nsauditor-ai 0.2.41 → 0.2.43

package/README.md

@@ -17,13 +17,17 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**The compliance report now verifies the signatures it renders (CE 0.2.41 / Enterprise 0.36.0).** Paired with Enterprise 0.36.0 — **no CE behaviour change; the peer floor stays `>=0.2.40`, unraised, because nothing in this cycle needs new CE code.** Enterprise-side, a registry member may now carry the approver's public key beside its fingerprint, and when it does, every suppression signature in a compliance report is cryptographically checked — the Ed25519 suppression-signing capability this exercises stays **not yet proven**, its verification gate not having run against published bytes. Verdicts name the exact bytes they verified, a revoked key's bytes are still checked so signing-after-revocation becomes a cryptographic finding, and a MISSING verdict reads "not checked" rather than "failed" — a report must not accuse an operator of forgery for not having migrated. **Ed25519 suppression signing stays `not yet proven`**: this ships the code that makes the verification gate satisfiable, which is not a gate that has passed.
+**The pack-signing commands land in the CLI — reachable, not yet proven (CE 0.2.43 / Enterprise 0.38.0).** `nsauditor-ai compliance sign-pack --manifest <envelope>` signs a chain-of-custody envelope with an operator-held Ed25519 key; `compliance verify-pack` establishes authorship from it — via `--registry` (your identity registry, with revocation and validity checked **as at signing time**) or `--public-key` (which discloses in its own output that those checks did not run). Both are thin forwards: Enterprise owns every decision and refusal, CE contributes the flags and the exit code. **Verify does more than the signature** — it recomputes every `artifacts[].sha256` against disk, so a signed pack whose report was edited returns a failure with the signature still reading VERIFIED. Exit **0** verified · **1** a violation · **2** the run could not measure, and the third is never a failure. Requires the Enterprise package; an auditor can also verify offline with `openssl` and nothing of ours, because the exact signed bytes ship beside the signature. **⚠️ Also a correction affecting 0.2.42/0.37.0:** a **gzipped** KEV/EPSS store — the default shape, since FIRST distributes EPSS only as `.csv.gz` — loaded with ZERO entries, so every finding reported *no store* rather than an exploit band. Misdiagnosis and silent degradation, **not** a false security verdict: findings carried a visible no-store marker throughout. Compression is now decided by file content rather than by filename.
 
-**The suppression-approval commands land in the CLI (CE 0.2.40 / Enterprise 0.35.0).** `compliance suppress | review | renew | keygen` are new subcommands — thin forwards, the same discipline `compliance attest` established: Enterprise owns validation, defaults, the signing decision and every refusal; CE contributes flags and an exit code. `keygen` writes an approval keypair for a capability that is not yet proven — Ed25519, private half `0600` — and prints an identity-registry member to paste, refusing to overwrite an existing signing key — regenerating one makes every signature it ever produced unverifiable, and nothing reports that until an auditor checks an archived approval. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature, because the expiry and the renewal record are inside the signed payload. Ed25519 suppression signing is thereby reachable and **not yet proven** — its verification gate has not run against published bytes, so a produced signature is not yet evidence anything vouches for.
+**The `feed` commands: offline CVE data can be hand-carried (CE 0.2.42 / Enterprise 0.37.0).** `nsauditor-ai feed bundle` merges the NVD feed files you downloaded on a connected host into one portable archive; `feed import` reads one into the offline store on an isolated host — delivered as a **restricted** distribution rather than a public `npm install`, and amd64 only. The implementations are Enterprise-side (**requires `@nsasoft/nsauditor-ai-ee` >= 0.37.0**); the commands, flags and usage text are here, because this is the package with the `bin`. Optional `--kev` / `--epss` carry **your own** downloads from CISA and FIRST inside the archive, and `--extras-dir` places them on import and prints the environment lines to set — **no exploit data ships with either package**. `bundle` bundles the FEEDS YOU DOWNLOADED, never "your database": the offline store is a lossy derivation of an NVD feed and cannot be turned back into one. Import now names **why** it skipped records — about a quarter of a real NVD year file is skipped by design (withdrawn CVEs, entries with no CPE data) and a bare `skipped 9353` reads as data loss; malformed records are called out separately because those are **not** expected. ⚠️ **A bundle is integrity-checked, not authenticated** — the recorded SHA-256 detects alteration in transit but cannot establish authorship, because it travels inside the archive it covers. Also here: **`--flag=value` is now refused by name** instead of being parsed as a valueless flag with the value discarded, which made `--severity=high` run a default-severity scan and report success — a wrong answer that looked like a right one; and the **mDNS module-shape fallback was a TDZ self-reference**, so it never once fell back. **The air-gap delivery claims are earned back at this release**, with two conditions that travel with them: the dependency-complete bundle is a **restricted** distribution rather than a public install, and it is **amd64** only — no arm64 image is published.
+
+**The compliance report now verifies the signatures it renders (CE 0.2.41 / Enterprise 0.36.0).** Paired with Enterprise 0.36.0 — **no CE behaviour change; the peer floor stays `>=0.2.40`, unraised, because nothing in this cycle needs new CE code.** Enterprise-side, a registry member may now carry the approver's public key beside its fingerprint, and when it does, every suppression signature in a compliance report is cryptographically checked — the Ed25519 suppression-signing capability this exercises is **proven as of Enterprise 0.36.0**, its verification gate having run against the published bytes and passed with a tamper negative control, and verified for approvers whose registry entry carries **key material**. Verdicts name the exact bytes they verified, a revoked key's bytes are still checked so signing-after-revocation becomes a cryptographic finding, and a MISSING verdict reads "not checked" rather than "failed" — a report must not accuse an operator of forgery for not having migrated. **Ed25519 suppression signing was `not yet proven` when this shipped**: it shipped the code that made the verification gate satisfiable, and that gate then passed at Enterprise 0.36.0.
+
+**The suppression-approval commands land in the CLI (CE 0.2.40 / Enterprise 0.35.0).** `compliance suppress | review | renew | keygen` are new subcommands — thin forwards, the same discipline `compliance attest` established: Enterprise owns validation, defaults, the signing decision and every refusal; CE contributes flags and an exit code. `keygen` writes an approval keypair for a capability that was not yet proven at that release — Ed25519, private half `0600` — and prints an identity-registry member to paste, refusing to overwrite an existing signing key — regenerating one makes every signature it ever produced unverifiable, and nothing reports that until an auditor checks an archived approval. `suppress` signs the approval it writes when `NSAUDITOR_SIGNING_KEY` names a local Ed25519 key, and a malformed key fails at the command with nothing written. `renew` warns that renewing a signed approval invalidates its signature, because the expiry and the renewal record are inside the signed payload. Ed25519 suppression signing was thereby reachable and, **at that release, not yet proven** — its verification gate had not run against published bytes. It passed at Enterprise 0.36.0.
 
 **Exploit intelligence lands in Pro, and a risk-score claim gets corrected here (CE 0.2.39 / Enterprise 0.34.0).** Paired with Enterprise 0.34.0 — **no CE behaviour change.** Enterprise findings that carry CVEs are now joined by CVE-ID against a local **CISA KEV** catalog and a local **FIRST EPSS** scores file, banded and ordered exploit-first, so a KEV-listed MEDIUM outranks an unexploited CRITICAL. Both stores are **operator-populated — no feed data ships** — and fail closed when stale, so an out-of-date catalog never reports "not exploited". The CE-side change is a correction this README owed you: *"a composite risk score (severity × exploitability × impact × exposure)"* described inputs the code never had. It computes **CVSS weighted by verification status, with an uplift for initial-access techniques**, and that is what it now says. `prioritize()` in the documented FindingQueue sorts by **severity rank alone** — the exploit-aware ordering is Enterprise-side. Community Edition scanning, plugins and output are unchanged.
 
-**The opt-in RFC 3161 register stops understating itself (CE 0.2.38 / Enterprise 0.33.1).** Paired with Enterprise 0.33.1 — **no CE behaviour change; wording only, and it is the wording npm freezes.** Trusted timestamping is opt-in, became operator-configurable in 0.33.0, and has since been proven end to end against a real Time-Stamp Authority twice over: on the npm path, and separately from inside the published Marketplace container image. Six places in this README still told you the container leg was unverified. They now state what is true — **RFC 3161 timestamping is opt-in via `NSAUDITOR_TSA_URL`, with no default ever and an outbound call to the authority you name** — and keep the one caveat that survives: retained images at `:0.32.11` and earlier carry no `openssl` at all, so nothing here speaks for them. **Ed25519 suppression signing was unchanged at that release and still not reachable then** — it became reachable in EE 0.35.0 via `compliance suppress` and is **not yet proven**.
+**The opt-in RFC 3161 register stops understating itself (CE 0.2.38 / Enterprise 0.33.1).** Paired with Enterprise 0.33.1 — **no CE behaviour change; wording only, and it is the wording npm freezes.** Trusted timestamping is opt-in, became operator-configurable in 0.33.0, and has since been proven end to end against a real Time-Stamp Authority twice over: on the npm path, and separately from inside the published Marketplace container image. Six places in this README still told you the container leg was unverified. They now state what is true — **RFC 3161 timestamping is opt-in via `NSAUDITOR_TSA_URL`, with no default ever and an outbound call to the authority you name** — and keep the one caveat that survives: retained images at `:0.32.11` and earlier carry no `openssl` at all, so nothing here speaks for them. **Ed25519 suppression signing was unchanged at that release and still not reachable then** — it became reachable in EE 0.35.0 via `compliance suppress` and is **proven as of EE 0.36.0**, verified for approvers whose registry entry carries **key material**.
 
 See **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
 
@@ -64,7 +68,7 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS C
   - **ISO/IEC 27001:2022** (ISO + IEC, Oct 2022; 2013 edition retired Oct 31, 2025) — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe); per-Annex-A-code mapping auditor-canonical for ISO/IEC 17021-1 certification body assessors; Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes
   - **CIS Critical Security Controls v8** (CIS, May 2021; v8.1 errata June 2024) — **17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls**; per-Safeguard mapping with the **Implementation Group cumulative discipline** (IG1=56 cyber-insurance baseline / IG2 cumulative=130 / IG3 cumulative=153); no-certification-body attestation discipline (INPUT to your CSAT / CIS-CAT Pro self-attestation, never "CIS certified"); Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (4.1/4.2/4.6)
   - **GDPR Article 32 (Security of Processing)** (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units**; **GDPR Article 32 infrastructure substrate only — NOT GDPR compliance** (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate *for* your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); **Art. 83(4) lower fine tier** (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
-- 🔐 **Evidence with a verifiable chain of custody** — SHA-256 sidecars on every artifact, verifiable offline. RFC 3161 trusted timestamps are **opt-in since EE 0.33.0** via `NSAUDITOR_TSA_URL`, require an outbound call to the authority you name plus the `openssl` binary, and were exercised against a live Time-Stamp Authority on the npm path on 2026-08-07: the auditor procedure `openssl ts -verify` returned OK, with a one-byte-mutated copy returning FAILED as the control. The `:0.33.0` Marketplace image is proven too: on 2026-08-08 the same round-trip was driven from inside the pushed image against a real authority, verified with the image’s own `openssl`. **Retained images at `:0.32.11` and earlier carry no `openssl` at all**, so nothing here speaks for them. **Ed25519 suppression signing became reachable in EE 0.35.0 via `compliance suppress`** and is **not yet proven** — its verification gate has not run against published bytes, so do not plan around a produced signature as verified evidence.
+- 🔐 **Evidence with a verifiable chain of custody** — SHA-256 sidecars on every artifact, verifiable offline. RFC 3161 trusted timestamps are **opt-in since EE 0.33.0** via `NSAUDITOR_TSA_URL`, require an outbound call to the authority you name plus the `openssl` binary, and were exercised against a live Time-Stamp Authority on the npm path on 2026-08-07: the auditor procedure `openssl ts -verify` returned OK, with a one-byte-mutated copy returning FAILED as the control. The `:0.33.0` Marketplace image is proven too: on 2026-08-08 the same round-trip was driven from inside the pushed image against a real authority, verified with the image’s own `openssl`. **Retained images at `:0.32.11` and earlier carry no `openssl` at all**, so nothing here speaks for them. **Ed25519 suppression signing became reachable in EE 0.35.0 via `compliance suppress`** and is **proven as of EE 0.36.0 for approvers whose registry entry carries key material** — a shipped entry point signs, and a one-character length-preserving tamper makes the report render `signature FAILED verification`. A fingerprint-only registry entry reads `not checked by this report`, which records that no check ran and never that one failed.
 - 🏛️ **Zero Data Exfiltration architecture** — no scan data is collected, transmitted, or stored by Nsasoft; reports are written to your local disk. Air-gapped operation once configured for it (`NSAUDITOR_OFFLINE_ONLY=1` plus a local NVD store; a default run queries NIST's public CVE API). AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
 - 🔗 **GRC connectors — Vanta + Drata + Secureframe (Enterprise)** — map compliance findings to your GRC platform's evidence/test records and push them at **scan time** (opt-in). Suppression-aware outcome mapping (Vanta) / structured records (Drata + Secureframe), idempotent retries, rate-limit handling, token redaction, and Zero-Data-Exfiltration egress redaction. Early-access, single-workspace; live validation against production tenants is in progress. See **[GRC Connectors](#grc-connectors-vanta-drata-secureframe)** below.
 - 🗄️ **WORM posture VALIDATION** — we read your bucket's S3 Object Lock configuration per CloudTrail trail bucket and fail the control when it is absent, in GOVERNANCE mode or under-retained. That is substrate FOR a SEC Rule 17a-4(f) / FINRA 4511 retention claim, not the claim itself: the engine WRITING artifacts into the immutable store is built and **not reachable** (no caller), so the retention guarantee stays yours to make about your own archive
@@ -112,7 +116,7 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 | Multi-framework `--compliance soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr` from one scan | — | — | ✅ |
 | **Enterprise — auditor-grade evidence** | | | |
 | Evidence packs with SHA-256 chain-of-custody (RFC 3161 timestamps opt-in via `NSAUDITOR_TSA_URL`, exercised against a live TSA on both the npm path and the `:0.33.0` container image; retained images `:0.32.11` and earlier carry no `openssl`) | — | — | ✅ |
-| Suppression workflow with approver identity verification (Ed25519 SIGNING reachable 0.35.0, not yet proven) | — | — | ✅ |
+| Suppression workflow with approver identity verification (Ed25519 SIGNING reachable 0.35.0, proven 0.36.0, verified per approver holding **key material**) | — | — | ✅ |
 | Chain-of-custody manifests | — | — | ✅ |
 | SLA / MTTR tracking + compensating controls | — | — | ✅ |
 | Recurring-scan attestation (Type II operating-effectiveness) | — | — | ✅ |
@@ -120,7 +124,8 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 | **Enterprise — integration + deployment** | | | |
 | GRC connectors — Vanta + Drata + Secureframe push (scan-time, opt-in) | — | — | ✅ |
 | Tabletop simulation + SIEM correlation — built, **not reachable** (no caller) | — | — | 🚧 |
-| Air-gapped **operation** once installed — offline licence validation, offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`. (Air-gapped DELIVERY is WITHDRAWN: no offline installer, image bundle or feed bundle ships.) | — | — | ✅ |
+| Air-gapped **operation** once installed — offline licence validation (local ES256, no callback, every tier) and offline CVE matching under `NSAUDITOR_OFFLINE_ONLY=1`, which is the **Pro** intelligence engine. The `feed bundle` / `feed import` hand-carry pipeline (EE 0.37.0) moves the NVD feeds **you downloaded**; it needs the Enterprise **package** installed but is not licence-gated, so a Pro licensee can run it. | — | ✅ | ✅ |
+| Air-gapped **DELIVERY** — the dependency-complete offline installation tarball, install script and checksums (EE 0.37.0), distributed **restricted**, amd64 only. No container image bundle ships and arm64 images remain WITHDRAWN. | — | — | ✅ |
 
 **This repository is the Community Edition** — fully functional, MIT-licensed, no restrictions, no telemetry. Pro and Enterprise features ship via the [`@nsasoft/nsauditor-ai-ee`](https://www.nsauditor.com/ai/pricing) package and install alongside the CE binary once licensed.
 
@@ -262,7 +267,7 @@ Results land in `./out/<host>_<timestamp>/`:
 
 **28 enterprise plugins: 27 cloud auditors across AWS, GCP and Azure substrate, plus **`1023 Zero Trust Assessment`**, which scores zero-trust posture (segmentation, encryption-in-transit, identity, lateral-movement risk) from a **network-host** scan** — all mapped to AICPA Trust Services Criteria 2017 (10 covered + 4 partial controls). EE plugins live in the disjoint 1000+ ID range; CE reserves 001-099. Once licensed, the EE package installs alongside the CE binary and discovers automatically. A cloud `--host` pass auto-scopes on `cloudProvider`, which only the 27 declare, so `1023` never runs on a cloud pass. It runs on a network-host scan with the full plugin set — measured on the shipped CLI, selecting it by id on its own does not work, because it requires the host to be confirmed up by a discovery plugin.
 
-→ **[Watch a sample scan run end-to-end](https://www.nsauditor.com/ai/docs/sample-scan/)** — synthetic Acme Corp AWS account + home-office router. Real real scan output, no signup required. See the transitive SG chain reachability finding, the multi-region GuardDuty audit, the dnsmasq CVE detection, and what the signed evidence pack actually looks like.
+→ **[Watch a sample scan run end-to-end](https://www.nsauditor.com/ai/docs/sample-scan/)** — synthetic Acme Corp AWS account + home-office router. Real real scan output, no signup required. See the transitive SG chain reachability finding, the multi-region GuardDuty audit, the dnsmasq CVE detection, and what the evidence pack actually looks like.
 
 → **[Buy NSAuditor AI Enterprise Edition](https://www.nsauditor.com/ai/enterprise/)** · $2k / $5k / $10k+ per year · 5 / 25 / unlimited seats · onboarding call included.
 
@@ -304,8 +309,8 @@ Results land in `./out/<host>_<timestamp>/`:
 | 1220 | Azure Storage Account Data-Protection (**EE 0.13.2**) | Enterprise | Dedicated Azure Storage Account encryption / transit / authorization auditor — orthogonal to the 1022 scanner's network-exposure dims (no double-emission; mirrors the AWS 1020 + 1120 two-plugin S3 split). HTTPS-only transit (`enableHttpsTrafficOnly`) + minimum TLS version + Shared Key authorization (`allowSharedKeyAccess` — bypasses Azure AD; absent = enabled, never silent-PASS) + infrastructure (double) encryption + encryption key source incl. **customer-managed-key reachability + rotation** (`keyVaultProperties` — a disabled/revoked/version-pinned CMK degrades, not silent-PASS). Conservative classifier: indeterminate field / AccessDenied → evidence-gap; single-subscription scope surfaced explicitly. **CC6.7 / CC6.1 / C1.1** |
 | 1221 | Azure NSG Perimeter (**EE 0.14.0**; UDP lane **EE 0.14.1**) | Enterprise | The Azure analog of AWS 1170 — a CC6.6 network-segmentation perimeter auditor for Azure Network Security Groups. Evaluates each NSG's inbound rules in Azure priority order (first match wins; DenyAllInbound default): all-protocol public Allow + public-source (`*`/`0.0.0.0/0`/`Internet`) to a restricted **TCP** management/data-tier port (SSH/RDP/MSSQL/MySQL/Postgres/Redis/Mongo/SMB/WinRM/etc.) + `::/0` IPv6-wildcard to a restricted port (the dimension 1022's flat lint misses) + **public-source / `::/0` to a restricted UDP service** (SNMP/CLDAP/NTP/rpcbind/IPMI/IKE/Memcached etc. — Dim 2u/3u, EE 0.14.1) + public→non-restricted INFO + PASS substrate. **Attachment-aware** (attached → CRITICAL effective; orphaned → MEDIUM latent) + effective priority/deny-override resolution + `0.0.0.0/1` split-range coverage. Non-overlapping-by-depth with 1022's coarse per-rule NSG lint. Conservative classifier: denied/indeterminate → evidence-gap; one malformed NSG degrades per-resource. **CC6.6** |
 | 1222 | Azure Key Vault Deep Auditor (**EE 0.15.0**) | Enterprise | The third dedicated Azure auditor (after 1220 storage + 1221 NSG) — the KV analog of how 1221 deepens 1022's flat NSG dim. Enumerates each vault's keys, role assignments, and diagnostic settings across 4 dims: (1) key **auto-rotation policy** + (2) key **expiry** (epoch-s/ms/Date/string coerced) + (3) **diagnostic logging → Log Analytics** (`@azure/arm-monitor`) + (4) **privileged-access depth** (RBAC `roleAssignments` admin/data-plane/scope-aware + legacy `accessPolicies` export/wide-crypto breadth). Orthogonal to 1022's vault-property dims (purge/soft-delete/network-ACL/RBAC-mode) — no double-emission. Secret/cert expiry is a deliberate data-plane scope boundary. Conservative classifier: indeterminate field / AccessDenied / arm-monitor absent → evidence-gap; one malformed vault degrades per-resource. **CC6.3 / C1.1 / CC6.1 / CC7.2** |
-| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), SHA-256 chain-of-custody, opt-in RFC 3161 timestamps, exercised against a live TSA on both the npm path and the `:0.33.0` container image, and the suppression workflow. (Ed25519 SIGNING of suppressions is reachable from EE 0.35.0 and not yet proven — the gate has not run against published bytes.) |
-| — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same evidence infrastructure as SOC 2 (SHA-256 chain-of-custody; opt-in RFC 3161 timestamps; suppression signing reachable from EE 0.35.0 but not yet proven). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
+| — | SOC 2 Compliance Engine | Enterprise | AICPA TSC 2017 mapping (10 covered + 4 partial controls), SHA-256 chain-of-custody, opt-in RFC 3161 timestamps, exercised against a live TSA on both the npm path and the `:0.33.0` container image, and the suppression workflow. (Ed25519 SIGNING of suppressions is reachable from EE 0.35.0 and PROVEN at EE 0.36.0, verified per approver holding **key material**.) |
+| — | **HIPAA Compliance Engine (EE 0.9.0)** | Enterprise | HIPAA Security Rule §164.312 Technical Safeguards mapping (7 covered + 3 partial + 45 OOS within §164.312 + entire §164.308 + entire §164.310). HHS Required/Addressable discipline per control. Same evidence infrastructure as SOC 2 (SHA-256 chain-of-custody; opt-in RFC 3161 timestamps; suppression signing reachable from EE 0.35.0, proven at EE 0.36.0 and verified per approver holding **key material**). Use `--compliance hipaa` or `--compliance soc2,hipaa` for dual-framework reports from a single scan. **Zero BAA required** — Zero Data Exfiltration architecture means ePHI never leaves customer infrastructure. |
 | — | **NIST CSF 2.0 Compliance Engine (EE 0.10.0)** | Enterprise | NIST Cybersecurity Framework 2.0 Core mapping at the auditor-canonical Subcategory level — 13 covered + 10 partial + 83 OOS across 106 of CSF 2.0's 107 Subcategories. Govern function OOS-by-design (GV.SC-04 partial as substrate exception); Respond function OOS-entirely; Implementation Tiers 1-4 OOS as organizational-maturity claims. NIST SP 800-53 Rev. 5 + CIS Critical Security Controls v8 cross-references baked into `informativeReferences`. Use `--compliance nist-csf` or `--compliance soc2,hipaa,nist-csf` for triple-framework reports from a single scan. |
 | — | **PCI DSS v4.0.1 Compliance Engine (EE 0.11.0)** | Enterprise | PCI DSS v4.0.1 (PCI SSC, June 2024 errata; supersedes v4.0 March 2022; v3.2.1 retired March 31, 2024) mapping at the auditor-canonical sub-requirement level for QSA Report on Compliance workflow — **19 covered + 9 partial + 39 OOS across 67 of ~250 sub-requirements (MVP-67 density)** (Req 7.2.2 down-rated covered→partial in EE 0.19.4 — access-by-job-classification is process/HR-gated). Req 12 Information Security Program OOS-by-design entirely. Req 5 anti-malware + Req 9 physical OOS-entirely. **Defined-vs-Customized Approach discipline per Appendix E** — 15 Defined-only sub-requirements enforced at schema layer. **Cardholder Data Environment (CDE) scope operator-attested** via CDE Data Flow Diagram per Req 1.2.4 + Req 12.5.1. **Card-brand AOC enforcement priority view** (Visa CISP / Mastercard SDP / Amex DSOP / Discover DISC). **4 load-bearing schema enrichments** per control: `controlType` + `approachEligibility` + `cloudProviderAttestation` (AWS / Azure / GCP currently-named AOCs) + `cdeScope`. CAO MVP-deferred to EE 0.11.1. Use `--compliance pci-dss` or `--compliance soc2,hipaa,nist-csf,pci-dss` for quad-framework reports from a single scan. |
 | — | **ISO/IEC 27001:2022 Compliance Engine (EE 0.12.0)** | Enterprise | ISO/IEC 27001:2022 (ISO + IEC, October 2022; 2013 edition retired October 31, 2025) Annex A mapping at the auditor-canonical per-Annex-A-code level for ISO/IEC 17021-1 certification body assessors — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe across 4 themes: A.5 Organizational 37 + A.6 People 8 + A.7 Physical 14 + A.8 Technological 34). **Statement of Applicability per Clause 6.1.3.d discipline** — engine produces substrate for INCLUDED controls; SoA inclusion/exclusion is operator-side. **ISMS Clauses 4-10 OOS-by-design** with 7 Major Nonconformity classes (absence of internal audit per Clause 9.2 OR management review per Clause 9.3 = auto-fail Stage 2). 11 NEW 2022 controls + 5-attribute taxonomy (cybersecurityConcepts 5 categories, NOT 6 like NIST CSF) + 2013-to-2022 transition discipline + Cloud-Provider Certificate Inheritance Matrix. Use `--compliance iso-27001` or any combination for multi-framework reports from a single scan. |
@@ -354,7 +359,7 @@ nsauditor-ai scan --host aws --plugins all --compliance soc2 --aws-region all
 - **Global services** (IAM, account-level S3 enumeration) are audited once regardless of `--aws-region`; the S3 auditors resolve **each bucket's own region** and skip + disclose buckets outside the scoped set (closing latent cross-region false-cleans).
 - **MCP `scan_cloud` (Claude Desktop / Claude Code):** the same scoping is a `regions` argument — *omit* it to scan the server-configured `AWS_REGION`, or pass `["all"]` (or a region-code list like `["us-east-1","eu-west-1"]`) to fan out. Omitting does **not** fan out, so a single tool-call stays within Desktop's timeout.
 
-The auditor evidence pack is emitted under `out/` — cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, the suppression workflow and approver identity verification, plus opt-in RFC 3161 trusted-timestamps (`NSAUDITOR_TSA_URL`), exercised against a live TSA on both the npm path and the `:0.33.0` container image. Ed25519 suppression SIGNING is built and not reachable. EE is available at [`www.nsauditor.com/ai/pricing`](https://www.nsauditor.com/ai/pricing).
+The auditor evidence pack is emitted under `out/` — cover-page Scope Attestation, SHA-256 chain-of-custody sidecars, the suppression workflow and approver identity verification, plus opt-in RFC 3161 trusted-timestamps (`NSAUDITOR_TSA_URL`), exercised against a live TSA on both the npm path and the `:0.33.0` container image. Ed25519 suppression SIGNING is reachable from EE 0.35.0 and PROVEN at EE 0.36.0, verified per approver holding **key material**. EE is available at [`www.nsauditor.com/ai/pricing`](https://www.nsauditor.com/ai/pricing).
 
 ---
 
@@ -675,6 +680,10 @@ nsauditor-ai license install <KEY>
 nsauditor-ai license <--status | --capabilities | --plugins>
 nsauditor-ai security <set|delete|list|get> <KEY>
 nsauditor-ai validate
+nsauditor-ai feed bundle --from <dir-of-NVD-feeds> --out <bundle.json.gz> [--kev <f>] [--epss <f>]
+nsauditor-ai feed import --file <feed-or-bundle> [--cache-dir <d>] [--extras-dir <d>]   # the feeds you downloaded
+nsauditor-ai compliance <attest|suppress|review|renew|keygen>   (Enterprise)
+nsauditor-ai mcp
 nsauditor-ai --help        (or -h, or `help`)
 nsauditor-ai --version     (or -v, or `version`)
 ```
@@ -846,7 +855,7 @@ explanatory message if it is absent. CLI-only; the MCP surface does not reach th
 # (pass --email/--role/--team too, or the member prints REPLACE ME placeholders)
 nsauditor-ai compliance keygen --key ~/.nsauditor/approver.pem --approver "Ann Approver"
 
-# Record an approval; SIGNS it when NSAUDITOR_SIGNING_KEY names a local Ed25519 key (not yet proven)
+# Record an approval; SIGNS it when NSAUDITOR_SIGNING_KEY names a local Ed25519 key (verified per approver holding key material)
 NSAUDITOR_SIGNING_KEY=~/.nsauditor/approver.pem \
 nsauditor-ai compliance suppress --suppressions ./out/suppressions.json \
   --source auth_agent --title-pattern "SSH password authentication enabled" \
@@ -869,8 +878,12 @@ auditor checks an archived approval); a malformed signing key fails the command
 it warns loudly and tells you to re-approve.
 
 ⚠️ **`--flag=value` is not supported**, here or on any flag this CLI has: use `--flag value`.
-Ed25519 suppression signing is reachable from Enterprise 0.35.0 and **not yet proven** — its
-verification gate has not run against published bytes.
+Ed25519 suppression signing is reachable from Enterprise 0.35.0, and **proven at 0.36.0 for approvers whose registry entry carries key material**.
+Its verification gate ran against the published bytes and passed, tamper negative control included.
+A fingerprint-only registry entry reads `not checked by this report`, which records that no check
+ran and never that one failed.
+Verification runs for approvers whose registry entry carries key material; a fingerprint-only entry
+reads `not checked by this report`, which records that no check ran and never that one failed.
 
 **Compliance evidence (`NSAUDITOR_*` — Enterprise, all opt-in):**
 
@@ -899,15 +912,15 @@ NSAUDITOR_SIGNING_KEY=            # A REFERENCE, never key material: keychain:LA
                                   # (mode 0600) | awskms:alias/… — see the honesty note below.
 ```
 
-One of these is deliberately **not** a capability yet and the other is proven on one path only —
-saying which is which is the point:
+Both of these are capabilities now, and each was proven later than it was wired — saying exactly
+when, on which delivery vehicle, and for whom is the point:
 
-- **`NSAUDITOR_SIGNING_KEY` is CONSUMED from EE 0.35.0, and the note below used to say otherwise.** EE 0.33.0 stopped parsing it at option-resolution time — a malformed value used to abort the EE stage for a setting nothing read — so it is carried through unparsed; `parseSigningRef` / `resolveSigner` hold the parse and the offline veto at the point a key is used. As of EE 0.35.0 `compliance suppress` signs the approval it writes when this variable names a local Ed25519 key — a capability that is **not yet proven**, because its verification gate has
-  not run against published bytes, so a produced signature is not yet evidence anything vouches
-  for. The record's `algorithm` and `backend` fields were frozen *before* the first
+- **`NSAUDITOR_SIGNING_KEY` is CONSUMED from EE 0.35.0, and the note below used to say otherwise.** EE 0.33.0 stopped parsing it at option-resolution time — a malformed value used to abort the EE stage for a setting nothing read — so it is carried through unparsed; `parseSigningRef` / `resolveSigner` hold the parse and the offline veto at the point a key is used. As of EE 0.35.0 `compliance suppress` signs the approval it writes when this variable names a local Ed25519 key — proven as of EE 0.36.0 and verified per approver holding key material.
+  Its verification gate ran against the published bytes and passed, so a produced signature IS
+  evidence for those approvers; a fingerprint-only registry entry reads `not checked by this report`. The record's `algorithm` and `backend` fields were frozen *before* the first
   signature could reach a customer archive, because retrofitting that later breaks every
   auditor holding one.
-- **`NSAUDITOR_TSA_URL` is wired, and since 2026-08-07 it is proven — on the npm path only.**
+- **`NSAUDITOR_TSA_URL` is wired, and it is proven on both delivery vehicles — the npm path on 2026-08-07, and from inside the `:0.33.0` container image on 2026-08-08.**
   The live check this note used to say was outstanding has been run: through the installed
   binary, against a real Time-Stamp Authority, the auditor procedure `openssl ts -verify`
   returns OK on the compliance report, the scope attestation and the chain of custody; the
@@ -1126,7 +1139,7 @@ NSAuditor AI is built on a **Zero Data Exfiltration (ZDE)** architecture:
 - **No data processing.** Nsasoft US LLC never sees, stores, or processes your scan results.
 - **AI is opt-in.** External AI calls use your own API keys. Redaction runs locally first.
 - **License validation is offline.** JWT signature verified locally with an embedded public key.
-- **Air-gappable, once configured for it.** Scanning, analysis, license verification and evidence-pack generation all run with no outbound network access; Enterprise adds offline CVE matching from a local NVD store under `NSAUDITOR_OFFLINE_ONLY=1`, which emits an explicit coverage gap rather than a silent clean when the store cannot answer. Stated precisely because it matters operationally: a **default** scan still attempts NVD egress unless that variable is set. The other outbound paths — AI enrichment, the GRC push, the continuous-monitoring webhook, and the timestamping and signing paths on the roadmap — are opt-in and off by default; the paths that are *not* optional are the scan target itself, your own cloud provider's APIs during a cloud scan, and DNS resolution of the target. All of them are enumerated with their trigger and default state in the egress register (EE `docs/architecture.md` §14.1.1), which is generated from code and guarded in both directions — deliberately, so this sentence never again has to carry a completeness claim that prose alone cannot keep true. Populating the local NVD store is the operator's; no feed data is delivered with the product. The prior absolute form of this bullet — *"Fully air-gappable. Every feature works without internet access (Enterprise includes offline NVD feeds)"* — is **WITHDRAWN** (CE 0.2.33): quoted here so the withdrawal record stays on this page now that release history lives in the [CHANGELOG](./CHANGELOG.md).
+- **Air-gappable, once configured for it.** Scanning, analysis, license verification and evidence-pack generation all run with no outbound network access; Enterprise adds offline CVE matching from a local NVD store under `NSAUDITOR_OFFLINE_ONLY=1`, which emits an explicit coverage gap rather than a silent clean when the store cannot answer. Stated precisely because it matters operationally: a **default** scan still attempts NVD egress unless that variable is set. The other outbound paths — AI enrichment, the GRC push, the continuous-monitoring webhook, the opt-in RFC 3161 timestamping path (`NSAUDITOR_TSA_URL`, no default ever), and the AWS KMS signing path that ships but is not yet wired — are opt-in and off by default; the paths that are *not* optional are the scan target itself, your own cloud provider's APIs during a cloud scan, and DNS resolution of the target. All of them are enumerated with their trigger and default state in the egress register (EE `docs/architecture.md` §14.1.1), which is generated from code and guarded in both directions — deliberately, so this sentence never again has to carry a completeness claim that prose alone cannot keep true. Populating the local NVD store is the operator's; no feed data is delivered with the product. The prior absolute form of this bullet — *"Fully air-gappable. Every feature works without internet access (Enterprise includes offline NVD feeds)"* — is **WITHDRAWN** (CE 0.2.33): quoted here so the withdrawal record stays on this page now that release history lives in the [CHANGELOG](./CHANGELOG.md).
 
 Nsasoft US LLC is not a data processor, data controller, or business associate under any data protection regulation. You own and control all data produced by NSAuditor AI.
 

package/cli.mjs

@@ -603,6 +603,40 @@ export async function parseArgs(argv) {
   }
   if (a.length && !a[0].startsWith('--')) args.cmd = a[0];
 
+  // ⚠️ REFUSE `--flag=value` LOUDLY RATHER THAN IGNORING IT SILENTLY.
+  //
+  // `get()` below is an exact-token `indexOf('--' + name)`, so `--plugins=port_scanner` is a
+  // DIFFERENT token and returns undefined. The consequences were not uniformly loud, which is
+  // what made this worth a refusal rather than a note: `--host=1.2.3.4` yields undefined and the
+  // CLI refuses because a missing host is checked, but `--plugins=port_scanner` fell through to
+  // the `all` default and ran EVERY plugin against whatever the operator was scanning — a
+  // materially different scan than they asked for, and one they cannot see.
+  //
+  // Measured before adding this: ZERO documented `=` usages anywhere in either repo. The shape
+  // never worked, so nothing can depend on it, and refusing costs no working invocation.
+  //
+  // ⚠️ THIS IS A REFUSAL, NOT SUPPORT. Full `=` parsing touches every flag and every test that
+  // depends on current parsing; it is its own lane. A loud refusal is strictly better than silent
+  // divergence for every operator typing `=` today, and it leaves that lane a clean starting state.
+  {
+    const eqFlag = a.find((t) => typeof t === 'string' && /^--[a-z0-9][a-z0-9-]*=/i.test(t));
+    if (eqFlag) {
+      const [name, ...rest] = eqFlag.slice(2).split('=');
+      // ⚠️ THROW, DO NOT `process.exit()` — and this was learned the hard way ONE HOUR AFTER
+      // finding the same shape elsewhere. The first version called `process.exit(2)` here,
+      // matching the webhook-rejection precedent a few lines below. `parseArgs` is EXPORTED and
+      // called in-process by the test suite, so that exit killed the runner mid-file:
+      // `cli_approval_surface.test.mjs` reported `tests 1 · pass 0` — a count of the FILE, with
+      // every other case in it silently not running. An exported function that can kill its
+      // caller's process is untestable by construction. The entry point below maps this code to
+      // exit 2, so the operator-facing contract is unchanged.
+      const err = new Error(`${eqFlag}: the --flag=value form is not supported. `
+        + `Use a space: --${name} ${rest.join('=') || '<value>'}`);
+      err.code = 'EFLAGSHAPE';
+      throw err;
+    }
+  }
+
   const get = (name) => {
     const i = a.indexOf(`--${name}`);
     if (i === -1) return undefined;
@@ -681,9 +715,39 @@ export async function parseArgs(argv) {
 
   // ── the approval surface (EE 0.35.0) ────────────────────────────────────────
   // Parsed HERE with every other flag rather than read from `process.argv` in the
-  // subcommand, so one parser owns the `--flag value` / `--flag=value` / boolean
-  // shapes. `attest` taught this: a second parser is a second set of edge cases.
+  // subcommand, so ONE parser owns the flag shapes. `attest` taught this: a second parser is a
+  // second set of edge cases.
+  //
+  // ⚠️ CORRECTED 2026-08-15 — THIS COMMENT USED TO CLAIM THE PARSER OWNS THE `--flag=value` SHAPE.
+  // It does not, and never has: `get()` is an exact-token `indexOf('--' + name)`, so `--flag=value`
+  // is a DIFFERENT token and returns undefined. Measured: `--suppressions=/tmp/s.json` -> null,
+  // while `--suppressions /tmp/s.json` -> "/tmp/s.json". The documented intent was right and the
+  // code did the other thing, with nothing comparing them.
+  // Consequences differ per flag and are NOT uniformly loud: `--host=1.2.3.4` yields undefined and
+  // the CLI refuses ("Fatal: --host or --host-file is required"), but `--plugins=port_scanner`
+  // falls through to the `all` default and SILENTLY runs every plugin instead of the one asked for.
+  // Adding `=` support is a CLI-wide change touching every flag and belongs in its own measured
+  // commit, not smuggled in beside a feature — boarded rather than done here.
   const str = (name) => { const v = get(name); return (v && v !== true) ? v : null; };
+  // F1 air-gapped delivery: the hand-carry feed pipeline's flags. Parsed HERE for the same
+  // reason `approvalArgs` is — a second parser is a second set of edge cases, and the approval
+  // surface already paid for that with a ReferenceError on its first real invocation.
+  args.feedArgs = {
+    from: str('from'),
+    out: str('out'),
+    file: str('file'),
+    cacheDir: str('cache-dir') ?? str('cache_dir'),
+    // Boolean: present means true. NOT defaulted to true — an accumulating default means a
+    // re-import never REPLACES, so a store the operator believes they refreshed silently keeps
+    // every stale record it ever held.
+    append: get('append') === true || str('append') === 'true',
+    // D-95.3: the operator's OWN exploit-intelligence downloads ride the archive. The product
+    // ships no KEV/EPSS data of its own; in an air-gapped enclave there is no other way to get it
+    // across. `--extras-dir` is where import PLACES them, and the env lines are printed after.
+    kev: str('kev'),
+    epss: str('epss'),
+    extrasDir: str('extras-dir') ?? str('extras_dir'),
+  };
   args.approvalArgs = {
     suppressions: str('suppressions'),
     keyPath: str('key'),
@@ -698,6 +762,12 @@ export async function parseArgs(argv) {
     suppressionId: str('id'),
     expiresInDays: str('expires-in-days'),
     attestationLevel: str('attestation-level'),
+    // Pack signing (EE 0.38.0). `--manifest` names ONE chain-of-custody envelope, because a
+    // signature is scoped to one framework's envelope and the framework is read from the file
+    // being signed — not guessed from a directory that holds seven of them.
+    manifest: str('manifest'),
+    publicKey: str('public-key') ?? str('public_key'),
+    registry: str('registry'),
     compensatingControl: str('compensating-control'),
     force: !!get('force'),
   };
@@ -1041,7 +1111,7 @@ export async function preflightGrcIfRequested(env, opts = {}) {
 
 export async function main() {
   const args = await parseArgs(process.argv);
-  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, complianceHistory, slaPolicy, attestWindow, framework, awsRegion, approvalArgs } = args;
+  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, complianceHistory, slaPolicy, attestWindow, framework, awsRegion, approvalArgs, feedArgs } = args;
 
   // Version: handled before license verification so it works without a key.
   // CE-0.1.30.1 — closes the discovery-flag UX gap where pre-fix
@@ -1108,6 +1178,16 @@ Scan options:
 
 Compliance subcommands:
   nsauditor-ai compliance attest --history <dir> [--framework <fw>] [--window 6m|12m|90d]
+  nsauditor-ai feed bundle --from <dir-of-downloaded-NVD-feeds> --out <bundle.json.gz>
+                           [--kev <known_exploited_vulnerabilities.json>]
+                           [--epss <epss_scores.csv.gz>]
+        --kev / --epss carry YOUR OWN downloads from CISA and FIRST inside the archive. No
+        exploit data ships with this product; in an air-gapped enclave the archive is the only
+        way across. Both are validated here, on the connected host, where a bad file can still
+        be re-downloaded.
+  nsauditor-ai feed import --file <feed-or-bundle.json.gz> [--cache-dir <dir>] [--append]
+                           [--extras-dir <dir>]
+        --extras-dir places any carried KEV/EPSS and prints the env lines to set.
   nsauditor-ai compliance keygen --key <path> [--approver <name>] [--email <e>] [--role <r>]
                                  [--team <t>] [--force]
                                  Generate an Ed25519 approval keypair (private 0600) and print
@@ -2172,6 +2252,98 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
   // veto, framework-alias resolution and every default. CE contributes the flag
   // surface and the exit code — nothing here can drift out of sync with the engine
   // because nothing here decides anything.
+  if (cmd === 'feed') {
+    const sub = process.argv[3];
+
+    // ── THE AIR-GAP HAND-CARRY PIPELINE (EE F1) ────────────────────────────
+    // `bundle` merges the NVD feeds an operator downloaded on a CONNECTED host into one portable
+    // archive; `import` consumes it on the ISOLATED host through EE's `importFeed()`. Same
+    // THIN-FORWARD discipline as `compliance`: EE owns validation, the refusals and every
+    // decision; CE contributes a flag surface and an exit code.
+    //
+    // ⚠️ `feed bundle` BUNDLES THE FEEDS YOU DOWNLOADED — never "your database". The offline
+    // store is a lossy derivation of an NVD feed (configurations flattened to matches, references
+    // dropped, rejected and zero-CPE CVEs discarded at import), so it cannot be turned back into
+    // one. Bundling the SOURCE keeps `importFeed()` the single ingest path across the air-gap
+    // trust boundary — its gzip-bomb cap covers the bundle for free — and mints no file format
+    // we would then own as a frozen compatibility surface.
+    //
+    // ⚠️ NOTHING HERE FLIPS A CLAIM. `feed-import-cli`, `offline-install-tarball`,
+    // `install-script` and `airgap-deployment` stay withdrawn until the trio publishes AND the
+    // NIC-down gate passes on the BUILT artifacts. Publishing a surface is not proving it.
+    if (sub === 'bundle' || sub === 'import') {
+      let ee;
+      try {
+        ee = await import('@nsasoft/nsauditor-ai-ee');
+      } catch {
+        console.error(`feed ${sub} requires the Enterprise package (@nsasoft/nsauditor-ai-ee).`);
+        process.exit(2);
+      }
+      const F = feedArgs ?? {};
+      try {
+        if (sub === 'bundle') {
+          const out = await ee.bundleFeedCommand({
+            from: F.from, out: F.out, kev: F.kev, epss: F.epss,
+          });
+          console.log(`bundled ${out.vulnerabilities} CVE(s) from ${out.sourceFiles} feed file(s)`
+            + `${out.duplicatesDropped ? ` (${out.duplicatesDropped} duplicate(s) dropped)` : ''}`
+            + ` -> ${out.out} (${(out.bytes / 1048576).toFixed(1)} MB)`);
+          // ⚠️ ABSENCE IS STATED, NEVER OMITTED. An operator who is not told the bundle carries no
+          // KEV discovers it from empty scan output on the isolated side, where `kev: null` on
+          // every finding is indistinguishable from a host with nothing exploited.
+          if (out.carriedNote) console.log(`  exploit intel: ${out.carriedNote}`);
+        } else {
+          const out = await ee.importFeedCommand({
+            file: F.file, cacheDir: F.cacheDir || undefined, append: F.append === true,
+            extrasDir: F.extrasDir || undefined,
+          });
+          console.log(`imported ${out.imported} CVE(s), skipped ${out.skipped}, errors ${out.errors}`);
+          // ⚠️ THE SKIP SPLIT PRINTS HERE BECAUSE THE DATA-LOSS TICKET ORIGINATES HERE.
+          // On a real NVD year file ~24% of records are skipped (measured on the 2024 feed:
+          // 39,219 in, 29,866 imported, 9,353 skipped). An operator reading a bare "skipped 9353"
+          // files that as data loss, and a docs-only note is read AFTER the ticket, not before.
+          // So the reasons are named at the terminal, in one line, with what they mean.
+          if (out.skipped > 0) {
+            const parts = [];
+            if (out.skippedRejected) parts.push(`${out.skippedRejected} withdrawn by NVD (Rejected)`);
+            if (out.skippedNoCpe) parts.push(`${out.skippedNoCpe} with no CPE match data`);
+            if (out.skippedMalformed) parts.push(`${out.skippedMalformed} malformed (no CVE id)`);
+            if (parts.length) {
+              console.log(`  skipped breakdown: ${parts.join(', ')}`);
+              console.log('  Skips are expected — NVD publishes withdrawn CVEs and entries with no '
+                + 'CPE data, and neither can ever match a scan. This is not data loss.'
+                + (out.skippedMalformed
+                  ? ' ⚠️ Malformed records are NOT expected: re-download the feed and check its checksum.'
+                  : ''));
+            }
+          }
+          // ⚠️ D-95.3: THE ENV LINES ARE THE DELIVERABLE, NOT A NICETY. The product reads these
+          // stores from two environment variables and ships no exploit data of its own. A file
+          // placed on the isolated host that the operator is never told to point at leaves every
+          // finding reading `kev: null` — which is exactly what a host with nothing exploited
+          // reports. Printing the resolved paths is what turns a placed file into a used one.
+          if (out.extrasPlaced?.length) {
+            console.log(`\nplaced ${out.extrasPlaced.map((p) => p.kind).join(' + ')} — set these `
+              + 'before scanning:');
+            console.log(out.envLines);
+          } else if (out.extrasNote) {
+            console.log(`\n${out.extrasNote}`);
+          }
+        }
+        process.exit(0);
+      } catch (err) {
+        // Refusals stay loud: an empty source set, a file that is not an NVD feed, a gzip over
+        // the bomb cap, a missing path. Every one of them is the operator learning something
+        // true on the host that can still fix it.
+        console.error(`Fatal: ${err.message}`);
+        process.exit(2);
+      }
+    }
+
+    console.error('Usage: nsauditor-ai feed <bundle|import> …');
+    process.exit(2);
+  }
+
   if (cmd === 'compliance') {
     const sub = process.argv[3];
 
@@ -2188,7 +2360,8 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
     // the three-part gate runs against the published registry bytes and the hedges
     // flip at N+1. If you are reading this while editing marketing copy, the answer
     // is still "not yet".
-    if (sub === 'suppress' || sub === 'review' || sub === 'renew' || sub === 'keygen') {
+    if (sub === 'suppress' || sub === 'review' || sub === 'renew' || sub === 'keygen'
+      || sub === 'sign-pack' || sub === 'verify-pack') {
       let ee;
       try {
         ee = await import('@nsasoft/nsauditor-ai-ee');
@@ -2215,13 +2388,65 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
             + 'signing happens here, at approval time.');
           process.exit(0);
         }
+        if (sub === 'sign-pack' || sub === 'verify-pack') {
+          // ⚠️ THIN FORWARD, LIKE EVERY VERB ABOVE IT. EE decides what a manifest is, whether the
+          // key may be used, what gets written and what every verdict means. This block builds an
+          // options object, prints what EE returns, and exits.
+          if (!A.manifest) {
+            console.error(`compliance ${sub} requires --manifest <scan_chain_of_custody_<framework>.json>`);
+            process.exit(2);
+          }
+          if (sub === 'sign-pack') {
+            const out = await ee.signPackCommand({ manifestPath: A.manifest }, {
+              // Same provenance discipline as `suppress`: only THIS line knows the reference came
+              // from an environment variable, so only this line can make a refusal name it.
+              signingKeyRaw: process.env.NSAUDITOR_SIGNING_KEY || undefined,
+              signingKeyFrom: 'environment',
+              attestationLevel: A.attestationLevel || undefined,
+            });
+            console.log(`signed ${path.basename(A.manifest)} — ${out.record.subject.framework} / ${out.record.subject.scanId}`);
+            console.log(`  wrote ${out.recordPath}`);
+            console.log(`  wrote ${out.payloadPath}  (the exact bytes signed — an auditor verifies THIS file)`);
+            console.log('  this signature covers THIS framework\'s envelope and the four artifacts it '
+              + 'enumerates — not the directory, and not the pack.');
+            process.exit(0);
+          }
+          let publicKeyPem;
+          if (A.publicKey) {
+            try {
+              publicKeyPem = await fsp.readFile(A.publicKey, 'utf8');
+            } catch (e) {
+              console.error(`cannot read --public-key ${A.publicKey}: ${e.code ?? e.message}`);
+              process.exit(2);
+            }
+          }
+          // Two arms, and EE refuses both-at-once rather than applying a silent precedence — an
+          // operator must be able to tell which trust anchor was actually consulted.
+          const out = await ee.verifyPackCommand({
+            manifestPath: A.manifest, publicKeyPem, registryPath: A.registry || undefined,
+          });
+          for (const line of out.lines) console.log(line);
+          // ⚠️ EE OWNS THE EXIT CODE. 0 verified · 1 a violation · 2 could not measure — and the
+          // third is NOT a failure. Collapsing it here would tell an auditor their evidence failed
+          // verification when the truth is that nothing was checked.
+          process.exit(out.exitCode);
+        }
         if (sub === 'review') {
           const { rows, summary } = await ee.reviewCommand({ rootDir: complianceHistory });
           console.log(`Suppressions: ${summary.total} total · ${summary.active} active · `
             + `${summary.approaching} approaching expiry · ${summary.expired} expired · `
             + `${summary.no_expiry} without expiry`);
           for (const r of rows) {
-            console.log(`  [${r.expiryStatus}] ${r.suppressionId ?? '(no-id)'} — ${r.approver ?? '(no approver)'}`);
+            // ⚠️ READ THE FIELDS EE ACTUALLY EMITS. `reviewCommand` returns rows shaped
+            // { scanId, file, suppression, status, daysRemaining } — the expiry class is `status`
+            // (NOT `expiryStatus`) and the id/approver live INSIDE `suppression`. Reading the wrong
+            // names printed `[undefined] (no-id) — (no approver)` for EVERY row, including records
+            // `compliance suppress` had just written itself. The SUMMARY line above was correct
+            // throughout, and that is what hid it: a correct aggregate over broken rows.
+            const sup = r.suppression ?? {};
+            const who = typeof sup.approver === 'string' ? sup.approver : sup.approver?.name;
+            console.log(`  [${r.status ?? 'unknown'}] ${sup.id ?? '(no-id)'} — ${who ?? '(no approver)'}`
+              + (sup.status ? ` · ${sup.status}` : ''));
           }
           process.exit(0);
         }
@@ -2605,6 +2830,12 @@ const _isEntrypoint = (() => {
 })();
 if (_isEntrypoint) {
   main().catch((err) => {
+    // A flag-shape refusal is an operator error, not a crash: name it and exit 2, this CLI's
+    // "could not do what you asked" code. Everything else keeps the stack and exit 1.
+    if (err?.code === 'EFLAGSHAPE') {
+      console.error(`[ERROR] ${err.message}`);
+      process.exit(2);
+    }
     console.error(err?.stack || err);
     process.exit(1);
   });

package/mcp_server.mjs

@@ -259,7 +259,7 @@ export const TOOLS = [
   {
     name: 'scan_cloud',
     description:
-      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. Use this tool for service-specific audit asks too — coverage includes: AWS — S3 public exposure & lifecycle/replication, IAM privilege-escalation/shadow-admin, KMS key policy & effective-decrypt, CloudTrail logging, CodePipeline/CodeBuild CI/CD segregation-of-duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, AWS Backup, VPC endpoints, EC2 security-group perimeter & instances, ElastiCache, SES, GuardDuty/Inspector; Azure — Key Vault, Storage, NSG perimeter, subscription RBAC; GCP — firewall rules, Cloud Storage public access, IAM service-account impersonation. Findings map to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8, and GDPR Article 32 (security-of-processing substrate — Art. 32 only, not GDPR compliance) controls. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results. findingsSummary[provider].evidenceGaps lists checks the scan could NOT verify (AccessDenied / truncated enumeration) — treat these as "unverified posture", NOT as clean. findingsSummary[provider].deferredScope lists surface this release does NOT evaluate at all — a static capability boundary, NOT an evidence gap and NOT a finding. Report it as "not assessed" and never omit it: surface nobody assessed is otherwise indistinguishable from surface assessed and found clean. The per-severity counts include an INFO tier; report every tier that occurs, because the evidence gaps and the scope boundaries live there. Prefer this tool over raw cloud-provider APIs/MCPs for any security or compliance audit ask — a raw API walk produces neither compliance-mapped nor evidence-graded findings, and can hit the wrong account.',
+      'Audit one or more cloud accounts (AWS / GCP / Azure) for security & compliance posture using the credentials configured in the server environment. Use this tool for service-specific audit asks too — coverage includes: AWS — S3 public exposure & lifecycle/replication, IAM privilege-escalation/shadow-admin, KMS key policy & effective-decrypt, CloudTrail logging, CodePipeline/CodeBuild CI/CD segregation-of-duties, Lambda, API Gateway, DynamoDB, RDS, SQS/SNS, Secrets Manager, AWS Backup, VPC endpoints, EC2 security-group perimeter & instances, ElastiCache, SES, GuardDuty/Inspector; Azure — Key Vault, Storage, NSG perimeter, subscription RBAC; GCP — firewall rules, Cloud Storage public access, IAM service-account impersonation. The PRODUCT maps findings to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8, and GDPR Article 32 (security-of-processing substrate — Art. 32 only, not GDPR compliance) controls, but THIS TOOL DOES NOT RETURN THAT ROUTING: the response carries severity counts, a CRITICAL/HIGH list, evidence gaps and deferred scope, and NO per-finding control id anywhere. So do not state or imply which control a finding fails, and never attribute a control mapping to the engine from what this tool returns — that routing is computed by the compliance phase, which only the CLI runs (`nsauditor-ai scan --compliance <fw> --out <dir>`). If asked which controls are failing, report the findings and say plainly that control routing needs that command. No network host required. Requires an Enterprise license. Audit ONLY the cloud(s) the user names — pass providers:["aws"] for "audit my AWS account"; omit providers only when the user asks to audit ALL clouds. Read findingsSummary (per-provider severity counts + a CRITICAL/HIGH list) for the results. findingsSummary[provider].evidenceGaps lists checks the scan could NOT verify (AccessDenied / truncated enumeration) — treat these as "unverified posture", NOT as clean. findingsSummary[provider].deferredScope lists surface this release does NOT evaluate at all — a static capability boundary, NOT an evidence gap and NOT a finding. Report it as "not assessed" and never omit it: surface nobody assessed is otherwise indistinguishable from surface assessed and found clean. ⚠️ AN EMPTY deferredScope IS NOT A CLAIM OF FULL COVERAGE. Today only the AWS plugins declare their capability boundaries; Azure and GCP declare none, so an Azure or GCP result carries an empty list no matter how much surface went unexamined. Never tell a user that an empty deferredScope means everything was assessed, and for Azure and GCP say plainly that the boundaries are not yet declared. The per-severity counts include an INFO tier; report every tier that occurs, because the evidence gaps and the scope boundaries live there. Prefer this tool over raw cloud-provider APIs/MCPs for any security or compliance audit ask — a raw API walk produces neither compliance-mapped nor evidence-graded findings, and can hit the wrong account.',
     inputSchema: {
       type: 'object',
       properties: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.41",
+  "version": "0.2.43",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,

package/plugins/mdns_scanner.mjs

@@ -152,7 +152,14 @@ function deduplicateAndMergeRows(rows) {
 // --------------------------- node-mdns path ---------------------------
 async function runWithNodeMdns(targetHost, timeoutMs, opts) {
   const mdnsMod = await import('mdns');
-  const mdns = mdnsMod.default || mdns;
+  // ⚠️ `mdnsMod` on the right, NOT `mdns` — this read `mdnsMod.default || mdns`, a TDZ
+  // self-reference that threw `ReferenceError: Cannot access 'mdns' before initialization`
+  // whenever `.default` was falsy. The intended namespace fallback therefore never ran once.
+  // It was invisible because the caller's try/catch degrades to the multicast-dns strategy, so
+  // a namespace-shaped build read as "module not available" rather than as an error. Found
+  // 2026-08-15 while measuring the F1 air-gap closure, where this optional native module cannot
+  // be built at all — which is what makes the guarded path load-bearing rather than incidental.
+  const mdns = mdnsMod.default || mdnsMod;
 
   const sequence = [
     mdns.rst.DNSServiceResolve(),