@blamejs/exceptd-skills 0.21.9 → 0.21.11

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.21.11 — 2026-09-28
+
+446 zero-day lesson texts and 7 catalog fields on 341 CVEs no longer cite the curation input. Evidence and control texts that read "Packet records cisa_kev true with kev_date 2025-10-02, poc_available true" or "the packet places the defect in ..." now state each fact in a sentence and name its source where there is one: CISA's KEV entry, the vendor advisory, or a framework gap recorded for the entry. Every quotation attributed to CISA's KEV entry matches the KEV record. The catalog gap audit's `pipeline-wording` class now reports no texts, and the predeploy budget gate holds it at 0.
+
+The discovery note on CVE-2017-17562 said the KEV entry lists no vendor. The KEV entry names Embedthis as the vendor and links no vendor advisory, and the note now says so.
+
+`scripts/audit-catalog-gaps.js` now lists every extended class it covers under `totals.extended` and `extended_findings`, with a count of 0 for a class that has no findings. It used to leave such a class out, so `--class pipeline-wording` returned no count at all once the class reached 0.
+
+## 0.21.10 — 2026-09-28
+
+626 catalog and zero-day lesson texts on 240 CVEs no longer say that CISA's KEV required action calls for a restart or reboot. CISA's required action for these CVEs says to apply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product. Every one of these entries records `patch_required_reboot: true`, so each text keeps the restart and drops only the attribution: "the vendor patch typically requires a service restart or system reboot per the KEV requiredAction" now ends at "system reboot". 239 of the texts are `live_patch_notes` fields in the catalog.
+
+The catalog gap audit's `logical-consistency` class now reports a text that credits a restart or reboot to the KEV required action, and `exceptd refresh --curate-batch` refuses to apply a batch whose new entry or lesson uses the form these texts shared, "requires a service restart or system reboot per the KEV requiredAction", and lists any other phrasing the check matches under `warnings`. An accurate reference to the required action, such as "apply mitigations per the KEV requiredAction", does not match, and neither does a negated restart, such as "no service restart or system reboot is required per the KEV requiredAction".
+
 ## 0.21.9 — 2026-09-27
 
 159 more zero-day lesson texts that cited the curation input instead of a source now state the fact directly. The `pipeline-wording` class in the catalog gap audit now also recognizes labels such as "Packet records ...", "Packet attack vector: ..." and "Packet NIST-800-53-SI-2 gap: ...", and phrases such as "the packet places ...", "a public exploit recorded in the packet", "Priority follows the packet rather than ..." and "the packet's boundary-protection gap". The class reports 326 texts, and the predeploy budget gate now holds it at 326. Network wording such as "a device forwarding the packet", "the length supplied in the packet", "the protocol version named in the packet", "the options listed in the packet header" or "the packet's inter-frame gap" does not match.

package/data/_indexes/_meta.json

@@ -1,14 +1,14 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-09-28T12:21:36.155Z",
+  "generated_at": "2026-09-28T21:45:53.908Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "a2a3289098e463fff44f46a94ffd99fcaa322be1f17ad38d9a4466eb86eb03ff",
+    "manifest.json": "4458e5bbea371c93b1bd8b496097a9bd5cd9c99b3ac62d99b056e53e7ced9ebc",
     "README.md": "864570c1f7fb221b0176d22d3b0823a8d077d6a7209edc6045b426b1e9ec555d",
     "data/atlas-ttps.json": "c36c0a27c8de8a37a7070923d7b187345c46db9db778f58e4637f1f81ca6d6b1",
     "data/attack-techniques.json": "9857a11bd035c8638e61b200cdabea0cc43f0115b239e4941a19682076a1cfd3",
-    "data/cve-catalog.json": "2139b98428f241d0aa6ebc2fc5f28db0dedb0ef0d01a86499b05367fb7785493",
+    "data/cve-catalog.json": "d225c9429a16992716ad62db3779cede31ed776bd9319c4f3a8d28269d09732c",
     "data/cwe-catalog.json": "2116d47911a3e50b46495b51a31b12d0aede23233a62ef1362cb72810680b57c",
     "data/d3fend-catalog.json": "feec37e4b0a40cd7bc14616b50e7b9bcdb58a92d8e9326f9e2e632896d8ea576",
     "data/dlp-controls.json": "791f6a46b19b0c0fa2f46630ac8b398afb7ec9c2f2019056828c8820fe255f19",
@@ -16,7 +16,7 @@
     "data/framework-control-gaps.json": "79e40362b0a71582a88dd2f4af70715218cef45fb9d3e1c00955bda642dda089",
     "data/global-frameworks.json": "86249047c50d2584b4854eb381ba53c309c0e6e29d4cb0e522b4ba1405481de6",
     "data/rfc-references.json": "6e9017eca910ab7e4bee85ad7c23927fd6ec766f34be7fce49ebf020cec3381a",
-    "data/zeroday-lessons.json": "0291b9e21e5af74b6b71aa2a60a4f61c4851768aca8bbc4a464f54530f9568dc",
+    "data/zeroday-lessons.json": "ac5ffd458028b3aef7140f99e00f4cefe749c4b19101f396c98ac6409874ed1b",
     "skills/kernel-lpe-triage/skill.md": "78a547771c42b9348a1f80201e0f1b8a5ed3e7b4f15b35b1f64cf4ee54b0480b",
     "skills/ai-attack-surface/skill.md": "bc9084127e4e928cba439187025f9e77aaca8089fe64891312824e74dd9fdb5b",
     "skills/mcp-agent-trust/skill.md": "c20bda4c1267b16db4f713667216d93e0ab4b98c0fb244024749dcfb32d709cf",

package/data/_indexes/activity-feed.json

@@ -6,7 +6,7 @@
   },
   "events": [
     {
-      "date": "2026-09-27",
+      "date": "2026-09-28",
       "type": "catalog_update",
       "artifact": "data/cve-catalog.json",
       "path": "data/cve-catalog.json",
@@ -14,7 +14,7 @@
       "entry_count": 1758
     },
     {
-      "date": "2026-09-27",
+      "date": "2026-09-28",
       "type": "catalog_update",
       "artifact": "data/zeroday-lessons.json",
       "path": "data/zeroday-lessons.json",

package/data/_indexes/catalog-summaries.json

@@ -53,7 +53,7 @@
       "path": "data/cve-catalog.json",
       "purpose": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
       "schema_version": "1.0.0",
-      "last_updated": "2026-09-27",
+      "last_updated": "2026-09-28",
       "tlp": "CLEAR",
       "source_confidence_default": "A1",
       "freshness_policy": {
@@ -229,7 +229,7 @@
       "path": "data/zeroday-lessons.json",
       "purpose": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
       "schema_version": "1.1.0",
-      "last_updated": "2026-09-27",
+      "last_updated": "2026-09-28",
       "tlp": "CLEAR",
       "source_confidence_default": "B2",
       "freshness_policy": {