@blamejs/exceptd-skills 0.9.4 → 0.9.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (14) hide show
  1. package/CHANGELOG.md +65 -0
  2. package/bin/exceptd.js +3 -0
  3. package/data/_indexes/_meta.json +3 -3
  4. package/data/_indexes/currency.json +138 -138
  5. package/lib/verify.js +45 -0
  6. package/manifest-snapshot.json +1 -1
  7. package/manifest.json +39 -39
  8. package/orchestrator/dispatcher.js +13 -1
  9. package/orchestrator/index.js +119 -5
  10. package/orchestrator/pipeline.js +8 -2
  11. package/orchestrator/scanner.js +168 -3
  12. package/package.json +1 -1
  13. package/sbom.cdx.json +6 -6
  14. package/scripts/builders/currency.js +5 -3
package/CHANGELOG.md CHANGED
@@ -1,5 +1,70 @@
1
1
  # Changelog
2
2
 
3
+ ## 0.9.5 — 2026-05-12
4
+
5
+ **Pin: six operator-reported bug fixes from real CLI use.**
6
+
7
+ ### Bug 1 — Currency formula penalized `forward_watch` entries
8
+
9
+ `pipeline.js` and `scripts/builders/currency.js` subtracted 5 points per `forward_watch` item, so a skill that diligently tracked 14 upcoming threats scored **30%** the day after a review. Perverse incentive: punished skills doing the right thing. **Fix**: `forward_watch` no longer affects the score — currency is now a pure function of age-since-last_threat_review. `cloud-security` jumped from 30% → 100%; `sector-financial` from 40% → 100%; etc. The decay-formula docstring documents the change.
10
+
11
+ ### Bug 2 — `exceptd report executive` mixed currency thresholds in messaging
12
+
13
+ Earlier output mixed `< 70%` ("skills need review") with `< 50%` ("require immediate update") in the same block, which read inconsistently. **Fix**: report now splits into two named tiers with the threshold inline:
14
+ - *Critical-stale* (`< 50%`, `> 90` days)
15
+ - *Stale* (`50-69%`, `30-90` days)
16
+
17
+ ### Bug 3 — PQC scanner stopped at "verify ML-KEM/ML-DSA"
18
+
19
+ The scanner detected OpenSSL 3.5+ as "PQC-capable" but never actually probed for the algorithms. **Fix**: new `probePqcAlgorithms()` queries the runtime via three channels (Node `crypto.kemEncapsulate`/`getCurves`/`getHashes`/`getCiphers`, `openssl list -kem-algorithms`, `openssl list -signature-algorithms`) and returns boolean availability flags. Probes **22 algorithm flags** across the full emerging PQC landscape:
20
+
21
+ | Tier | Algorithms |
22
+ |---|---|
23
+ | **NIST finalized (FIPS 203/204/205)** | ML-KEM (Kyber), ML-DSA (Dilithium), SLH-DSA (SPHINCS+) |
24
+ | **NIST draft / alternate** | FN-DSA (Falcon, FIPS 206 draft), HQC (alternate KEM, March 2025) |
25
+ | **NIST Round-4 / niche** | FrodoKEM, NTRU / NTRU-Prime, Classic McEliece, BIKE |
26
+ | **NIST signature on-ramp (Round 2, 2024+)** | HAWK, MAYO, SQIsign, CROSS, UOV/SNOVA, SDitH, MIRATH, FAEST, PERK |
27
+ | **Stateful hash sigs** | LMS (RFC 8554), XMSS (RFC 8391), HSS |
28
+ | **IETF composite / hybrid** | composite signatures (RSA+ML-DSA, ECDSA+ML-DSA, etc.), composite KEMs (X25519+ML-KEM) |
29
+
30
+ The scanner finding now surfaces per-algo `provider_hint` so an operator can tell whether availability came from Node's runtime, the OpenSSL provider, or OQS.
31
+
32
+ ### Bug 4 — Dispatcher hid CVE IDs behind aggregate counts
33
+
34
+ `dispatch` previously said *"1 CISA KEV CVE with RWEP ≥ 90"* without naming the CVE. **Fix**: dispatcher threads the per-finding `items[]` array into each plan entry as an `evidence` block. The print path renders each CVE explicitly:
35
+ ```
36
+ [CRITICAL] compliance-theater
37
+ Triggered by: cisa_kev_high_rwep (framework)
38
+ Action: 1 CISA KEV CVEs with RWEP >= 90...
39
+ Evidence:
40
+ - CVE-2026-31431 · "Copy Fail" · RWEP 90
41
+ ```
42
+
43
+ ### Bug 5 — `exceptd verify` succeeded without disclosing key fingerprint
44
+
45
+ A swapped `keys/public.pem` would still produce *"38/38 passed"* — operators had no way to detect key substitution from the exit code alone. **Fix**: verify now prints **both SHA-256 and SHA3-512** fingerprints of the public key:
46
+
47
+ ```
48
+ [verify] Public key: keys/public.pem
49
+ [verify] SHA256:jD19nBPExofyiO60loNQgx5ONUbrwxG8XZM8Hh7pV+w=
50
+ [verify] SHA3-512:okdinIchi8kMtlhOyYmDquwaRw2TSpJFe9MjfGpGI+7mE5dwPy5ZUVG4Hx1PB9KJkInLAzemhE1gsmhjZ0USww==
51
+ ```
52
+
53
+ SHA-256 matches `ssh-keygen -lf` / GPG / npm-provenance / Sigstore conventions; SHA3-512 hedges against SHA-2 family weaknesses with the same Keccak family ML-KEM/ML-DSA use internally. Operators pin one (or both) out-of-band.
54
+
55
+ ### Bug 6 — `framework-gap-analysis` had no programmatic CLI runner
56
+
57
+ Earlier `exceptd dispatch` would say *"run framework-gap-analysis"* but the only thing the CLI could actually do was `exceptd skill framework-gap-analysis` to dump the body. **Fix**: new `exceptd framework-gap <FRAMEWORK_ID|all> <SCENARIO|CVE-ID> [--json]` subcommand executes the analytical path in `lib/framework-gap.js`. Produces structured human or JSON output covering matching gaps, universal gaps, theater-risk controls per framework.
58
+
59
+ Examples:
60
+ ```bash
61
+ exceptd framework-gap NIST-800-53 CVE-2026-31431
62
+ exceptd framework-gap PCI-DSS-4.0 "prompt injection"
63
+ exceptd framework-gap all CVE-2025-53773 --json
64
+ ```
65
+
66
+ 13/13 predeploy gates green; 201 tests pass.
67
+
3
68
  ## 0.9.4 — 2026-05-12
4
69
 
5
70
  **Pin: drop upper bound on Node engine requirement.**
package/bin/exceptd.js CHANGED
@@ -68,11 +68,14 @@ const COMMANDS = {
68
68
  "validate-cves": () => path.join(PKG_ROOT, "orchestrator", "index.js"),
69
69
  "validate-rfcs": () => path.join(PKG_ROOT, "orchestrator", "index.js"),
70
70
  watchlist: () => path.join(PKG_ROOT, "orchestrator", "index.js"),
71
+ "framework-gap": () => path.join(PKG_ROOT, "orchestrator", "index.js"),
72
+ "framework-gap-analysis": () => path.join(PKG_ROOT, "orchestrator", "index.js"),
71
73
  };
72
74
 
73
75
  const ORCHESTRATOR_PASSTHROUGH = new Set([
74
76
  "scan", "dispatch", "skill", "currency", "report",
75
77
  "validate-cves", "validate-rfcs", "watchlist",
78
+ "framework-gap", "framework-gap-analysis",
76
79
  ]);
77
80
 
78
81
  function readPkgVersion() {
package/data/_indexes/_meta.json CHANGED
@@ -1,10 +1,10 @@
1
1
  {
2
2
  "schema_version": "1.1.0",
3
- "generated_at": "2026-05-12T03:28:40.863Z",
3
+ "generated_at": "2026-05-12T03:51:54.072Z",
4
4
  "generator": "scripts/build-indexes.js",
5
5
  "source_count": 49,
6
6
  "source_hashes": {
7
- "manifest.json": "df707e6e95191a5b63e7223abadf716f01155477b113d5688092ed53bf4639b0",
7
+ "manifest.json": "ea6d754eb8909f05a931cd895cc10655842e212a3508a066c811650c58990db4",
8
8
  "data/atlas-ttps.json": "1500b5830dab070c4252496964a8c0948e1052a656e2c7c6e1efaf0350645e13",
9
9
  "data/cve-catalog.json": "a81d3e4b491b27ccc084596b063a6108ff10c9eb01d7776922fc393980b534fe",
10
10
  "data/cwe-catalog.json": "c3367d469b4b3d31e4c56397dd7a8305a0be338ecd85afa27804c0c9ce12157b",
@@ -78,7 +78,7 @@
78
78
  "jurisdiction_clocks": 29,
79
79
  "did_ladders": 8,
80
80
  "theater_fingerprints": 7,
81
- "currency_action_required": 8,
81
+ "currency_action_required": 0,
82
82
  "frequency_fields": 7,
83
83
  "activity_feed_events": 49,
84
84
  "catalog_summaries": 10,
package/data/_indexes/currency.json CHANGED
@@ -3,189 +3,189 @@
3
3
  "schema_version": "1.0.0",
4
4
  "reference_date": "2026-05-01",
5
5
  "note": "Pre-computed skill currency snapshot. Reference date is manifest.threat_review_date (deterministic). Re-runs of build-indexes against the same inputs produce byte-identical output. The orchestrator `currency` command produces a real-time view against today's date.",
6
- "decay_formula": "100 base; -30/-20/-10/-5 at 180/90/60/30-day thresholds; -5 per forward_watch entry. Label thresholds: ≥90 current, ≥70 acceptable, ≥50 stale, <50 critical_stale."
6
+ "decay_formula": "100 base; -30/-20/-10/-5 at 180/90/60/30-day thresholds. forward_watch count does NOT affect the score (it's a maintenance signal, not a staleness one). Label thresholds: ≥90 current, ≥70 acceptable, ≥50 stale, <50 critical_stale."
7
7
  },
8
8
  "summary": {
9
- "current": 19,
10
- "acceptable": 11,
11
- "stale": 5,
12
- "critical_stale": 3,
13
- "action_required": 8
9
+ "current": 38,
10
+ "acceptable": 0,
11
+ "stale": 0,
12
+ "critical_stale": 0,
13
+ "action_required": 0
14
14
  },
15
15
  "skills": [
16
16
  {
17
- "skill": "cloud-security",
17
+ "skill": "age-gates-child-safety",
18
18
  "last_threat_review": "2026-05-11",
19
19
  "days_since_review": -10,
20
- "currency_score": 30,
21
- "currency_label": "critical_stale",
22
- "forward_watch_count": 14,
23
- "action_required": true
20
+ "currency_score": 100,
21
+ "currency_label": "current",
22
+ "forward_watch_count": 10,
23
+ "action_required": false
24
24
  },
25
25
  {
26
- "skill": "sector-financial",
27
- "last_threat_review": "2026-05-11",
28
- "days_since_review": -10,
29
- "currency_score": 40,
30
- "currency_label": "critical_stale",
31
- "forward_watch_count": 12,
32
- "action_required": true
26
+ "skill": "ai-attack-surface",
27
+ "last_threat_review": "2026-05-01",
28
+ "days_since_review": 0,
29
+ "currency_score": 100,
30
+ "currency_label": "current",
31
+ "forward_watch_count": 0,
32
+ "action_required": false
33
33
  },
34
34
  {
35
- "skill": "pqc-first",
35
+ "skill": "ai-c2-detection",
36
36
  "last_threat_review": "2026-05-01",
37
37
  "days_since_review": 0,
38
- "currency_score": 45,
39
- "currency_label": "critical_stale",
40
- "forward_watch_count": 11,
41
- "action_required": true
38
+ "currency_score": 100,
39
+ "currency_label": "current",
40
+ "forward_watch_count": 0,
41
+ "action_required": false
42
42
  },
43
43
  {
44
- "skill": "age-gates-child-safety",
44
+ "skill": "ai-risk-management",
45
45
  "last_threat_review": "2026-05-11",
46
46
  "days_since_review": -10,
47
- "currency_score": 50,
48
- "currency_label": "stale",
49
- "forward_watch_count": 10,
50
- "action_required": true
47
+ "currency_score": 100,
48
+ "currency_label": "current",
49
+ "forward_watch_count": 0,
50
+ "action_required": false
51
51
  },
52
52
  {
53
- "skill": "sector-federal-government",
53
+ "skill": "api-security",
54
54
  "last_threat_review": "2026-05-11",
55
55
  "days_since_review": -10,
56
- "currency_score": 50,
57
- "currency_label": "stale",
58
- "forward_watch_count": 10,
59
- "action_required": true
56
+ "currency_score": 100,
57
+ "currency_label": "current",
58
+ "forward_watch_count": 0,
59
+ "action_required": false
60
60
  },
61
61
  {
62
- "skill": "incident-response-playbook",
62
+ "skill": "attack-surface-pentest",
63
63
  "last_threat_review": "2026-05-11",
64
64
  "days_since_review": -10,
65
- "currency_score": 60,
66
- "currency_label": "stale",
67
- "forward_watch_count": 8,
68
- "action_required": true
65
+ "currency_score": 100,
66
+ "currency_label": "current",
67
+ "forward_watch_count": 4,
68
+ "action_required": false
69
69
  },
70
70
  {
71
- "skill": "sector-energy",
71
+ "skill": "cloud-security",
72
72
  "last_threat_review": "2026-05-11",
73
73
  "days_since_review": -10,
74
- "currency_score": 60,
75
- "currency_label": "stale",
76
- "forward_watch_count": 8,
77
- "action_required": true
74
+ "currency_score": 100,
75
+ "currency_label": "current",
76
+ "forward_watch_count": 14,
77
+ "action_required": false
78
78
  },
79
79
  {
80
- "skill": "skill-update-loop",
80
+ "skill": "compliance-theater",
81
81
  "last_threat_review": "2026-05-01",
82
82
  "days_since_review": 0,
83
- "currency_score": 65,
84
- "currency_label": "stale",
85
- "forward_watch_count": 7,
86
- "action_required": true
83
+ "currency_score": 100,
84
+ "currency_label": "current",
85
+ "forward_watch_count": 0,
86
+ "action_required": false
87
87
  },
88
88
  {
89
- "skill": "coordinated-vuln-disclosure",
89
+ "skill": "container-runtime-security",
90
90
  "last_threat_review": "2026-05-11",
91
91
  "days_since_review": -10,
92
- "currency_score": 70,
93
- "currency_label": "acceptable",
94
- "forward_watch_count": 6,
92
+ "currency_score": 100,
93
+ "currency_label": "current",
94
+ "forward_watch_count": 0,
95
95
  "action_required": false
96
96
  },
97
97
  {
98
- "skill": "mlops-security",
98
+ "skill": "coordinated-vuln-disclosure",
99
99
  "last_threat_review": "2026-05-11",
100
100
  "days_since_review": -10,
101
- "currency_score": 70,
102
- "currency_label": "acceptable",
101
+ "currency_score": 100,
102
+ "currency_label": "current",
103
103
  "forward_watch_count": 6,
104
104
  "action_required": false
105
105
  },
106
106
  {
107
- "skill": "supply-chain-integrity",
107
+ "skill": "defensive-countermeasure-mapping",
108
108
  "last_threat_review": "2026-05-11",
109
109
  "days_since_review": -10,
110
- "currency_score": 70,
111
- "currency_label": "acceptable",
112
- "forward_watch_count": 6,
110
+ "currency_score": 100,
111
+ "currency_label": "current",
112
+ "forward_watch_count": 0,
113
113
  "action_required": false
114
114
  },
115
115
  {
116
- "skill": "threat-modeling-methodology",
116
+ "skill": "dlp-gap-analysis",
117
117
  "last_threat_review": "2026-05-11",
118
118
  "days_since_review": -10,
119
- "currency_score": 70,
120
- "currency_label": "acceptable",
121
- "forward_watch_count": 6,
119
+ "currency_score": 100,
120
+ "currency_label": "current",
121
+ "forward_watch_count": 5,
122
122
  "action_required": false
123
123
  },
124
124
  {
125
- "skill": "dlp-gap-analysis",
125
+ "skill": "email-security-anti-phishing",
126
126
  "last_threat_review": "2026-05-11",
127
127
  "days_since_review": -10,
128
- "currency_score": 75,
129
- "currency_label": "acceptable",
130
- "forward_watch_count": 5,
128
+ "currency_score": 100,
129
+ "currency_label": "current",
130
+ "forward_watch_count": 0,
131
131
  "action_required": false
132
132
  },
133
133
  {
134
- "skill": "threat-model-currency",
134
+ "skill": "exploit-scoring",
135
135
  "last_threat_review": "2026-05-01",
136
136
  "days_since_review": 0,
137
- "currency_score": 75,
138
- "currency_label": "acceptable",
139
- "forward_watch_count": 5,
137
+ "currency_score": 100,
138
+ "currency_label": "current",
139
+ "forward_watch_count": 0,
140
140
  "action_required": false
141
141
  },
142
142
  {
143
- "skill": "attack-surface-pentest",
144
- "last_threat_review": "2026-05-11",
145
- "days_since_review": -10,
146
- "currency_score": 80,
147
- "currency_label": "acceptable",
148
- "forward_watch_count": 4,
143
+ "skill": "framework-gap-analysis",
144
+ "last_threat_review": "2026-05-01",
145
+ "days_since_review": 0,
146
+ "currency_score": 100,
147
+ "currency_label": "current",
148
+ "forward_watch_count": 0,
149
149
  "action_required": false
150
150
  },
151
151
  {
152
152
  "skill": "fuzz-testing-strategy",
153
153
  "last_threat_review": "2026-05-11",
154
154
  "days_since_review": -10,
155
- "currency_score": 80,
156
- "currency_label": "acceptable",
155
+ "currency_score": 100,
156
+ "currency_label": "current",
157
157
  "forward_watch_count": 4,
158
158
  "action_required": false
159
159
  },
160
160
  {
161
- "skill": "policy-exception-gen",
161
+ "skill": "global-grc",
162
162
  "last_threat_review": "2026-05-01",
163
163
  "days_since_review": 0,
164
- "currency_score": 80,
165
- "currency_label": "acceptable",
166
- "forward_watch_count": 4,
164
+ "currency_score": 100,
165
+ "currency_label": "current",
166
+ "forward_watch_count": 0,
167
167
  "action_required": false
168
168
  },
169
169
  {
170
- "skill": "security-maturity-tiers",
171
- "last_threat_review": "2026-05-01",
172
- "days_since_review": 0,
173
- "currency_score": 80,
174
- "currency_label": "acceptable",
175
- "forward_watch_count": 4,
170
+ "skill": "identity-assurance",
171
+ "last_threat_review": "2026-05-11",
172
+ "days_since_review": -10,
173
+ "currency_score": 100,
174
+ "currency_label": "current",
175
+ "forward_watch_count": 0,
176
176
  "action_required": false
177
177
  },
178
178
  {
179
- "skill": "zeroday-gap-learn",
180
- "last_threat_review": "2026-05-01",
181
- "days_since_review": 0,
182
- "currency_score": 80,
183
- "currency_label": "acceptable",
184
- "forward_watch_count": 4,
179
+ "skill": "incident-response-playbook",
180
+ "last_threat_review": "2026-05-11",
181
+ "days_since_review": -10,
182
+ "currency_score": 100,
183
+ "currency_label": "current",
184
+ "forward_watch_count": 8,
185
185
  "action_required": false
186
186
  },
187
187
  {
188
- "skill": "ai-attack-surface",
188
+ "skill": "kernel-lpe-triage",
189
189
  "last_threat_review": "2026-05-01",
190
190
  "days_since_review": 0,
191
191
  "currency_score": 100,
@@ -194,7 +194,7 @@
194
194
  "action_required": false
195
195
  },
196
196
  {
197
- "skill": "ai-c2-detection",
197
+ "skill": "mcp-agent-trust",
198
198
  "last_threat_review": "2026-05-01",
199
199
  "days_since_review": 0,
200
200
  "currency_score": 100,
@@ -203,16 +203,16 @@
203
203
  "action_required": false
204
204
  },
205
205
  {
206
- "skill": "ai-risk-management",
206
+ "skill": "mlops-security",
207
207
  "last_threat_review": "2026-05-11",
208
208
  "days_since_review": -10,
209
209
  "currency_score": 100,
210
210
  "currency_label": "current",
211
- "forward_watch_count": 0,
211
+ "forward_watch_count": 6,
212
212
  "action_required": false
213
213
  },
214
214
  {
215
- "skill": "api-security",
215
+ "skill": "ot-ics-security",
216
216
  "last_threat_review": "2026-05-11",
217
217
  "days_since_review": -10,
218
218
  "currency_score": 100,
@@ -221,34 +221,34 @@
221
221
  "action_required": false
222
222
  },
223
223
  {
224
- "skill": "compliance-theater",
224
+ "skill": "policy-exception-gen",
225
225
  "last_threat_review": "2026-05-01",
226
226
  "days_since_review": 0,
227
227
  "currency_score": 100,
228
228
  "currency_label": "current",
229
- "forward_watch_count": 0,
229
+ "forward_watch_count": 4,
230
230
  "action_required": false
231
231
  },
232
232
  {
233
- "skill": "container-runtime-security",
234
- "last_threat_review": "2026-05-11",
235
- "days_since_review": -10,
233
+ "skill": "pqc-first",
234
+ "last_threat_review": "2026-05-01",
235
+ "days_since_review": 0,
236
236
  "currency_score": 100,
237
237
  "currency_label": "current",
238
- "forward_watch_count": 0,
238
+ "forward_watch_count": 11,
239
239
  "action_required": false
240
240
  },
241
241
  {
242
- "skill": "defensive-countermeasure-mapping",
243
- "last_threat_review": "2026-05-11",
244
- "days_since_review": -10,
242
+ "skill": "rag-pipeline-security",
243
+ "last_threat_review": "2026-05-01",
244
+ "days_since_review": 0,
245
245
  "currency_score": 100,
246
246
  "currency_label": "current",
247
247
  "forward_watch_count": 0,
248
248
  "action_required": false
249
249
  },
250
250
  {
251
- "skill": "email-security-anti-phishing",
251
+ "skill": "researcher",
252
252
  "last_threat_review": "2026-05-11",
253
253
  "days_since_review": -10,
254
254
  "currency_score": 100,
@@ -257,34 +257,34 @@
257
257
  "action_required": false
258
258
  },
259
259
  {
260
- "skill": "exploit-scoring",
261
- "last_threat_review": "2026-05-01",
262
- "days_since_review": 0,
260
+ "skill": "sector-energy",
261
+ "last_threat_review": "2026-05-11",
262
+ "days_since_review": -10,
263
263
  "currency_score": 100,
264
264
  "currency_label": "current",
265
- "forward_watch_count": 0,
265
+ "forward_watch_count": 8,
266
266
  "action_required": false
267
267
  },
268
268
  {
269
- "skill": "framework-gap-analysis",
270
- "last_threat_review": "2026-05-01",
271
- "days_since_review": 0,
269
+ "skill": "sector-federal-government",
270
+ "last_threat_review": "2026-05-11",
271
+ "days_since_review": -10,
272
272
  "currency_score": 100,
273
273
  "currency_label": "current",
274
- "forward_watch_count": 0,
274
+ "forward_watch_count": 10,
275
275
  "action_required": false
276
276
  },
277
277
  {
278
- "skill": "global-grc",
279
- "last_threat_review": "2026-05-01",
280
- "days_since_review": 0,
278
+ "skill": "sector-financial",
279
+ "last_threat_review": "2026-05-11",
280
+ "days_since_review": -10,
281
281
  "currency_score": 100,
282
282
  "currency_label": "current",
283
- "forward_watch_count": 0,
283
+ "forward_watch_count": 12,
284
284
  "action_required": false
285
285
  },
286
286
  {
287
- "skill": "identity-assurance",
287
+ "skill": "sector-healthcare",
288
288
  "last_threat_review": "2026-05-11",
289
289
  "days_since_review": -10,
290
290
  "currency_score": 100,
@@ -293,52 +293,52 @@
293
293
  "action_required": false
294
294
  },
295
295
  {
296
- "skill": "kernel-lpe-triage",
296
+ "skill": "security-maturity-tiers",
297
297
  "last_threat_review": "2026-05-01",
298
298
  "days_since_review": 0,
299
299
  "currency_score": 100,
300
300
  "currency_label": "current",
301
- "forward_watch_count": 0,
301
+ "forward_watch_count": 4,
302
302
  "action_required": false
303
303
  },
304
304
  {
305
- "skill": "mcp-agent-trust",
305
+ "skill": "skill-update-loop",
306
306
  "last_threat_review": "2026-05-01",
307
307
  "days_since_review": 0,
308
308
  "currency_score": 100,
309
309
  "currency_label": "current",
310
- "forward_watch_count": 0,
310
+ "forward_watch_count": 7,
311
311
  "action_required": false
312
312
  },
313
313
  {
314
- "skill": "ot-ics-security",
314
+ "skill": "supply-chain-integrity",
315
315
  "last_threat_review": "2026-05-11",
316
316
  "days_since_review": -10,
317
317
  "currency_score": 100,
318
318
  "currency_label": "current",
319
- "forward_watch_count": 0,
319
+ "forward_watch_count": 6,
320
320
  "action_required": false
321
321
  },
322
322
  {
323
- "skill": "rag-pipeline-security",
323
+ "skill": "threat-model-currency",
324
324
  "last_threat_review": "2026-05-01",
325
325
  "days_since_review": 0,
326
326
  "currency_score": 100,
327
327
  "currency_label": "current",
328
- "forward_watch_count": 0,
328
+ "forward_watch_count": 5,
329
329
  "action_required": false
330
330
  },
331
331
  {
332
- "skill": "researcher",
332
+ "skill": "threat-modeling-methodology",
333
333
  "last_threat_review": "2026-05-11",
334
334
  "days_since_review": -10,
335
335
  "currency_score": 100,
336
336
  "currency_label": "current",
337
- "forward_watch_count": 0,
337
+ "forward_watch_count": 6,
338
338
  "action_required": false
339
339
  },
340
340
  {
341
- "skill": "sector-healthcare",
341
+ "skill": "webapp-security",
342
342
  "last_threat_review": "2026-05-11",
343
343
  "days_since_review": -10,
344
344
  "currency_score": 100,
@@ -347,12 +347,12 @@
347
347
  "action_required": false
348
348
  },
349
349
  {
350
- "skill": "webapp-security",
351
- "last_threat_review": "2026-05-11",
352
- "days_since_review": -10,
350
+ "skill": "zeroday-gap-learn",
351
+ "last_threat_review": "2026-05-01",
352
+ "days_since_review": 0,
353
353
  "currency_score": 100,
354
354
  "currency_label": "current",
355
- "forward_watch_count": 0,
355
+ "forward_watch_count": 4,
356
356
  "action_required": false
357
357
  }
358
358
  ]
package/lib/verify.js CHANGED
@@ -161,6 +161,41 @@ function loadManifest() {
161
161
  return JSON.parse(fs.readFileSync(MANIFEST_PATH, 'utf8'));
162
162
  }
163
163
 
164
+ /**
165
+ * Public key fingerprint(s) of the DER-encoded SPKI public key,
166
+ * base64-encoded. Emits both:
167
+ *
168
+ * - SHA-256: the universal convention. Matches `ssh-keygen -lf`
169
+ * output for the same key, matches GPG / npm provenance / CT log
170
+ * fingerprints. Operators cross-referencing the key against an
171
+ * external pin will use this line.
172
+ *
173
+ * - SHA3-512: SHA-3 family (Keccak / sponge construction), different
174
+ * mathematical foundation than SHA-2. Hedges against future SHA-2
175
+ * weaknesses. 512-bit output (~88 b64 chars) so collision +
176
+ * second-preimage resistance both exceed the 256-bit Ed25519 key
177
+ * itself. SHA-3 is also the hash family ML-KEM / ML-DSA use
178
+ * internally, so this fingerprint travels well with the project's
179
+ * PQ posture.
180
+ *
181
+ * @param {string|null} pemKey PEM-encoded public key (or null)
182
+ * @returns {{sha256: string, sha3_512: string}|{error: string}}
183
+ */
184
+ function publicKeyFingerprint(pemKey) {
185
+ if (!pemKey) return { sha256: '(no key)', sha3_512: '(no key)' };
186
+ try {
187
+ const keyObj = crypto.createPublicKey(pemKey);
188
+ const der = keyObj.export({ type: 'spki', format: 'der' });
189
+ return {
190
+ sha256: 'SHA256:' + crypto.createHash('sha256').update(der).digest('base64'),
191
+ sha3_512: 'SHA3-512:' + crypto.createHash('sha3-512').update(der).digest('base64'),
192
+ };
193
+ } catch (err) {
194
+ const errStr = `(invalid: ${err.message})`;
195
+ return { sha256: errStr, sha3_512: errStr };
196
+ }
197
+ }
198
+
164
199
  // --- CLI ---
165
200
 
166
201
  if (require.main === module) {
@@ -203,7 +238,17 @@ if (require.main === module) {
203
238
  if (result.no_key) process.exit(1);
204
239
 
205
240
  const total = Object.values(result).filter(Array.isArray).flat().length;
241
+ // Compute + print the public key fingerprints so operators can pin
242
+ // the key out-of-band. Without this, a swapped keys/public.pem
243
+ // would still produce a "verified" message — undetectable from the
244
+ // exit code alone. Dual fingerprint (SHA-256 + SHA3-512) gives
245
+ // ssh-keygen compatibility AND a SHA-3 family diversity hedge.
246
+ const pubKey = loadPublicKey();
247
+ const fp = publicKeyFingerprint(pubKey);
206
248
  console.log(`\n[verify] ${result.valid.length}/${total} skills passed Ed25519 verification.`);
249
+ console.log(`[verify] Public key: keys/public.pem`);
250
+ console.log(`[verify] ${fp.sha256}`);
251
+ console.log(`[verify] ${fp.sha3_512}`);
207
252
 
208
253
  if (result.invalid.length > 0) { console.error('[verify] TAMPERED:', result.invalid.join(', ')); process.exit(1); }
209
254
  if (result.missing_sig.length > 0) { console.warn('[verify] UNSIGNED:', result.missing_sig.join(', ')); process.exit(1); }