nsauditor-ai-agent-skill 0.2.32 → 0.2.33

package/CHANGELOG.md

@@ -4,6 +4,12 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.33 (2026-08-03) — Paired with EE 0.32.10 · no knowledge change, one honesty correction upstream
+
+**No change to the skill's guidance, schemas, or plugin references.** Published in lockstep with Enterprise 0.32.10 and CE 0.2.35 so an agent installing the trio never mixes versions.
+
+Worth knowing if you are teaching an agent to reason about NSAuditor's evidence: the Enterprise release corrects what its dependency-advisory gate measures (the packed-and-installed customer closure, not the maintainer's working tree) and makes it prove an advisory source answered before reporting clean. The SOC 2 matrix is now enumerated in full at **10 / 4 / 37 = 51** — enumeration completeness, not a coverage change. Plugin catalog UNCHANGED at **28 EE / 55 overall**.
+
 ## 0.2.32 (2026-07-29) — Paired with EE 0.32.9 · the skill package's own provenance sweep
 
 **This package carried the marker class the EE cycle existed to kill, and npm freezes it at publish.** `references/plugins.md` is loaded into an LLM's context and quoted back to customers. Swept from the shipped `files[]` set: **330 occurrences → 0** — memory-slug wiki links (19), reviewer-fold codes (274), internal roadmap ids (35) and internal audit-review names (5).

package/SKILL.md

@@ -16,7 +16,9 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.31 (post-EE-0.32.8 — a **documentation-and-prose** release, no behaviour change. Capability-claim honesty pass, part 2: the air-gapped-delivery class. **27 withdrawn-claim sites** (distinct lines) across the three published packages, each verified against the code — an arm64 image (the build forces `--platform linux/amd64`), offline-installable tarballs (an `npm pack` tarball still resolves deps from a registry), monthly NVD feed bundles (nothing produces one), an air-gapped install script (none exists), a `feed import` CLI command (`importFeed()` has zero non-test callers), and CE's absolute "every feature works without internet access". **Five of the sites were rendered runtime strings**, not documentation: coverage-gap rationales in `utils/intelligence_engine.mjs` that render verbatim into the assessor-facing evidence pack and named a command that does not exist. **In this skill:** the Enterprise tier row's unhedged "RFC 3161 timestamps" is corrected — RFC 3161 timestamping is implemented but not yet wired to a flag, so **do not describe it as shipping**; SHA-256 chain-of-custody is the layer that ships. "Air-gapped deployment" is now stated as "air-gapped operation (offline licensing + offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`)". Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED. No MCP tool or plugin schema change.)
+> **Version:** 0.2.33 (post-EE-0.32.10 — **no knowledge change**; published in lockstep with EE 0.32.10 + CE 0.2.35. Upstream: the dependency-advisory gate now measures the packed-and-installed customer closure rather than the maintainer's working tree, and proves an advisory source answered before reporting clean; SOC 2 matrix enumerated in full at **10 / 4 / 37 = 51** (completeness, not a coverage change). Plugin catalog UNCHANGED at 28 EE / 55 overall.)
+
+> **Prior:** 0.2.32 (post-EE-0.32.9 — the skill package's own provenance sweep.)
 
 > **Prior:** 0.2.30 (post-EE-0.32.7 — a **matrix-neutral** release that does two things. (1) **Cross-framework routing:** the network-scan analysis agents' findings now route in **all seven compliance frameworks**, not just SOC 2 — a host serving cleartext or exposing SMB previously failed the SOC 2 report and read clean in HIPAA / NIST CSF / ISO 27001 / CIS v8 / PCI / GDPR off the same scan; that gap is closed (mutation-proven guard; all seven `coverageSummary` blocks byte-identical). (2) **Capability-claim honesty pass:** several Pro/Enterprise capabilities advertised without a shipping implementation — verification engine, branded reports, usage metering, Docker per-scan isolation, and the ZDE "policy engine" / Enterprise-CTEM datastore framings — are **withdrawn**; the real cores (the code-enforced ZDE read-only guarantee, Pro-tier CTEM retention) ship and are described honestly, and the `verifiers/` stub files no longer ship. Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED.)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.32",
+  "version": "0.2.33",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",