nsauditor-ai 0.2.37 → 0.2.39

package/README.md

@@ -17,23 +17,11 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Three flags, one new command, and a startup veto that stops swallowing itself (CE 0.2.37 / Enterprise 0.2.37 + 0.33.0).** Paired with Enterprise 0.33.0, and **this CE is required by it** — `compliance attest`, `--sla-policy <file>` and `--compliance-history <dir>` live here, so the Enterprise peer floor is raised to 0.2.37. `compliance attest` produces a Type II recurring-scan attestation over a directory of prior scans; the two flags reach the SLA/MTTR engine, which had been wired inside the compliance phase behind options nothing set. A startup posture preflight now refuses a configuration contradiction — `NSAUDITOR_OFFLINE_ONLY=1` together with a configured outbound path — with exit 2, at every tier and every command. And the bare `catch {}` around the Enterprise stage is split: "Enterprise is not installed" stays silent, but "Enterprise ran and threw" now names the lost stage on stderr instead of exiting 0 with no compliance report and no output. Also corrected on this frozen page: the MCP tool tables listed seven tools that are not registered and omitted two that are; WORM evidence storage was sold with a ✅ though its writer has no caller; and `--help` told operators to select plugin 1023 with `--plugins`, which cannot work — it needs a discovery plugin to confirm the host is up first.
+**Exploit intelligence lands in Pro, and a risk-score claim gets corrected here (CE 0.2.39 / Enterprise 0.34.0).** Paired with Enterprise 0.34.0 — **no CE behaviour change.** Enterprise findings that carry CVEs are now joined by CVE-ID against a local **CISA KEV** catalog and a local **FIRST EPSS** scores file, banded and ordered exploit-first, so a KEV-listed MEDIUM outranks an unexploited CRITICAL. Both stores are **operator-populated — no feed data ships** — and fail closed when stale, so an out-of-date catalog never reports "not exploited". The CE-side change is a correction this README owed you: *"a composite risk score (severity × exploitability × impact × exposure)"* described inputs the code never had. It computes **CVSS weighted by verification status, with an uplift for initial-access techniques**, and that is what it now says. `prioritize()` in the documented FindingQueue sorts by **severity rank alone** — the exploit-aware ordering is Enterprise-side. Community Edition scanning, plugins and output are unchanged.
 
-**The scan summary stops hiding its own scope limits, and a new tool ends matrix guesswork (CE 0.2.36 / Enterprise 0.32.11).** `scan_cloud`'s markdown rendered `CRITICAL · HIGH · MEDIUM · LOW · PASS` — **INFO was not a column** — so on a real AWS scan 55 of 62 INFO records appeared in no summary anywhere, several of them declarations of what was **not** assessed. INFO is now a column and rolls up by category, and scope boundaries get their own `[🔎 SCOPE NOT ASSESSED]` channel: surface nobody assessed must not read like surface assessed and found clean. **New MCP tool `compliance_matrix`** returns the shipped coverage matrix for any of the seven frameworks, derived from the framework maps at call time and failing closed rather than returning an empty one. `pdfExport` is withdrawn (registered and minted, implemented nowhere), and **every capability now ships a written description** — a bare flag name is a claim with no text behind it. `--watch` is described honestly, including the part the obvious correction got wrong: each tick writes that tick's artifacts; what is missing is any relation between them.
+**The opt-in RFC 3161 register stops understating itself (CE 0.2.38 / Enterprise 0.33.1).** Paired with Enterprise 0.33.1 — **no CE behaviour change; wording only, and it is the wording npm freezes.** Trusted timestamping is opt-in, became operator-configurable in 0.33.0, and has since been proven end to end against a real Time-Stamp Authority twice over: on the npm path, and separately from inside the published Marketplace container image. Six places in this README still told you the container leg was unverified. They now state what is true — **RFC 3161 timestamping is opt-in via `NSAUDITOR_TSA_URL`, with no default ever and an outbound call to the authority you name** — and keep the one caveat that survives: retained images at `:0.32.11` and earlier carry no `openssl` at all, so nothing here speaks for them. **Ed25519 suppression signing is unchanged and still not reachable** — the workflow ships, the signature does not, and no shipped entry point signs a suppression.
 
-**The dependency gate starts measuring what you install (CE 0.2.35 / Enterprise 0.32.10).** Paired with Enterprise 0.32.10 — **no CE behaviour change**. On the Enterprise side the advisory gate had been auditing the maintainer's working tree while calling it the production closure; it now packs the tarball, installs it the way you would, and audits **that**, and it will not report a clean result until it has proved an advisory database actually answered. The two trees shared 5 of 26 advisory packages and **zero** high-severity ones. Also: the SOC 2 matrix is enumerated in full (**10 / 4 / 37 = 51** — completeness, no control moved), and the Type II docs now say which mechanisms are reachable versus roadmap.
-
-**Internal-provenance strip + a false-clean closure (CE 0.2.34 / Enterprise 0.32.9).** Paired with Enterprise 0.32.9. The evidence pack a customer hands their auditor no longer carries internal engineering markers — **686 unexplained occurrences → 0** on a rebuilt three-cloud pack, with a positive control so the zero is a measurement rather than an absence of looking. Two behavioural fixes ride with it: a cloud plugin that returns `up:false` (optional SDK absent, credentials unusable) now fail-closes an evidence gap on every in-scope control of that cloud instead of leaving them PASS, and an archived scan conclusion re-mapped through the new build warns instead of failing clean. CE's side: the MCP `scan_cloud` summary strips **both** spellings of the evidence-gap routing prefix, so an operator pairing this CE with an older Enterprise still gets a clean one-line summary. **⚠️ If you suppress by `titlePattern` on the old violation text, re-point it — see the [Enterprise CHANGELOG](https://github.com/nsasoft/nsauditor-ai-ee/blob/main/CHANGELOG.md).**
-
-**Capability-claim honesty pass, part 2 — the air-gapped-delivery class (CE 0.2.33 / Enterprise 0.32.8).** Paired with Enterprise 0.32.8, a **documentation-and-prose release** — no detection, routing, or compliance behaviour changes. 0.32.7 withdrew six phantom capability *flags*; an audit of the air-gapped-delivery claims found the same class one layer down, in prose, across **27 sites** (distinct lines) in the three published packages. **CE fix this cycle — `--out` with a version-named directory.** `--out .../ee-0.32.8` silently wrote artifacts to the *parent* directory: the file-vs-directory check keyed on "has an extension", and `path.parse('ee-0.32.8').ext` is `'.8'`. The same shape broke `v1.2.3` and `release-2026.07`. An extension now counts as file-like only if it starts with a letter, so version-named output directories work and `--out report.json` still resolves to its parent. Found by the pre-publish smoke gate running the documented command end-to-end. **CE docs change this cycle:** the ZDE section's *"Fully air-gappable. Every feature works without internet access"* is corrected to **"Air-gappable, once configured for it"** — scanning, analysis, license verification and evidence-pack generation all run with no outbound network access, and Enterprise adds offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1` (which emits an explicit coverage gap rather than a silent clean when the local store cannot answer), but a **default** scan still attempts NVD egress unless that variable is set, and the only other outbound paths — AI enrichment and the GRC push — are opt-in and off by default. The claim that Enterprise "includes offline NVD feeds" is **WITHDRAWN**: no feed data is delivered with the product, and populating the local store is the operator's. Held by a new mutation-proven guard (`tests/capability_claim_honesty.test.mjs`) that fails the build both if the absolute claim returns **and** if the honest qualifier is deleted. On the Enterprise side the same sweep found **five** rendered runtime strings — prose that reaches the assessor-facing evidence pack — making claims the code does not support. Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED. See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
-
-**Cross-framework routing + capability-claim honesty pass (CE 0.2.32 / Enterprise 0.32.7).** Paired with Enterprise 0.32.7, a **matrix-neutral** release. The network-scan analysis agents' findings now route in **all seven compliance frameworks** — a host serving cleartext or exposing SMB previously failed the SOC 2 report and read clean in HIPAA / NIST CSF / ISO 27001 / CIS v8 / PCI / GDPR off the *same scan*; that gap is closed (48 mapping rules across the seven framework files, a mutation-proven drift guard, all coverage matrices byte-identical). And a **capability-claim honesty pass** withdraws several Pro/Enterprise capabilities that were advertised without a shipping implementation. **CE code change this cycle:** the tier-capability map (`utils/capabilities.mjs`) drops six flags — `verificationEngine`, `brandedReports`, `usageMetering`, `dockerIsolation` (no implementation) and `zdePolicyEngine`, `enterpriseCTEM` (real cores ship + are claimed in prose; no distinct engine behind the name) — in lockstep with Enterprise and both licensing repos, so `nsauditor-ai license --capabilities` and every minted license now name only capabilities that ship. `resolveCapabilities(tier)` derives from tier and ignores the JWT capability array, so **issued licenses are unaffected**. Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED. See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
-
-**Network-scan false-negative closures on the analysis agents (CE 0.2.31 / Enterprise 0.32.6).** No CE code change this cycle — a paired bump for Enterprise 0.32.6, a **matrix-neutral** false-negative-hardening release on the EE analysis-agent (network-scan) path: **cleartext transport** is now flagged where before only weak-TLS-where-TLS-exists was — a service that should be encrypted but offers no TLS at all used to read clean (→ **SOC 2 CC6.7**); **SMB-alone** exposure is now its own **HIGH** finding rather than being silenced by an `SMB && RDP` conjunction — SMB without RDP is the higher-risk case (→ **CC6.6**); and **WinRM 5985/5986 · Elasticsearch 9300 · MSRPC 135 · a new aggregate open-port-count rule** are new exposure signals (→ **CC6.6**). Routed SOC 2-first with drift-detector coverage; **SOC 2 routing only this cycle — cross-framework mappings (HIPAA §164.312(e)(1) · CIS · NIST) deferred.** Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED. See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
-
-**Marketplace registration in CLI help + report-quality / routing-integrity release (CE 0.2.30 / Enterprise 0.32.5).** CE now surfaces **AWS Marketplace license registration** in `--help` and in `nsauditor-ai license --status`, so a Marketplace buyer can find the registration step without leaving the CLI. Paired with Enterprise 0.32.5, a **matrix-neutral** report-quality release: nine API Gateway (plugin 1050) mapping rules matched zero findings — **eight were re-sourced, and the ninth (a HIPAA §164.312(c)(1) Integrity mapping) was removed on doctrine rather than repaired**, because a WAF integration that fails closed alters no ePHI. **Routing was never broken and no finding was ever missed**: correctly-sourced catch-all rules already failed the same controls, verified by ablation. The real defect was report **prose** — first-match-wins surfaced a **stale** auditor-facing rationale while the accurate per-class rationale sat unreachable. Also: six auditor-facing rationales in that API-Gateway cohort were rewritten (a **cohort fix, not a class fix** — other rationales across the framework files still carry internal-development-history wording), the JSON report artifact no longer serializes raw routing regexes or rule sources, **a genuine CI/CD false-clean was closed** (a `codebuild:ListProjects` AccessDenied was warning-only, and warnings route to zero controls, so CI/CD controls could read clean over an un-enumerated inventory — now fail-closed into the existing evidence gap), and three compliance guards were hardened (one had been suppressed by a factually false comment; another had silently become a tautology; a third adds an expected-unmapped equality table). Plugin count UNCHANGED at 28; all seven coverage matrices UNCHANGED.
-
-**RDS false-negative depth pass, part 2 (CE 0.2.29 / Enterprise 0.32.4).** No CE code change this cycle — a paired bump for Enterprise 0.32.4, a **matrix-neutral** RDS false-negative-and-report-quality depth pass on plugin 1140: **RDS Proxy client↔proxy TLS** (a proxy with `RequireTLS` off accepts cleartext client connections — a transit leg distinct from the DB-engine SSL parameter — now a fail-closed HIGH), a new **retained / cross-region-replicated automated-backup at-rest surface** (an unencrypted automated backup that survives instance/cluster deletion, invisible to the live-resource and snapshot scans, is now caught), the **Aurora cluster-member double-audit closure** (a provisioned Aurora cluster's members no longer double-report the cluster-scoped SSL / Multi-AZ settings as instance-level false positives), and a **cross-framework report-quality leak closure** (a renderer backstop strips foreign framework control-ids out of the violation prose that renders into every framework report). No new plugins, all seven coverage matrices unchanged. See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
+See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
 
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)
 
@@ -50,7 +38,7 @@ Scan → Analyze → Prioritize → Track → Act
 - **Smart result fusion** — the Result Concluder merges all plugin outputs into a normalized view with OS detection, service fingerprinting, and evidence linking
 - **Structured finding format** — all findings use a common schema with category, severity, evidence, and remediation — enabling consistent SARIF export and MCP integration
 - **AI-powered analysis** — send redacted scan results to OpenAI or Claude (your keys, your choice) for vulnerability assessments and remediation guidance
-- **Risk-scored prioritization (Pro)** — findings carry a composite risk score (severity × exploitability × impact × exposure) and a status field, and an operator suppression workflow (accepted-risk / false-positive with expiry) keeps triaged findings out of the report until they expire
+- **Risk-scored prioritization (Pro)** — findings carry a composite risk score (CVSS weighted by verification status, with an uplift for initial-access techniques) and a status field, and an operator suppression workflow (accepted-risk / false-positive with expiry) keeps triaged findings out of the report until they expire
 - **Continuous monitoring (CTEM)** — watch mode rescans on a schedule, diffs against previous results, and fires webhook alerts on changes
 - **MCP integration** — expose scanning tools to AI assistants like Claude Code via Model Context Protocol
 - **CI/CD ready** — SARIF output with `--fail-on` severity gating for pipeline integration
@@ -72,7 +60,7 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS C
   - **ISO/IEC 27001:2022** (ISO + IEC, Oct 2022; 2013 edition retired Oct 31, 2025) — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe); per-Annex-A-code mapping auditor-canonical for ISO/IEC 17021-1 certification body assessors; Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes
   - **CIS Critical Security Controls v8** (CIS, May 2021; v8.1 errata June 2024) — **17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls**; per-Safeguard mapping with the **Implementation Group cumulative discipline** (IG1=56 cyber-insurance baseline / IG2 cumulative=130 / IG3 cumulative=153); no-certification-body attestation discipline (INPUT to your CSAT / CIS-CAT Pro self-attestation, never "CIS certified"); Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (4.1/4.2/4.6)
   - **GDPR Article 32 (Security of Processing)** (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units**; **GDPR Article 32 infrastructure substrate only — NOT GDPR compliance** (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate *for* your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); **Art. 83(4) lower fine tier** (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
-- 🔐 **Evidence with a verifiable chain of custody** — SHA-256 sidecars on every artifact, verifiable offline. RFC 3161 trusted timestamps are **opt-in since EE 0.33.0** via `NSAUDITOR_TSA_URL`, require an outbound call to the authority you name, and have never been exercised against a real one. **Ed25519 suppression signing is implemented in the package but not reachable from any shipped entry point** — no first-party run signs a suppression, so do not plan around it.
+- 🔐 **Evidence with a verifiable chain of custody** — SHA-256 sidecars on every artifact, verifiable offline. RFC 3161 trusted timestamps are **opt-in since EE 0.33.0** via `NSAUDITOR_TSA_URL`, require an outbound call to the authority you name plus the `openssl` binary, and were exercised against a live Time-Stamp Authority on the npm path on 2026-08-07: the auditor procedure `openssl ts -verify` returned OK, with a one-byte-mutated copy returning FAILED as the control. The `:0.33.0` Marketplace image is proven too: on 2026-08-08 the same round-trip was driven from inside the pushed image against a real authority, verified with the image’s own `openssl`. **Retained images at `:0.32.11` and earlier carry no `openssl` at all**, so nothing here speaks for them. **Ed25519 suppression signing is implemented in the package but not reachable from any shipped entry point** — no first-party run signs a suppression, so do not plan around it.
 - 🏛️ **Zero Data Exfiltration architecture** — no scan data is collected, transmitted, or stored by Nsasoft; reports are written to your local disk. Air-gapped operation once configured for it (`NSAUDITOR_OFFLINE_ONLY=1` plus a local NVD store; a default run queries NIST's public CVE API). AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
 - 🔗 **GRC connectors — Vanta + Drata + Secureframe (Enterprise)** — map compliance findings to your GRC platform's evidence/test records and push them at **scan time** (opt-in). Suppression-aware outcome mapping (Vanta) / structured records (Drata + Secureframe), idempotent retries, rate-limit handling, token redaction, and Zero-Data-Exfiltration egress redaction. Early-access, single-workspace; live validation against production tenants is in progress. See **[GRC Connectors](#grc-connectors-vanta-drata-secureframe)** below.
 - 🗄️ **WORM posture VALIDATION** — we read your bucket's S3 Object Lock configuration per CloudTrail trail bucket and fail the control when it is absent, in GOVERNANCE mode or under-retained. That is substrate FOR a SEC Rule 17a-4(f) / FINRA 4511 retention claim, not the claim itself: the engine WRITING artifacts into the immutable store is built and **not reachable** (no caller), so the retention guarantee stays yours to make about your own archive
@@ -118,7 +106,7 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 | **GDPR Article 32 (Security of Processing)** — Art. 32 infrastructure substrate (4 covered + 5 partial + 2 OOS / 11 sub-measure units); **not GDPR compliance** · Art. 83(4) lower fine tier | — | — | ✅ |
 | Multi-framework `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr` from one scan | — | — | ✅ |
 | **Enterprise — auditor-grade evidence** | | | |
-| Evidence packs with SHA-256 chain-of-custody (RFC 3161 timestamps opt-in, unproven against a real TSA) | — | — | ✅ |
+| Evidence packs with SHA-256 chain-of-custody (RFC 3161 timestamps opt-in via `NSAUDITOR_TSA_URL`, exercised against a live TSA on both the npm path and the `:0.33.0` container image; retained images `:0.32.11` and earlier carry no `openssl`) | — | — | ✅ |
 | Suppression workflow with approver identity verification (Ed25519 SIGNING is built, not reachable) | — | — | ✅ |
 | Chain-of-custody manifests | — | — | ✅ |
 | SLA / MTTR tracking + compensating controls | — | — | ✅ |
@@ -311,7 +299,7 @@ Results land in `./out/<host>_<timestamp>/`:
 | 1220 | Azure Storage Account Data-Protection (**EE 0.13.2**) | Enterprise | Dedicated Azure Storage Account encryption / transit / authorization auditor — orthogonal to the 1022 scanner's network-exposure dims (no double-emission; mirrors the AWS 1020 + 1120 two-plugin S3 split). HTTPS-only transit (`enableHttpsTrafficOnly`) + minimum TLS version + Shared Key authorization (`allowSharedKeyAccess` — bypasses Azure AD; absent = enabled, never silent-PASS) + infrastructure (double) encryption + encryption key source incl. **customer-managed-key reachability + rotation** (`keyVaultProperties` — a disabled/revoked/version-pinned CMK degrades, not silent-PASS). Conservative classifier: indeterminate field / AccessDenied → evidence-gap; single-subscription scope surfaced explicitly. **CC6.7 / CC6.1 / C1.1** |
 | 1221 | Azure NSG Perimeter (**EE 0.14.0**; UDP lane **EE 0.14.1**) | Enterprise | The Azure analog of AWS 1170 — a CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups. Evaluates each NSG's inbound rules in Azure priority order (first match wins; DenyAllInbound default): all-protocol public Allow + public-source (`*`/`0.0.0.0/0`/`Internet`) to a restricted **TCP** management/data-tier port (SSH/RDP/MSSQL/MySQL/Postgres/Redis/Mongo/SMB/WinRM/etc.) + `::/0` IPv6-wildcard to a restricted port (the dimension 1022's flat lint misses) + **public-source / `::/0` to a restricted UDP service** (SNMP/CLDAP/NTP/rpcbind/IPMI/IKE/Memcached etc. — Dim 2u/3u, EE 0.14.1) + public→non-restricted INFO + PASS substrate. **Attachment-aware** (attached → CRITICAL effective; orphaned → MEDIUM latent) + effective priority/deny-override resolution + `0.0.0.0/1` split-range coverage. Non-overlapping-by-depth with 1022's coarse per-rule NSG lint. Conservative classifier: denied/indeterminate → evidence-gap; one malformed NSG degrades per-resource. **CC6.6** |
 | 1222 | Azure Key Vault Deep Auditor (**EE 0.15.0**) | Enterprise | The third dedicated Azure auditor (after 1220 storage + 1221 NSG) — the KV analog of how 1221 deepens 1022's flat NSG dim. Enumerates each vault's keys, role assignments, and diagnostic settings across 4 dims: (1) key **auto-rotation policy** + (2) key **expiry** (epoch-s/ms/Date/string coerced) + (3) **diagnostic logging → Log Analytics** (`@azure/arm-monitor`) + (4) **privileged-access depth** (RBAC `roleAssignments` admin/data-plane/scope-aware + legacy `accessPolicies` export/wide-crypto breadth). Orthogonal to 1022's vault-property dims (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission. Secret/cert expiry is a deliberate data-plane scope boundary. Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource. **CC6.3 / C1.1 / CC6.1 / CC7.2** |
-| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), SHA-256 chain-of-custody, opt-in RFC 3161 timestamps, and the suppression workflow. (Ed25519 SIGNING of suppressions is built but unreachable — the workflow ships, the signature does not.) |
+| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), SHA-256 chain-of-custody, opt-in RFC 3161 timestamps, exercised against a live TSA on both the npm path and the `:0.33.0` container image, and the suppression workflow. (Ed25519 SIGNING of suppressions is built and not reachable — the workflow ships, the signature does not.) |
 | — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same evidence infrastructure as SOC 2 (SHA-256 chain-of-custody; opt-in RFC 3161 timestamps; suppression signing built but not reachable). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
 | — | **NIST CSF 2.0 Compliance Engine (EE 0.10.0)** | Enterprise | NIST Cybersecurity Framework 2.0 Core mapping at the auditor-canonical Subcategory level — 13 covered + 10 partial + 83 OOS across 106 of CSF 2.0's 107 Subcategories. Govern function OOS-by-design (GV.SC-04 partial as substrate exception); Respond function OOS-entirely; Implementation Tiers 1-4 OOS as organizational-maturity claims. NIST SP 800-53 Rev. 5 + CIS Critical Security Controls v8 cross-references baked into `informativeReferences`. Use `--compliance nist-csf` or `--compliance soc2,hipaa,nist-csf` for triple-framework reports from a single scan. |
 | — | **PCI DSS v4.0.1 Compliance Engine (EE 0.11.0)** | Enterprise | PCI DSS v4.0.1 (PCI SSC, June 2024 errata; supersedes v4.0 March 2022; v3.2.1 retired March 31, 2024) mapping at the auditor-canonical sub-requirement level for QSA Report on Compliance workflow — **19 covered + 9 partial + 39 OOS across 67 of ~250 sub-requirements (MVP-67 density)** (Req 7.2.2 down-rated covered→partial in EE 0.19.4 — access-by-job-classification is process/HR-gated). Req 12 Information Security Program OOS-by-design entirely. Req 5 anti-malware + Req 9 physical OOS-entirely. **Defined-vs-Customized Approach discipline per Appendix E** — 15 Defined-only sub-requirements enforced at schema layer. **Cardholder Data Environment (CDE) scope operator-attested** via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. **Card-brand AOC enforcement priority view** (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC). **4 load-bearing schema enrichments** per control: `controlType` + `approachEligibility` + `cloudProviderAttestation` (AWS / Azure / GCP currently-named AOCs) + `cdeScope`. CAO MVP-deferred to EE 0.11.1. Use `--compliance pci-dss` or `--compliance soc2,hipaa,nist-csf,pci-dss` for quad-framework reports from a single scan. |
@@ -361,7 +349,7 @@ nsauditor-ai scan --host aws --plugins all --compliance soc2 --aws-region all
 - **Global services** (IAM, account-level S3 enumeration) are audited once regardless of `--aws-region`; the S3 auditors resolve **each bucket's own region** and skip + disclose buckets outside the scoped set (closing latent cross-region false-cleans).
 - **MCP `scan_cloud` (Claude Desktop / Claude Code):** the same scoping is a `regions` argument — *omit* it to scan the server-configured `AWS_REGION`, or pass `["all"]` (or a region-code list like `["us-east-1","eu-west-1"]`) to fan out. Omitting does **not** fan out, so a single tool-call stays within Desktop's timeout.
 
-The auditor evidence pack is emitted under `out/` — cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, the suppression workflow and approver identity verification, plus opt-in RFC 3161 trusted-timestamps (`NSAUDITOR_TSA_URL`; never run against a real authority). Ed25519 suppression SIGNING is built and not reachable. EE is available at [`www.nsauditor.com/ai/pricing`](https://www.nsauditor.com/ai/pricing).
+The auditor evidence pack is emitted under `out/` — cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, the suppression workflow and approver identity verification, plus opt-in RFC 3161 trusted-timestamps (`NSAUDITOR_TSA_URL`), exercised against a live TSA on both the npm path and the `:0.33.0` container image. Ed25519 suppression SIGNING is built and not reachable. EE is available at [`www.nsauditor.com/ai/pricing`](https://www.nsauditor.com/ai/pricing).
 
 ---
 
@@ -858,8 +846,10 @@ NSAUDITOR_OFFLINE_ONLY=1          # Exact match on '1'. Forbids outbound: CVE ma
                                   # clean. Also VETOES the two settings below — configuring an offline
                                   # posture and an outbound destination together is a startup error,
                                   # never a quiet downgrade to weaker evidence.
-NSAUDITOR_TSA_URL=                # RFC 3161 Time-Stamp Authority endpoint. NO DEFAULT, EVER — unset
-                                  # means the feature is absent, not "use a vendor default".
+NSAUDITOR_TSA_URL=                # RFC 3161 Time-Stamp Authority endpoint, opt-in. Proven against a
+                                  # live TSA on the npm path AND from inside the :0.33.0 container
+                                  # image; :0.32.11 and earlier carry no openssl. NO DEFAULT, EVER —
+                                  # unset means the feature is absent, not "use a vendor default".
 NSAUDITOR_TSA_CERT_CHAIN=         # Path to the TSA certificate chain (PEM), for offline verification
 NSAUDITOR_TSA_POLICY_OID=         # Optional policy OID to request from the TSA
 NSAUDITOR_IDENTITY_REGISTRY=      # Path to the approver identity registry JSON. Binds the humans named
@@ -869,17 +859,35 @@ NSAUDITOR_SIGNING_KEY=            # A REFERENCE, never key material: keychain:LA
                                   # (mode 0600) | awskms:alias/… — see the honesty note below.
 ```
 
-Two of these are deliberately **not** capabilities yet, and saying so here is the point:
+One of these is deliberately **not** a capability yet and the other is proven on one path only —
+saying which is which is the point:
 
 - **`NSAUDITOR_SIGNING_KEY` is groundwork, and less wired than this note used to say.** EE 0.33.0 stopped parsing it at option-resolution time — a malformed value used to abort the EE stage for a setting nothing reads — so it is now carried through unparsed; `parseSigningRef` / `resolveSigner` hold the parse and the offline veto at the point a key would be used, and no
   shipped entry point signs a suppression, so setting it changes nothing today. It exists
   now because the signature record's `algorithm` and `backend` fields had to be frozen
   *before* the first signature reaches a customer archive — retrofitting that later breaks
   every auditor holding one.
-- **`NSAUDITOR_TSA_URL` is wired but unproven.** The request is built and sent; it has
-  **never been exercised against a real Time-Stamp Authority** — every test to date injects
-  a fake, which proves the plumbing and not the capability. Treat trusted timestamping as
-  roadmap until that live check is published.
+- **`NSAUDITOR_TSA_URL` is wired, and since 2026-08-07 it is proven — on the npm path only.**
+  The live check this note used to say was outstanding has been run: through the installed
+  binary, against a real Time-Stamp Authority, the auditor procedure `openssl ts -verify`
+  returns OK on the compliance report, the scope attestation and the chain of custody; the
+  same response file checked against a one-byte-mutated copy of the artifact returns FAILED,
+  so the OK is a statement about those exact bytes and not about the command having run.
+  ⚠️ The Marketplace container is a second delivery vehicle and was a separate question,
+  because the implementation shells out to the `openssl` binary and a distroless runtime
+  does not carry one unless it was deliberately put there. **It was deliberately put there
+  for `:0.33.0`**: the image now carries the openssl CLI and libs, and a build-blocking gate
+  proves it by building a real `openssl ts -query` request through the shipped module INSIDE
+  the image before the leg is allowed to push. That check is made by RUNNING the image, never
+  by reading the Dockerfile — a negative from a broken probe reads exactly like a negative
+  from a missing binary, so the gate exits 2 rather than 1 when its own positive control
+  fails. **And the live round-trip has now been run too** (2026-08-08): the shipped signing
+  function was driven from inside the pushed `:0.33.0` image against a real authority,
+  returning a genuine `.tsr` that the image's own `openssl` verified — with a one-byte-appended
+  copy returning FAILED, so the OK is a statement about those bytes rather than about the
+  command running. Both delivery vehicles are therefore proven end to end. **The one container
+  caveat that survives is version scope:** retained images at `:0.32.11` and earlier do not
+  carry the binary at all, so nothing here speaks for them.
 
 **Security overrides:**
 
@@ -1078,7 +1086,7 @@ NSAuditor AI is built on a **Zero Data Exfiltration (ZDE)** architecture:
 - **No data processing.** Nsasoft US LLC never sees, stores, or processes your scan results.
 - **AI is opt-in.** External AI calls use your own API keys. Redaction runs locally first.
 - **License validation is offline.** JWT signature verified locally with an embedded public key.
-- **Air-gappable, once configured for it.** Scanning, analysis, license verification and evidence-pack generation all run with no outbound network access; Enterprise adds offline CVE matching from a local NVD store under `NSAUDITOR_OFFLINE_ONLY=1`, which emits an explicit coverage gap rather than a silent clean when the store cannot answer. Stated precisely because it matters operationally: a **default** scan still attempts NVD egress unless that variable is set. The other outbound paths — AI enrichment, the GRC push, the continuous-monitoring webhook, and the timestamping and signing paths on the roadmap — are opt-in and off by default; the paths that are *not* optional are the scan target itself, your own cloud provider's APIs during a cloud scan, and DNS resolution of the target. All of them are enumerated with their trigger and default state in the egress register (EE `docs/architecture.md` §14.1.1), which is generated from code and guarded in both directions — deliberately, so this sentence never again has to carry a completeness claim that prose alone cannot keep true. Populating the local NVD store is the operator's; no feed data is delivered with the product.
+- **Air-gappable, once configured for it.** Scanning, analysis, license verification and evidence-pack generation all run with no outbound network access; Enterprise adds offline CVE matching from a local NVD store under `NSAUDITOR_OFFLINE_ONLY=1`, which emits an explicit coverage gap rather than a silent clean when the store cannot answer. Stated precisely because it matters operationally: a **default** scan still attempts NVD egress unless that variable is set. The other outbound paths — AI enrichment, the GRC push, the continuous-monitoring webhook, and the timestamping and signing paths on the roadmap — are opt-in and off by default; the paths that are *not* optional are the scan target itself, your own cloud provider's APIs during a cloud scan, and DNS resolution of the target. All of them are enumerated with their trigger and default state in the egress register (EE `docs/architecture.md` §14.1.1), which is generated from code and guarded in both directions — deliberately, so this sentence never again has to carry a completeness claim that prose alone cannot keep true. Populating the local NVD store is the operator's; no feed data is delivered with the product. The prior absolute form of this bullet — *"Fully air-gappable. Every feature works without internet access (Enterprise includes offline NVD feeds)"* — is **WITHDRAWN** (CE 0.2.33): quoted here so the withdrawal record stays on this page now that release history lives in the [CHANGELOG](./CHANGELOG.md).
 
 Nsasoft US LLC is not a data processor, data controller, or business associate under any data protection regulation. You own and control all data produced by NSAuditor AI.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.37",
+  "version": "0.2.39",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,

package/plugins/port_scanner.mjs

@@ -6,6 +6,8 @@ import net from "node:net";
 import dgram from "node:dgram";
 import fsp from "node:fs/promises";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { mapLimit } from "../utils/concurrency.mjs";
 
 /* ------------------------------ helpers ------------------------------ */
 
@@ -57,16 +59,29 @@ export function parsePortsSpec(spec) {
   return out;
 }
 
-async function loadConfigPortsFromServicesJson(cwd = process.cwd()) {
-  // Supports the "array schema" used by tests:
-  // { "services": [ { port, protocol }, ... ] }
-  // and a fallback object schema: { tcp: [...], udp: [...] }
+/**
+ * ⚠️ THE PACKAGE'S OWN DATA IS FOUND RELATIVE TO THE PACKAGE, NOT TO THE CALLER.
+ *
+ * This used to default to `process.cwd()` alone, with the `catch` below swallowing the miss.
+ * A globally installed CLI runs from wherever the OPERATOR happens to be, so unless that
+ * directory contained a `config/services.json`, the default port list came back EMPTY, the
+ * early return in `run()` fired, and the scan reported `up:false` with every bucket empty —
+ * in about a millisecond, having probed nothing. Measured 2026-08-10 on the installed build:
+ * cwd=/private/tmp gave 0 rows, cwd=<package> gave 50 rows and tcpOpen [80,21,53,443,…].
+ *
+ * That is a FALSE CLEAN shipped to every npm customer: an empty sweep is indistinguishable
+ * from a host with nothing listening, and downstream every plugin gated on `tcp_open` is then
+ * skipped silently. cwd is still tried FIRST so an operator can override the port set by
+ * placing their own `config/services.json` beside them — the documented behaviour — but the
+ * package copy is the floor, and a scan can no longer fall through to nothing.
+ */
+const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+
+/** Parse ONE services.json into a port set. Never throws; an unusable file yields nothing. */
+async function readPortSet(fp) {
   const out = { tcp: [], udp: [] };
   try {
-    const fp = path.join(cwd, "config", "services.json");
-    const raw = await fsp.readFile(fp, "utf8");
-    const cfg = JSON.parse(raw);
-
+    const cfg = JSON.parse(await fsp.readFile(fp, "utf8"));
     if (Array.isArray(cfg?.services)) {
       for (const s of cfg.services) {
         const p = Number(s?.port);
@@ -79,14 +94,33 @@ async function loadConfigPortsFromServicesJson(cwd = process.cwd()) {
       if (Array.isArray(cfg?.tcp)) out.tcp.push(...cfg.tcp);
       if (Array.isArray(cfg?.udp)) out.udp.push(...cfg.udp);
     }
-  } catch {
-    // no config, ignore
-  }
+  } catch { /* unreadable or unparseable — yields nothing, and the caller falls through */ }
   out.tcp = uniqInts(out.tcp);
   out.udp = uniqInts(out.udp);
   return out;
 }
 
+/**
+ * The default port set: the caller's override if it YIELDS PORTS, otherwise the package's own.
+ *
+ * ⚠️ THE RULE IS *YIELD*, NOT *READ*, AND A REVIEW CAUGHT THE DIFFERENCE. An earlier fix tried
+ * cwd then the package and committed to the first file that READ successfully. But
+ * `config/services.json` is a common filename: a FOREIGN one in the caller's directory —
+ * another application's, or an empty/typo'd nsauditor one (`{}`, `{"services":[]}`) — parses
+ * fine, populates nothing, and the package floor was then never consulted. The scan probed
+ * ZERO ports and reported `up:false`: the same false clean as before, re-gated on a filename
+ * collision instead of a missing file. Committing on read also made that fix's own comment
+ * ("a scan can no longer fall through to nothing") untrue.
+ *
+ * A non-empty override REPLACES rather than merges — an operator narrowing the sweep on
+ * purpose must not silently get the full set back.
+ */
+async function loadConfigPortsFromServicesJson(cwd = process.cwd()) {
+  const override = await readPortSet(path.join(cwd, "config", "services.json"));
+  if (override.tcp.length || override.udp.length) return override;
+  return readPortSet(path.join(PKG_ROOT, "config", "services.json"));
+}
+
 function classifyTcpError(err) {
   const code = err?.code || "";
   const msg = err?.message || String(err) || "";
@@ -261,15 +295,31 @@ export default {
 
     const data = [];
 
+    // ⚠️ BOUNDED CONCURRENCY, NOT A SEQUENTIAL LOOP — and the reason is a measured false clean.
+    // These two loops used to `await` one port at a time. A filtered or silent port costs the
+    // FULL per-port timeout, so the shipped 50-port sweep (43 TCP + 7 UDP) took 40,977 ms
+    // against a real router on 2026-08-10 — past the 30,000 ms `PLUGIN_TIMEOUT_MS` the plugin
+    // manager races every run against. The orchestrator therefore DISCARDED a correct result
+    // (`up:true`, `tcpOpen:[80,21,53,443,...]`) that arrived eleven seconds later, and
+    // substituted an empty one.
+    //
+    // That is not slowness, it is a FALSE CLEAN: with `ctx.tcpOpen` empty, every plugin gated
+    // on `tcp_open` is skipped by `plugin_manager.mjs` with a bare `return false` — no finding,
+    // no evidence gap — so `HTTP Probe` and `Webapp Detector` never ran, and the compliance
+    // layer reported PASS controls off a scan that never probed HTTP.
+    //
+    // `mapLimit` returns results IN INPUT ORDER, so the evidence rows stay deterministic; the
+    // cap is deliberately modest because a port sweep is latency-bound, not CPU-bound, and a
+    // scanner that floods a small target is its own kind of defect.
+    const SWEEP_CONCURRENCY = toInt(process.env.PORT_SCAN_CONCURRENCY, 12);
+
     // TCP scans
-    for (const p of tcpPorts) {
-      data.push(await scanTcpPort(host, p, { timeoutMs, bannerTimeoutMs, maxBannerBytes }));
-    }
+    data.push(...await mapLimit(tcpPorts, SWEEP_CONCURRENCY, (p) =>
+      scanTcpPort(host, p, { timeoutMs, bannerTimeoutMs, maxBannerBytes })));
 
     // UDP scans
-    for (const p of udpPorts) {
-      data.push(await scanUdpPort(host, p, { timeoutMs, udpPayload }));
-    }
+    data.push(...await mapLimit(udpPorts, SWEEP_CONCURRENCY, (p) =>
+      scanUdpPort(host, p, { timeoutMs, udpPayload })));
 
     // Buckets
     const tcpOpen      = data.filter(d => d.probe_protocol === "tcp" && d.status === "open").map(d => d.probe_port);

package/utils/nvd_cache.mjs

@@ -3,12 +3,42 @@
 
 import fsp from 'node:fs/promises';
 import path from 'node:path';
+import os from 'node:os';
 
 const DEFAULT_TTL_DAYS = 7;
 const MAX_ENTRIES = 10000;
 
+/**
+ * Where the cache lives when the caller does not say.
+ *
+ * ⚠️ NOT `'.nvd_cache'`, AND THE REASON IS A MEASURED OUTAGE. That default was CWD-RELATIVE
+ * (`path.resolve` below), and `mcp_server.mjs` constructs its client with no `cacheDir` — so
+ * under the Claude Desktop MCP server, which runs from `/`, the write target was
+ * `/.nvd_cache` and `mkdir` returned EROFS. `get_vulnerabilities` was DEAD for every Desktop
+ * user (Gate 3, 2026-08-10). For CLI users it was quieter and still wrong: the cache lived
+ * wherever the operator happened to stand, so it never persisted between directories and
+ * every run re-fetched what it already had.
+ *
+ * ⚠️ SAME CLASS AS THE PORT-SCANNER FIX IN THIS SAME RELEASE (CE 0.2.39), one module over, on
+ * a WRITE path: package data and package state resolved against the CALLER's cwd under a
+ * globally installed binary. That fix addressed `config/services.json` and did not touch this
+ * — the named instance, not the class. [[guard_the_hazard_class_not_the_named_instance]]
+ *
+ * Per-user, not per-directory, and overridable by the env var an operator can point at a
+ * writable volume in a container.
+ */
+export function defaultCacheDir() {
+  const fromEnv = process.env.NSAUDITOR_NVD_CACHE_DIR;
+  if (fromEnv && String(fromEnv).trim()) return String(fromEnv).trim();
+  try {
+    const home = os.homedir();
+    if (home) return path.join(home, '.nsauditor', 'nvd_cache');
+  } catch { /* no home in this environment — fall through */ }
+  return path.join(os.tmpdir(), 'nsauditor-nvd-cache');
+}
+
 export class NvdCache {
-  constructor(cacheDir = '.nvd_cache') {
+  constructor(cacheDir = defaultCacheDir()) {
     this.cacheFile = path.resolve(cacheDir, 'nvd_cache.json');
     this.ttlMs = (Number(process.env.NVD_CACHE_TTL_DAYS) || DEFAULT_TTL_DAYS) * 86400000;
     this._data = null;
@@ -45,8 +75,23 @@ export class NvdCache {
   }
 
   async _save() {
-    await fsp.mkdir(path.dirname(this.cacheFile), { recursive: true });
-    await fsp.writeFile(this.cacheFile, JSON.stringify(this._data, null, 2), 'utf8');
+    // ⚠️ A CACHE IS AN OPTIMISATION: AN UNWRITABLE LOCATION COSTS CACHING, NEVER THE TOOL.
+    // The Desktop outage was not that the cache was unavailable — it was that an unavailable
+    // cache took `get_vulnerabilities` down with it. A read-only or hostile environment now
+    // loses persistence and keeps the feature; the in-memory `_data` still serves the run.
+    try {
+      await fsp.mkdir(path.dirname(this.cacheFile), { recursive: true });
+      await fsp.writeFile(this.cacheFile, JSON.stringify(this._data, null, 2), 'utf8');
+    } catch (err) {
+      if (!this._warnedUnwritable) {
+        this._warnedUnwritable = true;
+        // Said ONCE, and said out loud: a silently non-persisting cache is the quieter
+        // half of this very defect.
+        console.error(`[nsauditor] NVD cache not persisted (${err.code || err.message}) at ` +
+          `${path.dirname(this.cacheFile)} — continuing without caching. Set ` +
+          'NSAUDITOR_NVD_CACHE_DIR to a writable path to restore it.');
+      }
+    }
   }
 
   async get(key) {