nsauditor-ai 0.2.35 → 0.2.37

package/README.md

@@ -13,10 +13,14 @@ A modular, AI-assisted network security audit platform that scans, understands,
 
 NSAuditor AI is the open-source core of a privacy-first security intelligence platform built by [Nsasoft US LLC](https://www.nsauditor.com/ai/). It orchestrates 27 specialized scanning plugins against target hosts, fuses their results through an intelligent concluder, and optionally produces AI-powered vulnerability reports — all running entirely on your machine.
 
-**Zero Data Exfiltration by design.** NSAuditor AI works fully offline. AI analysis, CVE correlation, and continuous monitoring all happen locally. External calls (to AI APIs, NVD, etc.) are opt-in and use your own API keys. We never see your scan data.
+**Zero Data Exfiltration by design — and stated precisely.** We never see your scan data: no customer data is collected, transmitted, or stored by Nsasoft US LLC, and the product has no telemetry or phone-home endpoint. Scanning, analysis, license verification and report generation all run on your machine. Two clarifications that matter operationally: AI enrichment is **opt-in** and uses your own API keys (point it at a local Ollama and nothing leaves the host), while **CVE correlation queries NIST's public NVD API by default** — set `NSAUDITOR_OFFLINE_ONLY=1` with a local NVD store to make it fully local, which reports an explicit coverage gap instead of a silent clean.
 
 ## What's New
 
+**Three flags, one new command, and a startup veto that stops swallowing itself (CE 0.2.37 / Enterprise 0.2.37 + 0.33.0).** Paired with Enterprise 0.33.0, and **this CE is required by it** — `compliance attest`, `--sla-policy <file>` and `--compliance-history <dir>` live here, so the Enterprise peer floor is raised to 0.2.37. `compliance attest` produces a Type II recurring-scan attestation over a directory of prior scans; the two flags reach the SLA/MTTR engine, which had been wired inside the compliance phase behind options nothing set. A startup posture preflight now refuses a configuration contradiction — `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path — with exit 2, at every tier and every command. And the bare `catch {}` around the Enterprise stage is split: "Enterprise is not installed" stays silent, but "Enterprise ran and threw" now names the lost stage on stderr instead of exiting 0 with no compliance report and no output. Also corrected on this frozen page: the MCP tool tables listed seven tools that are not registered and omitted two that are; WORM evidence storage was sold with a ✅ though its writer has no caller; and `--help` told operators to select plugin 1023 with `--plugins`, which cannot work — it needs a discovery plugin to confirm the host is up first.
+
+**The scan summary stops hiding its own scope limits, and a new tool ends matrix guesswork (CE 0.2.36 / Enterprise 0.32.11).** `scan_cloud`'s markdown rendered `CRITICAL · HIGH · MEDIUM · LOW · PASS` — **INFO was not a column** — so on a real AWS scan 55 of 62 INFO records appeared in no summary anywhere, several of them declarations of what was **not** assessed. INFO is now a column and rolls up by category, and scope boundaries get their own `[🔎 SCOPE NOT ASSESSED]` channel: surface nobody assessed must not read like surface assessed and found clean. **New MCP tool `compliance_matrix`** returns the shipped coverage matrix for any of the seven frameworks, derived from the framework maps at call time and failing closed rather than returning an empty one. `pdfExport` is withdrawn (registered and minted, implemented nowhere), and **every capability now ships a written description** — a bare flag name is a claim with no text behind it. `--watch` is described honestly, including the part the obvious correction got wrong: each tick writes that tick's artifacts; what is missing is any relation between them.
+
 **The dependency gate starts measuring what you install (CE 0.2.35 / Enterprise 0.32.10).** Paired with Enterprise 0.32.10 — **no CE behaviour change**. On the Enterprise side the advisory gate had been auditing the maintainer's working tree while calling it the production closure; it now packs the tarball, installs it the way you would, and audits **that**, and it will not report a clean result until it has proved an advisory database actually answered. The two trees shared 5 of 26 advisory packages and **zero** high-severity ones. Also: the SOC 2 matrix is enumerated in full (**10 / 4 / 37 = 51** — completeness, no control moved), and the Type II docs now say which mechanisms are reachable versus roadmap.
 
 **Internal-provenance strip + a false-clean closure (CE 0.2.34 / Enterprise 0.32.9).** Paired with Enterprise 0.32.9. The evidence pack a customer hands their auditor no longer carries internal engineering markers — **686 unexplained occurrences → 0** on a rebuilt three-cloud pack, with a positive control so the zero is a measurement rather than an absence of looking. Two behavioural fixes ride with it: a cloud plugin that returns `up:false` (optional SDK absent, credentials unusable) now fail-closes an evidence gap on every in-scope control of that cloud instead of leaving them PASS, and an archived scan conclusion re-mapped through the new build warns instead of failing clean. CE's side: the MCP `scan_cloud` summary strips **both** spellings of the evidence-gap routing prefix, so an operator pairing this CE with an older Enterprise still gets a clean one-line summary. **⚠️ If you suppress by `titlePattern` on the old violation text, re-point it — see the [Enterprise CHANGELOG](https://github.com/nsasoft/nsauditor-ai-ee/blob/main/CHANGELOG.md).**
@@ -59,7 +63,7 @@ NSAuditor AI is available in three editions: Community (free, MIT-licensed, no r
 
 If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS Controls v8, or GDPR Article 32 audit** — or need to satisfy customer security questionnaires citing those frameworks, or an IG1 attestation for cyber-insurance renewal — Enterprise turns scan output into **auditor-ready evidence packs** that pass institutional scrutiny:
 
-- ☁️ **28 cloud plugins** across AWS / Azure / GCP — find the configuration risks an auditor will flag, before they do (CloudTrail integrity, KMS custody, S3 Object Lock, IAM shadow-admin paths, GCP IAM impersonation chains, Azure RBAC sprawl, and more)
+- ☁️ **28 enterprise plugins — 27 cloud auditors across AWS / Azure / GCP, plus **`1023 Zero Trust Assessment`**, which scores zero-trust posture (segmentation, encryption-in-transit, identity, lateral-movement risk) from a **network-host** scan** — find the configuration risks an auditor will flag, before they do (CloudTrail integrity, KMS custody, S3 Object Lock, IAM shadow-admin paths, GCP IAM impersonation chains, Azure RBAC sprawl, and more)
 - 📋 **7 compliance frameworks shipped** — generate any combination from a single scan:
   - **SOC 2** (AICPA TSC 2017) — 10 fully-covered + 4 partial controls
   - **HIPAA Security Rule §164.312** — 7 covered + 3 partial Technical Safeguards; **Zero BAA required** (ePHI never leaves your infrastructure)
@@ -68,10 +72,10 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS C
   - **ISO/IEC 27001:2022** (ISO + IEC, Oct 2022; 2013 edition retired Oct 31, 2025) — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe); per-Annex-A-code mapping auditor-canonical for ISO/IEC 17021-1 certification body assessors; Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes
   - **CIS Critical Security Controls v8** (CIS, May 2021; v8.1 errata June 2024) — **17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls**; per-Safeguard mapping with the **Implementation Group cumulative discipline** (IG1=56 cyber-insurance baseline / IG2 cumulative=130 / IG3 cumulative=153); no-certification-body attestation discipline (INPUT to your CSAT / CIS-CAT Pro self-attestation, never "CIS certified"); Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (4.1/4.2/4.6)
   - **GDPR Article 32 (Security of Processing)** (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units**; **GDPR Article 32 infrastructure substrate only — NOT GDPR compliance** (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate *for* your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); **Art. 83(4) lower fine tier** (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
-- 🔐 **Cryptographically signed evidence** — SHA-256 chain-of-custody + RFC 3161 trusted timestamps + Ed25519 suppression signing. Non-repudiation, not just integrity. Auditors can verify offline.
-- 🏛️ **Zero Data Exfiltration architecture** — your scan data never leaves your infrastructure. Air-gapped deployment supported. AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
+- 🔐 **Evidence with a verifiable chain of custody** — SHA-256 sidecars on every artifact, verifiable offline. RFC 3161 trusted timestamps are **opt-in since EE 0.33.0** via `NSAUDITOR_TSA_URL`, require an outbound call to the authority you name, and have never been exercised against a real one. **Ed25519 suppression signing is implemented in the package but not reachable from any shipped entry point** — no first-party run signs a suppression, so do not plan around it.
+- 🏛️ **Zero Data Exfiltration architecture** — no scan data is collected, transmitted, or stored by Nsasoft; reports are written to your local disk. Air-gapped operation once configured for it (`NSAUDITOR_OFFLINE_ONLY=1` plus a local NVD store; a default run queries NIST's public CVE API). AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
 - 🔗 **GRC connectors — Vanta + Drata + Secureframe (Enterprise)** — map compliance findings to your GRC platform's evidence/test records and push them at **scan time** (opt-in). Suppression-aware outcome mapping (Vanta) / structured records (Drata + Secureframe), idempotent retries, rate-limit handling, token redaction, and Zero-Data-Exfiltration egress redaction. Early-access, single-workspace; live validation against production tenants is in progress. See **[GRC Connectors](#grc-connectors-vanta-drata-secureframe)** below.
-- 🗄️ **WORM evidence storage** — S3 Object Lock COMPLIANCE-mode for SEC Rule 17a-4(f) / FINRA 4511 retention compliance
+- 🗄️ **WORM posture VALIDATION** — we read your bucket's S3 Object Lock configuration per CloudTrail trail bucket and fail the control when it is absent, in GOVERNANCE mode or under-retained. That is substrate FOR a SEC Rule 17a-4(f) / FINRA 4511 retention claim, not the claim itself: the engine WRITING artifacts into the immutable store is built and **not reachable** (no caller), so the retention guarantee stays yours to make about your own archive
 - 📊 **SLA / MTTR tracking + recurring-scan attestation** — the **Type II operating-effectiveness evidence** auditors actually demand (not just point-in-time snapshots)
 - 🎯 **11 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 8-of-8 COMPLETE for all shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + CIS Controls v8 + GDPR Article 32 + GRC connector)
 
@@ -102,7 +106,7 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 | Risk scoring + prioritization | — | ✅ | ✅ |
 | Parallel analysis agents | — | ✅ | ✅ |
 | **Enterprise — cloud scanning** | | | |
-| 28 cloud plugins (AWS / Azure / GCP) | — | — | ✅ |
+| 28 enterprise plugins — 27 cloud (AWS / Azure / GCP) + 1 network-scan zero-trust check | — | — | ✅ |
 | Zero Trust assessment | — | — | ✅ |
 | **Enterprise — compliance (7 frameworks)** | | | |
 | SOC 2 (AICPA TSC 2017) — 10 covered + 4 partial controls | — | — | ✅ |
@@ -114,16 +118,16 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 | **GDPR Article 32 (Security of Processing)** — Art. 32 infrastructure substrate (4 covered + 5 partial + 2 OOS / 11 sub-measure units); **not GDPR compliance** · Art. 83(4) lower fine tier | — | — | ✅ |
 | Multi-framework `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr` from one scan | — | — | ✅ |
 | **Enterprise — auditor-grade evidence** | | | |
-| Signed evidence packs (SHA-256 + RFC 3161 timestamps) | — | — | ✅ |
-| Ed25519 suppression signing | — | — | ✅ |
+| Evidence packs with SHA-256 chain-of-custody (RFC 3161 timestamps opt-in, unproven against a real TSA) | — | — | ✅ |
+| Suppression workflow with approver identity verification (Ed25519 SIGNING is built, not reachable) | — | — | ✅ |
 | Chain-of-custody manifests | — | — | ✅ |
 | SLA / MTTR tracking + compensating controls | — | — | ✅ |
 | Recurring-scan attestation (Type II operating-effectiveness) | — | — | ✅ |
-| WORM evidence storage (S3 Object Lock — SEC 17a-4 / FINRA 4511) | — | — | ✅ |
+| WORM POSTURE VALIDATION on your own buckets (S3 Object Lock — SEC 17a-4 / FINRA 4511 substrate). The engine WRITING into the immutable store is built, **not reachable** | — | — | ✅ |
 | **Enterprise — integration + deployment** | | | |
 | GRC connectors — Vanta + Drata + Secureframe push (scan-time, opt-in) | — | — | ✅ |
-| Tabletop simulation + SIEM correlation | — | — | ✅ |
-| Air-gapped deployment | — | — | ✅ |
+| Tabletop simulation + SIEM correlation — built, **not reachable** (no caller) | — | — | 🚧 |
+| Air-gapped **operation** once installed — offline licence validation, offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`. (Air-gapped DELIVERY is WITHDRAWN: no offline installer, image bundle or feed bundle ships.) | — | — | ✅ |
 
 **This repository is the Community Edition** — fully functional, MIT-licensed, no restrictions, no telemetry. Pro and Enterprise features ship via the [`@nsasoft/nsauditor-ai-ee`](https://www.nsauditor.com/ai/pricing) package and install alongside the CE binary once licensed.
 
@@ -263,7 +267,7 @@ Results land in `./out/<host>_<timestamp>/`:
 
 ### Pro/Enterprise Plugins (via @nsasoft/nsauditor-ai-ee)
 
-**28 enterprise plugins** across AWS, GCP, and Azure substrate audits — all mapped to AICPA Trust Services Criteria 2017 (10 covered + 4 partial controls). EE plugins live in the disjoint 1000+ ID range; CE reserves 001-099. Once licensed, the EE package installs alongside the CE binary and discovers automatically.
+**28 enterprise plugins: 27 cloud auditors across AWS, GCP and Azure substrate, plus **`1023 Zero Trust Assessment`**, which scores zero-trust posture (segmentation, encryption-in-transit, identity, lateral-movement risk) from a **network-host** scan** — all mapped to AICPA Trust Services Criteria 2017 (10 covered + 4 partial controls). EE plugins live in the disjoint 1000+ ID range; CE reserves 001-099. Once licensed, the EE package installs alongside the CE binary and discovers automatically. A cloud `--host` pass auto-scopes on `cloudProvider`, which only the 27 declare, so `1023` never runs on a cloud pass. It runs on a network-host scan with the full plugin set — measured on the shipped CLI, selecting it by id on its own does not work, because it requires the host to be confirmed up by a discovery plugin.
 
 → **[Watch a sample scan run end-to-end](https://www.nsauditor.com/ai/docs/sample-scan/)** — synthetic Acme Corp AWS account + home-office router. Real real scan output, no signup required. See the transitive SG chain reachability finding, the multi-region GuardDuty audit, the dnsmasq CVE detection, and what the signed evidence pack actually looks like.
 
@@ -307,8 +311,8 @@ Results land in `./out/<host>_<timestamp>/`:
 | 1220 | Azure Storage Account Data-Protection (**EE 0.13.2**) | Enterprise | Dedicated Azure Storage Account encryption / transit / authorization auditor — orthogonal to the 1022 scanner's network-exposure dims (no double-emission; mirrors the AWS 1020 + 1120 two-plugin S3 split). HTTPS-only transit (`enableHttpsTrafficOnly`) + minimum TLS version + Shared Key authorization (`allowSharedKeyAccess` — bypasses Azure AD; absent = enabled, never silent-PASS) + infrastructure (double) encryption + encryption key source incl. **customer-managed-key reachability + rotation** (`keyVaultProperties` — a disabled/revoked/version-pinned CMK degrades, not silent-PASS). Conservative classifier: indeterminate field / AccessDenied → evidence-gap; single-subscription scope surfaced explicitly. **CC6.7 / CC6.1 / C1.1** |
 | 1221 | Azure NSG Perimeter (**EE 0.14.0**; UDP lane **EE 0.14.1**) | Enterprise | The Azure analog of AWS 1170 — a CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups. Evaluates each NSG's inbound rules in Azure priority order (first match wins; DenyAllInbound default): all-protocol public Allow + public-source (`*`/`0.0.0.0/0`/`Internet`) to a restricted **TCP** management/data-tier port (SSH/RDP/MSSQL/MySQL/Postgres/Redis/Mongo/SMB/WinRM/etc.) + `::/0` IPv6-wildcard to a restricted port (the dimension 1022's flat lint misses) + **public-source / `::/0` to a restricted UDP service** (SNMP/CLDAP/NTP/rpcbind/IPMI/IKE/Memcached etc. — Dim 2u/3u, EE 0.14.1) + public→non-restricted INFO + PASS substrate. **Attachment-aware** (attached → CRITICAL effective; orphaned → MEDIUM latent) + effective priority/deny-override resolution + `0.0.0.0/1` split-range coverage. Non-overlapping-by-depth with 1022's coarse per-rule NSG lint. Conservative classifier: denied/indeterminate → evidence-gap; one malformed NSG degrades per-resource. **CC6.6** |
 | 1222 | Azure Key Vault Deep Auditor (**EE 0.15.0**) | Enterprise | The third dedicated Azure auditor (after 1220 storage + 1221 NSG) — the KV analog of how 1221 deepens 1022's flat NSG dim. Enumerates each vault's keys, role assignments, and diagnostic settings across 4 dims: (1) key **auto-rotation policy** + (2) key **expiry** (epoch-s/ms/Date/string coerced) + (3) **diagnostic logging → Log Analytics** (`@azure/arm-monitor`) + (4) **privileged-access depth** (RBAC `roleAssignments` admin/data-plane/scope-aware + legacy `accessPolicies` export/wide-crypto breadth). Orthogonal to 1022's vault-property dims (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission. Secret/cert expiry is a deliberate data-plane scope boundary. Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource. **CC6.3 / C1.1 / CC6.1 / CC7.2** |
-| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), chain-of-custody, RFC 3161 timestamps, suppression workflow with Ed25519 signing. |
-| — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same institutional-grade evidence infrastructure as SOC 2 (chain-of-custody, RFC 3161 timestamps, Ed25519 suppression signing). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
+| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), SHA-256 chain-of-custody, opt-in RFC 3161 timestamps, and the suppression workflow. (Ed25519 SIGNING of suppressions is built but unreachable — the workflow ships, the signature does not.) |
+| — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same evidence infrastructure as SOC 2 (SHA-256 chain-of-custody; opt-in RFC 3161 timestamps; suppression signing built but not reachable). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
 | — | **NIST CSF 2.0 Compliance Engine (EE 0.10.0)** | Enterprise | NIST Cybersecurity Framework 2.0 Core mapping at the auditor-canonical Subcategory level — 13 covered + 10 partial + 83 OOS across 106 of CSF 2.0's 107 Subcategories. Govern function OOS-by-design (GV.SC-04 partial as substrate exception); Respond function OOS-entirely; Implementation Tiers 1-4 OOS as organizational-maturity claims. NIST SP 800-53 Rev. 5 + CIS Critical Security Controls v8 cross-references baked into `informativeReferences`. Use `--compliance nist-csf` or `--compliance soc2,hipaa,nist-csf` for triple-framework reports from a single scan. |
 | — | **PCI DSS v4.0.1 Compliance Engine (EE 0.11.0)** | Enterprise | PCI DSS v4.0.1 (PCI SSC, June 2024 errata; supersedes v4.0 March 2022; v3.2.1 retired March 31, 2024) mapping at the auditor-canonical sub-requirement level for QSA Report on Compliance workflow — **19 covered + 9 partial + 39 OOS across 67 of ~250 sub-requirements (MVP-67 density)** (Req 7.2.2 down-rated covered→partial in EE 0.19.4 — access-by-job-classification is process/HR-gated). Req 12 Information Security Program OOS-by-design entirely. Req 5 anti-malware + Req 9 physical OOS-entirely. **Defined-vs-Customized Approach discipline per Appendix E** — 15 Defined-only sub-requirements enforced at schema layer. **Cardholder Data Environment (CDE) scope operator-attested** via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. **Card-brand AOC enforcement priority view** (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC). **4 load-bearing schema enrichments** per control: `controlType` + `approachEligibility` + `cloudProviderAttestation` (AWS / Azure / GCP currently-named AOCs) + `cdeScope`. CAO MVP-deferred to EE 0.11.1. Use `--compliance pci-dss` or `--compliance soc2,hipaa,nist-csf,pci-dss` for quad-framework reports from a single scan. |
 | — | **ISO/IEC 27001:2022 Compliance Engine (EE 0.12.0)** | Enterprise | ISO/IEC 27001:2022 (ISO + IEC, October 2022; 2013 edition retired October 31, 2025) Annex A mapping at the auditor-canonical per-Annex-A-code level for ISO/IEC 17021-1 certification body assessors — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe across 4 themes: A.5 Organizational 37 + A.6 People 8 + A.7 Physical 14 + A.8 Technological 34). **Statement of Applicability per Clause 6.1.3.d discipline** — engine produces substrate for INCLUDED controls; SoA inclusion/exclusion is operator-side. **ISMS Clauses 4-10 OOS-by-design** with 7 Major Nonconformity classes (absence of internal audit per Clause 9.2 OR management review per Clause 9.3 = auto-fail Stage 2). 11 NEW 2022 controls + 5-attribute taxonomy (cybersecurityConcepts 5 categories, NOT 6 like NIST CSF) + 2013-to-2022 transition discipline + Cloud-Provider Certificate Inheritance Matrix. Use `--compliance iso-27001` or any combination for multi-framework reports from a single scan. |
@@ -317,7 +321,7 @@ Results land in `./out/<host>_<timestamp>/`:
 | — | SLA & MTTR Tracking | Enterprise | Per-severity SLA targets, compensating-control flow, finding lifecycle, Type II rolling-quarter cadence. |
 | — | Recurring-Scan Attestation | Enterprise | Multi-scan chronological matrix, cadence gap detection, scope-drift surface (CC8.1). |
 | — | GRC Platform Connector | Enterprise | Vanta + Drata + Secureframe connectors — scan-time push (opt-in), retry/backoff, deterministic idempotency, rate-limit handling, circuit breaker, foreign-token detection, ZDE egress redaction. See [GRC Connectors](#grc-connectors-vanta-drata-secureframe). |
-| — | WORM Evidence Storage | Enterprise | S3 Object Lock COMPLIANCE-mode + resource redaction + SHA-256 manifest. SEC 17a-4 / FINRA 4511 retention-compatible. |
+| — | WORM Posture Validation | Enterprise | Reads S3 Object Lock configuration on your trail buckets + resource redaction + SHA-256 manifest — substrate for a SEC 17a-4 / FINRA 4511 claim. The archive WRITER (`prepareArchive`) is built and **not reachable**: no caller, so no first-party run writes into an immutable store. |
 | — | Tabletop Simulation | Enterprise | Probe-event manifest + SIEM detection correlation, configurable coverage bands (Type II / High-Assurance presets). |
 
 **Running EE plugins** (after `nsauditor-ai license install <key>`):
@@ -357,7 +361,7 @@ nsauditor-ai scan --host aws --plugins all --compliance soc2 --aws-region all
 - **Global services** (IAM, account-level S3 enumeration) are audited once regardless of `--aws-region`; the S3 auditors resolve **each bucket's own region** and skip + disclose buckets outside the scoped set (closing latent cross-region false-cleans).
 - **MCP `scan_cloud` (Claude Desktop / Claude Code):** the same scoping is a `regions` argument — *omit* it to scan the server-configured `AWS_REGION`, or pass `["all"]` (or a region-code list like `["us-east-1","eu-west-1"]`) to fan out. Omitting does **not** fan out, so a single tool-call stays within Desktop's timeout.
 
-The auditor evidence pack is emitted under `out/` — cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, RFC 3161 trusted-timestamps, suppression workflow, identity verification. EE is available at [`www.nsauditor.com/ai/pricing`](https://www.nsauditor.com/ai/pricing).
+The auditor evidence pack is emitted under `out/` — cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, the suppression workflow and approver identity verification, plus opt-in RFC 3161 trusted-timestamps (`NSAUDITOR_TSA_URL`; never run against a real authority). Ed25519 suppression SIGNING is built and not reachable. EE is available at [`www.nsauditor.com/ai/pricing`](https://www.nsauditor.com/ai/pricing).
 
 ---
 
@@ -436,32 +440,32 @@ nsauditor-ai-mcp
 npx nsauditor-ai-mcp
 ```
 
-**CE Tools:**
+The server registers **seven** tools and lists all seven to every client. The licence is
+checked when a tool is CALLED, not when the list is served — so an unlicensed call returns
+an explicit 🔒 refusal naming the tier it needs, never an empty result that reads as "nothing
+found". A higher tier does not add tools; it unlocks the ones already in the list.
+
+**Available on every tier:**
 
 | Tool | Purpose |
 |---|---|
-| `scan_host` | Run full scan against a host with plugin selection |
-| `list_plugins` | List available scanner plugins with metadata |
+| `scan_host` | Run a full plugin scan against a host — service detection, OS fingerprint, structured findings |
+| `list_plugins` | List available scanner plugins with their IDs, priorities and requirements |
+| `compliance_matrix` | Return the shipped coverage matrix for a framework — Covered / Partial / Out of scope, with the per-group out-of-scope reasons. **Needs the Enterprise pack installed**: the matrices are its data, so on a Community-only install this fails closed with an install instruction rather than returning an empty matrix (an empty matrix is what gets filled in with a guess) |
 
-**Pro Tools** (requires license key + `@nsasoft/nsauditor-ai-ee`):
+**Unlocked by Pro** (licence key + `@nsasoft/nsauditor-ai-ee`):
 
 | Tool | Purpose |
 |---|---|
-| `probe_service` | Deep scan a specific port/service |
-| `get_vulnerabilities` | Query CVEs by CPE string |
-| `risk_summary` | Prioritized risk overview from last scan |
-| `scan_compare` | Diff two scan results with risk weighting |
-| `save_finding` | Save a validated finding to the finding queue (schema-checked) |
+| `probe_service` | Run one specific plugin against a single `host:port` |
+| `get_vulnerabilities` | Look up known CVEs for a CPE (Common Platform Enumeration) string via the NVD API |
 
-**Enterprise Tools** (requires Enterprise license):
+**Unlocked by Enterprise:**
 
 | Tool | Purpose |
 |---|---|
 | `scan_cloud` | Audit one or more cloud accounts (AWS / GCP / Azure) using server-configured credentials; no network host. "Audit my AWS account" / "Audit my AWS and Azure accounts". |
-| `start_assessment` | Multi-host orchestrated assessment workflow |
-| `prioritize_risks` | Cross-host risk prioritization |
-| `compliance_check` | Compliance mapping with gap analysis |
-| `export_report` | Generate formatted compliance report |
+| `get_findings` | Drill into the findings of the most recent `scan_cloud` run (per-provider session cache — not live state) |
 
 > `scan_cloud` runs the requested clouds' plugins **concurrently** (default up to 20 at once, 25s per-plugin
 > timeout) so a full multi-service cloud audit completes within Claude Desktop's ~60s tool-call limit. Tune with
@@ -695,7 +699,7 @@ nsauditor-ai --version     (or -v, or `version`)
 | `--output-format <fmt>` | Additional output format: `sarif` (CI/CD) · `csv` (spreadsheet) · `md` or `markdown` (chat/PR/Slack quotable) | — |
 | `--fail-on <sev>` | Exit code 2 if findings ≥ severity: `critical\|high\|medium\|low\|info` | — |
 | `--insecure-https` | Accept self-signed TLS certificates | `false` |
-| `--watch` | Enable CTEM continuous scanning | `false` |
+| `--watch` | CTEM continuous **alerting** loop — re-scan on `--interval`, diff, webhook on `--alert-severity`. Not an evidence cadence: no retention, no cross-run aggregation, skips SARIF/CSV/Markdown + `--fail-on`, dies with the process. Use a scheduler for SOC 2 Type II history. | `false` |
 | `--interval <min>` | Rescan interval in minutes (requires `--watch`) | `60` |
 | `--webhook-url <url>` | Webhook URL for delta alerts | — |
 | `--alert-severity <sev>` | Minimum severity for webhook alerts | `high` |
@@ -817,6 +821,66 @@ NSAUDITOR_LICENSE_KEY=pro_eyJhbGci...   # Pro or Enterprise license key
 NSAUDITOR_PLUGIN_PATH=                   # Additional plugin directories (colon-separated)
 ```
 
+**Longitudinal compliance evidence (Enterprise CLI, new alongside the variables below):**
+
+A single scan shows configuration at an instant. A SOC 2 Type II auditor — and the ISO
+surveillance cadence, PCI Appendix E sampling, HIPAA §164.312(b) and GDPR Art. 32(1)(d)
+equivalents — asks whether controls operated over a *period*. Every scan has always written
+a per-framework `scan_attestation_<framework>.json`, so a history you already have is
+aggregatable today:
+
+```bash
+# Track remediation SLA / MTTR against a directory of prior scans
+nsauditor-ai scan --host aws --compliance soc2 \
+  --compliance-history ./out --sla-policy ./my-sla.json
+
+# Roll a directory of prior scans up into a multi-period attestation
+nsauditor-ai compliance attest --history ./out --framework soc2 --window 12m
+```
+
+Three things the roll-up states about itself rather than leaving you to discover:
+discovery reads **one** directory level (`<history-root>/<scan-id>/`), scans whose own
+attestation is marked `REPORT INVALID FOR AUDIT` are **counted and named** rather than
+averaged into a clean verdict, and an empty history exits **3** with status `no_evidence` —
+absence of evidence is a finding, not a pass.
+
+**Compliance evidence (`NSAUDITOR_*` — Enterprise, all opt-in):**
+
+Every variable added from Enterprise 0.33.0 onward carries the `NSAUDITOR_` prefix, so a
+deploy can tell at a glance which environment variables belong to this product. The
+unprefixed families above (`AI_*`, `OPENAI_*`, `NVD_API_KEY`, `COMPLIANCE_GRC_*`) keep
+working exactly as they do today — prefixed aliases arrive in a later minor, and a silent
+rename will never happen.
+
+```ini
+NSAUDITOR_OFFLINE_ONLY=1          # Exact match on '1'. Forbids outbound: CVE matching reads a local
+                                  # NVD store and reports an explicit coverage gap rather than a silent
+                                  # clean. Also VETOES the two settings below — configuring an offline
+                                  # posture and an outbound destination together is a startup error,
+                                  # never a quiet downgrade to weaker evidence.
+NSAUDITOR_TSA_URL=                # RFC 3161 Time-Stamp Authority endpoint. NO DEFAULT, EVER — unset
+                                  # means the feature is absent, not "use a vendor default".
+NSAUDITOR_TSA_CERT_CHAIN=         # Path to the TSA certificate chain (PEM), for offline verification
+NSAUDITOR_TSA_POLICY_OID=         # Optional policy OID to request from the TSA
+NSAUDITOR_IDENTITY_REGISTRY=      # Path to the approver identity registry JSON. Binds the humans named
+                                  # in your suppression file to identities an assessor can check.
+                                  # Template ships at data/compliance/identity_registry.json (Enterprise).
+NSAUDITOR_SIGNING_KEY=            # A REFERENCE, never key material: keychain:LABEL | /path/to/key.pem
+                                  # (mode 0600) | awskms:alias/… — see the honesty note below.
+```
+
+Two of these are deliberately **not** capabilities yet, and saying so here is the point:
+
+- **`NSAUDITOR_SIGNING_KEY` is groundwork, and less wired than this note used to say.** EE 0.33.0 stopped parsing it at option-resolution time — a malformed value used to abort the EE stage for a setting nothing reads — so it is now carried through unparsed; `parseSigningRef` / `resolveSigner` hold the parse and the offline veto at the point a key would be used, and no
+  shipped entry point signs a suppression, so setting it changes nothing today. It exists
+  now because the signature record's `algorithm` and `backend` fields had to be frozen
+  *before* the first signature reaches a customer archive — retrofitting that later breaks
+  every auditor holding one.
+- **`NSAUDITOR_TSA_URL` is wired but unproven.** The request is built and sent; it has
+  **never been exercised against a real Time-Stamp Authority** — every test to date injects
+  a fake, which proves the plumbing and not the capability. Treat trusted timestamping as
+  roadmap until that live check is published.
+
 **Security overrides:**
 
 ```ini
@@ -1014,7 +1078,7 @@ NSAuditor AI is built on a **Zero Data Exfiltration (ZDE)** architecture:
 - **No data processing.** Nsasoft US LLC never sees, stores, or processes your scan results.
 - **AI is opt-in.** External AI calls use your own API keys. Redaction runs locally first.
 - **License validation is offline.** JWT signature verified locally with an embedded public key.
-- **Air-gappable, once configured for it.** Scanning, analysis, license verification and evidence-pack generation all run with no outbound network access; Enterprise adds offline CVE matching from a local NVD store under `NSAUDITOR_OFFLINE_ONLY=1`, which emits an explicit coverage gap rather than a silent clean when the store cannot answer. Stated precisely because it matters operationally: a **default** scan still attempts NVD egress unless that variable is set, and the only other outbound paths — AI enrichment and the GRC push — are opt-in and off by default. Populating the local NVD store is the operator's; no feed data is delivered with the product.
+- **Air-gappable, once configured for it.** Scanning, analysis, license verification and evidence-pack generation all run with no outbound network access; Enterprise adds offline CVE matching from a local NVD store under `NSAUDITOR_OFFLINE_ONLY=1`, which emits an explicit coverage gap rather than a silent clean when the store cannot answer. Stated precisely because it matters operationally: a **default** scan still attempts NVD egress unless that variable is set. The other outbound paths — AI enrichment, the GRC push, the continuous-monitoring webhook, and the timestamping and signing paths on the roadmap — are opt-in and off by default; the paths that are *not* optional are the scan target itself, your own cloud provider's APIs during a cloud scan, and DNS resolution of the target. All of them are enumerated with their trigger and default state in the egress register (EE `docs/architecture.md` §14.1.1), which is generated from code and guarded in both directions — deliberately, so this sentence never again has to carry a completeness claim that prose alone cannot keep true. Populating the local NVD store is the operator's; no feed data is delivered with the product.
 
 Nsasoft US LLC is not a data processor, data controller, or business associate under any data protection regulation. You own and control all data produced by NSAuditor AI.
 

package/cli.mjs

@@ -660,6 +660,27 @@ export async function parseArgs(argv) {
   // (override-on) for this scan; `--aws-profile <name>` selects a named profile
   // from ~/.aws/credentials. Both are wired into main() via resolveScanEnv().
   // get() returns undefined (absent), true (value-less flag), or the string value.
+  // EE 0.33.0 (N2): longitudinal compliance evidence. Both are forwarded verbatim to
+  // EE, which owns every default and every validation — CE never parses or defaults
+  // them. Tri-state like `--env` and NOT the `--compliance-scope` collapse-to-null
+  // form: a value-less `--sla-policy` must be an error in main(), because silently
+  // nulling it is precisely the quiet skip this feature exists to remove.
+  // `--history` is the spelling the `compliance attest` subcommand documents and the one
+  // an operator types there; `--compliance-history` is the scan-path spelling. Both
+  // resolve to the same value because they name the same directory. Accepting only one
+  // is how a DOCUMENTED flag becomes a flag that does nothing — and that is exactly what
+  // shipped in the first draft here, caught by RUNNING the command rather than reading
+  // it. The EE guard that catches this class is scoped to /--compliance[A-Za-z-]*/, and
+  // `--history` does not match it.
+  const complianceHistoryVal = get('compliance-history') || get('compliance_history') || get('history');
+  args.complianceHistory = complianceHistoryVal === undefined ? undefined : complianceHistoryVal;
+  const slaPolicyVal = get('sla-policy') || get('sla_policy');
+  args.slaPolicy = slaPolicyVal === undefined ? undefined : slaPolicyVal;
+  const attestWindowVal = get('window');
+  args.attestWindow = (attestWindowVal && attestWindowVal !== true) ? attestWindowVal : null;
+  const frameworkVal = get('framework');
+  args.framework = (frameworkVal && frameworkVal !== true) ? frameworkVal : null;
+
   const envVal = get('env');
   args.env = envVal === undefined ? undefined : envVal; // string path, or true if value-less
   const awsProfileVal = get('aws-profile');
@@ -740,21 +761,47 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
   // AWS accounts. EE 0.3.2 + CE 0.1.30 ship as a paired release; mixing
   // versions is supported but the EE-side cloud-harvest behavior requires
   // CE-0.1.30+ to take effect.
+  // ⚠️ THE IMPORT AND THE CALL GET SEPARATE CATCHES, AND THE SPLIT IS THE POINT.
+  // A single bare `catch {}` around both made "EE is not installed" — a legitimate,
+  // expected, silent skip for every Community user — indistinguishable from "EE ran and
+  // THREW", which silently deletes the deliverable: the scan exits 0, writes no compliance
+  // report, and prints nothing. That is the false-clean shape, and it is the channel a
+  // whole class of defects has reached production through (a malformed env var did exactly
+  // this until 0.33.0 moved the parse). Absence stays silent; failure is named and the run
+  // is marked, because an operator who asked for `--compliance` and got no report must not
+  // have to diff directories to discover it.
+  let ee = null;
+  try {
+    ee = await import('@nsasoft/nsauditor-ai-ee');
+  } catch { /* EE not installed — CE proceeds unchanged. The ONLY silent case. */ }
   try {
-    const { enrichScan } = await import('@nsasoft/nsauditor-ai-ee');
-    const eeEnrichment = await enrichScan(conclusion, {
+    const eeEnrichment = ee ? await ee.enrichScan(conclusion, {
       host,
       outDir,
       compliance:      opts.compliance ?? process.env.COMPLIANCE_FRAMEWORKS ?? null,
       complianceScope: opts.complianceScope ?? null,
+      // EE 0.33.0 (N2). Forwarded verbatim; EE owns the defaults, the validation and
+      // the path-or-object handling for the policy.
+      complianceTrackSla:    opts.complianceTrackSla,
+      complianceHistoryRoot: opts.complianceHistoryRoot,
+      slaPolicy:             opts.slaPolicy,
       results,
       onWarn: (msg) => console.warn(`[EE] ${msg}`),
-    });
+    }) : null;
     if (eeEnrichment?.enrichedPrompt) {
       conclusion.result = conclusion.result || {};
       conclusion.result.eeEnrichment = eeEnrichment;
     }
-  } catch { /* EE not installed — CE proceeds unchanged */ }
+  } catch (err) {
+    // EE IS PRESENT AND FAILED. Never silent: name the stage that was lost, and mark the
+    // conclusion so a downstream reader can tell "no findings" from "the stage that finds
+    // them did not run". Still non-fatal — a scan that completed its CE work is worth
+    // keeping — but it is now a visible degradation rather than an invisible one.
+    console.error(`[EE] enrichment FAILED — this scan has no compliance report, no `
+      + `intelligence enrichment and no analysis-agent findings: ${err?.message ?? err}`);
+    conclusion.result = conclusion.result || {};
+    conclusion.result.eeEnrichmentError = String(err?.message ?? err);
+  }
 
   const { file_paths: ai_file_paths, ai_conclusion, ai_status, ai_error } = await maybeSendToOpenAI({ host, results, conclusion, promptMode, outDir });
   // BUG1 (fail-VISIBLE): a one-line end-of-scan AI status so a failed/aborted AI
@@ -902,6 +949,45 @@ function maxSeverityInConclusion(conclusion) {
  * @param {object} [opts] - { cmd, frameworks, importEE(test seam) }
  * @returns {Promise<{ran:boolean, reason?:string}>}
  */
+/**
+ * STARTUP POSTURE VETO — `NSAUDITOR_OFFLINE_ONLY=1` against a configured egress path.
+ *
+ * EE raises this as an `NsauditorConfigError` from `resolveComplianceEnvOpts`, and exports
+ * that function specifically so CE can fail fast at startup with the SAME definition of
+ * "offline". Until now nothing called it, and the veto's only route into CE was through
+ * `enrichScan` — straight into the bare `catch {}` on the scan path, which does not abort
+ * the scan: it silently drops the ENTIRE EE stage (intelligence, agents, the compliance
+ * report). A quiet skip wearing a fail-fast's name, one repo over from the test that
+ * forbids exactly that.
+ *
+ * Deliberately NOT gated on the command and NOT gated on a licence tier — a contradiction
+ * between two operator settings is a configuration error under every command, and
+ * `enrichScan` never even evaluated it below Pro tier. `tests/cli_posture_preflight.test.mjs`
+ * pins both of those as decisions rather than accidents, and explains why this exits 2 while
+ * the GRC preflight below exits 1.
+ *
+ * EE stays optional: an unresolvable EE means no EE egress paths to veto, and that is a
+ * reason, not a failure.
+ *
+ * @param {Record<string,string|undefined>} env
+ * @param {{importEE?: Function}} [opts]  `importEE` is the test seam — these cases must not
+ *   require EE to be installed, the same convention `preflightGrcIfRequested` uses.
+ * @returns {Promise<{ran: boolean, reason?: string}>}
+ * @throws the EE `NsauditorConfigError` verbatim, so main() can print it and exit 2
+ */
+export async function preflightNsauditorPosture(env, opts = {}) {
+  const { importEE } = opts;
+  let ee;
+  try {
+    ee = importEE ? await importEE() : await import('@nsasoft/nsauditor-ai-ee');
+  } catch {
+    return { ran: false, reason: 'ee-unavailable' };
+  }
+  if (typeof ee?.resolveComplianceEnvOpts !== 'function') return { ran: false, reason: 'ee-too-old' };
+  ee.resolveComplianceEnvOpts(env);
+  return { ran: true };
+}
+
 export async function preflightGrcIfRequested(env, opts = {}) {
   const { cmd, frameworks, importEE } = opts;
   if (cmd !== 'scan') return { ran: false, reason: 'not-scan' };
@@ -922,7 +1008,7 @@ export async function preflightGrcIfRequested(env, opts = {}) {
 
 export async function main() {
   const args = await parseArgs(process.argv);
-  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, awsRegion } = args;
+  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, complianceHistory, slaPolicy, attestWindow, framework, awsRegion } = args;
 
   // Version: handled before license verification so it works without a key.
   // CE-0.1.30.1 — closes the discovery-flag UX gap where pre-fix
@@ -965,7 +1051,14 @@ Scan options:
   --fail-on <severity>         Exit non-zero if any finding ≥ severity
   --output-format <fmt>        Additional report format: sarif | csv | md
   --insecure-https             Skip TLS validation on probed HTTPS targets
-  --watch                      CTEM continuous mode
+  --watch                      CTEM continuous ALERTING mode: re-scan on --interval,
+                               diff against the previous cycle, fire --webhook-url when a
+                               change crosses --alert-severity. NOT an evidence cadence —
+                               it adds no retention or cross-run aggregation, skips SARIF/
+                               CSV/Markdown output and --fail-on, and dies with this process.
+                               Each tick is an ordinary scan, so with --compliance it writes
+                               that tick's artifacts; nothing relates them across ticks. For
+                               SOC 2 Type II history use a scheduler (cron/systemd/CI).
   --interval <minutes>         Watch interval (default 60)
   --webhook-url <url>          Send delta alerts (must be public; private/loopback blocked)
   --alert-severity <sev>       Min severity to alert on (default: high)
@@ -973,6 +1066,22 @@ Scan options:
                                of soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr (aliases
                                nist/pci/iso/cis). Unknown tokens fail fast. Enterprise only.
   --compliance-scope <path>    JSON file describing the assessment scope
+  --compliance-history <dir>   Directory of prior scans (one subdirectory per scan). Turns on
+                               SLA/MTTR longitudinal tracking against that history. Enterprise.
+  --sla-policy <path>          JSON file of SLA thresholds per severity; defaults to the
+                               shipped data/compliance/sla.json. Turns SLA tracking on by
+                               itself. Relative paths resolve against the current
+                               directory. Enterprise.
+
+Compliance subcommands:
+  nsauditor-ai compliance attest --history <dir> [--framework <fw>] [--window 6m|12m|90d]
+                                        Aggregate the per-scan attestation records in
+                                        <dir> into a multi-period (Type II) recurring-scan
+                                        attestation. Reads scan_attestation_<fw>.json from
+                                        each subdirectory, so a history you already have is
+                                        aggregatable. Discovery is ONE level deep and the
+                                        report says so. Exits 3 when no evidence is found —
+                                        an empty history is a finding, not a pass.
 
 License subcommands:
   nsauditor-ai license install <KEY>    Verify and persist a license key (Keychain
@@ -1017,7 +1126,9 @@ Environment:
   NSA_ALLOW_ALL_HOSTS=1          Permit RFC1918 / loopback (local-network auditing)
   CLOUD_PROVIDER=aws|gcp|azure   Required for cloud scanner plugins (020/021/022/023/030)
   AI_PROVIDER=openai|claude|ollama   AI provider for report generation
-  COMPLIANCE_TSA_URL             RFC 3161 timestamp authority for SOC 2 attestation
+  NSAUDITOR_TSA_URL              RFC 3161 timestamp authority for compliance attestation.
+                                 No default, ever — unset means the feature is absent.
+                                 Refused at startup together with NSAUDITOR_OFFLINE_ONLY=1.
 
 Cloud-scan hosts:
   --host aws[,gcp,azure]         One or more cloud sentinel literals, comma-separated
@@ -1039,8 +1150,10 @@ Cloud-scan hosts:
                                  is safe here.
                                  Note: the composite zero-trust checker (1023) has no
                                  single cloud and is therefore skipped under this
-                                 auto-scope; to run it, select it explicitly
-                                 (--plugins 023,...) or scan a network host/CIDR.
+                                 auto-scope. It runs on a NETWORK host/CIDR scan with
+                                 the full plugin set; selecting it by id on its own
+                                 does not work, because it needs a discovery plugin to
+                                 confirm the host is up first.
                                  INVERSE (cloud scope integrity): a cloud auditor runs
                                  ONLY on its own sentinel host. On a NETWORK host (IP /
                                  CIDR / hostname) the cloud-scanner plugins NEVER run —
@@ -1109,6 +1222,17 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
   // --env load) so a bad token / control-map / provider fails fast instead of after a
   // full scan. The helper gates on the exact push condition (so a framework-less recon
   // scan / non-scan command is never hard-failed) + silently skips if EE isn't installed.
+  // Posture veto FIRST — before the GRC preflight and before any scan work. An operator who
+  // has forbidden outbound connections and also configured one must hear about it here, not
+  // from an EE stage that a bare catch would drop on the floor. Exit 2 matches
+  // `compliance attest`, the other door into the same veto.
+  try {
+    await preflightNsauditorPosture(process.env);
+  } catch (err) {
+    console.error(`Fatal: ${err.message}`);
+    process.exit(2);
+  }
+
   try {
     await preflightGrcIfRequested(process.env, { cmd, frameworks: args.compliance ?? process.env.COMPLIANCE_FRAMEWORKS });
   } catch (err) {
@@ -1173,12 +1297,22 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       console.log(`  nsauditor-ai (CE):              ${TOOL_VERSION}`);
       console.log(`  @nsasoft/nsauditor-ai-ee (EE):  ${_eeVersion}`);
     } else if (rawArgs.includes('--capabilities')) {
+      const { CAPABILITIES } = await import('./utils/capabilities.mjs');
       const tier = getTierFromEnv();
       const caps = resolveCapabilities(tier);
       console.log(`Active capabilities for tier: ${tier}\n`);
+      // ⚠️ PRINT THE DESCRIPTION, NOT JUST THE NAME. This list is read back by assistants,
+      // and a bare identifier is a claim with no text behind it: `✓ airGapped` was expanded
+      // into "air-gapped deployment" — a withdrawn phrase — and `✓ pdfExport` into "the
+      // output is auditor-consumable via pdfExport", for a function that throws. A reader
+      // given reviewed text quotes it; a reader given an identifier invents one.
       for (const [name, enabled] of Object.entries(caps)) {
+        const desc = CAPABILITIES[name] && CAPABILITIES[name].desc;
         console.log(`  ${enabled ? '✓' : '✗'} ${name}`);
+        if (desc) console.log(`      ${desc}`);
       }
+      console.log('\nEach line above states what the capability DOES. Quote these descriptions '
+        + 'rather than expanding the flag name — the name is an identifier, not a claim.');
     } else if (rawArgs.includes('--plugins')) {
       // CE-0.1.30.3 — real enumeration of discovered plugins, grouped by
       // source (CE / EE / custom NSAUDITOR_PLUGIN_PATH). Pre-fix this
@@ -1979,6 +2113,55 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
     process.exit(exitCode);
   }
 
+  // ── `compliance attest` (EE 0.33.0, N2) ───────────────────────────────────
+  // Placed BEFORE the unknown-command guard, or it would be dead code that exits 2.
+  // Deliberately a THIN forward: EE owns framework validation, the offline posture
+  // veto, framework-alias resolution and every default. CE contributes the flag
+  // surface and the exit code — nothing here can drift out of sync with the engine
+  // because nothing here decides anything.
+  if (cmd === 'compliance') {
+    const sub = process.argv[3];
+    if (sub !== 'attest') {
+      console.error('Usage: nsauditor-ai compliance attest --history <dir> [--framework <fw>] [--window 6m|12m|90d]');
+      process.exit(2);
+    }
+    if (typeof complianceHistory !== 'string' || complianceHistory.length === 0) {
+      console.error('Fatal: compliance attest requires --history <dir>');
+      process.exit(2);
+    }
+    let runAttestCommand;
+    try {
+      ({ runAttestCommand } = await import('@nsasoft/nsauditor-ai-ee'));
+    } catch {
+      console.error('compliance attest requires the Enterprise package (@nsasoft/nsauditor-ai-ee).');
+      process.exit(2);
+    }
+    try {
+      const { report, files, exitCode } = await runAttestCommand({
+        // EE gates on this, exactly as it does for a compliance scan. CE resolves the
+        // tier it already resolved for `--compliance`; presenting it here rather than
+        // letting EE default keeps ONE definition of "Enterprise" across both paths.
+        capabilities: resolveCapabilities(getTierFromEnv()),
+        rootDir: complianceHistory,
+        outDir: resolveBaseOutDir(),
+        framework: framework || compliance || 'soc2',
+        window: attestWindow || '6m',
+        onWarn: (msg) => console.warn(`[EE] ${msg}`),
+      });
+      console.log(`Recurring attestation (${report.framework}): ${report.summary.scanCount} scans in window, status ${report.summary.complianceStatus}`);
+      if (report.summary.invalidForAudit > 0) {
+        console.warn(`  ${report.summary.invalidForAudit} of them are marked REPORT INVALID FOR AUDIT by their own attestation — see scansWithWarnings`);
+      }
+      for (const f of files) console.log(`  wrote ${f.path ?? f}`);
+      process.exit(exitCode);
+    } catch (err) {
+      // A posture contradiction or an unknown framework arrives here. It must NOT be
+      // swallowed: the whole point of the veto is that it stops the run loudly.
+      console.error(`Fatal: ${err.message}`);
+      process.exit(2);
+    }
+  }
+
   if (cmd !== 'scan') {
     console.error(`Unknown command: ${cmd}`);
     process.exit(2);
@@ -2007,6 +2190,30 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
   if (ports) opts.ports = ports;
   if (compliance) opts.compliance = compliance;
   if (complianceScope) opts.complianceScope = complianceScope;
+  // A value-less flag is a mistake worth stopping for: `--sla-policy` with no path
+  // would otherwise scan on and produce a report indistinguishable from one where the
+  // operator never asked for SLA tracking at all.
+  for (const [flag, val] of [['--compliance-history', complianceHistory], ['--sla-policy', slaPolicy]]) {
+    if (val === true) {
+      console.error(`Fatal: ${flag} requires a value`);
+      process.exit(2);
+    }
+  }
+  if (typeof complianceHistory === 'string' && complianceHistory.length > 0) {
+    opts.complianceHistoryRoot = complianceHistory;
+    // The history root IS the request: asking for a history and not tracking against
+    // it would be a flag that reads as doing something and does nothing.
+    opts.complianceTrackSla = true;
+  }
+  if (typeof slaPolicy === 'string' && slaPolicy.length > 0) {
+    opts.slaPolicy = slaPolicy;
+    // …and it TURNS TRACKING ON. Setting the policy alone was a byte-identical no-op:
+    // the whole SLA block is gated on complianceTrackSla, so an operator who passed
+    // --sla-policy and nothing else got a report indistinguishable from passing nothing,
+    // with no warning in either channel. A flag that reads as configuring a feature must
+    // not silently require a second flag to have any effect.
+    opts.complianceTrackSla = true;
+  }
   if (awsRegionIntent) opts.awsRegionIntent = awsRegionIntent;
   const pm = await PluginManager.create(`${__dirname}/plugins`);
   const promptMode = String(process.env.OPENAI_PROMPT_MODE || 'basic').toLowerCase().trim();

package/mcp_server.mjs

@@ -29,6 +29,8 @@ import { resolveCapabilities } from './utils/capabilities.mjs';
 import { buildMarkdownReport } from './utils/report_md.mjs';
 import { summarizeCloudFindings, renderCloudFindingsMarkdown, describeFinding, RESOURCE_KEYS } from './utils/cloud_finding_summary.mjs';
 import { authorizeMcpServerStartup, getMcpAuthKeyAge, getRotationWarningDays, reportMcpAuthSource } from './utils/mcp_auth.mjs';
+import _nodeFs from 'node:fs';
+import _nodePath from 'node:path';
 
 const _require = createRequire(import.meta.url);
 const { version: TOOL_VERSION } = _require('./package.json');
@@ -68,7 +70,7 @@ function requireProCapability(toolName) {
   return {
     content: [{
       type: 'text',
-      text: `🔒 **${toolName}** requires a Pro license.\n\nView Pro/Enterprise pricing at https://www.nsauditor.com/ai/pricing/\n\n**CE tools available:** scan_host, list_plugins`,
+      text: `🔒 **${toolName}** requires a Pro license.\n\nView Pro/Enterprise pricing at https://www.nsauditor.com/ai/pricing/\n\n**CE tools available:** scan_host, list_plugins, compliance_matrix`,
     }],
     isError: true,
   };
@@ -79,7 +81,7 @@ export function requireEnterpriseCapability(toolName) {
   return {
     content: [{
       type: 'text',
-      text: `🔒 **${toolName}** (cloud account auditing) requires an Enterprise license.\n\nView Enterprise pricing at https://www.nsauditor.com/ai/pricing/\n\n**CE tools available:** scan_host, list_plugins`,
+      text: `🔒 **${toolName}** (cloud account auditing) requires an Enterprise license.\n\nView Enterprise pricing at https://www.nsauditor.com/ai/pricing/\n\n**CE tools available:** scan_host, list_plugins, compliance_matrix`,
     }],
     isError: true,
   };
@@ -209,6 +211,29 @@ function appendCallSentinel(text, callId) {
 // Max findings per page — also referenced in the TOOLS inputSchema description below.
 const GET_FINDINGS_MAX_LIMIT = 20;   // ~500 chars/finding -> ~10KB page (Desktop 60s budget)
 
+// ---------------------------------------------------------------------------
+// FRAMEWORK_STEMS — the ONE CE-side name for the shipped compliance framework set.
+//
+// ⚠️ WHY A CE-SIDE CONSTANT AND NOT AN EE IMPORT. EE owns this set
+// (`@nsasoft/nsauditor-ai-ee/utils/framework_ids.mjs` → FRAMEWORK_STEMS) and that specifier IS
+// exported and resolvable — but EE is not a CE dependency at all: CE must load and serve its
+// tool registry with EE absent. `TOOLS` below is built at MODULE LOAD, so importing EE here
+// would make the tool REGISTRY itself conditional on an optional package, which is a strictly
+// worse failure than a stale list (no tools at all, on the customers who never buy EE).
+// The equality is therefore enforced where a hard EE dependency is allowed — at test time, by
+// tests/framework_stem_parity.test.mjs, which holds this array in TWO-WAY equality with both
+// EE's declaration and the on-disk `data/compliance/*.json` census, and which FAILS (never
+// skips) when EE is unresolvable.
+//
+// It is declared HERE, above TOOLS, because the set had drifted into FOUR transcriptions: the
+// compliance_matrix enum, the handler's validation list, this suite's own copy — and the tool
+// DESCRIPTION, which is the load-bearing one. A schema enum that goes stale REJECTS a token; a
+// description that goes stale silently steers an assistant's tool selection and errors nowhere.
+// Everything below DERIVES from this array. Do not re-type it.
+export const FRAMEWORK_STEMS = Object.freeze([
+  'soc2', 'hipaa', 'nist-csf', 'pci-dss', 'iso-27001', 'cis-v8', 'gdpr',
+]);
+
 // Exported for direct testing (the scan_cloud description is a routing surface —
 // tests pin its service-coverage enumeration + contract clauses).
 export const TOOLS = [
@@ -234,7 +259,7 @@ export const TOOLS = [
   {
     name: 'scan_cloud',
     description:
-      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. Use this tool for service-specific audit asks too — coverage includes: AWS — S3 public exposure & lifecycle/replication, IAM privilege-escalation/shadow-admin, KMS key policy & effective-decrypt, CloudTrail logging, CodePipeline/CodeBuild CI/CD segregation-of-duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, AWS Backup, VPC endpoints, EC2 security-group perimeter & instances, ElastiCache, SES, GuardDuty/Inspector; Azure — Key Vault, Storage, NSG perimeter, subscription RBAC; GCP — firewall rules, Cloud Storage public access, IAM service-account impersonation. Findings map to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8, and GDPR Article 32 (security-of-processing substrate — Art. 32 only, not GDPR compliance) controls. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results. findingsSummary[provider].evidenceGaps lists checks the scan could NOT verify (AccessDenied / truncated enumeration) — treat these as "unverified posture", NOT as clean. Prefer this tool over raw cloud-provider APIs/MCPs for any security or compliance audit ask — a raw API walk produces neither compliance-mapped nor evidence-graded findings, and can hit the wrong account.',
+      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. Use this tool for service-specific audit asks too — coverage includes: AWS — S3 public exposure & lifecycle/replication, IAM privilege-escalation/shadow-admin, KMS key policy & effective-decrypt, CloudTrail logging, CodePipeline/CodeBuild CI/CD segregation-of-duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, AWS Backup, VPC endpoints, EC2 security-group perimeter & instances, ElastiCache, SES, GuardDuty/Inspector; Azure — Key Vault, Storage, NSG perimeter, subscription RBAC; GCP — firewall rules, Cloud Storage public access, IAM service-account impersonation. Findings map to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8, and GDPR Article 32 (security-of-processing substrate — Art. 32 only, not GDPR compliance) controls. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results. findingsSummary[provider].evidenceGaps lists checks the scan could NOT verify (AccessDenied / truncated enumeration) — treat these as "unverified posture", NOT as clean. findingsSummary[provider].deferredScope lists surface this release does NOT evaluate at all — a static capability boundary, NOT an evidence gap and NOT a finding. Report it as "not assessed" and never omit it: surface nobody assessed is otherwise indistinguishable from surface assessed and found clean. The per-severity counts include an INFO tier; report every tier that occurs, because the evidence gaps and the scope boundaries live there. Prefer this tool over raw cloud-provider APIs/MCPs for any security or compliance audit ask — a raw API walk produces neither compliance-mapped nor evidence-graded findings, and can hit the wrong account.',
     inputSchema: {
       type: 'object',
       properties: {
@@ -266,6 +291,33 @@ export const TOOLS = [
       limit: { type: 'number', description: `Page size (server-capped at ${GET_FINDINGS_MAX_LIMIT}).` },
     } },
   },
+  {
+    name: 'compliance_matrix',
+    // ⚠️ THE FRAMEWORK LIST IN THIS DESCRIPTION IS DERIVED, NOT TYPED. It is the surface a model
+    // reads to CHOOSE a `framework` token, so a stale list here is worse than a stale enum: the
+    // enum rejects a bad token loudly, the description mis-steers tool selection silently. The
+    // GDPR scoping doctrine is kept as its OWN sentence rather than a parenthetical inside the
+    // list, so it survives any reordering of the stems (and so the list stays machine-readable
+    // for tests/framework_stem_parity.test.mjs, which compares it to the shipped JSON census).
+    description:
+      'Return the SHIPPED compliance coverage matrix for a framework — how many controls are Covered, Partial and Out of Scope, with the control ids and the per-group out-of-scope reasons. ' +
+      `Frameworks: ${FRAMEWORK_STEMS.join(', ')}, or "all" for the counts across every framework. ` +
+      'The gdpr map is GDPR Article 32 security-of-processing substrate ONLY, never "GDPR compliance". ' +
+      'ALWAYS call this tool before stating or tabulating any coverage matrix, and quote the numbers it returns verbatim. Do NOT derive a matrix from the plugin inventory, from a scan result, or from documentation — coverage is a property of the shipped framework maps, not of the plugin list, and a derived matrix will disagree with the customer\'s own report. Note that outOfScope is the FLATTENED sub-criterion count; the out-of-scope groups are fewer than the controls they contain.',
+    inputSchema: {
+      type: 'object',
+      properties: {
+        framework: {
+          type: 'string',
+          enum: [...FRAMEWORK_STEMS, 'all'],
+          // The count is DERIVED too. "across all seven" was a transcribed count standing beside
+          // a transcribed list — two things to forget on the next framework cycle instead of none.
+          description: `Which framework matrix to return. Omit or pass "all" for the counts across all ${FRAMEWORK_STEMS.length} shipped frameworks.`,
+        },
+      },
+      required: [],
+    },
+  },
   {
     name: 'probe_service',
     description:
@@ -638,6 +690,123 @@ export async function handleListPlugins() {
 }
 
 /** Map tool name to handler. Exported for testing. */
+// ---------------------------------------------------------------------------
+// compliance_matrix — the SHIPPED coverage matrix, derived at call time.
+//
+// Gate-3 prompt 5 published a wrong SOC 2 matrix (5/18/38 = 61 against a shipped
+// 10/4/37 = 51) and its own note gave the reason: "No MCP tool returns the coverage
+// matrix." With no authoritative surface, an assistant asked for an exact matrix will
+// derive one from whatever it CAN see — here, the plugin inventory. This tool does not
+// supply knowledge; it removes the option to synthesise.
+//
+// TWO RULES, both load-bearing:
+//   1. DERIVE, never transcribe. The numbers are read out of the shipped framework JSON on
+//      every call. A constant here would rot exactly like the transcribed matrices this repo
+//      keeps catching — inside the instrument built to stop them.
+//   2. FAIL CLOSED. `plugin_discovery.mjs` swallows an unresolvable EE into `catch {}` so CE
+//      runs standalone, and copying that here would answer "no matrix" — which is precisely
+//      the void an assistant fills with a synthesised one.
+//
+// The framework set this handler validates against is the module-level FRAMEWORK_STEMS declared
+// above TOOLS — the SAME array the enum and the tool description are built from. It used to be
+// a second copy right here, which is how rule 1 was being obeyed for the NUMBERS and quietly
+// broken for the framework LIST inside the very tool built to stop transcription rot.
+
+function _defaultResolveEE() {
+  // `@nsasoft/nsauditor-ai-ee/data/compliance/*.json` is NOT importable — EE's `exports` map
+  // publishes ./plugins/*, ./utils/*, ./agents/*, ./mcp/* and no ./data/*, so a direct
+  // specifier throws ERR_PACKAGE_PATH_NOT_EXPORTED even though `files[]` ships the directory.
+  // Resolve the manifest and path-join, the same way plugin_discovery.mjs finds ./plugins.
+  return _nodePath.dirname(_require.resolve('@nsasoft/nsauditor-ai-ee/package.json'));
+}
+
+function _readFrameworkSummary(eeRoot, stem) {
+  const file = _nodePath.join(eeRoot, 'data', 'compliance', `${stem}.json`);
+  const raw = JSON.parse(_nodeFs.readFileSync(file, 'utf8'));
+  const cs = raw.coverageSummary || {};
+  const covered = Array.isArray(cs.covered) ? cs.covered : [];
+  const partial = Array.isArray(cs.partial) ? cs.partial : [];
+  const groups = Array.isArray(cs.outOfScope) ? cs.outOfScope : [];
+  // ⚠️ `outOfScope` is an array of GROUPS ({ids, title, reason}), not of ids. soc2's 11
+  // groups flatten to 37 ids; publishing `groups.length` yields a plausible-looking 10/4/11.
+  const oosIds = groups.reduce((n, g) => n + (Array.isArray(g.ids) ? g.ids.length : 0), 0);
+  // FAIL CLOSED ON EMPTY DATA, not just on a missing package (added at review). Every default
+  // above degrades to [], so a file that parses but carries no usable coverageSummary produced
+  // `0 covered / 0 partial / 0 out-of-scope` — published with the same authority as a real
+  // matrix, over a framework whose file was simply unreadable. A tool built to stop an
+  // assistant synthesising a matrix must not hand it a zero to synthesise around.
+  if (covered.length + partial.length + oosIds === 0) {
+    throw new Error(
+      `the shipped coverage matrix for '${stem}' could not be read: ${file} has no usable ` +
+      'coverageSummary (covered / partial / outOfScope are all empty). This is a broken or ' +
+      'incompatible Enterprise install, NOT a framework with zero coverage. Reinstall ' +
+      '@nsasoft/nsauditor-ai-ee and restart the MCP server. Do NOT reconstruct the matrix from ' +
+      'the plugin inventory or from documentation.',
+    );
+  }
+  return {
+    framework: stem,
+    label: raw.frameworkLabel || raw.framework || stem,
+    version: raw.version || null,
+    covered: covered.length,
+    partial: partial.length,
+    outOfScope: oosIds,
+    total: covered.length + partial.length + oosIds,
+    coveredIds: covered,
+    partialIds: partial,
+    outOfScopeGroups: groups.map((g) => ({ ids: g.ids || [], title: g.title || null, reason: g.reason || null })),
+  };
+}
+
+export async function handleComplianceMatrix(args = {}) {
+  const which = args.framework == null ? 'all' : String(args.framework);
+  if (which !== 'all' && !FRAMEWORK_STEMS.includes(which)) {
+    throw new Error(`unknown framework '${which}' (valid: ${FRAMEWORK_STEMS.join(', ')}, all)`);
+  }
+  const resolveEE = typeof args._resolveEE === 'function' ? args._resolveEE : _defaultResolveEE;
+  let eeRoot;
+  try {
+    eeRoot = resolveEE();
+  } catch {
+    throw new Error(
+      'The compliance coverage matrix is shipped with the Enterprise plugin pack, and ' +
+      '@nsasoft/nsauditor-ai-ee is not installed / not resolvable from this server. ' +
+      'Install it (npm i -g @nsasoft/nsauditor-ai-ee) and restart the MCP server. ' +
+      'Do NOT reconstruct the matrix from the plugin inventory or from documentation — ' +
+      'coverage is a property of the shipped framework maps, not of the plugin list.',
+    );
+  }
+
+  if (which !== 'all') return _readFrameworkSummary(eeRoot, which);
+
+  // The all-frameworks view drops the per-group `reason` prose: keeping it for all seven is
+  // ~52 KB against a ~10 KB per-response norm here, and a response an assistant truncates is
+  // a response an assistant partially synthesises.
+  const frameworks = {};
+  const unavailable = [];
+  for (const stem of FRAMEWORK_STEMS) {
+    try {
+      const { coveredIds, partialIds, outOfScopeGroups, ...counts } = _readFrameworkSummary(eeRoot, stem);
+      frameworks[stem] = counts;
+    } catch (err) {
+      // Partial-tolerant, but never silent: a framework that could not be read is NAMED, so a
+      // caller can tell "this framework has no coverage" from "this framework was not readable".
+      unavailable.push({ framework: stem, reason: err && err.message ? err.message : String(err) });
+    }
+  }
+  if (!Object.keys(frameworks).length) {
+    throw new Error('no shipped coverage matrix could be read from the Enterprise pack at ' +
+      `${eeRoot}: ${unavailable.map((u) => u.framework).join(', ')}. Do NOT reconstruct the matrix.`);
+  }
+  return {
+    frameworks,
+    ...(unavailable.length ? { unavailable } : {}),
+    note: 'Counts are derived from the shipped data/compliance/<framework>.json coverageSummary at call time. ' +
+      'outOfScope is the FLATTENED sub-criterion count, not the number of out-of-scope groups. ' +
+      'Call this tool with a single framework to get the control ids and the per-group out-of-scope reasons.',
+  };
+}
+
 export const toolHandlers = {
   scan_host: handleScanHost,
   scan_cloud: handleScanCloud,
@@ -645,6 +814,7 @@ export const toolHandlers = {
   probe_service: handleProbeService,
   get_vulnerabilities: handleGetVulnerabilities,
   list_plugins: handleListPlugins,
+  compliance_matrix: handleComplianceMatrix,
 };
 
 // ---------------------------------------------------------------------------
@@ -755,7 +925,7 @@ export function createServer() {
           `If versions in this response don't match your shell, the response was\n` +
           `AI-generated rather than retrieved from the MCP server (see CE 0.1.33 advisory).`;
 
-        const tierSuffix = `\n\nCurrent tier: ${tierLabel[_tier] ?? _tier}. ${_capabilities.proMCP ? '' : 'Upgrade to Pro for probe_service, get_vulnerabilities, risk_summary, and more.'}`;
+        const tierSuffix = `\n\nCurrent tier: ${tierLabel[_tier] ?? _tier}. ${_capabilities.proMCP ? '' : 'Upgrade to Pro for probe_service and get_vulnerabilities.'}`;
 
         return {
           content: [{ type: 'text', text: appendCallSentinel(JSON.stringify(result, null, 2) + tierSuffix + versionLines, callId) }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.35",
+  "version": "0.2.37",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,

package/utils/capabilities.mjs

@@ -1,34 +1,58 @@
 // utils/capabilities.mjs
 
+/**
+ * The capability registry.
+ *
+ * ⚠️ EVERY FLAG CARRIES A `desc`, AND THAT IS A CLAIM-HONESTY MECHANISM, NOT DOCUMENTATION.
+ * Until 0.32.11 the product shipped bare flag NAMES: `license --capabilities` printed
+ * `✓ airGapped` and nothing else. An assistant asked what the product does then EXPANDS the
+ * identifier — and "airGapped" expands to "air-gapped deployment", the exact phrase withdrawn
+ * from the README, the skill, six web surfaces and the Marketplace listing. That is a claim
+ * surface with NO TEXT TO SWEEP: at sweep time the claim exists only as an identifier, so no
+ * gate can see it, and it is regenerated fresh on every reading. A `desc` written in the
+ * reviewed register is what a reader quotes INSTEAD of inventing one — Gate-3 prompt 7
+ * demonstrated the converse, where reviewed text survived retelling verbatim.
+ *
+ * So: when adding a flag, write its `desc` in the register the claim guards allow, and say
+ * what the code DOES, not what the name suggests.
+ *
+ * Keep in lockstep with EE index.mjs EE_CAPABILITIES + license-manager keygen.mjs +
+ * licensing/api.sls.licensing keygenclass.js (the DEPLOYED signer — a flag left there is
+ * still minted into customer JWTs, which is what an assistant actually reads).
+ */
 export const CAPABILITIES = {
   // CE (always available)
-  coreScanning:       { tier: 'ce' },
-  aiAnalysis:         { tier: 'ce' },  // Any provider (OpenAI/Claude/Ollama), basic prompts
-  basicCTEM:          { tier: 'ce' },
-  basicRedaction:     { tier: 'ce' },
-  basicMCP:           { tier: 'ce' },
-  findingQueue:       { tier: 'ce' },
+  coreScanning:       { tier: 'ce', desc: 'Network and host scanning plugins (ports, protocols, TLS, OS fingerprinting).' },
+  aiAnalysis:         { tier: 'ce', desc: 'AI analysis of scan output via any configured provider (OpenAI / Claude / Ollama), basic prompts.' },
+  basicCTEM:          { tier: 'ce', desc: 'Continuous watch mode: interval re-scan, delta report, webhook alert. An ALERTING loop — it adds no evidence retention or cross-run aggregation.' },
+  basicRedaction:     { tier: 'ce', desc: 'Redaction of secrets and identifiers from AI prompt payloads before egress.' },
+  basicMCP:           { tier: 'ce', desc: 'MCP tools scan_host, list_plugins and compliance_matrix (the coverage matrix is ungated — it reports what the installed framework maps say).' },
+  findingQueue:       { tier: 'ce', desc: 'The finding-queue data structure. NOTE: the persisted scan_finding_queue.json artifact is written by the Enterprise plugin pack behind the Pro-tier intelligenceEngine gate, so a CE-only install has the structure and not the file.' },
 
   // Pro
-  intelligenceEngine: { tier: 'pro' },
-  riskScoring:        { tier: 'pro' },
-  proAI:              { tier: 'pro' },
-  analysisAgents:     { tier: 'pro' },
-  advancedCTEM:       { tier: 'pro' },
-  enhancedRedaction:  { tier: 'pro' },
-  proMCP:             { tier: 'pro' },
-  pdfExport:          { tier: 'pro' },
+  intelligenceEngine: { tier: 'pro', desc: 'Offline CPE generation and NVD CVE matching against detected services.' },
+  riskScoring:        { tier: 'pro', desc: 'Risk weighting applied to intelligence-engine findings.' },
+  proAI:              { tier: 'pro', desc: 'Pro analysis prompts (deeper context than the CE prompt set).' },
+  analysisAgents:     { tier: 'pro', desc: 'Auth, crypto, config and service analysis agents over scan evidence. Analysis of collected evidence — NOT active exploitation probes.' },
+  advancedCTEM:       { tier: 'pro', desc: 'Extended scan-history retention beyond the CE window.' },
+  enhancedRedaction:  { tier: 'pro', desc: 'Additional redaction patterns over the CE set for AI prompt payloads.' },
+  proMCP:             { tier: 'pro', desc: 'MCP tools probe_service and get_vulnerabilities.' },
 
   // Enterprise
-  cloudScanners:      { tier: 'enterprise' },
-  zeroTrust:          { tier: 'enterprise' },
-  complianceEngine:   { tier: 'enterprise' },
-  enterpriseMCP:      { tier: 'enterprise' },
-  airGapped:          { tier: 'enterprise' },
+  cloudScanners:      { tier: 'enterprise', desc: 'AWS / Azure / GCP cloud posture audit plugins (Enterprise plugin pack).' },
+  zeroTrust:          { tier: 'enterprise', desc: 'Zero-trust posture checks over collected identity and network evidence.' },
+  complianceEngine:   { tier: 'enterprise', desc: 'Maps findings to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8 and GDPR Art. 32 controls, and renders the report artifacts.' },
+  enterpriseMCP:      { tier: 'enterprise', desc: 'MCP tools scan_cloud and get_findings.' },
+  airGapped:          { tier: 'enterprise', desc: 'Offline OPERATION: licence validation is local (ES256 against an embedded key, no callback, no phone-home) and CVE matching runs against a local feed. This describes how the software RUNS, not how it is delivered or installed.' },
   // Removed 2026-07-21 (capability claim audit): verificationEngine / brandedReports /
   // usageMetering / dockerIsolation (no implementation) + zdePolicyEngine / enterpriseCTEM
   // (real cores ship + are claimed in prose; no distinct engine/datastore behind the flag).
-  // Keep in lockstep with EE index.mjs EE_CAPABILITIES + license-manager keygen.mjs.
+  // Removed 2026-08-05 (0.32.11): pdfExport — registered, minted into licences and printed
+  // to customers as `✓ pdfExport`, while renderBrandedReport() throws 'Not implemented',
+  // puppeteer is not a dependency, and NO code read the flag. Gate-3 caught it generating a
+  // claim end to end: an assistant read the flag list and wrote "the output is auditor-
+  // consumable via pdfExport" into a customer-facing document. HTML reports remain
+  // printable from a browser; that is the browser's capability, not a licensed one.
 };
 
 const TIER_CAPS = {

package/utils/cloud_finding_summary.mjs

@@ -58,17 +58,35 @@ function pickClause(issues, prefer) {
   return String(issues[0]);
 }
 
-/** Robust one-line descriptor from any plugin finding shape. Never empty, never a raw object dump. */
+/**
+ * Robust one-line descriptor from any plugin finding shape. Never empty, never a raw object
+ * dump, and — since 0.32.11 — never MULTI-LINE.
+ *
+ * ⚠️ ONE-LINE IS A RENDERING CONTRACT, not tidiness. The markdown renderer emits one list
+ * item per line (`- **[TAG]** plugin: title`), so an embedded newline terminates the item and
+ * dumps the remainder as unformatted body text. Several producers build their issue as
+ * `"…:\n- alpha\n- beta"`, which is exactly the shape that breaks it, and the breakage is
+ * worst on the disclosures that matter most — a truncated scope declaration reads as a
+ * complete one.
+ *
+ * @param {object} x
+ * @param {{prefer?: 'gap', max?: number}} [opts] `max` overrides the 160-char budget for
+ *   channels whose whole purpose is to state a boundary (see the deferred-scope channel,
+ *   where a 160-char slice discloses one deferred dimension out of eight and so claims more
+ *   coverage than it has).
+ */
 export function describeFinding(x, opts = {}) {
-  if (!x || typeof x !== 'object') return String(x ?? '').slice(0, 160);
+  const max = Number.isFinite(opts.max) ? opts.max : 160;
+  const flat = (v) => String(v ?? '').replace(/\s+/g, ' ').trim();
+  if (!x || typeof x !== 'object') return flat(x).slice(0, max);
   let res = '';
   for (const k of RESOURCE_KEYS) { if (x[k]) { res = String(x[k]); break; } }
   let why = '';
   if (Array.isArray(x.issues) && x.issues.length) why = pickClause(x.issues, opts.prefer);
   else for (const k of REASON_KEYS) { if (x[k]) { why = String(x[k]); break; } }
-  why = why.replace(ROUTING_PREFIX_RE, '');
-  const s = ((res ? res + ' — ' : '') + why).trim();
-  if (s) return s.length > 160 ? s.slice(0, 160).replace(/\s+\S*$/, '') + '…' : s;
+  why = flat(why).replace(ROUTING_PREFIX_RE, '');
+  const s = ((res ? flat(res) + ' — ' : '') + why).trim();
+  if (s) return s.length > max ? s.slice(0, max).replace(/\s+\S*$/, '') + '…' : s;
   const sev = String(x.severity || x.level || '').toUpperCase();
   return sev ? sev + ' finding (no description)' : 'finding (no description)';
 }
@@ -108,10 +126,26 @@ export function summarizeCloudFindings(results, providerOf, cap = Number(process
     // bucketed under 'unknown' rather than silently dropped (defense-in-depth against a
     // future id collision / cloudProvider drift — never let a real finding vanish).
     const prov = providerOf(r?.id ?? r?.result?.id) || UNKNOWN_PROVIDER;
-    const bucket = (out[prov] ||= { counts: {}, findings: [], evidenceGaps: [], truncated: false, _rollup: { MEDIUM: new Map(), LOW: new Map() } });
+    const bucket = (out[prov] ||= { counts: {}, findings: [], evidenceGaps: [], deferredScope: [], truncated: false, _rollup: { MEDIUM: new Map(), LOW: new Map(), INFO: new Map() } });
     for (const x of found) {
       const sev = String(x?.severity || x?.level || 'INFO').toUpperCase();
       bucket.counts[sev] = (bucket.counts[sev] || 0) + 1;
+      // A STATIC CAPABILITY BOUNDARY, not a per-scan gap. Its own channel, deliberately:
+      // contract-v1 §2 freezes `deferredScope` as "must NOT route as a live gap", and the
+      // 2026-06-10 operator decision unmarked these from `evidenceGap` precisely so a
+      // boundary would not fail every scan universally. Surfacing it must not undo that by
+      // the back door — so it gets a channel and a badge of its own, and never the gap badge.
+      if (x && typeof x === 'object' && x.details && x.details.deferredScope === true) {
+        bucket.deferredScope.push({
+          plugin: String(r?.id ?? ''),
+          scopeId: x.details.deferredScopeId ? String(x.details.deferredScopeId) : null,
+          category: x.details.category ? String(x.details.category) : null,
+          // A boundary statement gets a wider budget than a finding: these declarations run
+          // to several hundred characters across four to eight deferred dimensions, and a
+          // 160-char slice discloses ONE of them while reading like the whole boundary.
+          title: describeFinding(x, { max: 420 }),
+        });
+      }
       let findingEntry = null;
       if (sev === 'CRITICAL' || sev === 'HIGH') {
         findingEntry = { severity: sev, plugin: String(r?.id ?? ''), title: describeFinding(x) };
@@ -136,7 +170,13 @@ export function summarizeCloudFindings(results, providerOf, cap = Number(process
         if (findingEntry) gapEntry._findingRef = findingEntry;
         bucket.evidenceGaps.push(gapEntry);
       }
-      if ((sev === 'MEDIUM' || sev === 'LOW') && !(x && x.details && x.details.evidenceGap === true)) {
+      // INFO joined MEDIUM/LOW at 0.32.11. It was the ONLY populated tier with no channel at
+      // all: not in the header, not in findings[], not in the rollup — so on a real AWS scan
+      // 55 of 62 INFO records appeared in no summary anywhere. Records that already have a
+      // channel (evidence gaps, scope boundaries) are excluded, or the same record is counted
+      // twice and a cross-cloud roll-up becomes arithmetically wrong.
+      const hasOwnChannel = !!(x && x.details && (x.details.evidenceGap === true || x.details.deferredScope === true));
+      if ((sev === 'MEDIUM' || sev === 'LOW' || sev === 'INFO') && !hasOwnChannel) {
         const cat = (x && x.details && x.details.category)
           ? String(x.details.category)
           : `uncategorized(${String(r?.id ?? '')})`;
@@ -160,12 +200,9 @@ export function summarizeCloudFindings(results, providerOf, cap = Number(process
         delete g._findingRef; // internal ref must never reach the MCP payload
       }
     }
-    b.rollup = {
-      MEDIUM: [...b._rollup.MEDIUM].map(([category, count]) => ({ category, count }))
-                .sort((a, c) => c.count - a.count || a.category.localeCompare(c.category)),
-      LOW: [...b._rollup.LOW].map(([category, count]) => ({ category, count }))
-                .sort((a, c) => c.count - a.count || a.category.localeCompare(c.category)),
-    };
+    const rollupOf = (tier) => [...b._rollup[tier]].map(([category, count]) => ({ category, count }))
+      .sort((a, c) => c.count - a.count || a.category.localeCompare(c.category));
+    b.rollup = { MEDIUM: rollupOf('MEDIUM'), LOW: rollupOf('LOW'), INFO: rollupOf('INFO') };
     delete b._rollup;
   }
   return out;
@@ -208,13 +245,27 @@ export function renderCloudFindingsMarkdown(summary, providers, opts = {}) {
   for (const prov of order) {
     const b = summary[prov]; if (!b) continue;
     const c = b.counts || {};
-    lines.push(`## ${String(prov).toUpperCase()} — ${c.CRITICAL || 0} CRITICAL · ${c.HIGH || 0} HIGH · ${c.MEDIUM || 0} MEDIUM · ${c.LOW || 0} LOW · ${c.PASS || 0} PASS`);
+    // INFO is a column. It was omitted until 0.32.11, so a header could read "…0 LOW · 17
+    // PASS" over 62 unreported INFO records — the tier that carries the evidence gaps and the
+    // scope boundaries, i.e. exactly the material a reader needs to tell an incomplete scan
+    // from a clean one.
+    lines.push(`## ${String(prov).toUpperCase()} — ${c.CRITICAL || 0} CRITICAL · ${c.HIGH || 0} HIGH · ${c.MEDIUM || 0} MEDIUM · ${c.LOW || 0} LOW · ${c.INFO || 0} INFO · ${c.PASS || 0} PASS`);
     for (const f of (b.findings || [])) lines.push(`- **[${f.severity}]** ${f.plugin}: ${f.title}`);
     if (b.truncated) lines.push(`- _…CRITICAL/HIGH list truncated; see counts above for totals._`);
     for (const g of (b.evidenceGaps || [])) lines.push(`- **[⚠ EVIDENCE GAP — unverified]** ${g.plugin}: ${g.title}${g.action ? ` · actionable: ${g.action}` : ''}`);
     if (b.evidenceGapsTruncated) lines.push(`- _…evidence-gap list truncated; see LOW count for totals._`);
+    // A DISTINCT badge, and the wording is load-bearing in both directions: it must not say
+    // "gap" (that is the unverified-this-scan channel, and contract-v1 forbids routing a
+    // boundary as one), and it must not be silent (surface nobody assessed is otherwise
+    // indistinguishable from surface assessed and found clean — the cardinal class here).
+    for (const d of (b.deferredScope || [])) {
+      lines.push(`- **[🔎 SCOPE NOT ASSESSED — outside this release's evidence scope, not a finding]** ${d.plugin}: ${d.title}`);
+    }
     const drill = opts.getFindingsAvailable ? ' — drill any category via get_findings' : '';
-    for (const tier of ['MEDIUM', 'LOW']) {
+    if ((b.deferredScope || []).length && opts.getFindingsAvailable) {
+      lines.push('- _Scope declarations are abridged here; read them in full via get_findings._');
+    }
+    for (const tier of ['MEDIUM', 'LOW', 'INFO']) {
       const rows = (b.rollup && b.rollup[tier]) || [];
       if (!rows.length) continue;
       const total = c[tier] || rows.reduce((n, rr) => n + rr.count, 0);