@blamejs/exceptd-skills 0.19.31 → 0.19.33

package/lib/cve-batch.js

@@ -1,24 +1,16 @@
 'use strict';
 
-// Batch curation orchestration: read a facts file + a judgments file, run
-// each pair through cve-enrich.assembleEntry, refuse to write when any
-// entry has an orphaned reference or an assembly error, and otherwise
-// write the catalog (targeted string surgery — never round-tripped),
-// zeroday-lessons.json (canonical writer, it DOES round-trip), and one
-// tests/cve-<id>.test.js per curated CVE. Wired to the CLI as
-// `refresh --curate-batch --facts <path> --judgments <path> [--apply]`.
+// Batch curation: facts + judgments through cve-enrich.assembleEntry, then the
+// catalog, zeroday-lessons.json and one tests/cve-<id>.test.js per CVE. Nothing
+// is written if any entry has an orphaned reference or an assembly error.
+// CLI: `refresh --curate-batch --facts <path> --judgments <path> [--apply]`.
 
 const fs = require('fs');
 const path = require('path');
 const enrich = require('./cve-enrich.js');
 
-// ---------------------------------------------------------------------
-// Catalog string-surgery insert + _meta recompute (Task 6)
-// ---------------------------------------------------------------------
-
-// Find the insertion point just after the top-level "_meta" member. Brace-
-// matches from the "_meta" key. The catalog is 2-space-indented; new members
-// are emitted at that indent.
+// The insertion point just after the top-level "_meta" member, brace-matched
+// from its key. The catalog is 2-space-indented and new members match it.
 function _metaEnd(text) {
   const m = /\n {2}"_meta"\s*:/.exec(text);
   if (!m) throw new Error('cve-batch: could not locate top-level "_meta" member');
@@ -31,26 +23,20 @@ function _metaEnd(text) {
     else if (c === '"') { i++; while (i < text.length && text[i] !== '"') { if (text[i] === '\\') i++; i++; } }
   }
   const comma = text.indexOf(',', i);
-  // A comma whose gap from _meta's closing brace is whitespace-only is _meta's
-  // member separator → insert after it (a member follows). Otherwise _meta is
-  // the only/last member (no separator) → insert right after its brace with a
-  // leading comma and no trailing comma.
+  // Whitespace-only gap to the next comma means _meta has a following member,
+  // so insert after the separator; otherwise _meta is last and the insert
+  // supplies its own leading comma.
   if (comma !== -1 && text.slice(i, comma).trim() === '') return { at: comma + 1, leadingComma: false };
   return { at: i, leadingComma: true };
 }
 
-// Ids already present as top-level members of the catalog text. insertEntries
-// splices new members in after _meta and cannot replace an existing one, so an
-// id that is already there would end up written TWICE. JSON.parse keeps the
-// last duplicate, which is the copy that was already on disk — so a re-apply
-// silently discards the new entry, inflates the file, and leaves every count,
-// schema check and orphan scan passing on stale data. Refusing is the only
-// honest outcome: the caller restores the catalog and applies once.
+// Ids already present as top-level catalog members. insertEntries appends and
+// cannot replace, so writing one twice leaves a duplicate JSON key; JSON.parse
+// keeps the last, which is the stale copy, while every count and schema check
+// still passes. Parsed rather than pattern-matched: a CVE id quoted inside
+// another entry's prose is not a member, and building a RegExp from caller ids
+// would be a ReDoS sink in the one function that exists to distrust them.
 function existingIds(catalogText, ids) {
-  // Parsed, not pattern-matched. A top-level key is exactly what JSON.parse
-  // reports, so this cannot mistake a CVE id quoted inside another entry's prose
-  // for a member — and it builds no RegExp from the caller's ids, which would be
-  // a ReDoS sink for input this function exists to distrust.
   let parsed;
   try {
     parsed = JSON.parse(catalogText);
@@ -80,12 +66,10 @@ function insertEntries(catalogText, entriesById) {
 }
 
 function recomputeAiMeta(catalogText, aiCount, total) {
-  // current_rate is the ROUNDED rate (a separate test asserts it equals
-  // round(observed, 3)). The floor, however, is enforced against the RAW rate
-  // (the catalog test checks `rawRate >= floor`), so the floor must be lowered
-  // to the raw rate FLOORED to 3 decimals — using the rounded rate here let a
-  // raw rate of 0.02262 (rounds to 0.023) leave a 0.023 floor the raw rate
-  // cannot clear. Never raise the floor; only lower it when the rate dilutes.
+  // current_rate is ROUNDED; the floor is enforced against the RAW rate, so the
+  // floor must be the raw rate FLOORED to 3 decimals. Rounding both leaves a
+  // floor the raw rate cannot clear (0.02262 rounds to 0.023). Only ever lower
+  // the floor — raising it fails the corpus it describes.
   const rawRate = aiCount / total;
   const rate = Math.round(rawRate * 1000) / 1000;
   let out = catalogText.replace(/("current_rate"\s*:\s*)[0-9.]+/, `$1${rate}`);
@@ -102,10 +86,7 @@ function recomputeAiMeta(catalogText, aiCount, total) {
   return out;
 }
 
-// ---------------------------------------------------------------------
-// zeroday-lessons.json writer (Task 7) — this file DOES round-trip.
-// ---------------------------------------------------------------------
-
+// zeroday-lessons.json round-trips, so it is rewritten whole rather than spliced.
 function addLessons(lessonsObj, lessonsById) {
   const out = { ...lessonsObj };
   let added = 0;
@@ -118,10 +99,6 @@ function addLessons(lessonsObj, lessonsById) {
   return out;
 }
 
-// ---------------------------------------------------------------------
-// Per-CVE test-file generator (Task 8)
-// ---------------------------------------------------------------------
-
 function renderTest(cveId) {
   return `const test = require('node:test');
 const assert = require('node:assert');
@@ -146,10 +123,6 @@ test('${cveId}: curated KEV entry is complete and self-consistent', () => {
 `;
 }
 
-// ---------------------------------------------------------------------
-// curateBatch orchestration + CLI (Task 9)
-// ---------------------------------------------------------------------
-
 function _loadIds(root, file, key) {
   const p = path.join(root, 'data', file);
   if (!fs.existsSync(p)) return new Set();
@@ -179,9 +152,8 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
     else errors.push(`${id}: missing lesson in judgments.`);
   }
 
-  // Report an already-present id as a normal validation error so the DRY RUN
-  // surfaces it. insertEntries throws on the same condition, but that fires only
-  // under --apply, which is one step too late to be useful.
+  // Reported as a validation error so the DRY RUN surfaces it; insertEntries
+  // throws on the same condition, but only under --apply.
   const catText = fs.readFileSync(path.join(catalogRoot, 'data', 'cve-catalog.json'), 'utf8');
   for (const id of existingIds(catText, Object.keys(entries)))
     errors.push(`${id}: already present in the catalog — this batch adds entries and cannot replace one. Restore the catalog and apply once.`);
@@ -203,9 +175,8 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
   const lesObj = addLessons(JSON.parse(fs.readFileSync(lesPath, 'utf8')), lessons);
   fs.writeFileSync(lesPath, JSON.stringify(lesObj, null, 2) + '\n');
 
-  // id is already "CVE-2025-0108" — lowercasing alone yields the repo's
-  // existing tests/cve-<year>-<num>.test.js convention; prepending another
-  // "cve-" would double the prefix (tests/cve-cve-2025-0108.test.js).
+  // The id already carries its "CVE-" prefix, so lowercasing alone produces the
+  // repo's tests/cve-<year>-<num>.test.js convention.
   for (const id of Object.keys(entries))
     fs.writeFileSync(path.join(catalogRoot, 'tests', `${id.toLowerCase()}.test.js`), renderTest(id));
 
@@ -220,10 +191,9 @@ async function cli(argv) {
     else if (a === '--judgments') opts.judgments = argv[++i];
     else if (a === '--apply') opts.apply = true;
   }
-  // Guard missing/unreadable inputs before touching curateBatch — without
-  // this, fs.readFileSync(null) / a nonexistent path throws out of the
-  // async function and crashes the CLI instead of returning a structured
-  // {ok:false} envelope like every other refresh-curate error path.
+  // Inputs are checked before curateBatch so a missing path returns the same
+  // {ok:false} envelope every other refresh-curate error path does, rather than
+  // throwing out of the async function.
   if (!opts.facts || !opts.judgments || !fs.existsSync(opts.facts) || !fs.existsSync(opts.judgments)) {
     const missing = [];
     if (!opts.facts) missing.push('--facts <path>');

package/lib/cve-curation.js

@@ -462,7 +462,31 @@ function buildQuestionnaire(cveId, draft) {
       field: "cisa_kev + cisa_kev_date",
       current_value: { cisa_kev: draft.cisa_kev ?? null, cisa_kev_date: draft.cisa_kev_date ?? null },
       candidates: [],
-      ask: "Is the CVE on CISA's Known Exploited Vulnerabilities list? If yes, capture the date added (YYYY-MM-DD). If no, answer false explicitly — null fails the strict schema gate.",
+      ask: "Is the CVE on CISA's Known Exploited Vulnerabilities list? If yes, capture the date added (YYYY-MM-DD), the due date, and whether the record marks known ransomware campaign use. If no, answer false explicitly — null fails the strict schema gate.",
+    });
+  }
+
+  // The KEV block above only fires while cisa_kev is still unanswered, so a
+  // draft that already knows it is listed needs its own checks for the two
+  // fields that come from the same record and are easy to leave behind.
+  if (draft.cisa_kev === true && !draft.cisa_kev_due_date) {
+    questions.push({
+      field: "cisa_kev_due_date",
+      current_value: draft.cisa_kev_due_date ?? null,
+      candidates: [],
+      ask: "What remediation deadline does the KEV record carry (dueDate, YYYY-MM-DD)? Read it from the record rather than assuming a fixed window after the listing date — CISA sets shorter ones, and this date is rendered into remediation output and notification drafts.",
+    });
+  }
+
+  // A KEV-listed entry has to carry the designation as a boolean: an absent
+  // field reads as false to every consumer, which asserts something CISA's
+  // record may not say.
+  if (draft.cisa_kev === true && typeof draft.known_ransomware_use !== "boolean") {
+    questions.push({
+      field: "known_ransomware_use",
+      current_value: draft.known_ransomware_use ?? null,
+      candidates: [],
+      ask: "Does the CISA KEV record mark this CVE as known ransomware campaign use? Read knownRansomwareCampaignUse on the KEV record: 'Known' is true, 'Unknown' is false. The field cannot be left null on a KEV-listed entry.",
     });
   }
 
@@ -591,6 +615,7 @@ function applyAnswersUnderLock(cveId, catalog, catalogPath, answers) {
     ["cisa_kev",               (v) => typeof v === "boolean", id],
     ["cisa_kev_date",          (v) => v === null || (typeof v === "string" && isUsableDate(v).ok), id],
     ["cisa_kev_due_date",      (v) => v === null || (typeof v === "string" && isUsableDate(v).ok), id],
+    ["known_ransomware_use",   (v) => typeof v === "boolean", id],
     ["poc_available",          (v) => typeof v === "boolean", id],
     ["poc_description",        (v) => typeof v === "string", id],
     ["ai_discovered",          (v) => typeof v === "boolean", id],

package/lib/cve-enrich.js

@@ -15,26 +15,13 @@ function parseCvssVector(vectorString) {
   };
 }
 
-// Extract REAL vendor advisories from a reference list — only references
-// explicitly tagged "Vendor Advisory" by NVD. Returns [] when none are
-// present. NVD itself is an aggregator, not a vendor, so it is deliberately
-// NOT synthesized in here — its detail URL lives in `verification_sources`
-// (see deriveMechanicalFields). Fabricating an NVD "vendor advisory" for
-// every KEV entry would silently satisfy the "cisa_kev:true but
-// vendor_advisories empty" curation-gap detector in lib/gap-detectors.js,
-// hiding entries that genuinely lack a vendor advisory. An empty array is the
-// honest signal that a curator still needs to attach the real advisory.
-// `cveId` is retained in the signature for callers/back-compat; it is not used
-// now that no synthetic NVD entry is appended.
+// References NVD tags "Vendor Advisory", deduplicated by URL; [] when none.
+// NVD is an aggregator, so it is never synthesized in here: a synthetic NVD
+// advisory would satisfy the empty-vendor_advisories gap detector and hide the
+// entries that genuinely lack one. `cveId` is unused, kept for callers.
 function extractVendorAdvisories(references, kevVendor, cveId) {
   void cveId;
   const out = [];
-  // Deduplicate by URL. Upstream reference lists repeat the same advisory —
-  // NVD carries a link once per tag combination, and a draft that has already
-  // been through one enrichment pass can carry its own copy alongside the
-  // original. Repeating it produces an advisory list that says the same thing
-  // several times in every rendered output, and duplicated relationships in the
-  // generated indexes.
   const seen = new Set();
   for (const r of references || []) {
     if (Array.isArray(r.tags) && r.tags.includes('Vendor Advisory')) {
@@ -55,12 +42,9 @@ function _ordinal(n) {
   return `${n}${suffixes[(v - 20) % 10] || suffixes[v] || suffixes[0]}`;
 }
 
-// The operator-readable restatement of an entry's EPSS fields. It is DERIVED
-// text, not authored, so it has exactly one definition — here — which both the
-// writer (lib/refresh-external.js, when a refresh moves the numbers) and the
-// gate (scripts/check-epss-consistency.js, which compares an entry's stored
-// note against the fields) call. Two copies of this renderer would drift, and
-// the drift would surface as a gate failure on correctly-refreshed data.
+// The one definition of the derived epss_note. Both the writer
+// (lib/refresh-external.js) and the gate (scripts/check-epss-consistency.js)
+// call this; a second copy would drift and fail the gate on correct data.
 function renderEpssNote(entry) {
   const pct = Math.round(entry.epss_percentile * 100);
   return `FIRST EPSS ${entry.epss_score} (${_ordinal(pct)} percentile) as of ${entry.epss_date}.`;
@@ -71,9 +55,8 @@ function deriveMechanicalFields(facts, today) {
   const kev = f.kev || {};
   const cvss = f.cvss || null;
   const parsed = parseCvssVector(cvss && cvss.vector);
-  // Deduplicate: an upstream weakness list can name the same CWE twice (one per
-  // assigning source), and a repeated id becomes a repeated relationship
-  // wherever the catalog is joined against the CWE catalog.
+  // Deduplicated: upstream names the same CWE once per assigning source, and a
+  // repeat becomes a repeated relationship in every catalog join.
   const cweRefs = [...new Set((f.cwe_nvd || []).filter((c) => /^CWE-\d+$/.test(c)))];
   const vendorAdv = extractVendorAdvisories(f.references, kev.vendor, f.id);
   const verification = [...new Set([
@@ -111,9 +94,8 @@ const JUDGMENT_KEYS = ['type','blast_radius','poc_available','poc_description','
   'active_exploitation_notes','attack_refs','atlas_refs','framework_control_gaps','patch_available',
   'patch_required_reboot','live_patch_available','live_patch_tools','live_patch_notes','affected',
   'affected_versions','vendor_update_paths',
-  // A curator/research agent can supply the real vendor advisories when NVD's
-  // refs carry no "Vendor Advisory"-tagged link; this overlays (replaces) the
-  // auto-derived array via the JUDGMENT_KEYS spread loop below.
+  // Overlays (replaces) the auto-derived array, for CVEs whose NVD refs carry
+  // no "Vendor Advisory" tag.
   'vendor_advisories'];
 
 function assembleEntry(facts, judgment, today) {
@@ -123,15 +105,11 @@ function assembleEntry(facts, judgment, today) {
   for (const k of JUDGMENT_KEYS) if (k in j && j[k] !== undefined) entry[k] = j[k];
   if (typeof j.vector === 'string' && j.vector.trim()) entry.vector = j.vector.trim();
 
-  // cwe_refs: mechanical (from NVD) wins when present; fall back to a curator-
-  // supplied list (e.g. when NVD only returns NVD-CWE-noinfo). Kept out of the
-  // blanket JUDGMENT_KEYS loop so facts take precedence over judgment here.
+  // Outside the JUDGMENT_KEYS loop so NVD's CWEs win over a curator's; the
+  // curator list is the fallback for NVD-CWE-noinfo.
   if ((!entry.cwe_refs || entry.cwe_refs.length === 0) && Array.isArray(j.cwe_refs))
     entry.cwe_refs = [...new Set(j.cwe_refs)];
 
-  // The same guard on the judgment-supplied reference arrays. These are written
-  // by hand, so a repeat is a transcription slip rather than an upstream quirk,
-  // but it lands in exactly the same joined output.
   for (const k of ['attack_refs', 'atlas_refs', 'verification_sources', 'vendor_update_paths'])
     if (Array.isArray(entry[k])) entry[k] = [...new Set(entry[k])];
   if (Array.isArray(entry.vendor_advisories)) {
@@ -144,14 +122,13 @@ function assembleEntry(facts, judgment, today) {
     });
   }
 
-  // Defaults + intake markers.
   if (entry.ai_discovery_source === undefined)
     entry.ai_discovery_source = entry.ai_discovered ? 'unknown' : 'vendor_research';
   if (entry.live_patch_tools === undefined) entry.live_patch_tools = [];
   entry._auto_imported = false;
   entry._intake_method = 'batch-curated';
 
-  // RWEP via canonical scoring — Σ factors must equal score AND agree with scoreCustom.
+  // Σ factors must equal rwep_score and agree with scoring.scoreCustom.
   const inputs = {
     cisa_kev: entry.cisa_kev === true,
     poc_available: entry.poc_available === true,
@@ -175,10 +152,8 @@ function assembleEntry(facts, judgment, today) {
   if (entry.poc_available === true && !iocsOk)
     errors.push(`${facts.id}: poc_available=true requires a populated iocs block (Hard Rule #14).`);
 
-  // Required judgment fields — populated, not merely present. A key that is
-  // present-but-empty (empty string / empty array / empty object / non-boolean)
-  // fails the same §7 gate as a missing key, so an under-specified judgment
-  // cannot slip an incomplete entry past the writer.
+  // Required judgment fields must be POPULATED, not merely present: an empty
+  // string, array or object fails the same gate downstream as a missing key.
   if (typeof j.type !== 'string' || j.type.trim() === '')
     errors.push(`${facts.id}: required judgment field "type" missing or not a non-empty string.`);
   if (typeof j.blast_radius !== 'number' || !Number.isFinite(j.blast_radius))
@@ -192,8 +167,8 @@ function assembleEntry(facts, judgment, today) {
   if (typeof j.discovery_attribution_note !== 'string' || j.discovery_attribution_note.trim() === '')
     errors.push(`${facts.id}: required judgment field "discovery_attribution_note" missing or not a non-empty string.`);
 
-  // blast_radius range [0,30]. Surfaces a unit typo (e.g. 250) as an error
-  // rather than letting postWeightFactors silently clamp it inside rwep_factors.
+  // Range-checked here so a unit typo is an error; postWeightFactors would
+  // silently clamp it inside rwep_factors.
   if (typeof entry.blast_radius === 'number' && Number.isFinite(entry.blast_radius) &&
       (entry.blast_radius < 0 || entry.blast_radius > 30))
     errors.push(`${facts.id}: blast_radius ${entry.blast_radius} outside [0,30].`);

package/lib/refresh-external.js

@@ -111,6 +111,12 @@ function parseArgs(argv) {
     // older than 7d or one that was prefetched without a signing keypair.
     // EXCEPTD_FORCE_STALE=1 mirrors for non-interactive automation.
     else if (a === "--force-stale") out.forceStale = true;
+    // --drift-only reconciles the entries the catalog already holds and skips
+    // auto-discovery of new ones. Discovery imports drafts that still need
+    // curation, so an operator correcting stale fields on shipped entries would
+    // otherwise have to take that work in the same commit or leave the fields
+    // stale.
+    else if (a === "--drift-only") out.driftOnly = true;
     // --prefetch / --no-network are prefetch-cache operations. Capture them so
     // main() can delegate to lib/prefetch.js (the same routing bin/exceptd.js
     // performs) when this script is invoked directly — otherwise the help
@@ -163,6 +169,11 @@ Modes:
                      discovery still queries IETF Datatracker live; add --air-gap
                      for a fully offline run. Cache must be pre-populated via --prefetch.
   --source kev,epss  scope to a comma-separated list (kev|epss|nvd|rfc|pins|ghsa|osv)
+  --drift-only       reconcile the entries the catalog already holds; skip
+                     auto-discovery of new ones. Discovered entries arrive as
+                     drafts that still need curation, so this is the flag for
+                     correcting stale fields on shipped entries without pulling
+                     that work into the same change.
   --check-advisories poll primary-source advisory feeds (Qualys TRU, RHSA, USN,
                      ZDI, kernel.org, oss-security, vendor research blogs) and
                      report newly-seen CVE IDs ahead of NVD enrichment.
@@ -286,8 +297,19 @@ const KEV_SOURCE = {
     for (const r of report.results) {
       if (r.status === "unreachable") errors++;
       for (const d of r.discrepancies || []) {
-        if (d.field === "cisa_kev" || d.field === "cisa_kev_date") {
+        // Every KEV field the validator compares, not just the flag and its
+        // date: a filter naming two of the four leaves the deadline and the
+        // ransomware designation reconciling on --from-cache runs alone, which
+        // is not the path most operators take.
+        if (KEV_RECONCILED_FIELDS.has(d.field)) {
           const diff = { id: r.cve_id, field: d.field, before: d.local, after: d.fetched, severity: d.severity };
+          // A designation being REMOVED against an implausibly small feed is the
+          // feed failing to tell us something, not upstream telling us it is
+          // gone — held for review exactly as a de-listing is.
+          if (d.field === "known_ransomware_use" && d.local === true && d.fetched === false && !feedComplete) {
+            diff.review_only = true;
+            diff.note = `Ransomware designation removal held for review: live feed returned only ${liveFeedSize} entries (< ${KEV_FEED_MIN_PLAUSIBLE}), likely incomplete.`;
+          }
           // Symmetric with the --from-cache path: a LIVE KEV de-listing
           // (true→false) is held for review (applyDiff skips review_only)
           // instead of auto-downgrading the entry when EITHER the entry carries
@@ -366,6 +388,11 @@ const KEV_SOURCE = {
           if (d.after === false) {
             if ("cisa_kev_date" in entry) entry.cisa_kev_date = null;
             if ("cisa_kev_due_date" in entry) entry.cisa_kev_due_date = null;
+            // The designation restates a KEV record that no longer exists, so
+            // it cannot stand. Null rather than false: false would assert that
+            // CISA records no ransomware use, which is a claim about a record
+            // that is gone, not a fact upstream supplied.
+            if ("known_ransomware_use" in entry) entry.known_ransomware_use = null;
           }
         }
         catalog[d.id].last_verified = TODAY;
@@ -389,6 +416,9 @@ const KEV_SOURCE = {
  */
 function kevDiffWithDiscoveryFromCache(ctx) {
   const drift = kevDiffFromCache(ctx);
+  if (ctx.driftOnly) {
+    return { ...drift, spilled: 0, summary: `${drift.diffs.length} KEV drifts (from cache, discovery suppressed)` };
+  }
   const discovery = discoverNewKev(ctx);
   const diffs = [...drift.diffs, ...discovery.diffs];
   const summary =
@@ -686,6 +716,9 @@ const RFC_SOURCE = {
  */
 async function rfcDiffWithDiscoveryFromCache(ctx) {
   const drift = rfcDiffFromCache(ctx);
+  if (ctx.driftOnly) {
+    return { ...drift, spilled: 0, summary: `${drift.diffs.length} RFC drifts (from cache, discovery suppressed)` };
+  }
   const discovery = await discoverNewRfcs(ctx);
   const diffs = [...drift.diffs, ...discovery.diffs];
   const summary =
@@ -1052,6 +1085,14 @@ function cvssDiff(id, field, before, after, severity, local) {
 // refused wholesale when the feed is implausibly small.
 const KEV_FEED_MIN_PLAUSIBLE = 500;
 
+// The KEV fields both refresh paths reconcile. Named once so the live path and
+// the cache path cannot cover different subsets — which is exactly how the
+// deadline and the ransomware designation went unreconciled while the flag and
+// its date tracked upstream.
+const KEV_RECONCILED_FIELDS = new Set([
+  "cisa_kev", "cisa_kev_date", "cisa_kev_due_date", "known_ransomware_use",
+]);
+
 function kevDiffFromCache(ctx) {
   const feed = readCachedJson(ctx.cacheDir, "kev", "known_exploited_vulnerabilities", { forceStale: ctx.forceStale });
   if (!feed) {
@@ -1059,10 +1100,22 @@ function kevDiffFromCache(ctx) {
   }
   const kevSet = new Set();
   const kevDates = new Map();
+  const kevDue = new Map();
+  const kevRansom = new Map();
   for (const v of feed.vulnerabilities || []) {
     if (v && v.cveID) {
       kevSet.add(v.cveID);
       if (v.dateAdded) kevDates.set(v.cveID, v.dateAdded);
+      if (v.dueDate) kevDue.set(v.cveID, v.dueDate);
+      // Recorded ONLY for a value this code understands. An absent or
+      // unrecognised knownRansomwareCampaignUse must not be read as "Unknown":
+      // `String(undefined).toLowerCase() === "known"` is false, which would
+      // propose downgrading a curated true to false on the strength of a field
+      // the feed never carried. Absence is no answer, not a negative answer.
+      const r = typeof v.knownRansomwareCampaignUse === "string"
+        ? v.knownRansomwareCampaignUse.trim().toLowerCase() : null;
+      if (r === "known") kevRansom.set(v.cveID, true);
+      else if (r === "unknown") kevRansom.set(v.cveID, false);
     }
   }
   // An implausibly small feed cannot be trusted to de-list curated entries.
@@ -1107,6 +1160,44 @@ function kevDiffFromCache(ctx) {
     if (upDate && (entry.cisa_kev_date || null) !== upDate) {
       diffs.push({ id, field: "cisa_kev_date", before: entry.cisa_kev_date ?? null, after: upDate, severity: "low" });
     }
+
+    // CISA edits a listing after publishing it. The remediation deadline and
+    // the ransomware designation both move that way, and neither was compared
+    // here — so an entry curated on the day of listing kept whatever those
+    // fields held then, indefinitely, while every other KEV field tracked the
+    // feed. Only entries upstream still lists are considered; a de-listing
+    // clears both fields through the cisa_kev branch above.
+    if (upstream) {
+      const upDue = kevDue.get(id) || null;
+      // The deadline is rendered into remediation output and regulator drafts,
+      // so a stale one states a date CISA does not require. It is not decoration
+      // and its severity says so.
+      if (upDue && (entry.cisa_kev_due_date || null) !== upDue) {
+        diffs.push({ id, field: "cisa_kev_due_date", before: entry.cisa_kev_due_date ?? null, after: upDue, severity: "medium" });
+      }
+      const upRansom = kevRansom.has(id) ? kevRansom.get(id) : null;
+      // An entry that omits the field is not asserting anything, but every
+      // consumer reads a missing boolean as false — so an omission on an entry
+      // CISA has since designated is read as "no ransomware association", which
+      // is the wrong answer rather than no answer. For a KEV-listed CVE the
+      // value is a restatement of the feed and carries no curator judgment, so
+      // it is filled from upstream in both directions and the field becomes
+      // total across KEV-listed entries instead of sometimes-absent.
+      const localRansom = typeof entry.known_ransomware_use === "boolean" ? entry.known_ransomware_use : null;
+      if (upRansom !== null && localRansom !== upRansom) {
+        // Same asymmetry as the de-list guard: a designation being ADDED is
+        // upstream telling us something new, while one being REMOVED against an
+        // implausibly small feed is the feed failing to tell us anything. Hold
+        // the removal for review rather than erasing a curated designation.
+        const removing = localRansom === true && upRansom === false;
+        const d = { id, field: "known_ransomware_use", before: localRansom, after: upRansom, severity: "medium" };
+        if (removing && !feedComplete) {
+          d.review_only = true;
+          d.note = `Ransomware designation removal held for review: cached feed has only ${kevSet.size} entries (< ${KEV_FEED_MIN_PLAUSIBLE}), likely incomplete.`;
+        }
+        diffs.push(d);
+      }
+    }
   }
   return { status: "ok", diffs, errors: 0, summary: `${diffs.length} KEV diffs (from cache)` };
 }
@@ -1294,6 +1385,14 @@ function loadCtx(opts) {
     // Thread --force-stale through so readCachedJson can downgrade cache-
     // integrity refusals to warnings when an operator explicitly opts out.
     forceStale: !!(opts && opts.forceStale),
+    // `--drift-only` keeps a refresh to the entries the catalog already holds.
+    // Discovery and drift answer different questions — "what is upstream that
+    // we lack" against "what have we got that upstream has since changed" — and
+    // an operator correcting the second does not necessarily want the first,
+    // because a discovered entry arrives as a draft that has to be curated
+    // before it can ship. Bundling them forces a choice between leaving known
+    // fields stale and importing work that is not ready.
+    driftOnly: !!(opts && opts.driftOnly),
   };
   if (opts.fromFixture) {
     // `--from-fixture` injects frozen test payloads as if they were live