nsauditor-ai-agent-skill 0.2.36 → 0.2.38

package/CHANGELOG.md

@@ -4,6 +4,33 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.38 (2026-08-12) — post-EE-0.35.0: the suppression-approval commands are reachable
+
+Paired with EE 0.35.0 / CE 0.2.40. Four Enterprise commands reach the CLI — `compliance suppress | review | renew | keygen` — so the suppression-approval workflow has an operator entry point for the first time. ⚠️ The skill's own prose is corrected with them: Ed25519 suppression signing was taught as NOT REACHABLE, which this release makes false. It is now **reachable and not yet proven** — the verification gate has not run against published bytes, so a produced signature must never be presented as verified evidence. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+
+
+## 0.2.37 (2026-08-10) — post-EE-0.34.0: teach exploit intelligence, and stop teaching a risk-score formula the code never used
+
+Enterprise findings carrying CVEs are joined by CVE-ID against a local **CISA KEV** catalog and a
+local **FIRST EPSS** scores file, banded `KNOWN_EXPLOITED` / `ELEVATED` / `BASELINE`, with the
+finding queue ordered exploit-first.
+
+Two things an agent must get right when it explains this:
+
+1. **No feed data ships with the product.** Both stores are operator-populated via
+   `NSAUDITOR_EXPLOIT_KEV_STORE` / `NSAUDITOR_EXPLOIT_EPSS_STORE` — the same rule as the offline
+   NVD store — and both fail closed when stale (KEV 14-day / EPSS 10-day windows), so an
+   out-of-date catalog never reports "not exploited". Never describe the feeds as included.
+2. **`riskScore` is unchanged.** `exploitPriority` is a new axis beside it, not a re-weighting.
+
+Corrected in this package's own prose: the risk score is **CVSS weighted by verification status
+with an initial-access uplift**, not "severity x exploitability x impact x exposure" — that
+phrasing named an exploitability input that did not exist until EE 0.34.0.
+
+Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+
+---
+
 ## 0.2.36 (2026-08-07) — the opt-in RFC 3161 wording corrected: a hedge that had outlived its measurement
 
 `SKILL.md` described RFC 3161 timestamping as *"implemented but not yet wired to a flag — do

package/README.md

@@ -9,6 +9,23 @@ An installable knowledge package that teaches AI coding agents how to use NSAudi
 
 Works with **Claude Code**, **Claude Desktop**, **Cursor**, **Windsurf**, **VS Code Copilot**, and any MCP-aware agent.
 
+## Current release
+
+**0.2.38** — paired with **Enterprise 0.35.0 / Community 0.2.40**. Teaches the four new
+suppression-approval commands (`compliance suppress | review | renew | keygen`) and the
+environment setting behind them.
+
+⚠️ **What the skill must teach accurately about this release, because it is easy to overstate:**
+`NSAUDITOR_SIGNING_KEY` is not a new variable — it existed and was inert. As of Enterprise 0.35.0
+it is **CONSUMED**: `compliance suppress` signs the approval it writes when the variable names a
+local Ed25519 key — a capability that is **reachable and not yet proven**, because its verification
+gate has not run against published bytes — so an agent must never present a produced signature as verified
+evidence, and must never use the bare word "signed" without that qualifier. The commands are
+**CLI-only**; no MCP tool reaches them, so an agent asked to record an approval must shell out
+rather than look for a tool.
+
+See [CHANGELOG.md](CHANGELOG.md) for the full history.
+
 ## What's Inside
 
 ```
@@ -115,7 +132,7 @@ This package provides **knowledge about** NSAuditor AI. To actually **run** scan
 |---------|-------|-----------|
 | **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, SARIF, CTEM, scan history |
 | **Pro** | $49/mo | + CVE matching, risk scoring, 3 Pro plugins (040 TLS / 050 TRIBE / 060 DNS) |
-| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors across AWS / Azure / GCP plus `1023 Zero Trust Assessment`, which scores zero-trust posture from a NETWORK-host scan and does not run on a cloud pass, seven-framework evidence-pack (SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 / ISO 27001:2022 / CIS Controls v8 / GDPR Art. 32), SHA-256 chain-of-custody attestations, air-gapped operation (offline licensing + offline CVE matching) |
+| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors across AWS / Azure / GCP plus `1023 Zero Trust Assessment`, which scores zero-trust posture from a NETWORK-host scan and does not run on a cloud pass, seven-framework evidence-pack (SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 / ISO 27001:2022 / CIS Controls v8 / GDPR Art. 32), SHA-256 chain-of-custody attestations, the suppression-approval CLI with opt-in Ed25519 signing (reachable from EE 0.35.0, not yet proven), air-gapped operation (offline licensing + offline CVE matching) |
 
 → [Pricing](https://www.nsauditor.com/ai/pricing/)
 

package/SKILL.md

@@ -16,7 +16,11 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.36 (post-EE-0.33.0 · **requires CE ≥ 0.2.37**) — a wording-only patch on top of the wiring release: the RFC 3161 row said the capability was "implemented but not yet wired to a flag", which EE 0.33.0 falsified and the live-TSA smokes then falsified twice over (npm path 2026-08-07, from inside the `:0.33.0` container image 2026-08-08). It is opt-in via `NSAUDITOR_TSA_URL`, proven on both delivery vehicles, and the only surviving caveat is version scope — retained images `:0.32.11` and earlier carry no `openssl`. **Prior:** 0.2.35 — the wiring release. Three CE entry points are new and the skill should teach them: `compliance attest` (Type II recurring-scan attestation over a directory of prior scans; exit 3 on an empty history), and `--sla-policy <file>` / `--compliance-history <dir>`, which reach the SLA/MTTR engine. A startup posture veto refuses `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path (exit 2). ⚠️ Two corrections to this package's own prose: the `compliance_check` disclosure now carries the WITHDRAWN marker so an instrument can tell it from a claim, and the Enterprise row no longer calls plugin 1023 a cloud auditor — it scores zero-trust posture from a NETWORK-host scan and cannot be run by selecting it with `--plugins`. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+> **Version:** 0.2.38 (post-EE-0.35.0 · **requires CE ≥ 0.2.40**) — the approval-surface release. Four Enterprise commands are now reachable from the CLI: `compliance suppress | review | renew | keygen`. `keygen` creates an Ed25519 approval keypair for a capability that is not yet proven, writes the private half `0600` and prints an identity-registry member to paste; it refuses to overwrite an existing signing key. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature — the expiry and the renewal record live inside the signed payload, so the record afterwards reads `signature does not match payload`, which an auditor cannot distinguish from real tampering. ⚠️ **Teach this precisely: Ed25519 suppression signing is now REACHABLE and NOT YET PROVEN.** The verification gate has not run against published bytes, so never present a produced signature as verified evidence and never use the bare word "signed" without that qualifier. These commands are CLI-only — they are not MCP-reachable. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+>
+> **Prior:** 0.2.37 (post-EE-0.34.0 · **requires CE ≥ 0.2.39**) — the exploit-intelligence release. Enterprise findings that carry CVEs are joined by CVE-ID against a local **CISA KEV** catalog and a local **FIRST EPSS** scores file, banded `KNOWN_EXPLOITED` / `ELEVATED` / `BASELINE`, and the finding queue is ordered exploit-first — a KEV-listed MEDIUM outranks an unexploited CRITICAL. ⚠️ Teach this accurately: **no feed data ships with the product.** Both stores are operator-populated via `NSAUDITOR_EXPLOIT_KEV_STORE` / `NSAUDITOR_EXPLOIT_EPSS_STORE`, the same rule as the offline NVD store, and both **fail closed when stale** (KEV 14-day / EPSS 10-day windows) so an out-of-date catalog never reports "not exploited". `riskScore` is UNCHANGED — `exploitPriority` is a new axis beside it, not a re-weighting. ⚠️ One correction to this package's own prose: the risk score is **CVSS weighted by verification status with an initial-access uplift**, not "severity × exploitability × impact × exposure" — that phrasing named an exploitability input that did not exist until this release. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+
+> **Prior:** 0.2.36 (post-EE-0.33.0 · **requires CE ≥ 0.2.37**) — a wording-only patch on top of the wiring release: the RFC 3161 row said the capability was "implemented but not yet wired to a flag", which EE 0.33.0 falsified and the live-TSA smokes then falsified twice over (npm path 2026-08-07, from inside the `:0.33.0` container image 2026-08-08). It is opt-in via `NSAUDITOR_TSA_URL`, proven on both delivery vehicles, and the only surviving caveat is version scope — retained images `:0.32.11` and earlier carry no `openssl`. **Prior:** 0.2.35 — the wiring release. Three CE entry points are new and the skill should teach them: `compliance attest` (Type II recurring-scan attestation over a directory of prior scans; exit 3 on an empty history), and `--sla-policy <file>` / `--compliance-history <dir>`, which reach the SLA/MTTR engine. A startup posture veto refuses `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path (exit 2). ⚠️ Two corrections to this package's own prose: the `compliance_check` disclosure now carries the WITHDRAWN marker so an instrument can tell it from a claim, and the Enterprise row no longer calls plugin 1023 a cloud auditor — it scores zero-trust posture from a NETWORK-host scan and cannot be run by selecting it with `--plugins`. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
 
 > **Prior:** 0.2.34 (post-EE-0.32.11 — **a correction release.** The Verification Engine was WITHDRAWN at EE 0.32.7; this package went on presenting it as a shipped Phase 4, glossing `VERIFIED` as probe-confirmed, and selling "verification probes" in the pricing table. All corrected — the status enum stays, the active-probe gloss goes, and findings are stated to be emitted UNVERIFIED. Upstream: `scan_cloud` summaries now surface the INFO tier and `deferredScope` boundaries; a new `compliance_matrix` MCP tool returns the shipped coverage matrix for any of the seven frameworks, derived at call time; `pdfExport` withdrawn and every capability now ships a description. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.)
 
@@ -226,7 +230,7 @@ mapping the engine did not emit, and never claim an MCP call produced a pack.
 
 An operator can mark a finding as accepted-risk or false-positive. That suppression workflow **ships and is reachable**: a suppressed finding renders with status `FALSE_POSITIVE`, set by an operator rather than by a probe, and the suppression is applied before the pack is written — so it sits **inside** the hashed artifact rather than being independently attested.
 
-⚠️ **Ed25519 SIGNING of suppressions is implemented in the package but NOT REACHABLE — no shipped entry point signs a suppression, so no first-party run produces a signed one.** The signer backends and the frozen `algorithm` / `backend` record fields are groundwork, deliberately landed before reachability because retrofitting algorithm agility once signatures exist in customer archives would break every auditor holding one. Setting `NSAUDITOR_SIGNING_KEY` changes nothing today, because nothing calls the signer.
+⚠️ **Ed25519 SIGNING of suppressions became reachable in EE 0.35.0 via `compliance suppress`, and is NOT YET PROVEN — the verification gate has not run against published bytes, so never present a produced signature as verified evidence.** The signer backends and the frozen `algorithm` / `backend` record fields are groundwork, deliberately landed before reachability because retrofitting algorithm agility once signatures exist in customer archives would break every auditor holding one. Setting `NSAUDITOR_SIGNING_KEY` changes nothing today, because nothing calls the signer.
 
 **Never tell an operator their suppressions are cryptographically signed** — not even in the softer form "signed once you configure a key". If asked what the SHA-256 chain-of-custody covers: it proves the pack was not altered after generation. It does **not** attest who suppressed a finding, when, or with what justification, and an assessor asking about suppressions usually wants the second thing.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.36",
+  "version": "0.2.38",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",