nsauditor-ai-agent-skill 0.2.35 → 0.2.37

package/CHANGELOG.md

@@ -4,6 +4,50 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.37 (2026-08-10) — post-EE-0.34.0: teach exploit intelligence, and stop teaching a risk-score formula the code never used
+
+Enterprise findings carrying CVEs are joined by CVE-ID against a local **CISA KEV** catalog and a
+local **FIRST EPSS** scores file, banded `KNOWN_EXPLOITED` / `ELEVATED` / `BASELINE`, with the
+finding queue ordered exploit-first.
+
+Two things an agent must get right when it explains this:
+
+1. **No feed data ships with the product.** Both stores are operator-populated via
+   `NSAUDITOR_EXPLOIT_KEV_STORE` / `NSAUDITOR_EXPLOIT_EPSS_STORE` — the same rule as the offline
+   NVD store — and both fail closed when stale (KEV 14-day / EPSS 10-day windows), so an
+   out-of-date catalog never reports "not exploited". Never describe the feeds as included.
+2. **`riskScore` is unchanged.** `exploitPriority` is a new axis beside it, not a re-weighting.
+
+Corrected in this package's own prose: the risk score is **CVSS weighted by verification status
+with an initial-access uplift**, not "severity x exploitability x impact x exposure" — that
+phrasing named an exploitability input that did not exist until EE 0.34.0.
+
+Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+
+---
+
+## 0.2.36 (2026-08-07) — the opt-in RFC 3161 wording corrected: a hedge that had outlived its measurement
+
+`SKILL.md` described RFC 3161 timestamping as *"implemented but not yet wired to a flag — do
+not quote it as shipping"*. EE 0.33.0 wired it via `NSAUDITOR_TSA_URL`, and on 2026-08-07 the
+live smoke exercised it against a real Time-Stamp Authority through the published binary
+(`openssl ts -verify` returning OK, with a one-byte-mutated copy returning FAILED as the
+control). The sentence had been false for a full release, and because this file is
+instruction material for AI agents it did not merely sit there — a live Claude Desktop reply
+repeated it downstream, which is how it was found.
+
+The row now states what is true: opt-in via `NSAUDITOR_TSA_URL`, no CLI flag and no default,
+an outbound call to the Time-Stamp Authority you name, and exercised against a live authority
+on the npm path. ⚠️ **Superseded within the day:** the in-container live round-trip was then
+run too, from inside the pushed `:0.33.0` image, so BOTH delivery vehicles are proven end to
+end. The only container caveat that survives is version scope — retained images at `:0.32.11`
+and earlier carry no `openssl` and nothing here speaks for them.
+
+No behaviour change; wording only. Paired with the EE-side renderer correction on the same
+root cause.
+
+---
+
 ## 0.2.35 (2026-08-07) — paired with EE 0.33.0 · requires CE ≥ 0.2.37
 
 Three new CE entry points to teach: `compliance attest` (Type II recurring-scan attestation;

package/SKILL.md

@@ -16,7 +16,9 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.35 (post-EE-0.33.0 · **requires CE ≥ 0.2.37**) — the wiring release. Three CE entry points are new and the skill should teach them: `compliance attest` (Type II recurring-scan attestation over a directory of prior scans; exit 3 on an empty history), and `--sla-policy <file>` / `--compliance-history <dir>`, which reach the SLA/MTTR engine. A startup posture veto refuses `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path (exit 2). ⚠️ Two corrections to this package's own prose: the `compliance_check` disclosure now carries the WITHDRAWN marker so an instrument can tell it from a claim, and the Enterprise row no longer calls plugin 1023 a cloud auditor — it scores zero-trust posture from a NETWORK-host scan and cannot be run by selecting it with `--plugins`. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+> **Version:** 0.2.37 (post-EE-0.34.0 · **requires CE ≥ 0.2.39**) — the exploit-intelligence release. Enterprise findings that carry CVEs are joined by CVE-ID against a local **CISA KEV** catalog and a local **FIRST EPSS** scores file, banded `KNOWN_EXPLOITED` / `ELEVATED` / `BASELINE`, and the finding queue is ordered exploit-first — a KEV-listed MEDIUM outranks an unexploited CRITICAL. ⚠️ Teach this accurately: **no feed data ships with the product.** Both stores are operator-populated via `NSAUDITOR_EXPLOIT_KEV_STORE` / `NSAUDITOR_EXPLOIT_EPSS_STORE`, the same rule as the offline NVD store, and both **fail closed when stale** (KEV 14-day / EPSS 10-day windows) so an out-of-date catalog never reports "not exploited". `riskScore` is UNCHANGED — `exploitPriority` is a new axis beside it, not a re-weighting. ⚠️ One correction to this package's own prose: the risk score is **CVSS weighted by verification status with an initial-access uplift**, not "severity × exploitability × impact × exposure" — that phrasing named an exploitability input that did not exist until this release. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+
+> **Prior:** 0.2.36 (post-EE-0.33.0 · **requires CE ≥ 0.2.37**) — a wording-only patch on top of the wiring release: the RFC 3161 row said the capability was "implemented but not yet wired to a flag", which EE 0.33.0 falsified and the live-TSA smokes then falsified twice over (npm path 2026-08-07, from inside the `:0.33.0` container image 2026-08-08). It is opt-in via `NSAUDITOR_TSA_URL`, proven on both delivery vehicles, and the only surviving caveat is version scope — retained images `:0.32.11` and earlier carry no `openssl`. **Prior:** 0.2.35 — the wiring release. Three CE entry points are new and the skill should teach them: `compliance attest` (Type II recurring-scan attestation over a directory of prior scans; exit 3 on an empty history), and `--sla-policy <file>` / `--compliance-history <dir>`, which reach the SLA/MTTR engine. A startup posture veto refuses `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path (exit 2). ⚠️ Two corrections to this package's own prose: the `compliance_check` disclosure now carries the WITHDRAWN marker so an instrument can tell it from a claim, and the Enterprise row no longer calls plugin 1023 a cloud auditor — it scores zero-trust posture from a NETWORK-host scan and cannot be run by selecting it with `--plugins`. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
 
 > **Prior:** 0.2.34 (post-EE-0.32.11 — **a correction release.** The Verification Engine was WITHDRAWN at EE 0.32.7; this package went on presenting it as a shipped Phase 4, glossing `VERIFIED` as probe-confirmed, and selling "verification probes" in the pricing table. All corrected — the status enum stays, the active-probe gloss goes, and findings are stated to be emitted UNVERIFIED. Upstream: `scan_cloud` summaries now surface the INFO tier and `deferredScope` boundaries; a new `compliance_matrix` MCP tool returns the shipped coverage matrix for any of the seven frameworks, derived at call time; `pdfExport` withdrawn and every capability now ships a description. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.)
 
@@ -222,6 +224,16 @@ mapping the engine did not emit, and never claim an MCP call produced a pack.
 
 ---
 
+### Suppressions — the workflow SHIPS, the signature does NOT (post EE 0.33.1)
+
+An operator can mark a finding as accepted-risk or false-positive. That suppression workflow **ships and is reachable**: a suppressed finding renders with status `FALSE_POSITIVE`, set by an operator rather than by a probe, and the suppression is applied before the pack is written — so it sits **inside** the hashed artifact rather than being independently attested.
+
+⚠️ **Ed25519 SIGNING of suppressions is implemented in the package but NOT REACHABLE — no shipped entry point signs a suppression, so no first-party run produces a signed one.** The signer backends and the frozen `algorithm` / `backend` record fields are groundwork, deliberately landed before reachability because retrofitting algorithm agility once signatures exist in customer archives would break every auditor holding one. Setting `NSAUDITOR_SIGNING_KEY` changes nothing today, because nothing calls the signer.
+
+**Never tell an operator their suppressions are cryptographically signed** — not even in the softer form "signed once you configure a key". If asked what the SHA-256 chain-of-custody covers: it proves the pack was not altered after generation. It does **not** attest who suppressed a finding, when, or with what justification, and an assessor asking about suppressions usually wants the second thing.
+
+⚠️ **Disambiguation:** "suppression" also appears in this package in the unrelated **AWS SES email suppression list** sense (plugin 1190). They are different subjects; check which one is being asked about.
+
 ## Five-Phase Pipeline Architecture
 
 NSAuditor AI follows an institutional five-phase pipeline:
@@ -432,7 +444,7 @@ Add to your MCP configuration with the same command/args pattern.
 |---------|-------|-------------|
 | **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, CTEM, SARIF, scan history |
 | **Pro** | $49/mo | + CVE matching, risk scoring, analysis agents, Pro plugins (040 TLS / 050 TRIBE / 060 DNS) |
-| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors covering AWS / GCP / Azure plus `1023 Zero Trust Assessment` (which declares no cloud provider and scores zero-trust posture from a NETWORK-host scan — it never runs on a cloud pass, and selecting it by id on its own does not run it either) — against seven frameworks (SOC 2 10 covered + 4 partial; HIPAA; NIST CSF 2.0; PCI DSS v4.0.1; ISO/IEC 27001:2022; CIS Controls v8; GDPR Art. 32 infrastructure substrate); SOC 2 evidence-pack generation; SHA-256 chain-of-custody attestations (RFC 3161 timestamping is implemented but not yet wired to a flag — do not quote it as shipping); air-gapped operation (offline licensing + offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`) |
+| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors covering AWS / GCP / Azure plus `1023 Zero Trust Assessment` (which declares no cloud provider and scores zero-trust posture from a NETWORK-host scan — it never runs on a cloud pass, and selecting it by id on its own does not run it either) — against seven frameworks (SOC 2 10 covered + 4 partial; HIPAA; NIST CSF 2.0; PCI DSS v4.0.1; ISO/IEC 27001:2022; CIS Controls v8; GDPR Art. 32 infrastructure substrate); SOC 2 evidence-pack generation; SHA-256 chain-of-custody attestations (RFC 3161 timestamping is opt-in via the `NSAUDITOR_TSA_URL` environment variable — there is no CLI flag and no default, it makes an outbound call to the Time-Stamp Authority you name, and it was exercised against a live Time-Stamp Authority on BOTH delivery vehicles — the npm path and, from inside the pushed `:0.33.0` Marketplace image, on 2026-08-08; retained images `:0.32.11` and earlier carry no `openssl`); air-gapped operation (offline licensing + offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`) |
 
 → [Pricing](https://www.nsauditor.com/ai/pricing/)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",