nsauditor-ai-agent-skill 0.2.43 → 0.2.45

package/CHANGELOG.md

@@ -4,6 +4,83 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.44 (2026-08-23) — paired with EE 0.40.2: the TSA status gate reaches the skill's teaching
+
+**Requires CE >= 0.2.45 — UNCHANGED.** Paired with **Enterprise 0.40.2 / Community 0.2.46**.
+
+What EE 0.40.2 adds to the taught knowledge, and the skill now teaches:
+
+- **A TSA rejection is refused, never written as evidence.** The response status is read before
+  anything reaches disk; a refusal writes no `.tsr`, leaves a prior success's sidecar byte-identical,
+  and records `signed: false` with one of five reason codes in the chain-of-custody envelope
+  (`artifacts[].tsa.signed` / `.error` is the per-artifact ledger). A missing `.tsr` beside a
+  `.sha256` means REFUSED, not failed. `signed: true` attests protocol status, never cryptography —
+  `openssl ts -verify` remains the adjudicator.
+- **The TSA policy-OID option works on OpenSSL ≥ 3.0 hosts for the first time** — the query flag is
+  attempted as `-tspolicy` with a `-policy` fallback (LibreSSL kept the old spelling; both report a
+  3.x version, so no version table can decide it), and the result carries `tsaPolicyFlagFallback`
+  when the legacy spelling was used. This is the option commercial TSAs require.
+- **Parenthesised `(Dim N)` internal dimension codes are out of GCP finding prose**; bare `Dim N`
+  references remain in some GCP IAM finding text, a census-pinned residual the agent should not
+  report as a new defect.
+
+Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED.
+
+Also in this release: the header-correction set below — made at 0.2.43 as unreleased edits, shipping
+now with the bump.
+
+### The SKILL.md header corrections (made pre-release at 0.2.43)
+
+Four corrections to the header, none of them a knowledge change, recorded here because the
+CHANGELOG is where a record belongs.
+
+1. **The version line read `post-EE-0.40.0` while EE 0.40.1 was live.** The skill's own version is
+   correct and is not moving; what drifted is the EE release it claims currency with. EE 0.40.1 was
+   a prose correction that changed no capability this skill teaches — which is exactly why nothing
+   forced the label to move. A version label that rots on somebody ELSE's release is invisible to
+   every code-triggered review. Second instance in this file; `7146320` fixed the same class when
+   the header still read 0.2.42.
+
+2. **The added pre-publish note bled into live teaching.** It ended mid-paragraph and the
+   eighth-framework content continued in the same block, so the header read as though
+   `--compliance nist-800-171` were part of what the unpublished EE 0.40.2 will carry. It shipped at
+   0.40.0 and is live. Sell-before-ship arriving by punctuation rather than by claim — caused by the
+   note written to prevent that class.
+
+3. **⚠️ AND THE CORRECTIONS THEMSELVES WERE WRITTEN INTO THE WRONG SURFACE.** The fixes for (1) and
+   (2) were made as commentary INSIDE `SKILL.md`: a warning about what the line used to read, a
+   commit hash, and a paragraph on how version labels rot. `SKILL.md` is an agent's INSTRUCTIONS and
+   the first thing Claude Desktop renders — so an agent loading the skill read an incident report
+   about a version label before it read anything about NSAuditor, and a customer saw it in the
+   Skills pane. Repo process commentary does not belong on a surface a customer sees and an agent
+   consumes. 618 characters removed; the operator-facing note is now two sentences telling the agent
+   what to do — do not teach 0.40.2, say it is not released — and the record is here instead.
+
+4. **⚠️ A FOURTH INSTANCE, AND IT WAS THE FIX FOR THE THIRD.** The replacement note read *"EE 0.40.2
+   exists but is NOT published — do not teach it. If asked, say it is not released."* Measured: that
+   line was the **ONLY** mention of 0.40.2 anywhere in the skill. An agent that never read it could
+   not have taught 0.40.2 — so its sole effect was to hand every customer's agent the fact it
+   otherwise lacked. **Pre-release existence disclosure delivered by the sentence written to prevent
+   talking about it.** It also carried a rot clock pointing the wrong way: the moment 0.40.2
+   publishes, *"is NOT published"* becomes a FALSE INSTRUCTION and agents would DENY a shipped
+   release — the underclaim class — repairable only by three coupled motions (edit, re-zip,
+   redistribute), any one of which could be missed. Replaced with a version-agnostic behavioural
+   rule that never needs editing: if tool output reports a version newer than the knowledge bound,
+   say the skill does not cover it. Also cut *"the LIVE Enterprise release"* and *"live today"* —
+   mutable registry state a shipped file cannot know, false at the next publish. The bounded
+   *"knowledge current as of EE 0.40.1"* stays: it is true, and it stays true after 0.40.2 ships.
+
+**THE DURABLE RULE, CORRECTED — the first version of it was keyed on the wrong noun.** It read *"a
+fix and its record are different artifacts"*, with the discriminator being whether a surface is
+CONSUMED by an agent or MAINTAINED by a human. That boundary does not survive contact: CI consumes
+test files, and it would eventually be used to strip the annotations that make a red test
+diagnosable. The working test is behavioural — **an annotation earns its place iff it changes what
+THIS reader DOES at the moment of reading.** The board and `tasks/CLAUDE.md` records change a
+maintainer's next action (do not retry that approach; do not delete that guard) — load-bearing. A
+test-file annotation serves the human staring at a red — load-bearing. An incident narrative in
+`SKILL.md` changes nothing an advising agent should do — pure cost, and it occupies the most
+expensive real estate an agent surface has.
+
 ## 0.2.43 (2026-08-20) — post-EE 0.40.0: the EIGHTH framework, and the words the skill must never use
 
 **Requires CE >= 0.2.45 — RAISED.** Enterprise 0.40.0 registers `nist-800-171`, and CE 0.2.44 does

package/README.md

@@ -11,7 +11,17 @@ Works with **Claude Code**, **Claude Desktop**, **Cursor**, **Windsurf**, **VS C
 
 ## Current release
 
-**0.2.43** — paired with **Enterprise 0.40.0 / Community 0.2.45**. The eighth compliance framework:
+**0.2.45** — paired with **Enterprise 0.40.3 / Community 0.2.47**. New in this release's teaching: on
+the **opt-in** RFC 3161 path (`NSAUDITOR_TSA_URL`; no default authority), a granted token that attests
+a DIFFERENT digest than the request carried is now refused (`tsa_imprint_mismatch`); the auditor
+instruction printed on every timestamped report is corrected to one that actually runs; and a
+BER-encoded token is no longer refused when openssl can read it.
+
+**0.2.44** — paired with **Enterprise 0.40.2 / Community 0.2.46**. New in this release's teaching: a TSA
+rejection is refused instead of being written as a signed sidecar (five named refusal codes; a missing
+`.tsr` beside a `.sha256` means refused, not failed), the TSA policy-OID option works on OpenSSL ≥ 3.0
+hosts, and parenthesised `(Dim N)` internal codes are out of GCP finding prose. Carried forward, the
+eighth compliance framework:
 **NIST SP 800-171 Rev 2**, taught as **evidence substrate for CMMC Level 2 preparation**. ⚠️ **Requires
 Community >= 0.2.45** — a real floor bump: the framework stem is registered in CE, and an older CE
 rejects the name outright. What the agent must refuse to say is part of the skill, not a footnote:

package/SKILL.md

@@ -16,7 +16,15 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.43 (post-EE-0.40.0 · **requires CE ≥ 0.2.45 — RAISED**) — the eighth-framework release. **NIST SP 800-171 Rev 2 ships as `--compliance nist-800-171`, and CE registers the stem, so an older CE REJECTS the framework name outright** — that is what makes this floor a real bump rather than a paired bump. Teach the scope as **"NIST SP 800-171 evidence substrate for CMMC Level 2 preparation."** ⚠️ **WITHDRAWN — deliberately not claimed, in these exact words: "CMMC certified", "CMMC compliant", "CMMC ready", "FedRAMP authorized", any MET / NOT MET verdict, and any SPRS score.** Each of those is a C3PAO determination and none is a product output; a misrepresented SP 800-171 posture is the shape the DOJ Civil Cyber-Fraud Initiative settles, which is why this is a refusal rule for the agent and not a wording preference. All 110 Rev 2 requirements are enumerated — **2 covered / 49 partial / 59 out of scope**, each with a written reason — and coverage is claimed at the SP 800-171A **determination-statement (objective)** level, which is why only two clear the bar: a requirement counts as covered only when EVERY objective is technical system state the scan reads directly. ⚠️ **Rev 2 is PINNED**: CMMC assesses Rev 2 by rule, and Rev 3 is a different 97-requirement universe with organization-defined parameters — answering a Rev 3 question with Rev 2 output is drift. **CUI scope is the operator's assertion**: the scanner cannot see CUI, cannot tell FCI from CUI, and cannot see an enclave boundary. Also in this release: a KMS key in an account or project the operator may not control is no longer reported as customer key custody — it becomes an evidence gap, never a violation, because a cross-account CMK is recommended architecture. Plugin catalog UNCHANGED at 28 EE / 55 overall; the seven prior coverage matrices UNCHANGED.
+> **Version:** 0.2.45 (knowledge current as of **EE 0.40.3** · **requires CE ≥ 0.2.45**) — the message-imprint release.
+>
+> ⛔ **If tool output reports an EE version NEWER than the knowledge bound above, say this skill's knowledge does not yet cover that version — never guess at capabilities it might add.**
+>
+> **What this release (EE 0.40.3) teaches:** **A timestamp for a DIFFERENT artifact is no longer accepted as yours.** RFC 3161 timestamping stays **opt-in** (`NSAUDITOR_TSA_URL`; no default authority). When enabled, a granted token carries a `messageImprint` — the digest it attests — and nothing compared it to the digest our request carried, so a replay, a caching proxy or an authority fault could return a valid timestamp for someone else's bytes and it was written as evidence, while the auditor's own `openssl ts -verify` printed `message imprint mismatch` → FAILED over it. Refused now, before any write, as **`tsa_imprint_mismatch`**, naming both digests. Two more codes join it: **`tsa_response_malformed`** (bytes RFC 3161 does not admit inside the response; openssl refuses such a file outright) and **`tsa_token_unreadable`** (neither this reader nor openssl could decode the token). **Eight refusal codes** total. ⚠️ **Teach the OPPOSITE direction too, because it is a LOOSENING and a user may report it as a change:** a **BER-encoded** token is no longer refused when openssl can read it. 0.40.2 refused those outright; CMS permits BER and `openssl ts -verify` accepts them, so the old behaviour discarded genuine evidence from authorities whose stacks nobody here has surveyed. A refusal now requires **both** readers to fail — so timestamps that start working again on 0.40.3 are the fix, not a regression. **The chain-of-custody envelope now records `artifacts[].tsa.imprintVerified`** (an explicit boolean) plus `imprintUnverifiedReason` when the comparison could not be made. ⚠️ Teach that **the absence of `imprintUnverified` is NOT the presence of verification** — read the boolean. And a run configured for timestamping that TIMESTAMPED fewer artifacts than it attempted now says so ONCE, carrying the refusal codes, so *"zero `.tsr` files"* is no longer indistinguishable from *"timestamping was never configured"*. ⚠️ **THE PUBLISHED AUDITOR INSTRUCTION CHANGED AND THE OLD ONE CANNOT BE RUN:** verify with `openssl ts -verify -in <file>.tsr -data <file> -CAfile <ca-bundle>`. The prior text passed `-queryfile` AND `-data` together — mutually exclusive; openssl exits 1 with **no verdict at all** — and named a `.tsq` that no pack contains, because the request is built in a temp directory and deleted. If a user quotes the old command and reports that verification failed, that is why. ⚠️ **NOT RETROACTIVE:** packs timestamped before 0.40.3 were never checked for imprint match; re-verify them, and treat a `.tsr` that fails as never having been a valid timestamp for that artifact. ⚠️ `signed: true` attests **protocol status and what the token SAYS it attests, never cryptography**. Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED; peer floor UNCHANGED at CE ≥ 0.2.45.
+>
+> **Prior:** 0.2.44 (post-EE-0.40.2) — **A TSA rejection is no longer written as evidence.** RFC 3161 timestamping stays opt-in (`NSAUDITOR_TSA_URL`; no default authority). When enabled, the response status is now read before anything reaches disk: a refusal writes NO `.tsr`, leaves any sidecar from a prior success byte-identical, and records `signed: false` with one of five reason codes — `tsa_submit_failed` · `tsa_rejected` · `tsa_not_granted` · `tsa_response_no_token` · `tsa_response_unparseable` — in the chain-of-custody envelope. Teach the reading: **a missing `.tsr` beside a `.sha256` means REFUSED, not failed** — the per-artifact ledger is `artifacts[].tsa.signed` / `.error` in the envelope, and `tsa_rejected` (the authority declined; fix the request) routes to a different action than `tsa_not_granted` (waiting or revocation; ask again later). ⚠️ **`signed: true` attests protocol status, never cryptography** — it means the authority granted and enclosed a token; `openssl ts -verify` remains the only thing that adjudicates the token itself. ⚠️ Packs produced by earlier versions against a rejecting authority may carry a ~50-byte rejection recorded as signed (real tokens run ~4.6 KB) — a tiny `.tsr` that fails `openssl ts -verify` is that class, and re-signing under 0.40.2 refuses honestly instead. Also taught: **the TSA policy-OID option (`NSAUDITOR_TSA_POLICY_OID`) works on OpenSSL ≥ 3.0 hosts for the first time** — OpenSSL 3.0 renamed the query flag to `-tspolicy` while LibreSSL kept `-policy`, both report a 3.x version, and the fix attempts the modern spelling and falls back; when the legacy spelling was used the signing result carries `tsaPolicyFlagFallback`. This is the option commercial TSAs (DigiCert / GlobalSign / Sectigo) require, so an operator who saw `unexpected_failure` with a policy OID configured should re-try on 0.40.2. And **parenthesised `(Dim N)` internal dimension codes are gone from GCP finding prose** — bare `Dim N` references remain in some GCP IAM finding text, a known census-pinned residual, not a new defect to report. Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED; peer floor UNCHANGED at CE ≥ 0.2.45.
+>
+> **Prior:** 0.2.43 (post-EE-0.40.0 · **requires CE ≥ 0.2.45 — RAISED**) — the eighth-framework release. **NIST SP 800-171 Rev 2 ships as `--compliance nist-800-171`, and CE registers the stem, so an older CE REJECTS the framework name outright** — that is what makes this floor a real bump rather than a paired bump. Teach the scope as **"NIST SP 800-171 evidence substrate for CMMC Level 2 preparation."** ⚠️ **WITHDRAWN — deliberately not claimed, in these exact words: "CMMC certified", "CMMC compliant", "CMMC ready", "FedRAMP authorized", any MET / NOT MET verdict, and any SPRS score.** Each of those is a C3PAO determination and none is a product output; a misrepresented SP 800-171 posture is the shape the DOJ Civil Cyber-Fraud Initiative settles, which is why this is a refusal rule for the agent and not a wording preference. All 110 Rev 2 requirements are enumerated — **2 covered / 49 partial / 59 out of scope**, each with a written reason — and coverage is claimed at the SP 800-171A **determination-statement (objective)** level, which is why only two clear the bar: a requirement counts as covered only when EVERY objective is technical system state the scan reads directly. ⚠️ **Rev 2 is PINNED**: CMMC assesses Rev 2 by rule, and Rev 3 is a different 97-requirement universe with organization-defined parameters — answering a Rev 3 question with Rev 2 output is drift. **CUI scope is the operator's assertion**: the scanner cannot see CUI, cannot tell FCI from CUI, and cannot see an enclave boundary. Also in this release: a KMS key in an account or project the operator may not control is no longer reported as customer key custody — it becomes an evidence gap, never a violation, because a cross-account CMK is recommended architecture. Plugin catalog UNCHANGED at 28 EE / 55 overall; the seven prior coverage matrices UNCHANGED.
 >
 > **Prior:** 0.2.42 (post-EE-0.39.0 · **requires CE ≥ 0.2.43**) — the coverage-honesty release. ⚠️ **Teach `deferredScope` as a per-PLUGIN declaration, never as a provider or coverage inventory.** Every GCP and Azure plugin now declares what it does NOT evaluate (1021, 1022, 1024, 1025, 1220, 1221, 1222), joining the AWS plugins that already did — 8 to 12 static boundaries each, emitted at `run()` scope on the audited path **including over an empty estate**, because "zero findings" is otherwise indistinguishable from "assessed and clean". A declaration is a **static capability boundary**: it is NOT an evidence gap and NOT a finding, it routes to ZERO compliance controls by design, and it must be reported as "not assessed". ⚠️ **An empty or short `deferredScope` is NEVER a claim of full coverage** — not every plugin declares its boundaries, so the list bounds only what the DECLARING plugins state. Never tell a user that an empty list means everything was assessed. Two AWS declarations (1080 Lambda, 1130 Backup) are now emitted ONCE PER RUN rather than once per region, so a fleet reads nine once-per-run disclosures — a count that no longer scales with the estate. And **GCP impersonation now REFUSES rather than degrading**: an impersonated client that yields no Authorization header fails loudly by name with the target principal, surfacing as `up:false` plus a warning that fires scanner-down synthesis. ⚠️ Teach that refusal as a PASS of the fail-closed design, never as a regression — the alternative it replaced was silent anonymous requests reporting FALSE evidence gaps. Plugin catalog UNCHANGED at 28 EE / 55 overall; every coverage matrix UNCHANGED.
 >
@@ -83,7 +91,7 @@ Out of scope, with the control ids and the per-group out-of-scope reasons.
 
 | Parameter | Type | Required | Description |
 |-----------|------|----------|-------------|
-| `framework` | string | ❌ | `soc2` \| `hipaa` \| `nist-csf` \| `pci-dss` \| `iso-27001` \| `cis-v8` \| `gdpr` \| `all` (default) |
+| `framework` | string | ❌ | `soc2` \| `hipaa` \| `nist-csf` \| `pci-dss` \| `iso-27001` \| `cis-v8` \| `gdpr` \| `nist-800-171` \| `all` (default) |
 
 **ALWAYS call this before stating or tabulating any coverage matrix, and quote what it returns.** Do NOT derive a
 matrix from the plugin inventory, from a scan result, or from documentation — coverage is a property of the shipped

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.43",
-  "description": "AI Agent Skill for NSAuditor AI \u2014 gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
+  "version": "0.2.45",
+  "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",
     "ai-agent",
@@ -54,5 +54,8 @@
     "nsauditor-ai": {
       "optional": true
     }
+  },
+  "scripts": {
+    "build:desktop-zip": "node scripts/build_desktop_skill_zip.mjs"
   }
 }