nsauditor-ai 0.2.20 → 0.2.21

package/README.md

@@ -17,29 +17,8 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.20 + Enterprise 0.31.6** (June 2026) — paired content bump for the Enterprise **"RDS enumeration-truncation no-false-clean class CLOSED + audit-log retention routing-depth sweep"** cycle. The Enterprise engine now makes every RDS enumerator (snapshots, live DB/cluster lists, audit-log groups) **fail closed** on page-cap truncation — a resource beyond the cap can no longer read CLEAN — and maps RDS audit-log retention to every framework's retention control (PCI DSS 10.5.1 · NIST CSF PR.PS-04 · ISO A.8.15 · CIS Safeguard 8.10), closing the named PCI 10.5.1 false-clean. **No new framework, no new plugins (still 28). Six coverage matrices UNCHANGED; the CIS Controls v8 matrix MOVES 17/22/114 → 17/23/113** (Safeguard 8.10 "Retain Audit Logs" OOS→partial — IG1 cyber-insurance baseline UNCHANGED at 23/56). **No CE engine behavior change** (detection + routing live in the Enterprise engine — this is a paired content bump). Paired **EE 0.31.6** + agent-skill 0.2.18. **EE 0.31.6 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
+**Latest: CE 0.2.21 + Enterprise 0.31.7** (June 2026) — paired bump for the Enterprise "RDS audit-log no-false-clean (generation + retention) + opt-in positive-substrate RoC surfacing" cycle. No new framework, no new plugins (still 28), all seven coverage matrices unchanged; no CE engine change. Requires CE 0.2.8+. Full detail in **[CHANGELOG.md](./CHANGELOG.md)**.
 
-**Prior: CE 0.2.19 + Enterprise 0.31.5** (June 2026) — paired content bump for the Enterprise **"RDS Multi-AZ DB cluster REAL snapshot detection + at-rest snapshot routing fleet sweep"** cycle. The Enterprise engine promotes a non-Aurora **RDS Multi-AZ DB cluster** snapshot to real detection (public `restore=all` **CRITICAL**, cross-account / unencrypted **HIGH** — was a fail-closed residual gap) and closes a cross-framework **single-framework snapshot false-clean**: an unencrypted snapshot now routes to the at-rest control in **all seven** frameworks (was SOC 2 + HIPAA only — NIST PR.DS-01 · PCI 3.5.1 · ISO A.8.24 · CIS 3.11 + 11.3 recovery-data · GDPR Art.32(1)(a)); a public/cross-account share also routes to access-control (SOC 2 CC6.1 + the Required HIPAA §164.312(a)(1)). **No new framework, no new plugins (still 28), no coverage-matrix changes.** **No CE engine behavior change** (detection + routing live in the Enterprise engine — this is a paired content bump). Paired **EE 0.31.5** + agent-skill 0.2.17. **EE 0.31.5 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.18 + Enterprise 0.31.4** (June 2026) — **CLI usability patch:** `--host aws,gcp,azure` now scans **one or more clouds in a single run** (comma-separated; `--host aws` for one cloud). Previously a comma list hit the SSRF guard (`getaddrinfo ENOTFOUND aws,gcp,azure`) — there was no way to audit multiple clouds in one command. The `--host` `--help` documents the comma form + warns that the `aws|gcp|azure` (pipe) form is notation (a shell treats `|` as a pipe). **0.2.18** also fixes the per-host auto-scope log line so it no longer implies other clouds are dropped on a multi-cloud run (they're scanned on their own pass). **CLI-only change (CE)**; Enterprise 0.31.4 unaffected (peer `nsauditor-ai >=0.2.8` unchanged). See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.16 + Enterprise 0.31.4** (June 2026) — paired content bump for the Enterprise **"Cloud-scan presentation false-clean fix + `--compliance all` / fail-fast validation"** cycle. A cloud scan (`--host aws|azure|gcp`) with real findings no longer surfaces the network concluder's *"Host is UP — No open services detected"* headline — the conclusion shows a cloud-appropriate summary (N findings by severity + top risks), and a plugin that **times out or errors** routes to **coverage UNVERIFIED** rather than an affirmative clean verdict. **`--compliance all`** expands to all seven frameworks and an unknown `--compliance` token now **fails fast** (no *"Framework load failed"* stub) — the CE `--help` now documents both (the only CE-side change). Detection is unchanged (oracle-validated). **No new framework, no new plugins (still 28), no coverage-matrix changes.** Paired **EE 0.31.4** + agent-skill 0.2.16. **EE 0.31.4 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.15 + Enterprise 0.31.3** (June 2026) — paired content bump for the Enterprise **"Enumeration-failure fleet sweep (no-silent-false-clean) + Aurora DB-cluster snapshot dimension"** cycle. The Enterprise engine closes a fleet-wide class of **enumeration-failure** false-cleans across **12 AWS plugins** — a scanner that cannot enumerate a resource population now fails **CLOSED** with a routed evidence-gap instead of reading CLEAN — and adds the Aurora **DB-cluster snapshot** dimension to plugin 1140 (a public `restore=all` cluster snapshot is CRITICAL, an unencrypted one HIGH; the cluster surface instance-level scans never see), with a Multi-AZ DB cluster fail-close. **No new framework, no new plugins (still 28), no coverage-matrix changes** — a false-negative-hardening release. **No CE engine behavior change** (the detection + routing live in the Enterprise engine). Paired **EE 0.31.3** + agent-skill 0.2.15. **EE 0.31.3 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.14 + Enterprise 0.31.2** (June 2026) — paired content bump for the Enterprise "At-rest encryption → ISO A.8.24 fleet sweep + cross-cloud KEY-CUSTODY-HOME doctrine" cycle (every AWS at-rest source → the 7-control at-rest set; DynamoDB + EC2-indeterminate class-O false-cleans fixed; cross-cloud key-custody doctrine → ISO A.8.24; SOC 2 file-lock fix). See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.13 + Enterprise 0.30.1** — paired content bump for the Enterprise "AWS RDS + API Gateway false-negative depth pass + AXIS_MAP graduation" cycle (RDS snapshot-sharing CRITICAL even when encrypted · API Gateway WAF deep-audit gap arm; every AWS source now false-negative-passed). See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.12 + Enterprise 0.30.0** — paired content bump for the Enterprise AWS + Azure false-negative depth-pass + cross-source/cross-vector compliance-mapping parity cycle (S3 access-points · resource-policy effective-exposure · EC2-SG · KMS effective-decrypt · Azure class-O fail-opens · seven-framework routing parity). See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.11 + Enterprise 0.20.0** — paired content bump for the Enterprise **GDPR Article 32 (Security of Processing)** cycle, the seventh compliance framework (Art. 32 infrastructure substrate only, not GDPR compliance; the MCP `scan_cloud` description lists GDPR Art. 32; the agent-skill teaches it; no CE engine change). See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.10 + Enterprise 0.19.4** — MCP affordance II: `scan_cloud` rolls up MEDIUM/LOW findings per provider by category + a NEW Enterprise-gated `get_findings` drill-down tool. See [CHANGELOG.md](./CHANGELOG.md).
-
-**Prior: CE 0.2.9 + Enterprise 0.19.4** — paired README-refresh pin for EE 0.19.4 "Routing-Integrity Hardening" (PCI matrix 20/8/39 → 19/9/39; no CE code change). See [CHANGELOG.md](./CHANGELOG.md).
-
-→ Full release history: **[CHANGELOG.md](./CHANGELOG.md)**
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.20",
+  "version": "0.2.21",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,