nsauditor-ai-agent-skill 0.2.45 → 0.2.47

package/CHANGELOG.md

@@ -4,6 +4,31 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.47 (2026-08-27) — paired with EE 0.42.0: the sovereign-cloud release
+
+Requires **CE >= 0.2.49** (raised from 0.2.45 — Enterprise 0.42.0 needs the new partition detection).
+
+- **Teaches that non-commercial AWS partitions and Azure sovereign clouds are first-class.** An agent driving a GovCloud, China, ISO or European-Sovereign scan should expect findings that previously read clean: public S3 access points riding a bucket delegation, IAM privesc at CRITICAL rather than HIGH, shadow-admin graph edges that were absent, and the full effective-decrypt severity ladder.
+- **Teaches the Azure cloud selectors and, more importantly, the REFUSAL.** `AZURE_ENVIRONMENT` / `ARM_ENVIRONMENT` / `AZURE_ARM_ENDPOINT` / `AZURE_AUTHORITY_HOST` select the cloud; an unrecognised or contradicted selection refuses and emits an evidence gap. An agent must not treat that refusal as a scan failure to retry past — it is the product declining to report on an estate the operator did not select.
+- **Teaches the subject stamp.** Every Azure scan states which estate it addressed. An agent summarising a clean Azure result should name the estate, because a clean report about the wrong estate looks exactly like a clean report.
+- **Teaches the FIPS boundary.** `docs/fips-posture.md` claims approved *algorithms* and explicitly not a validated *module*; an agent must never let a user infer FIPS 140 validation from it.
+- Plugin count **UNCHANGED at 29**; all eight coverage matrices **UNCHANGED**.
+
+## 0.2.46 (2026-08-26) — paired with EE 0.41.0: the DocumentDB plugin reaches the skill's teaching
+
+**Requires CE >= 0.2.45 — UNCHANGED.** Paired with **Enterprise 0.41.0 / Community 0.2.48**.
+
+- **Teaches plugin `1230 AWS DocumentDB Auditor`** (the 29th Enterprise plugin): docdb-engine
+  ownership on the shared RDS control plane; seven dimensions (storage encryption + KMS custody,
+  `tls` cluster parameter, `audit_logs` + CloudWatch export, backup retention, deletion
+  protection, replica/AZ topology under the CLUSTER lens, manual-snapshot restorability probes).
+- **Teaches the RDS auditor's shared-plane engine filter**: DocumentDB is delegated to 1230,
+  Neptune is skipped with a counted, standing disclosure — an agent asked about Neptune must say
+  the estate is UNAUDITED, because the report itself says so.
+- **Teaches the deferred scopes**: DocumentDB Elastic clusters (separate API) are declared
+  deferred; the per-instance Multi-AZ flag is RDS semantics and never applies to DocumentDB.
+- Plugin count 28 → 29 across the reference tables; all eight coverage matrices UNCHANGED.
+
 ## 0.2.44 (2026-08-23) — paired with EE 0.40.2: the TSA status gate reaches the skill's teaching
 
 **Requires CE >= 0.2.45 — UNCHANGED.** Paired with **Enterprise 0.40.2 / Community 0.2.46**.

package/README.md

@@ -11,7 +11,20 @@ Works with **Claude Code**, **Claude Desktop**, **Cursor**, **Windsurf**, **VS C
 
 ## Current release
 
-**0.2.45** — paired with **Enterprise 0.40.3 / Community 0.2.47**. New in this release's teaching: on
+**0.2.47** — paired with **Enterprise 0.42.0 / Community 0.2.49**. ⚠️ **A real floor bump: Community >= 0.2.49.**
+New in this release's teaching: non-commercial AWS partitions (GovCloud, China, the ISO partitions and
+the European Sovereign Cloud) and Azure sovereign clouds are first-class, and both **refuse rather than
+silently reporting on the wrong estate**. An agent driving a sovereign scan should expect findings that
+previously read clean — a public S3 access point riding a bucket delegation, IAM privesc at CRITICAL
+instead of HIGH, shadow-admin graph edges that were missing, the full effective-decrypt severity ladder.
+For Azure, `AZURE_ENVIRONMENT` / `ARM_ENVIRONMENT` / `AZURE_ARM_ENDPOINT` / `AZURE_AUTHORITY_HOST` select
+the cloud, an unrecognised or self-contradicting selection **refuses and emits an evidence gap**, and
+every Azure scan **states which estate it addressed** — an agent summarising a clean Azure result should
+name the estate, because a clean report about the wrong estate looks exactly like a clean one. Also
+taught: the FIPS boundary (approved *algorithms*, explicitly not a validated *module*) and the SBOM gate.
+Plugin count **unchanged at 29**; all eight coverage matrices **unchanged**.
+
+**Prior: 0.2.46** — paired with **Enterprise 0.41.0 / Community 0.2.48**. New in this release's teaching: the 29th Enterprise plugin, `1230 AWS DocumentDB Auditor` (docdb-engine ownership on the shared RDS control plane — encryption + custody, `tls`, audit logging + export, retention, deletion protection, replica/AZ topology, snapshot sharing), the RDS auditor's engine filter with its standing disclosure (a Neptune estate is explicitly unaudited), and the deferred status of DocumentDB Elastic clusters. Prior: **0.2.45** — paired with **Enterprise 0.40.3 / Community 0.2.47**. New in this release's teaching: on
 the **opt-in** RFC 3161 path (`NSAUDITOR_TSA_URL`; no default authority), a granted token that attests
 a DIFFERENT digest than the request carried is now refused (`tsa_imprint_mismatch`); the auditor
 instruction printed on every timestamped report is corrected to one that actually runs; and a

package/SKILL.md

@@ -16,11 +16,19 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.45 (knowledge current as of **EE 0.40.3** · **requires CE ≥ 0.2.45**) — the message-imprint release.
+> **Version:** 0.2.47 (knowledge current as of **EE 0.42.0** · **requires CE ≥ 0.2.49**) — the sovereign-cloud release.
+>
+> **What this release (EE 0.42.0) teaches:** **Non-commercial AWS partitions and Azure sovereign clouds are now first-class, and both REFUSE rather than silently reporting on the wrong estate.** When you drive a scan against GovCloud, China, an ISO partition or the European Sovereign Cloud, findings that previously read CLEAN now fire: a public S3 access point riding a bucket delegation, IAM privilege-escalation at CRITICAL (it demoted to HIGH before), shadow-admin graph edges that were missing entirely, and the full effective-decrypt severity ladder (it collapsed to `info`). **THE ID→DEFECT MAPPING, HERE ON THE ALWAYS-LOADED SURFACE because a reader asked for it BY ID got "no source confirming there was a partition-side fix" while it sat in an on-demand reference (measured 2026-08-28):** `1020` S3 access point riding a bucket delegation · `1030` IAM privesc severity + shadow-admin edges · `1110` KMS effective-decrypt ladder · `1050` API Gateway policy classification + SSRF parsers · `1200` alerting-destination liveness · `1040` region denominator. ⚠️ Do NOT attribute the S3 case to `1110` or the decrypt ladder to `1050` — those are the pre-fix misattributions. Pre-0.42.0 non-commercial reports are unproven on THOSE FAMILIES; findings outside them stand. For Azure, `AZURE_ENVIRONMENT` / `ARM_ENVIRONMENT` / `AZURE_ARM_ENDPOINT` / `AZURE_AUTHORITY_HOST` now select the cloud — and an unrecognised or self-contradicting selection **refuses the scan and emits an evidence gap naming the variable that fixes it**, because falling back to commercial is how an operator holding both commercial and sovereign credentials gets a real, clean-looking report about an estate they did not mean. **Every Azure scan stamps the estate it addressed — but WHERE it lands is channel-specific and the Desktop channel does NOT carry it.** On the CLI/report path the stamp rides the evidence stream and the concluder summary. Through MCP it does NOT: `get_findings` iterates `result.findings` with no `result.data` fallback, and the cloud summariser short-circuits on a non-nullish `findings[]` (an EMPTY array is non-nullish, so a genuinely clean Azure scan — the exact case you would want it for — still never reaches `data[]`). **So on Desktop you CANNOT name the estate on a clean Azure result: say that you cannot confirm which estate was addressed and that the operator must check the CLI or the selector variables — never guess one.** On the REFUSAL path the estate IS visible, because it is written into the gap finding's own text. Also new: the SBOM gate (`npm run gate:sbom`) emits CycloneDX/SPDX over *the installed package* rather than the source tree — ⚠️ **but it is a MAINTAINER-side repository script: `scripts/` ships ZERO files in the customer tarball, so an installed package CANNOT run that command** (the npm script entry ships; the script it points at does not). **Never hand `npm run gate:sbom` to an end user as something to run against their install** — that is a published instruction that cannot succeed; the SBOM is generated from a repository checkout and provided on request. And `docs/fips-posture.md` states approved *algorithms*, explicitly not a validated *module* — do not let a user infer FIPS 140 validation from it; whether the RUNTIME beneath the product is a validated module is a property of the operator's platform, not of this product. **Plugin count UNCHANGED at 29; all eight coverage matrices UNCHANGED.**
+
+> **Prior:** 0.2.46 (post-EE-0.41.0 · **requires CE ≥ 0.2.45**) — the DocumentDB release.
 >
 > ⛔ **If tool output reports an EE version NEWER than the knowledge bound above, say this skill's knowledge does not yet cover that version — never guess at capabilities it might add.**
 >
-> **What this release (EE 0.40.3) teaches:** **A timestamp for a DIFFERENT artifact is no longer accepted as yours.** RFC 3161 timestamping stays **opt-in** (`NSAUDITOR_TSA_URL`; no default authority). When enabled, a granted token carries a `messageImprint` — the digest it attests — and nothing compared it to the digest our request carried, so a replay, a caching proxy or an authority fault could return a valid timestamp for someone else's bytes and it was written as evidence, while the auditor's own `openssl ts -verify` printed `message imprint mismatch` → FAILED over it. Refused now, before any write, as **`tsa_imprint_mismatch`**, naming both digests. Two more codes join it: **`tsa_response_malformed`** (bytes RFC 3161 does not admit inside the response; openssl refuses such a file outright) and **`tsa_token_unreadable`** (neither this reader nor openssl could decode the token). **Eight refusal codes** total. ⚠️ **Teach the OPPOSITE direction too, because it is a LOOSENING and a user may report it as a change:** a **BER-encoded** token is no longer refused when openssl can read it. 0.40.2 refused those outright; CMS permits BER and `openssl ts -verify` accepts them, so the old behaviour discarded genuine evidence from authorities whose stacks nobody here has surveyed. A refusal now requires **both** readers to fail — so timestamps that start working again on 0.40.3 are the fix, not a regression. **The chain-of-custody envelope now records `artifacts[].tsa.imprintVerified`** (an explicit boolean) plus `imprintUnverifiedReason` when the comparison could not be made. ⚠️ Teach that **the absence of `imprintUnverified` is NOT the presence of verification** — read the boolean. And a run configured for timestamping that TIMESTAMPED fewer artifacts than it attempted now says so ONCE, carrying the refusal codes, so *"zero `.tsr` files"* is no longer indistinguishable from *"timestamping was never configured"*. ⚠️ **THE PUBLISHED AUDITOR INSTRUCTION CHANGED AND THE OLD ONE CANNOT BE RUN:** verify with `openssl ts -verify -in <file>.tsr -data <file> -CAfile <ca-bundle>`. The prior text passed `-queryfile` AND `-data` together — mutually exclusive; openssl exits 1 with **no verdict at all** — and named a `.tsq` that no pack contains, because the request is built in a temp directory and deleted. If a user quotes the old command and reports that verification failed, that is why. ⚠️ **NOT RETROACTIVE:** packs timestamped before 0.40.3 were never checked for imprint match; re-verify them, and treat a `.tsr` that fails as never having been a valid timestamp for that artifact. ⚠️ `signed: true` attests **protocol status and what the token SAYS it attests, never cryptography**. Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED; peer floor UNCHANGED at CE ≥ 0.2.45.
+> ⛔ **THE MIRROR RULE — when the REGISTRY lags this skill's knowledge bound.** If npm (or `npm view`) does not yet list the EE version named in the knowledge bound above, that version is **STAGED, not nonexistent** — this skill is rebuilt at staging, before publish, so the registry lagging the bound is the NORMAL pre-release state, not a contradiction to resolve. **The registry answers what is PUBLISHED; this skill answers what a version CONTAINS.** Asked what that version fixed, changed or contains, answer from this skill and state the publication status beside it ("per the registry, 0.42.0 is not yet published") — **never deny the content exists because the registry has not caught up, and never let a registry check override this mapping.** (Measured 2026-08-28: asked for the partition-fix plugin ids, an agent checked npm first, found the version unpublished, and answered "I have no source confirming there was a partition-side fix" — a true registry fact converted into a false content claim.)
+>
+> ⛔ **THE CAP ON BOTH RULES:** if ANY source — tool output **or the user's own words** — names an EE version NEWER than the knowledge bound above, this skill's knowledge stops at the bound: say so, do not guess, and do not apply this release's mapping to that newer version.
+>
+> **What EE 0.40.3 taught:** **A timestamp for a DIFFERENT artifact is no longer accepted as yours.** RFC 3161 timestamping stays **opt-in** (`NSAUDITOR_TSA_URL`; no default authority). When enabled, a granted token carries a `messageImprint` — the digest it attests — and nothing compared it to the digest our request carried, so a replay, a caching proxy or an authority fault could return a valid timestamp for someone else's bytes and it was written as evidence, while the auditor's own `openssl ts -verify` printed `message imprint mismatch` → FAILED over it. Refused now, before any write, as **`tsa_imprint_mismatch`**, naming both digests. Two more codes join it: **`tsa_response_malformed`** (bytes RFC 3161 does not admit inside the response; openssl refuses such a file outright) and **`tsa_token_unreadable`** (neither this reader nor openssl could decode the token). **Eight refusal codes** total. ⚠️ **Teach the OPPOSITE direction too, because it is a LOOSENING and a user may report it as a change:** a **BER-encoded** token is no longer refused when openssl can read it. 0.40.2 refused those outright; CMS permits BER and `openssl ts -verify` accepts them, so the old behaviour discarded genuine evidence from authorities whose stacks nobody here has surveyed. A refusal now requires **both** readers to fail — so timestamps that start working again on 0.40.3 are the fix, not a regression. **The chain-of-custody envelope now records `artifacts[].tsa.imprintVerified`** (an explicit boolean) plus `imprintUnverifiedReason` when the comparison could not be made. ⚠️ Teach that **the absence of `imprintUnverified` is NOT the presence of verification** — read the boolean. And a run configured for timestamping that TIMESTAMPED fewer artifacts than it attempted now says so ONCE, carrying the refusal codes, so *"zero `.tsr` files"* is no longer indistinguishable from *"timestamping was never configured"*. ⚠️ **THE PUBLISHED AUDITOR INSTRUCTION CHANGED AND THE OLD ONE CANNOT BE RUN:** verify with `openssl ts -verify -in <file>.tsr -data <file> -CAfile <ca-bundle>`. The prior text passed `-queryfile` AND `-data` together — mutually exclusive; openssl exits 1 with **no verdict at all** — and named a `.tsq` that no pack contains, because the request is built in a temp directory and deleted. If a user quotes the old command and reports that verification failed, that is why. ⚠️ **NOT RETROACTIVE:** packs timestamped before 0.40.3 were never checked for imprint match; re-verify them, and treat a `.tsr` that fails as never having been a valid timestamp for that artifact. ⚠️ `signed: true` attests **protocol status and what the token SAYS it attests, never cryptography**. Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED; peer floor UNCHANGED at CE ≥ 0.2.45.
 >
 > **Prior:** 0.2.44 (post-EE-0.40.2) — **A TSA rejection is no longer written as evidence.** RFC 3161 timestamping stays opt-in (`NSAUDITOR_TSA_URL`; no default authority). When enabled, the response status is now read before anything reaches disk: a refusal writes NO `.tsr`, leaves any sidecar from a prior success byte-identical, and records `signed: false` with one of five reason codes — `tsa_submit_failed` · `tsa_rejected` · `tsa_not_granted` · `tsa_response_no_token` · `tsa_response_unparseable` — in the chain-of-custody envelope. Teach the reading: **a missing `.tsr` beside a `.sha256` means REFUSED, not failed** — the per-artifact ledger is `artifacts[].tsa.signed` / `.error` in the envelope, and `tsa_rejected` (the authority declined; fix the request) routes to a different action than `tsa_not_granted` (waiting or revocation; ask again later). ⚠️ **`signed: true` attests protocol status, never cryptography** — it means the authority granted and enclosed a token; `openssl ts -verify` remains the only thing that adjudicates the token itself. ⚠️ Packs produced by earlier versions against a rejecting authority may carry a ~50-byte rejection recorded as signed (real tokens run ~4.6 KB) — a tiny `.tsr` that fails `openssl ts -verify` is that class, and re-signing under 0.40.2 refuses honestly instead. Also taught: **the TSA policy-OID option (`NSAUDITOR_TSA_POLICY_OID`) works on OpenSSL ≥ 3.0 hosts for the first time** — OpenSSL 3.0 renamed the query flag to `-tspolicy` while LibreSSL kept `-policy`, both report a 3.x version, and the fix attempts the modern spelling and falls back; when the legacy spelling was used the signing result carries `tsaPolicyFlagFallback`. This is the option commercial TSAs (DigiCert / GlobalSign / Sectigo) require, so an operator who saw `unexpected_failure` with a policy OID configured should re-try on 0.40.2. And **parenthesised `(Dim N)` internal dimension codes are gone from GCP finding prose** — bare `Dim N` references remain in some GCP IAM finding text, a known census-pinned residual, not a new defect to report. Plugin catalog UNCHANGED at 28 EE / 55 overall; all eight coverage matrices UNCHANGED; peer floor UNCHANGED at CE ≥ 0.2.45.
 >
@@ -320,7 +328,7 @@ Phase 5: SCORING (Pro/Ent)     Risk scoring → Pro AI prompts → Compliance ma
 
 ---
 
-## Plugin Reference (55 scanners — 27 Community + 28 Enterprise)
+## Plugin Reference (56 scanners — 27 Community + 29 Enterprise)
 
 **`references/plugins.md` is the authoritative catalog.** The counts above are derived from the
 shipped plugin files; verify any of them with `nsauditor-ai license --plugins`, which prints the
@@ -494,7 +502,7 @@ Add to your MCP configuration with the same command/args pattern.
 |---------|-------|-------------|
 | **Community** | Free / MIT | 27 plugins (service probes + host/network discovery + intelligence/meta), basic AI, CTEM, SARIF, scan history |
 | **Pro** | $49/mo | + CVE matching, risk scoring, analysis agents, Pro plugins (040 TLS / 050 TRIBE / 060 DNS) |
-| **Enterprise** | $2k+/yr | + 28 enterprise plugins (1020-1222 range) — 27 cloud-substrate auditors covering AWS / GCP / Azure plus `1023 Zero Trust Assessment` (which declares no cloud provider and scores zero-trust posture from a NETWORK-host scan — it never runs on a cloud pass, and selecting it by id on its own does not run it either) — against every shipped framework (SOC 2 10 covered + 4 partial; HIPAA; NIST CSF 2.0; PCI DSS v4.0.1; ISO/IEC 27001:2022; CIS Controls v8; GDPR Art. 32 infrastructure substrate; NIST SP 800-171 Rev 2 evidence substrate for CMMC Level 2 preparation); SOC 2 evidence-pack generation; SHA-256 chain-of-custody attestations (RFC 3161 timestamping is opt-in via the `NSAUDITOR_TSA_URL` environment variable — there is no CLI flag and no default, it makes an outbound call to the Time-Stamp Authority you name, and it was exercised against a live Time-Stamp Authority on BOTH delivery vehicles — the npm path and, from inside the pushed `:0.33.0` Marketplace image, on 2026-08-08; retained images `:0.32.11` and earlier carry no `openssl`); air-gapped operation (offline licensing + offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`) |
+| **Enterprise** | $2k+/yr | + 29 enterprise plugins (1020-1230 range) — 28 cloud-substrate auditors covering AWS / GCP / Azure plus `1023 Zero Trust Assessment` (which declares no cloud provider and scores zero-trust posture from a NETWORK-host scan — it never runs on a cloud pass, and selecting it by id on its own does not run it either) — against every shipped framework (SOC 2 10 covered + 4 partial; HIPAA; NIST CSF 2.0; PCI DSS v4.0.1; ISO/IEC 27001:2022; CIS Controls v8; GDPR Art. 32 infrastructure substrate; NIST SP 800-171 Rev 2 evidence substrate for CMMC Level 2 preparation); SOC 2 evidence-pack generation; SHA-256 chain-of-custody attestations (RFC 3161 timestamping is opt-in via the `NSAUDITOR_TSA_URL` environment variable — there is no CLI flag and no default, it makes an outbound call to the Time-Stamp Authority you name, and it was exercised against a live Time-Stamp Authority on BOTH delivery vehicles — the npm path and, from inside the pushed `:0.33.0` Marketplace image, on 2026-08-08; retained images `:0.32.11` and earlier carry no `openssl`); air-gapped operation (offline licensing + offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`) |
 
 → [Pricing](https://www.nsauditor.com/ai/pricing/)
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.45",
-  "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
+  "version": "0.2.47",
+  "description": "AI Agent Skill for NSAuditor AI \u2014 gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",
     "ai-agent",
@@ -48,7 +48,7 @@
     "examples/"
   ],
   "peerDependencies": {
-    "nsauditor-ai": ">=0.2.45"
+    "nsauditor-ai": ">=0.2.49"
   },
   "peerDependenciesMeta": {
     "nsauditor-ai": {

package/references/plugins.md

@@ -165,7 +165,51 @@ listings, and default pages.
 
 ---
 
-## Enterprise Plugins (28)
+## Enterprise Plugins (29)
+
+> **⚠️ EE 0.42.0 — non-commercial estates.** These plugins are partition- and sovereign-cloud aware.
+>
+> **AWS.** ARN handling covers `aws`, `aws-us-gov`, `aws-cn`, the four ISO partitions and `aws-eusc`.
+> Before 0.42.0 several plugins UNDER-REPORTED outside the commercial partition — the scan ran and
+> looked, but named families came back thinner than they should have: a public S3 access point riding
+> a bucket delegation produced **no finding** (**1020**); IAM privilege escalation demoted CRITICAL→HIGH
+> with shadow-admin graph edges missing outright (**1030**); the KMS effective-decrypt severity ladder
+> collapsed to `info` (**1110**); API Gateway resource-policy classification and the SSRF-defence
+> parsers refused non-commercial input (**1050**); alerting-destination liveness (**1200**); and the
+> region denominator in the scan-scope disclosure borrowed the commercial universe for an unknown
+> partition (**1040**).
+>
+> ⚠️ **How to read a PRE-0.42.0 report, stated per cloud because the two are not the same failure.**
+> *AWS, non-commercial partition:* a clean result is **UNPROVEN on those families specifically** —
+> resource-policy exposure breadth, S3 access-point delegation, IAM privesc severity and shadow-admin
+> edges, KMS effective-decrypt severity, API Gateway policy classification, alerting-destination
+> liveness, and the region-count disclosure. **Findings outside them stand**; do not tell an operator
+> to discard a whole report. *Azure, sovereign estate:* no scan of that era could address one at all.
+> A clean Azure result from before 0.42.0 describes **the commercial estate** (if the credentials were
+> valid in both) or **nothing** (if they were gov-only, which shows up as gaps). That is wrong-subject
+> evidence, not weak evidence.
+>
+> **Azure (1022, 1220, 1221, 1222).** The estate is selected by `AZURE_ENVIRONMENT` / `ARM_ENVIRONMENT`
+> / `AZURE_ARM_ENDPOINT` / `AZURE_AUTHORITY_HOST`. An unrecognised or self-contradicting selection
+> **refuses** rather than falling back to commercial, and names the variable that fixes it.
+> **A refusal is not a scan failure to route around; it is the finding.**
+>
+> ⚠️ **What you can actually SEE depends on the channel — check which one you are on before you
+> summarise.** Via **Desktop / `scan_cloud`**: the refusal arrives as an **itemized evidence gap with a
+> badge** (`details.evidenceGap === true`, shown at any severity). You will **not** see a literal
+> `up:false` — no MCP consumer reads that field. And the **estate stamp is NOT in the `scan_cloud`
+> summary**: it rides an INFO-severity evidence line, which the summariser rolls up rather than
+> itemizing. ⚠️ **and the estate is NOT retrievable here at all.** `get_findings` iterates
+> `result.findings` with no `result.data` fallback, and the summariser short-circuits on a non-nullish
+> `findings[]` — an EMPTY array is non-nullish, so a clean Azure scan never reaches `data[]` either.
+> **On Desktop, say you cannot confirm the estate and point the operator at the CLI or the selector
+> variables. Never name one you did not see.** A clean report about the wrong subscription reads
+> exactly like a clean report about the right one, and on this channel the subject is not available.
+> ⚠️ Refusals are `severity: 'low'`, NOT `INFO` — a `get_findings` call filtered `severity:"INFO"`
+> returns ZERO rows for them. Filter by provider, or not at all. Via the **CLI**: the estate is
+> stated in the scan summary, and `up:false` additionally FAILS the controls that source attests
+> instead of passing them — the compliance layer only exists on this path.
+
 
 > **EE plugin ID range.** As of EE 0.3.9 (2026-05-12), all EE plugins use the disjoint **1000+ ID range** to avoid CE collision. The earlier 020/021/022/023/030/040/050/060 IDs were renumbered to 1020/1021/1022/1023/1030/1040/1050/1060. CE reserves 001-099. EE plugins audit AWS / GCP / Azure cloud substrate end-to-end against **every shipped compliance framework** — SOC 2, HIPAA §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 (Art. 32 infrastructure substrate only, NOT GDPR compliance) and NIST SP 800-171 Rev 2 (examine-method evidence substrate for CMMC Level 2 preparation, never a certification). **The authoritative enumeration, with each framework's citation level and ship version, is in `SKILL.md` — it is not repeated here.** Each plugin's findings route to every one of them via the framework-agnostic engine plus a per-framework control-citation map, so a report cites only its own framework's ids (SOC 2 `CC6.1`, HIPAA `§164.312(a)(1)`, NIST `PR.AA-01`, PCI `Req 1.2.1`, ISO `A.8.24`, CIS `4.4`, GDPR `Art.32(1)(b)`, 800-171 `3.13.16`) — closing cross-framework citation leak across every ordered pair. ⚠️ 800-171 and PCI DSS ids COLLIDE exactly (`3.5.1` is real in both), so an 800-171 citation always carries its qualifier. Every plugin is enterprise-gated by the `cloudScanners` capability and runs against customer-supplied cloud credentials. Multi-framework workflow: `--compliance all` (every shipped framework), or any CSV subset such as `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171` — one scan produces a separate, complete auditor-ready evidence pack per framework requested. **Zero BAA required** for HIPAA — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure (and CHD never leaves for PCI DSS CDE-isolation threat models). **NIST CSF 2.0 Implementation Tiers 1-4** (Partial / Risk-Informed / Repeatable / Adaptive) are organizational-maturity claims explicitly OOS for infrastructure scanning — surfaced in renderer as cover-page Tiers OOS disclaimer section (markdown + HTML parity); pair with NIST-aware GRC platforms (Tugboat Logic, Drata NIST CSF, Vanta NIST CSF, AuditBoard). **PCI DSS v4.0.1 specifics**: sub-requirement-level mapping for QSA Report on Compliance workflow (MVP-67 density: 67 of ~250 sub-requirements. **For the current covered/partial/OOS triple, call `compliance_matrix` with `framework: "pci-dss"`** — it derives from the shipped framework map at call time. A figure typed here goes stale: this sentence carried `20 + 8 + 39` against a shipped `19 / 9 / 39`, the same stale triple that had already propagated to a public page once). **Req 12 Information Security Program OOS-by-design entirely** (Targeted Risk Analysis Req 12.3.1 + Customized Approach Documentation Req 12.3.2 + TPSP Responsibility Matrix Req 12.8.5 + IR personnel training Req 12.10.4 all Defined-only per Appendix E). **Req 5 anti-malware + Req 9 physical OOS-entirely** (endpoint EDR + facility-tier). **Req 3 stored CHD OOS-by-design at technical-control layer** pending operator CDE attestation via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. **Defined-vs-Customized Approach discipline per Appendix E** — 15 Defined-only sub-requirements enforced at schema layer. CAO text MVP-deferred to EE 0.11.1 patch. **Card-brand AOC enforcement priority view** (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC — the actual penalty mechanism). Pair with PCI-aware GRC platforms (Drata PCI, Vanta PCI, AuditBoard PCI module, OneTrust GRC).
 
@@ -199,6 +243,7 @@ listings, and default pages.
 | 1220 | Azure Storage Account Data-Protection Auditor (**NEW EE 0.13.2** — Move C-2; **+2 dims EE 0.13.3** — Move C-2.1; plugin count 25 → 26; first dedicated Azure auditor beyond the multi-purpose 1022 scanner) | Enterprise | Audits the Azure Storage Account data-protection surface across **7 dims** — **orthogonal to plugin 1022** which owns the network-exposure dims (no double-emission; mirrors the AWS 1020 S3-scanner + 1120 S3-lifecycle two-plugin split). (1) **HTTPS-only transit** (`enableHttpsTrafficOnly` — HIGH on plaintext HTTP; CC6.7) + (2) **minimum TLS version** (< TLS1_2 → MEDIUM; CC6.7) + (3) **Shared Key authorization** (`allowSharedKeyAccess` — bypasses Azure AD identity; CC6.1; Azure field-default discipline: absent = ENABLED, never silent-PASS) + (4) **infrastructure (double) encryption** (`requireInfrastructureEncryption`; C1.1) + (5) **encryption key source incl. CMK reachability + rotation** (`encryption.keyVaultProperties` — keySource=Microsoft.Keyvault PASS only when the key is currently resolvable + auto-rotating; a disabled/revoked/version-pinned CMK degrades, not silent-PASS; C1.1) + (6) **blob recoverability** (soft-delete + versioning via the secondary `blobServices.getServiceProperties` path — A1.2; EE 0.13.3) + (7) **per-container anonymous public access** (account-toggle-aware via `blobContainers.list` — `publicAccess=Blob/Container` + allowBlobPublicAccess=true → HIGH effective exposure; C1.1; EE 0.13.3). Conservative classifier: indeterminate field / AccessDenied / secondary-path failure → evidence-gap (never silent-PASS); `for await` pagination. Single-subscription scope surfaced explicitly. Built + reviewed through the cloud-plugin-false-negatives lens. `@azure/arm-storage` + `@azure/identity`. | CC6.7 / CC6.1 / C1.1 / A1.2 |
 | 1221 | Azure NSG Perimeter Auditor (**NEW EE 0.14.0** — Move C-2.2; **UDP lane EE 0.14.1**; plugin count 26 → 27; the Azure analog of AWS plugin 1170) | Enterprise | A CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups — **non-overlapping-by-depth with plugin 1022's flat per-rule NSG lint** (no double-emission of a verdict; mirrors the AWS 1023-observed / 1170-declared two-plugin precedent). Evaluates each NSG's inbound rules in **Azure priority order** (first match wins; DenyAllInbound default): (1) **all-protocol (`*`) public Allow** — every port reachable from the public internet + (2) **public-source (`*`/`0.0.0.0/0`/`Internet`) to a restricted TCP port** (SSH/RDP/MSSQL/MySQL/Postgres/Redis/Memcached/MongoDB/Elasticsearch/CouchDB/SMB/WinRM/Oracle/Docker/Kubelet) + (3) **`::/0` IPv6-wildcard to a restricted port** (the dimension 1022's flat lint misses) + **(2u/3u) public-source / `::/0` to a restricted UDP service** (DNS/TFTP/rpcbind/NTP/NetBIOS/SNMP/CLDAP/IKE/Syslog/IPMI/OpenVPN/MSSQL-Monitor/SSDP/IPsec-NAT-T/Memcached — closes the public-UDP false negative, **EE 0.14.1**) + (4) **public→non-restricted port** INFO substrate + (5) **PASS substrate** when no public restricted exposure. **Attachment-aware severity** via the read-only `nsg.subnets[]`/`networkInterfaces[]` back-references — attached → CRITICAL (effective exposure); orphaned → MEDIUM (latent). Per-transport effective priority/deny-override resolution + port-range expansion + `0.0.0.0/1` split-range coverage + service-tag/ASG-source normalization (VirtualNetwork/AzureLoadBalancer/ASG = not public). Conservative classifier: denied/indeterminate listAll → evidence-gap; one malformed NSG degrades per-resource (never aborts the scan); `for await` pagination; single-subscription scope explicit. Built + reviewed through the cloud-plugin-false-negatives lens (EE 0.14.0 SHIP-WITH-FOLDS 2 LOW; EE 0.14.1 UDP lane SHIP-WITH-FOLDS 2 MED + 1 LOW, all folded). `@azure/arm-network` + `@azure/identity`. | CC6.6 |
 | 1222 | Azure Key Vault Deep Auditor (**NEW EE 0.15.0** — Move C-2.3; plugin count 27 → 28; the third dedicated Azure auditor after 1220 storage + 1221 NSG; **hotfixed EE 0.15.1** — Dim-3 SDK-shape + Dim-4 inherited-admin severity re-tune) | Enterprise | The deep Key Vault auditor — the KV analog of how 1221 deepens 1022's flat NSG dim; **orthogonal to plugin 1022's vault-property dims** (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission of a verdict. Enumerates each vault's **keys, role assignments, and diagnostic settings** across 4 dims: (1) key **auto-rotation policy** — keys with no `rotationPolicy` / no rotate-action → finding + (2) key **expiry** — keys with no `expires` (or already-expired), with epoch-s/ms/Date/string coercion (closes the ms-overflow false-clean) + (3) **diagnostic logging → Log Analytics** — vaults with no `AuditEvent`→workspace diagnostic setting; reads `@azure/arm-monitor`'s `diagnosticSettings.list()` correctly as an `await`-ed `{value:[]}` collection object (NOT a paged async-iterator — the EE 0.15.1 H-1 fix; pre-fix the dim always threw and degraded to a non-functional evidence-gap), soft-degrades to an evidence-gap if the SDK is absent + (4) **privileged-access depth** — RBAC `roleAssignments` (admin/data-plane/**scope-aware severity**: vault-scoped control-plane god roles + Key Vault Administrator at any scope → HIGH; inherited subscription/management-group-scope Owner/User-Access-Administrator → MEDIUM, inherited Contributor → LOW — the EE 0.15.1 H-2 re-tune that stops flagging the ubiquitous inherited-admin reality as HIGH on every RBAC vault) + legacy `accessPolicies` breadth (export + wide-crypto permissions). **Secret/cert expiry is a deliberate data-plane scope boundary** (explicit caveat — the control-plane mgmt API does not expose data-plane object expiry). Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource (never aborts the scan); single-subscription scope explicit. Findings route across every shipped framework (SOC 2 CC6.3/C1.1/CC6.1/CC7.2 · HIPAA §164.312(a)(2)(iv)/(b)/(a)(1) · NIST CSF PR.DS-01/DE.CM-09/PR.AA-05 · PCI DSS 3.5.1/10.2.1/7.2.1 · ISO 27001 A.8.24/A.8.15/A.5.15+A.8.2 · CIS v8 3.11/8.2/5.4 · GDPR Art.32(1)(b)-confidentiality + Art.32(1)(b)-integrity) — every coverage matrix UNCHANGED at that release. Built + reviewed through the cloud-plugin-false-negatives lens (SHIP-WITH-FOLDS 0C/3H/2M/4L; 4 folded). `@azure/arm-keyvault` + `@azure/arm-monitor` + `@azure/arm-authorization` + `@azure/identity`. | CC6.3 / C1.1 / CC6.1 / CC7.2 |
+| 1230 | AWS DocumentDB Auditor (**NEW EE 0.41.0** — plugin count 28 → 29; owns the `docdb` engine on the shared RDS control plane, closing the measured false clean where an unencrypted DocumentDB cluster read CLEAN under the RDS auditor's Aurora-only cluster filter) | Enterprise | Seven dimensions: storage encryption at rest + KMS custody classification (customer-alias PASS / AWS-managed MEDIUM / key-UUID and foreign-account custody stay evidence gaps); `tls` cluster parameter (disabled = HIGH); `audit_logs` parameter + CloudWatch `audit` export (generating-but-unexported is its own MEDIUM); automated backup retention vs the 7-day floor; deletion protection; replica/AZ availability topology under the CLUSTER lens (never the per-instance Multi-AZ flag — that is RDS semantics and does not apply); manual-snapshot `restore`-attribute probes (`all` = publicly restorable CRITICAL; external account ids = HIGH). Non-docdb engines counted and skipped; DocumentDB Elastic clusters declared deferred. Paired 1140 change: docdb/neptune engine-filtered with counted skips + a standing disclosure — a Neptune estate is explicitly UNAUDITED. |
 
 ---