nsauditor-ai 0.2.55 → 0.2.57

package/plugins/040_tls_cert_auditor.mjs

@@ -23,6 +23,7 @@
 
 import tls from "node:tls";
 import { isIP } from "node:net";
+import { X509Certificate } from "node:crypto";
 
 // ── Severity ─────────────────────────────────────────────────────────────────
 
@@ -84,22 +85,60 @@ const WEAK_CIPHER_FRAGMENTS = [
 ];
 
 const DEPRECATED_PROTOCOLS = new Set(["SSLv2", "SSLv3", "TLSv1", "TLSv1.1"]);
-const WEAK_SIG_ALGORITHMS  = /sha1WithRSA|md5WithRSA|md2WithRSA|sha1-with-rsa|dsaWithSHA1/i;
+const WEAK_SIG_ALGORITHMS  = /sha1WithRSA|md5WithRSA|md2WithRSA|sha1-with-rsa|dsaWithSHA1|ecdsa-with-SHA1/i;
+
+// ⚠️ THE SIGNATURE ALGORITHM IS NOT ON getPeerCertificate() (1.3.0 build 5, Gate 3-A F-3b). Node's peer certificate
+// carries subject, issuer, modulus, bits, raw … and no signature algorithm (measured on Node 24.12), so the leaf and
+// chain checks below read "unknown" and could not fire from e96c8f9 (2026-04-08) on. It is in the DER: X509Certificate
+// reads it on Node 24 (measured v24.12.0), and the getter does NOT EXIST on Node 20 (v20.19.6, CE's engines floor);
+// Node 22 is not measured. Where it cannot be read, the algorithm is NOT ASSESSED — never "unknown" read as a pass.
+export function signatureAlgorithmOf(peerCert) {
+  if (!peerCert?.raw) return null;
+  try {
+    const alg = new X509Certificate(peerCert.raw).signatureAlgorithm;
+    return typeof alg === "string" && alg ? alg : null;
+  } catch {
+    return null;
+  }
+}
+// The reason is a claim, so it names the cause it measured: the runtime sentence only when the getter does not EXIST
+// (checked when the strength is decided, not at load); any other null — no DER on the peer object, a parse failure —
+// says the algorithm could not be read, so an operator is not sent to upgrade Node for a certificate it cannot parse.
+export function signatureStrengthOf(sigAlg) {
+  if (sigAlg) return "assessed";
+  return "signatureAlgorithm" in X509Certificate.prototype
+    ? "not assessed — the certificate's signature algorithm could not be read"
+    : "not assessed — this Node runtime does not report certificate signature algorithms (Node 24 does; Node 20 does not)";
+}
+// A certificate that issued itself: its own signature is verified by no client (an anchor, or a leaf that is its own).
+const selfIssued = (c) => !!c?.issuerCertificate && c.issuerCertificate.fingerprint256 === c.fingerprint256;
 
 // ── Hostname Validation ──────────────────────────────────────────────────────
 // Checks CN and SANs against the target hostname, handling wildcards.
 
 function validateHostname(cert, hostname) {
   if (isIP(hostname)) {
-    // For IP connections, check IP SANs
-    const ipSans = extractSANs(cert, "IP");
-    return ipSans.includes(hostname);
+    // For IP connections, check IP SANs — as ADDRESSES, never as strings: Node prints an IPv6 SAN expanded
+    // ("0:0:0:0:0:0:0:1") where the target may be written compressed ("::1").
+    const target = canonicalAddress(hostname);
+    return extractSANs(cert, "IP").some((san) => canonicalAddress(san) === target);
   }
 
   const names = getAllNames(cert);
   return names.some((name) => matchesHostname(name, hostname));
 }
 
+// The canonical text of an IP literal (IPv6 compressed, lower-case), or null for anything that is not one.
+function canonicalAddress(addr) {
+  const family = isIP(String(addr));
+  if (!family) return null;
+  try {
+    return new URL(`http://${family === 6 ? `[${addr}]` : addr}/`).hostname;
+  } catch {
+    return null;
+  }
+}
+
 function getAllNames(cert) {
   const names = [];
 
@@ -117,11 +156,16 @@ function getAllNames(cert) {
 
 function extractSANs(cert, type) {
   if (!cert.subjectaltname) return [];
+  // 0.2.57: Node prints an IP SAN as "IP Address:<addr>" (measured — "DNS:a.example, IP Address:127.0.0.1"), so an
+  // "IP:" filter alone never found one and every IP target read as a mismatch. Both spellings are read.
+  const prefixes = type === "IP" ? ["IP Address:", "IP:"] : [`${type}:`];
   return cert.subjectaltname
     .split(",")
     .map((s) => s.trim())
-    .filter((s) => s.startsWith(`${type}:`))
-    .map((s) => s.slice(type.length + 1));
+    .flatMap((s) => {
+      const p = prefixes.find((x) => s.startsWith(x));
+      return p ? [s.slice(p.length)] : [];
+    });
 }
 
 function matchesHostname(pattern, hostname) {
@@ -170,7 +214,7 @@ function analyzeChain(cert, now) {
       validTo: current.valid_to,
       expired: now > validTo,
       notYetValid: now < validFrom,
-      signatureAlgorithm: current.signatureAlgorithm || "unknown",
+      signatureAlgorithm: signatureAlgorithmOf(current) ?? "not reported",
     };
 
     chain.push(entry);
@@ -193,8 +237,10 @@ function analyzeChain(cert, now) {
       });
     }
 
-    // Weak sig in chain
-    if (depth > 0 && WEAK_SIG_ALGORITHMS.test(entry.signatureAlgorithm)) {
+    // Weak sig in chain — on an ISSUED certificate only. A self-signed terminal entry is the trust anchor, whose own
+    // signature no client verifies (the architect seat's ruling, F-3b), so a SHA-1 root above SHA-256 certificates is
+    // recorded and not graded.
+    if (depth > 0 && !selfIssued(current) && WEAK_SIG_ALGORITHMS.test(entry.signatureAlgorithm)) {
       issues.push({
         severity: SEVERITY.MEDIUM,
         check: "chain_weak_signature",
@@ -220,17 +266,27 @@ function analyzeChain(cert, now) {
 
 // ── Key Strength Analysis ────────────────────────────────────────────────────
 
-function analyzeKeyStrength(cert, config) {
+// ⚠️ THE TYPE COMES FROM THE FIELDS NODE ACTUALLY SETS (1.3.0 build 5, Gate 3-A F-3). Node's getPeerCertificate() gives
+// `pubkey` as a raw Buffer with no `.type`; an RSA key carries `modulus` and `exponent`, an EC key a named curve
+// (`asn1Curve` / `nistCurve`), and both carry `bits` (measured on Node 24.12). Until build 5 this read `cert.pubkey?.type`,
+// so the type was always "unknown" and neither branch below could run on a real server — a 1024-bit RSA key raised
+// nothing. A key of neither type (Ed25519 carries none of these fields) is NOT ASSESSED, said on certAudit, never silent.
+export function analyzeKeyStrength(cert, config) {
   const issues = [];
-  const keyType = cert.pubkey?.type || "unknown";
-  const keyBits = cert.bits || cert.pubkey?.size || null;
+  const keyType = cert.modulus ? "RSA" : (cert.asn1Curve || cert.nistCurve) ? "EC" : "unknown";
+  const keyBits = Number.isFinite(cert.bits) && cert.bits > 0 ? cert.bits : null;
 
   const result = {
     type: keyType,
     bits: keyBits,
+    strength: keyType === "unknown"
+      ? "not assessed — the key is neither RSA (no modulus) nor EC (no named curve), so its size is not graded"
+      : keyBits === null
+        ? `not assessed — the ${keyType} key reported no size`
+        : "assessed",
   };
 
-  if (keyType === "RSA" || keyType === "rsa") {
+  if (keyType === "RSA") {
     if (keyBits && keyBits < config.minRsaBits) {
       issues.push({
         severity: keyBits < 1024 ? SEVERITY.CRITICAL : SEVERITY.HIGH,
@@ -238,7 +294,7 @@ function analyzeKeyStrength(cert, config) {
         detail: `RSA key is ${keyBits} bits (minimum recommended: ${config.minRsaBits})`,
       });
     }
-  } else if (keyType === "EC" || keyType === "ec") {
+  } else if (keyType === "EC") {
     if (keyBits && keyBits < config.minEcBits) {
       issues.push({
         severity: SEVERITY.HIGH,
@@ -390,23 +446,47 @@ async function auditPort(host, port, config) {
     cert.subject?.O === cert.issuer?.O &&
     cert.fingerprint256 === cert.issuerCertificate?.fingerprint256;
 
-  if (isSelfSigned) {
-    issues.push({
-      severity: SEVERITY.HIGH,
-      check: "self_signed",
-      detail: "Certificate is self-signed — not trusted by clients",
-    });
-  }
+  const selfSignedIssue = isSelfSigned
+    ? { severity: SEVERITY.HIGH, check: "self_signed", detail: "Certificate is self-signed — not trusted by clients" }
+    : null;
+  if (selfSignedIssue) issues.push(selfSignedIssue);
 
   // ── Hostname Mismatch ──────────────────────────────────────────────────
   const hostnameValid = validateHostname(cert, host);
   if (!hostnameValid) {
     const certNames = getAllNames(cert).join(", ");
-    issues.push({
-      severity: SEVERITY.HIGH,
-      check: "hostname_mismatch",
-      detail: `Hostname "${host}" does not match certificate names: ${certNames}`,
-    });
+    // 0.2.57: graded by the target's form. Scanned by ADDRESS, a certificate that names DNS names only cannot match —
+    // a true finding (a client connecting by address sees the mismatch), kept, but LOW: it is expected wherever the
+    // service is reached by name. LOW, never INFO — the grading table drops `info`, which would hide it from every
+    // reader. HIGH stays HIGH for a DNS-name target the certificate does not name, a certificate naming a DIFFERENT
+    // address, and one naming no SAN at all.
+    const dnsSans = extractSANs(cert, "DNS");
+    const ipSans = extractSANs(cert, "IP");
+    const byAddress = isIP(host) !== 0 && dnsSans.length > 0 && ipSans.length === 0;
+    // A certificate with NO subjectAltName names no host a modern (RFC 6125) client checks — the CN is ignored — so
+    // "does not match certificate names: <CN>" told the reader a usable name was present and merely differed. HIGH,
+    // with that said (0.2.57, before this text had any prior identity in a delta).
+    const noSan = dnsSans.length === 0 && ipSans.length === 0;
+    issues.push(noSan
+      ? {
+        severity: SEVERITY.HIGH,
+        check: "hostname_mismatch",
+        detail: `Hostname "${host}": the certificate carries no subjectAltName — modern clients reject it for any name `
+          + (cert.subject?.CN ? `(CN ${cert.subject.CN} is not checked)` : "(and it carries no CN either)"),
+      }
+      : byAddress
+      ? {
+        severity: SEVERITY.LOW,
+        check: "hostname_mismatch",
+        detail: `Hostname "${host}" does not match certificate names: ${certNames} — the certificate names DNS names only `
+          + `(${dnsSans.join(", ")}); a client connecting by address sees a name mismatch, expected where the service is `
+          + "reached by name",
+      }
+      : {
+        severity: SEVERITY.HIGH,
+        check: "hostname_mismatch",
+        detail: `Hostname "${host}" does not match certificate names: ${certNames}`,
+      });
   }
 
   // ── Wildcard Sprawl ────────────────────────────────────────────────────
@@ -421,13 +501,22 @@ async function auditPort(host, port, config) {
   }
 
   // ── Signature Algorithm ────────────────────────────────────────────────
-  const sigAlg = cert.signatureAlgorithm || "unknown";
-  if (WEAK_SIG_ALGORITHMS.test(sigAlg)) {
-    issues.push({
-      severity: SEVERITY.HIGH,
-      check: "weak_signature",
-      detail: `Weak signature algorithm: ${sigAlg}`,
-    });
+  // Read from the DER (signatureAlgorithmOf, above). A weak algorithm on a SELF-SIGNED leaf is not graded — the leaf is
+  // its own anchor, so no client verifies that signature (option B, ruled) — and the self_signed finding says which
+  // algorithm and why, so the skip is visible; the algorithm is recorded either way.
+  const sigAlg = signatureAlgorithmOf(cert);
+  const sigStrength = signatureStrengthOf(sigAlg);
+  if (sigAlg && WEAK_SIG_ALGORITHMS.test(sigAlg)) {
+    if (selfSignedIssue) {
+      selfSignedIssue.detail += `; signed with ${sigAlg} — not graded on a self-signed certificate, whose signature no `
+        + "client verifies (pin it by fingerprint)";
+    } else {
+      issues.push({
+        severity: SEVERITY.HIGH,
+        check: "weak_signature",
+        detail: `Weak signature algorithm: ${sigAlg}`,
+      });
+    }
   }
 
   // ── Key Strength ───────────────────────────────────────────────────────
@@ -447,8 +536,10 @@ async function auditPort(host, port, config) {
     });
   }
 
-  // Forward secrecy check
-  const hasForwardSecrecy = /ECDHE|DHE/i.test(cipher.name);
+  // Forward secrecy check. 0.2.57: TLS 1.3 by the PROTOCOL — every TLS 1.3 suite is ephemeral by construction, and
+  // its name (TLS_AES_256_GCM_SHA384) carries neither ECDHE nor DHE, so the name test called every TLS 1.3 server
+  // "no forward secrecy". Below TLS 1.3, the cipher name as before.
+  const hasForwardSecrecy = protocol === "TLSv1.3" || /ECDHE|DHE/i.test(cipher.name);
   if (!hasForwardSecrecy) {
     issues.push({
       severity: SEVERITY.MEDIUM,
@@ -479,11 +570,26 @@ async function auditPort(host, port, config) {
   issues.push(...chainAnalysis.issues);
 
   // ── Node.js authorization check (CA trust store validation) ────────────
-  if (!probe.authorized && !isSelfSigned) {
+  // 0.2.57: NOT on a name mismatch alone. With a chain the CA store VERIFIED and only the name wrong, Node reports
+  // authorized=false with authorizationError ERR_TLS_CERT_ALTNAME_INVALID (measured: the same CA-signed certificate
+  // reads authorized=true once its IP SAN matches the target), and this said the store distrusted a chain it trusted.
+  // hostname_mismatch carries that fact. Keyed on the EXACT code: a chain that fails reports its own code, so an
+  // untrusted chain with a wrong name keeps this finding beside the mismatch.
+  //
+  // 1.3.0 build 5 (the architect seat's ruling): Node reports UNSPECIFIED for a verify error outside its named table —
+  // measured for a 1024-bit leaf key and for a SHA-1 signature under a CA the store DOES hold, both refused by the
+  // verifier's policy. "Not trusted by system CA store" would name a cause that is false there, so UNSPECIFIED states the
+  // fact and no cause; where this certificate carries a graded weak key or signature, it points at that grade (a pointer,
+  // not a causal claim — the refusal's cause is not measured here). Named codes keep their wording.
+  if (!probe.authorized && !isSelfSigned && probe.authError !== "ERR_TLS_CERT_ALTNAME_INVALID") {
+    const weakGrade = issues.some((i) => ["weak_rsa_key", "weak_ec_key", "weak_signature", "chain_weak_signature"].includes(i.check));
     issues.push({
       severity: SEVERITY.MEDIUM,
       check: "ca_not_trusted",
-      detail: `Certificate not trusted by system CA store: ${probe.authError || "unknown reason"}`,
+      detail: probe.authError === "UNSPECIFIED"
+        ? "Certificate chain refused by this runtime's verifier — Node reports no named reason (UNSPECIFIED)"
+          + (weakGrade ? "; the graded weak key / signature on this certificate is the actionable finding" : "")
+        : `Certificate not trusted by system CA store: ${probe.authError || "unknown reason"}`,
     });
   }
 
@@ -512,9 +618,11 @@ async function auditPort(host, port, config) {
       selfSigned: isSelfSigned,
       hostnameValid,
       names: allNames,
-      signatureAlgorithm: sigAlg,
+      signatureAlgorithm: sigAlg ?? "not reported",
+      signatureStrength: sigStrength,
       keyType: keyAnalysis.keyInfo.type,
       keyBits: keyAnalysis.keyInfo.bits,
+      keyStrength: keyAnalysis.keyInfo.strength,
       fingerprint256: cert.fingerprint256,
       serialNumber: cert.serialNumber,
     },
@@ -698,19 +806,24 @@ export default {
         status = "valid";
       }
 
-      // Filter actionable issues (skip PASS and INFO for conclude)
+      // Actionable issues (skip PASS and INFO), each with its OWN severity and check — 1.3.0 (s1): the shared
+      // service-flag table grades one finding per issue, and a detail string alone left only the port's roll-up.
       const actionableIssues = pr.issues
         .filter((i) => i.severity !== SEVERITY.PASS && i.severity !== SEVERITY.INFO)
-        .map((i) => i.detail);
-
+        .map((i) => ({ severity: i.severity, check: i.check, detail: i.detail }));
+      // The roll-up is DERIVED from the issues carried here, never copied from the port result: a second copy of a datum
+      // is a copy that can disagree. Null when nothing is actionable.
+      const rollUp = [SEVERITY.CRITICAL, SEVERITY.HIGH, SEVERITY.MEDIUM, SEVERITY.LOW]
+        .find((sev) => actionableIssues.some((i) => i.severity === sev)) ?? null;
+
+      // 1.3.0: the audit travels under `certAudit`, never in identity. This record wrote program "TLS" and the
+      // NEGOTIATED protocol as the service version, and once the concluder reached it, that version would have
+      // filled the blank on the TLS scanner's authoritative record.
       items.push({
         port: pr.port,
         protocol: "tcp",
         service: pr.service,
-        program: "TLS",
-        version: pr.negotiation.protocol,
         status: "open",
-        severity: pr.severity,
         info: [
           status,
           `${pr.certificate.daysToExpiry}d remaining`,
@@ -719,18 +832,25 @@ export default {
           pr.certificate.selfSigned ? "self-signed" : null,
           pr.certificate.hostnameValid ? null : "hostname-mismatch",
         ].filter(Boolean).join(" | "),
-        issues: actionableIssues,
-        details: {
-          subject: pr.certificate.subject,
-          issuer: pr.certificate.issuer,
-          names: pr.certificate.names,
-          validFrom: pr.certificate.validFrom,
-          validTo: pr.certificate.validTo,
-          signatureAlgorithm: pr.certificate.signatureAlgorithm,
-          keyType: pr.certificate.keyType,
-          keyBits: pr.certificate.keyBits,
-          chainDepth: pr.chain.depth,
-          authorized: pr.authorized,
+        certAudit: {
+          severity: rollUp,
+          certStatus: status,
+          negotiatedProtocol: pr.negotiation.protocol,
+          issues: actionableIssues,
+          details: {
+            subject: pr.certificate.subject,
+            issuer: pr.certificate.issuer,
+            names: pr.certificate.names,
+            validFrom: pr.certificate.validFrom,
+            validTo: pr.certificate.validTo,
+            signatureAlgorithm: pr.certificate.signatureAlgorithm,
+            signatureStrength: pr.certificate.signatureStrength,
+            keyType: pr.certificate.keyType,
+            keyBits: pr.certificate.keyBits,
+            keyStrength: pr.certificate.keyStrength,
+            chainDepth: pr.chain.depth,
+            authorized: pr.authorized,
+          },
         },
         // ZDE: fingerprints and serial numbers stay in-process.
         // Conclude emits only classifications and metadata.

package/plugins/050_tribe_health.mjs

@@ -590,58 +590,37 @@ export default {
   },
 
   // ── Conclude: NSAuditor report items ────────────────────────────────────
+  // 1.3.0: ONE record on 8080, its findings under `tribeHealth`. The per-finding records shared the summary's
+  // protocol:port key and were dropped by the merge once the concluder reached this adapter — the CRITICAL among them.
   conclude({ result }) {
     if (!result.up) {
+      // The API probe failed on a port the scan found open: that says nothing about the port's liveness.
       return [{
         port: 8080,
         protocol: "tcp",
         service: "tribe-v2",
-        status: "down",
-        severity: SEVERITY.INFO,
         info: result.error,
+        tribeHealth: { state: "down", severity: SEVERITY.INFO, error: result.error ?? null, findings: [] },
         source: "tribe-health",
       }];
     }
 
-    const items = [];
+    // Individual findings grouped by category; only actionable ones (skip PASS and INFO in conclude).
+    // ZDE: no response bodies or header values in conclude output — classifications and issue descriptions only.
+    const findings = Object.entries(result.findings)
+      .flatMap(([category, issues]) => issues.map((i) => ({ ...i, category })))
+      .filter((f) => f.severity !== SEVERITY.PASS && f.severity !== SEVERITY.INFO)
+      .map((f) => ({ severity: f.severity, category: f.category, check: f.check, detail: f.detail }));
 
-    // Service identity item
-    items.push({
+    return [{
       port: 8080,
       protocol: "tcp",
       service: "tribe-v2",
       status: "open",
-      severity: result.overallSeverity,
       info: `API probe complete: ${result.summary.critical} critical, ${result.summary.high} high, ${result.summary.medium} medium findings`,
-      serverInfo: result.serverInfo,
+      tribeHealth: { state: "up", severity: result.overallSeverity, summary: result.summary, serverInfo: result.serverInfo, findings },
       source: "tribe-health",
       authoritative: true,
-    });
-
-    // Individual findings grouped by category
-    const allFindings = Object.entries(result.findings).flatMap(
-      ([category, issues]) => issues.map((i) => ({ ...i, category }))
-    );
-
-    // Only surface actionable items (skip PASS and INFO in conclude)
-    for (const f of allFindings) {
-      if (f.severity === SEVERITY.PASS || f.severity === SEVERITY.INFO) continue;
-
-      items.push({
-        port: 8080,
-        protocol: "tcp",
-        service: "tribe-v2",
-        severity: f.severity,
-        status: "action_required",
-        category: f.category,
-        check: f.check,
-        info: f.detail,
-        // ZDE: no response bodies or header values in conclude output.
-        // Only classifications and issue descriptions.
-        source: "tribe-health",
-      });
-    }
-
-    return items;
+    }];
   },
 };

package/plugins/060_dns_sec_auditor.mjs

@@ -842,6 +842,13 @@ export default {
 
   // ── Main Execution ──────────────────────────────────────────────────────
   async run(host, port, opts = {}) {
+    // 0.2.57: an IP LITERAL is DECLINED, with its reason on the plugin's status. Queried as a name it answers NXDOMAIN to
+    // every record type, and each absence became a finding (missing SPF / DMARC / NS at HIGH) on every default scan of
+    // an address. Only the literal is declined: a hostname that resolves to an address — localhost too — is a domain.
+    if (net.isIP(String(host)) !== 0) {
+      return { up: false, skipped: true,
+        reason: `DNS posture needs a domain name — ${host} is an IP address, which has no SPF, DMARC or NS records to audit` };
+    }
     const config = loadConfig(opts);
     const startTime = Date.now();
 
@@ -944,20 +951,29 @@ export default {
   },
 
   // ── Conclude ────────────────────────────────────────────────────────────
+  // 1.3.0: ONE record, its findings under `dnsSecurity`, ATTACH-ONLY. This audits a domain's DNS posture and runs on
+  // every scan, so it is not a port on the scanned host: it lands on a 53/udp record a port-level probe found, and
+  // otherwise becomes evidence. Its per-finding records carried NO port (they keyed to `dns:NaN`), and the summary
+  // wrote "DNS-Audit" / "v2" into identity and its verdict into the liveness field.
   conclude({ result, host }) {
     if (!result.findings) return [];
 
-    const items = [];
+    const findings = Object.entries(result.findings)
+      .flatMap(([category, issues]) => issues.map((i) => ({ ...i, category })))
+      .filter((f) => f.severity !== SEVERITY.PASS && f.severity !== SEVERITY.INFO)
+      .map((f) => ({ severity: f.severity, category: f.category, check: f.check, detail: f.detail }));
 
-    // Summary item
-    items.push({
+    return [{
       port: 53,
       protocol: "udp",
       service: "dns-security",
-      program: "DNS-Audit",
-      version: "v2",
-      status: result.summary.actionable > 0 ? "action_required" : "hardened",
-      severity: result.overallSeverity,
+      attachOnly: true,
+      dnsSecurity: {
+        status: result.summary.actionable > 0 ? "action_required" : "hardened",
+        severity: result.overallSeverity,
+        actionable: result.summary.actionable,
+        findings,
+      },
       info: [
         `${result.summary.actionable} actionable findings`,
         result.details.spfRecord ? "SPF present" : "SPF missing",
@@ -969,29 +985,7 @@ export default {
       ].join(" | "),
       source: "dns-sec-auditor",
       authoritative: false,
-    });
-
-    // Individual actionable findings
-    const allFindings = Object.entries(result.findings).flatMap(
-      ([category, issues]) => issues.map((i) => ({ ...i, category }))
-    );
-
-    for (const f of allFindings) {
-      if (f.severity === SEVERITY.PASS || f.severity === SEVERITY.INFO) continue;
-
-      items.push({
-        protocol: "dns",
-        service: "dns-security",
-        severity: f.severity,
-        status: "action_required",
-        category: f.category,
-        check: f.check,
-        info: f.detail,
-        source: "dns-sec-auditor",
-      });
-    }
-
-    return items;
+    }];
   },
 
   authoritativePorts: new Set(),

package/plugins/dns_scanner.mjs

@@ -202,11 +202,14 @@ function sendAxfrQuery(host, domain, port=53, timeoutMs=TIMEOUT){
     let done = false;
     const records = [];
 
-    const finish = (ok, info) => {
+    // `outcome` is what was MEASURED (1.3.0 (s3)): 'allowed' (records came back), 'refused' (an error RCODE, or TCP/53
+    // refused the connection — no transfer can be had), or 'no-answer' (a timeout, a TCP error, a parse error, a close with
+    // nothing received) — nothing was measured, and that is never "denied".
+    const finish = (ok, info, outcome = ok ? 'allowed' : 'no-answer') => {
       if (done) return;
       done = true;
       try { s.destroy(); } catch {}
-      resolve({ ok, info, records });
+      resolve({ ok, info, outcome, records });
     };
 
     const t = setTimeout(() => finish(false, 'AXFR timeout'), timeoutMs);
@@ -224,7 +227,7 @@ function sendAxfrQuery(host, domain, port=53, timeoutMs=TIMEOUT){
           const rr = parseResponse(msg);
           if (rr.rcode !== 0) {
             clearTimeout(t);
-            return finish(false, `AXFR refused (rcode=${rr.rcode})`);
+            return finish(false, `AXFR refused (rcode=${rr.rcode})`, 'refused');
           }
           records.push(...rr.answers);
           if (records.length > MAX_AXFR_RECORDS) {
@@ -237,7 +240,7 @@ function sendAxfrQuery(host, domain, port=53, timeoutMs=TIMEOUT){
         }
       }
     });
-    s.on('error', err => { clearTimeout(t); finish(false, String(err?.code || 'TCP error')); });
+    s.on('error', err => { clearTimeout(t); finish(false, String(err?.code || 'TCP error'), err?.code === 'ECONNREFUSED' ? 'refused' : 'no-answer'); });
     s.on('close', () => {
       clearTimeout(t);
       if (records.length > 0) finish(true, `AXFR success: ${records.length} records`);
@@ -325,24 +328,28 @@ export default {
       data.push(entry);
     }
 
-    // 4) AXFR zone transfer (opt-in via env)
+    // 4) AXFR zone transfer (opt-in via env). 1.3.0 (s3): `axfrTested` records whether it ran and MEASURED — true, or the
+    // reason it did not ('opt-in-off', 'no-domain', 'no-answer'); `axfrAllowed` is null unless a measurement was made.
     const checkAxfr = /^(1|true|yes|on)$/i.test(String(process.env.DNS_CHECK_AXFR || ''));
     const axfrDomain = String(process.env.DNS_AXFR_DOMAIN || opts.axfrDomain || '');
     let axfrAllowed = null;
+    let axfrTested = !checkAxfr ? 'opt-in-off' : !axfrDomain ? 'no-domain' : 'no-answer';
 
     if (checkAxfr && axfrDomain) {
       const axfrRes = await sendAxfrQuery(host, axfrDomain, targetPort, timeoutMs);
-      axfrAllowed = axfrRes.ok;
+      if (axfrRes.outcome !== 'no-answer') { axfrAllowed = axfrRes.outcome === 'allowed'; axfrTested = true; }
       data.push({
         probe_protocol: 'tcp',
         probe_port: targetPort,
         probe_service: 'dns',
-        probe_info: axfrRes.ok ? `AXFR ${axfrDomain} allowed` : `AXFR ${axfrDomain} denied`,
+        probe_info: axfrRes.outcome === 'allowed' ? `AXFR ${axfrDomain} allowed`
+          : axfrRes.outcome === 'refused' ? `AXFR ${axfrDomain} denied`
+            : `AXFR ${axfrDomain} not measured — ${axfrRes.info}`,
         response_banner: axfrRes.info
       });
     }
 
-    return { up, type:'dns', program, version, axfrAllowed, data };
+    return { up, type:'dns', program, version, axfrAllowed, axfrTested, data };
   }
 };
 
@@ -362,6 +369,7 @@ export async function conclude({ host, result }){
     version: result?.version || 'Unknown',
     status, info, banner,
     axfrAllowed: result?.axfrAllowed ?? null,
+    axfrTested: result?.axfrTested ?? null,
     source: 'dns',
     evidence: rows,
     authoritative: true