@blamejs/exceptd-skills 0.21.3 → 0.21.5

package/sbom.cdx.json

@@ -1,23 +1,23 @@
 {
   "bomFormat": "CycloneDX",
   "specVersion": "1.6",
-  "serialNumber": "urn:uuid:d900a446-1a09-4eba-abcb-ccd5fb708eea",
+  "serialNumber": "urn:uuid:99dafa74-a1f1-4f58-968c-6d582a69b82d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-24T00:00:00.000Z",
+    "timestamp": "2026-09-27T00:00:00.000Z",
     "tools": [
       {
         "vendor": "blamejs",
         "name": "scripts/refresh-sbom.js",
-        "version": "0.21.3"
+        "version": "0.21.5"
       }
     ],
     "component": {
-      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.21.3",
+      "bom-ref": "pkg:npm/@blamejs/exceptd-skills@0.21.5",
       "type": "application",
       "name": "@blamejs/exceptd-skills",
-      "version": "0.21.3",
-      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1752 CVEs / 241 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
+      "version": "0.21.5",
+      "description": "AI security skills grounded in mid-2026 threat reality, not stale framework documentation. 51 skills, 11 catalogs (1754 CVEs / 241 CWEs / 794 ATT&CK + ICS / 174 ATLAS / 468 D3FEND / 8889 RFCs), 35 jurisdictions, 10-class catalog gap detector + budget gate, real XML parser + canonical-form diff + content-pattern regression detection, Ed25519-signed.",
       "licenses": [
         {
           "license": {
@@ -25,17 +25,17 @@
           }
         }
       ],
-      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.21.3",
+      "purl": "pkg:npm/%40blamejs/exceptd-skills@0.21.5",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6910b1e8555ddcbc57d8c6f6760dc56a9fb2bdaa9ddf529ec000cfda6d14c483"
+          "content": "f85f2b74f092b1146f7e6a7c3b6093c0e1398279d0a8208f8e74329a25f0a6e6"
         }
       ],
       "externalReferences": [
         {
           "type": "distribution",
-          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.21.3"
+          "url": "https://www.npmjs.com/package/@blamejs/exceptd-skills/v/0.21.5"
         },
         {
           "type": "vcs",
@@ -124,11 +124,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "55a974fc0b2069d5bcc783ae68cb82ba8f98c1caed1038c77cd4d680df44a2e0"
+          "content": "8edeb11bc2c862aeb003abf349ce50a0d45427c1be5bad0f9c7660e57cafbb97"
         },
         {
           "alg": "SHA3-512",
-          "content": "d18d089ef59870fa9d7c27bf6678989a686ffead44c92dfbf87c04ad73fa411028fdc3d5d54cb9bbac7695230ca07abd3d2e03138ec61391b9841e31d4f501ab"
+          "content": "88e705b6a843f3baa45605ba9e7ee553f17068ea35d3e87fed625f3540abe066170bc70a09624f4916902c40bdd9e5e054a31f0e05e3171bf97f647eaada4dd4"
         }
       ]
     },
@@ -319,11 +319,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c2dcbd311fc5280b32e87e7705f5db5f1a5da7a97ac72bd33defa025b5d2c55a"
+          "content": "f004eadd708c9243aea6667e683451b29921b6cec45d1aec9bf63b4b49493b13"
         },
         {
           "alg": "SHA3-512",
-          "content": "88ecfc16990f314873c297432a637a9d40ce2c0d6d389986dfa3b4e351b900b01d4ffef9c4cd9ff6efdc426bcd56922c40449edc307bfd1cb7cd9c6fa24c1ef9"
+          "content": "a43b1206ad4f3aa01e48f3e5eba4ae3c91941134e1a6a11ff804c8d54e16f63f4f1d8d828de30cabe885d4985fe4b1362a9124f48b4449a7d70fddd5890bed97"
         }
       ]
     },
@@ -334,11 +334,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "387f78d2ba3b5961f9e7276ed06cc394f0df8edc8c32c427ac1fc46ce124b895"
+          "content": "deddba50e7f8d16528b04007715a1574211d058afc403d36c475ca8380e89eec"
         },
         {
           "alg": "SHA3-512",
-          "content": "670eb906f168babda9eba2bcde19a708b43b12b72449ddc1194fd31de80a3fb7dac9e96ab57dae52d1e5a25968f6356345b85ff25b8ee8644afcba7ea81b7f4b"
+          "content": "92d9204f0f55404b3f5b0489a7594aecfaf33dc5041341eaeec1857ab61876aec292d8b6eb22b57a2d8f17228934b2395260a9908b5aaf40d1de453ec98c7851"
         }
       ]
     },
@@ -349,11 +349,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b833d102be2a2485c7c275edcb8140813343fb289d7d9fd352c12ffb016e1bf2"
+          "content": "4a11ae07ebfb69c9f7321a51468d36335cfa42f7c049d24439e39ed99fda18d8"
         },
         {
           "alg": "SHA3-512",
-          "content": "743efba36fc8e7c77e09ad9a25050c09ad97f150560bb82c93ef8be73f38f552bb227c08fffede354cb9a463846b95cd6884fd6603072cf97b4c595ad8562adc"
+          "content": "58cf99e0daaf3db6679674469dfb1bdb66dc2dbd66d3608d9370399f5010290439bfd2d7eea4d5f0cc0cab8c649f99d61e92d6e831bb438d7eda273661f975b2"
         }
       ]
     },
@@ -409,11 +409,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "928fe789dab5f9fafcb2f9e7f82e72e5f0e6b94c9781a460338279fb7ff831ce"
+          "content": "8ddc65d007fd67c9f6ef3a9f818b09e8025af72d59532a4785bdba956dd01dfd"
         },
         {
           "alg": "SHA3-512",
-          "content": "a5dc55e21ee1468332c8fe4d8c1872a68bf49e2c69f49cb35caca1fe00087627a9ffdbc3a3c7ab004131e2f4e58ca04be64a7009edbe61c6093bbd754f3e8a95"
+          "content": "7fc815f99463ffab4d16d3647843cdbc66215c41ed91b75448519c9452e80844844c73ea7179c90d161e2ae8384356a755e872203ad8b68641dc108d2a778b61"
         }
       ]
     },
@@ -949,11 +949,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ac80c712f24408667da61433eff002922f3c056b8fb8d9927442814d9fe1c599"
+          "content": "a8fec7dd4cc7fd2b817d593c07e697b94f32628d9b197a4d7d3d9bafda7754a4"
         },
         {
           "alg": "SHA3-512",
-          "content": "e19db300f1571d2f573cea5744066b3165ae1f27d4a2cd5d933c52edf96d55b3955435bbdea6d50fac74c9b9979d3da1dc2df23c7d0ccf43798765bc45f51b81"
+          "content": "b7c0a41d1988dfdc7874986da7bd99335ef1a925abb7aa0c634ce6aa8504abe0255186cabb008d9cb065ff098ed4d467bea2b315482f9c466bd1f76076ced7d0"
         }
       ]
     },
@@ -1309,11 +1309,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "936688801e2bc02004db5a9324159c6aa32f23bd9bc75dfc285225172e6778fd"
+          "content": "45cb7d334468884ff84c74d9fe1e1c5091b6e1e414443769455d7276314c2e6a"
         },
         {
           "alg": "SHA3-512",
-          "content": "e252e1a0e15165be77f9070e337c2d8b2c9d6e11f05853cc09a982e2dc540f2deb3f57a0f82456c7a7be3d28938dec0f5b91b152d456d3a2d3d5bf5cebdd0d8d"
+          "content": "1f1df26ba3909cea83a5c29213a7031ca3c7649db2c16a50be316fb9d33508c11b351d05009f3911ebfccb06febda306b1dd998c14c1e5beb74bbcce75882fc0"
         }
       ]
     },
@@ -1459,11 +1459,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "785689a840e7eb4242f0b2956e33c42a2b84bc97c9670331c8b9a154bf0ca243"
+          "content": "0bce0c11c11549e8151465c9902deedad94e5c694b0e4deb79c2744d36ccf799"
         },
         {
           "alg": "SHA3-512",
-          "content": "932e68236b7aecd49aaf863b527f51cc89a7ae921123b3862725906714c4b5e6140d0f08025fd7cfa24ae160054f38abec0a771ebc6502d1f3fed37fcfe97f56"
+          "content": "a4b5395ae33d32c5c0a296a1ee0c9f60e708a77831b5ba2364aeb3932cb7c67593397b6130916bf1003c117e2e267f66a93e1c68d541e61083e7d8955c10c2b4"
         }
       ]
     },
@@ -1954,11 +1954,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "b57d31f96b49ed1cc418972797df9c088d418bde0f45ec9a77a2b3ac4c42f9eb"
+          "content": "02398f4bcc28238623b56128e7e517d6b33375360be62c7cf799b3896d1b5a93"
         },
         {
           "alg": "SHA3-512",
-          "content": "426314c22a3a793712668f6658b16cd4a95f3475fdd30e0debe84f3f521d2c25023297723414cc2f9882531e221c2b460d097666813b62936e8ae8940e01042d"
+          "content": "46aaab8c7783e42f02fabf5143b3a5534ef83e77a50455e8e30715a9b080b9f26618630f1ff79e272c56b91de0188c38fcc38094d32559e603aafd85fcc0a1e5"
         }
       ]
     },
@@ -2074,11 +2074,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d767b3e4bc9bbe3dce869f54d1d5f95123acd7a2b4a396ef59c19ea2356277c7"
+          "content": "a5d0c91f21d55c9da2140bc735108caf2f036a0a7314e3c2b38a60a7390dc6d7"
         },
         {
           "alg": "SHA3-512",
-          "content": "23e1d2410c7ec0deec40c9c52b73f6cb776ebcc779d9a665bc5ea39a170f8b16963ff1a4cc20974e75dc5f70c6ecdd508e18c14ff7d18bbf3eb78d0694d576e1"
+          "content": "e22e5a674211276bdb6ad47661b80ca4e080a35d6d96d1415149934b2db84cfecd5d4af53cab3341cfe82cf27c00a01b717566f48e0cf82b469301a8a128f112"
         }
       ]
     },
@@ -2089,11 +2089,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5040feece24bf4bfabf27fe3f25b9e5687d274576955d44ca9c07408a453f9c7"
+          "content": "15beed039cb1022e4dd040d0e26e7fb873d04124602f44af2168a0b19cb8fbb2"
         },
         {
           "alg": "SHA3-512",
-          "content": "a365f1e546e7a4ab56b95dd824aea4c9b7a84e89cfb3391733a91128571c2b26cffd8a53eb7a535379226c8ec608c9ab2137e52e912e54e2614178e9b814c9be"
+          "content": "e508f4ecaed05572be153a19f6f25d2bb29a2ae8370507a9dea0cd06e423844df041e299819d752b25ffd4bbdefff706900a3c7d72b6703c91dbbc6f65581b76"
         }
       ]
     },
@@ -2404,11 +2404,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7178ab91899c7bf5a93f8828e4dd9620f0011345283466159e8a17a19b3640af"
+          "content": "2ecbfdc338534054d1b2f51e43a5a0c7d78b62f01da4a854df5f8b8b560807fd"
         },
         {
           "alg": "SHA3-512",
-          "content": "872a5fafe89654f7d62ec7f2ca861bf98715aa9420d87859ac2cbc4809d41cd029e01ab1c05e9a4f47494e7c04e0fb0060ba4d560852f7892cafd2faf338a7b3"
+          "content": "7c8de0d6aac1bd6d6f92887145c3f0bff734e94a8bcdb04faa68a0197a988fb84ccf9e461a5e5b456765896cba532a9bb57c1a89cf62b877d50fcb4185642aef"
         }
       ]
     },
@@ -2824,11 +2824,11 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a2e80cf80692c5c0c2f26812d02332172094ef2a52ad5f1c2eac2ff4eeea8690"
+          "content": "b00dc7f39e23d5cb3a28a26562865d8cb5210c3ce757c68c1c52f78396dcf506"
         },
         {
           "alg": "SHA3-512",
-          "content": "58d2b7bd2c2be3f55d88d9c875bc02ee94be47e36c35940ad78fdd3aa7fcb7708fa01a0cf32462d67b51d3a0a5de51c7f2a02c035104b0f878af1b5e3c483e0f"
+          "content": "3db79e84a0b9299018cd8282d9d8c5988959c8cd64a2bfb96d358184ea930b22d6f02be61bdfb872173ff8f8536f6d1b4f249d342846342fc6922501fa106f69"
         }
       ]
     },

package/scripts/audit-catalog-gaps.js

@@ -249,19 +249,11 @@ function emitPretty(report) {
   return lines.join("\n");
 }
 
-// Names `--class` accepts; the extended ones are implemented in lib/gap-detectors.js.
-const VALID_CLASSES = new Set([
-  "missing-context", "dangling-ref", "draft-debt",
-  "content-quality", "temporal-staleness", "logical-consistency",
-  "cross-ref-completeness", "schema-evolution", "operator-action-sla",
-  "unused-orphan"
-]);
-const EXTENDED_CLASS_NAMES = new Set([
-  "content-quality", "temporal-staleness", "logical-consistency",
-  "cross-ref-completeness", "schema-evolution", "operator-action-sla",
-  "unused-orphan"
-]);
+// Names `--class` accepts; the extended ones are implemented in lib/gap-detectors.js
+// and taken from its DETECTOR_CLASSES.
 const EXTENDED_DETECTORS = require("../lib/gap-detectors.js");
+const EXTENDED_CLASS_NAMES = new Set(EXTENDED_DETECTORS.DETECTOR_CLASSES);
+const VALID_CLASSES = new Set(["missing-context", "dangling-ref", "draft-debt", ...EXTENDED_DETECTORS.DETECTOR_CLASSES]);
 
 function main() {
   const opts = parseArgs(process.argv);

package/scripts/check-catalog-gap-budget.js

@@ -60,7 +60,12 @@ const BUDGET = {
   "cross-ref-completeness": 5,
   "schema-evolution": 0,
   "operator-action-sla": 0,
-  "unused-orphan": 1400
+  "unused-orphan": 1400,
+  // Lesson and catalog texts that cite the curation input ("Packet: ...", "the
+  // packet names ...", "the packet's own ...") instead of stating the fact and
+  // its source. refresh --curate-batch refuses new ones; the budget comes down
+  // as existing texts are rewritten.
+  "pipeline-wording": 2159
 };
 
 function main() {

package/scripts/release.js

@@ -345,11 +345,14 @@ function cmdPush() {
   _run("git", ["push", "-u", "origin", branch]);
   _ok("pushed " + branch);
 
-  if (_openPrNumber(branch)) {
-    _ok("PR already open for " + branch + " (resume mode)");
+  var section = _changelogSection(next);
+  var title = _releaseSubject(next, section);
+  var existing = _openPrNumber(branch);
+  if (existing) {
+    // The PR title and body follow the current CHANGELOG section on every push.
+    _run("gh", ["pr", "edit", existing, "--title", title, "--body", section]);
+    _ok("PR #" + existing + " already open for " + branch + " (resume mode); title and body updated from CHANGELOG.md");
   } else {
-    var section = _changelogSection(next);
-    var title = _releaseSubject(next, section);
     _run("gh", ["pr", "create", "--base", "main", "--head", branch,
       "--title", title, "--body", section]);
     _ok("PR opened");
@@ -452,8 +455,13 @@ function cmdMerge() {
     throw new Error("release: refusing to merge PR #" + prNum + " — " +
       unresolved.length + " unresolved review thread(s); run watch again");
   }
+  // The squash commit takes its subject and body from the CHANGELOG section, not
+  // from the branch's commit messages.
+  var section = _changelogSection(next);
+  var subject = _releaseSubject(next, section) + " (#" + prNum + ")";
   // Solo-maintainer protection requires 0 approvals; --admin covers required checks.
-  _run("gh", ["pr", "merge", prNum, "--squash", "--admin", "--delete-branch"]);
+  _run("gh", ["pr", "merge", prNum, "--squash", "--admin", "--delete-branch",
+    "--subject", subject, "--body", section]);
   _ok("PR #" + prNum + " squash-merged");
 
   _run("git", ["checkout", "main"]);