nsauditor-ai 0.1.70 → 0.1.71

package/README.md

@@ -17,7 +17,11 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-- **CE 0.1.69** (current) — paired with **EE 0.9.0** (May 2026). **HIPAA FRAMEWORK CYCLE — first 0.9.x release**: HIPAA Security Rule §164.312 Technical Safeguards ships as the second supported compliance framework alongside SOC 2 (closes the long-standing "planned" gap in EE's roadmap for the highest-demand next framework). **Dual-framework workflow**: use `--compliance hipaa` or `--compliance soc2,hipaa` for HIPAA-only or SOC 2 + HIPAA evidence packs from a single scan. **HIPAA coverage matrix introduced at 7 covered + 3 partial + 45 OOS** within §164.312 + entire §164.308 Administrative Safeguards + entire §164.310 Physical Safeguards (architecturally OOS for any infrastructure scanner — pair with HIPAA-focused GRC platforms like Drata HIPAA / Vanta HIPAA / Compliancy Group for §164.308 + §164.310). **HHS Required vs Addressable discipline** surfaced per control. **§164.312(c)(1) Integrity ransomware-defense substrate**: EE's `aws-backup-auditor` Logically Air-Gapped Backup Vault cross-verification produces HHS-OCR-2024-enforcement-relevant evidence on ePHI backup integrity preservation against full source-account compromise. **Per-framework SLA-citation map** in EE renderer — HIPAA reports cite §164.312(b) audit-controls cadence + §164.312(d) Person/Entity Authentication (not SOC 2 CC IDs); closes the auditor-detectable cross-framework citation leak class. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. **Zero engine/CLI changes**: CE's `--compliance` flag already accepts CSV (wired since EE 0.3.0). **6 same-session reviewer folds** (2 R-HIGH defensive-coding + 2 R-MEDIUM scope-broadening + 1 R-LOW comment fix + 1 docstring strengthening; 0 R-CRITICAL). **+85 new tests across 3 new suites**: load-bearing anchor-drift defense via inheritance contract (32) + engine-end-to-end fixture tests across all 10 §164.312 controls (36) + per-framework renderer citation correctness (17). **EE regression: 5890/5890 across 928 suites; 69-session 100% green streak preserved.** **AWS-dogfood verified** against operator's test account (207 findings analyzed, per-framework citation map confirmed firing, ransomware-substrate surfaces correctly). **Plugin count UNCHANGED at 24**; SOC 2 coverage matrix UNCHANGED at 10/4/33 (additive-only cycle; no SOC 2 mappings changed). **No breaking changes** — additive only.
+- **CE 0.1.71** (current) — paired with **EE 0.10.0** (May 2026). **NIST CSF 2.0 FRAMEWORK CYCLE — Track 3 third-framework introduction**: NIST Cybersecurity Framework 2.0 ships as the third supported compliance framework alongside SOC 2 (AICPA TSC 2017) and HIPAA Security Rule §164.312 — completing the 3-framework Track 3 institutional set. **Triple-framework workflow**: use `--compliance nist-csf`, `--compliance soc2,hipaa,nist-csf`, or any CSV subset for tailored evidence packs from a single scan. **NIST CSF 2.0 coverage matrix at 13 covered + 10 partial + 83 OOS** across 106 of CSF 2.0's 107 Subcategories — auditor-canonical Subcategory-level granularity per NIST CSWP 29 (February 2024). **Govern function OOS-by-design** with `GV.SC-04` (suppliers known) partial as the single substrate-evidence exception via cross-account VPC endpoint inventory + backup-vault wildcard-Principal trust — parallel to HIPAA §164.308 OOS framing. **Respond function OOS-entirely** (incident-response runbook execution; pair with operator's IR platform + tabletop-exercise log archive). **Implementation Tiers 1-4** (Partial / Risk-Informed / Repeatable / Adaptive) explicitly OOS as organizational-maturity claims — surfaced in EE renderer as cover-page Tiers OOS disclaimer section gated on `isNistCsfReport` (markdown + HTML parity); pair with NIST-aware GRC platforms (Tugboat Logic, Drata NIST CSF, Vanta NIST CSF, AuditBoard) for Tiers dimension. **Per-framework citation map** extended in EE renderer with `nist-csf` slot table (8 slots: sla/governance/identity/risk-analysis/retention/integrity-substrate/breach-signal + NEW implementation-tiers); NIST reports cite DE.CM-01 networks-monitored cadence + PR.AA-01/PR.AA-03 Identity + PR.DS-11 + RC.RP-03 backup-integrity-verification (not SOC 2 CC IDs or HIPAA §164 references); closes the auditor-detectable cross-framework citation leak class in all 3 directions (SOC 2 ↔ HIPAA ↔ NIST CSF). **Zero engine/CLI changes**: CE's `--compliance` flag already accepts CSV (wired since EE 0.3.0); the engine is framework-agnostic. **Reviewer-pass discipline**: 2 reviewers (2nd parallel — security + air-gap + framework-leak deep-dive). 5 same-session folds applied (R-HIGH-1 schema-additive field propagation to controlEntries — closes ghost-schema; R-HIGH-2 HTML Implementation Tiers parity; R-MEDIUM-1 SOC 2→NIST CSF cross-framework leak test — the third direction; R-MEDIUM-1 JSDoc continuation marker). **+91 net new tests across 3 new suites**: load-bearing anchor-drift defense via inheritance contract (27) + engine-end-to-end fixture tests across all 6 Functions (39) + per-framework renderer citation correctness with 3-way cross-framework leak defense (25). **EE regression: 6104/6104 across 983 suites; 75-session 100% green streak preserved.** **Plugin count UNCHANGED at 24**; **SOC 2 + HIPAA coverage matrices UNCHANGED at 10/4/33 + 7/3/45** (additive-only cycle; no SOC 2 or HIPAA mappings changed). **No breaking changes** — additive only. NIST CSF 2.0 published February 2024 (NIST CSWP 29); EE 0.10.0 is the third Track 3 framework after SOC 2 (EE 0.3.x) and HIPAA (EE 0.9.0).
+
+- **CE 0.1.70** — paired with **EE 0.9.1** (May 2026). External-audit-findings ship-blocker patch: license verifier air-gap operational hardening (D-HIGH-1 per-host replay defense + D-HIGH-2 ES256-signed revocation blocklist + D-HIGH-3 monotonic clock anchor). +33 new CE tests. Paired EE 0.9.1 closes 10 ship-blockers including A-CRIT-1 (real NVD offline feed) + B-CRIT-1/2 (KMS-grant cross-reference) + C-CRIT-1..4 (PRIVESC_ACTIONS canonical Pacu paths).
+
+- **CE 0.1.69** — paired with **EE 0.9.0** (May 2026). **HIPAA FRAMEWORK CYCLE — first 0.9.x release**: HIPAA Security Rule §164.312 Technical Safeguards ships as the second supported compliance framework alongside SOC 2 (closes the long-standing "planned" gap in EE's roadmap for the highest-demand next framework). **Dual-framework workflow**: use `--compliance hipaa` or `--compliance soc2,hipaa` for HIPAA-only or SOC 2 + HIPAA evidence packs from a single scan. **HIPAA coverage matrix introduced at 7 covered + 3 partial + 45 OOS** within §164.312 + entire §164.308 Administrative Safeguards + entire §164.310 Physical Safeguards (architecturally OOS for any infrastructure scanner — pair with HIPAA-focused GRC platforms like Drata HIPAA / Vanta HIPAA / Compliancy Group for §164.308 + §164.310). **HHS Required vs Addressable discipline** surfaced per control. **§164.312(c)(1) Integrity ransomware-defense substrate**: EE's `aws-backup-auditor` Logically Air-Gapped Backup Vault cross-verification produces HHS-OCR-2024-enforcement-relevant evidence on ePHI backup integrity preservation against full source-account compromise. **Per-framework SLA-citation map** in EE renderer — HIPAA reports cite §164.312(b) audit-controls cadence + §164.312(d) Person/Entity Authentication (not SOC 2 CC IDs); closes the auditor-detectable cross-framework citation leak class. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. **Zero engine/CLI changes**: CE's `--compliance` flag already accepts CSV (wired since EE 0.3.0). **6 same-session reviewer folds** (2 R-HIGH defensive-coding + 2 R-MEDIUM scope-broadening + 1 R-LOW comment fix + 1 docstring strengthening; 0 R-CRITICAL). **+85 new tests across 3 new suites**: load-bearing anchor-drift defense via inheritance contract (32) + engine-end-to-end fixture tests across all 10 §164.312 controls (36) + per-framework renderer citation correctness (17). **EE regression: 5890/5890 across 928 suites; 69-session 100% green streak preserved.** **AWS-dogfood verified** against operator's test account (207 findings analyzed, per-framework citation map confirmed firing, ransomware-substrate surfaces correctly). **Plugin count UNCHANGED at 24**; SOC 2 coverage matrix UNCHANGED at 10/4/33 (additive-only cycle; no SOC 2 mappings changed). **No breaking changes** — additive only.
 
 - **CE 0.1.68** — paired with **EE 0.8.0** (May 2026). **24 enterprise plugins** across AWS / Azure / GCP, mapped to 10 fully-covered + 4 partial AICPA TSC controls. **MINOR VERSION MILESTONE — EE-RT.23 Move B**: EE plugin 1022 Azure scanner refactored to per-dim source attribution. Each of the 4 helpers now emits findings with its own source: `azure-nsg-auditor` / `azure-rbac-auditor` / `azure-storage-auditor` / `azure-keyvault-auditor`. Closes long-standing blocker (EE 0.6.9 R1-MEDIUM-1) for routing Azure storage findings into Appendix A "Cloud Bucket Exposure Attestation" without commingling NSG / RBAC / Key Vault. **Engine `details.category` projection contract** added (`normalizeFindings` + violation surface; additive, backward-compat). **Key Vault soc2.json gap closure — 13 new mappings** (CC6.1 + CC6.3 + C1.1 + A1.2): pre-0.8.0 Key Vault dim emitted 10 distinct `details.category` values but had ZERO soc2 routing — latent silent false-clean class closed. **Appendix A multi-cloud expansion**: 3 sources (AWS S3 + GCS + Azure Storage); `computeBucketStats` dedup key now provider-qualified (closes cross-cloud bucket-name collision). **7 same-session reviewer folds** (2 R-HIGH + 3 R-MEDIUM + 2 R-LOW; 0 R-CRITICAL). **+23 new tests / +6 new suites**. **EE regression: 5805/5805 across 907 suites; 68-session 100% green streak preserved.** **Plugin count UNCHANGED at 24**; coverage matrix UNCHANGED at 10/4/33 (pure substrate-evidence depth uplift on already-covered controls — but KV gap closure was a silent false-clean class). ⚠️ **Customer migration**: suppressions targeting `match.source: 'azure-cloud-scanner'` silently no-op post-0.8.0 — must be split into per-dim entries (see EE CHANGELOG for migration snippet).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.1.70",
+  "version": "0.1.71",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,