nsauditor-ai-agent-skill 0.2.39 → 0.2.40

package/CHANGELOG.md

@@ -4,6 +4,33 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.40 (2026-08-15) — post-EE 0.37.0: offline CVE data can be hand-carried
+
+**Requires CE >= 0.2.42** — raised, because the new entry points live in CE.
+
+Enterprise 0.37.0 ships `feed bundle` and `feed import` — delivered as a **restricted** distribution, amd64 only.
+They merge NVD feed files downloaded on a connected host into one archive, carry it, and import it
+into the offline store on an isolated host. What an agent working with these artifacts must know:
+
+- **`feed bundle` bundles the FEEDS YOU DOWNLOADED, never "your database".** The offline store is a
+  lossy derivation of an NVD feed and cannot be turned back into one. Do not describe this as a
+  store export, and do not tell an operator it will back up their store.
+- **No KEV or EPSS data ships with the product.** `--kev` / `--epss` carry the operator's own
+  downloads from CISA and FIRST. "Exploit intelligence ships with NSAuditor" is wrong.
+- **A bundle is integrity-checked, not authenticated.** The recorded SHA-256 detects alteration in
+  transit; it cannot establish authorship, because it travels inside the archive it covers. Never
+  describe an imported bundle as trusted or verified-as-genuine.
+- **Import skips about a quarter of a real NVD year file by design** — withdrawn CVEs and entries
+  with no CPE match data. That is not data loss. Malformed records are a different signal and mean
+  re-download.
+- **The air-gap delivery claims are EARNED BACK at this release** — offline installation tarball,
+  install script, feed-import CLI and air-gapped deployment. Teach them WITH their conditions, which
+  are part of the claim: the bundle is a **restricted** distribution (not a public `npm install`) and
+  it is **amd64** only. **arm64 images remain WITHDRAWN**, so never describe an arm64 enclave as
+  supported.
+
+---
+
 ## 0.2.39 (2026-08-13) — post-EE 0.36.0: the report verifies the signatures it renders
 
 **Requires CE >= 0.2.40** (unchanged — nothing this cycle needs new CE code).

package/README.md

@@ -18,9 +18,13 @@ environment setting behind them.
 ⚠️ **What the skill must teach accurately about this release, because it is easy to overstate:**
 `NSAUDITOR_SIGNING_KEY` is not a new variable — it existed and was inert. As of Enterprise 0.35.0
 it is **CONSUMED**: `compliance suppress` signs the approval it writes when the variable names a
-local Ed25519 key — a capability that is **reachable and not yet proven**, because its verification
-gate has not run against published bytes — so an agent must never present a produced signature as verified
-evidence, and must never use the bare word "signed" without that qualifier. The commands are
+local Ed25519 key — reachable, and PROVEN as of EE 0.36.0 per approver holding key material.
+Its verification
+gate ran against the published bytes and passed, with a length-preserving tamper rendering
+`signature FAILED verification` as the negative control. An agent may describe a produced signature
+as verified evidence **for approvers whose registry entry carries key material** — for a
+fingerprint-only entry a report reads `not checked by this report`, which records that no check ran
+and never that one failed, and must not be reported as tampering. The commands are
 **CLI-only**; no MCP tool reaches them, so an agent asked to record an approval must shell out
 rather than look for a tool.
 
@@ -132,7 +136,7 @@ This package provides **knowledge about** NSAuditor AI. To actually **run** scan
 |---------|-------|-----------|
 | **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, SARIF, CTEM, scan history |
 | **Pro** | $49/mo | + CVE matching, risk scoring, 3 Pro plugins (040 TLS / 050 TRIBE / 060 DNS) |
-| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors across AWS / Azure / GCP plus `1023 Zero Trust Assessment`, which scores zero-trust posture from a NETWORK-host scan and does not run on a cloud pass, seven-framework evidence-pack (SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 / ISO 27001:2022 / CIS Controls v8 / GDPR Art. 32), SHA-256 chain-of-custody attestations, the suppression-approval CLI with opt-in Ed25519 signing (reachable from EE 0.35.0, not yet proven), air-gapped operation (offline licensing + offline CVE matching) |
+| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors across AWS / Azure / GCP plus `1023 Zero Trust Assessment`, which scores zero-trust posture from a NETWORK-host scan and does not run on a cloud pass, seven-framework evidence-pack (SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 / ISO 27001:2022 / CIS Controls v8 / GDPR Art. 32), SHA-256 chain-of-custody attestations, the suppression-approval CLI with opt-in Ed25519 signing (reachable from EE 0.35.0, proven 0.36.0, verified per approver holding key material), air-gapped operation (offline licensing + offline CVE matching) |
 
 → [Pricing](https://www.nsauditor.com/ai/pricing/)
 

package/SKILL.md

@@ -16,9 +16,11 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.39 (post-EE-0.36.0 · **requires CE ≥ 0.2.40**) — the verification release. Every compliance report now cryptographically checks each suppression signature — the Ed25519 suppression-signing capability this exercises stays **not yet proven**, its verification gate not having run against published bytes, and writes `report.signatureVerification`. A MISSING verdict means NOT CHECKED, never failed; `cryptoValid` is absent when unanswerable, never `false`. Ed25519 suppression signing stays **not yet proven** — its gate has not run against published bytes.
+> **Version:** 0.2.40 (post-EE-0.37.0 · **requires CE ≥ 0.2.42**) — the air-gap feed release. `feed bundle` and `feed import` let NVD feed files downloaded on a connected host be merged into one archive, hand-carried, and imported into the offline store on an isolated host — delivered as a **restricted** distribution rather than a public `npm install`, and amd64 only. ⚠️ Teach these precisely: **`feed bundle` bundles the FEEDS YOU DOWNLOADED, never "your database"** — the offline store is a lossy derivation of an NVD feed and cannot be turned back into one, so never describe this as a store export or a backup. **No KEV or EPSS data ships with the product**; `--kev` / `--epss` carry the operator's own downloads from CISA and FIRST, and `--extras-dir` places them on import and prints the environment lines to set. **A bundle is integrity-checked, NOT authenticated** — the recorded SHA-256 detects alteration in transit but cannot establish authorship, because it travels inside the archive it covers; never describe an imported bundle as trusted or verified-as-genuine. **Import skips about a quarter of a real NVD year file by design** (withdrawn CVEs, entries with no CPE match data) — that is not data loss, while malformed records are a different signal meaning re-download. The air-gap delivery claims are EARNED BACK at this release — offline installation tarball, install script, feed-import CLI and air-gapped deployment — because the artifacts exist and the delivery gate passes on the built bytes. Teach them WITH their conditions, which are part of the claim and not footnotes: the bundle is a **restricted** distribution rather than a public `npm install`, and it is **amd64** only. **arm64 images remain WITHDRAWN** — never describe an arm64 enclave as supported.
 >
-> **Prior:** 0.2.38 (post-EE-0.35.0 · **requires CE ≥ 0.2.40**) — the approval-surface release. Four Enterprise commands are now reachable from the CLI: `compliance suppress | review | renew | keygen`. `keygen` creates an Ed25519 approval keypair for a capability that is not yet proven, writes the private half `0600` and prints an identity-registry member to paste; it refuses to overwrite an existing signing key. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature — the expiry and the renewal record live inside the signed payload, so the record afterwards reads `signature does not match payload`, which an auditor cannot distinguish from real tampering. ⚠️ **Teach this precisely: Ed25519 suppression signing is now REACHABLE and NOT YET PROVEN.** The verification gate has not run against published bytes, so never present a produced signature as verified evidence and never use the bare word "signed" without that qualifier. These commands are CLI-only — they are not MCP-reachable. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+> **Prior:** 0.2.39 (post-EE-0.36.0 · **requires CE ≥ 0.2.40**) — the verification release. Every compliance report now cryptographically checks each suppression signature — the Ed25519 suppression-signing capability this exercises is **proven as of EE 0.36.0 and verified for approvers whose registry entry carries key material**, its verification gate having run against the published bytes and passed — and writes `report.signatureVerification`. A MISSING verdict means NOT CHECKED, never failed; `cryptoValid` is absent when unanswerable, never `false`. Verification runs for approvers whose registry entry carries key material.
+>
+> **Prior:** 0.2.38 (post-EE-0.35.0 · **requires CE ≥ 0.2.40**) — the approval-surface release. Four Enterprise commands are now reachable from the CLI: `compliance suppress | review | renew | keygen`. `keygen` creates an Ed25519 approval keypair for a capability that was not yet proven at that release, writes the private half `0600` and prints an identity-registry member to paste; it refuses to overwrite an existing signing key. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature — the expiry and the renewal record live inside the signed payload, so the record afterwards reads `signature does not match payload`, which an auditor cannot distinguish from real tampering. ⚠️ **Teach this precisely: Ed25519 suppression signing became REACHABLE at that release and was NOT YET PROVEN then. It was PROVEN at EE 0.36.0** — the verification gate ran against the published bytes and passed. Verification runs for approvers whose registry entry carries key material; for a fingerprint-only entry a report reads `not checked`, which records that no check ran and never that one failed. These commands are CLI-only — they are not MCP-reachable. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
 >
 > **Prior:** 0.2.37 (post-EE-0.34.0 · **requires CE ≥ 0.2.39**) — the exploit-intelligence release. Enterprise findings that carry CVEs are joined by CVE-ID against a local **CISA KEV** catalog and a local **FIRST EPSS** scores file, banded `KNOWN_EXPLOITED` / `ELEVATED` / `BASELINE`, and the finding queue is ordered exploit-first — a KEV-listed MEDIUM outranks an unexploited CRITICAL. ⚠️ Teach this accurately: **no feed data ships with the product.** Both stores are operator-populated via `NSAUDITOR_EXPLOIT_KEV_STORE` / `NSAUDITOR_EXPLOIT_EPSS_STORE`, the same rule as the offline NVD store, and both **fail closed when stale** (KEV 14-day / EPSS 10-day windows) so an out-of-date catalog never reports "not exploited". `riskScore` is UNCHANGED — `exploitPriority` is a new axis beside it, not a re-weighting. ⚠️ One correction to this package's own prose: the risk score is **CVSS weighted by verification status with an initial-access uplift**, not "severity × exploitability × impact × exposure" — that phrasing named an exploitability input that did not exist until this release. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
 
@@ -232,7 +234,7 @@ mapping the engine did not emit, and never claim an MCP call produced a pack.
 
 An operator can mark a finding as accepted-risk or false-positive. That suppression workflow **ships and is reachable**: a suppressed finding renders with status `FALSE_POSITIVE`, set by an operator rather than by a probe, and the suppression is applied before the pack is written — so it sits **inside** the hashed artifact rather than being independently attested.
 
-⚠️ **Ed25519 SIGNING of suppressions became reachable in EE 0.35.0 via `compliance suppress`, and is NOT YET PROVEN — the verification gate has not run against published bytes, so never present a produced signature as verified evidence.** The signer backends and the frozen `algorithm` / `backend` record fields are groundwork, deliberately landed before reachability because retrofitting algorithm agility once signatures exist in customer archives would break every auditor holding one. Setting `NSAUDITOR_SIGNING_KEY` changes nothing today, because nothing calls the signer.
+⚠️ **Ed25519 SIGNING of suppressions became reachable in EE 0.35.0 via `compliance suppress` and was PROVEN at EE 0.36.0, verified for approvers whose registry entry carries key material** — the verification gate ran against the published bytes and passed, tamper negative control included. Present a produced signature as verified evidence only **for approvers whose registry entry carries key material**; a fingerprint-only registry entry makes a report read `not checked by this report`, which records that no check ran and must never be reported as a failure. The signer backends and the frozen `algorithm` / `backend` record fields are groundwork, deliberately landed before reachability because retrofitting algorithm agility once signatures exist in customer archives would break every auditor holding one. Setting `NSAUDITOR_SIGNING_KEY` changes nothing today, because nothing calls the signer.
 
 **Never tell an operator their suppressions are cryptographically signed** — not even in the softer form "signed once you configure a key". If asked what the SHA-256 chain-of-custody covers: it proves the pack was not altered after generation. It does **not** attest who suppressed a finding, when, or with what justification, and an assessor asking about suppressions usually wants the second thing.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.39",
+  "version": "0.2.40",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",