nsauditor-ai-agent-skill 0.2.40 → 0.2.41

package/CHANGELOG.md

@@ -4,6 +4,25 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.41 (2026-08-17) — post-EE 0.38.0: the evidence pack can be signed
+
+**Requires CE >= 0.2.43** — both new verbs are routed from CE.
+
+Enterprise 0.38.0 ships `compliance sign-pack` and `compliance verify-pack` — reachable, **not yet** proven. The skill teaches the
+scope precisely, because this is the claim most easily overstated: a verified signature proves the
+holder of a key asserted authorship of **one framework's** chain-of-custody envelope at a stated
+time, relative to **operator** key custody. It is never a vendor attestation, never proof the scan
+ran, and never proof the findings are true — and it covers that envelope plus the four artifacts it
+enumerates, not the directory and not the pack.
+
+Also taught: `verify-pack` recomputes every enumerated artifact hash as well as checking the
+signature (so an edited report fails while the signature still reads VERIFIED); the two trust
+anchors and what the `--public-key` arm discloses it skipped; and the exit contract, where **2**
+means the run could not measure and is never a failure.
+
+Correction carried from EE: a **gzipped** KEV/EPSS store loaded with zero entries, so exploit
+banding reported *no store* rather than a band. Misdiagnosis, not a false security verdict.
+
 ## 0.2.40 (2026-08-15) — post-EE 0.37.0: offline CVE data can be hand-carried
 
 **Requires CE >= 0.2.42** — raised, because the new entry points live in CE.
@@ -23,8 +42,7 @@ into the offline store on an isolated host. What an agent working with these art
 - **Import skips about a quarter of a real NVD year file by design** — withdrawn CVEs and entries
   with no CPE match data. That is not data loss. Malformed records are a different signal and mean
   re-download.
-- **The air-gap delivery claims are EARNED BACK at this release** — offline installation tarball,
-  install script, feed-import CLI and air-gapped deployment. Teach them WITH their conditions, which
+- **The air-gap delivery claims are EARNED BACK at this release, as a restricted distribution, amd64 only** — the offline installation tarball is restricted, the install script is restricted, the feed-import CLI moves the feeds you downloaded, and air-gapped deployment is restricted and amd64 only. Teach them WITH those conditions, which
   are part of the claim: the bundle is a **restricted** distribution (not a public `npm install`) and
   it is **amd64** only. **arm64 images remain WITHDRAWN**, so never describe an arm64 enclave as
   supported.

package/README.md

@@ -11,9 +11,23 @@ Works with **Claude Code**, **Claude Desktop**, **Cursor**, **Windsurf**, **VS C
 
 ## Current release
 
-**0.2.38** — paired with **Enterprise 0.35.0 / Community 0.2.40**. Teaches the four new
-suppression-approval commands (`compliance suppress | review | renew | keygen`) and the
-environment setting behind them.
+**0.2.41** — paired with **Enterprise 0.38.0 / Community 0.2.43**. Not yet proven: the two new pack-signing
+commands (`compliance sign-pack | verify-pack`) — reachable, **not yet** proven by the gate that runs
+against published bytes — and the exact scope of what a verified pack signature does and does not
+establish.
+
+⚠️ **What the skill must teach accurately about THIS release, because it is the claim most easily
+overstated:** a verified signature proves the holder of a key asserted authorship of **one
+framework's** chain-of-custody envelope at a stated time, **relative to operator key custody**. It
+is never a vendor attestation, never proof the scan ran, and never proof the findings are true. It
+covers that envelope plus the four artifacts it enumerates — **not the directory and not the pack**;
+a seven-framework pack holds 74 files and no object in it enumerates the set. `verify-pack` also
+recomputes every enumerated artifact hash against disk, so an edited report fails while the
+signature itself still reads VERIFIED. And exit **2** means the run could not measure — an unsigned
+pack, an unsupplied key or a registry member with no key material — which an agent must never
+report as a verification failure.
+
+*(The suppression-approval material below is retained; it remains accurate.)*
 
 ⚠️ **What the skill must teach accurately about this release, because it is easy to overstate:**
 `NSAUDITOR_SIGNING_KEY` is not a new variable — it existed and was inert. As of Enterprise 0.35.0

package/SKILL.md

@@ -16,7 +16,9 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.40 (post-EE-0.37.0 · **requires CE ≥ 0.2.42**) — the air-gap feed release. `feed bundle` and `feed import` let NVD feed files downloaded on a connected host be merged into one archive, hand-carried, and imported into the offline store on an isolated host — delivered as a **restricted** distribution rather than a public `npm install`, and amd64 only. ⚠️ Teach these precisely: **`feed bundle` bundles the FEEDS YOU DOWNLOADED, never "your database"** — the offline store is a lossy derivation of an NVD feed and cannot be turned back into one, so never describe this as a store export or a backup. **No KEV or EPSS data ships with the product**; `--kev` / `--epss` carry the operator's own downloads from CISA and FIRST, and `--extras-dir` places them on import and prints the environment lines to set. **A bundle is integrity-checked, NOT authenticated** — the recorded SHA-256 detects alteration in transit but cannot establish authorship, because it travels inside the archive it covers; never describe an imported bundle as trusted or verified-as-genuine. **Import skips about a quarter of a real NVD year file by design** (withdrawn CVEs, entries with no CPE match data) — that is not data loss, while malformed records are a different signal meaning re-download. The air-gap delivery claims are EARNED BACK at this release — offline installation tarball, install script, feed-import CLI and air-gapped deployment — because the artifacts exist and the delivery gate passes on the built bytes. Teach them WITH their conditions, which are part of the claim and not footnotes: the bundle is a **restricted** distribution rather than a public `npm install`, and it is **amd64** only. **arm64 images remain WITHDRAWN** — never describe an arm64 enclave as supported.
+> **Version:** 0.2.41 (post-EE-0.38.0 · **requires CE ≥ 0.2.43**) — the pack-signing release, reachable and **not yet** proven by the published-bytes gate. `compliance sign-pack` signs a chain-of-custody envelope with an operator-held Ed25519 key (reachable, **not yet** proven); `compliance verify-pack` establishes authorship AND recomputes every enumerated artifact hash against disk. A verified signature proves the holder of a key asserted authorship of ONE framework's envelope, relative to operator key custody — never a vendor attestation, never proof the scan ran. It covers that envelope and its four artifacts, not the pack. Exit 2 means the run could not measure and is never a failure.
+>
+> **Prior:** 0.2.40 (post-EE-0.37.0 · **requires CE ≥ 0.2.42**) — the air-gap feed release. `feed bundle` and `feed import` let NVD feed files downloaded on a connected host be merged into one archive, hand-carried, and imported into the offline store on an isolated host — delivered as a **restricted** distribution rather than a public `npm install`, and amd64 only. ⚠️ Teach these precisely: **`feed bundle` bundles the FEEDS YOU DOWNLOADED, never "your database"** — the offline store is a lossy derivation of an NVD feed and cannot be turned back into one, so never describe this as a store export or a backup. **No KEV or EPSS data ships with the product**; `--kev` / `--epss` carry the operator's own downloads from CISA and FIRST, and `--extras-dir` places them on import and prints the environment lines to set. **A bundle is integrity-checked, NOT authenticated** — the recorded SHA-256 detects alteration in transit but cannot establish authorship, because it travels inside the archive it covers; never describe an imported bundle as trusted or verified-as-genuine. **Import skips about a quarter of a real NVD year file by design** (withdrawn CVEs, entries with no CPE match data) — that is not data loss, while malformed records are a different signal meaning re-download. The air-gap delivery claims are EARNED BACK at this release, every one of them as a **restricted** distribution and **amd64 only** — the offline installation tarball is restricted, the install script is restricted, the feed-import CLI moves the feeds you downloaded, and air-gapped deployment is restricted and amd64 only — because the artifacts exist and the delivery gate passes on the built bytes. Teach them WITH their conditions, which are part of the claim and not footnotes: the bundle is a **restricted** distribution rather than a public `npm install`, and it is **amd64** only. **arm64 images remain WITHDRAWN** — never describe an arm64 enclave as supported.
 >
 > **Prior:** 0.2.39 (post-EE-0.36.0 · **requires CE ≥ 0.2.40**) — the verification release. Every compliance report now cryptographically checks each suppression signature — the Ed25519 suppression-signing capability this exercises is **proven as of EE 0.36.0 and verified for approvers whose registry entry carries key material**, its verification gate having run against the published bytes and passed — and writes `report.signatureVerification`. A MISSING verdict means NOT CHECKED, never failed; `cryptoValid` is absent when unanswerable, never `false`. Verification runs for approvers whose registry entry carries key material.
 >

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.40",
+  "version": "0.2.41",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",