-press feeds (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org, oss-security, JFrog, CISA, Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red, BleepingComputer security, and The Hacker News) into auto-PRs for editorial review, alongside a silent-regression watcher that flags historical CVEs re-broken without a new identifier.
+Pre-1.0. Released on [GitHub](https://github.com/blamejs/exceptd-skills/releases)
+and on npm as [`@blamejs/exceptd-skills`](https://www.npmjs.com/package/@blamejs/exceptd-skills),
+with npm provenance attestation and an Ed25519 signature on every skill body.
+
+51 skills across kernel LPE, MCP supply chain, AI-as-C2, prompt injection,
+post-quantum crypto, SBOM integrity, identity incident response and 35 further
+domains.
+
+| | |
+|---|---|
+| **11 catalogs** | CVE, ATLAS, ATT&CK, CWE, D3FEND, DLP, RFC, framework gaps, global frameworks, zero-day lessons, exploit availability — across 35 jurisdictions |
+| **1,323 CVEs** | Each with behavioral indicators, an ATT&CK technique mapping, and a defense-chain zero-day lesson |
+| **33 playbooks** | Seven-phase investigations: `kernel`, `mcp`, `ai-api`, `sbom`, `containers`, `crypto`, `secrets` and the rest, through `webhook-callback-abuse`, `cicd-pipeline-compromise`, `identity-sso-compromise`, `llm-tool-use-exfil` and `post-quantum-migration`. `exceptd brief --all` is the live list |
+| **A CLI** | `discover → brief → run → attest`, where each run executes the playbook's seven-phase contract |
+
+A nightly job pulls KEV, NVD, EPSS, GHSA, OSV and IETF deltas alongside 15
+advisory, vendor-research and tech-press feeds, and opens a pull request for
+editorial review rather than merging. A companion watcher flags historical CVEs
+re-broken without a new identifier being assigned.
 
 ---
 
@@ -159,20 +177,6 @@ Verify on npm: `npm view @blamejs/exceptd-skills@<version> dist.signatures` show
 
 Air-gapped operation: run `exceptd refresh --prefetch` on a connected host, copy the resulting `.cache/upstream/` to the airgap, run `exceptd refresh --from-cache <path> --apply` over there. The vendored upstream snapshots replace every network call.
 
-Fresh-disclosure workflow (v0.12.0): the nightly auto-PR job pulls KEV / NVD / EPSS / IETF / **GHSA** (added in v0.12.0) / **OSV** (added in v0.12.10). KEV typically takes days; NVD ~10 days; GHSA fires within hours of disclosure and covers npm + PyPI + Maven + Go + NuGet + …; OSV aggregates the OSSF Malicious Packages dataset (`MAL-*` keys) + Snyk + RustSec + Mageia + Ubuntu USN + Go Vuln DB + PYSEC + UVI on top of GHSA — useful for malicious-package compromises that don't have CVEs yet (`exceptd refresh --advisory MAL-2026-3083`). New IDs land as drafts (`_auto_imported: true`, `_draft: true`) that the catalog validator treats as warnings, not errors — operators get the fresh entry immediately, editorial review (framework gaps, IoCs, ATLAS/ATT&CK refs) follows via `exceptd refresh --curate <ID>`. To pull one advisory immediately: `exceptd refresh --advisory <CVE-or-GHSA-or-MAL-or-SNYK-or-RUSTSEC-ID> --apply`.
-
-Primary-source advisory polling: `exceptd refresh --check-advisories` polls 15 vendor and coordinated-disclosure feeds — 8 advisory/coordinated-disclosure venues (Qualys TRU, Red Hat RHSA, Ubuntu USN, Zero Day Initiative, kernel.org commits, oss-security mailing list, JFrog SecOps, CISA current advisories), 4 vendor security research blogs (Microsoft Security Blog, Sysdig, Trail of Bits, Embrace the Red), and 3 more (BleepingComputer security, The Hacker News, and a researcher activity-feed tracker). Combined coverage publishes CVE IDs at T+0 to T+1 — typically 3–14 days ahead of NVD enrichment. The command is report-only: it returns a structured `diffs[]` listing each newly-seen CVE ID with its source attributions and advisory URLs, but does not mutate the catalog. A complementary silent-regression watcher (`lib/cve-regression-watcher.js`) cross-checks poller diffs for historical-CVE references (year ≤ currentYear − 2) and surfaces candidate silent-regression cases — historical CVEs re-broken by a new proof-of-concept without a new ID being assigned. Operators triage the output and route promising IDs through `exceptd refresh --advisory <CVE-ID> --apply`. Pairs with the daily scheduled remote agent below.
-
-CVE-class alert surfacing: `exceptd watchlist --alerts` matches the live `cve-catalog.json` against five operational patterns (`kernel_lpe_with_poc`, `supply_chain_family`, `ai_discovered_kev`, `active_exploitation_unpatched`, `recent_poc_no_kev_yet`) and returns the matches sorted critical-severity-first, then by RWEP. Use it to triage a refreshed catalog without scanning every entry by hand.
-
-GitHub repo-pattern monitoring: `exceptd watchlist --org-scan --org <login>` probes GitHub Search for repositories matching known threat-actor naming patterns ("A Gift From TeamPCP", "Shai-Hulud", "TeamPCP") scoped to one org. Custom patterns via repeatable `--pattern <s>`. Implements the canonical detection for the Shai-Hulud / TeamPCP supply-chain framework class — the attacker uses GitHub itself as the exfil channel. Set `GITHUB_TOKEN` for private-repo coverage and rate-limit headroom; public-repo search works without auth.
-
-AI-assistant config-file audit: `exceptd doctor --ai-config` walks `~/.claude`, `~/.cursor`, `~/.codeium`, `~/.aider`, and `~/.continue`, flagging sensitive files (`settings.json`, `mcp.json`, `*.mcp_config.json`, `api_key*`, `*.token`, `*.credentials`) not at mode 0600 on POSIX. On Windows the mode bits aren't load-bearing; each finding is surfaced with an info-level "manual ACL review" note. Catches the AI-config-credential-exfil class that the Shai-Hulud framework targets. Opt-in — does not run as part of the default no-flag `doctor` pass.
-
-Evidence-collection layer: `exceptd collect <playbook>` invokes a companion script under `lib/collectors/<playbook>.js` that walks cwd, applies the catalogued regex set, stats permissions, and emits the submission JSON in the same shape `exceptd run --evidence -` accepts. 14 of 33 playbooks have collectors today (`ai-api`, `cicd-pipeline-compromise`, `citation-hygiene`, `containers`, `cred-stores`, `crypto`, `crypto-codebase`, `hardening`, `kernel`, `library-author`, `mcp`, `runtime`, `sbom`, `secrets`); the remaining 19 are policy-skipped per AGENTS.md (judgement-shaped incident / governance / pure-analyze playbooks where AI-driven evidence collection is the design). Canonical operator pipe: `exceptd collect <pb> | exceptd run <pb> --evidence -`. `exceptd doctor --collectors` enumerates the layer; `exceptd discover` tags applicable playbooks with `[collector]` when one ships. `cicd-pipeline-compromise` requires `--attest-ownership` on the collect call (the playbook's `operator-owns-ci-fleet` precondition is opt-in to prevent unauthorized CI assessments).
-
-Daily scheduled threat intake: a `routine: exceptd-threat-intake` (claude.ai remote agent) runs daily at 14:00 UTC. Sequence: `npm install` → `refresh --check-advisories` → `watchlist --alerts` → `refresh --apply` → `refresh --advisory <CVE-ID>` for up to 5 new CVE IDs from the primary-source feeds → re-sign + rebuild-indexes if the catalog mutated → commit on `intake/<YYYY-MM-DD>` branch with the full diff in the report. Fresh disclosures no longer wait for an operator to trigger an intake run. Operator-managed at <https://claude.ai/code/routines>.
-
 Optional env vars for higher rate budgets:
 
 | Variable | Purpose |
@@ -202,11 +206,83 @@ npm run predeploy          # full predeploy gate sequence locally
 
 Direct invocations also available: `npm run verify`, `node lib/sign.js sign-all`.
 
+## Keeping the catalog current
+
+A CVE reaches the catalog through one of three paths, at different speeds.
+
+**The nightly job** pulls KEV, NVD, EPSS, IETF, GHSA and OSV. They arrive at
+different times: KEV takes days and NVD around ten, while GHSA fires within hours
+of disclosure across npm, PyPI, Maven, Go and NuGet. OSV layers Snyk, RustSec,
+Mageia, Ubuntu USN, the Go vulnerability database, PYSEC and UVI on top, plus the
+OSSF Malicious Packages dataset — which is where a compromised package with no
+CVE shows up at all. New IDs land as drafts flagged `_auto_imported`, which the
+catalog validator reports as warnings rather than errors: the entry is available
+immediately and the editorial work follows.
+
+```bash
+exceptd refresh --advisory CVE-2026-45321 --apply   # pull one ID now
+exceptd refresh --curate CVE-2026-45321             # editorial questions for a draft
+exceptd refresh --drift-only --apply                # reconcile what is already held
+```
+
+**Primary-source polling** runs ahead of all of them. `exceptd refresh
+--check-advisories` reads 15 feeds — eight advisory and coordinated-disclosure
+venues (Qualys TRU, Red Hat RHSA, Ubuntu USN, ZDI, kernel.org commits,
+oss-security, JFrog SecOps, CISA), four vendor research blogs (Microsoft
+Security, Sysdig, Trail of Bits, Embrace the Red), and three press and researcher
+trackers. Between them they publish CVE IDs three to fourteen days ahead of NVD
+enrichment. The command is report-only: it returns each newly-seen ID with its
+sources and advisory URLs and changes nothing. `lib/cve-regression-watcher.js`
+reads the same diffs for references to CVEs two or more years old, which is what
+a silently re-broken historical flaw looks like before anyone assigns it a new
+identifier.
+
+**A daily agent** (`routine: exceptd-threat-intake`, 14:00 UTC) chains those
+steps — poll, alert, refresh, enrich up to five new IDs, re-sign and rebuild if
+the catalog moved — and commits to an `intake/<date>` branch. Managed at
+<https://claude.ai/code/routines>.
+
+Once a refresh lands, `exceptd watchlist --alerts` matches the catalog against
+five operational patterns — `kernel_lpe_with_poc`, `supply_chain_family`,
+`ai_discovered_kev`, `active_exploitation_unpatched`, `recent_poc_no_kev_yet` —
+sorted critical-first, then by RWEP, so a refreshed catalog can be triaged
+without reading every entry.
+
+## Evidence collection
+
+`exceptd collect <playbook>` walks the working directory, applies the playbook's
+catalogued patterns, stats permissions, and emits submission JSON in the shape
+`exceptd run --evidence -` accepts:
+
+```bash
+exceptd collect <playbook> | exceptd run <playbook> --evidence -
+exceptd doctor --collectors            # which playbooks ship one, and which do not
+```
+
+14 of the 33 playbooks ship a collector. The other 19 are deliberately without
+one: they are judgement-shaped incident, governance and pure-analyze playbooks
+where the evidence is an assessment rather than a file on disk.
+`cicd-pipeline-compromise` additionally requires `--attest-ownership`, because
+its `operator-owns-ci-fleet` precondition is what stops it being pointed at
+someone else's CI.
+
+Two scans sit outside the playbook contract:
+
+- `exceptd watchlist --org-scan --org <login>` searches one GitHub org for
+  repositories matching known threat-actor naming patterns. This is the
+  detection for the supply-chain class that uses GitHub itself as the exfil
+  channel. Set `GITHUB_TOKEN` for private repositories and rate-limit headroom.
+- `exceptd doctor --ai-config` checks `~/.claude`, `~/.cursor`, `~/.codeium`,
+  `~/.aider` and `~/.continue` for credential-bearing files — `settings.json`,
+  `mcp.json`, `api_key*`, `*.token`, `*.credentials` — left readable beyond mode
+  0600. Windows has no equivalent bit, so findings there are raised for manual
+  ACL review. Opt-in; the bare `doctor` pass does not run it.
+
 ## CLI command reference
 
 Every command works the same via `npx @blamejs/exceptd-skills`, a global install (`exceptd`), or a local `node bin/exceptd.js`.
 
-### v0.11.0 canonical verbs
+### Canonical verbs
 
 ```
 exceptd                               First-run welcome — two ways to start
@@ -415,6 +491,11 @@ exceptd refresh                       Refresh upstream catalogs + indexes.
                                       upstream artifact now (network required).
                                       Run on a connected host, then point
                                       --from-cache at the result on the air-gap.
+  --drift-only                        Reconcile the entries the catalog already
+                                      holds; skip discovery of new ones. Use it
+                                      to correct stale fields on shipped entries
+                                      without pulling in drafts that still need
+                                      curation.
   --no-network                        Report-only dry-run: list what would be
                                       fetched without touching the network.
   --network                           (v0.11.14) Fetch latest signed catalog
@@ -506,7 +587,7 @@ exceptd <verb> --help                 Most verbs print per-verb usage with flag
                                       descriptions.
 ```
 
-### Legacy v0.10.x verbs
+### Deprecated and removed verbs
 
 Five verbs removed in v0.13.0 after deprecation since v0.11.0. Invoking any of these now returns a structured `ok:false` refusal pointing at the replacement; pre-v0.13 scripts must migrate.
 

package/SECURITY.md

@@ -1,73 +1,93 @@
 # Security Policy
 
-## Scope
+## Reporting a vulnerability
 
-This security policy covers the exceptd Security skills repository itself — the skill files, data catalogs, and library code. It does not cover downstream applications that use these skills.
+Two private channels, either is fine:
 
-## Reporting a Vulnerability
+- **GitHub** — open a draft advisory from the repository's Security tab
+  ([Report a vulnerability](https://github.com/blamejs/exceptd-skills/security/advisories/new)).
+  Private vulnerability reporting is enabled, so the report stays between you and
+  the maintainers until an advisory is published.
+- **Email** — security@exceptd.com
 
-Email: security@exceptd.com
+**Do not open a public GitHub issue.** A public issue is the one channel that
+tells everyone else before the fix exists.
 
-Include:
-- Description of the issue
-- Steps to reproduce
-- Impact assessment
-- Whether you believe this is being actively exploited
+Include what you have:
 
-**Do not file public GitHub issues for security vulnerabilities.**
+- What the issue is
+- How to reproduce it
+- What an attacker gets
+- Whether you believe it is being exploited now
 
-## Response SLAs
+## What to expect
 
-| Severity | First Response | Triage | Fix |
+| Severity | First response | Triage | Fix |
 |---|---|---|---|
-| Critical (data integrity attack on CVE catalog, RWEP score manipulation) | 24h | 72h | 7d |
-| High (skill instruction that produces incorrect remediation for CISA KEV) | 72h | 7d | 14d |
-| Medium (incorrect framework gap mapping, wrong control ID) | 7d | 14d | 30d |
-| Low (missing data, incomplete entries) | 14d | 30d | next minor |
-
-## Supported Versions
-
-Pre-1.0: Latest patch on the most recent minor receives data updates (CVE catalog, framework gap updates, new ATLAS TTPs). All versions receive critical accuracy corrections.
+| Critical — data-integrity attack on the CVE catalog, RWEP score manipulation | 24h | 72h | 7d |
+| High — a skill that produces incorrect remediation for a CISA KEV entry | 72h | 7d | 14d |
+| Medium — an incorrect framework gap mapping or wrong control ID | 7d | 14d | 30d |
+| Low — missing data, incomplete entries | 14d | 30d | next minor |
 
-Once 1.0: 18-month data update support after each major version.
+## Supported versions
 
-## Threat Model
+Pre-1.0, the latest patch on the most recent minor receives data updates: CVE
+catalog, framework gap changes, new ATLAS TTPs. Every version receives critical
+accuracy corrections.
 
-### What This Repo Defends
+From 1.0, each major version receives data updates for 18 months.
 
-**Data integrity of the CVE catalog and RWEP scores.** Tampered scores could cause security teams to deprioritize genuinely critical vulnerabilities. Every RWEP calculation is reproducible from `data/cve-catalog.json` inputs and the formula in `lib/scoring.js`. Auditors should verify scores independently for high-stakes decisions.
-
-**Accuracy of framework gap declarations.** If a gap is incorrectly declared as "closed" when it remains open, organizations may believe they are protected when they are not. Gap status changes require evidence (framework update reference + control text analysis) not assertions.
+## Scope
 
-**Freshness of exploit availability data.** Stale PoC status (marking an exploit as not-public when it is) causes teams to use incorrect RWEP scores. `data/exploit-availability.json` is versioned and dated. Every entry has a `last_verified` field.
+This policy covers the repository itself — the skill files, the data catalogs,
+and the library code. It does not cover applications built on top of them.
 
-**Skill instruction correctness.** A skill that produces incorrect remediation guidance (e.g., recommending a patch that doesn't exist for a kernel version, citing a wrong ATLAS TTP ID) creates direct harm. Skills are pinned to `last_threat_review` dates and reviewed when referenced CVEs or TTPs change.
+The repository has no npm runtime dependencies; `lib/` is self-contained and the
+skills and catalogs are plain text and JSON. Loaded through an AI assistant, the
+skills are instruction text: nothing here executes in your environment unless
+your assistant chooses to run it.
 
-### What This Repo Does Not Defend
+Out of scope:
 
-- Runtime security of applications that use these skills (that's blamejs's scope)
-- Upstream framework accuracy (NIST, ISO, MITRE ATLAS) — we track lag, we don't control it
-- Physical access to systems this runs on
+- Runtime security of applications that consume these skills
+- Accuracy of the upstream frameworks themselves — NIST, ISO and MITRE lag is
+  tracked here, not controlled here
+- Physical access to the machine this runs on
 
-## Data Integrity
+## What the repository defends
 
-CVE catalog entries and RWEP scores are not authoritative sources — they are analytical summaries for operational use. Always cross-reference:
+**The CVE catalog and its RWEP scores.** Tampered scores deprioritize
+vulnerabilities that are genuinely critical. Every RWEP score is reproducible
+from the inputs in `data/cve-catalog.json` and the formula in `lib/scoring.js`;
+recompute it yourself when the decision is a large one.
 
-- CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
-- NVD: https://nvd.nist.gov/
-- MITRE ATLAS: https://atlas.mitre.org/
-- MITRE ATT&CK: https://attack.mitre.org/
+**Framework gap declarations.** A gap recorded as closed while it remains open
+tells an organization it is covered when it is not. Changing a gap's status
+requires evidence — a framework update reference and the control text it turns
+on — not an assertion.
 
-For critical security decisions, verify CISA KEV status directly. RWEP scores are a prioritization heuristic, not a compliance instrument.
+**Exploit-availability freshness.** An exploit marked not-public when it is
+public understates RWEP by a fifth of the scale. `data/exploit-availability.json`
+is versioned and every entry carries `last_verified`.
 
-## Supply Chain
+**Skill instruction correctness.** A skill that recommends a patch which does not
+exist for a given kernel version, or cites the wrong ATLAS technique, does direct
+harm. Skills carry a `last_threat_review` date and are re-reviewed when the CVEs
+or techniques they cite change.
 
-This repository has no npm runtime dependencies. The library code in `lib/` is self-contained. Skills and data files are plain text/JSON.
+## Using the data
 
-When using these skills via an AI assistant, the skills are loaded as instruction text. No code from this repository executes in your environment beyond what your AI assistant chooses to implement.
+Catalog entries and RWEP scores are analytical summaries for operational use, not
+authoritative sources. Cross-reference before acting:
 
-## Accuracy Disclaimer
+- CISA KEV — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+- NVD — https://nvd.nist.gov/
+- MITRE ATLAS — https://atlas.mitre.org/
+- MITRE ATT&CK — https://attack.mitre.org/
 
-Security threat intelligence has a short shelf life. CVE data, PoC availability status, and framework coverage assessments in this repository reflect the state of knowledge at the `last_threat_review` date in each skill's frontmatter. Verify current status with primary sources before making production security decisions.
+Verify KEV status against CISA directly for critical decisions. RWEP is a
+prioritization heuristic, not a compliance instrument.
 
-RWEP scores are analytical tools, not authoritative risk assessments. They are designed to surface prioritization signal beyond CVSS, not to replace professional security judgment.
+Threat intelligence has a short shelf life. What this repository asserts reflects
+the state of knowledge at each skill's `last_threat_review` date. Check the
+primary source before a production decision rests on it.

package/data/_indexes/_meta.json

@@ -1,22 +1,22 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-08-18T05:32:14.962Z",
+  "generated_at": "2026-08-22T06:16:21.493Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "81aa6acc7b57248f3efecb64f57223583366556ddbf2f8ede02677c4ae36b2b7",
-    "README.md": "a757b8ed9923b7954518d00a768d338800460c9a90811094f050710fe9888615",
+    "manifest.json": "0b5994038838da7f7685f50c81eb5dc9c552c3865617162bab778279ed9bacbe",
+    "README.md": "bc575c178c21e3d07f1491710e24b26cad3a3cee012c43641b6ea7e83468e64e",
     "data/atlas-ttps.json": "a14089671efcb4f06dd0f82d688fe49276c1370e167e4483d76e9c0a40ef41eb",
-    "data/attack-techniques.json": "4ac69e35dccb7a5f3eb3a8fefdfcb4ba5892345bddb5fa4d673ca6e336451ad8",
-    "data/cve-catalog.json": "c561377a52c2840f637e587175fa97c1ce96b35ad0431ec2491ecd63b70d29dd",
-    "data/cwe-catalog.json": "edfa10d0a1ade79c0cbc1ca928d0240e2d30b11302c453fed5cf440122d7424e",
+    "data/attack-techniques.json": "cf192b45621ce697d3b86789db58c840312c1fc13601beb58df7c747b065d08b",
+    "data/cve-catalog.json": "8293de3334f8c134c26b13269126c62ed80fc88663a4e45d456beb031b8893e4",
+    "data/cwe-catalog.json": "7db3e297a7401c99e1bf9019e9b2eaf88e5cda97f6799e01667acab13362a746",
     "data/d3fend-catalog.json": "9a4a356a1446d7db8be8b6684fa789802405a96cdaf769f06db4136bd07db6ac",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
     "data/exploit-availability.json": "7139702266a8d5ba8b235ab76518b8a84deaa31fdb912e81cb124121cf3e9930",
-    "data/framework-control-gaps.json": "927cf02d5ed3ec43a822e222a53f891ff0452e36fc5606b868e6dfc3f320e524",
+    "data/framework-control-gaps.json": "79cd66ea9ca6eb1e63c6647d52a28a205747d64c4cb96e61fb2bb0c057023834",
     "data/global-frameworks.json": "20b18a851b3ab82e57cd159b49476d69fe544f02523398b2015189ab81c7c3f8",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "7d06853a6a4b151620044190296a2e20b3d904333b5565863ecf1a75eb9e7c0a",
+    "data/zeroday-lessons.json": "3ee0c1aa27701a0eda2479f0d10fb4f095d8d542152595a04b15373eddf69d1e",
     "skills/kernel-lpe-triage/skill.md": "0f79c641cef6e5f4a942eb94f43c460562bf83dfb67ae112d146c39c6b320fb0",
     "skills/ai-attack-surface/skill.md": "c97335e14cd34bd1cd3c9d2cbd397f33569a07292b2f2f7721483575eb4459f7",
     "skills/mcp-agent-trust/skill.md": "6195c93a6cadb213051214742890fa2bf4e39bae377a654d4195f0c90bd8b896",
@@ -101,7 +101,7 @@
       "dlp_refs": 0
     },
     "trigger_table_entries": 688,
-    "chains_cve_entries": 1212,
+    "chains_cve_entries": 1310,
     "chains_cwe_entries": 236,
     "jurisdictions_indexed": 34,
     "handoff_dag_nodes": 51,

package/data/_indexes/activity-feed.json

@@ -6,23 +6,23 @@
   },
   "events": [
     {
-      "date": "2026-08-18",
+      "date": "2026-08-22",
       "type": "catalog_update",
-      "artifact": "data/attack-techniques.json",
-      "path": "data/attack-techniques.json",
+      "artifact": "data/cve-catalog.json",
+      "path": "data/cve-catalog.json",
       "schema_version": "1.0.0",
-      "entry_count": 794
+      "entry_count": 1323
     },
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
-      "artifact": "data/cve-catalog.json",
-      "path": "data/cve-catalog.json",
+      "artifact": "data/attack-techniques.json",
+      "path": "data/attack-techniques.json",
       "schema_version": "1.0.0",
-      "entry_count": 1225
+      "entry_count": 794
     },
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
       "artifact": "data/cwe-catalog.json",
       "path": "data/cwe-catalog.json",
@@ -30,7 +30,7 @@
       "entry_count": 236
     },
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
       "artifact": "data/framework-control-gaps.json",
       "path": "data/framework-control-gaps.json",
@@ -38,12 +38,12 @@
       "entry_count": 194
     },
     {
-      "date": "2026-08-18",
+      "date": "2026-08-19",
       "type": "catalog_update",
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",
       "schema_version": "1.1.0",
-      "entry_count": 1225
+      "entry_count": 1323
     },
     {
       "date": "2026-08-08",