nsauditor-ai 0.2.15 → 0.2.16

package/README.md

@@ -17,7 +17,9 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.15 + Enterprise 0.31.3** (June 2026) — paired content bump for the Enterprise **"Enumeration-failure fleet sweep (no-silent-false-clean) + Aurora DB-cluster snapshot dimension"** cycle. The Enterprise engine closes a fleet-wide class of **enumeration-failure** false-cleans across **12 AWS plugins** — a scanner that cannot enumerate a resource population now fails **CLOSED** with a routed evidence-gap instead of reading CLEAN — and adds the Aurora **DB-cluster snapshot** dimension to plugin 1140 (a public `restore=all` cluster snapshot is CRITICAL, an unencrypted one HIGH; the cluster surface instance-level scans never see), with a Multi-AZ DB cluster fail-close. **No new framework, no new plugins (still 28), no coverage-matrix changes** — a false-negative-hardening release. **No CE engine behavior change** (the detection + routing live in the Enterprise engine). Paired **EE 0.31.3** + agent-skill 0.2.15. **EE 0.31.3 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
+**Latest: CE 0.2.16 + Enterprise 0.31.4** (June 2026) — paired content bump for the Enterprise **"Cloud-scan presentation false-clean fix + `--compliance all` / fail-fast validation"** cycle. A cloud scan (`--host aws|azure|gcp`) with real findings no longer surfaces the network concluder's *"Host is UP — No open services detected"* headline — the conclusion shows a cloud-appropriate summary (N findings by severity + top risks), and a plugin that **times out or errors** routes to **coverage UNVERIFIED** rather than an affirmative clean verdict. **`--compliance all`** expands to all seven frameworks and an unknown `--compliance` token now **fails fast** (no *"Framework load failed"* stub) — the CE `--help` now documents both (the only CE-side change). Detection is unchanged (oracle-validated). **No new framework, no new plugins (still 28), no coverage-matrix changes.** Paired **EE 0.31.4** + agent-skill 0.2.16. **EE 0.31.4 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
+
+**Prior: CE 0.2.15 + Enterprise 0.31.3** (June 2026) — paired content bump for the Enterprise **"Enumeration-failure fleet sweep (no-silent-false-clean) + Aurora DB-cluster snapshot dimension"** cycle. The Enterprise engine closes a fleet-wide class of **enumeration-failure** false-cleans across **12 AWS plugins** — a scanner that cannot enumerate a resource population now fails **CLOSED** with a routed evidence-gap instead of reading CLEAN — and adds the Aurora **DB-cluster snapshot** dimension to plugin 1140 (a public `restore=all` cluster snapshot is CRITICAL, an unencrypted one HIGH; the cluster surface instance-level scans never see), with a Multi-AZ DB cluster fail-close. **No new framework, no new plugins (still 28), no coverage-matrix changes** — a false-negative-hardening release. **No CE engine behavior change** (the detection + routing live in the Enterprise engine). Paired **EE 0.31.3** + agent-skill 0.2.15. **EE 0.31.3 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
 
 **Prior: CE 0.2.14 + Enterprise 0.31.2** (June 2026) — paired content bump for the Enterprise "At-rest encryption → ISO A.8.24 fleet sweep + cross-cloud KEY-CUSTODY-HOME doctrine" cycle (every AWS at-rest source → the 7-control at-rest set; DynamoDB + EC2-indeterminate class-O false-cleans fixed; cross-cloud key-custody doctrine → ISO A.8.24; SOC 2 file-lock fix). See [CHANGELOG.md](./CHANGELOG.md).
 

package/cli.mjs

@@ -867,7 +867,9 @@ Scan options:
   --interval <minutes>         Watch interval (default 60)
   --webhook-url <url>          Send delta alerts (must be public; private/loopback blocked)
   --alert-severity <sev>       Min severity to alert on (default: high)
-  --compliance <framework>     Run compliance mapping (e.g. soc2). Enterprise only.
+  --compliance <framework>     Map findings to controls. 'all' = all 7 frameworks, or a CSV
+                               of soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr (aliases
+                               nist/pci/iso/cis). Unknown tokens fail fast. Enterprise only.
   --compliance-scope <path>    JSON file describing the assessment scope
 
 License subcommands:
@@ -926,7 +928,7 @@ Cloud-scan hosts:
 Examples:
   nsauditor-ai scan --host 10.0.0.1 --plugins all
   CLOUD_PROVIDER=aws AWS_PROFILE=default \\
-    nsauditor-ai scan --host aws --plugins 020 --compliance soc2
+    nsauditor-ai scan --host aws --plugins all --compliance all   # full AWS audit, all 7 frameworks
   nsauditor-ai scan --host 10.0.0.0/24 --plugins all --compliance soc2
   nsauditor-ai license install enterprise_eyJhbGciOiJFUzI1NiIs...
   nsauditor-ai license --status

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.15",
+  "version": "0.2.16",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,