nsauditor-ai-agent-skill 0.2.39 → 0.2.41

package/CHANGELOG.md

@@ -4,6 +4,51 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.41 (2026-08-17) — post-EE 0.38.0: the evidence pack can be signed
+
+**Requires CE >= 0.2.43** — both new verbs are routed from CE.
+
+Enterprise 0.38.0 ships `compliance sign-pack` and `compliance verify-pack` — reachable, **not yet** proven. The skill teaches the
+scope precisely, because this is the claim most easily overstated: a verified signature proves the
+holder of a key asserted authorship of **one framework's** chain-of-custody envelope at a stated
+time, relative to **operator** key custody. It is never a vendor attestation, never proof the scan
+ran, and never proof the findings are true — and it covers that envelope plus the four artifacts it
+enumerates, not the directory and not the pack.
+
+Also taught: `verify-pack` recomputes every enumerated artifact hash as well as checking the
+signature (so an edited report fails while the signature still reads VERIFIED); the two trust
+anchors and what the `--public-key` arm discloses it skipped; and the exit contract, where **2**
+means the run could not measure and is never a failure.
+
+Correction carried from EE: a **gzipped** KEV/EPSS store loaded with zero entries, so exploit
+banding reported *no store* rather than a band. Misdiagnosis, not a false security verdict.
+
+## 0.2.40 (2026-08-15) — post-EE 0.37.0: offline CVE data can be hand-carried
+
+**Requires CE >= 0.2.42** — raised, because the new entry points live in CE.
+
+Enterprise 0.37.0 ships `feed bundle` and `feed import` — delivered as a **restricted** distribution, amd64 only.
+They merge NVD feed files downloaded on a connected host into one archive, carry it, and import it
+into the offline store on an isolated host. What an agent working with these artifacts must know:
+
+- **`feed bundle` bundles the FEEDS YOU DOWNLOADED, never "your database".** The offline store is a
+  lossy derivation of an NVD feed and cannot be turned back into one. Do not describe this as a
+  store export, and do not tell an operator it will back up their store.
+- **No KEV or EPSS data ships with the product.** `--kev` / `--epss` carry the operator's own
+  downloads from CISA and FIRST. "Exploit intelligence ships with NSAuditor" is wrong.
+- **A bundle is integrity-checked, not authenticated.** The recorded SHA-256 detects alteration in
+  transit; it cannot establish authorship, because it travels inside the archive it covers. Never
+  describe an imported bundle as trusted or verified-as-genuine.
+- **Import skips about a quarter of a real NVD year file by design** — withdrawn CVEs and entries
+  with no CPE match data. That is not data loss. Malformed records are a different signal and mean
+  re-download.
+- **The air-gap delivery claims are EARNED BACK at this release, as a restricted distribution, amd64 only** — the offline installation tarball is restricted, the install script is restricted, the feed-import CLI moves the feeds you downloaded, and air-gapped deployment is restricted and amd64 only. Teach them WITH those conditions, which
+  are part of the claim: the bundle is a **restricted** distribution (not a public `npm install`) and
+  it is **amd64** only. **arm64 images remain WITHDRAWN**, so never describe an arm64 enclave as
+  supported.
+
+---
+
 ## 0.2.39 (2026-08-13) — post-EE 0.36.0: the report verifies the signatures it renders
 
 **Requires CE >= 0.2.40** (unchanged — nothing this cycle needs new CE code).

package/README.md

@@ -11,16 +11,34 @@ Works with **Claude Code**, **Claude Desktop**, **Cursor**, **Windsurf**, **VS C
 
 ## Current release
 
-**0.2.38** — paired with **Enterprise 0.35.0 / Community 0.2.40**. Teaches the four new
-suppression-approval commands (`compliance suppress | review | renew | keygen`) and the
-environment setting behind them.
+**0.2.41** — paired with **Enterprise 0.38.0 / Community 0.2.43**. Not yet proven: the two new pack-signing
+commands (`compliance sign-pack | verify-pack`) — reachable, **not yet** proven by the gate that runs
+against published bytes — and the exact scope of what a verified pack signature does and does not
+establish.
+
+⚠️ **What the skill must teach accurately about THIS release, because it is the claim most easily
+overstated:** a verified signature proves the holder of a key asserted authorship of **one
+framework's** chain-of-custody envelope at a stated time, **relative to operator key custody**. It
+is never a vendor attestation, never proof the scan ran, and never proof the findings are true. It
+covers that envelope plus the four artifacts it enumerates — **not the directory and not the pack**;
+a seven-framework pack holds 74 files and no object in it enumerates the set. `verify-pack` also
+recomputes every enumerated artifact hash against disk, so an edited report fails while the
+signature itself still reads VERIFIED. And exit **2** means the run could not measure — an unsigned
+pack, an unsupplied key or a registry member with no key material — which an agent must never
+report as a verification failure.
+
+*(The suppression-approval material below is retained; it remains accurate.)*
 
 ⚠️ **What the skill must teach accurately about this release, because it is easy to overstate:**
 `NSAUDITOR_SIGNING_KEY` is not a new variable — it existed and was inert. As of Enterprise 0.35.0
 it is **CONSUMED**: `compliance suppress` signs the approval it writes when the variable names a
-local Ed25519 key — a capability that is **reachable and not yet proven**, because its verification
-gate has not run against published bytes — so an agent must never present a produced signature as verified
-evidence, and must never use the bare word "signed" without that qualifier. The commands are
+local Ed25519 key — reachable, and PROVEN as of EE 0.36.0 per approver holding key material.
+Its verification
+gate ran against the published bytes and passed, with a length-preserving tamper rendering
+`signature FAILED verification` as the negative control. An agent may describe a produced signature
+as verified evidence **for approvers whose registry entry carries key material** — for a
+fingerprint-only entry a report reads `not checked by this report`, which records that no check ran
+and never that one failed, and must not be reported as tampering. The commands are
 **CLI-only**; no MCP tool reaches them, so an agent asked to record an approval must shell out
 rather than look for a tool.
 
@@ -132,7 +150,7 @@ This package provides **knowledge about** NSAuditor AI. To actually **run** scan
 |---------|-------|-----------|
 | **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, SARIF, CTEM, scan history |
 | **Pro** | $49/mo | + CVE matching, risk scoring, 3 Pro plugins (040 TLS / 050 TRIBE / 060 DNS) |
-| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors across AWS / Azure / GCP plus `1023 Zero Trust Assessment`, which scores zero-trust posture from a NETWORK-host scan and does not run on a cloud pass, seven-framework evidence-pack (SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 / ISO 27001:2022 / CIS Controls v8 / GDPR Art. 32), SHA-256 chain-of-custody attestations, the suppression-approval CLI with opt-in Ed25519 signing (reachable from EE 0.35.0, not yet proven), air-gapped operation (offline licensing + offline CVE matching) |
+| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors across AWS / Azure / GCP plus `1023 Zero Trust Assessment`, which scores zero-trust posture from a NETWORK-host scan and does not run on a cloud pass, seven-framework evidence-pack (SOC 2 / HIPAA / NIST CSF 2.0 / PCI DSS v4.0.1 / ISO 27001:2022 / CIS Controls v8 / GDPR Art. 32), SHA-256 chain-of-custody attestations, the suppression-approval CLI with opt-in Ed25519 signing (reachable from EE 0.35.0, proven 0.36.0, verified per approver holding key material), air-gapped operation (offline licensing + offline CVE matching) |
 
 → [Pricing](https://www.nsauditor.com/ai/pricing/)
 

package/SKILL.md

@@ -16,9 +16,13 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.39 (post-EE-0.36.0 · **requires CE ≥ 0.2.40**) — the verification release. Every compliance report now cryptographically checks each suppression signature — the Ed25519 suppression-signing capability this exercises stays **not yet proven**, its verification gate not having run against published bytes, and writes `report.signatureVerification`. A MISSING verdict means NOT CHECKED, never failed; `cryptoValid` is absent when unanswerable, never `false`. Ed25519 suppression signing stays **not yet proven** — its gate has not run against published bytes.
+> **Version:** 0.2.41 (post-EE-0.38.0 · **requires CE ≥ 0.2.43**) — the pack-signing release, reachable and **not yet** proven by the published-bytes gate. `compliance sign-pack` signs a chain-of-custody envelope with an operator-held Ed25519 key (reachable, **not yet** proven); `compliance verify-pack` establishes authorship AND recomputes every enumerated artifact hash against disk. A verified signature proves the holder of a key asserted authorship of ONE framework's envelope, relative to operator key custody — never a vendor attestation, never proof the scan ran. It covers that envelope and its four artifacts, not the pack. Exit 2 means the run could not measure and is never a failure.
 >
-> **Prior:** 0.2.38 (post-EE-0.35.0 · **requires CE ≥ 0.2.40**) — the approval-surface release. Four Enterprise commands are now reachable from the CLI: `compliance suppress | review | renew | keygen`. `keygen` creates an Ed25519 approval keypair for a capability that is not yet proven, writes the private half `0600` and prints an identity-registry member to paste; it refuses to overwrite an existing signing key. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature — the expiry and the renewal record live inside the signed payload, so the record afterwards reads `signature does not match payload`, which an auditor cannot distinguish from real tampering. ⚠️ **Teach this precisely: Ed25519 suppression signing is now REACHABLE and NOT YET PROVEN.** The verification gate has not run against published bytes, so never present a produced signature as verified evidence and never use the bare word "signed" without that qualifier. These commands are CLI-only — they are not MCP-reachable. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
+> **Prior:** 0.2.40 (post-EE-0.37.0 · **requires CE ≥ 0.2.42**) — the air-gap feed release. `feed bundle` and `feed import` let NVD feed files downloaded on a connected host be merged into one archive, hand-carried, and imported into the offline store on an isolated host — delivered as a **restricted** distribution rather than a public `npm install`, and amd64 only. ⚠️ Teach these precisely: **`feed bundle` bundles the FEEDS YOU DOWNLOADED, never "your database"** — the offline store is a lossy derivation of an NVD feed and cannot be turned back into one, so never describe this as a store export or a backup. **No KEV or EPSS data ships with the product**; `--kev` / `--epss` carry the operator's own downloads from CISA and FIRST, and `--extras-dir` places them on import and prints the environment lines to set. **A bundle is integrity-checked, NOT authenticated** — the recorded SHA-256 detects alteration in transit but cannot establish authorship, because it travels inside the archive it covers; never describe an imported bundle as trusted or verified-as-genuine. **Import skips about a quarter of a real NVD year file by design** (withdrawn CVEs, entries with no CPE match data) — that is not data loss, while malformed records are a different signal meaning re-download. The air-gap delivery claims are EARNED BACK at this release, every one of them as a **restricted** distribution and **amd64 only** — the offline installation tarball is restricted, the install script is restricted, the feed-import CLI moves the feeds you downloaded, and air-gapped deployment is restricted and amd64 only — because the artifacts exist and the delivery gate passes on the built bytes. Teach them WITH their conditions, which are part of the claim and not footnotes: the bundle is a **restricted** distribution rather than a public `npm install`, and it is **amd64** only. **arm64 images remain WITHDRAWN** — never describe an arm64 enclave as supported.
+>
+> **Prior:** 0.2.39 (post-EE-0.36.0 · **requires CE ≥ 0.2.40**) — the verification release. Every compliance report now cryptographically checks each suppression signature — the Ed25519 suppression-signing capability this exercises is **proven as of EE 0.36.0 and verified for approvers whose registry entry carries key material**, its verification gate having run against the published bytes and passed — and writes `report.signatureVerification`. A MISSING verdict means NOT CHECKED, never failed; `cryptoValid` is absent when unanswerable, never `false`. Verification runs for approvers whose registry entry carries key material.
+>
+> **Prior:** 0.2.38 (post-EE-0.35.0 · **requires CE ≥ 0.2.40**) — the approval-surface release. Four Enterprise commands are now reachable from the CLI: `compliance suppress | review | renew | keygen`. `keygen` creates an Ed25519 approval keypair for a capability that was not yet proven at that release, writes the private half `0600` and prints an identity-registry member to paste; it refuses to overwrite an existing signing key. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature — the expiry and the renewal record live inside the signed payload, so the record afterwards reads `signature does not match payload`, which an auditor cannot distinguish from real tampering. ⚠️ **Teach this precisely: Ed25519 suppression signing became REACHABLE at that release and was NOT YET PROVEN then. It was PROVEN at EE 0.36.0** — the verification gate ran against the published bytes and passed. Verification runs for approvers whose registry entry carries key material; for a fingerprint-only entry a report reads `not checked`, which records that no check ran and never that one failed. These commands are CLI-only — they are not MCP-reachable. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
 >
 > **Prior:** 0.2.37 (post-EE-0.34.0 · **requires CE ≥ 0.2.39**) — the exploit-intelligence release. Enterprise findings that carry CVEs are joined by CVE-ID against a local **CISA KEV** catalog and a local **FIRST EPSS** scores file, banded `KNOWN_EXPLOITED` / `ELEVATED` / `BASELINE`, and the finding queue is ordered exploit-first — a KEV-listed MEDIUM outranks an unexploited CRITICAL. ⚠️ Teach this accurately: **no feed data ships with the product.** Both stores are operator-populated via `NSAUDITOR_EXPLOIT_KEV_STORE` / `NSAUDITOR_EXPLOIT_EPSS_STORE`, the same rule as the offline NVD store, and both **fail closed when stale** (KEV 14-day / EPSS 10-day windows) so an out-of-date catalog never reports "not exploited". `riskScore` is UNCHANGED — `exploitPriority` is a new axis beside it, not a re-weighting. ⚠️ One correction to this package's own prose: the risk score is **CVSS weighted by verification status with an initial-access uplift**, not "severity × exploitability × impact × exposure" — that phrasing named an exploitability input that did not exist until this release. Plugin catalog UNCHANGED at 28 EE / 55 overall; all seven matrices UNCHANGED.
 
@@ -232,7 +236,7 @@ mapping the engine did not emit, and never claim an MCP call produced a pack.
 
 An operator can mark a finding as accepted-risk or false-positive. That suppression workflow **ships and is reachable**: a suppressed finding renders with status `FALSE_POSITIVE`, set by an operator rather than by a probe, and the suppression is applied before the pack is written — so it sits **inside** the hashed artifact rather than being independently attested.
 
-⚠️ **Ed25519 SIGNING of suppressions became reachable in EE 0.35.0 via `compliance suppress`, and is NOT YET PROVEN — the verification gate has not run against published bytes, so never present a produced signature as verified evidence.** The signer backends and the frozen `algorithm` / `backend` record fields are groundwork, deliberately landed before reachability because retrofitting algorithm agility once signatures exist in customer archives would break every auditor holding one. Setting `NSAUDITOR_SIGNING_KEY` changes nothing today, because nothing calls the signer.
+⚠️ **Ed25519 SIGNING of suppressions became reachable in EE 0.35.0 via `compliance suppress` and was PROVEN at EE 0.36.0, verified for approvers whose registry entry carries key material** — the verification gate ran against the published bytes and passed, tamper negative control included. Present a produced signature as verified evidence only **for approvers whose registry entry carries key material**; a fingerprint-only registry entry makes a report read `not checked by this report`, which records that no check ran and must never be reported as a failure. The signer backends and the frozen `algorithm` / `backend` record fields are groundwork, deliberately landed before reachability because retrofitting algorithm agility once signatures exist in customer archives would break every auditor holding one. Setting `NSAUDITOR_SIGNING_KEY` changes nothing today, because nothing calls the signer.
 
 **Never tell an operator their suppressions are cryptographically signed** — not even in the softer form "signed once you configure a key". If asked what the SHA-256 chain-of-custody covers: it proves the pack was not altered after generation. It does **not** attest who suppressed a finding, when, or with what justification, and an assessor asking about suppressions usually wants the second thing.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.39",
+  "version": "0.2.41",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",