nsauditor-ai-agent-skill 0.2.44 → 0.2.46

package/CHANGELOG.md

@@ -4,6 +4,21 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.46 (2026-08-26) — paired with EE 0.41.0: the DocumentDB plugin reaches the skill's teaching
+
+**Requires CE >= 0.2.45 — UNCHANGED.** Paired with **Enterprise 0.41.0 / Community 0.2.48**.
+
+- **Teaches plugin `1230 AWS DocumentDB Auditor`** (the 29th Enterprise plugin): docdb-engine
+  ownership on the shared RDS control plane; seven dimensions (storage encryption + KMS custody,
+  `tls` cluster parameter, `audit_logs` + CloudWatch export, backup retention, deletion
+  protection, replica/AZ topology under the CLUSTER lens, manual-snapshot restorability probes).
+- **Teaches the RDS auditor's shared-plane engine filter**: DocumentDB is delegated to 1230,
+  Neptune is skipped with a counted, standing disclosure — an agent asked about Neptune must say
+  the estate is UNAUDITED, because the report itself says so.
+- **Teaches the deferred scopes**: DocumentDB Elastic clusters (separate API) are declared
+  deferred; the per-instance Multi-AZ flag is RDS semantics and never applies to DocumentDB.
+- Plugin count 28 → 29 across the reference tables; all eight coverage matrices UNCHANGED.
+
 ## 0.2.44 (2026-08-23) — paired with EE 0.40.2: the TSA status gate reaches the skill's teaching
 
 **Requires CE >= 0.2.45 — UNCHANGED.** Paired with **Enterprise 0.40.2 / Community 0.2.46**.

package/README.md

@@ -11,6 +11,12 @@ Works with **Claude Code**, **Claude Desktop**, **Cursor**, **Windsurf**, **VS C
 
 ## Current release
 
+**0.2.46** — paired with **Enterprise 0.41.0 / Community 0.2.48**. New in this release's teaching: the 29th Enterprise plugin, `1230 AWS DocumentDB Auditor` (docdb-engine ownership on the shared RDS control plane — encryption + custody, `tls`, audit logging + export, retention, deletion protection, replica/AZ topology, snapshot sharing), the RDS auditor's engine filter with its standing disclosure (a Neptune estate is explicitly unaudited), and the deferred status of DocumentDB Elastic clusters. Prior: **0.2.45** — paired with **Enterprise 0.40.3 / Community 0.2.47**. New in this release's teaching: on
+the **opt-in** RFC 3161 path (`NSAUDITOR_TSA_URL`; no default authority), a granted token that attests
+a DIFFERENT digest than the request carried is now refused (`tsa_imprint_mismatch`); the auditor
+instruction printed on every timestamped report is corrected to one that actually runs; and a
+BER-encoded token is no longer refused when openssl can read it.
+
 **0.2.44** — paired with **Enterprise 0.40.2 / Community 0.2.46**. New in this release's teaching: a TSA
 rejection is refused instead of being written as a signed sidecar (five named refusal codes; a missing
 `.tsr` beside a `.sha256` means refused, not failed), the TSA policy-OID option works on OpenSSL ≥ 3.0

package/SKILL.md

@@ -16,11 +16,17 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.44 (knowledge current as of **EE 0.40.2** · **requires CE ≥ 0.2.45**) — the TSA-status-gate release.
+> **Version:** 0.2.46 (knowledge current as of **EE 0.41.0** · **requires CE ≥ 0.2.45**) — the DocumentDB release.
+>
+> **What this release (EE 0.41.0) teaches:** **The 29th Enterprise plugin — `1230 AWS DocumentDB Auditor` — owns the `docdb` engine on the shared RDS control plane.** Teach these three facts together: (1) a `--host aws` pass now includes DocumentDB cluster security — storage encryption + KMS custody, the `tls` cluster parameter, `audit_logs` + CloudWatch export, backup retention, deletion protection, replica/AZ topology (DocumentDB availability is replicas across AZs; the per-instance Multi-AZ flag does not apply and the plugin never consults it), and manual-snapshot public/cross-account restorability; (2) the RDS auditor (1140) engine-filters DocumentDB and Neptune out of every path with counted skips and a standing deferred-scope disclosure — when a user asks about Neptune, the honest answer is that **a Neptune estate is UNAUDITED by every plugin**, and the report says so itself; (3) DocumentDB ELASTIC clusters ride a separate API and are a declared deferred scope, not covered. Plugin count 28 → 29; all eight coverage matrices UNCHANGED.
+
+> **Prior:** 0.2.45 (post-EE-0.40.3 · **requires CE ≥ 0.2.45**) — the message-imprint release.
 >
 > ⛔ **If tool output reports an EE version NEWER than the knowledge bound above, say this skill's knowledge does not yet cover that version — never guess at capabilities it might add.**
 >
-> **What this release (EE 0.40.2) teaches:** **A TSA rejection is no longer written as evidence.** RFC 3161 timestamping stays opt-in (`NSAUDITOR_TSA_URL`; no default authority). When enabled, the response status is now read before anything reaches disk: a refusal writes NO `.tsr`, leaves any sidecar from a prior success byte-identical, and records `signed: false` with one of five reason codes — `tsa_submit_failed` · `tsa_rejected` · `tsa_not_granted` · `tsa_response_no_token` · `tsa_response_unparseable` — in the chain-of-custody envelope. Teach the reading: **a missing `.tsr` beside a `.sha256` means REFUSED, not failed** — the per-artifact ledger is `artifacts[].tsa.signed` / `.error` in the envelope, and `tsa_rejected` (the authority declined; fix the request) routes to a different action than `tsa_not_granted` (waiting or revocation; ask again later). ⚠️ **`signed: true` attests protocol status, never cryptography** — it means the authority granted and enclosed a token; `openssl ts -verify` remains the only thing that adjudicates the token itself. ⚠️ Packs produced by earlier versions against a rejecting authority may carry a ~50-byte rejection recorded as signed (real tokens run ~4.6 KB) — a tiny `.tsr` that fails `openssl ts -verify` is that class, and re-signing under 0.40.2 refuses honestly instead. Also taught: **the TSA policy-OID option (`NSAUDITOR_TSA_POLICY_OID`) works on OpenSSL ≥ 3.0 hosts for the first time** — OpenSSL 3.0 renamed the query flag to `-tspolicy` while LibreSSL kept `-policy`, both report a 3.x version, and the fix attempts the modern spelling and falls back; when the legacy spelling was used the signing result carries `tsaPolicyFlagFallback`. This is the option commercial TSAs (DigiCert / GlobalSign / Sectigo) require, so an operator who saw `unexpected_failure` with a policy OID configured should re-try on 0.40.2. And **parenthesised `(Dim N)` internal dimension codes are gone from GCP finding prose** — bare `Dim N` references remain in some GCP IAM finding text, a known census-pinned residual, not a new defect to report. Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED; peer floor UNCHANGED at CE ≥ 0.2.45.
+> **What EE 0.40.3 taught:** **A timestamp for a DIFFERENT artifact is no longer accepted as yours.** RFC 3161 timestamping stays **opt-in** (`NSAUDITOR_TSA_URL`; no default authority). When enabled, a granted token carries a `messageImprint` — the digest it attests — and nothing compared it to the digest our request carried, so a replay, a caching proxy or an authority fault could return a valid timestamp for someone else's bytes and it was written as evidence, while the auditor's own `openssl ts -verify` printed `message imprint mismatch` → FAILED over it. Refused now, before any write, as **`tsa_imprint_mismatch`**, naming both digests. Two more codes join it: **`tsa_response_malformed`** (bytes RFC 3161 does not admit inside the response; openssl refuses such a file outright) and **`tsa_token_unreadable`** (neither this reader nor openssl could decode the token). **Eight refusal codes** total. ⚠️ **Teach the OPPOSITE direction too, because it is a LOOSENING and a user may report it as a change:** a **BER-encoded** token is no longer refused when openssl can read it. 0.40.2 refused those outright; CMS permits BER and `openssl ts -verify` accepts them, so the old behaviour discarded genuine evidence from authorities whose stacks nobody here has surveyed. A refusal now requires **both** readers to fail — so timestamps that start working again on 0.40.3 are the fix, not a regression. **The chain-of-custody envelope now records `artifacts[].tsa.imprintVerified`** (an explicit boolean) plus `imprintUnverifiedReason` when the comparison could not be made. ⚠️ Teach that **the absence of `imprintUnverified` is NOT the presence of verification** — read the boolean. And a run configured for timestamping that TIMESTAMPED fewer artifacts than it attempted now says so ONCE, carrying the refusal codes, so *"zero `.tsr` files"* is no longer indistinguishable from *"timestamping was never configured"*. ⚠️ **THE PUBLISHED AUDITOR INSTRUCTION CHANGED AND THE OLD ONE CANNOT BE RUN:** verify with `openssl ts -verify -in <file>.tsr -data <file> -CAfile <ca-bundle>`. The prior text passed `-queryfile` AND `-data` together — mutually exclusive; openssl exits 1 with **no verdict at all** — and named a `.tsq` that no pack contains, because the request is built in a temp directory and deleted. If a user quotes the old command and reports that verification failed, that is why. ⚠️ **NOT RETROACTIVE:** packs timestamped before 0.40.3 were never checked for imprint match; re-verify them, and treat a `.tsr` that fails as never having been a valid timestamp for that artifact. ⚠️ `signed: true` attests **protocol status and what the token SAYS it attests, never cryptography**. Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED; peer floor UNCHANGED at CE ≥ 0.2.45.
+>
+> **Prior:** 0.2.44 (post-EE-0.40.2) — **A TSA rejection is no longer written as evidence.** RFC 3161 timestamping stays opt-in (`NSAUDITOR_TSA_URL`; no default authority). When enabled, the response status is now read before anything reaches disk: a refusal writes NO `.tsr`, leaves any sidecar from a prior success byte-identical, and records `signed: false` with one of five reason codes — `tsa_submit_failed` · `tsa_rejected` · `tsa_not_granted` · `tsa_response_no_token` · `tsa_response_unparseable` — in the chain-of-custody envelope. Teach the reading: **a missing `.tsr` beside a `.sha256` means REFUSED, not failed** — the per-artifact ledger is `artifacts[].tsa.signed` / `.error` in the envelope, and `tsa_rejected` (the authority declined; fix the request) routes to a different action than `tsa_not_granted` (waiting or revocation; ask again later). ⚠️ **`signed: true` attests protocol status, never cryptography** — it means the authority granted and enclosed a token; `openssl ts -verify` remains the only thing that adjudicates the token itself. ⚠️ Packs produced by earlier versions against a rejecting authority may carry a ~50-byte rejection recorded as signed (real tokens run ~4.6 KB) — a tiny `.tsr` that fails `openssl ts -verify` is that class, and re-signing under 0.40.2 refuses honestly instead. Also taught: **the TSA policy-OID option (`NSAUDITOR_TSA_POLICY_OID`) works on OpenSSL ≥ 3.0 hosts for the first time** — OpenSSL 3.0 renamed the query flag to `-tspolicy` while LibreSSL kept `-policy`, both report a 3.x version, and the fix attempts the modern spelling and falls back; when the legacy spelling was used the signing result carries `tsaPolicyFlagFallback`. This is the option commercial TSAs (DigiCert / GlobalSign / Sectigo) require, so an operator who saw `unexpected_failure` with a policy OID configured should re-try on 0.40.2. And **parenthesised `(Dim N)` internal dimension codes are gone from GCP finding prose** — bare `Dim N` references remain in some GCP IAM finding text, a known census-pinned residual, not a new defect to report. Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED; peer floor UNCHANGED at CE ≥ 0.2.45.
 >
 > **Prior:** 0.2.43 (post-EE-0.40.0 · **requires CE ≥ 0.2.45 — RAISED**) — the eighth-framework release. **NIST SP 800-171 Rev 2 ships as `--compliance nist-800-171`, and CE registers the stem, so an older CE REJECTS the framework name outright** — that is what makes this floor a real bump rather than a paired bump. Teach the scope as **"NIST SP 800-171 evidence substrate for CMMC Level 2 preparation."** ⚠️ **WITHDRAWN — deliberately not claimed, in these exact words: "CMMC certified", "CMMC compliant", "CMMC ready", "FedRAMP authorized", any MET / NOT MET verdict, and any SPRS score.** Each of those is a C3PAO determination and none is a product output; a misrepresented SP 800-171 posture is the shape the DOJ Civil Cyber-Fraud Initiative settles, which is why this is a refusal rule for the agent and not a wording preference. All 110 Rev 2 requirements are enumerated — **2 covered / 49 partial / 59 out of scope**, each with a written reason — and coverage is claimed at the SP 800-171A **determination-statement (objective)** level, which is why only two clear the bar: a requirement counts as covered only when EVERY objective is technical system state the scan reads directly. ⚠️ **Rev 2 is PINNED**: CMMC assesses Rev 2 by rule, and Rev 3 is a different 97-requirement universe with organization-defined parameters — answering a Rev 3 question with Rev 2 output is drift. **CUI scope is the operator's assertion**: the scanner cannot see CUI, cannot tell FCI from CUI, and cannot see an enclave boundary. Also in this release: a KMS key in an account or project the operator may not control is no longer reported as customer key custody — it becomes an evidence gap, never a violation, because a cross-account CMK is recommended architecture. Plugin catalog UNCHANGED at 28 EE / 55 overall; the seven prior coverage matrices UNCHANGED.
 >
@@ -318,7 +324,7 @@ Phase 5: SCORING (Pro/Ent)     Risk scoring → Pro AI prompts → Compliance ma
 
 ---
 
-## Plugin Reference (55 scanners — 27 Community + 28 Enterprise)
+## Plugin Reference (56 scanners — 27 Community + 29 Enterprise)
 
 **`references/plugins.md` is the authoritative catalog.** The counts above are derived from the
 shipped plugin files; verify any of them with `nsauditor-ai license --plugins`, which prints the
@@ -492,7 +498,7 @@ Add to your MCP configuration with the same command/args pattern.
 |---------|-------|-------------|
 | **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, CTEM, SARIF, scan history |
 | **Pro** | $49/mo | + CVE matching, risk scoring, analysis agents, Pro plugins (040 TLS / 050 TRIBE / 060 DNS) |
-| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors covering AWS / GCP / Azure plus `1023 Zero Trust Assessment` (which declares no cloud provider and scores zero-trust posture from a NETWORK-host scan — it never runs on a cloud pass, and selecting it by id on its own does not run it either) — against every shipped framework (SOC 2 10 covered + 4 partial; HIPAA; NIST CSF 2.0; PCI DSS v4.0.1; ISO/IEC 27001:2022; CIS Controls v8; GDPR Art. 32 infrastructure substrate; NIST SP 800-171 Rev 2 evidence substrate for CMMC Level 2 preparation); SOC 2 evidence-pack generation; SHA-256 chain-of-custody attestations (RFC 3161 timestamping is opt-in via the `NSAUDITOR_TSA_URL` environment variable — there is no CLI flag and no default, it makes an outbound call to the Time-Stamp Authority you name, and it was exercised against a live Time-Stamp Authority on BOTH delivery vehicles — the npm path and, from inside the pushed `:0.33.0` Marketplace image, on 2026-08-08; retained images `:0.32.11` and earlier carry no `openssl`); air-gapped operation (offline licensing + offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`) |
+| **Enterprise** | $2k+/yr | + 29 enterprise plugins (1020-1230 range) — 28 cloud-substrate auditors covering AWS / GCP / Azure plus `1023 Zero Trust Assessment` (which declares no cloud provider and scores zero-trust posture from a NETWORK-host scan — it never runs on a cloud pass, and selecting it by id on its own does not run it either) — against every shipped framework (SOC 2 10 covered + 4 partial; HIPAA; NIST CSF 2.0; PCI DSS v4.0.1; ISO/IEC 27001:2022; CIS Controls v8; GDPR Art. 32 infrastructure substrate; NIST SP 800-171 Rev 2 evidence substrate for CMMC Level 2 preparation); SOC 2 evidence-pack generation; SHA-256 chain-of-custody attestations (RFC 3161 timestamping is opt-in via the `NSAUDITOR_TSA_URL` environment variable — there is no CLI flag and no default, it makes an outbound call to the Time-Stamp Authority you name, and it was exercised against a live Time-Stamp Authority on BOTH delivery vehicles — the npm path and, from inside the pushed `:0.33.0` Marketplace image, on 2026-08-08; retained images `:0.32.11` and earlier carry no `openssl`); air-gapped operation (offline licensing + offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`) |
 
 → [Pricing](https://www.nsauditor.com/ai/pricing/)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.44",
+  "version": "0.2.46",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",

package/references/plugins.md

@@ -199,6 +199,7 @@ listings, and default pages.
 | 1220 | Azure Storage Account Data-Protection Auditor (**NEW EE 0.13.2** — Move C-2; **+2 dims EE 0.13.3** — Move C-2.1; plugin count 25 → 26; first dedicated Azure auditor beyond the multi-purpose 1022 scanner) | Enterprise | Audits the Azure Storage Account data-protection surface across **7 dims** — **orthogonal to plugin 1022** which owns the network-exposure dims (no double-emission; mirrors the AWS 1020 S3-scanner + 1120 S3-lifecycle two-plugin split). (1) **HTTPS-only transit** (`enableHttpsTrafficOnly` — HIGH on plaintext HTTP; CC6.7) + (2) **minimum TLS version** (< TLS1_2 → MEDIUM; CC6.7) + (3) **Shared Key authorization** (`allowSharedKeyAccess` — bypasses Azure AD identity; CC6.1; Azure field-default discipline: absent = ENABLED, never silent-PASS) + (4) **infrastructure (double) encryption** (`requireInfrastructureEncryption`; C1.1) + (5) **encryption key source incl. CMK reachability + rotation** (`encryption.keyVaultProperties` — keySource=Microsoft.Keyvault PASS only when the key is currently resolvable + auto-rotating; a disabled/revoked/version-pinned CMK degrades, not silent-PASS; C1.1) + (6) **blob recoverability** (soft-delete + versioning via the secondary `blobServices.getServiceProperties` path — A1.2; EE 0.13.3) + (7) **per-container anonymous public access** (account-toggle-aware via `blobContainers.list` — `publicAccess=Blob/Container` + allowBlobPublicAccess=true → HIGH effective exposure; C1.1; EE 0.13.3). Conservative classifier: indeterminate field / AccessDenied / secondary-path failure → evidence-gap (never silent-PASS); `for await` pagination. Single-subscription scope surfaced explicitly. Built + reviewed through the cloud-plugin-false-negatives lens. `@azure/arm-storage` + `@azure/identity`. | CC6.7 / CC6.1 / C1.1 / A1.2 |
 | 1221 | Azure NSG Perimeter Auditor (**NEW EE 0.14.0** — Move C-2.2; **UDP lane EE 0.14.1**; plugin count 26 → 27; the Azure analog of AWS plugin 1170) | Enterprise | A CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups — **non-overlapping-by-depth with plugin 1022's flat per-rule NSG lint** (no double-emission of a verdict; mirrors the AWS 1023-observed / 1170-declared two-plugin precedent). Evaluates each NSG's inbound rules in **Azure priority order** (first match wins; DenyAllInbound default): (1) **all-protocol (`*`) public Allow** — every port reachable from the public internet + (2) **public-source (`*`/`0.0.0.0/0`/`Internet`) to a restricted TCP port** (SSH/RDP/MSSQL/MySQL/Postgres/Redis/Memcached/MongoDB/Elasticsearch/CouchDB/SMB/WinRM/Oracle/Docker/Kubelet) + (3) **`::/0` IPv6-wildcard to a restricted port** (the dimension 1022's flat lint misses) + **(2u/3u) public-source / `::/0` to a restricted UDP service** (DNS/TFTP/rpcbind/NTP/NetBIOS/SNMP/CLDAP/IKE/Syslog/IPMI/OpenVPN/MSSQL-Monitor/SSDP/IPsec-NAT-T/Memcached — closes the public-UDP false negative, **EE 0.14.1**) + (4) **public→non-restricted port** INFO substrate + (5) **PASS substrate** when no public restricted exposure. **Attachment-aware severity** via the read-only `nsg.subnets[]`/`networkInterfaces[]` back-references — attached → CRITICAL (effective exposure); orphaned → MEDIUM (latent). Per-transport effective priority/deny-override resolution + port-range expansion + `0.0.0.0/1` split-range coverage + service-tag/ASG-source normalization (VirtualNetwork/AzureLoadBalancer/ASG = not public). Conservative classifier: denied/indeterminate listAll → evidence-gap; one malformed NSG degrades per-resource (never aborts the scan); `for await` pagination; single-subscription scope explicit. Built + reviewed through the cloud-plugin-false-negatives lens (EE 0.14.0 SHIP-WITH-FOLDS 2 LOW; EE 0.14.1 UDP lane SHIP-WITH-FOLDS 2 MED + 1 LOW, all folded). `@azure/arm-network` + `@azure/identity`. | CC6.6 |
 | 1222 | Azure Key Vault Deep Auditor (**NEW EE 0.15.0** — Move C-2.3; plugin count 27 → 28; the third dedicated Azure auditor after 1220 storage + 1221 NSG; **hotfixed EE 0.15.1** — Dim-3 SDK-shape + Dim-4 inherited-admin severity re-tune) | Enterprise | The deep Key Vault auditor — the KV analog of how 1221 deepens 1022's flat NSG dim; **orthogonal to plugin 1022's vault-property dims** (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission of a verdict. Enumerates each vault's **keys, role assignments, and diagnostic settings** across 4 dims: (1) key **auto-rotation policy** — keys with no `rotationPolicy` / no rotate-action → finding + (2) key **expiry** — keys with no `expires` (or already-expired), with epoch-s/ms/Date/string coercion (closes the ms-overflow false-clean) + (3) **diagnostic logging → Log Analytics** — vaults with no `AuditEvent`→workspace diagnostic setting; reads `@azure/arm-monitor`'s `diagnosticSettings.list()` correctly as an `await`-ed `{value:[]}` collection object (NOT a paged async-iterator — the EE 0.15.1 H-1 fix; pre-fix the dim always threw and degraded to a non-functional evidence-gap), soft-degrades to an evidence-gap if the SDK is absent + (4) **privileged-access depth** — RBAC `roleAssignments` (admin/data-plane/**scope-aware severity**: vault-scoped control-plane god roles + Key Vault Administrator at any scope → HIGH; inherited subscription/management-group-scope Owner/User-Access-Administrator → MEDIUM, inherited Contributor → LOW — the EE 0.15.1 H-2 re-tune that stops flagging the ubiquitous inherited-admin reality as HIGH on every RBAC vault) + legacy `accessPolicies` breadth (export + wide-crypto permissions). **Secret/cert expiry is a deliberate data-plane scope boundary** (explicit caveat — the control-plane mgmt API does not expose data-plane object expiry). Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource (never aborts the scan); single-subscription scope explicit. Findings route across every shipped framework (SOC 2 CC6.3/C1.1/CC6.1/CC7.2 · HIPAA §164.312(a)(2)(iv)/(b)/(a)(1) · NIST CSF PR.DS-01/DE.CM-09/PR.AA-05 · PCI DSS 3.5.1/10.2.1/7.2.1 · ISO 27001 A.8.24/A.8.15/A.5.15+A.8.2 · CIS v8 3.11/8.2/5.4 · GDPR Art.32(1)(b)-confidentiality + Art.32(1)(b)-integrity) — every coverage matrix UNCHANGED at that release. Built + reviewed through the cloud-plugin-false-negatives lens (SHIP-WITH-FOLDS 0C/3H/2M/4L; 4 folded). `@azure/arm-keyvault` + `@azure/arm-monitor` + `@azure/arm-authorization` + `@azure/identity`. | CC6.3 / C1.1 / CC6.1 / CC7.2 |
+| 1230 | AWS DocumentDB Auditor (**NEW EE 0.41.0** — plugin count 28 → 29; owns the `docdb` engine on the shared RDS control plane, closing the measured false clean where an unencrypted DocumentDB cluster read CLEAN under the RDS auditor's Aurora-only cluster filter) | Enterprise | Seven dimensions: storage encryption at rest + KMS custody classification (customer-alias PASS / AWS-managed MEDIUM / key-UUID and foreign-account custody stay evidence gaps); `tls` cluster parameter (disabled = HIGH); `audit_logs` parameter + CloudWatch `audit` export (generating-but-unexported is its own MEDIUM); automated backup retention vs the 7-day floor; deletion protection; replica/AZ availability topology under the CLUSTER lens (never the per-instance Multi-AZ flag — that is RDS semantics and does not apply); manual-snapshot `restore`-attribute probes (`all` = publicly restorable CRITICAL; external account ids = HIGH). Non-docdb engines counted and skipped; DocumentDB Elastic clusters declared deferred. Paired 1140 change: docdb/neptune engine-filtered with counted skips + a standing disclosure — a Neptune estate is explicitly UNAUDITED. |
 
 ---