nsauditor-ai-agent-skill 0.2.23 → 0.2.24

package/CHANGELOG.md

@@ -4,6 +4,12 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.24 (2026-07-09) — Paired content bump for EE 0.32.1 (compliance report-quality hygiene + deeper positive-substrate curation + GRC-connector DRY refactor)
+
+Paired version bump for the EE 0.32.1 trio — matrix-neutral patch. EE 0.32.1 cleans internal engineering markers (`[[wiki-links]]`, `EE-RT` work-codes, reviewer-codes, `Rn-SEVERITY` review-round IDs) out of the "Why this violates" rationales rendered into every Report on Compliance across all seven frameworks (~900 rationales, subsequence-invariant-proven), fixes a KMS-parse-failure rationale that leaked a reviewer-code + a foreign-framework token into all seven reports, opts more Azure + deeper-AWS PASS-tier findings into the display-only positive-substrate RoC view, and collapses the Vanta + Drata push loops into a shared `_runPushBatch`. No new framework, plugin count UNCHANGED at 28, all seven coverage matrices UNCHANGED. Paired **EE 0.32.1** + **CE 0.2.26**.
+
+---
+
 ## 0.2.23 (2026-07-07) — Paired content bump for EE 0.32.0 (Enterprise GRC push activation — Vanta + Drata)
 
 Paired content bump (SKILL.md version line + the `compliance_check` capability's GRC-connector mention + the `COMPLIANCE_GRC_PROVIDER` Environment-Variables entry + this changelog). **EE 0.32.0** wires the dormant Vanta connector for **scan-time GRC push activation** (`COMPLIANCE_GRC_PROVIDER=vanta` + `COMPLIANCE_GRC_TOKEN` → the compliance phase maps findings to Vanta test results and pushes them, opt-in + ZDE-redacted, token never serialized) and ships a new **Drata** connector (Custom Connections; your Drata Test Builder rules evaluate the pushed records); Secureframe is on the roadmap. Also ships the **T1/T2 AWS positive-substrate curation** (60 PASS-tier findings opt into the per-control RoC positive-substrate view; display-only, non-flipping, count-neutral). Honest status: connectors shipped + opt-in + extensively tested; live validation against production tenants is in progress — early-access, single-workspace, not a multi-tenant sync. **No new MCP tools or schemas. No new framework, no new plugins (still 28), all seven coverage matrices UNCHANGED.** Paired **EE 0.32.0** + **CE 0.2.25**.

package/SKILL.md

@@ -16,7 +16,7 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.23 (post-EE-0.32.0 — the **Enterprise GRC push activation (Vanta wired + Drata connector) + T1/T2 AWS positive-substrate uplift**: **no new framework, no new plugins (still 28), all seven coverage matrices UNCHANGED.** EE 0.32.0 wires the dormant Vanta connector for **scan-time GRC push** — set `COMPLIANCE_GRC_PROVIDER=vanta` + `COMPLIANCE_GRC_TOKEN` and the compliance phase maps each finding to Vanta test results and pushes them (opt-in, ZDE-redacted egress, token never serialized; suppression-aware outcomes, framework-dimensioned idempotency, rate-limit backoff, circuit breaker) — and ships a new **Drata** connector (Custom Connections; your Drata Test Builder rules evaluate the pushed records); Secureframe on the roadmap. Honest status: connectors shipped + opt-in + extensively tested; live validation against production tenants in progress — early-access, single-workspace, not a multi-tenant sync. Also opts 60 AWS PASS-tier findings (T1 at-rest + T2 AWS-other) into the per-control RoC positive-substrate view (display-only + non-flipping + count-neutral). The seven frameworks: SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · **GDPR Article 32** — the last is **Art. 32 infrastructure substrate ONLY, NOT GDPR compliance** [Art. 32 is the only one of GDPR's 99 articles an infrastructure scanner can evidence; the rest is operator-side, out of scope by design], carrying four-factor proportionality + personal-data-scope attestation + the Art. 83(4) LOWER fine tier [€10M/2%, not the €20M/4% headline tier]. Paired CE 0.2.24 + EE 0.31.10) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
+> **Version:** 0.2.24 (post-EE-0.32.1 — a **matrix-neutral compliance report-quality hygiene + deeper positive-substrate curation + GRC-connector DRY refactor** patch: **no new framework, no new plugins (still 28), all seven coverage matrices UNCHANGED.** EE 0.32.1 cleans internal engineering markers (`[[wiki-links]]`, `EE-RT` work-codes, reviewer-codes, `Rn-SEVERITY` review-round IDs) out of the "Why this violates" rationales that render into every Report on Compliance across all seven frameworks (~900 rationales, subsequence-invariant-proven), fixes a KMS-parse-failure rationale that leaked a reviewer-code + foreign token into all seven reports, opts more Azure + deeper-AWS PASS-tier findings into the display-only positive-substrate RoC view, and collapses the Vanta + Drata push loops into a shared `_runPushBatch`. Prior context — EE 0.32.0 wires the dormant Vanta connector for **scan-time GRC push** — set `COMPLIANCE_GRC_PROVIDER=vanta` + `COMPLIANCE_GRC_TOKEN` and the compliance phase maps each finding to Vanta test results and pushes them (opt-in, ZDE-redacted egress, token never serialized; suppression-aware outcomes, framework-dimensioned idempotency, rate-limit backoff, circuit breaker) — and ships a new **Drata** connector (Custom Connections; your Drata Test Builder rules evaluate the pushed records); Secureframe on the roadmap. Honest status: connectors shipped + opt-in + extensively tested; live validation against production tenants in progress — early-access, single-workspace, not a multi-tenant sync. Also opts 60 AWS PASS-tier findings (T1 at-rest + T2 AWS-other) into the per-control RoC positive-substrate view (display-only + non-flipping + count-neutral). The seven frameworks: SOC 2 · HIPAA · NIST CSF 2.0 · PCI DSS v4.0.1 · ISO/IEC 27001:2022 · CIS Controls v8 · **GDPR Article 32** — the last is **Art. 32 infrastructure substrate ONLY, NOT GDPR compliance** [Art. 32 is the only one of GDPR's 99 articles an infrastructure scanner can evidence; the rest is operator-side, out of scope by design], carrying four-factor proportionality + personal-data-scope attestation + the Art. 83(4) LOWER fine tier [€10M/2%, not the €20M/4% headline tier]. Paired CE 0.2.26 + EE 0.32.1) · **Source:** [github.com/nsasoft/nsauditor-ai](https://github.com/nsasoft/nsauditor-ai) · **npm:** `nsauditor-ai` · **License:** MIT (CE)
 
 NSAuditor AI is a modular, AI-assisted network security audit platform with 27+ scanner
 plugins, CVE matching, MITRE ATT&CK mapping, and Zero Data Exfiltration by design. This

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.23",
+  "version": "0.2.24",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",