nsauditor-ai 0.1.53 → 0.1.54

package/README.md

@@ -17,7 +17,8 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-- **0.1.53 (current)** — docs-only patch announcing **EE 0.5.4 release** (paired release narrative). **EE plugin count UNCHANGED at 20** (no new plugin in 0.5.4; cross-plugin Thread H sweep). **§7.5 closure**: `_promote*FromKms` cross-plugin signature hardening on plugin 1140 v2 + plugin 1180 v2 — Map-form lookup replaces caller-side parallel-threading (closes false-CLEAN class). **§8 closure**: operator-config DoS caps on plugin 1170 v2 (`_OPERATOR_CONFIG_MAX_ENTRIES = 1000`). **Clean reviewer pass** (0 R-CRITICAL + 0 R-HIGH; 3 R-MEDIUM/LOW coverage pins folded same-session). **+20 new tests** cross-plugin; EE full regression: 4982/4982; 50-session 100% green streak preserved. **Coverage matrix UNCHANGED at 10/4/33** — pure structural-discipline tightening. CE binary unchanged. **Tenth consecutive trio-publish across EE + CE + agent-skill** — 0.4.5–0.5.4. **v0.5.x close-out cycle**; ready for 0.6.0 milestone.
+- **0.1.54 (current)** — docs-only patch announcing **EE 0.6.0 release** (paired release narrative — minor-version milestone). **EE plugin count 20 → 21** — EE-RT.19 v1 NEW plugin 1160 AWS VPC Endpoints / PrivateLink Auditor. **First plugin to specifically audit the PrivateLink isolation boundary** (complements plugin 1170 layer-4 SG perimeter with SERVICE-LAYER perimeter audit). **4 SOC 2 dimensions**: endpoint resource policy permissive principals (CC6.6 CRITICAL on unconditional wildcard); PrivateDNS enabled (CC6.6 MEDIUM silent-bypass when Interface + disabled); endpoint state (A1.2 + CC7.2 HIGH on `failed`); endpoint type substrate disclosure. **Clean reviewer pass** (0 R-CRITICAL + 0 R-HIGH; 2 R-MEDIUM/NIT folded same-session). **+59 new tests**; EE regression: 5044/5044 across 792 suites; 51-session 100% green streak. **7 new soc2.json rules** (5 CC6.6 + 2 CC7.2/A1.2 dual-mapped). Coverage matrix UNCHANGED at 10/4/33. CE binary unchanged. **Eleventh consecutive trio-publish across EE + CE + agent-skill** — 0.4.5–0.6.0.
+- **0.1.53 (deprecated)** — docs-only patch announcing **EE 0.5.4 release** (paired release narrative). **EE plugin count UNCHANGED at 20** (no new plugin in 0.5.4; cross-plugin Thread H sweep). **§7.5 closure**: `_promote*FromKms` cross-plugin signature hardening on plugin 1140 v2 + plugin 1180 v2 — Map-form lookup replaces caller-side parallel-threading (closes false-CLEAN class). **§8 closure**: operator-config DoS caps on plugin 1170 v2 (`_OPERATOR_CONFIG_MAX_ENTRIES = 1000`). **Clean reviewer pass** (0 R-CRITICAL + 0 R-HIGH; 3 R-MEDIUM/LOW coverage pins folded same-session). **+20 new tests** cross-plugin; EE full regression: 4982/4982; 50-session 100% green streak preserved. **Coverage matrix UNCHANGED at 10/4/33** — pure structural-discipline tightening. CE binary unchanged. **Tenth consecutive trio-publish across EE + CE + agent-skill** — 0.4.5–0.5.4. **v0.5.x close-out cycle**; ready for 0.6.0 milestone.
 - **0.1.52 (deprecated)** — docs-only patch announcing **EE 0.5.3 release** (paired release narrative). **EE plugin count UNCHANGED at 20** (no new plugin in 0.5.3; existing plugin 1190 `aws-ses-auditor` extended via **EE-RT.18 v3**: Part A DKIM public-key fingerprint capture/pin + Part B in-band DMARC alignment classifier). **5 same-session reviewer folds** (1 R-CRITICAL + 3 R-HIGH + 1 R-MEDIUM). **R-CRITICAL closure (discovered via test)**: `_stripControlChars` 256-char truncation corrupted long DKIM keys producing wrong SHA-256 fingerprints — new `_stripControlCharsNoTruncate` helper for cryptographic-data surface. **R-HIGH closures**: empty/short-key floor (≥128 bytes catches `p=` empty-key substitution attacks) + multiple-DKIM1-records LOW + evidenceGap (no silent [0] truncation) + DMARC alignment double-failure visibility. **R-MEDIUM closure**: pin-store + failed-capture-on-pinned-token downgraded to LOW + evidenceGap. **Coverage matrix UNCHANGED at 10/4/33** — 8 new aws-ses-auditor mapping rules (CC6.1 + Privacy). **+61 new tests this cycle** (45 v3 base + 16 reviewer-fold pins); plugin 1190 test count grew 248 → 309 across 49 → 60 suites. **EE full regression: 4962/4962; 49-session 100% green streak preserved**. **No new SDK dependencies** — v3 uses existing node:dns/promises + node:crypto. CE binary unchanged in 0.1.52 (code identical to 0.1.40 → 0.1.51). **Ninth consecutive trio-publish across EE + CE + agent-skill in a single session**. Memory tag closures: `conservative_classifier_principle` reinforced in 5 new fold sites; `emit_literal_set_drift` extended with 8 new named emission categories + 1 frozen Set + 1 new regex pin + 1 new no-truncate helper; `aws_string_case_normalization` reinforced via case-insensitive pin compare.
 - **0.1.51 (deprecated)** — docs-only patch announcing **EE 0.5.2 release** (paired release narrative). **EE plugin count UNCHANGED at 20** (no new plugin in 0.5.2; existing plugin 1190 `aws-ses-auditor` underwent pure v2.1 consolidation via **EE-RT.18 v2.1** — closes 7 deferred reviewer-fold items from the 0.5.0 cycle). **6 same-session reviewer folds** (1 CRITICAL + 3 HIGH + 2 MEDIUM): **R-CRITICAL closure**: missing soc2.json titlePattern for new `ses-dkim-dns-partial-with-transients` MEDIUM emission — same false-mapping class as 0.5.1 R-HIGH soc2-anchoring fold. **R-HIGH closure (silent-loss class)**: SES classic API quota exhaustion now routes post-retry-exhaustion bubble to `ses-classic-policy-unverifiable` LOW + evidenceGap with `cause: "classic-sdk-quota-exhausted"` (pre-fold this fell through to silent loss via warnings.push). **R-HIGH closures**: unknown-DNS-code call-site fail-safe pin + identityType producer→consumer round-trip. **R-MEDIUM closures**: mixed-failure-mode test + module-load-time disjointness IIFE (`_assertDnsErrorCodeSetsDisjoint()` promotes the invariant from test-time to Node startup enforcement). **7 deferred items closed**: DKIM partial-match severity tier (new MEDIUM `ses-dkim-dns-partial-with-transients`) + explicit `_DNS_TRANSIENT_ERROR_CODES` named Set + broadened classic-side error taxonomy (`IdentityNotVerified` / `ConfigurationSetDoesNotExist` / quota-error names) + DMARC chunk-split end-to-end + DKIM special-chars + identityType normalization + cosmetic constant-casing. **Coverage matrix UNCHANGED at 10/4/33** — pure evidence-quality uplift on already-covered CC6.1 + CC6.6 + A1.2 + CC7.1 + CC7.2 controls via 1 new aws-ses-auditor mapping rule + 5 reinforced classifier contracts. **+41 new tests this cycle** (34 deferred-items sweep base + 7 reviewer-fold pins); plugin 1190 test count grew 207 → 248 across 40 → 49 suites. **EE full regression: 4901/4901; 48-session 100% green streak preserved**. **No new SDK dependencies** — pure v2 consolidation. CE binary unchanged in 0.1.51 (code identical to 0.1.40 → 0.1.50). **Eighth consecutive trio-publish across EE + CE + agent-skill in a single session** — institutionalized discipline now spans 8 ship cycles (0.4.5 / 0.4.6 / 0.4.7 / 0.4.8 / 0.4.9 / 0.5.0 / 0.5.1 / 0.5.2). Paired agent-skill 0.1.18 catalog refresh reflects plugin 1190 v2.1 consolidation. Memory tag closures: `conservative_classifier_principle` reinforced in 3 new fold sites; `emit_literal_set_drift` extended with 3 new named Sets + 1 new named category + module-load-time disjointness IIFE; `aws_string_case_normalization` reinforced via identityType normalization at promoter consumer sites.
 - **0.1.50 (deprecated)** — paired with EE 0.5.1. EE-RT.15 v2 plugin 1150 SQS/SNS Auditor 5 → 7 dimensions (CloudWatch alarm coverage). Closes the **"messaging monitoring" SOC 2 dimension** per `tasks/things-to-check.md` §4 institutional checklist. **First plugin-1150 dim to cross an SDK boundary** (SQS+SNS → CloudWatch); single-fetch budget — `_enumerateMetricAlarms` paginates `cloudwatch:DescribeAlarms` once, `_buildAlarmIndex` builds per-resource Maps for O(1) lookup. **Dim 6 — SQS age-alarm coverage** (CC7.2 + A1.2; per-queue PASS / MEDIUM / LOW / LOW + evidenceGap). **Dim 7 — SNS failure-alarm coverage** (CC7.2 + A1.2; per-topic analogue). **Soft-degrade contract** — CW SDK load failure routes per-resource classifier to LOW + evidenceGap rather than blocking SQS+SNS primary substrate audit. **7 same-session reviewer folds** (1 CRITICAL + 1 HIGH + 2 MEDIUM + 1 LOW + 1 NIT; 6 folded same-session, 1 NIT deferred). **R-CRITICAL closure**: `ActionsEnabled=true + AlarmActions=[]` was silent PASS pre-fold (CloudWatch fires NO operator paging on empty AlarmActions); `actionable` filter now requires BOTH `ActionsEnabled=true` AND non-empty `AlarmActions[]`. Discriminates "all disabled" vs "all empty actions" in remediation narrative. **R-HIGH closure**: soc2.json PASS-tier titlePatterns narrowed to anchor on `AWS/SQS:ApproximateAgeOfOldestMessage` / `AWS/SNS:NumberOfNotificationsFailed` clauses. **R-MEDIUM-1/2 + R-LOW closures**: defensive shape guard + multi-alarm collision tests + FIFO end-to-end + corrupted-shape defensive tests. **+52 new tests this cycle** (41 v2 base + 11 reviewer-fold pins); plugin 1150 test count grew 116 → 168 across 22 → 33 suites. **EE full regression: 4860/4860; 47-session 100% green streak preserved**. **12 new soc2.json titlePattern entries** (8 CC7.2 + 4 A1.2 dual-mapped). **Synthetic-mock validation only** this cycle — real-AWS smoke deferred (no SQS/SNS paired fixtures yet in test-infra-builder; ship-without per documented gap, EE 0.5.0 SES precedent). **No new SDK dependencies** — `@aws-sdk/client-cloudwatch` already declared in optionalDependencies since EE 0.4.0. CE binary unchanged in 0.1.50 (code identical to 0.1.40 → 0.1.49); the bump carries the EE-paired-release narrative. **Seventh consecutive trio-publish across EE + CE + agent-skill in a single session** — institutionalized discipline now spans 7 ship cycles (0.4.5 / 0.4.6 / 0.4.7 / 0.4.8 / 0.4.9 / 0.5.0 / 0.5.1). Paired agent-skill 0.1.17 catalog refresh reflects plugin 1150 v2 extension. Memory tag closures: `aws_string_case_normalization` reinforced via split-surface QueueName/TopicName discipline; `conservative_classifier_principle` reinforced in 4 new fold sites; `emit_literal_set_drift` extended with 7 new named CW constants.
@@ -182,7 +183,9 @@ Results land in `./out/<host>_<timestamp>/`:
 
 ### Pro/Enterprise Plugins (via @nsasoft/nsauditor-ai-ee)
 
-**EE 0.5.4 ships 20 enterprise plugins** (UNCHANGED from EE 0.5.3 — the 0.5.4 bump is a cross-plugin Thread H sweep: §7.5 `_promote*FromKms` signature hardening on plugin 1140 v2 + 1180 v2 + §8 operator-config DoS caps on plugin 1170 v2; clean reviewer pass with 0 R-CRITICAL + 0 R-HIGH; final v0.5.x close-out cycle).
+**EE 0.6.0 ships 21 enterprise plugins** (UP FROM 20 — the 0.6.0 minor-version milestone is the first new plugin since EE 0.4.7: EE-RT.19 v1 NEW plugin 1160 AWS VPC Endpoints / PrivateLink Auditor; first plugin to specifically audit the PrivateLink isolation boundary; 4 SOC 2 dimensions; clean reviewer pass).
+
+**EE 0.5.4 (superseded)** —**EE 0.5.4 ships 20 enterprise plugins** (UNCHANGED from EE 0.5.3 — the 0.5.4 bump is a cross-plugin Thread H sweep: §7.5 `_promote*FromKms` signature hardening on plugin 1140 v2 + 1180 v2 + §8 operator-config DoS caps on plugin 1170 v2; clean reviewer pass with 0 R-CRITICAL + 0 R-HIGH; final v0.5.x close-out cycle).
 
 **EE 0.5.3 (superseded)** —**EE 0.5.3 ships 20 enterprise plugins** (UNCHANGED from EE 0.5.2 — the 0.5.3 patch-level bump is a pure plugin 1190 EE-RT.18 v3 extension: Part A DKIM public-key fingerprint capture/pin + Part B in-band DMARC alignment classifier; 5 same-session reviewer folds incl. 1 R-CRITICAL false-CLEAN closure on truncated DKIM keys).
 
@@ -215,6 +218,7 @@ Results land in `./out/<host>_<timestamp>/`:
 | **1130** | **AWS Backup Auditor — headline thread** (NEW EE 0.4.0; EE-RT.12 v1 → v1.24, 18-session institutional hardening arc) | Enterprise | The **largest single-plugin institutional-hardening arc in the EE codebase**: ~7800 lines / 545 plugin tests / 19 R2-strict recurrence-class same-session closures / 74 new soc2.json titlePattern entries across 7 controls. Audits the AWS Backup substrate end-to-end: Plans + Vaults + Recovery Points + Selections + Frameworks + Restore Testing + ReportPlans + Legal Holds + VaultType + Vault Tags + Vault Access Policy. **Headline capability: 12-dimension air-gapped vault attestation arc** for `LogicallyAirGappedBackupVault` resources — 6 cryptographic-isolation mechanisms (vault TYPE air-gapped + ARN account-segment-separation + destination KMS key-policy clean + destination KMS Grants clean + MRK-replica topology clean + source-account VPC-endpoint policy clean) PLUS 6 substrate dimensions (PITR / retention / encryption / RestoreTesting / Legal Holds / vault Access Policy). Cross-service SDK integration (`@aws-sdk/client-kms`, `@aws-sdk/client-ec2`, `@aws-sdk/client-config-service`, `@aws-sdk/client-backup`). CC6.3 / **CC6.6** / CC7.1 / CC8.1 / C1.1 / **C1.2** / **A1.2**. |
 | **1140** | **AWS RDS Auditor** (EE 0.4.3 v1; **GROWN in EE 0.4.5 v2** — 3 dims → 7 dims + kms:DescribeKey cross-reference; **GROWN AGAIN in EE 0.4.8 v3** — 7 dims → 10 dims + database audit-logging) | Enterprise | Audits AWS RDS DB instances against **10 SOC 2 substrate-evidence dimensions** (v1 = 3 + v2 = 4 + v3 = 3): **v3 dim 8 pgAudit enabled** (CC7.2 + CC7.3, postgres-only — `DescribeDBParameters → pgaudit.log` non-empty AND `shared_preload_libraries` contains `pgaudit` token per R-MEDIUM-2 reviewer-fold **false-PASS closure** since Postgres silently ignores the GUC when SPL omits pgaudit; HIGH on disabled / new MEDIUM `rds-pgaudit-misconfigured` on SPL-omitted / PASS on fully configured; non-postgres engines = INFO + engine-not-applicable per `conservative_classifier_principle`); **v3 dim 9 CloudWatch Logs exports** (CC7.2 — `EnabledCloudwatchLogsExports` engine-dispatched essential/optional policy via frozen `_RDS_ENGINE_CWL_NAMES` dispatch table covering mysql/mariadb/aurora-mysql (essential=`error`) / postgres/aurora-postgresql (essential=`postgresql`) / oracle-* (essential=`audit`+`trace`) / sqlserver-* (essential=`error`); empty=HIGH, partial=MEDIUM, complete=PASS, unknown engine=INFO+engine-not-supported); **v3 dim 10 CloudWatch Logs retention** (CC7.2 + CC7.3 — `logs:DescribeLogGroups` enumeration on engine-dispatched prefix per R-HIGH-1 reviewer-fold **false-INFO closure**: `/aws/rds/instance/<id>/` for non-Aurora; `/aws/rds/cluster/<DBClusterIdentifier>/` for `aurora-*` engines — pre-fold hard-coded the instance path → 0 log groups on every Aurora node = false-INFO MEDIUM across the whole Aurora fleet; 30-day institutional baseline operator-tunable via `opts.auditLogRetentionPassMinDays` clamped 1..3653; distinct categories for never-expire INFO + below-baseline MEDIUM + cwl-opt-out LOW R-MEDIUM-3 fold + probe-failed LOW R-MEDIUM-5 fold + AccessDenied LOW + retentionDistribution per-group spread R-MEDIUM-4 fold). **v2 dim 1-7** preserved (Multi-AZ A1.2 / storage encryption + KMS-key custody with kms:DescribeKey cross-reference C1.1 / parameter-group SSL enforcement C1.1 / backup retention period A1.2 / public accessibility CC6.6 / IAM database authentication CC6.1 / snapshot encryption C1.1). **9 same-session v3 reviewer folds applied** (HIGH-1 Aurora cluster log-path; MEDIUM-2 pgAudit-SPL cross-check; MEDIUM-3 cwl-opt-out distinct; MEDIUM-4 retentionDistribution surfaced; MEDIUM-5 transient-error distinct; LOW-8 `_PGAUDIT_LIBRARY_NAME` + `_SHARED_PRELOAD_LIBRARIES_PARAM` named constants; LOW-9 engine case-norm tests; LOW-10 `truncated:bool` + `distributionTruncated:bool` flags; NIT-12 Aurora cluster integration test). 7 new v3 soc2.json titlePattern entries under CC7.2 (cumulative 25 across v1+v2+v3). Full institutional contract applied day-1 (EE-RT.13 PLUGIN_ID export + Thread H wrap + ZDE sanitizer + conservative classifier + EE-RT.12.25 v1 run() scaffold). `@aws-sdk/client-cloudwatch-logs` already in optionalDependencies (used by plugin 1040 since EE 0.4.0); v3 reuses via new `_loadCwlSdk` lazy loader. **Real-AWS smoke END-TO-END against `test-infra-builder` paired fixtures** in account 522412052794: in-place modification of `rds-compliant-cluster` (cost $0; brief Multi-AZ failover during apply-immediately reboot) validated ALL 3 v3 PASS-path classifiers; unmodified `rds-violator-db` validated HIGH path; account-wide finding distribution 9 PASS + 2 MEDIUM + 4 INFO + 5 HIGH. **First 0.4.x extension cycle to validate BOTH PASS-path AND HIGH-path classifiers** against real AWS in the same smoke run. **A1.2 / CC6.1 / CC6.6 / C1.1 / CC7.2 / CC7.3**. |
 | **1150** | **AWS SQS/SNS Auditor** (NEW EE 0.4.4 v1; **EXTENDED EE 0.5.1 v2** — 5 → 7 dimensions: CloudWatch alarm coverage on SQS ApproximateAgeOfOldestMessage + SNS NumberOfNotificationsFailed; first plugin-1150 dim to cross an SDK boundary — SQS+SNS → CloudWatch) | Enterprise | Audits AWS SQS queues + SNS topics against **7 SOC 2 substrate-evidence dimensions** spanning two services in one plugin (institutional bundling — both substrate-evidence event-driven-architecture stores, both use the same SDK auth surface). **SQS encryption at rest** (C1.1 confidentiality — `GetQueueAttributes → SqsManagedSseEnabled` OR `KmsMasterKeyId`; four-tier severity ladder: HIGH unencrypted → MEDIUM AWS-managed-SSE OR `alias/aws/sqs` → PASS customer-managed CMK alias → LOW+evidenceGap on bare-UUID / `:key/UUID` ARN form per `conservative_classifier_principle`); **SQS transit-encryption policy** (CC6.6 segmentation — `aws:SecureTransport=false` Deny statement defense-in-depth over the HTTPS-only transport-layer guarantee); **SNS topic encryption at rest** (C1.1 confidentiality — `GetTopicAttributes → KmsMasterKeyId`; SNS has no SQS-managed-SSE equivalent so absent = HIGH); **SNS topic-policy permissive-Principal** (CC6.6 segmentation — wildcard-Principal classifier on sensitive actions sns:Publish / Subscribe / SetTopicAttributes / AddPermission / RemovePermission / DeleteTopic + `sns:*` / `*` wildcards; includes **NotAction-Allow** handling + **NotPrincipal-Allow** handling + **Resource-scope filtering**; severity ladder CRITICAL unconditional-wildcard → HIGH wildcard-WITH-Condition → PASS no-wildcard-sensitive); **SQS dead-letter queue presence** (A1.2 availability + CC7.1 anomaly-detection, **dual-mapped** — `RedrivePolicy` analysis; missing DLQ is the canonical silent-message-loss class). **NEW in v2 (EE 0.5.1): Dim 6 — SQS ApproximateAgeOfOldestMessage CloudWatch alarm coverage** (CC7.2 system-monitoring + A1.2 availability, dual-mapped — per-queue classifier checks for at least one `AWS/SQS:ApproximateAgeOfOldestMessage` MetricAlarm with the queue's `QueueName` dimension AND **both** `ActionsEnabled=true` AND non-empty `AlarmActions[]`; four severity outcomes PASS / MEDIUM / LOW / LOW+evidenceGap). **NEW in v2: Dim 7 — SNS NumberOfNotificationsFailed CloudWatch alarm coverage** (CC7.2 + A1.2, dual-mapped — per-topic analogue with `AWS/SNS:NumberOfNotificationsFailed` metric + `TopicName` dimension; closes silent message-loss class for downstream subscribers). **v2 single-fetch budget pattern** (mirrors plugin 1040 `_auditAlarmCoverage` scaffold): `_enumerateMetricAlarms` paginates `cloudwatch:DescribeAlarms` ONCE per scan; `_buildAlarmIndex` builds per-resource Maps (`sqsAgeByQueueName` + `snsFailureByTopicName`) for O(1) per-resource lookup. Pagination cap default 20 pages × 100 alarms = 2000 alarm ceiling, operator-tunable via `opts.cwAlarmPageCap`. **Soft-degrade contract** — CW SDK load failure routes per-resource classifier to LOW + evidenceGap rather than blocking SQS+SNS primary substrate audit. **R-CRITICAL v2 same-session fold (false-CLEAN closure)**: `actionable` requires BOTH `ActionsEnabled=true` AND non-empty `AlarmActions[]` array (pre-fold an `{ActionsEnabled:true, AlarmActions:[]}` alarm passed as PASS-tier evidence on a structurally broken alarm — CloudWatch fires NO operator paging when action list is empty). **First EE plugin to ship WITHOUT a smoke-time SDK hotfix** (v1) — `@aws-sdk/client-sqs` + `@aws-sdk/client-sns` were added to `optionalDependencies` PREEMPTIVELY per the 11th pre-implementation checklist item; v2 reuses `@aws-sdk/client-cloudwatch` already declared since EE 0.4.0 (no new SDK deps). **23 soc2.json titlePattern entries total** (11 v1 + 12 v2: 8 CC7.2 + 4 A1.2 dual-mapped). Full institutional contract applied day-1 (EE-RT.13 PLUGIN_ID export + Thread H wrap on BOTH SQS + SNS clients + ZDE sanitizer + conservative classifier + EE-RT.12.25 v1 run() scaffold + preemptive `aws_string_case_normalization` fold-sites). v1: 3 same-session reviewer folds. v2: 7 same-session reviewer folds (1 CRITICAL + 1 HIGH + 2 MEDIUM + 1 LOW + 1 NIT; 6 folded same-session). Smoke-validated against `test-infra-builder` paired fixtures (v1 only; v2 synthetic-mock only — no SQS/SNS CW alarms in fixtures yet). **C1.1 / CC6.6 / A1.2 / CC7.1 / CC7.2**. |
+| **1160** | **AWS VPC Endpoints / PrivateLink Auditor** (**NEW EE 0.6.0** — first new plugin since EE 0.4.7; first plugin to audit the PrivateLink isolation boundary) | Enterprise | Audits AWS VPC endpoints (Interface + Gateway flavors) against **4 SOC 2 substrate-evidence dimensions** — VPC endpoints are the AWS-canonical PrivateLink primitive governing VPC-to-managed-service traffic without public-internet traversal. **Complements plugin 1170 SG perimeter** (1170 = layer-4 ingress; 1160 = service-layer perimeter). **Dim 1 — Endpoint policy permissive principals** (CC6.6 segmentation — wildcard-Principal classifier mirroring plugin 1150 SNS topic-policy discipline; NotPrincipal-Allow + Action-sensitivity filter via `_VPCE_SENSITIVE_ACTIONS` frozen Set; unconditional wildcard on sensitive action = CRITICAL `vpce-policy-wildcard-unconditional` — PrivateLink isolation BROKEN at the policy layer; WITH Condition = HIGH walkthroughRequired). **Dim 2 — PrivateDNS enabled** (CC6.6 — Interface + PrivateDnsEnabled=false = MEDIUM `vpce-private-dns-disabled` silent-bypass class; common operator misconfig where endpoint exists but clients still resolve service-public hostname → traffic over public internet; Gateway = INFO not-applicable). **Dim 3 — Endpoint state** (A1.2 + CC7.2 — `available` = PASS; `failed` = HIGH `vpce-state-failed` silent-failure class; transient = INFO; unknown enum = LOW + evidenceGap per `[[conservative_classifier_principle]]`). **Dim 4 — Endpoint type substrate disclosure** (Privacy + CC6.6 — INFO substrate evidence per VPC; records PrivateLink connectivity attestation for auditor evidence pack). **2 same-session reviewer folds**: R-MEDIUM unknown-type fail-safe (defaults to Interface — more thorough audit path) + R-NIT Effect case-insensitivity regression pin. **No new SDK dependencies** — `@aws-sdk/client-ec2` already declared since EE 0.4.5. 7 new soc2.json titlePattern entries (5 CC6.6 + 2 CC7.2/A1.2 dual-mapped). Full institutional contract applied day-1 (EE-RT.13 PLUGIN_ID + Thread H wrap + ZDE sanitizer + conservative classifier + EE-RT.12.25 v1 run() scaffold). 57 plugin tests + 2 reviewer-fold pins (59 total). Synthetic-mock validation only — no VPC endpoint paired fixtures yet in test-infra-builder. **CC6.6 / A1.2 / CC7.2 / Privacy (substrate)**. |
 | **1170** | **AWS EC2 SG Perimeter Auditor** (EE 0.4.5 v1; **EXTENDED in EE 0.4.6 v2** — RESTRICTED_PORTS 13 → 23 ports per CIS AWS Foundations v3.0 + operator-config + per-SG cardinality cap) | Enterprise | Audits AWS EC2 Security Groups against SOC 2 CC6.6 network-segmentation evidence — reads the AWS-API DECLARED SG policy via `DescribeSecurityGroups`. **Orthogonal evidence to plugin 1023 zero-trust-checker** (1023 reads OBSERVED open ports from prior network probes; 1170 reads DECLARED SG policy). The pair gives auditors complete coverage of "is this port reachable, and is it supposed to be?" **Cross-plugin sister of EE-RT.14 v2 `_classifyPublicAccessibility`** dimension in plugin 1140 (which emits "auditor walkthrough required for SG analysis"; plugin 1170 closes that walkthrough deterministically). **6 audit dimensions:** **IPv4 0.0.0.0/0 ingress to RESTRICTED_PORTS** (CC6.6 perimeter — CRITICAL; **v2 RESTRICTED_PORTS covers 23 ports** per CIS AWS Foundations v3.0 alignment + emerging-data-tier coverage: SSH (22), RDP (3389), MS SQL (1433), MySQL (3306), Postgres (5432), Redshift (5439 — NEW v2), Redis (6379), Memcached (11211), MongoDB (27017), Elasticsearch (9200, 9300), CouchDB (5984), Docker daemon (2375), Kubelet API (10250), **K8s API server (6443 — NEW v2), etcd (2379-2380 — NEW v2), Kibana (5601 — NEW v2), InfluxDB (8086 — NEW v2), Kafka (9092 — NEW v2), Consul (8500 — NEW v2), ZooKeeper (2181 — NEW v2), Vault (8200 — NEW v2)**); **IPv6 ::/0 ingress to RESTRICTED_PORTS** (CC6.6 — CRITICAL IPv6 sibling; operators often miss while locking IPv4 down); **all-protocol (-1) ingress from 0.0.0.0/0** (CC6.6 — CRITICAL worst-possible perimeter posture; **per R-MEDIUM-1 fold suppresses dim 1+2 emissions at SG-scope** — auditor pack stays at one CRITICAL/SG instead of N+1); **public ingress to non-restricted ports** (CC6.6 substrate — INFO + walkthroughRequired; 80/443/8080-style web tier likely intentional, auditor verifies intent); **egress 0.0.0.0/0** (CC6.6 substrate — INFO; AWS-default posture; out-of-scope for SG-layer DLP concerns); **orphan SGs** (CC6.2 governance — LOW; SG with no attached ENI via `DescribeNetworkInterfaces` cross-reference; AWS-default `default` SGs per-VPC excluded; **v2 system-managed-SG name-prefix exclusion list** excludes `ElasticMapReduce-`, `eks-cluster-sg-`, `AWSServiceRole`, `awseb-` etc. from orphan-detection — these are AWS-service-controlled and structurally non-deletable). **v2 operator-config knob `opts.additionalRestrictedPorts`** — lets tenants add custom ports beyond the baseline (validated 0-65535 integer + deduped against baseline). **v2 per-SG cardinality cap via `_USER_GROUP_DISPLAY_CAP = 10`** with rollup trailer (`...and N more`) defends against finding-size DoS on 1000+ SG accounts. **`UserIdGroupPairs` (SG-as-source) rules** surfaced as INFO + evidenceGap + walkthroughRequired per R-HIGH-1 fold — v1 only analyzes CIDR-source rules; transitive SG→SG chain reachability deferred to v3 (EE-RT.16 v3). 10 new soc2.json titlePattern entries across v1 + v2 (6 CC6.6 + 1 CC6.2 from v1; 1 PASS-tier fix + 2 cardinality-cap trailers from v2). Full institutional contract applied day-1. **7 same-session v2 reviewer folds including 2 CONVERGENT-CRITICAL findings** (C1 pre-existing v1 PASS-tier titlePattern bug; C2 cardinality-cap-trailer titlePatterns silently dropped at framework-engine harvest pre-fold). Smoke-validated against `test-infra-builder` paired fixtures (`nsauditor-secure-sg` + `nsauditor-exposed-sg`) in account 522412052794. **CC6.6 / CC6.2**. |
 | **1190** | **AWS SES Email Integrity Auditor** (NEW EE 0.4.7; **EXTENDED EE 0.5.0 v2** — dims 1 + 2 + 4 grown in scope: DKIM CNAME DNS resolution + DMARC TXT record parser + SES classic API parity; first plugin in EE to depend on `node:dns/promises` for live DNS cross-reference) | Enterprise | Audits AWS SES + SESv2 email-sending substrate against **6 SOC 2 evidence dimensions** spanning confidentiality + email-integrity. Closes the next-highest-priority gap from the AWS SOC 2 audit-canonical compliance checklist after Redis closed in EE 0.4.6. **DKIM enablement + signing status** (CC6.1 / Privacy — `DkimAttributes.SigningEnabled` + 5-enum Status classifier: SUCCESS PASS / PENDING-TEMPORARY_FAILURE-NOT_STARTED INFO+walkthroughRequired transient / FAILED MEDIUM on DNS drift / unknown LOW+evidenceGap per `conservative_classifier_principle`; HIGH on SigningEnabled=false because outbound mail unsigned defeats SPF+DKIM+DMARC trust chain). **Custom MailFrom domain alignment** (Privacy substrate — `MailFromAttributes.MailFromDomain` + `MailFromDomainStatus`; INFO + walkthroughRequired on default amazonses.com because DMARC strict alignment impossible without custom MailFrom subdomain; PASS on custom + Status=SUCCESS). **Configuration set TLS enforcement** (C1.1 transit — `DeliveryOptions.TlsPolicy`; REQUIRE PASS / OPTIONAL HIGH opens SMTP-downgrade-attack window where network-layer adversary can strip STARTTLS from EHLO response forcing cleartext delivery of message body + headers; **distinct LOW + `tlsPolicyType` evidence branch** per R-MEDIUM-7 reviewer-fold catches non-string SDK-contract violations separately from missing-field unverifiable — pre-fold both flowed through identical narrative with empty quotes). **Identity sending authorization policy permissive principals** (CC6.6 — JSON-parsed IAM policy with **multi-class wildcard detector** covering bare `"*"` + `{AWS:"*"}` + `{Service:"*"}` + `{Federated:"*"}` + `{CanonicalUser:"*"}` + array-form `[*]` per R-HIGH-4 reviewer-fold walking every Principal class value; **distinct HIGH `ses-sending-auth-notprincipal-allow`** per R-CRITICAL-1 reviewer-fold catches NotPrincipal+Effect=Allow wildcard-EQUIVALENT class (universal grant minus exclusion list — pre-fold silently classified as bounded = false-CLEAN; matches plugins 1070 + 1150 NotPrincipal+Allow discipline); **LOW + evidenceGap `ses-sending-auth-malformed-statement`** per R-HIGH-2 reviewer-fold surfaces Effect-missing send-action statements that pre-fold were silently dropped). **Dedicated IP pool sending posture** (CC7.1 substrate, account-level — `ListDedicatedIpPools`; INFO + walkthroughRequired on configured pools / INFO on shared-pool default). **Suppression list state** (CC7.1 deliverability substrate, account-level — `ListSuppressedDestinations`; **ZDE invariant: NEVER reads suppressed-destination email addresses** — count + reason only; verified at run() envelope boundary via sentinel-string assertion per R-LOW-8 reviewer-fold). **Dual API surface discipline:** v1 uses SESv2 only (canonical modern API surface covers all 6 dimensions); `@aws-sdk/client-ses` declared in optionalDependencies for v2+ cross-API parity (per the dual-API discipline established in plugin 1180) — `_loadSesClassicSdk` dead-code load-check REMOVED per R-MEDIUM-6 reviewer-fold (false-degraded risk: pre-fold a missing classic SDK in production forced run() into "Plugin skipped" path even though v1 never exercises any classic export). 8 new soc2.json titlePattern entries (3 CC6.1 + 3 CC6.6 + 2 C1.1). Full institutional contract applied day-1 (EE-RT.13 PLUGIN_ID export + Thread H wrap + ZDE sanitizer + conservative classifier + EE-RT.12.25 v1 run() scaffold). **11 same-session reviewer folds applied** — ties the single-cycle reviewer-fold record (independent `general-purpose-agent` review yielded 12 findings; 11 folded same-session, 1 deferred to cross-plugin Thread H sweep). **Fourth EE plugin to ship without smoke-time SDK hotfix** (`@aws-sdk/client-ses` + `@aws-sdk/client-sesv2` both preemptively added to optionalDependencies). **No real-AWS smoke against violation-tier fixtures** — test-infra-builder has NO SES paired fixtures yet (full-stack fixtures deferred to EE-RT.18 v2 alongside DKIM CNAME DNS resolution + DMARC TXT record parsing). Empty-account smoke baseline against 522412052794 DID succeed end-to-end: plugin loads via CE→EE binding, all 4 SESv2 API enumerations succeed, baseline 2 INFO findings emit correctly, durationMs=842, ZDE invariant preserved. **CC6.1 / CC6.6 / C1.1 / CC7.1 (substrate) / Privacy (substrate)**. |
 | **1180** | **AWS ElastiCache Redis Auditor** (EE 0.4.6 v1; **EXTENDED in EE 0.4.9 v2** — dims 2 + 6 grown in scope: kms:DescribeKey promotion + subnet route-table verifier; closes both v1 deferred items R-MEDIUM-3 + R-LOW-2) | Enterprise | Audits AWS ElastiCache Redis clusters against **6 SOC 2 substrate-evidence dimensions** spanning confidentiality + availability + segmentation. Closes the highest-priority gap from the AWS SOC 2 audit-canonical compliance checklist. **Transit encryption** (C1.1 PASS/HIGH — `TransitEncryptionEnabled=true` wraps RESP in TLS for client→cluster + primary→replica connections; HIGH on disabled — cleartext RESP on wire + AUTH tokens flow cleartext; cannot be toggled in place, requires snapshot+restore). **At-rest encryption with KMS key custody** (C1.1 four-tier ladder — HIGH disabled → MEDIUM AWS-owned-default (encrypted but no customer KmsKeyId) → MEDIUM `alias/aws/elasticache` (AWS-managed alias via `_AWS_MANAGED_ELASTICACHE_ALIAS_RE`) → PASS customer-managed CMK + LOW+evidenceGap on `:key/UUID` ARN form per `conservative_classifier_principle`). **Redis AUTH / IAM-auth user groups** (CC6.1 + CC6.2 — PASS on UserGroupIds configured (Redis 7+ ACL/IAM-auth user groups replace long-lived AUTH passwords); MEDIUM on no-authentication (cluster relies solely on SG perimeter — cross-plugin sister with plugin 1170 SG-perimeter audit); UserGroupIds cardinality cap 10 + "...and N more" overflow per R-MEDIUM-1 fold). **Multi-AZ deployment** (A1.2 availability — HIGH on `MultiAZ=disabled` for replication groups; INFO + standalone-not-applicable on single-node CacheClusters; INFO + evidenceGap on transient states `enabling` / `disabling` per `conservative_classifier_principle`). **SnapshotRetentionLimit cadence** (A1.2 — 0 = HIGH (no snapshots), 1-6 days = MEDIUM (below 7-day baseline), ≥7 days = PASS; operator-tunable via `opts.snapshotRetentionPassMinDays` clamped 1..35). **Subnet placement** (CC6.6 perimeter — INFO + walkthroughRequired on `default` subnet group per `conservative_classifier_principle` — operator may have private subnets named "default"). **Dual API enumeration with inter-API dedup**: `DescribeReplicationGroups` + `DescribeCacheClusters` covers both replication-group and standalone-CacheCluster surfaces; CacheClusters with `ReplicationGroupId` set are skipped (member-of-replication-group rule) to avoid double-emission. `_ELASTICACHE_SUPPORTED_ENGINES = Object.freeze(new Set(["redis"]))` — Memcached is out-of-scope by design (no native AUTH; no transit encryption substrate). 16 new soc2.json titlePattern entries (4 CC6.1 + 1 CC6.6 + 5 A1.2 + 8 C1.1). Full institutional contract applied day-1 (EE-RT.13 PLUGIN_ID export + Thread H wrap + ZDE sanitizer + conservative classifier + EE-RT.12.25 v1 run() scaffold). 3 same-session reviewer folds applied (R-MEDIUM-1 UserGroupIds cardinality cap canonical-parity, R-LOW-1 transient Multi-AZ state INFO + evidenceGap, R-LOW-2 inter-API dedup test pin). **Third EE plugin to ship without smoke-time SDK hotfix** (`@aws-sdk/client-elasticache` preemptively added to optionalDependencies). Smoke-validated against `test-infra-builder` paired fixtures (`redis-secure-cache` + `redis-leaky-cache`) in account 522412052794. **CC6.1 / CC6.2 / CC6.6 / A1.2 / C1.1**. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.1.53",
+  "version": "0.1.54",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,