@blamejs/exceptd-skills 0.9.3 → 0.9.5

package/CHANGELOG.md

@@ -1,5 +1,76 @@
 # Changelog
 
+## 0.9.5 — 2026-05-12
+
+**Pin: six operator-reported bug fixes from real CLI use.**
+
+### Bug 1 — Currency formula penalized `forward_watch` entries
+
+`pipeline.js` and `scripts/builders/currency.js` subtracted 5 points per `forward_watch` item, so a skill that diligently tracked 14 upcoming threats scored **30%** the day after a review. Perverse incentive: punished skills doing the right thing. **Fix**: `forward_watch` no longer affects the score — currency is now a pure function of age-since-last_threat_review. `cloud-security` jumped from 30% → 100%; `sector-financial` from 40% → 100%; etc. The decay-formula docstring documents the change.
+
+### Bug 2 — `exceptd report executive` mixed currency thresholds in messaging
+
+Earlier output mixed `< 70%` ("skills need review") with `< 50%` ("require immediate update") in the same block, which read inconsistently. **Fix**: report now splits into two named tiers with the threshold inline:
+- *Critical-stale* (`< 50%`, `> 90` days)
+- *Stale* (`50-69%`, `30-90` days)
+
+### Bug 3 — PQC scanner stopped at "verify ML-KEM/ML-DSA"
+
+The scanner detected OpenSSL 3.5+ as "PQC-capable" but never actually probed for the algorithms. **Fix**: new `probePqcAlgorithms()` queries the runtime via three channels (Node `crypto.kemEncapsulate`/`getCurves`/`getHashes`/`getCiphers`, `openssl list -kem-algorithms`, `openssl list -signature-algorithms`) and returns boolean availability flags. Probes **22 algorithm flags** across the full emerging PQC landscape:
+
+| Tier | Algorithms |
+|---|---|
+| **NIST finalized (FIPS 203/204/205)** | ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (SPHINCS+) |
+| **NIST draft / alternate** | FN-DSA (Falcon, FIPS 206 draft), HQC (alternate KEM, March 2025) |
+| **NIST Round-4 / niche** | FrodoKEM, NTRU / NTRU-Prime, Classic McEliece, BIKE |
+| **NIST signature on-ramp (Round 2, 2024+)** | HAWK, MAYO, SQIsign, CROSS, UOV/SNOVA, SDitH, MIRATH, FAEST, PERK |
+| **Stateful hash sigs** | LMS (RFC 8554), XMSS (RFC 8391), HSS |
+| **IETF composite / hybrid** | composite signatures (RSA+ML-DSA, ECDSA+ML-DSA, etc.), composite KEMs (X25519+ML-KEM) |
+
+The scanner finding now surfaces per-algo `provider_hint` so an operator can tell whether availability came from Node's runtime, the OpenSSL provider, or OQS.
+
+### Bug 4 — Dispatcher hid CVE IDs behind aggregate counts
+
+`dispatch` previously said *"1 CISA KEV CVE with RWEP ≥ 90"* without naming the CVE. **Fix**: dispatcher threads the per-finding `items[]` array into each plan entry as an `evidence` block. The print path renders each CVE explicitly:
+```
+[CRITICAL] compliance-theater
+  Triggered by: cisa_kev_high_rwep (framework)
+  Action: 1 CISA KEV CVEs with RWEP >= 90...
+  Evidence:
+    - CVE-2026-31431 · "Copy Fail" · RWEP 90
+```
+
+### Bug 5 — `exceptd verify` succeeded without disclosing key fingerprint
+
+A swapped `keys/public.pem` would still produce *"38/38 passed"* — operators had no way to detect key substitution from the exit code alone. **Fix**: verify now prints **both SHA-256 and SHA3-512** fingerprints of the public key:
+
+```
+[verify] Public key: keys/public.pem
+[verify] SHA256:jD19nBPExofyiO60loNQgx5ONUbrwxG8XZM8Hh7pV+w=
+[verify] SHA3-512:okdinIchi8kMtlhOyYmDquwaRw2TSpJFe9MjfGpGI+7mE5dwPy5ZUVG4Hx1PB9KJkInLAzemhE1gsmhjZ0USww==
+```
+
+SHA-256 matches `ssh-keygen -lf` / GPG / npm-provenance / Sigstore conventions; SHA3-512 hedges against SHA-2 family weaknesses with the same Keccak family ML-KEM/ML-DSA use internally. Operators pin one (or both) out-of-band.
+
+### Bug 6 — `framework-gap-analysis` had no programmatic CLI runner
+
+Earlier `exceptd dispatch` would say *"run framework-gap-analysis"* but the only thing the CLI could actually do was `exceptd skill framework-gap-analysis` to dump the body. **Fix**: new `exceptd framework-gap <FRAMEWORK_ID|all> <SCENARIO|CVE-ID> [--json]` subcommand executes the analytical path in `lib/framework-gap.js`. Produces structured human or JSON output covering matching gaps, universal gaps, theater-risk controls per framework.
+
+Examples:
+```bash
+exceptd framework-gap NIST-800-53 CVE-2026-31431
+exceptd framework-gap PCI-DSS-4.0 "prompt injection"
+exceptd framework-gap all CVE-2025-53773 --json
+```
+
+13/13 predeploy gates green; 201 tests pass.
+
+## 0.9.4 — 2026-05-12
+
+**Pin: drop upper bound on Node engine requirement.**
+
+`package.json` `engines.node` goes from `>=24.0.0 <25.0.0` to `>=24.0.0`. The strict upper bound emitted `EBADENGINE` warnings on Node 25+ installs even though the code works fine — the project uses only Node stdlib APIs that have been stable since Node 18.
+
 ## 0.9.3 — 2026-05-12
 
 **Pin: expand RFC auto-discovery seed list for broader project coverage.**

package/bin/exceptd.js

@@ -68,11 +68,14 @@ const COMMANDS = {
   "validate-cves": () => path.join(PKG_ROOT, "orchestrator", "index.js"),
   "validate-rfcs": () => path.join(PKG_ROOT, "orchestrator", "index.js"),
   watchlist:       () => path.join(PKG_ROOT, "orchestrator", "index.js"),
+  "framework-gap": () => path.join(PKG_ROOT, "orchestrator", "index.js"),
+  "framework-gap-analysis": () => path.join(PKG_ROOT, "orchestrator", "index.js"),
 };
 
 const ORCHESTRATOR_PASSTHROUGH = new Set([
   "scan", "dispatch", "skill", "currency", "report",
   "validate-cves", "validate-rfcs", "watchlist",
+  "framework-gap", "framework-gap-analysis",
 ]);
 
 function readPkgVersion() {

package/data/_indexes/_meta.json

@@ -1,10 +1,10 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-05-12T03:23:50.446Z",
+  "generated_at": "2026-05-12T03:51:54.072Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 49,
   "source_hashes": {
-    "manifest.json": "e6ec5fe1c8c3675101f14ec1ecc57c51d723cee2e0496a1020e80c82895abbcf",
+    "manifest.json": "ea6d754eb8909f05a931cd895cc10655842e212a3508a066c811650c58990db4",
     "data/atlas-ttps.json": "1500b5830dab070c4252496964a8c0948e1052a656e2c7c6e1efaf0350645e13",
     "data/cve-catalog.json": "a81d3e4b491b27ccc084596b063a6108ff10c9eb01d7776922fc393980b534fe",
     "data/cwe-catalog.json": "c3367d469b4b3d31e4c56397dd7a8305a0be338ecd85afa27804c0c9ce12157b",
@@ -78,7 +78,7 @@
     "jurisdiction_clocks": 29,
     "did_ladders": 8,
     "theater_fingerprints": 7,
-    "currency_action_required": 8,
+    "currency_action_required": 0,
     "frequency_fields": 7,
     "activity_feed_events": 49,
     "catalog_summaries": 10,

package/data/_indexes/currency.json

@@ -3,189 +3,189 @@
     "schema_version": "1.0.0",
     "reference_date": "2026-05-01",
     "note": "Pre-computed skill currency snapshot. Reference date is manifest.threat_review_date (deterministic). Re-runs of build-indexes against the same inputs produce byte-identical output. The orchestrator `currency` command produces a real-time view against today's date.",
-    "decay_formula": "100 base; -30/-20/-10/-5 at 180/90/60/30-day thresholds; -5 per forward_watch entry. Label thresholds: ≥90 current, ≥70 acceptable, ≥50 stale, <50 critical_stale."
+    "decay_formula": "100 base; -30/-20/-10/-5 at 180/90/60/30-day thresholds. forward_watch count does NOT affect the score (it's a maintenance signal, not a staleness one). Label thresholds: ≥90 current, ≥70 acceptable, ≥50 stale, <50 critical_stale."
   },
   "summary": {
-    "current": 19,
-    "acceptable": 11,
-    "stale": 5,
-    "critical_stale": 3,
-    "action_required": 8
+    "current": 38,
+    "acceptable": 0,
+    "stale": 0,
+    "critical_stale": 0,
+    "action_required": 0
   },
   "skills": [
     {
-      "skill": "cloud-security",
+      "skill": "age-gates-child-safety",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 30,
-      "currency_label": "critical_stale",
-      "forward_watch_count": 14,
-      "action_required": true
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 10,
+      "action_required": false
     },
     {
-      "skill": "sector-financial",
-      "last_threat_review": "2026-05-11",
-      "days_since_review": -10,
-      "currency_score": 40,
-      "currency_label": "critical_stale",
-      "forward_watch_count": 12,
-      "action_required": true
+      "skill": "ai-attack-surface",
+      "last_threat_review": "2026-05-01",
+      "days_since_review": 0,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
+      "action_required": false
     },
     {
-      "skill": "pqc-first",
+      "skill": "ai-c2-detection",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
-      "currency_score": 45,
-      "currency_label": "critical_stale",
-      "forward_watch_count": 11,
-      "action_required": true
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
+      "action_required": false
     },
     {
-      "skill": "age-gates-child-safety",
+      "skill": "ai-risk-management",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 50,
-      "currency_label": "stale",
-      "forward_watch_count": 10,
-      "action_required": true
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
+      "action_required": false
     },
     {
-      "skill": "sector-federal-government",
+      "skill": "api-security",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 50,
-      "currency_label": "stale",
-      "forward_watch_count": 10,
-      "action_required": true
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
+      "action_required": false
     },
     {
-      "skill": "incident-response-playbook",
+      "skill": "attack-surface-pentest",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 60,
-      "currency_label": "stale",
-      "forward_watch_count": 8,
-      "action_required": true
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 4,
+      "action_required": false
     },
     {
-      "skill": "sector-energy",
+      "skill": "cloud-security",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 60,
-      "currency_label": "stale",
-      "forward_watch_count": 8,
-      "action_required": true
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 14,
+      "action_required": false
     },
     {
-      "skill": "skill-update-loop",
+      "skill": "compliance-theater",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
-      "currency_score": 65,
-      "currency_label": "stale",
-      "forward_watch_count": 7,
-      "action_required": true
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
+      "action_required": false
     },
     {
-      "skill": "coordinated-vuln-disclosure",
+      "skill": "container-runtime-security",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 70,
-      "currency_label": "acceptable",
-      "forward_watch_count": 6,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
       "action_required": false
     },
     {
-      "skill": "mlops-security",
+      "skill": "coordinated-vuln-disclosure",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 70,
-      "currency_label": "acceptable",
+      "currency_score": 100,
+      "currency_label": "current",
       "forward_watch_count": 6,
       "action_required": false
     },
     {
-      "skill": "supply-chain-integrity",
+      "skill": "defensive-countermeasure-mapping",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 70,
-      "currency_label": "acceptable",
-      "forward_watch_count": 6,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
       "action_required": false
     },
     {
-      "skill": "threat-modeling-methodology",
+      "skill": "dlp-gap-analysis",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 70,
-      "currency_label": "acceptable",
-      "forward_watch_count": 6,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 5,
       "action_required": false
     },
     {
-      "skill": "dlp-gap-analysis",
+      "skill": "email-security-anti-phishing",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 75,
-      "currency_label": "acceptable",
-      "forward_watch_count": 5,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
       "action_required": false
     },
     {
-      "skill": "threat-model-currency",
+      "skill": "exploit-scoring",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
-      "currency_score": 75,
-      "currency_label": "acceptable",
-      "forward_watch_count": 5,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
       "action_required": false
     },
     {
-      "skill": "attack-surface-pentest",
-      "last_threat_review": "2026-05-11",
-      "days_since_review": -10,
-      "currency_score": 80,
-      "currency_label": "acceptable",
-      "forward_watch_count": 4,
+      "skill": "framework-gap-analysis",
+      "last_threat_review": "2026-05-01",
+      "days_since_review": 0,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
       "action_required": false
     },
     {
       "skill": "fuzz-testing-strategy",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
-      "currency_score": 80,
-      "currency_label": "acceptable",
+      "currency_score": 100,
+      "currency_label": "current",
       "forward_watch_count": 4,
       "action_required": false
     },
     {
-      "skill": "policy-exception-gen",
+      "skill": "global-grc",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
-      "currency_score": 80,
-      "currency_label": "acceptable",
-      "forward_watch_count": 4,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
       "action_required": false
     },
     {
-      "skill": "security-maturity-tiers",
-      "last_threat_review": "2026-05-01",
-      "days_since_review": 0,
-      "currency_score": 80,
-      "currency_label": "acceptable",
-      "forward_watch_count": 4,
+      "skill": "identity-assurance",
+      "last_threat_review": "2026-05-11",
+      "days_since_review": -10,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 0,
       "action_required": false
     },
     {
-      "skill": "zeroday-gap-learn",
-      "last_threat_review": "2026-05-01",
-      "days_since_review": 0,
-      "currency_score": 80,
-      "currency_label": "acceptable",
-      "forward_watch_count": 4,
+      "skill": "incident-response-playbook",
+      "last_threat_review": "2026-05-11",
+      "days_since_review": -10,
+      "currency_score": 100,
+      "currency_label": "current",
+      "forward_watch_count": 8,
       "action_required": false
     },
     {
-      "skill": "ai-attack-surface",
+      "skill": "kernel-lpe-triage",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
       "currency_score": 100,
@@ -194,7 +194,7 @@
       "action_required": false
     },
     {
-      "skill": "ai-c2-detection",
+      "skill": "mcp-agent-trust",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
       "currency_score": 100,
@@ -203,16 +203,16 @@
       "action_required": false
     },
     {
-      "skill": "ai-risk-management",
+      "skill": "mlops-security",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 6,
       "action_required": false
     },
     {
-      "skill": "api-security",
+      "skill": "ot-ics-security",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
       "currency_score": 100,
@@ -221,34 +221,34 @@
       "action_required": false
     },
     {
-      "skill": "compliance-theater",
+      "skill": "policy-exception-gen",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 4,
       "action_required": false
     },
     {
-      "skill": "container-runtime-security",
-      "last_threat_review": "2026-05-11",
-      "days_since_review": -10,
+      "skill": "pqc-first",
+      "last_threat_review": "2026-05-01",
+      "days_since_review": 0,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 11,
       "action_required": false
     },
     {
-      "skill": "defensive-countermeasure-mapping",
-      "last_threat_review": "2026-05-11",
-      "days_since_review": -10,
+      "skill": "rag-pipeline-security",
+      "last_threat_review": "2026-05-01",
+      "days_since_review": 0,
       "currency_score": 100,
       "currency_label": "current",
       "forward_watch_count": 0,
       "action_required": false
     },
     {
-      "skill": "email-security-anti-phishing",
+      "skill": "researcher",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
       "currency_score": 100,
@@ -257,34 +257,34 @@
       "action_required": false
     },
     {
-      "skill": "exploit-scoring",
-      "last_threat_review": "2026-05-01",
-      "days_since_review": 0,
+      "skill": "sector-energy",
+      "last_threat_review": "2026-05-11",
+      "days_since_review": -10,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 8,
       "action_required": false
     },
     {
-      "skill": "framework-gap-analysis",
-      "last_threat_review": "2026-05-01",
-      "days_since_review": 0,
+      "skill": "sector-federal-government",
+      "last_threat_review": "2026-05-11",
+      "days_since_review": -10,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 10,
       "action_required": false
     },
     {
-      "skill": "global-grc",
-      "last_threat_review": "2026-05-01",
-      "days_since_review": 0,
+      "skill": "sector-financial",
+      "last_threat_review": "2026-05-11",
+      "days_since_review": -10,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 12,
       "action_required": false
     },
     {
-      "skill": "identity-assurance",
+      "skill": "sector-healthcare",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
       "currency_score": 100,
@@ -293,52 +293,52 @@
       "action_required": false
     },
     {
-      "skill": "kernel-lpe-triage",
+      "skill": "security-maturity-tiers",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 4,
       "action_required": false
     },
     {
-      "skill": "mcp-agent-trust",
+      "skill": "skill-update-loop",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 7,
       "action_required": false
     },
     {
-      "skill": "ot-ics-security",
+      "skill": "supply-chain-integrity",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 6,
       "action_required": false
     },
     {
-      "skill": "rag-pipeline-security",
+      "skill": "threat-model-currency",
       "last_threat_review": "2026-05-01",
       "days_since_review": 0,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 5,
       "action_required": false
     },
     {
-      "skill": "researcher",
+      "skill": "threat-modeling-methodology",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 6,
       "action_required": false
     },
     {
-      "skill": "sector-healthcare",
+      "skill": "webapp-security",
       "last_threat_review": "2026-05-11",
       "days_since_review": -10,
       "currency_score": 100,
@@ -347,12 +347,12 @@
       "action_required": false
     },
     {
-      "skill": "webapp-security",
-      "last_threat_review": "2026-05-11",
-      "days_since_review": -10,
+      "skill": "zeroday-gap-learn",
+      "last_threat_review": "2026-05-01",
+      "days_since_review": 0,
       "currency_score": 100,
       "currency_label": "current",
-      "forward_watch_count": 0,
+      "forward_watch_count": 4,
       "action_required": false
     }
   ]