@blamejs/exceptd-skills 0.21.8 → 0.21.9

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.21.9 — 2026-09-27
+
+159 more zero-day lesson texts that cited the curation input instead of a source now state the fact directly. The `pipeline-wording` class in the catalog gap audit now also recognizes labels such as "Packet records ...", "Packet attack vector: ..." and "Packet NIST-800-53-SI-2 gap: ...", and phrases such as "the packet places ...", "a public exploit recorded in the packet", "Priority follows the packet rather than ..." and "the packet's boundary-protection gap". The class reports 326 texts, and the predeploy budget gate now holds it at 326. Network wording such as "a device forwarding the packet", "the length supplied in the packet", "the protocol version named in the packet", "the options listed in the packet header" or "the packet's inter-frame gap" does not match.
+
+`exceptd refresh --curate-batch` now refuses a batch for curation-input wording only when a new entry or lesson cites a catalog field name after "packet", as in "Packet fields: cisa_kev true" or "the packet's live_patch_notes ...". Other curation-input wording, such as "Packet: ..." or "the packet names ...", is listed under a new `warnings` array in the output, and the batch still applies.
+
+63 reusable-control descriptions in the zero-day lessons carried another CVE's product, CWE, fixed build or KEV listing date. Each now describes the control in general terms or the entry's own flaw. They include the Apple JavaScriptCore text on seven Adobe Flash Player, Oracle Fusion Middleware, Microsoft Silverlight and Checkbox Survey entries, the nginx 1.30.1 sentence on 17 entries for other web software, the Android 2026-06-01 patch level on eight Samsung, Android, Linux kernel, Code Aurora and Arm Mali entries, a Windows Remote Desktop Services text on CVE-2022-22047 and CVE-2026-68820, and a FortiCloud SSO text on CVE-2018-13382. Six Adobe Acrobat and Reader entries no longer name CWE-1321 or say the fix requires a restart. Two lesson texts gave a KEV listing date a few days off CISA's: CISA listed CVE-2025-14174 on 2025-12-12 and CVE-2025-24201 on 2025-03-13.
+
+The Cisco advisory on CVE-2025-32433 is now recorded under vendor Cisco rather than Erlang.
+
+The catalog gap audit's `logical-consistency` class now reports a catalog or lesson text that states a KEV listing date other than the entry's `cisa_kev_date`, and `exceptd refresh --curate-batch` refuses a batch when a new entry or lesson assigns a different listing date to its own CVE id, as in "CVE-2025-0108 was KEV-listed on 2026-02-10" or "CISA added CVE-2025-0108 to KEV on 2026-02-10", and lists any other mismatch, such as "The predecessor of CVE-2025-0108 was KEV-listed on ...", under `warnings`. The check ignores case, so "kev-listed" counts. KEV due dates do not match, and neither does a date that belongs to another CVE named earlier in the same sentence, such as "CVE-2011-0611, a sibling, was KEV-listed 2022-06-09" on an entry for a different CVE. A sentence that also names the entry's own CVE, or refers back to its own flaw as in "Unlike CVE-2020-0002, this flaw was KEV-listed ...", is still checked.
+
 ## 0.21.8 — 2026-09-27
 
 1,998 zero-day lesson texts and 2 catalog fields no longer cite the curation input instead of a source, as in "Packet: ...", "Packet fields for CVE-...", "the packet's own ..." or a catalog field name such as `cisa_kev` or `live_patch_notes` quoted as evidence. Each text now states the fact directly, and names CISA's KEV entry or the vendor advisory where that is the source. The `pipeline-wording` class in the catalog gap audit falls from 2,159 texts to 159, and the predeploy budget gate now holds it at 159.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-27T22:56:11.649Z",
+  "generated_at": "2026-09-28T12:21:36.155Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "43a28aa0bf1a3d6cf1cab2b61d62f06fc24a81edead71e6bb9787dec5fb1fee4",
+    "manifest.json": "a2a3289098e463fff44f46a94ffd99fcaa322be1f17ad38d9a4466eb86eb03ff",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
-    "data/cve-catalog.json": "3a023a3d5c29b02cd23782936db8a2e863837f95dd715e0d3f4579cf088f298d",
+    "data/cve-catalog.json": "2139b98428f241d0aa6ebc2fc5f28db0dedb0ef0d01a86499b05367fb7785493",
     "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "4f472ef8b15d0634dc37f1c126429d601f3b537c875dbf1052b1623f54a6ce9f",
+    "data/zeroday-lessons.json": "0291b9e21e5af74b6b71aa2a60a4f61c4851768aca8bbc4a464f54530f9568dc",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",

package/data/cve-catalog.json

@@ -166887,7 +166887,7 @@
         "published_date": "2025-06-09"
       },
       {
-        "vendor": "Erlang",
+        "vendor": "Cisco",
         "advisory_id": null,
         "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy",
         "severity": "high",