@blamejs/exceptd-skills 0.21.7 → 0.21.9

package/lib/cve-batch.js

@@ -155,7 +155,7 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
     atlas: _loadIds(catalogRoot, 'atlas-ttps.json'),
     frameworkGaps: _loadIds(catalogRoot, 'framework-control-gaps.json'),
   };
-  const entries = {}; const lessons = {}; const orphans = []; const errors = [];
+  const entries = {}; const lessons = {}; const orphans = []; const errors = []; const warnings = [];
   for (const id of Object.keys(facts)) {
     const { entry, errors: e } = enrich.assembleEntry(facts[id], judgments[id] || {}, today);
     entry.id = id; // for orphan messages
@@ -175,11 +175,25 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
     }
   }
 
-  // New entries and lessons may not cite the curation input; the gap-detector
-  // budget covers only texts already in the catalog.
+  // A catalog field name cited after "packet" stops the batch. Other
+  // curation-input wording, and a stated KEV listing date that differs from the
+  // entry's, are matched by wording that network prose can also form, so they
+  // are warnings: the dry run lists them and the batch still applies.
+  const where = (f) => `${f.id}: ${f.catalog === 'cve-catalog' ? 'entry' : 'lesson'} ${f.field}`;
   for (const f of gaps.pipelineWordingFindings({ 'cve-catalog': entries, 'zeroday-lessons': lessons }, { includeDrafts: true })) {
-    errors.push(`${f.id}: ${f.catalog === 'cve-catalog' ? 'entry' : 'lesson'} ${f.field} cites the curation ` +
-      `input or a field name ("Packet: ...", "the packet names ..."); state the fact and its source instead.`);
+    if (f.field_citation) {
+      errors.push(`${where(f)} cites a catalog field of the curation input ("Packet fields for CVE-...", ` +
+        `"the packet's cisa_kev ..."); state the fact and its source instead.`);
+    } else {
+      warnings.push(`${where(f)} may cite the curation input ("Packet: ...", "the packet names ..."); ` +
+        `state the fact and its source instead unless the text is about a network packet.`);
+    }
+  }
+  // A date the text gives for this entry's own CVE id is a mismatch; any other
+  // attribution is a warning.
+  for (const f of gaps.kevListingDateFindings({ 'cve-catalog': entries, 'zeroday-lessons': lessons }, { entries })) {
+    if (f.definite) errors.push(`${where(f)} ${f.reason}.`);
+    else warnings.push(`${where(f)} ${f.reason}; check that the date belongs to this CVE.`);
   }
 
   // Reported as a validation error so the DRY RUN surfaces it; insertEntries
@@ -189,7 +203,7 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
     errors.push(`${id}: already present in the catalog — this batch adds entries and cannot replace one. Restore the catalog and apply once.`);
 
   const ok = orphans.length === 0 && errors.length === 0;
-  if (!apply || !ok) return { ok, entries, orphans, errors, written: false };
+  if (!apply || !ok) return { ok, entries, orphans, errors, warnings, written: false };
 
   // WRITE
   const catPath = path.join(catalogRoot, 'data', 'cve-catalog.json');
@@ -211,7 +225,7 @@ async function curateBatch({ factsPath, judgmentsPath, apply, catalogRoot, today
   for (const id of Object.keys(entries))
     fs.writeFileSync(path.join(catalogRoot, 'tests', `${id.toLowerCase()}.test.js`), renderTest(id));
 
-  return { ok: true, entries, orphans, errors, written: true };
+  return { ok: true, entries, orphans, errors, warnings, written: true };
 }
 
 async function cli(argv) {
@@ -247,7 +261,7 @@ async function cli(argv) {
     return;
   }
   process.stdout.write(JSON.stringify({ ok: r.ok, count: Object.keys(r.entries).length,
-    orphans: r.orphans, errors: r.errors, written: r.written }, null, 2) + '\n');
+    orphans: r.orphans, errors: r.errors, warnings: r.warnings, written: r.written }, null, 2) + '\n');
   if (!r.ok) process.exitCode = 1;
 }
 

package/lib/gap-detectors.js

@@ -36,11 +36,49 @@ const PIPELINE_WORDING = [
   /\bPacket fields?\s*(?::|for\s+(?:CVE-|this\b))/,
   /\bPacket vector\b/,
   /\bpacket(?:'s)? (?:attack_vector|live_patch_notes|cisa_kev|affected_versions|poc_description|patch_available|active_exploitation_notes|vendor_update_paths|cwe_refs|rwep_\w+)\b/i,
-  /\b[Tt]he packet (?:records|names|registers|supplies|lists|says|states|reports|marks|confirms|describes)\b/,
+  /\b[Tt]he packet (?:(?:also|actually|itself) )?(?:records|names|registers|supplies|lists|says|states|reports|marks|confirms|describes|notes)\b/,
+  // Verbs a curator used for the input bundle, each with the object that makes
+  // it curation wording rather than a statement about a network packet.
+  /\b[Tt]he packet (?:ties (?:this|the) (?:[\w/.-]+ ){0,4}(?:use-after-free|injection|overflow|flaw|defect|sink|weakness|bypass|CWE-\d+|affected|remediation|vulnerability)(?![\w-])|documents\b|locates the (?:flaw|defect|bug)|pairs that with|pairs an? (?:public (?:PoC|exploit)|pre-auth|(?:\d{4}(?:-\d{2}-\d{2})? )?(?:CVE|KEV))|attributes the (?:residual|exposure|flaw|defect)\b|establishes the (?:flaw|defect)|qualifies the (?:flaw|defect)|scores it (?:RWEP|CVSS)|dates the (?:vendor|fix|KEV)|conditions the (?:bypass|flaw|exploit|crash|trigger)\b|cites\b|pins this to|characterizes (?:the caller|the [\w -]{1,40}? as)|classifies this as|classes this CVE|labels this a|calls the (?:[\w-]+ ){0,3}(?:flaw|defect)|places (?:this|the (?:flaw|defect|bug|bypass|trigger|CVE)|execution)(?![\w-])|recording confirmed|naming a chain|chains that with|enumerates fixes|defines it:|has it wired|noting no live|measures:)/,
   /\b(?:per|according to) the packet\b/i,
+  /\bthe remediation the packet supports\b/i,
+  // A label that opens a text or sentence: "Packet records ...", "Packet attack
+  // vector: ...", "Packet NIST-800-53-SI-2 gap: ...", "Packet CVE-2025-0282 ...".
+  /(?:^|[.;!?]\s+)Packet (?:records (?:CWE-|CVE-|CVSS|an? CISA|cisa_|patch_|poc_|live_|active_|an? [\w -]{0,30}?(?:flaw|zero-day|write|read|overflow|injection|bypass|vulnerability|use-after-free)(?![\w-]))|names the affected|gives (?:patch|live|poc|cisa)_|gap (?:NIST|NIS2|AU-|UK-CAF|ISO-27001|DORA|EU-)|attack (?:vector|path)(?: as recorded)?:|affected(?::| field\b|\/)|name(?::| and vector\b)|description:|citing gaps\b|for CVE-|entry ['"‘“]|CVE-\d{4}-\d+|(?:NIST|NIS2|AU-|UK-CAF|ISO-27001|DORA|EU-|PCI-DSS|HIPAA|SOC2|CMMC|FedRAMP)[\w.-]* gap\b)/i,
+  /\bthe packet makes [\w -]{1,40}? the (?:precondition|condition|clock)\b/i,
+  /\bthe packet for CVE-\d/i,
+  /\bCWE-\d+ in the packet\b(?![\s-]*(?:headers?|captures?|payloads?|body|trailer|data|stream|buffer|fields?|options?|structure|pars\w*|process\w*|handl\w*|engine|path|type|flow|size|length|format|layer|queue|filter\w*|inspection|socket))/,
+  /\bCorroborating packet fields\b/i,
+  /\bthis packet (?:allows only|is one of the few|carries both halves)\b/i,
+  /\bpacket's (?:[\w-]+ )?note (?:records|says|states)\b/i,
+  /\bpacket's (?:structured record says|range runs from \d+\.\d+\.\d+|history supports|point is that|opening fact|update requires a reboot|access condition includes|second path is simply|mass exploitation|actual exploitation path)\b/i,
+  /\bpacket vector (?:states|records|says)\b/,
+  // "in the packet" is curation wording only when no part of a network packet,
+  // or the code that handles one (header, capture, payload, parser ...), follows it.
+  /\bcited in the packet\b(?![\s-]*(?:headers?|captures?|payloads?|body|trailer|data|stream|buffer|fields?|options?|structure|pars\w*|process\w*|handl\w*|engine|path|type|flow|size|length|format|layer|queue|filter\w*|inspection|socket))/i,
+  /\b(?:exploit|PoC|proof of concept|proof-of-concept) recorded in the packet\b(?![\s-]*(?:headers?|captures?|payloads?|body|trailer|data|stream|buffer|fields?|options?|structure|pars\w*|process\w*|handl\w*|engine|path|type|flow|size|length|format|layer|queue|filter\w*|inspection|socket))/i,
+  /\b(?:NVD|KEV|CISA|short) description(?: of CVE-\d{4}-\d+)? (?:carried )?in the packet\b(?![\s-]*(?:headers?|captures?|payloads?|body|trailer|data|stream|buffer|fields?|options?|structure|pars\w*|process\w*|handl\w*|engine|path|type|flow|size|length|format|layer|queue|filter\w*|inspection|socket))/i,
+  /\bfollows? the packet rather than\b/i,
+  /\b(?:a|the) claim the packet makes\b/i,
+  /\bwhat this packet establishes\b/i,
+  /\bthis packet makes it an? (?:authentication|enforcement|remediation|patch|priority|containment)[\w -]{0,30}?(?:point|item)\b/i,
+  /\bThis packet carries (?:two|three|several) facts\b/,
+  /\b(?:two|three|several) packet details\b/i,
+  /\bthe packet is (?:explicit|specific|silent|clear) (?:that|about)\b/i,
+  /\bwhat the packet does (?:not )?(?:establish|supply|say)\b/i,
+  /\bfact the packet does supply\b/i,
+  /\bthe packet has an? (?:(?:pre-authenticated|unauthenticated|authenticated|remote|local|low-privileged|privileged|adjacent),? ){0,4}attacker(?![\w-])/i,
+  /\bthe packet has the (?:flaw|defect)\b/i,
+  /\bthe packet requires (?:a user to open\b|a reboot after\b|the fixed build\b)/i,
+  /\b(?:reboot|restart) the packet requires\b/i,
+  /\bthe packet identifies (?:the (?:affected|vulnerable) (?:product|component|version)|the (?:product|flaw|defect) as)\b/i,
+  /\bthe packet identifies [\w.-]+\.exe\b/i,
+  /\bwhich the packet identifies as\b/i,
+  /\bthe packet sets (?:ai_|poc_|cisa_|patch_|live_|active_)/i,
   // A possessive followed by a curation noun, a catalog field identifier or a
   // framework key. Words a network packet can also own (path, delivery, length,
-  // boundary) are left out.
+  // boundary) appear only with the verbs a curator used with them.
+  /\bpacket's (?:path (?:ends in (?:OS |arbitrary |remote )?(?:command|code)|hands an? (?:unauthenticated|remote|local|attacker)|(?:needs|requires) no (?:credentials?|authentication|user|account|code)|starts from an? (?:local|remote|unauthenticated)|goes from unauthenticated|requires to reach)\b|delivery (?:path|step) is (?:mail|a victim|a target)\b|request (?:arrives|is) unauthenticated\b|only (?:other )?(?:stated|remediation)\b|(?:[\w-]+ ){0,2}access requirement\b|(?!flow|congestion)[\w-]*(?:protection|management|security|remediation|boundary|patch|hardening|monitoring|control)[\w-]* gap\b|trigger is an? (?:app|user|local)\b|end state is (?:an? attacker|arbitrary|remote (?:code|command)|code execution|command execution)\b)/i,
   /\bpacket's\s+(?:own|vector|stated|attack(?:\s+(?:vector|path))?|exploitation|remediation|live[- ]?patch|livepatch|chain|fix(?:ed)?|attacker|outcome|affected|flaw(?:-remediation)?|precondition|primitive|rwep|exploit|kev|gaps?|description|cit(?:ing|ed)|confirmed|defect|cwe\b|escalation|caf|recorded|requiredaction|product|essential(?:-eight)?|framing|cvss|reachability|timeline|chained|campaign|exposure|actor|interim|named|attribution|title|targeting|coverage|end-of-life|guidance|observed|recommended|threat|public-exploit|vendor|requirement|mitigation|documented|implant|lure|post-exploitation|patch-management|references?|notes?|framework|facts|advisory|versions?(?!\s+(?:field|number|byte|bits?)\b)|summary|deadline|(?:nist-800-53|uk-caf|au-essential-8|au-ism|iso-27001|nis2|dora|eu-ai-act|cwe-)[\w.-]*|(?:active_exploitation(?:_notes)?|affected_versions|ai_discovered|ai_discovery_\w+|attack_vector|cisa_kev\w*|cvss_\w+|cwe_refs|discovery_attribution_note|epss_\w+|framework_control_gaps|known_ransomware_use|live_patch_\w+|patch_available|patch_required_reboot|poc_available|poc_description|rwep_\w+|vendor_advisories|vendor_update_paths|verification_sources))\b/i,
 ];
 
@@ -49,6 +87,69 @@ function hasPipelineWording(str) {
   return PIPELINE_WORDING.some((re) => re.test(str));
 }
 
+// The subset no sentence about a network packet can form: a catalog field name
+// cited after "packet", or a "Packet fields" label naming a CVE.
+// refresh --curate-batch refuses a batch on these; the rest of PIPELINE_WORDING
+// is reported as a warning there and counted by the gap audit.
+// Every snake_case field name a CVE catalog entry uses or its schema declares.
+// tests/gap-detectors.test.js fails when either grows a name this list lacks.
+const CATALOG_FIELD_NAMES = new Set([
+  "_attack_refs_correction_note", "_auto_imported", "_curation_note", "_draft", "_editorial_note",
+  "_editorial_note_lightning", "_editorial_promoted", "_intake_method", "_kev_short_description",
+  "active_exploitation", "active_exploitation_notes", "actor_account_note", "additional_osv_ids",
+  "affected_versions", "ai_assist_weaponization_notes", "ai_assisted_notes", "ai_assisted_weaponization",
+  "ai_discovered", "ai_discovery_date", "ai_discovery_notes", "ai_discovery_source", "ai_factor",
+  "aliases_note", "as_of", "atlas_refs", "atlas_refs_note", "attack_class", "attack_refs", "attack_refs_note",
+  "attack_vector", "blast_radius", "cisa_kev", "cisa_kev_date", "cisa_kev_date_correction_note",
+  "cisa_kev_due_date", "cisa_kev_due_date_note", "cisa_kev_pending", "cisa_kev_pending_reason",
+  "complexity_notes", "curation_note", "cvss_correction_note", "cvss_note", "cvss_score",
+  "cvss_score_alternate", "cvss_score_note", "cvss_v4_score", "cvss_v4_vector", "cvss_vector",
+  "cvss_vector_alternate", "cwe_note", "cwe_refs", "cwe_refs_note", "discovery_attribution_note",
+  "epss_correction_note", "epss_date", "epss_note", "epss_percentile", "epss_score", "epss_source",
+  "framework_control_gaps", "intake_gap_note", "kev_scope_note", "known_ransomware_use", "last_updated",
+  "last_verified", "live_patch_available", "live_patch_notes", "live_patch_tools", "package_confidence",
+  "pairing_note", "patch_available", "patch_required_reboot", "poc_available", "poc_description",
+  "primary_id", "reboot_required", "related_threats", "related_threats_note", "remediation_note",
+  "remediation_status", "remediation_status_verified_at", "rwep_correction_note", "rwep_factors",
+  "rwep_notes", "rwep_rationale", "rwep_score", "source_verified", "status_source", "status_verified",
+  "subsystem_anchors", "vendor_advisories", "vendor_advisories_note", "vendor_update_paths",
+  "verification_sources",
+]);
+
+// A snake_case token right after "packet", "packet's", "packet:",
+// "Packet field(s):" or "Packet field(s) for CVE-X:". It is a field citation
+// only when it names a catalog field, so a plain word ("vector", "IP version")
+// or a network field ("src_ip") never counts.
+const PACKET_FIELD_TOKEN = /\bpacket(?:'s|’s|:| fields?(?: for (?:CVE-\d{4}-\d+|this CVE|this entry))?(?:\s*[:-]|\s+(?:include|includes|are|were|list|lists|show|shows)\b)?)?\s*(?:field(?:\s+named)?\s+)?(_[a-z][a-z0-9_]*|[a-z][a-z0-9]*(?:_[a-z0-9]+)+)\b/gi;
+
+// A label that introduces a list ("packet:", "Packet fields for this CVE:",
+// "Packet fields include ..."); every snake_case name in the list, up to the
+// end of the sentence, is checked. A period between digits ("cvss 9.8") and a
+// semicolon between fields do not end it.
+const PACKET_FIELD_LIST = /\bpacket(?: fields?(?: for (?:CVE-\d{4}-\d+|this CVE|this entry))?)?(?:\s*[:-]|\s+(?:include|includes|are|were|list|lists|show|shows)\b)/gi;
+const SNAKE_TOKEN = /(?:^|[^\w])(_[a-z][a-z0-9_]*|[a-z][a-z0-9]*(?:_[a-z0-9]+)+)\b/gi;
+
+function hasPipelineFieldCitation(str) {
+  if (typeof str !== "string" || str.length === 0) return false;
+  for (const m of str.matchAll(PACKET_FIELD_TOKEN)) if (CATALOG_FIELD_NAMES.has(m[1].toLowerCase())) return true;
+  for (const m of str.matchAll(PACKET_FIELD_LIST)) {
+    // The rest of the label's line, then any bulleted or indented lines that
+    // continue it ("Packet fields:\n- cisa_kev: true").
+    const [first, ...more] = str.slice(m.index + m[0].length).split("\n");
+    const lines = [first];
+    for (const line of more) {
+      if (!/^\s*(?:[-*•]|\d+[.)])\s+|^\s+\S/.test(line)) break;
+      lines.push(line);
+    }
+    for (const line of lines) {
+      // Drop a bullet or number marker ("1.") first, so its period does not end the list.
+      const list = line.replace(/^\s*(?:[-*•]|\d+[.)])\s+/, "").split(/\.(?!\d)|(?<!\d)\./)[0];
+      for (const t of list.matchAll(SNAKE_TOKEN)) if (CATALOG_FIELD_NAMES.has(t[1].toLowerCase())) return true;
+    }
+  }
+  return false;
+}
+
 // Every string under a value, with its dotted path.
 function _strings(value, pathSoFar, out) {
   if (typeof value === "string") out.push([pathSoFar, value]);
@@ -72,8 +173,8 @@ function pipelineWordingFindings(loaded, opts = {}) {
       const e = cat[id];
       if (!e || (e._auto_imported === true && !opts.includeDrafts)) continue;
       for (const [field, s] of _strings(e, "", [])) {
-        if (hasPipelineWording(s)) {
-          out.push({ class: "pipeline-wording", catalog, id, field,
+        if (hasPipelineWording(s) || hasPipelineFieldCitation(s)) {
+          out.push({ class: "pipeline-wording", catalog, id, field, field_citation: hasPipelineFieldCitation(s),
             reason: "text cites the curation input or a catalog field name instead of stating the fact and its source" });
         }
       }
@@ -82,6 +183,175 @@ function pipelineWordingFindings(loaded, opts = {}) {
   return out;
 }
 
+// Wording that states when CISA listed the flaw. Due dates ("KEV due date",
+// "due 2026-06-28") are a different date and do not match.
+const KEV_LISTING_DATE = [
+  /\bKEV[- ]listed (?:(?:it|(?:this|the) (?:CVE|flaw|vulnerability|bug|defect|issue)|CVE-\d{4}-\d+) )?(?:by CISA )?(?:on )?\(?(\d{4}-\d{2}-\d{2})/gi,
+  /\bKEV listing(?: date)?(?: for (?:CVE-\d{4}-\d+|this CVE|this flaw|this vulnerability))?(?:\s*:|\s+(?:is|was|of|on))?\s+\(?(\d{4}-\d{2}-\d{2})/gi,
+  /(\d{4}-\d{2}-\d{2}) KEV listing\b/gi,
+  // In the forms below the catalog may be owned ("CISA's", "CISA’s", "its",
+  // "the CISA", "the"), named "Known Exploited Vulnerabilities (KEV)", and
+  // followed by "catalog", "catalogue" or "list".
+  /\blisted (?:(?:it|(?:this|the) (?:CVE|flaw|vulnerability|bug|defect|issue)|CVE-\d{4}-\d+) )?(?:in|on|by) (?:(?:CISA['’]s|its|the(?: CISA)?|CISA) )?(?:KEV|Known Exploited Vulnerabilities(?: \(KEV\))?)(?: catalog(?:ue)?| list)?(?: by CISA)? (?:on )?(\d{4}-\d{2}-\d{2})/gi,
+  /\bKEV clock (?:that )?(?:opened|opens|started|starts|running from) (?:on )?(\d{4}-\d{2}-\d{2})/gi,
+  /\b(?:added|listed) (?:to|in) (?:(?:CISA['’]s|its|the(?: CISA)?|CISA) )?(?:KEV|Known Exploited Vulnerabilities(?: \(KEV\))?)(?: catalog(?:ue)?| list)?(?: by CISA)? (?:on )?(\d{4}-\d{2}-\d{2})/gi,
+  /\b(?:entered|joined|appeared in) (?:(?:CISA['’]s|its|the(?: CISA)?|CISA) )?(?:KEV|Known Exploited Vulnerabilities(?: \(KEV\))?)(?: catalog(?:ue)?| list)? on (\d{4}-\d{2}-\d{2})/gi,
+  // Transitive forms with a short object: "CISA added the vulnerability to KEV
+  // on ...", "put CVE-X on its KEV list on ...".
+  /\b(?:added|listed|put|placed) (?:[\w/,&-]+ ){0,5}(?:to|in|on) (?:(?:CISA['’]s|its|the(?: CISA)?|CISA) )?(?:KEV|Known Exploited Vulnerabilities(?: \(KEV\))?)(?: catalog(?:ue)?| list)?(?: by CISA)? on (\d{4}-\d{2}-\d{2})/gi,
+  /\bKEV (?:dateAdded|date)\s*[:=]?\s*(\d{4}-\d{2}-\d{2})/gi,
+];
+
+// Date-first wording: "On 2026-02-10, CISA added CVE-X to KEV". Group 1 is the
+// date and group 2 the verb's object, where the ids that own the date appear.
+const KEV_LISTING_DATE_FIRST = [
+  /\bOn (\d{4}-\d{2}-\d{2}),?\s+CISA (?:added|listed|put|placed) ((?:[\w/,&-]+ ){1,6}?)(?:to|in|on) (?:(?:CISA['’]s|its|the(?: CISA)?|CISA) )?(?:KEV|Known Exploited Vulnerabilities(?: \(KEV\))?)\b/gi,
+];
+
+// Who owns a date-first listing date, from the ids in the verb's object. It is
+// definite only when the object is nothing but ids ("CVE-X", "CVE-X and
+// CVE-Y"); any other word ("variants of CVE-X and CVE-Y") leaves it a warning.
+function _dateFirstOwner(object, id) {
+  const ids = [...object.matchAll(/CVE-\d{4}-\d+/gi)];
+  if (!ids.length) return { owner: "unsure" };
+  if (!ids.some((x) => x[0].toUpperCase() === id.toUpperCase())) return { owner: "other" };
+  return { owner: "own", definite: /^\s*(?:CVE-\d{4}-\d+\s*(?:,\s*(?:and\s+|or\s+)?|and\s+|or\s+|&\s*|\/\s*)?)+$/i.test(object) };
+}
+
+// Words that point a listing date back at the entry's own flaw. "the flaw" and
+// "the CVE" count, so a sibling's date is exempt only when the text names the
+// sibling without them ("CVE-2011-0611, a sibling, was KEV-listed ..."). A bare
+// pronoun ("it was") does not count, since its antecedent can be the sibling.
+const SELF_REFERENCE = /\b(?:this|the same|the) (?:flaw|CVE|vulnerability|bug|defect|entry|issue)\b/i;
+
+// Who the date at `at` in `s` belongs to, judged from the nearest CVE id before
+// it in the same sentence:
+//   "own"   that id, or any id joined to it by "and", "or", "/" or a comma
+//           ("CVE-X and CVE-Y were added ..."), is `id`;
+//   "other" another CVE's id, with nothing between it and the date referring
+//           back to this entry ("Unlike CVE-Y, this flaw was ..." is not other);
+//   "unsure" no id in the sentence, or a self-reference after another id.
+// Ids compare case-insensitively. `start` and `end` bound the joined ids.
+function _dateOwner(s, at, id) {
+  // A sentence ends at . ? ! (with any closing quote or bracket) before
+  // whitespace, or at a line break. A semicolon joins clauses of one sentence,
+  // so "The sibling is CVE-X; it was KEV-listed ..." keeps CVE-X in scope.
+  let start = 0;
+  for (const b of s.slice(0, at).matchAll(/[.?!]['"’”)\]]*\s+|\n/g)) start = b.index + b[0].length;
+  const before = s.slice(start, at);
+  const ids = [...before.matchAll(/CVE-\d{4}-\d+/gi)];
+  if (!ids.length) return { owner: "unsure" };
+  let first = ids.length - 1;
+  while (first > 0 && /^\s*(?:,\s*(?:and\s+|or\s+)?|and\s+|or\s+|&\s*|\/\s*)$/i.test(
+    before.slice(ids[first - 1].index + ids[first - 1][0].length, ids[first].index))) first--;
+  // A singular verb after the group ("CVE-X and CVE-Y, which was KEV-listed
+  // ...") binds to the nearest id alone; a plural verb or none keeps the group.
+  const tail = before.slice(ids[ids.length - 1].index + ids[ids.length - 1][0].length);
+  if (/\b(?:was|is|has been)\b/i.test(tail) && !/\b(?:were|are|have been)\b/i.test(tail)) first = ids.length - 1;
+  const run = ids.slice(first);
+  const last = run[run.length - 1];
+  const span = { start: start + run[0].index, end: start + last.index + last[0].length };
+  if (run.some((x) => x[0].toUpperCase() === id.toUpperCase())) return { owner: "own", ...span };
+  // A date is another CVE's, and skipped, only when this entry's own id is not
+  // named earlier in the sentence; otherwise the attribution is unsure and the
+  // finding stays a warning ("CVE-X, together with CVE-Y, were added ...").
+  if (ids.some((x) => x[0].toUpperCase() === id.toUpperCase())) return { owner: "unsure" };
+  return { owner: SELF_REFERENCE.test(before.slice(last.index + last[0].length)) ? "unsure" : "other" };
+}
+
+// Whether the listing phrase `m` explicitly assigns its date to the ids that
+// span `start`..`end`: they are its subject ("CVE-X was KEV-listed on ...",
+// "CVE-X, which was added to KEV on ...", "CVE-X's KEV listing date is ...")
+// or the object of its verb ("CISA added CVE-X to KEV on ..."), and not the
+// object of a preposition ("the predecessor of CVE-X"). The set is kept to
+// forms whose attribution is unambiguous; anything else stays a warning.
+function _assignsDateTo(s, m, start, end) {
+  // Topical form: the sentence opens with "For CVE-X," and a pronoun takes the
+  // listing ("For CVE-X, CISA added it to KEV on ...", "For CVE-X, it was
+  // KEV-listed on ...").
+  let sentence = 0;
+  for (const b of s.slice(0, start).matchAll(/[.?!]['"’”)\]]*\s+|\n/g)) sentence = b.index + b[0].length;
+  if (/^\s*(?:For|Regarding|As for)\s+$/i.test(s.slice(sentence, start))) {
+    const rest = s.slice(end, m.index);
+    return (/^\s*,\s*(?:CISA\s+)?$/.test(rest) && /^(?:added|listed|put|placed|KEV[- ]listed) it\b/i.test(m[0]))
+      || /^\s*,\s*it\s+(?:was|is|has been)\s+(?:first\s+)?$/i.test(rest)
+      || (/^\s*,\s*(?:the\s+|its\s+)?$/i.test(rest) && /^KEV (?:listing|dateAdded|date)\b/i.test(m[0]));
+  }
+  // The CVE a label names: "The KEV listing date for CVE-X is ...". Checked
+  // before the preposition guard, whose "for" it would otherwise trip.
+  if (start >= m.index && /^KEV listing(?: date)? for\b/i.test(m[0])) return true;
+  if (/\b(?:of|for|to|than|like|unlike|with|from|and|or|by|as|versus|vs\.?)\s*$/i.test(s.slice(Math.max(0, start - 12), start))) return false;
+  // The id inside the listing phrase as the object of its verb.
+  if (start >= m.index) return /^(?:added|listed|put|placed|KEV[- ]listed)\b/i.test(m[0]);
+  const between = s.slice(end, m.index);
+  if (/^\s*(?:\([^)]{0,80}\)\s*)?$/.test(between) && /^(?:entered|joined|appeared in)\b/i.test(m[0])) return true;
+  if (/^\s*(?:\([^)]{0,80}\)\s*)?,?\s*has an?\s+$/i.test(between) && /^KEV listing\b/i.test(m[0])) return true;
+  // A short appositive that names no other CVE: "CVE-X, the vulnerability, was
+  // KEV-listed on ...".
+  const appositive = between.match(/^\s*,\s*([^,]{1,60}),\s*(?:was|were|is|are|has been|have been|had been)\s+(?:first\s+)?$/i);
+  if (appositive && !/CVE-\d/i.test(appositive[1])) return true;
+  // A label: "CVE-X: KEV-listed ...", "CVE-X - KEV listing date ...".
+  if (/^\s*[:—–-]\s*$/.test(between) && /^(?:KEV[- ]listed|KEV listing|KEV (?:dateAdded|date)|added|listed)\b/i.test(m[0])) return true;
+  // An appositive id names the subject: "Foo (CVE-X) was KEV-listed on ...".
+  if (/\(\s*$/.test(s.slice(Math.max(0, start - 3), start))
+    && /^\s*\)\s*(?:was|were|is|are|has been|have been|had been)\s+(?:first\s+)?$/i.test(between)) return true;
+  return /^\s*(?:\([^)]{0,80}\)\s*)?,?\s*(?:itself\s+|themselves\s+)?(?:(?:which|that)\s+)?(?:was|were|is|are|has been|have been|had been)\s+(?:first\s+)?$/i.test(between) || /^['’]s\s+$/.test(between);
+}
+
+// One finding per catalog or lesson text that states a KEV listing date other
+// than the entry's cisa_kev_date. Such a text usually describes a different CVE.
+// A date that another CVE named earlier in the same sentence owns is skipped.
+// `definite` is true when the text explicitly assigns the date to the entry's
+// own CVE id (see _assignsDateTo). `entries` supplies cisa_kev_date for
+// lessons whose entry is not in loaded["cve-catalog"], as for a batch about to
+// be written.
+function kevListingDateFindings(loaded, opts = {}) {
+  const out = [];
+  const cve = { ...(loaded["cve-catalog"] || {}), ...(opts.entries || {}) };
+  for (const catalog of ["cve-catalog", "zeroday-lessons"]) {
+    const cat = loaded[catalog];
+    if (!cat) continue;
+    for (const id of Object.keys(cat)) {
+      if (id === "_meta") continue;
+      const listed = cve[id] && cve[id].cisa_kev_date;
+      if (typeof listed !== "string" || !listed) continue;
+      for (const [field, s] of _strings(cat[id], "", [])) {
+        // Two patterns can match the same stated date; it is one finding.
+        const seen = new Set();
+        for (const re of KEV_LISTING_DATE) {
+          for (const m of s.matchAll(re)) {
+            if (m[1] === listed) continue;
+            // The date's own position, so a CVE id inside the match ("added
+            // CVE-2011-0611 to its ... catalog on ...") precedes it.
+            const at = m.index + m[0].indexOf(m[1]);
+            if (seen.has(at)) continue;
+            seen.add(at);
+            const own = _dateOwner(s, at, id);
+            if (own.owner === "other") continue;
+            out.push({ class: "logical-consistency", catalog, id, field,
+              rule: "stated_kev_listing_date_matches_entry", definite: own.owner === "own" && _assignsDateTo(s, m, own.start, own.end),
+              reason: `text states a KEV listing date of ${m[1]}, but the entry's cisa_kev_date is ${listed}` });
+          }
+        }
+        for (const re of KEV_LISTING_DATE_FIRST) {
+          for (const m of s.matchAll(re)) {
+            if (m[1] === listed) continue;
+            const at = m.index + m[0].indexOf(m[1]);
+            if (seen.has(at)) continue;
+            seen.add(at);
+            const own = _dateFirstOwner(m[2], id);
+            if (own.owner === "other") continue;
+            out.push({ class: "logical-consistency", catalog, id, field,
+              rule: "stated_kev_listing_date_matches_entry", definite: own.owner === "own" && own.definite,
+              reason: `text states a KEV listing date of ${m[1]}, but the entry's cisa_kev_date is ${listed}` });
+          }
+        }
+      }
+    }
+  }
+  return out;
+}
+
 // Fields present but weak; what counts as weak is per catalog and field.
 function contentQualityFindings(loaded) {
   const out = [];
@@ -223,6 +493,7 @@ function logicalConsistencyFindings(loaded) {
         reason: "rwep_score declared but rwep_factors is empty — score is unjustified" });
     }
   }
+  out.push(...kevListingDateFindings(loaded));
   return out;
 }
 
@@ -481,8 +752,14 @@ const DETECTOR_CLASSES = [
 module.exports = {
   hasPlaceholderLanguage,
   hasPipelineWording,
+  hasPipelineFieldCitation,
   pipelineWordingFindings,
   PIPELINE_WORDING,
+  PACKET_FIELD_TOKEN,
+  CATALOG_FIELD_NAMES,
+  kevListingDateFindings,
+  KEV_LISTING_DATE,
+  KEV_LISTING_DATE_FIRST,
   daysSince,
   contentQualityFindings,
   temporalStalenessFindings,