nsauditor-ai 0.2.36 → 0.2.37

package/README.md

@@ -13,10 +13,12 @@ A modular, AI-assisted network security audit platform that scans, understands,
 
 NSAuditor AI is the open-source core of a privacy-first security intelligence platform built by [Nsasoft US LLC](https://www.nsauditor.com/ai/). It orchestrates 27 specialized scanning plugins against target hosts, fuses their results through an intelligent concluder, and optionally produces AI-powered vulnerability reports — all running entirely on your machine.
 
-**Zero Data Exfiltration by design.** NSAuditor AI works fully offline. AI analysis, CVE correlation, and continuous monitoring all happen locally. External calls (to AI APIs, NVD, etc.) are opt-in and use your own API keys. We never see your scan data.
+**Zero Data Exfiltration by design — and stated precisely.** We never see your scan data: no customer data is collected, transmitted, or stored by Nsasoft US LLC, and the product has no telemetry or phone-home endpoint. Scanning, analysis, license verification and report generation all run on your machine. Two clarifications that matter operationally: AI enrichment is **opt-in** and uses your own API keys (point it at a local Ollama and nothing leaves the host), while **CVE correlation queries NIST's public NVD API by default** — set `NSAUDITOR_OFFLINE_ONLY=1` with a local NVD store to make it fully local, which reports an explicit coverage gap instead of a silent clean.
 
 ## What's New
 
+**Three flags, one new command, and a startup veto that stops swallowing itself (CE 0.2.37 / Enterprise 0.2.37 + 0.33.0).** Paired with Enterprise 0.33.0, and **this CE is required by it** — `compliance attest`, `--sla-policy <file>` and `--compliance-history <dir>` live here, so the Enterprise peer floor is raised to 0.2.37. `compliance attest` produces a Type II recurring-scan attestation over a directory of prior scans; the two flags reach the SLA/MTTR engine, which had been wired inside the compliance phase behind options nothing set. A startup posture preflight now refuses a configuration contradiction — `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path — with exit 2, at every tier and every command. And the bare `catch {}` around the Enterprise stage is split: "Enterprise is not installed" stays silent, but "Enterprise ran and threw" now names the lost stage on stderr instead of exiting 0 with no compliance report and no output. Also corrected on this frozen page: the MCP tool tables listed seven tools that are not registered and omitted two that are; WORM evidence storage was sold with a ✅ though its writer has no caller; and `--help` told operators to select plugin 1023 with `--plugins`, which cannot work — it needs a discovery plugin to confirm the host is up first.
+
 **The scan summary stops hiding its own scope limits, and a new tool ends matrix guesswork (CE 0.2.36 / Enterprise 0.32.11).** `scan_cloud`'s markdown rendered `CRITICAL · HIGH · MEDIUM · LOW · PASS` — **INFO was not a column** — so on a real AWS scan 55 of 62 INFO records appeared in no summary anywhere, several of them declarations of what was **not** assessed. INFO is now a column and rolls up by category, and scope boundaries get their own `[🔎 SCOPE NOT ASSESSED]` channel: surface nobody assessed must not read like surface assessed and found clean. **New MCP tool `compliance_matrix`** returns the shipped coverage matrix for any of the seven frameworks, derived from the framework maps at call time and failing closed rather than returning an empty one. `pdfExport` is withdrawn (registered and minted, implemented nowhere), and **every capability now ships a written description** — a bare flag name is a claim with no text behind it. `--watch` is described honestly, including the part the obvious correction got wrong: each tick writes that tick's artifacts; what is missing is any relation between them.
 
 **The dependency gate starts measuring what you install (CE 0.2.35 / Enterprise 0.32.10).** Paired with Enterprise 0.32.10 — **no CE behaviour change**. On the Enterprise side the advisory gate had been auditing the maintainer's working tree while calling it the production closure; it now packs the tarball, installs it the way you would, and audits **that**, and it will not report a clean result until it has proved an advisory database actually answered. The two trees shared 5 of 26 advisory packages and **zero** high-severity ones. Also: the SOC 2 matrix is enumerated in full (**10 / 4 / 37 = 51** — completeness, no control moved), and the Type II docs now say which mechanisms are reachable versus roadmap.
@@ -61,7 +63,7 @@ NSAuditor AI is available in three editions: Community (free, MIT-licensed, no r
 
 If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS Controls v8, or GDPR Article 32 audit** — or need to satisfy customer security questionnaires citing those frameworks, or an IG1 attestation for cyber-insurance renewal — Enterprise turns scan output into **auditor-ready evidence packs** that pass institutional scrutiny:
 
-- ☁️ **28 cloud plugins** across AWS / Azure / GCP — find the configuration risks an auditor will flag, before they do (CloudTrail integrity, KMS custody, S3 Object Lock, IAM shadow-admin paths, GCP IAM impersonation chains, Azure RBAC sprawl, and more)
+- ☁️ **28 enterprise plugins — 27 cloud auditors across AWS / Azure / GCP, plus **`1023 Zero Trust Assessment`**, which scores zero-trust posture (segmentation, encryption-in-transit, identity, lateral-movement risk) from a **network-host** scan** — find the configuration risks an auditor will flag, before they do (CloudTrail integrity, KMS custody, S3 Object Lock, IAM shadow-admin paths, GCP IAM impersonation chains, Azure RBAC sprawl, and more)
 - 📋 **7 compliance frameworks shipped** — generate any combination from a single scan:
   - **SOC 2** (AICPA TSC 2017) — 10 fully-covered + 4 partial controls
   - **HIPAA Security Rule §164.312** — 7 covered + 3 partial Technical Safeguards; **Zero BAA required** (ePHI never leaves your infrastructure)
@@ -70,10 +72,10 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS C
   - **ISO/IEC 27001:2022** (ISO + IEC, Oct 2022; 2013 edition retired Oct 31, 2025) — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe); per-Annex-A-code mapping auditor-canonical for ISO/IEC 17021-1 certification body assessors; Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes
   - **CIS Critical Security Controls v8** (CIS, May 2021; v8.1 errata June 2024) — **17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls**; per-Safeguard mapping with the **Implementation Group cumulative discipline** (IG1=56 cyber-insurance baseline / IG2 cumulative=130 / IG3 cumulative=153); no-certification-body attestation discipline (INPUT to your CSAT / CIS-CAT Pro self-attestation, never "CIS certified"); Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (4.1/4.2/4.6)
   - **GDPR Article 32 (Security of Processing)** (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units**; **GDPR Article 32 infrastructure substrate only — NOT GDPR compliance** (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate *for* your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); **Art. 83(4) lower fine tier** (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
-- 🔐 **Cryptographically signed evidence** — SHA-256 chain-of-custody + RFC 3161 trusted timestamps + Ed25519 suppression signing. Non-repudiation, not just integrity. Auditors can verify offline.
-- 🏛️ **Zero Data Exfiltration architecture** — your scan data never leaves your infrastructure. Air-gapped deployment supported. AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
+- 🔐 **Evidence with a verifiable chain of custody** — SHA-256 sidecars on every artifact, verifiable offline. RFC 3161 trusted timestamps are **opt-in since EE 0.33.0** via `NSAUDITOR_TSA_URL`, require an outbound call to the authority you name, and have never been exercised against a real one. **Ed25519 suppression signing is implemented in the package but not reachable from any shipped entry point** — no first-party run signs a suppression, so do not plan around it.
+- 🏛️ **Zero Data Exfiltration architecture** — no scan data is collected, transmitted, or stored by Nsasoft; reports are written to your local disk. Air-gapped operation once configured for it (`NSAUDITOR_OFFLINE_ONLY=1` plus a local NVD store; a default run queries NIST's public CVE API). AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
 - 🔗 **GRC connectors — Vanta + Drata + Secureframe (Enterprise)** — map compliance findings to your GRC platform's evidence/test records and push them at **scan time** (opt-in). Suppression-aware outcome mapping (Vanta) / structured records (Drata + Secureframe), idempotent retries, rate-limit handling, token redaction, and Zero-Data-Exfiltration egress redaction. Early-access, single-workspace; live validation against production tenants is in progress. See **[GRC Connectors](#grc-connectors-vanta-drata-secureframe)** below.
-- 🗄️ **WORM evidence storage** — S3 Object Lock COMPLIANCE-mode for SEC Rule 17a-4(f) / FINRA 4511 retention compliance
+- 🗄️ **WORM posture VALIDATION** — we read your bucket's S3 Object Lock configuration per CloudTrail trail bucket and fail the control when it is absent, in GOVERNANCE mode or under-retained. That is substrate FOR a SEC Rule 17a-4(f) / FINRA 4511 retention claim, not the claim itself: the engine WRITING artifacts into the immutable store is built and **not reachable** (no caller), so the retention guarantee stays yours to make about your own archive
 - 📊 **SLA / MTTR tracking + recurring-scan attestation** — the **Type II operating-effectiveness evidence** auditors actually demand (not just point-in-time snapshots)
 - 🎯 **11 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 8-of-8 COMPLETE for all shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + CIS Controls v8 + GDPR Article 32 + GRC connector)
 
@@ -104,7 +106,7 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 | Risk scoring + prioritization | — | ✅ | ✅ |
 | Parallel analysis agents | — | ✅ | ✅ |
 | **Enterprise — cloud scanning** | | | |
-| 28 cloud plugins (AWS / Azure / GCP) | — | — | ✅ |
+| 28 enterprise plugins — 27 cloud (AWS / Azure / GCP) + 1 network-scan zero-trust check | — | — | ✅ |
 | Zero Trust assessment | — | — | ✅ |
 | **Enterprise — compliance (7 frameworks)** | | | |
 | SOC 2 (AICPA TSC 2017) — 10 covered + 4 partial controls | — | — | ✅ |
@@ -116,16 +118,16 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 | **GDPR Article 32 (Security of Processing)** — Art. 32 infrastructure substrate (4 covered + 5 partial + 2 OOS / 11 sub-measure units); **not GDPR compliance** · Art. 83(4) lower fine tier | — | — | ✅ |
 | Multi-framework `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr` from one scan | — | — | ✅ |
 | **Enterprise — auditor-grade evidence** | | | |
-| Signed evidence packs (SHA-256 + RFC 3161 timestamps) | — | — | ✅ |
-| Ed25519 suppression signing | — | — | ✅ |
+| Evidence packs with SHA-256 chain-of-custody (RFC 3161 timestamps opt-in, unproven against a real TSA) | — | — | ✅ |
+| Suppression workflow with approver identity verification (Ed25519 SIGNING is built, not reachable) | — | — | ✅ |
 | Chain-of-custody manifests | — | — | ✅ |
 | SLA / MTTR tracking + compensating controls | — | — | ✅ |
 | Recurring-scan attestation (Type II operating-effectiveness) | — | — | ✅ |
-| WORM evidence storage (S3 Object Lock — SEC 17a-4 / FINRA 4511) | — | — | ✅ |
+| WORM POSTURE VALIDATION on your own buckets (S3 Object Lock — SEC 17a-4 / FINRA 4511 substrate). The engine WRITING into the immutable store is built, **not reachable** | — | — | ✅ |
 | **Enterprise — integration + deployment** | | | |
 | GRC connectors — Vanta + Drata + Secureframe push (scan-time, opt-in) | — | — | ✅ |
-| Tabletop simulation + SIEM correlation | — | — | ✅ |
-| Air-gapped deployment | — | — | ✅ |
+| Tabletop simulation + SIEM correlation — built, **not reachable** (no caller) | — | — | 🚧 |
+| Air-gapped **operation** once installed — offline licence validation, offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`. (Air-gapped DELIVERY is WITHDRAWN: no offline installer, image bundle or feed bundle ships.) | — | — | ✅ |
 
 **This repository is the Community Edition** — fully functional, MIT-licensed, no restrictions, no telemetry. Pro and Enterprise features ship via the [`@nsasoft/nsauditor-ai-ee`](https://www.nsauditor.com/ai/pricing) package and install alongside the CE binary once licensed.
 
@@ -265,7 +267,7 @@ Results land in `./out/<host>_<timestamp>/`:
 
 ### Pro/Enterprise Plugins (via @nsasoft/nsauditor-ai-ee)
 
-**28 enterprise plugins** across AWS, GCP, and Azure substrate audits — all mapped to AICPA Trust Services Criteria 2017 (10 covered + 4 partial controls). EE plugins live in the disjoint 1000+ ID range; CE reserves 001-099. Once licensed, the EE package installs alongside the CE binary and discovers automatically.
+**28 enterprise plugins: 27 cloud auditors across AWS, GCP and Azure substrate, plus **`1023 Zero Trust Assessment`**, which scores zero-trust posture (segmentation, encryption-in-transit, identity, lateral-movement risk) from a **network-host** scan** — all mapped to AICPA Trust Services Criteria 2017 (10 covered + 4 partial controls). EE plugins live in the disjoint 1000+ ID range; CE reserves 001-099. Once licensed, the EE package installs alongside the CE binary and discovers automatically. A cloud `--host` pass auto-scopes on `cloudProvider`, which only the 27 declare, so `1023` never runs on a cloud pass. It runs on a network-host scan with the full plugin set — measured on the shipped CLI, selecting it by id on its own does not work, because it requires the host to be confirmed up by a discovery plugin.
 
 → **[Watch a sample scan run end-to-end](https://www.nsauditor.com/ai/docs/sample-scan/)** — synthetic Acme Corp AWS account + home-office router. Real real scan output, no signup required. See the transitive SG chain reachability finding, the multi-region GuardDuty audit, the dnsmasq CVE detection, and what the signed evidence pack actually looks like.
 
@@ -309,8 +311,8 @@ Results land in `./out/<host>_<timestamp>/`:
 | 1220 | Azure Storage Account Data-Protection (**EE 0.13.2**) | Enterprise | Dedicated Azure Storage Account encryption / transit / authorization auditor — orthogonal to the 1022 scanner's network-exposure dims (no double-emission; mirrors the AWS 1020 + 1120 two-plugin S3 split). HTTPS-only transit (`enableHttpsTrafficOnly`) + minimum TLS version + Shared Key authorization (`allowSharedKeyAccess` — bypasses Azure AD; absent = enabled, never silent-PASS) + infrastructure (double) encryption + encryption key source incl. **customer-managed-key reachability + rotation** (`keyVaultProperties` — a disabled/revoked/version-pinned CMK degrades, not silent-PASS). Conservative classifier: indeterminate field / AccessDenied → evidence-gap; single-subscription scope surfaced explicitly. **CC6.7 / CC6.1 / C1.1** |
 | 1221 | Azure NSG Perimeter (**EE 0.14.0**; UDP lane **EE 0.14.1**) | Enterprise | The Azure analog of AWS 1170 — a CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups. Evaluates each NSG's inbound rules in Azure priority order (first match wins; DenyAllInbound default): all-protocol public Allow + public-source (`*`/`0.0.0.0/0`/`Internet`) to a restricted **TCP** management/data-tier port (SSH/RDP/MSSQL/MySQL/Postgres/Redis/Mongo/SMB/WinRM/etc.) + `::/0` IPv6-wildcard to a restricted port (the dimension 1022's flat lint misses) + **public-source / `::/0` to a restricted UDP service** (SNMP/CLDAP/NTP/rpcbind/IPMI/IKE/Memcached etc. — Dim 2u/3u, EE 0.14.1) + public→non-restricted INFO + PASS substrate. **Attachment-aware** (attached → CRITICAL effective; orphaned → MEDIUM latent) + effective priority/deny-override resolution + `0.0.0.0/1` split-range coverage. Non-overlapping-by-depth with 1022's coarse per-rule NSG lint. Conservative classifier: denied/indeterminate → evidence-gap; one malformed NSG degrades per-resource. **CC6.6** |
 | 1222 | Azure Key Vault Deep Auditor (**EE 0.15.0**) | Enterprise | The third dedicated Azure auditor (after 1220 storage + 1221 NSG) — the KV analog of how 1221 deepens 1022's flat NSG dim. Enumerates each vault's keys, role assignments, and diagnostic settings across 4 dims: (1) key **auto-rotation policy** + (2) key **expiry** (epoch-s/ms/Date/string coerced) + (3) **diagnostic logging → Log Analytics** (`@azure/arm-monitor`) + (4) **privileged-access depth** (RBAC `roleAssignments` admin/data-plane/scope-aware + legacy `accessPolicies` export/wide-crypto breadth). Orthogonal to 1022's vault-property dims (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission. Secret/cert expiry is a deliberate data-plane scope boundary. Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource. **CC6.3 / C1.1 / CC6.1 / CC7.2** |
-| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), chain-of-custody, RFC 3161 timestamps, suppression workflow with Ed25519 signing. |
-| — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same institutional-grade evidence infrastructure as SOC 2 (chain-of-custody, RFC 3161 timestamps, Ed25519 suppression signing). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
+| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), SHA-256 chain-of-custody, opt-in RFC 3161 timestamps, and the suppression workflow. (Ed25519 SIGNING of suppressions is built but unreachable — the workflow ships, the signature does not.) |
+| — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same evidence infrastructure as SOC 2 (SHA-256 chain-of-custody; opt-in RFC 3161 timestamps; suppression signing built but not reachable). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
 | — | **NIST CSF 2.0 Compliance Engine (EE 0.10.0)** | Enterprise | NIST Cybersecurity Framework 2.0 Core mapping at the auditor-canonical Subcategory level — 13 covered + 10 partial + 83 OOS across 106 of CSF 2.0's 107 Subcategories. Govern function OOS-by-design (GV.SC-04 partial as substrate exception); Respond function OOS-entirely; Implementation Tiers 1-4 OOS as organizational-maturity claims. NIST SP 800-53 Rev. 5 + CIS Critical Security Controls v8 cross-references baked into `informativeReferences`. Use `--compliance nist-csf` or `--compliance soc2,hipaa,nist-csf` for triple-framework reports from a single scan. |
 | — | **PCI DSS v4.0.1 Compliance Engine (EE 0.11.0)** | Enterprise | PCI DSS v4.0.1 (PCI SSC, June 2024 errata; supersedes v4.0 March 2022; v3.2.1 retired March 31, 2024) mapping at the auditor-canonical sub-requirement level for QSA Report on Compliance workflow — **19 covered + 9 partial + 39 OOS across 67 of ~250 sub-requirements (MVP-67 density)** (Req 7.2.2 down-rated covered→partial in EE 0.19.4 — access-by-job-classification is process/HR-gated). Req 12 Information Security Program OOS-by-design entirely. Req 5 anti-malware + Req 9 physical OOS-entirely. **Defined-vs-Customized Approach discipline per Appendix E** — 15 Defined-only sub-requirements enforced at schema layer. **Cardholder Data Environment (CDE) scope operator-attested** via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. **Card-brand AOC enforcement priority view** (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC). **4 load-bearing schema enrichments** per control: `controlType` + `approachEligibility` + `cloudProviderAttestation` (AWS / Azure / GCP currently-named AOCs) + `cdeScope`. CAO MVP-deferred to EE 0.11.1. Use `--compliance pci-dss` or `--compliance soc2,hipaa,nist-csf,pci-dss` for quad-framework reports from a single scan. |
 | — | **ISO/IEC 27001:2022 Compliance Engine (EE 0.12.0)** | Enterprise | ISO/IEC 27001:2022 (ISO + IEC, October 2022; 2013 edition retired October 31, 2025) Annex A mapping at the auditor-canonical per-Annex-A-code level for ISO/IEC 17021-1 certification body assessors — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe across 4 themes: A.5 Organizational 37 + A.6 People 8 + A.7 Physical 14 + A.8 Technological 34). **Statement of Applicability per Clause 6.1.3.d discipline** — engine produces substrate for INCLUDED controls; SoA inclusion/exclusion is operator-side. **ISMS Clauses 4-10 OOS-by-design** with 7 Major Nonconformity classes (absence of internal audit per Clause 9.2 OR management review per Clause 9.3 = auto-fail Stage 2). 11 NEW 2022 controls + 5-attribute taxonomy (cybersecurityConcepts 5 categories, NOT 6 like NIST CSF) + 2013-to-2022 transition discipline + Cloud-Provider Certificate Inheritance Matrix. Use `--compliance iso-27001` or any combination for multi-framework reports from a single scan. |
@@ -319,7 +321,7 @@ Results land in `./out/<host>_<timestamp>/`:
 | — | SLA & MTTR Tracking | Enterprise | Per-severity SLA targets, compensating-control flow, finding lifecycle, Type II rolling-quarter cadence. |
 | — | Recurring-Scan Attestation | Enterprise | Multi-scan chronological matrix, cadence gap detection, scope-drift surface (CC8.1). |
 | — | GRC Platform Connector | Enterprise | Vanta + Drata + Secureframe connectors — scan-time push (opt-in), retry/backoff, deterministic idempotency, rate-limit handling, circuit breaker, foreign-token detection, ZDE egress redaction. See [GRC Connectors](#grc-connectors-vanta-drata-secureframe). |
-| — | WORM Evidence Storage | Enterprise | S3 Object Lock COMPLIANCE-mode + resource redaction + SHA-256 manifest. SEC 17a-4 / FINRA 4511 retention-compatible. |
+| — | WORM Posture Validation | Enterprise | Reads S3 Object Lock configuration on your trail buckets + resource redaction + SHA-256 manifest — substrate for a SEC 17a-4 / FINRA 4511 claim. The archive WRITER (`prepareArchive`) is built and **not reachable**: no caller, so no first-party run writes into an immutable store. |
 | — | Tabletop Simulation | Enterprise | Probe-event manifest + SIEM detection correlation, configurable coverage bands (Type II / High-Assurance presets). |
 
 **Running EE plugins** (after `nsauditor-ai license install <key>`):
@@ -359,7 +361,7 @@ nsauditor-ai scan --host aws --plugins all --compliance soc2 --aws-region all
 - **Global services** (IAM, account-level S3 enumeration) are audited once regardless of `--aws-region`; the S3 auditors resolve **each bucket's own region** and skip + disclose buckets outside the scoped set (closing latent cross-region false-cleans).
 - **MCP `scan_cloud` (Claude Desktop / Claude Code):** the same scoping is a `regions` argument — *omit* it to scan the server-configured `AWS_REGION`, or pass `["all"]` (or a region-code list like `["us-east-1","eu-west-1"]`) to fan out. Omitting does **not** fan out, so a single tool-call stays within Desktop's timeout.
 
-The auditor evidence pack is emitted under `out/` — cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, RFC 3161 trusted-timestamps, suppression workflow, identity verification. EE is available at [`www.nsauditor.com/ai/pricing`](https://www.nsauditor.com/ai/pricing).
+The auditor evidence pack is emitted under `out/` — cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, the suppression workflow and approver identity verification, plus opt-in RFC 3161 trusted-timestamps (`NSAUDITOR_TSA_URL`; never run against a real authority). Ed25519 suppression SIGNING is built and not reachable. EE is available at [`www.nsauditor.com/ai/pricing`](https://www.nsauditor.com/ai/pricing).
 
 ---
 
@@ -438,32 +440,32 @@ nsauditor-ai-mcp
 npx nsauditor-ai-mcp
 ```
 
-**CE Tools:**
+The server registers **seven** tools and lists all seven to every client. The licence is
+checked when a tool is CALLED, not when the list is served — so an unlicensed call returns
+an explicit 🔒 refusal naming the tier it needs, never an empty result that reads as "nothing
+found". A higher tier does not add tools; it unlocks the ones already in the list.
+
+**Available on every tier:**
 
 | Tool | Purpose |
 |---|---|
-| `scan_host` | Run full scan against a host with plugin selection |
-| `list_plugins` | List available scanner plugins with metadata |
+| `scan_host` | Run a full plugin scan against a host — service detection, OS fingerprint, structured findings |
+| `list_plugins` | List available scanner plugins with their IDs, priorities and requirements |
+| `compliance_matrix` | Return the shipped coverage matrix for a framework — Covered / Partial / Out of scope, with the per-group out-of-scope reasons. **Needs the Enterprise pack installed**: the matrices are its data, so on a Community-only install this fails closed with an install instruction rather than returning an empty matrix (an empty matrix is what gets filled in with a guess) |
 
-**Pro Tools** (requires license key + `@nsasoft/nsauditor-ai-ee`):
+**Unlocked by Pro** (licence key + `@nsasoft/nsauditor-ai-ee`):
 
 | Tool | Purpose |
 |---|---|
-| `probe_service` | Deep scan a specific port/service |
-| `get_vulnerabilities` | Query CVEs by CPE string |
-| `risk_summary` | Prioritized risk overview from last scan |
-| `scan_compare` | Diff two scan results with risk weighting |
-| `save_finding` | Save a validated finding to the finding queue (schema-checked) |
+| `probe_service` | Run one specific plugin against a single `host:port` |
+| `get_vulnerabilities` | Look up known CVEs for a CPE (Common Platform Enumeration) string via the NVD API |
 
-**Enterprise Tools** (requires Enterprise license):
+**Unlocked by Enterprise:**
 
 | Tool | Purpose |
 |---|---|
 | `scan_cloud` | Audit one or more cloud accounts (AWS / GCP / Azure) using server-configured credentials; no network host. "Audit my AWS account" / "Audit my AWS and Azure accounts". |
-| `start_assessment` | Multi-host orchestrated assessment workflow |
-| `prioritize_risks` | Cross-host risk prioritization |
-| `compliance_check` | Compliance mapping with gap analysis |
-| `export_report` | Generate formatted compliance report |
+| `get_findings` | Drill into the findings of the most recent `scan_cloud` run (per-provider session cache — not live state) |
 
 > `scan_cloud` runs the requested clouds' plugins **concurrently** (default up to 20 at once, 25s per-plugin
 > timeout) so a full multi-service cloud audit completes within Claude Desktop's ~60s tool-call limit. Tune with
@@ -819,6 +821,66 @@ NSAUDITOR_LICENSE_KEY=pro_eyJhbGci...   # Pro or Enterprise license key
 NSAUDITOR_PLUGIN_PATH=                   # Additional plugin directories (colon-separated)
 ```
 
+**Longitudinal compliance evidence (Enterprise CLI, new alongside the variables below):**
+
+A single scan shows configuration at an instant. A SOC 2 Type II auditor — and the ISO
+surveillance cadence, PCI Appendix E sampling, HIPAA §164.312(b) and GDPR Art. 32(1)(d)
+equivalents — asks whether controls operated over a *period*. Every scan has always written
+a per-framework `scan_attestation_<framework>.json`, so a history you already have is
+aggregatable today:
+
+```bash
+# Track remediation SLA / MTTR against a directory of prior scans
+nsauditor-ai scan --host aws --compliance soc2 \
+  --compliance-history ./out --sla-policy ./my-sla.json
+
+# Roll a directory of prior scans up into a multi-period attestation
+nsauditor-ai compliance attest --history ./out --framework soc2 --window 12m
+```
+
+Three things the roll-up states about itself rather than leaving you to discover:
+discovery reads **one** directory level (`<history-root>/<scan-id>/`), scans whose own
+attestation is marked `REPORT INVALID FOR AUDIT` are **counted and named** rather than
+averaged into a clean verdict, and an empty history exits **3** with status `no_evidence` —
+absence of evidence is a finding, not a pass.
+
+**Compliance evidence (`NSAUDITOR_*` — Enterprise, all opt-in):**
+
+Every variable added from Enterprise 0.33.0 onward carries the `NSAUDITOR_` prefix, so a
+deploy can tell at a glance which environment variables belong to this product. The
+unprefixed families above (`AI_*`, `OPENAI_*`, `NVD_API_KEY`, `COMPLIANCE_GRC_*`) keep
+working exactly as they do today — prefixed aliases arrive in a later minor, and a silent
+rename will never happen.
+
+```ini
+NSAUDITOR_OFFLINE_ONLY=1          # Exact match on '1'. Forbids outbound: CVE matching reads a local
+                                  # NVD store and reports an explicit coverage gap rather than a silent
+                                  # clean. Also VETOES the two settings below — configuring an offline
+                                  # posture and an outbound destination together is a startup error,
+                                  # never a quiet downgrade to weaker evidence.
+NSAUDITOR_TSA_URL=                # RFC 3161 Time-Stamp Authority endpoint. NO DEFAULT, EVER — unset
+                                  # means the feature is absent, not "use a vendor default".
+NSAUDITOR_TSA_CERT_CHAIN=         # Path to the TSA certificate chain (PEM), for offline verification
+NSAUDITOR_TSA_POLICY_OID=         # Optional policy OID to request from the TSA
+NSAUDITOR_IDENTITY_REGISTRY=      # Path to the approver identity registry JSON. Binds the humans named
+                                  # in your suppression file to identities an assessor can check.
+                                  # Template ships at data/compliance/identity_registry.json (Enterprise).
+NSAUDITOR_SIGNING_KEY=            # A REFERENCE, never key material: keychain:LABEL | /path/to/key.pem
+                                  # (mode 0600) | awskms:alias/… — see the honesty note below.
+```
+
+Two of these are deliberately **not** capabilities yet, and saying so here is the point:
+
+- **`NSAUDITOR_SIGNING_KEY` is groundwork, and less wired than this note used to say.** EE 0.33.0 stopped parsing it at option-resolution time — a malformed value used to abort the EE stage for a setting nothing reads — so it is now carried through unparsed; `parseSigningRef` / `resolveSigner` hold the parse and the offline veto at the point a key would be used, and no
+  shipped entry point signs a suppression, so setting it changes nothing today. It exists
+  now because the signature record's `algorithm` and `backend` fields had to be frozen
+  *before* the first signature reaches a customer archive — retrofitting that later breaks
+  every auditor holding one.
+- **`NSAUDITOR_TSA_URL` is wired but unproven.** The request is built and sent; it has
+  **never been exercised against a real Time-Stamp Authority** — every test to date injects
+  a fake, which proves the plumbing and not the capability. Treat trusted timestamping as
+  roadmap until that live check is published.
+
 **Security overrides:**
 
 ```ini
@@ -1016,7 +1078,7 @@ NSAuditor AI is built on a **Zero Data Exfiltration (ZDE)** architecture:
 - **No data processing.** Nsasoft US LLC never sees, stores, or processes your scan results.
 - **AI is opt-in.** External AI calls use your own API keys. Redaction runs locally first.
 - **License validation is offline.** JWT signature verified locally with an embedded public key.
-- **Air-gappable, once configured for it.** Scanning, analysis, license verification and evidence-pack generation all run with no outbound network access; Enterprise adds offline CVE matching from a local NVD store under `NSAUDITOR_OFFLINE_ONLY=1`, which emits an explicit coverage gap rather than a silent clean when the store cannot answer. Stated precisely because it matters operationally: a **default** scan still attempts NVD egress unless that variable is set, and the only other outbound paths — AI enrichment and the GRC push — are opt-in and off by default. Populating the local NVD store is the operator's; no feed data is delivered with the product.
+- **Air-gappable, once configured for it.** Scanning, analysis, license verification and evidence-pack generation all run with no outbound network access; Enterprise adds offline CVE matching from a local NVD store under `NSAUDITOR_OFFLINE_ONLY=1`, which emits an explicit coverage gap rather than a silent clean when the store cannot answer. Stated precisely because it matters operationally: a **default** scan still attempts NVD egress unless that variable is set. The other outbound paths — AI enrichment, the GRC push, the continuous-monitoring webhook, and the timestamping and signing paths on the roadmap — are opt-in and off by default; the paths that are *not* optional are the scan target itself, your own cloud provider's APIs during a cloud scan, and DNS resolution of the target. All of them are enumerated with their trigger and default state in the egress register (EE `docs/architecture.md` §14.1.1), which is generated from code and guarded in both directions — deliberately, so this sentence never again has to carry a completeness claim that prose alone cannot keep true. Populating the local NVD store is the operator's; no feed data is delivered with the product.
 
 Nsasoft US LLC is not a data processor, data controller, or business associate under any data protection regulation. You own and control all data produced by NSAuditor AI.
 

package/cli.mjs

@@ -660,6 +660,27 @@ export async function parseArgs(argv) {
   // (override-on) for this scan; `--aws-profile <name>` selects a named profile
   // from ~/.aws/credentials. Both are wired into main() via resolveScanEnv().
   // get() returns undefined (absent), true (value-less flag), or the string value.
+  // EE 0.33.0 (N2): longitudinal compliance evidence. Both are forwarded verbatim to
+  // EE, which owns every default and every validation — CE never parses or defaults
+  // them. Tri-state like `--env` and NOT the `--compliance-scope` collapse-to-null
+  // form: a value-less `--sla-policy` must be an error in main(), because silently
+  // nulling it is precisely the quiet skip this feature exists to remove.
+  // `--history` is the spelling the `compliance attest` subcommand documents and the one
+  // an operator types there; `--compliance-history` is the scan-path spelling. Both
+  // resolve to the same value because they name the same directory. Accepting only one
+  // is how a DOCUMENTED flag becomes a flag that does nothing — and that is exactly what
+  // shipped in the first draft here, caught by RUNNING the command rather than reading
+  // it. The EE guard that catches this class is scoped to /--compliance[A-Za-z-]*/, and
+  // `--history` does not match it.
+  const complianceHistoryVal = get('compliance-history') || get('compliance_history') || get('history');
+  args.complianceHistory = complianceHistoryVal === undefined ? undefined : complianceHistoryVal;
+  const slaPolicyVal = get('sla-policy') || get('sla_policy');
+  args.slaPolicy = slaPolicyVal === undefined ? undefined : slaPolicyVal;
+  const attestWindowVal = get('window');
+  args.attestWindow = (attestWindowVal && attestWindowVal !== true) ? attestWindowVal : null;
+  const frameworkVal = get('framework');
+  args.framework = (frameworkVal && frameworkVal !== true) ? frameworkVal : null;
+
   const envVal = get('env');
   args.env = envVal === undefined ? undefined : envVal; // string path, or true if value-less
   const awsProfileVal = get('aws-profile');
@@ -740,21 +761,47 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
   // AWS accounts. EE 0.3.2 + CE 0.1.30 ship as a paired release; mixing
   // versions is supported but the EE-side cloud-harvest behavior requires
   // CE-0.1.30+ to take effect.
+  // ⚠️ THE IMPORT AND THE CALL GET SEPARATE CATCHES, AND THE SPLIT IS THE POINT.
+  // A single bare `catch {}` around both made "EE is not installed" — a legitimate,
+  // expected, silent skip for every Community user — indistinguishable from "EE ran and
+  // THREW", which silently deletes the deliverable: the scan exits 0, writes no compliance
+  // report, and prints nothing. That is the false-clean shape, and it is the channel a
+  // whole class of defects has reached production through (a malformed env var did exactly
+  // this until 0.33.0 moved the parse). Absence stays silent; failure is named and the run
+  // is marked, because an operator who asked for `--compliance` and got no report must not
+  // have to diff directories to discover it.
+  let ee = null;
+  try {
+    ee = await import('@nsasoft/nsauditor-ai-ee');
+  } catch { /* EE not installed — CE proceeds unchanged. The ONLY silent case. */ }
   try {
-    const { enrichScan } = await import('@nsasoft/nsauditor-ai-ee');
-    const eeEnrichment = await enrichScan(conclusion, {
+    const eeEnrichment = ee ? await ee.enrichScan(conclusion, {
       host,
       outDir,
       compliance:      opts.compliance ?? process.env.COMPLIANCE_FRAMEWORKS ?? null,
       complianceScope: opts.complianceScope ?? null,
+      // EE 0.33.0 (N2). Forwarded verbatim; EE owns the defaults, the validation and
+      // the path-or-object handling for the policy.
+      complianceTrackSla:    opts.complianceTrackSla,
+      complianceHistoryRoot: opts.complianceHistoryRoot,
+      slaPolicy:             opts.slaPolicy,
       results,
       onWarn: (msg) => console.warn(`[EE] ${msg}`),
-    });
+    }) : null;
     if (eeEnrichment?.enrichedPrompt) {
       conclusion.result = conclusion.result || {};
       conclusion.result.eeEnrichment = eeEnrichment;
     }
-  } catch { /* EE not installed — CE proceeds unchanged */ }
+  } catch (err) {
+    // EE IS PRESENT AND FAILED. Never silent: name the stage that was lost, and mark the
+    // conclusion so a downstream reader can tell "no findings" from "the stage that finds
+    // them did not run". Still non-fatal — a scan that completed its CE work is worth
+    // keeping — but it is now a visible degradation rather than an invisible one.
+    console.error(`[EE] enrichment FAILED — this scan has no compliance report, no `
+      + `intelligence enrichment and no analysis-agent findings: ${err?.message ?? err}`);
+    conclusion.result = conclusion.result || {};
+    conclusion.result.eeEnrichmentError = String(err?.message ?? err);
+  }
 
   const { file_paths: ai_file_paths, ai_conclusion, ai_status, ai_error } = await maybeSendToOpenAI({ host, results, conclusion, promptMode, outDir });
   // BUG1 (fail-VISIBLE): a one-line end-of-scan AI status so a failed/aborted AI
@@ -902,6 +949,45 @@ function maxSeverityInConclusion(conclusion) {
  * @param {object} [opts] - { cmd, frameworks, importEE(test seam) }
  * @returns {Promise<{ran:boolean, reason?:string}>}
  */
+/**
+ * STARTUP POSTURE VETO — `NSAUDITOR_OFFLINE_ONLY=1` against a configured egress path.
+ *
+ * EE raises this as an `NsauditorConfigError` from `resolveComplianceEnvOpts`, and exports
+ * that function specifically so CE can fail fast at startup with the SAME definition of
+ * "offline". Until now nothing called it, and the veto's only route into CE was through
+ * `enrichScan` — straight into the bare `catch {}` on the scan path, which does not abort
+ * the scan: it silently drops the ENTIRE EE stage (intelligence, agents, the compliance
+ * report). A quiet skip wearing a fail-fast's name, one repo over from the test that
+ * forbids exactly that.
+ *
+ * Deliberately NOT gated on the command and NOT gated on a licence tier — a contradiction
+ * between two operator settings is a configuration error under every command, and
+ * `enrichScan` never even evaluated it below Pro tier. `tests/cli_posture_preflight.test.mjs`
+ * pins both of those as decisions rather than accidents, and explains why this exits 2 while
+ * the GRC preflight below exits 1.
+ *
+ * EE stays optional: an unresolvable EE means no EE egress paths to veto, and that is a
+ * reason, not a failure.
+ *
+ * @param {Record<string,string|undefined>} env
+ * @param {{importEE?: Function}} [opts]  `importEE` is the test seam — these cases must not
+ *   require EE to be installed, the same convention `preflightGrcIfRequested` uses.
+ * @returns {Promise<{ran: boolean, reason?: string}>}
+ * @throws the EE `NsauditorConfigError` verbatim, so main() can print it and exit 2
+ */
+export async function preflightNsauditorPosture(env, opts = {}) {
+  const { importEE } = opts;
+  let ee;
+  try {
+    ee = importEE ? await importEE() : await import('@nsasoft/nsauditor-ai-ee');
+  } catch {
+    return { ran: false, reason: 'ee-unavailable' };
+  }
+  if (typeof ee?.resolveComplianceEnvOpts !== 'function') return { ran: false, reason: 'ee-too-old' };
+  ee.resolveComplianceEnvOpts(env);
+  return { ran: true };
+}
+
 export async function preflightGrcIfRequested(env, opts = {}) {
   const { cmd, frameworks, importEE } = opts;
   if (cmd !== 'scan') return { ran: false, reason: 'not-scan' };
@@ -922,7 +1008,7 @@ export async function preflightGrcIfRequested(env, opts = {}) {
 
 export async function main() {
   const args = await parseArgs(process.argv);
-  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, awsRegion } = args;
+  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, complianceHistory, slaPolicy, attestWindow, framework, awsRegion } = args;
 
   // Version: handled before license verification so it works without a key.
   // CE-0.1.30.1 — closes the discovery-flag UX gap where pre-fix
@@ -980,6 +1066,22 @@ Scan options:
                                of soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr (aliases
                                nist/pci/iso/cis). Unknown tokens fail fast. Enterprise only.
   --compliance-scope <path>    JSON file describing the assessment scope
+  --compliance-history <dir>   Directory of prior scans (one subdirectory per scan). Turns on
+                               SLA/MTTR longitudinal tracking against that history. Enterprise.
+  --sla-policy <path>          JSON file of SLA thresholds per severity; defaults to the
+                               shipped data/compliance/sla.json. Turns SLA tracking on by
+                               itself. Relative paths resolve against the current
+                               directory. Enterprise.
+
+Compliance subcommands:
+  nsauditor-ai compliance attest --history <dir> [--framework <fw>] [--window 6m|12m|90d]
+                                        Aggregate the per-scan attestation records in
+                                        <dir> into a multi-period (Type II) recurring-scan
+                                        attestation. Reads scan_attestation_<fw>.json from
+                                        each subdirectory, so a history you already have is
+                                        aggregatable. Discovery is ONE level deep and the
+                                        report says so. Exits 3 when no evidence is found —
+                                        an empty history is a finding, not a pass.
 
 License subcommands:
   nsauditor-ai license install <KEY>    Verify and persist a license key (Keychain
@@ -1024,7 +1126,9 @@ Environment:
   NSA_ALLOW_ALL_HOSTS=1          Permit RFC1918 / loopback (local-network auditing)
   CLOUD_PROVIDER=aws|gcp|azure   Required for cloud scanner plugins (020/021/022/023/030)
   AI_PROVIDER=openai|claude|ollama   AI provider for report generation
-  COMPLIANCE_TSA_URL             RFC 3161 timestamp authority for SOC 2 attestation
+  NSAUDITOR_TSA_URL              RFC 3161 timestamp authority for compliance attestation.
+                                 No default, ever — unset means the feature is absent.
+                                 Refused at startup together with NSAUDITOR_OFFLINE_ONLY=1.
 
 Cloud-scan hosts:
   --host aws[,gcp,azure]         One or more cloud sentinel literals, comma-separated
@@ -1046,8 +1150,10 @@ Cloud-scan hosts:
                                  is safe here.
                                  Note: the composite zero-trust checker (1023) has no
                                  single cloud and is therefore skipped under this
-                                 auto-scope; to run it, select it explicitly
-                                 (--plugins 023,...) or scan a network host/CIDR.
+                                 auto-scope. It runs on a NETWORK host/CIDR scan with
+                                 the full plugin set; selecting it by id on its own
+                                 does not work, because it needs a discovery plugin to
+                                 confirm the host is up first.
                                  INVERSE (cloud scope integrity): a cloud auditor runs
                                  ONLY on its own sentinel host. On a NETWORK host (IP /
                                  CIDR / hostname) the cloud-scanner plugins NEVER run —
@@ -1116,6 +1222,17 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
   // --env load) so a bad token / control-map / provider fails fast instead of after a
   // full scan. The helper gates on the exact push condition (so a framework-less recon
   // scan / non-scan command is never hard-failed) + silently skips if EE isn't installed.
+  // Posture veto FIRST — before the GRC preflight and before any scan work. An operator who
+  // has forbidden outbound connections and also configured one must hear about it here, not
+  // from an EE stage that a bare catch would drop on the floor. Exit 2 matches
+  // `compliance attest`, the other door into the same veto.
+  try {
+    await preflightNsauditorPosture(process.env);
+  } catch (err) {
+    console.error(`Fatal: ${err.message}`);
+    process.exit(2);
+  }
+
   try {
     await preflightGrcIfRequested(process.env, { cmd, frameworks: args.compliance ?? process.env.COMPLIANCE_FRAMEWORKS });
   } catch (err) {
@@ -1996,6 +2113,55 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
     process.exit(exitCode);
   }
 
+  // ── `compliance attest` (EE 0.33.0, N2) ───────────────────────────────────
+  // Placed BEFORE the unknown-command guard, or it would be dead code that exits 2.
+  // Deliberately a THIN forward: EE owns framework validation, the offline posture
+  // veto, framework-alias resolution and every default. CE contributes the flag
+  // surface and the exit code — nothing here can drift out of sync with the engine
+  // because nothing here decides anything.
+  if (cmd === 'compliance') {
+    const sub = process.argv[3];
+    if (sub !== 'attest') {
+      console.error('Usage: nsauditor-ai compliance attest --history <dir> [--framework <fw>] [--window 6m|12m|90d]');
+      process.exit(2);
+    }
+    if (typeof complianceHistory !== 'string' || complianceHistory.length === 0) {
+      console.error('Fatal: compliance attest requires --history <dir>');
+      process.exit(2);
+    }
+    let runAttestCommand;
+    try {
+      ({ runAttestCommand } = await import('@nsasoft/nsauditor-ai-ee'));
+    } catch {
+      console.error('compliance attest requires the Enterprise package (@nsasoft/nsauditor-ai-ee).');
+      process.exit(2);
+    }
+    try {
+      const { report, files, exitCode } = await runAttestCommand({
+        // EE gates on this, exactly as it does for a compliance scan. CE resolves the
+        // tier it already resolved for `--compliance`; presenting it here rather than
+        // letting EE default keeps ONE definition of "Enterprise" across both paths.
+        capabilities: resolveCapabilities(getTierFromEnv()),
+        rootDir: complianceHistory,
+        outDir: resolveBaseOutDir(),
+        framework: framework || compliance || 'soc2',
+        window: attestWindow || '6m',
+        onWarn: (msg) => console.warn(`[EE] ${msg}`),
+      });
+      console.log(`Recurring attestation (${report.framework}): ${report.summary.scanCount} scans in window, status ${report.summary.complianceStatus}`);
+      if (report.summary.invalidForAudit > 0) {
+        console.warn(`  ${report.summary.invalidForAudit} of them are marked REPORT INVALID FOR AUDIT by their own attestation — see scansWithWarnings`);
+      }
+      for (const f of files) console.log(`  wrote ${f.path ?? f}`);
+      process.exit(exitCode);
+    } catch (err) {
+      // A posture contradiction or an unknown framework arrives here. It must NOT be
+      // swallowed: the whole point of the veto is that it stops the run loudly.
+      console.error(`Fatal: ${err.message}`);
+      process.exit(2);
+    }
+  }
+
   if (cmd !== 'scan') {
     console.error(`Unknown command: ${cmd}`);
     process.exit(2);
@@ -2024,6 +2190,30 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
   if (ports) opts.ports = ports;
   if (compliance) opts.compliance = compliance;
   if (complianceScope) opts.complianceScope = complianceScope;
+  // A value-less flag is a mistake worth stopping for: `--sla-policy` with no path
+  // would otherwise scan on and produce a report indistinguishable from one where the
+  // operator never asked for SLA tracking at all.
+  for (const [flag, val] of [['--compliance-history', complianceHistory], ['--sla-policy', slaPolicy]]) {
+    if (val === true) {
+      console.error(`Fatal: ${flag} requires a value`);
+      process.exit(2);
+    }
+  }
+  if (typeof complianceHistory === 'string' && complianceHistory.length > 0) {
+    opts.complianceHistoryRoot = complianceHistory;
+    // The history root IS the request: asking for a history and not tracking against
+    // it would be a flag that reads as doing something and does nothing.
+    opts.complianceTrackSla = true;
+  }
+  if (typeof slaPolicy === 'string' && slaPolicy.length > 0) {
+    opts.slaPolicy = slaPolicy;
+    // …and it TURNS TRACKING ON. Setting the policy alone was a byte-identical no-op:
+    // the whole SLA block is gated on complianceTrackSla, so an operator who passed
+    // --sla-policy and nothing else got a report indistinguishable from passing nothing,
+    // with no warning in either channel. A flag that reads as configuring a feature must
+    // not silently require a second flag to have any effect.
+    opts.complianceTrackSla = true;
+  }
   if (awsRegionIntent) opts.awsRegionIntent = awsRegionIntent;
   const pm = await PluginManager.create(`${__dirname}/plugins`);
   const promptMode = String(process.env.OPENAI_PROMPT_MODE || 'basic').toLowerCase().trim();

package/mcp_server.mjs

@@ -211,6 +211,29 @@ function appendCallSentinel(text, callId) {
 // Max findings per page — also referenced in the TOOLS inputSchema description below.
 const GET_FINDINGS_MAX_LIMIT = 20;   // ~500 chars/finding -> ~10KB page (Desktop 60s budget)
 
+// ---------------------------------------------------------------------------
+// FRAMEWORK_STEMS — the ONE CE-side name for the shipped compliance framework set.
+//
+// ⚠️ WHY A CE-SIDE CONSTANT AND NOT AN EE IMPORT. EE owns this set
+// (`@nsasoft/nsauditor-ai-ee/utils/framework_ids.mjs` → FRAMEWORK_STEMS) and that specifier IS
+// exported and resolvable — but EE is not a CE dependency at all: CE must load and serve its
+// tool registry with EE absent. `TOOLS` below is built at MODULE LOAD, so importing EE here
+// would make the tool REGISTRY itself conditional on an optional package, which is a strictly
+// worse failure than a stale list (no tools at all, on the customers who never buy EE).
+// The equality is therefore enforced where a hard EE dependency is allowed — at test time, by
+// tests/framework_stem_parity.test.mjs, which holds this array in TWO-WAY equality with both
+// EE's declaration and the on-disk `data/compliance/*.json` census, and which FAILS (never
+// skips) when EE is unresolvable.
+//
+// It is declared HERE, above TOOLS, because the set had drifted into FOUR transcriptions: the
+// compliance_matrix enum, the handler's validation list, this suite's own copy — and the tool
+// DESCRIPTION, which is the load-bearing one. A schema enum that goes stale REJECTS a token; a
+// description that goes stale silently steers an assistant's tool selection and errors nowhere.
+// Everything below DERIVES from this array. Do not re-type it.
+export const FRAMEWORK_STEMS = Object.freeze([
+  'soc2', 'hipaa', 'nist-csf', 'pci-dss', 'iso-27001', 'cis-v8', 'gdpr',
+]);
+
 // Exported for direct testing (the scan_cloud description is a routing surface —
 // tests pin its service-coverage enumeration + contract clauses).
 export const TOOLS = [
@@ -270,15 +293,26 @@ export const TOOLS = [
   },
   {
     name: 'compliance_matrix',
+    // ⚠️ THE FRAMEWORK LIST IN THIS DESCRIPTION IS DERIVED, NOT TYPED. It is the surface a model
+    // reads to CHOOSE a `framework` token, so a stale list here is worse than a stale enum: the
+    // enum rejects a bad token loudly, the description mis-steers tool selection silently. The
+    // GDPR scoping doctrine is kept as its OWN sentence rather than a parenthetical inside the
+    // list, so it survives any reordering of the stems (and so the list stays machine-readable
+    // for tests/framework_stem_parity.test.mjs, which compares it to the shipped JSON census).
     description:
-      'Return the SHIPPED compliance coverage matrix for a framework — how many controls are Covered, Partial and Out of Scope, with the control ids and the per-group out-of-scope reasons. Frameworks: soc2, hipaa, nist-csf, pci-dss, iso-27001, cis-v8, gdpr (GDPR is Article 32 security-of-processing substrate ONLY, never "GDPR compliance"), or "all" for the counts across every framework. ALWAYS call this tool before stating or tabulating any coverage matrix, and quote the numbers it returns verbatim. Do NOT derive a matrix from the plugin inventory, from a scan result, or from documentation — coverage is a property of the shipped framework maps, not of the plugin list, and a derived matrix will disagree with the customer\'s own report. Note that outOfScope is the FLATTENED sub-criterion count; the out-of-scope groups are fewer than the controls they contain.',
+      'Return the SHIPPED compliance coverage matrix for a framework — how many controls are Covered, Partial and Out of Scope, with the control ids and the per-group out-of-scope reasons. ' +
+      `Frameworks: ${FRAMEWORK_STEMS.join(', ')}, or "all" for the counts across every framework. ` +
+      'The gdpr map is GDPR Article 32 security-of-processing substrate ONLY, never "GDPR compliance". ' +
+      'ALWAYS call this tool before stating or tabulating any coverage matrix, and quote the numbers it returns verbatim. Do NOT derive a matrix from the plugin inventory, from a scan result, or from documentation — coverage is a property of the shipped framework maps, not of the plugin list, and a derived matrix will disagree with the customer\'s own report. Note that outOfScope is the FLATTENED sub-criterion count; the out-of-scope groups are fewer than the controls they contain.',
     inputSchema: {
       type: 'object',
       properties: {
         framework: {
           type: 'string',
-          enum: ['soc2', 'hipaa', 'nist-csf', 'pci-dss', 'iso-27001', 'cis-v8', 'gdpr', 'all'],
-          description: 'Which framework matrix to return. Omit or pass "all" for the counts across all seven.',
+          enum: [...FRAMEWORK_STEMS, 'all'],
+          // The count is DERIVED too. "across all seven" was a transcribed count standing beside
+          // a transcribed list — two things to forget on the next framework cycle instead of none.
+          description: `Which framework matrix to return. Omit or pass "all" for the counts across all ${FRAMEWORK_STEMS.length} shipped frameworks.`,
         },
       },
       required: [],
@@ -672,7 +706,11 @@ export async function handleListPlugins() {
 //   2. FAIL CLOSED. `plugin_discovery.mjs` swallows an unresolvable EE into `catch {}` so CE
 //      runs standalone, and copying that here would answer "no matrix" — which is precisely
 //      the void an assistant fills with a synthesised one.
-const FRAMEWORK_STEMS = ['soc2', 'hipaa', 'nist-csf', 'pci-dss', 'iso-27001', 'cis-v8', 'gdpr'];
+//
+// The framework set this handler validates against is the module-level FRAMEWORK_STEMS declared
+// above TOOLS — the SAME array the enum and the tool description are built from. It used to be
+// a second copy right here, which is how rule 1 was being obeyed for the NUMBERS and quietly
+// broken for the framework LIST inside the very tool built to stop transcription rot.
 
 function _defaultResolveEE() {
   // `@nsasoft/nsauditor-ai-ee/data/compliance/*.json` is NOT importable — EE's `exports` map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,