nsauditor-ai-agent-skill 0.2.51 → 0.2.52

package/CHANGELOG.md

@@ -4,6 +4,20 @@ Release notes for **`nsauditor-ai-agent-skill`** — installable knowledge packa
 
 ---
 
+## 0.2.52 (⏳ PRE-PUBLISH — opened 2026-09-14, NOT YET ON npm) — Enterprise 1.0.0: the contract is binding, the counts are corrected
+
+Paired with **Enterprise 1.0.0 / Community 0.2.54** (Community is a README-only release; no scanner change). **NOT a
+floor bump: Community stays `>= 0.2.49`.** Plugin enumeration unchanged at 29 Enterprise plugins;
+all eight coverage matrices unchanged.
+
+What the skill now teaches: `Findings analyzed` counts findings rather than issues, so a 1.0.0 pack
+reads a SMALLER number than a 0.46.0 pack over the same estate and that is the correction — the new
+`report.summary.findingsReceived` / `findingsRouted` fields let an agent check the chain from the
+pack alone; an Azure RBAC assignment at the root scope is named as such; PCI DSS `11.5.2` is
+critical-file change detection. No tool surface changed.
+
+---
+
 ## 0.2.51 (2026-09-09) — the retired PCI density label, and why a pointer did not save it
 
 Paired with **Enterprise 0.46.0 / Community 0.2.53**. **NOT a floor bump: Community stays

package/README.md

@@ -9,9 +9,13 @@ An installable knowledge package that teaches AI coding agents how to use NSAudi
 
 Works with **Claude Code**, **Claude Desktop**, **Cursor**, **Windsurf**, **VS Code Copilot**, and any MCP-aware agent.
 
+> **About the `<!-- nsa:derived id="…" -->…<!-- /nsa:derived -->` markers in `SKILL.md`:** the text between them is a fact rendered by the Enterprise build from the trio's `package.json` files and shipped framework data (versions, the Community floor, plugin counts, matrix movement). Quote the text; the markers are only how it stays current.
+
 ## Current release
 
-**0.2.51** — paired with **Enterprise 0.46.0 / Community 0.2.53**. ⚠️ **NOT a floor bump: Community stays >= 0.2.49.** `references/plugins.md` carried the retired `MVP-67` PCI density label; the enumeration is **72 — 19 covered, 9 partial, 44 out of scope with a stated reason**, derived from the shipped framework file. The line already told a reader to call `compliance_matrix` for the current triple and that did not save it: **a pointer beside a hard-coded number does not stop the number rotting; only removing the number does.**
+**0.2.52** — paired with **Enterprise 1.0.0 / Community 0.2.54** (Community is a README-only release). ⚠️ **NOT a floor bump: Community stays >= 0.2.49.** Plugin enumeration unchanged at 29 Enterprise plugins; all eight coverage matrices unchanged. New in this release's teaching: `Findings analyzed` counts findings rather than issues, so a 1.0.0 pack reads a SMALLER number than a 0.46.0 pack over the same estate and that is the correction — the new `report.summary.findingsReceived` / `findingsRouted` fields let an agent check `findingsRouted ≤ findingCount ≤ findingsReceived` from the pack alone; an Azure RBAC assignment at the root scope (`/`) is named as such; PCI DSS `11.5.2` is critical-file change detection (the payment-page controls are `11.6.1` and `6.4.3`). No tool surface changed. The evidence contract in Enterprise's `docs/contract-v1.md` is binding from EE 1.0.0. See [CHANGELOG.md](./CHANGELOG.md).
+
+**Prior: 0.2.51** — paired with **Enterprise 0.46.0 / Community 0.2.53**. ⚠️ **NOT a floor bump: Community stays >= 0.2.49.** `references/plugins.md` carried the retired `MVP-67` PCI density label; the enumeration is **72 — 19 covered, 9 partial, 44 out of scope with a stated reason**, derived from the shipped framework file. The line already told a reader to call `compliance_matrix` for the current triple and that did not save it: **a pointer beside a hard-coded number does not stop the number rotting; only removing the number does.**
 
 **Prior: 0.2.50** — paired with **Enterprise 0.45.0 / Community 0.2.52**. ⚠️ **NOT a floor bump: Community stays >= 0.2.49.** New in this release's teaching, and it is a REFUSAL rule before it is a feature note: **the NTP clock attestation is WITHDRAWN** — the probe is deleted, the three `complianceNtp*` options are gone, there is no `NSAUDITOR_NTP_*` environment variable and there never was one, and it is NOT on a roadmap, so a hedge like "planned" is now a promise rather than a disclosure. The probe validated any reply of at least 48 bytes with a non-null transmit timestamp and nothing else — no mode byte, no stratum, no originate echo — and it measured the SCANNER's clock while every framework control about time synchronisation asks about the customer's estate. Point users at **opt-in RFC 3161 timestamping** instead (`NSAUDITOR_TSA_URL`; an outbound call to a third party, off by default), whose `.tsr` time comes from the authority rather than from the host. ⚠️ **The attestation's shape did NOT change** — all six `ntp` keys remain, now constants, because the envelope is a frozen schema id; a null `probedAt` is not a failed probe.
 

package/SKILL.md

@@ -16,7 +16,9 @@ description: >
 
 # NSAuditor AI — Agent Skill
 
-> **Version:** 0.2.51 (knowledge current as of **EE 0.46.0** · **requires CE ≥ 0.2.49**) — the PCI-citation-provenance release. **PCI DSS is 19 covered / 9 partial / 44 out of scope across 72 enumerated sub-requirements**; the other seven matrices are unchanged. ⚠️ **Do not cite `4.2.2.1` — it does not exist in PCI DSS v4.0.1** — and do not attribute Customized-Approach ineligibility to any appendix: the standard states it in each requirement's own Customized Approach Objective cell. Sampling is Section 6, which prescribes no sample size. For any PCI triple, call `compliance_matrix` rather than quoting a number from this file.
+> **Version:** <!-- nsa:derived id="skill-version" -->0.2.52<!-- /nsa:derived --> (knowledge current as of **EE <!-- nsa:derived id="ee-version" -->1.0.0<!-- /nsa:derived -->** · **requires CE ≥ <!-- nsa:derived id="ce-floor" -->0.2.49<!-- /nsa:derived -->**) — the 1.0 release: the evidence contract is binding and the cargo is corrective. Teach three things: (1) **`Findings analyzed` now counts FINDINGS, not issues** — a 1.0.0 pack over the same estate as a 0.46.0 pack shows a SMALLER number with no change on the customer's side, and that is the correction; `report.summary.findingsReceived` / `findingsRouted` let a reader check `findingsRouted ≤ findingCount ≤ findingsReceived` from the pack alone. (2) An Azure RBAC assignment at the ROOT scope (`/`) is now named as the root scope, not the subscription, and a plugin's `deferredScope` bounds THAT plugin only. (3) PCI DSS `11.5.2` is critical-file change detection; the payment-page controls are `11.6.1` and `6.4.3`. Plugin count UNCHANGED at <!-- nsa:derived id="plugins:ee" -->29<!-- /nsa:derived -->; <!-- nsa:derived id="matrix-movement" -->all eight coverage matrices unchanged since EE 0.46.0<!-- /nsa:derived -->; Community stays at <!-- nsa:derived id="ce-version" -->0.2.54<!-- /nsa:derived -->.
+>
+> **Prior: 0.2.51** (post-EE-0.46.0 · **requires CE ≥ 0.2.49**) — the PCI-citation-provenance release. **PCI DSS is 19 covered / 9 partial / 44 out of scope across 72 enumerated sub-requirements**; the other seven matrices are unchanged. ⚠️ **Do not cite `4.2.2.1` — it does not exist in PCI DSS v4.0.1** — and do not attribute Customized-Approach ineligibility to any appendix: the standard states it in each requirement's own Customized Approach Objective cell. Sampling is Section 6, which prescribes no sample size. For any PCI triple, call `compliance_matrix` rather than quoting a number from this file.
 >
 > **What EE 0.45.0 teaches, and it is a REFUSAL rule before it is a feature note.**
 > **⚠️ THE NTP CLOCK ATTESTATION IS WITHDRAWN. Do not describe it, offer it, or plan around it.**
@@ -192,6 +194,8 @@ Out of scope, with the control ids and the per-group out-of-scope reasons.
 matrix from the plugin inventory, from a scan result, or from documentation — coverage is a property of the shipped
 framework maps, not of the plugin list, and a derived matrix will disagree with the customer's own report.
 
+⚠️ **Never collapse a coverage triple into a single percentage or a "fully covers" figure.** State covered, partial and out of scope as three separate numbers with their ids; a percentage or a "fully" phrasing folds partial into covered and overstates coverage — a 19 / 9 / 44 matrix is 19 covered, not "about 39% fully."
+
 ⚠️ `outOfScope` is the **flattened sub-criterion count**, not the number of out-of-scope groups: SOC 2 returns 37
 ids across 11 groups. Publishing the group count yields a plausible-looking 10 / 4 / 11.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai-agent-skill",
-  "version": "0.2.51",
+  "version": "0.2.52",
   "description": "AI Agent Skill for NSAuditor AI — gives any AI coding agent built-in knowledge of NSAuditor's MCP tools, schemas, plugins, and security audit workflows.",
   "keywords": [
     "nsauditor",