nsauditor-ai 0.2.45 → 0.2.47

package/README.md

@@ -7,7 +7,7 @@ A modular, AI-assisted network security audit platform that scans, understands,
 [![npm](https://img.shields.io/npm/v/nsauditor-ai.svg)](https://www.npmjs.com/package/nsauditor-ai)
 [![MIT License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 [![Node.js 20+](https://img.shields.io/badge/node-20%2B-green.svg)](https://nodejs.org)
-[![Tests](https://img.shields.io/badge/tests-1305%20passing-brightgreen.svg)](#tests)
+[![Tests](https://img.shields.io/badge/tests-1308%20passing-brightgreen.svg)](#tests)
 
 ---
 
@@ -17,6 +17,32 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
+**Paired release with the Enterprise timestamp-integrity patch (CE 0.2.47 / Enterprise 0.40.3).** No CE
+behaviour change and **the peer floor stays `>=0.2.45`, unraised** — nothing in this cycle needs new
+Community Edition code. This bump exists because npm freezes a README at publish time, so the page
+you are reading can only be corrected by publishing, and it pairs with Enterprise 0.40.3. What
+Enterprise fixes, in case you run the pair — all on the **opt-in** RFC 3161 path
+(`NSAUDITOR_TSA_URL`; no default authority): a granted timestamp carries the digest it attests, and
+nothing compared it to the digest the request carried — so a replay or a caching proxy could return a
+valid timestamp **for a different artifact** and it was written as evidence. It is now refused. And the verification instruction printed on every timestamped compliance report could not be
+run: it passed `-queryfile` and `-data` together, which openssl rejects outright with no verdict, and
+named a `.tsq` file no pack contains. Timestamping remains **opt-in** (`NSAUDITOR_TSA_URL`; no default
+authority). ⚠️ **If you have timestamped packs produced before Enterprise 0.40.3, the fix is not
+retroactive** — re-verify them with `openssl ts -verify -in <file>.tsr -data <file> -CAfile <bundle>`,
+and note that a `.tsr` which fails there was never a valid timestamp for that artifact.
+
+**Paired release with the Enterprise evidence-integrity patch (CE 0.2.46 / Enterprise 0.40.2).** No CE
+code change — this publish exists because npm freezes this README at publish time: it delivers the
+page corrections made since 0.2.45 (the eighth framework was missing from four places on this page;
+the Activation section taught a stale form) and pairs the page with Enterprise 0.40.2. The Enterprise
+half of the pair is an evidence-integrity fix to the **opt-in** RFC 3161 timestamping path
+(`NSAUDITOR_TSA_URL`, no default authority): a Time-Stamp Authority **rejection** is now refused
+rather than mistaken for a valid timestamp, recorded with one of five named reason codes in the
+chain-of-custody envelope. The TSA policy-OID option also works on OpenSSL ≥ 3.0 hosts for the first
+time (`-tspolicy` attempted, legacy `-policy` fallback), and internal `(Dim N)` dimension codes are
+out of customer-facing GCP finding prose. **Peer floor unchanged: Enterprise requires CE ≥ 0.2.45,
+which 0.2.46 satisfies.**
+
 **The eighth compliance framework: NIST SP 800-171 Rev 2 (CE 0.2.45 / Enterprise 0.40.0).** Enterprise adds `--compliance nist-800-171`, and CE registers the stem so the MCP `scan_cloud` tool and the CLI accept it. ⚠️ **Requires CE ≥ 0.2.45** — CE 0.2.44 does NOT carry the stem, so an Enterprise 0.40.0 paired with an older CE will reject the framework name. What Enterprise produces is **evidence substrate an assessor reads**, scoped as *NIST SP 800-171 evidence substrate for CMMC Level 2 preparation*: it is **not** a CMMC certification, **not** a FedRAMP authorization, and it emits **no** MET/NOT MET determination and **no** SPRS score — those are a C3PAO's to make, and only a C3PAO's. All 110 Rev 2 requirements are enumerated with a written reason each; Rev 2 is pinned deliberately, because CMMC assesses Rev 2 by rule and Rev 3 is a different 97-requirement universe.
 
 **`scan_cloud` stops naming a provider roster it cannot derive (CE 0.2.44 / Enterprise 0.39.0).** Paired with Enterprise 0.39.0 — **no CE scanning behaviour change, and the peer floor stays `>=0.2.43`, unraised.** The one thing that moves here is model-facing and npm freezes it, which is why it needs its own publish: the MCP `scan_cloud` tool description used to tell an assistant that *only the AWS plugins declare their capability boundaries; Azure and GCP declare none.* Enterprise 0.39.0 falsifies that — its seven GCP and Azure plugins now declare theirs — and a sentence read on every scan cannot be allowed to go stale on a peer's release. It is rewritten to state the invariant that is true in BOTH states and that CE can actually stand behind: **not every plugin declares its capability boundaries, so `deferredScope` bounds only what the DECLARING plugins state and is never a coverage inventory** — an empty or short list is not a claim of full coverage. CE floats over a peer RANGE and cannot derive Enterprise's plugin roster, so any sentence that counted providers was a claim it had no way to check. Also here: the edition-comparison chart gains the Ed25519 evidence-pack signing row, carrying its permanent scope in-sentence — one framework's envelope and the artifacts it enumerates, an operator-held key, never a vendor attestation. **And a second fix, found by trying to USE the previous release's headline:** `compliance sign-pack` and `compliance verify-pack` dispatched correctly but were **absent from `nsauditor-ai help`** for the whole of 0.2.43 — documented in every README, changelog and design record, and missing from the one surface a user actually reads. Both now carry usage blocks, and a guard derives the dispatched verb set from the dispatch site and asserts help/dispatch equality in both directions, so a reachable-but-undiscoverable command fails the build.
@@ -61,10 +87,10 @@ NSAuditor AI is available in three editions: Community (free, MIT-licensed, no r
 
 ### Why upgrade to Enterprise?
 
-If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS Controls v8, or GDPR Article 32 audit** — or need to satisfy customer security questionnaires citing those frameworks, or an IG1 attestation for cyber-insurance renewal — Enterprise turns scan output into **auditor-ready evidence packs** that pass institutional scrutiny:
+If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS Controls v8, GDPR Article 32, or NIST SP 800-171 / CMMC Level 2 audit** — or need to satisfy customer security questionnaires citing those frameworks, or an IG1 attestation for cyber-insurance renewal — Enterprise turns scan output into **auditor-ready evidence packs** that pass institutional scrutiny:
 
 - ☁️ **28 enterprise plugins — 27 cloud auditors across AWS / Azure / GCP, plus **`1023 Zero Trust Assessment`**, which scores zero-trust posture (segmentation, encryption-in-transit, identity, lateral-movement risk) from a **network-host** scan** — find the configuration risks an auditor will flag, before they do (CloudTrail integrity, KMS custody, S3 Object Lock, IAM shadow-admin paths, GCP IAM impersonation chains, Azure RBAC sprawl, and more)
-- 📋 **7 compliance frameworks shipped** — generate any combination from a single scan:
+- 📋 **8 compliance frameworks shipped** — generate any combination from a single scan:
   - **SOC 2** (AICPA TSC 2017) — 10 fully-covered + 4 partial controls
   - **HIPAA Security Rule §164.312** — 7 covered + 3 partial Technical Safeguards; **Zero BAA required** (ePHI never leaves your infrastructure)
   - **NIST CSF 2.0 Core** (NIST CSWP 29, Feb 2024) — 13 covered + 10 partial Subcategories across 106 of CSF 2.0's 107 Subcategories; Subcategory-level mapping (auditor-canonical, not high-level Function/Category claims)
@@ -72,12 +98,13 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS C
   - **ISO/IEC 27001:2022** (ISO + IEC, Oct 2022; 2013 edition retired Oct 31, 2025) — **17 covered + 14 partial + 62 OOS across 93 Annex A controls** (the complete Annex A universe); per-Annex-A-code mapping auditor-canonical for ISO/IEC 17021-1 certification body assessors; Statement of Applicability per Clause 6.1.3.d discipline + ISMS Clauses 4-10 OOS-by-design with 7 Major Nonconformity classes
   - **CIS Critical Security Controls v8** (CIS, May 2021; v8.1 errata June 2024) — **17 covered + 23 partial + 113 OOS across 153 Safeguards / 18 Controls**; per-Safeguard mapping with the **Implementation Group cumulative discipline** (IG1=56 cyber-insurance baseline / IG2 cumulative=130 / IG3 cumulative=153); no-certification-body attestation discipline (INPUT to your CSAT / CIS-CAT Pro self-attestation, never "CIS certified"); Cloud Companion Guide v8 shared-responsibility + CIS-Hardened-Image substrate-evidence credit (4.1/4.2/4.6)
   - **GDPR Article 32 (Security of Processing)** (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units**; **GDPR Article 32 infrastructure substrate only — NOT GDPR compliance** (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate *for* your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); **Art. 83(4) lower fine tier** (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
+  - **NIST SP 800-171 Rev 2** (NIST, Feb 2020; the baseline CMMC assesses by rule) — **2 covered + 49 partial + 59 OOS across all 110 requirements**, claimed at the SP 800-171A determination-statement level. ⚠️ This is EXAMINE-method evidence substrate for **CMMC Level 2 preparation** — not a CMMC certification, not a FedRAMP authorization, and it emits no MET/NOT MET determination and no SPRS score; each of those is a C3PAO's to make.
 - 🔐 **Evidence with a verifiable chain of custody** — SHA-256 sidecars on every artifact, verifiable offline. RFC 3161 trusted timestamps are **opt-in since EE 0.33.0** via `NSAUDITOR_TSA_URL`, require an outbound call to the authority you name plus the `openssl` binary, and were exercised against a live Time-Stamp Authority on the npm path on 2026-08-07: the auditor procedure `openssl ts -verify` returned OK, with a one-byte-mutated copy returning FAILED as the control. The `:0.33.0` Marketplace image is proven too: on 2026-08-08 the same round-trip was driven from inside the pushed image against a real authority, verified with the image’s own `openssl`. **Retained images at `:0.32.11` and earlier carry no `openssl` at all**, so nothing here speaks for them. **Ed25519 suppression signing became reachable in EE 0.35.0 via `compliance suppress`** and is **proven as of EE 0.36.0 for approvers whose registry entry carries key material** — a shipped entry point signs, and a one-character length-preserving tamper makes the report render `signature FAILED verification`. A fingerprint-only registry entry reads `not checked by this report`, which records that no check ran and never that one failed.
 - 🏛️ **Zero Data Exfiltration architecture** — no scan data is collected, transmitted, or stored by Nsasoft; reports are written to your local disk. Air-gapped operation once configured for it (`NSAUDITOR_OFFLINE_ONLY=1` plus a local NVD store; a default run queries NIST's public CVE API). AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
 - 🔗 **GRC connectors — Vanta + Drata + Secureframe (Enterprise)** — map compliance findings to your GRC platform's evidence/test records and push them at **scan time** (opt-in). Suppression-aware outcome mapping (Vanta) / structured records (Drata + Secureframe), idempotent retries, rate-limit handling, token redaction, and Zero-Data-Exfiltration egress redaction. Early-access, single-workspace; live validation against production tenants is in progress. See **[GRC Connectors](#grc-connectors-vanta-drata-secureframe)** below.
 - 🗄️ **WORM posture VALIDATION** — we read your bucket's S3 Object Lock configuration per CloudTrail trail bucket and fail the control when it is absent, in GOVERNANCE mode or under-retained. That is substrate FOR a SEC Rule 17a-4(f) / FINRA 4511 retention claim, not the claim itself: the engine WRITING artifacts into the immutable store is built and **not reachable** (no caller), so the retention guarantee stays yours to make about your own archive
 - 📊 **SLA / MTTR tracking + recurring-scan attestation** — the **Type II operating-effectiveness evidence** auditors actually demand (not just point-in-time snapshots)
-- 🎯 **14 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 8-of-8 COMPLETE for all shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + CIS Controls v8 + GDPR Article 32 + GRC connector)
+- 🎯 **14 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 9-of-9 COMPLETE for all shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + CIS Controls v8 + GDPR Article 32 + NIST SP 800-171 + GRC connector)
 
 → **[See sample EE scan output](https://www.nsauditor.com/ai/docs/sample-scan/)** — full evidence pack against synthetic Acme Corp AWS account (no signup required)
 → **[Buy NSAuditor AI Enterprise Edition](https://www.nsauditor.com/ai/pricing/)** — $2k / $5k / $10k+ per year for 5 / 25 / unlimited seats + custom SLA. Onboarding call included.
@@ -711,7 +738,7 @@ nsauditor-ai --version     (or -v, or `version`)
 | `--interval <min>` | Rescan interval in minutes (requires `--watch`) | `60` |
 | `--webhook-url <url>` | Webhook URL for delta alerts | — |
 | `--alert-severity <sev>` | Minimum severity for webhook alerts | `high` |
-| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, `iso-27001`, `cis-v8`, `gdpr`, or any combination like `soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr`). **Enterprise license required.** Supported frameworks as of EE 0.20.0: `soc2` (AICPA TSC 2017) + `hipaa` (HIPAA Security Rule §164.312 Technical Safeguards) + `nist-csf` (NIST Cybersecurity Framework 2.0 Core, CSWP 29 Feb 2024) + `pci-dss` (PCI DSS v4.0.1, PCI SSC June 2024 errata) + `iso-27001` (ISO/IEC 27001:2022, ISO + IEC October 2022) + `cis-v8` (CIS Critical Security Controls v8, CIS May 2021 / v8.1 errata June 2024) + `gdpr` (GDPR Article 32 / Security of Processing, Regulation (EU) 2016/679 — Art. 32 infrastructure substrate, **not** GDPR compliance). See `@nsasoft/nsauditor-ai-ee` README for per-framework coverage details. | — |
+| `--compliance <fw>` | Compliance framework to map findings into. Accepts CSV for multi-framework runs (e.g. `soc2`, `hipaa`, `nist-csf`, `pci-dss`, `iso-27001`, `cis-v8`, `gdpr`, `nist-800-171`, or any combination like `soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171` — `all` expands to the same eight). **Enterprise license required.** Supported frameworks as of EE 0.40.0 — **eight**: `soc2` (AICPA TSC 2017) + `hipaa` (HIPAA Security Rule §164.312 Technical Safeguards) + `nist-csf` (NIST Cybersecurity Framework 2.0 Core, CSWP 29 Feb 2024) + `pci-dss` (PCI DSS v4.0.1, PCI SSC June 2024 errata) + `iso-27001` (ISO/IEC 27001:2022, ISO + IEC October 2022) + `cis-v8` (CIS Critical Security Controls v8, CIS May 2021 / v8.1 errata June 2024) + `gdpr` (GDPR Article 32 / Security of Processing, Regulation (EU) 2016/679 — Art. 32 infrastructure substrate, **not** GDPR compliance) + `nist-800-171` (NIST SP 800-171 Rev 2 — evidence substrate for **CMMC Level 2 preparation**, **not** a CMMC certification, **not** a FedRAMP authorization, and no MET/NOT MET determination or SPRS score). See `@nsasoft/nsauditor-ai-ee` README for per-framework coverage details. | — |
 | `--compliance-scope <path>` | Optional JSON file describing the assessment scope (passed to the compliance engine for cover-page attestation) | — |
 | `--help`, `-h` | Print usage block (subcommands, flags, env vars, examples) and exit 0 | — |
 | `--version`, `-v` | Print `nsauditor-ai <version>` and exit 0 | — |
@@ -1038,11 +1065,12 @@ export default {
 After purchasing at [nsauditor.com/ai/pricing](https://www.nsauditor.com/ai/pricing), you'll receive an email with your license key and an npm install command. Two steps:
 
 ```bash
-# 1. Install EE package (one-time, token included in email)
+# 1. Install both packages (one-time, token included in email — the base package carries the CLI)
+npm install -g nsauditor-ai
 npm install -g @nsasoft/nsauditor-ai-ee --//registry.npmjs.org/:_authToken=npm_xxxxx
 
-# 2. Set your license key
-export NSAUDITOR_LICENSE_KEY=pro_eyJhbGci...
+# 2. Install your license key — identical on macOS, Linux and Windows, no environment variable needed
+nsauditor-ai license install "pro_eyJhbGci..."
 ```
 
 Verify:
@@ -1065,7 +1093,7 @@ No license key? Everything in this repository works perfectly without one. The C
 
 ## Tests
 
-Run all 1305 tests:
+Run all 1308 tests:
 
 ```bash
 npm test

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.45",
+  "version": "0.2.47",
   "description": "Modular AI-assisted network security audit platform \u2014 Community Edition",
   "type": "module",
   "private": false,