@blamejs/exceptd-skills 0.9.1

package/scripts/builders/activity-feed.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * scripts/builders/activity-feed.js
+ *
+ * Builds `data/_indexes/activity-feed.json` — a "what changed when" feed
+ * across skills and catalogs, sorted by date. Lightweight RSS for the
+ * skill corpus that consumers can poll without diff-ing the manifest.
+ *
+ * Combines:
+ *   - per-skill last_threat_review
+ *   - per-catalog _meta.last_updated
+ *   - manifest threat_review_date + atlas_version_date when present
+ *
+ * Output sorted descending by date.
+ */
+
+const fs = require("fs");
+const path = require("path");
+
+function buildActivityFeed({ root, manifest, skills, catalogFiles }) {
+  const events = [];
+
+  for (const s of skills) {
+    if (s.last_threat_review) {
+      events.push({
+        date: s.last_threat_review,
+        type: "skill_review",
+        artifact: s.name,
+        path: s.path,
+        note: s.description || null,
+      });
+    }
+  }
+
+  for (const f of catalogFiles) {
+    const abs = path.join(root, f);
+    try {
+      const j = JSON.parse(fs.readFileSync(abs, "utf8"));
+      const meta = j._meta || {};
+      const when = meta.last_updated || meta.last_verified || null;
+      if (when) {
+        events.push({
+          date: when,
+          type: "catalog_update",
+          artifact: f,
+          path: f,
+          schema_version: meta.schema_version || null,
+          entry_count: Object.keys(j).filter((k) => !k.startsWith("_")).length,
+        });
+      }
+    } catch {
+      // skip non-JSON or malformed; build-indexes runs after lint so this
+      // is unlikely.
+    }
+  }
+
+  if (manifest.threat_review_date) {
+    events.push({
+      date: manifest.threat_review_date,
+      type: "manifest_review",
+      artifact: "manifest.json",
+      path: "manifest.json",
+      note: `manifest threat_review_date — ${manifest.skills.length} skills, ${catalogFiles.length} catalogs`,
+    });
+  }
+
+  events.sort((a, b) => (b.date || "").localeCompare(a.date || ""));
+
+  return {
+    _meta: {
+      schema_version: "1.0.0",
+      note: "Per-artifact 'last changed' feed sorted descending by date. Skill events from manifest.last_threat_review; catalog events from data/<catalog>.json _meta.last_updated.",
+      event_count: events.length,
+    },
+    events,
+  };
+}
+
+module.exports = { buildActivityFeed };

package/scripts/builders/catalog-summaries.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * scripts/builders/catalog-summaries.js
+ *
+ * Builds `data/_indexes/catalog-summaries.json` — for each data/<catalog>.json
+ * file, a compact summary: purpose, entry count, version pin (where applicable),
+ * source confidence, TLP, last-updated date. Consumers can load this single
+ * file (~3-4 KB) instead of every _meta block to learn what catalogs are
+ * available and how fresh they are.
+ *
+ * Curated human-readable purpose strings: keep these in lockstep with the
+ * canonical catalog README in `docs/data-catalogs.md` if/when added.
+ */
+
+const fs = require("fs");
+const path = require("path");
+
+const CATALOG_PURPOSES = {
+  "cve-catalog.json": "Per-CVE record (CVSS, EPSS, CISA KEV, RWEP, AI-discovery, vendor advisories, framework gaps, ATLAS/ATT&CK mappings). Cross-validated against NVD + CISA KEV + FIRST EPSS via validate-cves.",
+  "cwe-catalog.json": "MITRE CWE entries used by the project (subset with skill citations), with severity hint and category. Pinned to a CWE catalog version.",
+  "atlas-ttps.json": "MITRE ATLAS TTPs (AML.T0xxx) cited by skills, with tactic, name, description. Pinned to ATLAS v5.1.0 (November 2025).",
+  "d3fend-catalog.json": "MITRE D3FEND countermeasures (D3-xxx) keyed by id, with tactic + name. Pinned to D3FEND v1.0.0 release.",
+  "framework-control-gaps.json": "Per-control framework gap declarations: SI-2, A.8.8, PCI 6.3.3, etc. Each entry names the control, the lag, the evidence CVE, and remediation guidance.",
+  "global-frameworks.json": "Multi-jurisdiction framework registry: 34 jurisdictions × applicable frameworks × patch_sla / notification_sla / critical_controls / framework_gaps. Cross-cutting authority for jurisdiction-clocks index.",
+  "exploit-availability.json": "Per-CVE exploit availability: PoC public status, weaponization signal, AI-assist status, blast-radius. Project-curated (B2 Admiralty confidence) with source citations.",
+  "zeroday-lessons.json": "Distilled lessons from notable zero-days and campaigns (SesameOp, Copy Fail, Dirty Frag, Copilot RCE, Windsurf MCP). Each entry: technique, distinguishing characteristic, what it means for the framework lag.",
+  "rfc-references.json": "IETF RFCs + active Internet-Drafts cited by skills (TLS, IPsec, PQ crypto migration, HTTP/3, CT). Cross-validated against IETF Datatracker via validate-rfcs.",
+  "dlp-controls.json": "DLP control inventory: per-pattern definitions for the dlp-gap-analysis skill, jurisdiction-tagged so a deployment can scope by applicable laws.",
+};
+
+function buildCatalogSummaries({ root, catalogFiles }) {
+  const summaries = {};
+  for (const rel of catalogFiles) {
+    const base = path.basename(rel);
+    const abs = path.join(root, rel);
+    let parsed;
+    try {
+      parsed = JSON.parse(fs.readFileSync(abs, "utf8"));
+    } catch (err) {
+      summaries[base] = { error: `parse_error: ${err.message}` };
+      continue;
+    }
+    const meta = parsed._meta || {};
+    const entries = Object.keys(parsed).filter((k) => !k.startsWith("_"));
+    summaries[base] = {
+      path: rel,
+      purpose: CATALOG_PURPOSES[base] || null,
+      schema_version: meta.schema_version || null,
+      last_updated: meta.last_updated || meta.last_verified || null,
+      tlp: meta.tlp || null,
+      source_confidence_default: meta.source_confidence?.default || null,
+      freshness_policy: meta.freshness_policy || null,
+      entry_count: entries.length,
+      sample_keys: entries.slice(0, 5),
+    };
+  }
+  return {
+    _meta: {
+      schema_version: "1.0.0",
+      note: "Per-catalog compact summary so AI consumers can discover available data without loading every _meta block. Purpose strings are curated in scripts/builders/catalog-summaries.js.",
+      catalog_count: Object.keys(summaries).length,
+    },
+    catalogs: summaries,
+  };
+}
+
+module.exports = { buildCatalogSummaries };

package/scripts/builders/currency.js

@@ -0,0 +1,109 @@
+"use strict";
+/**
+ * scripts/builders/currency.js
+ *
+ * Builds `data/_indexes/currency.json` — pre-computed currency scores for
+ * every skill against a deterministic reference date (manifest's
+ * `threat_review_date`). Saves the watchlist/scheduler from re-running
+ * `orchestrator currency` to produce the same answer.
+ *
+ * The reference date is deterministic so the file hash stays stable until
+ * skills or the reference change — which is what `validate-indexes`
+ * requires. The orchestrator's interactive `currency` command remains the
+ * source-of-truth for live decay; this index is the snapshot view.
+ *
+ * Decay formula matches pipeline.js _currencyScore() exactly:
+ *   >180 days → -30, >90 → -20, >60 → -10, >30 → -5
+ *   -5 per forward_watch entry
+ */
+
+const fs = require("fs");
+const path = require("path");
+
+function currencyScore(daysSinceReview, forwardWatchCount) {
+  let score = 100;
+  if (daysSinceReview > 180) score -= 30;
+  else if (daysSinceReview > 90) score -= 20;
+  else if (daysSinceReview > 60) score -= 10;
+  else if (daysSinceReview > 30) score -= 5;
+  score -= forwardWatchCount * 5;
+  return Math.max(0, score);
+}
+
+function currencyLabel(score) {
+  if (score >= 90) return "current";
+  if (score >= 70) return "acceptable";
+  if (score >= 50) return "stale";
+  return "critical_stale";
+}
+
+function parseFrontmatterForwardWatchCount(body) {
+  const m = body.match(/^---\n([\s\S]*?)\n---/);
+  if (!m) return 0;
+  const fm = m[1];
+  // Counts top-level "forward_watch:" list items. Lines starting with "  - "
+  // immediately after a "forward_watch:" line until the next non-indented key.
+  const lines = fm.split(/\r?\n/);
+  let inFw = false;
+  let count = 0;
+  for (const line of lines) {
+    if (/^forward_watch:\s*$/.test(line)) {
+      inFw = true;
+      continue;
+    }
+    if (inFw) {
+      if (/^\s*-\s+/.test(line)) {
+        count++;
+      } else if (/^[a-zA-Z_]/.test(line)) {
+        // New top-level key — end of forward_watch block.
+        break;
+      }
+    }
+  }
+  return count;
+}
+
+function buildCurrency({ root, manifest, skills }) {
+  const ref = manifest.threat_review_date || "2026-05-01";
+  const refDate = new Date(ref + "T00:00:00Z");
+
+  const rows = [];
+  for (const s of skills) {
+    const body = fs.readFileSync(path.join(root, s.path), "utf8");
+    const fwCount = parseFrontmatterForwardWatchCount(body);
+    const reviewDate = new Date((s.last_threat_review || "2020-01-01") + "T00:00:00Z");
+    const days = Math.floor((refDate - reviewDate) / 86400000);
+    const score = currencyScore(days, fwCount);
+    rows.push({
+      skill: s.name,
+      last_threat_review: s.last_threat_review || null,
+      days_since_review: days,
+      currency_score: score,
+      currency_label: currencyLabel(score),
+      forward_watch_count: fwCount,
+      action_required: score < 70,
+    });
+  }
+  rows.sort((a, b) => a.currency_score - b.currency_score || a.skill.localeCompare(b.skill));
+
+  const summary = {
+    current: rows.filter((r) => r.currency_label === "current").length,
+    acceptable: rows.filter((r) => r.currency_label === "acceptable").length,
+    stale: rows.filter((r) => r.currency_label === "stale").length,
+    critical_stale: rows.filter((r) => r.currency_label === "critical_stale").length,
+    action_required: rows.filter((r) => r.action_required).length,
+  };
+
+  return {
+    _meta: {
+      schema_version: "1.0.0",
+      reference_date: ref,
+      note: "Pre-computed skill currency snapshot. Reference date is manifest.threat_review_date (deterministic). Re-runs of build-indexes against the same inputs produce byte-identical output. The orchestrator `currency` command produces a real-time view against today's date.",
+      decay_formula: "100 base; -30/-20/-10/-5 at 180/90/60/30-day thresholds; -5 per forward_watch entry. Label thresholds: ≥90 current, ≥70 acceptable, ≥50 stale, <50 critical_stale.",
+    },
+    summary,
+    skills: rows,
+  };
+}
+
+module.exports = { buildCurrency };

package/scripts/builders/cwe-chains.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * scripts/builders/cwe-chains.js
+ *
+ * Builds the CWE side of `data/_indexes/chains.json`. The existing chains
+ * object is keyed by CVE-id; this builder produces CWE-id entries with the
+ * same hydrated cross-walk shape so AI consumers can start from a CWE and
+ * see every skill / catalog dimension that touches the weakness class.
+ *
+ * Per-CWE shape:
+ *   {
+ *     name:                CWE catalog entry name
+ *     category:            CWE catalog category (memory-safety / injection / etc.)
+ *     referencing_skills:  every skill listing this CWE in cwe_refs
+ *     chain: {
+ *       atlas, attack_refs, framework_gaps, d3fend, rfc_refs, dlp_refs
+ *     }
+ *     related_cves:        CVEs in cve-catalog.json whose framework gaps
+ *                          surface via skills that also cite this CWE
+ *   }
+ *
+ * The CWE → CVE link is indirect — CWEs aren't currently stamped on each
+ * CVE entry directly. The skill bodies are the connective tissue. So we
+ * compute it the same way the CVE chains builder does: skills cite CWEs,
+ * skills cite framework_gaps, framework_gaps surface evidence_cves. The
+ * intersection through the skill graph gives the related-CVE set.
+ */
+
+function buildCweChains({ skills, cweCatalog, atlasTtps, cveCatalog, frameworkGaps, d3fendCatalog, rfcCatalog }) {
+  const cweIds = Object.keys(cweCatalog).filter((k) => !k.startsWith("_"));
+  const out = {};
+
+  for (const cweId of cweIds) {
+    const cweEntry = cweCatalog[cweId] || {};
+
+    const referencingSkills = skills
+      .filter((s) => (s.cwe_refs || []).includes(cweId))
+      .map((s) => s.name);
+
+    // Aggregate cross-refs from those skills.
+    const accum = {
+      atlas_refs: new Set(),
+      attack_refs: new Set(),
+      framework_gaps: new Set(),
+      d3fend_refs: new Set(),
+      rfc_refs: new Set(),
+      dlp_refs: new Set(),
+    };
+    for (const name of referencingSkills) {
+      const s = skills.find((x) => x.name === name);
+      if (!s) continue;
+      for (const field of Object.keys(accum)) {
+        for (const v of s[field] || []) accum[field].add(v);
+      }
+    }
+
+    // Hydrate the cross-walk dimensions for the AI consumer.
+    const hydrated = {
+      atlas: [...accum.atlas_refs].sort().map((a) => ({
+        id: a,
+        name: atlasTtps[a]?.name,
+        tactic: atlasTtps[a]?.tactic,
+      })),
+      attack_refs: [...accum.attack_refs].sort(),
+      framework_gaps: [...accum.framework_gaps].sort().map((f) => ({
+        id: f,
+        framework: frameworkGaps[f]?.framework,
+        control_name: frameworkGaps[f]?.control_name,
+      })),
+      d3fend: [...accum.d3fend_refs].sort().map((d) => ({
+        id: d,
+        name: d3fendCatalog[d]?.name,
+        tactic: d3fendCatalog[d]?.tactic,
+      })),
+      rfc_refs: [...accum.rfc_refs].sort().map((r) => ({
+        id: r,
+        title: rfcCatalog[r]?.title,
+        status: rfcCatalog[r]?.status,
+      })),
+    };
+
+    // Related CVEs: walk evidence_cves on the framework_gaps that the
+    // referencing skills cite. Inner join via the skill graph.
+    const relatedCves = new Set();
+    for (const gap of accum.framework_gaps) {
+      for (const ev of (frameworkGaps[gap]?.evidence_cves || [])) {
+        if (cveCatalog[ev]) relatedCves.add(ev);
+      }
+    }
+
+    out[cweId] = {
+      name: cweEntry.name,
+      category: cweEntry.category,
+      severity_hint: cweEntry.severity_hint,
+      referencing_skills: referencingSkills,
+      skill_count: referencingSkills.length,
+      chain: hydrated,
+      related_cves: [...relatedCves].sort(),
+    };
+  }
+
+  return out;
+}
+
+module.exports = { buildCweChains };

package/scripts/builders/did-ladders.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * scripts/builders/did-ladders.js
+ *
+ * Builds `data/_indexes/did-ladders.json` — canonical defense-in-depth
+ * ladders per high-frequency attack class. Each ladder is a layered
+ * sequence of controls (perimeter → identity → workload → data →
+ * detection) with a cross-reference to the source skill(s) that
+ * operationalize each layer and the D3FEND countermeasures backing each
+ * layer.
+ *
+ * Curated content, validated against the manifest: every referenced skill
+ * and D3FEND id must exist in their respective catalogs or the build
+ * fails. This is the only place where the project's DiD knowledge is
+ * laid out flat across attack classes.
+ */
+
+const LADDERS = [
+  {
+    id: "prompt-injection",
+    attack_class: "Prompt Injection (Direct + Indirect)",
+    primary_ttps: ["AML.T0051", "AML.T0054"],
+    layers: [
+      { layer: "Perimeter / Input", control: "Input source allowlist + retrieval provenance metadata", source_skill: "rag-pipeline-security", d3fend: ["D3-CA", "D3-CSPP"] },
+      { layer: "Model / Reasoning", control: "Prompt sanitization, instruction hierarchy enforcement, refusal calibration", source_skill: "ai-attack-surface", d3fend: ["D3-IOPR"] },
+      { layer: "Identity / Tool Auth", control: "Per-tool least-privilege scopes; user-confirmation gate for destructive tool calls", source_skill: "mcp-agent-trust", d3fend: ["D3-CBAN", "D3-MFA"] },
+      { layer: "Action / Egress", control: "Network egress allowlist for agentic outbound calls; DLP on tool outputs", source_skill: "ai-c2-detection", d3fend: ["D3-NTA", "D3-NTPM"] },
+      { layer: "Detection", control: "Behavioral anomaly on tool-call sequences; canary tokens in retrieved context", source_skill: "ai-c2-detection", d3fend: ["D3-RPA", "D3-NTA"] },
+    ],
+  },
+  {
+    id: "kernel-lpe",
+    attack_class: "Kernel Local Privilege Escalation",
+    primary_ttps: ["T1068", "T1548.001"],
+    layers: [
+      { layer: "Build / Kernel", control: "Up-to-date kernel + KASLR + control-flow integrity; live-patch capability deployed", source_skill: "kernel-lpe-triage", d3fend: ["D3-ASLR", "D3-EAL"] },
+      { layer: "Workload Isolation", control: "User namespaces with no_new_privs; seccomp profiles narrowing syscall surface", source_skill: "container-runtime-security", d3fend: ["D3-PSEP", "D3-SCP"] },
+      { layer: "Identity / Access", control: "No long-lived shell on production hosts; broker access via PAM/JIT", source_skill: "identity-assurance", d3fend: ["D3-MFA", "D3-CBAN"] },
+      { layer: "Detection", control: "Audit on uid=0 transitions; eBPF on suspicious capability acquisitions", source_skill: "ai-c2-detection", d3fend: ["D3-PHRA", "D3-PA"] },
+      { layer: "Patch Velocity", control: "≤72h to live-patch for CISA KEV LPE class; reboot-on-window for cold patch", source_skill: "kernel-lpe-triage", d3fend: ["D3-EAL"] },
+    ],
+  },
+  {
+    id: "ai-c2",
+    attack_class: "AI-API as C2 (PROMPTFLUX / SesameOp / AI egress abuse)",
+    primary_ttps: ["AML.T0096", "T1041"],
+    layers: [
+      { layer: "Perimeter / Egress", control: "Egress allowlist by destination + identity-aware proxy on AI API endpoints", source_skill: "ai-c2-detection", d3fend: ["D3-NTPM", "D3-NI"] },
+      { layer: "Identity", control: "Service-account per AI use-case; deny human creds on AI API destinations", source_skill: "identity-assurance", d3fend: ["D3-CBAN", "D3-MFA"] },
+      { layer: "Behavioral Detection", control: "Baseline AI-API call volume + content-length profile; alert on encoded blobs in prompts", source_skill: "ai-c2-detection", d3fend: ["D3-NTA", "D3-CSPP"] },
+      { layer: "Data", control: "DLP on prompt content to AI APIs (token-redaction + PII patterns)", source_skill: "dlp-gap-analysis", d3fend: ["D3-MENCR"] },
+      { layer: "IR", control: "Triage playbook for AI-as-C2 incidents; provider-side audit-log pull procedure", source_skill: "incident-response-playbook", d3fend: ["D3-IOPR"] },
+    ],
+  },
+  {
+    id: "ransomware",
+    attack_class: "Ransomware (Double-Extortion + OT Impact)",
+    primary_ttps: ["T1486", "T1567"],
+    layers: [
+      { layer: "Phishing Defense", control: "AI-generated phishing baseline; mailflow detonation + URL rewrite", source_skill: "email-security-anti-phishing", d3fend: ["D3-CA", "D3-DA"] },
+      { layer: "Identity / MFA", control: "MFA on every privileged path; deny legacy auth; conditional access by device posture", source_skill: "identity-assurance", d3fend: ["D3-MFA", "D3-CBAN"] },
+      { layer: "Lateral Movement Block", control: "Network segmentation by zone; deny SMB cross-segment; admin-tier isolation", source_skill: "incident-response-playbook", d3fend: ["D3-NI", "D3-NTPM"] },
+      { layer: "Data", control: "Immutable backups (3-2-1-1-0); offline restore-time tested quarterly", source_skill: "incident-response-playbook", d3fend: ["D3-FE"] },
+      { layer: "OT Impact", control: "OT/IT segmentation per IEC 62443 zones; manual-fallback procedures rehearsed", source_skill: "ot-ics-security", d3fend: ["D3-NI"] },
+      { layer: "Detection", control: "Behavioral on file-rename rates + canary files; T1486 ATT&CK detection", source_skill: "ai-c2-detection", d3fend: ["D3-FAPA", "D3-PHRA"] },
+    ],
+  },
+  {
+    id: "supply-chain",
+    attack_class: "Supply Chain Compromise (Build + Dependency + MCP)",
+    primary_ttps: ["AML.T0010", "T1195"],
+    layers: [
+      { layer: "Source", control: "Signed commits + branch-protection enforcement; trusted-builder allowlist", source_skill: "supply-chain-integrity", d3fend: ["D3-EHB", "D3-CBAN"] },
+      { layer: "Build", control: "Hermetic builds + SLSA Level 3+ provenance attestation", source_skill: "supply-chain-integrity", d3fend: ["D3-EHB"] },
+      { layer: "Dependency", control: "SBOM + signed attestation per dep; transitive-dep advisory loop", source_skill: "supply-chain-integrity", d3fend: ["D3-EHB", "D3-CA"] },
+      { layer: "MCP / Tooling", control: "MCP server allowlist on engineering workstations; signed plugin manifests", source_skill: "mcp-agent-trust", d3fend: ["D3-EAL", "D3-EHB"] },
+      { layer: "Runtime", control: "Workload identity attestation on deploy; deny-unsigned-image admission control", source_skill: "container-runtime-security", d3fend: ["D3-EHB", "D3-CBAN"] },
+      { layer: "Detection", control: "Anomalous build outputs; new outbound destinations from build hosts", source_skill: "ai-c2-detection", d3fend: ["D3-NTA"] },
+    ],
+  },
+  {
+    id: "bola",
+    attack_class: "Broken Object Level Authorization (BOLA / API auth bypass)",
+    primary_ttps: ["T1190"],
+    layers: [
+      { layer: "API Gateway", control: "Per-route policy with object-scoped authorization; reject opaque IDs without claim binding", source_skill: "api-security", d3fend: ["D3-CSPP"] },
+      { layer: "Service", control: "Authorization at the resource handler, never at the gateway alone", source_skill: "api-security", d3fend: ["D3-PA"] },
+      { layer: "Identity", control: "OAuth scopes + per-tenant claim with cryptographic binding to identity", source_skill: "identity-assurance", d3fend: ["D3-CBAN", "D3-MFA"] },
+      { layer: "Detection", control: "Per-user request-pattern baselining; alert on bulk-enumeration over /resource/:id", source_skill: "api-security", d3fend: ["D3-NTA", "D3-CSPP"] },
+      { layer: "Testing", control: "BOLA in pen-test scope, every release; fuzz IDOR primitives", source_skill: "fuzz-testing-strategy", d3fend: ["D3-PA"] },
+    ],
+  },
+  {
+    id: "model-exfiltration",
+    attack_class: "Model Weight / Training Data Exfiltration",
+    primary_ttps: ["AML.T0043", "AML.T0017"],
+    layers: [
+      { layer: "Storage", control: "Model weights in encrypted-at-rest object store; key access via KMS audit", source_skill: "mlops-security", d3fend: ["D3-FE", "D3-MENCR"] },
+      { layer: "Access Control", control: "ML-engineer workstations get read-only via signed checkouts; production weights gated", source_skill: "identity-assurance", d3fend: ["D3-CBAN", "D3-MFA"] },
+      { layer: "Egress", control: "DLP on weight-file size patterns + chunked upload to public buckets", source_skill: "dlp-gap-analysis", d3fend: ["D3-NTA", "D3-NTPM"] },
+      { layer: "Detection", control: "S3/GCS audit-log anomaly on model-bucket GET-rates; alert on cross-tenant key use", source_skill: "ai-c2-detection", d3fend: ["D3-FAPA", "D3-NTA"] },
+      { layer: "Provenance", control: "Watermarked model weights for high-value models", source_skill: "mlops-security", d3fend: ["D3-EAL"] },
+    ],
+  },
+  {
+    id: "bec",
+    attack_class: "Business Email Compromise (AI-generated)",
+    primary_ttps: ["T1566", "T1583.001"],
+    layers: [
+      { layer: "Email Gateway", control: "SPF + DKIM + DMARC enforcement at p=reject; impersonation-domain detection", source_skill: "email-security-anti-phishing", d3fend: ["D3-DA", "D3-CA"] },
+      { layer: "User Awareness", control: "AI-generated-content-aware training (grammar heuristics are dead)", source_skill: "email-security-anti-phishing", d3fend: ["D3-CSPP"] },
+      { layer: "Wire-Fraud Controls", control: "Out-of-band confirmation for any payment change; vendor-bank-change verification", source_skill: "sector-financial", d3fend: ["D3-CBAN"] },
+      { layer: "Detection", control: "Mailflow behavioral anomaly on first-time-correspondent + payment-context", source_skill: "email-security-anti-phishing", d3fend: ["D3-NTA", "D3-CSPP"] },
+      { layer: "Recovery", control: "BEC IR playbook with FBI IC3 reporting + bank-recall window (<72h)", source_skill: "incident-response-playbook", d3fend: ["D3-IOPR"] },
+    ],
+  },
+];
+
+function buildDidLadders({ skills, d3fendCatalog }) {
+  const skillNames = new Set(skills.map((s) => s.name));
+  const d3Ids = new Set(Object.keys(d3fendCatalog).filter((k) => !k.startsWith("_")));
+  const errors = [];
+  for (const ladder of LADDERS) {
+    for (const layer of ladder.layers) {
+      if (!skillNames.has(layer.source_skill)) {
+        errors.push(`ladder ${ladder.id} layer ${layer.layer}: unknown source_skill "${layer.source_skill}"`);
+      }
+      for (const d of layer.d3fend || []) {
+        if (!d3Ids.has(d)) {
+          errors.push(`ladder ${ladder.id} layer ${layer.layer}: unknown D3FEND ref "${d}"`);
+        }
+      }
+    }
+  }
+  if (errors.length) {
+    throw new Error("did-ladders.js: " + errors.join("; "));
+  }
+
+  return {
+    _meta: {
+      schema_version: "1.0.0",
+      note: "Canonical defense-in-depth ladder per high-frequency attack class. Each layer references the source skill that operationalizes it and the D3FEND countermeasures backing it.",
+      ladder_count: LADDERS.length,
+    },
+    ladders: LADDERS,
+  };
+}
+
+module.exports = { buildDidLadders };

package/scripts/builders/frequency.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * scripts/builders/frequency.js
+ *
+ * Builds `data/_indexes/frequency.json` — citation-count tables. For each
+ * catalog (CWE, ATLAS, ATT&CK, D3FEND, framework gaps, RFC, DLP), counts
+ * how many skills cite each entry. Surfaces which entries are load-bearing
+ * (cited by many) vs. orphan-adjacent (cited by ≤1).
+ *
+ * Per-field shape:
+ *   {
+ *     <entry_id>: { count, skills: [name, ...] }
+ *   }
+ *
+ * Plus rollups:
+ *   - top_cited: top 10 entries per field
+ *   - orphan_adjacent: entries cited by exactly one skill
+ *   - uncited: catalog entries with zero skill citations (flagged for review)
+ */
+
+function buildFrequency({ skills, catalogs }) {
+  const fields = ["cwe_refs", "d3fend_refs", "framework_gaps", "atlas_refs", "attack_refs", "rfc_refs", "dlp_refs"];
+  const counts = {};
+  for (const f of fields) counts[f] = {};
+
+  for (const s of skills) {
+    for (const f of fields) {
+      for (const v of s[f] || []) {
+        if (!counts[f][v]) counts[f][v] = { count: 0, skills: [] };
+        counts[f][v].count++;
+        counts[f][v].skills.push(s.name);
+      }
+    }
+  }
+  for (const f of fields) {
+    for (const k of Object.keys(counts[f])) counts[f][k].skills.sort();
+  }
+
+  function topN(field, n = 10) {
+    return Object.entries(counts[field])
+      .sort((a, b) => b[1].count - a[1].count || a[0].localeCompare(b[0]))
+      .slice(0, n)
+      .map(([id, info]) => ({ id, count: info.count, skills: info.skills }));
+  }
+
+  const orphanAdjacent = {};
+  for (const f of fields) {
+    orphanAdjacent[f] = Object.entries(counts[f])
+      .filter(([, info]) => info.count === 1)
+      .map(([id]) => id)
+      .sort();
+  }
+
+  // Uncited: catalog has an entry but zero skill cites it.
+  const uncited = {};
+  const catalogFieldMap = {
+    cwe_refs: catalogs.cwe,
+    atlas_refs: catalogs.atlas,
+    d3fend_refs: catalogs.d3fend,
+    framework_gaps: catalogs.frameworkGaps,
+    rfc_refs: catalogs.rfc,
+    dlp_refs: catalogs.dlp,
+  };
+  for (const [field, cat] of Object.entries(catalogFieldMap)) {
+    if (!cat) continue;
+    const inCatalog = Object.keys(cat).filter((k) => !k.startsWith("_"));
+    uncited[field] = inCatalog.filter((id) => !counts[field][id]).sort();
+  }
+
+  // attack_refs has no catalog file (uses MITRE upstream directly), so no
+  // uncited table for it — only counts.
+
+  const topCited = {};
+  for (const f of fields) topCited[f] = topN(f);
+
+  return {
+    _meta: {
+      schema_version: "1.0.0",
+      note: "Citation-count tables per catalog field. top_cited surfaces load-bearing entries; orphan_adjacent identifies entries cited by exactly one skill; uncited identifies catalog entries with zero skill references (review whether they should be culled or whether a skill should pick them up).",
+      fields_indexed: fields,
+    },
+    counts,
+    top_cited: topCited,
+    orphan_adjacent: orphanAdjacent,
+    uncited,
+  };
+}
+
+module.exports = { buildFrequency };