nsauditor-ai 0.2.56 → 1.0.0

package/cli.mjs

@@ -17,15 +17,18 @@ import { parseHostArg, parseHostFile } from './utils/host_iterator.mjs';
 import { buildSarifLog } from './utils/sarif.mjs';
 import { buildCsv } from './utils/export_csv.mjs';
 import { buildMarkdownReport } from './utils/report_md.mjs';
-import { recordScan, getLastScan, computeDiff, formatDiffReport, pruneForCE, HISTORY_FILE } from './utils/scan_history.mjs';
+import { conclusionFindings, maxRank, severityRank as flagSeverityRank, OPEN_SERVICE_SEVERITY } from './utils/service_flags.mjs';
+import { recordScan, getLastScan, computeDiff, formatDiffReport, pruneForCE, HISTORY_FILE, historyServiceEntry, historyHostEntry } from './utils/scan_history.mjs';
 import { aiBailMessage, computeAiTimeoutMs, aiFailureStubText, aiSummaryLine } from './utils/ai_stage.mjs';
 import { getTierFromEnv, loadLicense } from './utils/license.mjs';
 import { resolveCapabilities, hasCapability, inferRequiredTier, CAPABILITIES } from './utils/capabilities.mjs';
 import { createScheduler } from './utils/scheduler.mjs';
-import { buildDeltaReport, formatDeltaSummary, hasSignificantChanges } from './utils/delta_reporter.mjs';
-import { sendWebhook, buildAlertPayload, isSafeWebhookUrl } from './utils/webhook.mjs';
+import { watchCycle } from './utils/watch_cycle.mjs';
+import { redactSetCookieLines } from './utils/cookie_redaction.mjs';
+import { sendWebhook, buildAlertPayload, isSafeWebhookUrl, ALERT_PAYLOADS, NOTIFY_FORMATS, NOTIFY_PAYLOADS, NOTIFY_SEVERITIES } from './utils/webhook.mjs';
 import { scrubByKey } from './utils/redact.mjs';
-import { isBlockedIp, resolveAndValidate } from './utils/net_validation.mjs';
+import { isBlockedIp, resolveAndValidateAll, allowAllHosts, canonicalIp } from './utils/net_validation.mjs';
+import { runPinned } from './utils/scan_pin.mjs';
 import { getAllTechniques } from './utils/attack_map.mjs';
 import { TOOL_VERSION } from './utils/tool_version.mjs';
 import { resolveBaseOutDir, createHostOutDir, safeHost } from './utils/output_dir.mjs';
@@ -86,6 +89,34 @@ export function scrubIPv4KeepingProductIds(str, replaceAddress) {
  * to compare a raw against its payload, which needs the real function rather than a re-spelling
  * of its rules. `tests/redact_product_ids.test.mjs` is that census.
  */
+// ── AWS ACCOUNT IDs AND BARE 12-DIGIT IDS (EE 2.0.0) ──────────────────────────────────────────────────────────────────
+// Marketing task #204's real AWS run measured the account ID 20 times in one payload — bare, in bucket names, an SQS URL,
+// six SNS ARNs and an IAM user ARN — and the operator ruled "State it now, fix in 2.0.0". TWO PASSES, as the architect
+// seat ruled: (1) an ID found in a CERTAIN context — an ARN's account field in any partition, the account segment of an
+// `amazonaws.com/<12 digits>` URL — is an account, and every literal occurrence of it is masked as [ACCOUNT_ID], inside
+// resource names too (the names stay: remediation text that cannot name the bucket is useless to the customer); (2) any
+// OTHER bare 12-digit run is masked with a NEUTRAL label, [REDACTED_ID] — a 12-digit number in a router banner is not an AWS
+// account, so masking it is the safe direction and naming it would mislead the model and the auditor reading the payload.
+// tests/redact_aws_account_ids.test.mjs; the false-positive census is tests/redact_product_ids.test.mjs.
+export const ACCOUNT_ID_MASK = '[ACCOUNT_ID]';
+export const BARE_ID_MASK = '[REDACTED_ID]';
+const ARN_ACCOUNT_RE = /\barn:aws(?:-[a-z]+)*:[a-z0-9-]*:[a-z0-9-]*:(\d{12})(?=:)/gi;
+const URL_ACCOUNT_RE = /\bamazonaws\.com(?:\.cn)?\/(\d{12})(?!\d)/gi;
+const BARE_12_DIGIT_RE = /\b\d{12}\b/g;
+/** The AWS account IDs a payload carries in a CERTAIN context — ARN account fields and AWS URL segments, anywhere in it. */
+export function awsAccountIdsIn(input) {
+  const ids = new Set();
+  const visit = (v) => {
+    if (typeof v === 'string') {
+      for (const m of v.matchAll(ARN_ACCOUNT_RE)) ids.add(m[1]);
+      for (const m of v.matchAll(URL_ACCOUNT_RE)) ids.add(m[1]);
+    } else if (Array.isArray(v)) v.forEach(visit);
+    else if (v && typeof v === 'object') Object.values(v).forEach(visit);
+  };
+  visit(input);
+  return ids;
+}
+
 export function redactSensitiveForAI(input, targetHost) {
   const DROP_KEYS = new Set([
     'ip6', 'deviceWebPage', 'deviceWebPageInstruction',
@@ -97,14 +128,22 @@ export function redactSensitiveForAI(input, targetHost) {
     /^172\.(1[6-9]|2\d|3[0-1])\./.test(ip) ||
     /^192\.168\./.test(ip);
 
+  const accountIds = [...awsAccountIdsIn(input)];
+
   const scrubString = (str) => {
     let s = String(str);
+    for (const id of accountIds) s = s.split(id).join(ACCOUNT_ID_MASK);
     s = s.replace(/\bSerial\s*[:=]\s*[A-Za-z0-9._-]+/gi, 'Serial=[REDACTED_HIDDEN]');
     s = s.replace(/\b(?:[0-9a-f]{2}:){5}[0-9a-f]{2}\b/gi, '[MAC]'); // MAC
     s = s.replace(/\bfe80::[0-9a-f:]+\b/gi, '[FE80::/64]');         // IPv6 link-local
     s = s.replace(/\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\b/gi, '[IPv6]');
     // The shared rule; this call site's POLICY keeps private addresses and masks public ones.
     s = scrubIPv4KeepingProductIds(s, (ip) => (isPrivateV4(ip) ? ip : '[IP]'));
+    // A scanned service's Set-Cookie VALUE is its session token: redacted here whatever a producer kept (1.3.0, both
+    // seams ruled — the webapp detector still reflects its headers into the result).
+    s = redactSetCookieLines(s);
+    // LAST, so every rule above sees the input it always saw (a `Serial: <12 digits>` stays the serial rule's).
+    s = s.replace(BARE_12_DIGIT_RE, BARE_ID_MASK);
     return s;
   };
 
@@ -126,18 +165,117 @@ export function redactSensitiveForAI(input, targetHost) {
   return walk(input);
 }
 
+/**
+ * The payload the AI stage writes to scan_response_ai_payload.json and sends: every redaction step, in order, in ONE function
+ * that maybeSendToOpenAI calls, so the file IS this function's output and docs/openai.md's list is driven through the real
+ * pipeline (EE 2.0.0, the architect seat's S1 — a test that composed the rules with a policy spelled in the TEST proved the
+ * rules, never the call site).
+ */
+export function buildAIPayload({ host, hostOsHint = null, summary, results, conclusion, detectedSerial = null, redact = true, env = process.env }) {
+  let payloadForAI = {
+    host,
+    host_os_hint: hostOsHint,
+    summary, // include full; redactor will mask
+    services: conclusion?.result?.services ?? [],
+    evidence: conclusion?.result?.evidence ?? [],
+    _meta: {
+      resultsCount: Array.isArray(results) ? results.length : (results ? 1 : 0),
+      serialFound: !!detectedSerial
+    }
+  };
+
+  if (redact) {
+    // `_meta.redactor` names what ran: 'builtin', Community's redactor, the same at every tier. Until EE 2.0.0 a Pro-tier
+    // branch here deferred to a `globalThis.redactSensitiveForAI` hook that neither package installs, and the record started
+    // as 'fallback' and stayed there, so every normal run said "fallback" (marketing task #204, finding 3). The branch is
+    // deleted (the architect seat's ruling), and so is its retry: the redactor builds a new object and never modifies its
+    // input, so a second call on the same input throws again. A throw propagates to maybeSendToOpenAI, which has then written
+    // and sent nothing.
+    const used = 'builtin';
+    payloadForAI = redactSensitiveForAI(payloadForAI, host);
+
+    // additional key-based scrubbing (CONFIDENTIAL_KEYWORDS=serial,password,token)
+    const keywords = String(env.CONFIDENTIAL_KEYWORDS || '')
+      .split(',')
+      .map((s) => s.trim().toLowerCase())
+      .filter(Boolean);
+    if (keywords.length) payloadForAI = scrubByKey(payloadForAI, keywords, '[REDACTED_HIDDEN]');
+
+    // Redact top-level host field (private IPs survive scrubString)
+    if (typeof payloadForAI.host === 'string') {
+      payloadForAI.host = '[REDACTED_HOST]';
+    }
+
+    // Redact any remaining IP addresses in the summary field
+    if (typeof payloadForAI.summary === 'string') {
+      // ⚠️ THE SAME RULE, A DIFFERENT POLICY: every address goes, private ones included. It
+      // carried its own copy of the address regex — the copy that was NOT fixed when the
+      // identifier defect was found in the redactor, which is exactly how the second instance
+      // of a class arrives. Measured at the time: neither live payload's summary carries an
+      // `EE-` token, so this was a latent duplicate rather than a live defect.
+      payloadForAI.summary = scrubIPv4KeepingProductIds(payloadForAI.summary, () => '[REDACTED_HOST]');
+    }
+
+    // Also redact private IPs in nested service/evidence strings
+    const privateIpRe = /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b/g;
+    function scrubPrivateIps(obj) {
+      if (typeof obj === 'string') return obj.replace(privateIpRe, '[REDACTED_IP]');
+      if (Array.isArray(obj)) return obj.map(scrubPrivateIps);
+      if (obj && typeof obj === 'object') {
+        const out = {};
+        for (const [k, v] of Object.entries(obj)) out[k] = scrubPrivateIps(v);
+        return out;
+      }
+      return obj;
+    }
+    payloadForAI.services = scrubPrivateIps(payloadForAI.services);
+    payloadForAI.evidence = scrubPrivateIps(payloadForAI.evidence);
+
+    payloadForAI = { ...payloadForAI, _meta: { ...(payloadForAI?._meta || {}), wasRedacted: true, redactor: used } };
+  } else {
+    payloadForAI = { ...payloadForAI, _meta: { ...(payloadForAI?._meta || {}), wasRedacted: false } };
+  }
+
+  // Ensure placeholder only if a serial was detected
+  if (payloadForAI?._meta?.serialFound && detectedSerial) {
+    const s = String(payloadForAI.summary ?? '').trim();
+    if (!/\bSerial\s*[:=]/i.test(s)) {
+      payloadForAI.summary = `${s}  Serial: [REDACTED_HIDDEN]`;
+    } else {
+      payloadForAI.summary = s.replace(/\bSerial\s*[:=]\s*([A-Za-z0-9._-]+)/i, 'Serial: [REDACTED_HIDDEN]');
+    }
+  }
+
+  return payloadForAI;
+}
+
 /* ------------------------- OpenAI & reporting -------------------------- */
 
+/**
+ * The OpenAI model used when OPENAI_MODEL is unset (EE 2.0.0, marketing task #203 — the small model it named until then was a generation stale). Chosen on
+ * 2026-10-11 against OpenAI's own pages, read raw: https://developers.openai.com/api/docs/models lists `gpt-6-luna` as
+ * "Our most efficient model for focused, high-volume tasks" ($0.10 / $0.50 per MTok, 128K max output, 1.05M context), and
+ * https://developers.openai.com/api/docs/deprecations maps the previous small model (`gpt-5.4-nano`) to it. The request
+ * sends only `model` and `input`, so no parameter a newer model refuses rides with it.
+ */
+export const DEFAULT_OPENAI_MODEL = 'gpt-6-luna';
+
+/** The model the AI step asks for: the provider's own variable, or its default. */
+export function aiModelFor(env = process.env) {
+  const aiProvider = (env.AI_PROVIDER || 'openai').toLowerCase().trim();
+  return aiProvider === 'claude'
+    ? toCleanPath(env.ANTHROPIC_MODEL || 'claude-sonnet-4-6')
+    : aiProvider === 'ollama'
+    ? toCleanPath(env.OLLAMA_MODEL || 'llama3')
+    : toCleanPath(env.OPENAI_MODEL || DEFAULT_OPENAI_MODEL);
+}
+
 async function maybeSendToOpenAI({ host, results, conclusion, promptMode = 'basic', outDir: presetOutDir = null, runId = null, pluginStatus = [] }) {
   // --- env & opts -----------------------------------------------------------
   const sendEnabled   = parseBool(process.env.AI_ENABLED);
   const redactEnabled = parseBool(process.env.OPENAI_REDACT, true);
   const aiProvider    = (process.env.AI_PROVIDER || 'openai').toLowerCase().trim();
-  const model         = aiProvider === 'claude'
-    ? toCleanPath(process.env.ANTHROPIC_MODEL || 'claude-sonnet-4-6')
-    : aiProvider === 'ollama'
-    ? toCleanPath(process.env.OLLAMA_MODEL || 'llama3')
-    : toCleanPath(process.env.OPENAI_MODEL || 'gpt-4o-mini');
+  const model         = aiModelFor(process.env);
   const { resolveSecret } = await import('./utils/keychain.mjs');
   const keyRaw        = aiProvider === 'claude'
     ? await resolveSecret(process.env.ANTHROPIC_API_KEY)
@@ -158,6 +296,7 @@ async function maybeSendToOpenAI({ host, results, conclusion, promptMode = 'basi
   const adminRawPath   = path.join(outDir, 'scan_conclusion_raw.json');
   const adminHtmlPath  = path.join(outDir, 'scan_conclusion_raw.html');
   const aiPayloadPath  = path.join(outDir, 'scan_response_ai_payload.json');
+  const aiSystemPromptPath = path.join(outDir, 'scan_response_ai_system_prompt.txt');
   const aiResponsePath = path.join(outDir, 'scan_response_ai.json');
   const aiTxtPath      = path.join(outDir, 'scan_response_ai.txt');
   const aiHtmlPath     = path.join(outDir, 'scan_response_ai.html');
@@ -255,91 +394,8 @@ async function maybeSendToOpenAI({ host, results, conclusion, promptMode = 'basi
   }
 
   // --- Build sanitized payload for AI ---------------------------------------
-  let payloadForAI = {
-    host,
-    host_os_hint: hostOsHint,
-    summary: summaryWithFullSerial, // include full; redactor will mask
-    services: conclusion?.result?.services ?? [],
-    evidence: conclusion?.result?.evidence ?? [],
-    _meta: {
-      resultsCount: Array.isArray(results) ? results.length : (results ? 1 : 0),
-      serialFound: !!detectedSerial
-    }
-  };
-
-  if (redactEnabled) {
-    let used = 'fallback';
-    try {
-      // Only allow external redaction override for Pro/Enterprise tiers.
-      // CE always uses the built-in redact pipeline to preserve the ZDE guarantee.
-      const redactCaps = resolveCapabilities(getTierFromEnv());
-      if (hasCapability(redactCaps, 'enhancedRedaction') && typeof globalThis.redactSensitiveForAI === 'function') {
-        let out = globalThis.redactSensitiveForAI(payloadForAI);
-        if (out && typeof out.then === 'function') out = await out;
-        if (typeof out === 'string') out = JSON.parse(out);
-        if (!out || typeof out !== 'object') throw new Error('external redactor returned non-object');
-        payloadForAI = out;
-        used = 'external';
-      } else {
-        payloadForAI = redactSensitiveForAI(payloadForAI, host);
-      }
-    } catch (e) {
-      console.warn('[OpenAI] Redaction failed, using fallback:', e?.message || e);
-      payloadForAI = redactSensitiveForAI(payloadForAI, host);
-      used = 'fallback';
-    }
-
-    // additional key-based scrubbing (CONFIDENTIAL_KEYWORDS=serial,password,token)
-    const keywords = String(process.env.CONFIDENTIAL_KEYWORDS || '')
-      .split(',')
-      .map((s) => s.trim().toLowerCase())
-      .filter(Boolean);
-    if (keywords.length) payloadForAI = scrubByKey(payloadForAI, keywords, '[REDACTED_HIDDEN]');
-
-    // Redact top-level host field (private IPs survive scrubString)
-    if (typeof payloadForAI.host === 'string') {
-      payloadForAI.host = '[REDACTED_HOST]';
-    }
-
-    // Redact any remaining IP addresses in the summary field
-    if (typeof payloadForAI.summary === 'string') {
-      // ⚠️ THE SAME RULE, A DIFFERENT POLICY: every address goes, private ones included. It
-      // carried its own copy of the address regex — the copy that was NOT fixed when the
-      // identifier defect was found in the redactor, which is exactly how the second instance
-      // of a class arrives. Measured at the time: neither live payload's summary carries an
-      // `EE-` token, so this was a latent duplicate rather than a live defect.
-      payloadForAI.summary = scrubIPv4KeepingProductIds(payloadForAI.summary, () => '[REDACTED_HOST]');
-    }
-
-    // Also redact private IPs in nested service/evidence strings
-    const privateIpRe = /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})\b/g;
-    function scrubPrivateIps(obj) {
-      if (typeof obj === 'string') return obj.replace(privateIpRe, '[REDACTED_IP]');
-      if (Array.isArray(obj)) return obj.map(scrubPrivateIps);
-      if (obj && typeof obj === 'object') {
-        const out = {};
-        for (const [k, v] of Object.entries(obj)) out[k] = scrubPrivateIps(v);
-        return out;
-      }
-      return obj;
-    }
-    payloadForAI.services = scrubPrivateIps(payloadForAI.services);
-    payloadForAI.evidence = scrubPrivateIps(payloadForAI.evidence);
-
-    payloadForAI = { ...payloadForAI, _meta: { ...(payloadForAI?._meta || {}), wasRedacted: true, redactor: used } };
-  } else {
-    payloadForAI = { ...payloadForAI, _meta: { ...(payloadForAI?._meta || {}), wasRedacted: false } };
-  }
-
-  // Ensure placeholder only if a serial was detected
-  if (payloadForAI?._meta?.serialFound && detectedSerial) {
-    const s = String(payloadForAI.summary ?? '').trim();
-    if (!/\bSerial\s*[:=]/i.test(s)) {
-      payloadForAI.summary = `${s}  Serial: [REDACTED_HIDDEN]`;
-    } else {
-      payloadForAI.summary = s.replace(/\bSerial\s*[:=]\s*([A-Za-z0-9._-]+)/i, 'Serial: [REDACTED_HIDDEN]');
-    }
-  }
+  const payloadForAI = buildAIPayload({ host, hostOsHint, summary: summaryWithFullSerial, results, conclusion, detectedSerial,
+    redact: redactEnabled });
 
   // --- Bail out early if sending disabled -----------------------------------
   const providerLabel = aiProvider === 'claude' ? 'Claude' : aiProvider === 'ollama' ? 'Ollama' : 'OpenAI';
@@ -374,6 +430,17 @@ async function maybeSendToOpenAI({ host, results, conclusion, promptMode = 'basi
   const eeBlock = conclusion?.result?.eeEnrichment?.enrichedPrompt;
   if (eeBlock) promptText = eeBlock + '\n\n---\n\n' + promptText;
 
+  // --- Write the SYSTEM PROMPT we plan to send, beside the payload (EE 2.0.0, marketing task #204 finding 2) ---
+  // On Pro and Enterprise the intelligence block above travels here, not in the payload, so the payload file alone was not
+  // the record of what left the machine. Written BEFORE the request, as the payload is: the two files together are the
+  // request's content (the model name and the key are the rest).
+  try {
+    await fsp.writeFile(aiSystemPromptPath, promptText, 'utf8');
+    console.log(`[${providerLabel}] Wrote AI system prompt:`, aiSystemPromptPath);
+  } catch (e) {
+    console.warn(`[${providerLabel}] Failed to write AI system prompt:`, e?.message || e);
+  }
+
   // --- Send to AI provider ---------------------------------------------------
   let aiConclusionText = null;
   // review fold 8: contain the serialization — hoisting userContent above the
@@ -718,6 +785,51 @@ export async function parseArgs(argv) {
   }
   const alertSev = get('alert-severity') || get('alert_severity') || null;
   args.alertSeverity = (alertSev && alertSev !== true) ? alertSev.toLowerCase() : 'high';
+  // R4: by default a watch cycle alerts only hosts whose scan CHANGED; this restores an alert on every cycle.
+  args.alertEveryCycle = !!(get('alert-every-cycle') || get('alert_every_cycle'));
+
+  // ── EE 2.0.0 (cargo 3, D3/D5): the drift notification and the watch alert's payload mode ─────────────────────────
+  // Every refusal THROWS with code EFLAGVALUE (mapped to exit 2 at the entry point), never `process.exit`: parseArgs is
+  // exported and driven in-process by the suite, and an exit here kills the runner mid-file (the EFLAGSHAPE lesson).
+  const flagValue = (msg) => Object.assign(new Error(msg), { code: 'EFLAGVALUE' });
+  const oneOf = (flag, allowed, dflt) => {
+    const v = get(flag);
+    if (v === undefined) return dflt;
+    if (v === true || !allowed.includes(String(v).toLowerCase())) throw flagValue(`--${flag} must be one of ${allowed.join(' | ')}`);
+    return String(v).toLowerCase();
+  };
+  const notifyUrl = get('notify-webhook');
+  if (notifyUrl === true) throw flagValue('--notify-webhook requires a URL');
+  args.notifyFormat = oneOf('notify-format', NOTIFY_FORMATS, null);
+  args.notifySeverity = oneOf('notify-severity', NOTIFY_SEVERITIES, null);
+  args.notifyPayload = oneOf('notify-payload', NOTIFY_PAYLOADS, null);
+  if (notifyUrl === undefined) {
+    const stray = [['notify-format', args.notifyFormat], ['notify-severity', args.notifySeverity], ['notify-payload', args.notifyPayload]]
+      .filter(([, v]) => v !== null).map(([f]) => `--${f}`);
+    if (stray.length) throw flagValue(`${stray.join(', ')} configure the drift notification and need --notify-webhook <url>`);
+    args.notifyWebhook = null;
+  } else {
+    if (args.watch) {
+      throw flagValue('--notify-webhook sends the drift file of a ONE-SHOT scan, and --watch writes none; '
+        + 'watch-mode alerts use --webhook-url');
+    }
+    // https ONLY (the architect seat's read, F3): the URL is a credential and the body is scan content, so neither
+    // crosses the network in the clear. --webhook-url is unchanged.
+    let notifyProtocol = null;
+    try { notifyProtocol = new URL(notifyUrl).protocol; } catch { /* not a URL — the SSRF check below refuses it */ }
+    if (notifyProtocol === 'http:') {
+      throw flagValue('--notify-webhook must be an https URL: it carries its own credential, and the drift it sends is scan content');
+    }
+    // The SAME boundary check --webhook-url gets: public destinations only, DNS-resolved.
+    if (!(await isSafeWebhookUrl(notifyUrl))) {
+      throw flagValue('--notify-webhook rejected: private/loopback/metadata addresses are not allowed');
+    }
+    args.notifyWebhook = notifyUrl;
+  }
+  args.alertPayload = oneOf('alert-payload', ALERT_PAYLOADS, 'full');
+  if (get('alert-payload') !== undefined && !args.webhookUrl) {
+    throw flagValue('--alert-payload shapes the --watch webhook alert and needs --webhook-url <url>');
+  }
 
   // Compliance: framework selector + scope file. Forwarded to EE's
   // runCompliancePhase via enrichScan(). No-op without an EE Enterprise license.
@@ -858,6 +970,16 @@ export async function parseArgs(argv) {
  * @param {{ cmd?: string, host?: string|true, hostFile?: string }} args  parseArgs' result
  * @returns {{ message: string, code: number }|null}
  */
+/**
+ * EE 2.0.0: --notify-webhook sends the drift of a COMPLIANCE scan, so a run with no framework — from --compliance or
+ * from COMPLIANCE_FRAMEWORKS, which --env may have loaded — would accept the flag and send nothing, ever. Refused.
+ */
+export function notifyRefusal({ notifyWebhook, compliance, envCompliance } = {}) {
+  if (!notifyWebhook || compliance || envCompliance) return null;
+  return { code: 2, message: 'Fatal: --notify-webhook sends the drift file of a compliance scan; name a framework '
+    + 'with --compliance (or COMPLIANCE_FRAMEWORKS)' };
+}
+
 export function scanTargetRefusal({ cmd, host, hostFile } = {}) {
   if (cmd !== 'scan') return { message: `Unknown command: ${cmd}`, code: 2 };
   if (!hostFile && !host) return { message: 'Fatal: --host or --host-file is required', code: 2 };
@@ -879,30 +1001,56 @@ export function scanTargetRefusal({ cmd, host, hostFile } = {}) {
 // rather than per scanSingleHost() call (reviewer L1 fold).
 const CLOUD_SENTINEL_HOSTS = new Set(['aws', 'gcp', 'azure']);
 
-async function scanSingleHost(pm, host, plugins, opts, promptMode) {
-  // SSRF guard — block loopback, private ranges, cloud metadata endpoints.
-  // Set NSA_ALLOW_ALL_HOSTS=1 to scan RFC 1918 / private ranges (local network auditing).
-  // Cloud-sentinel hosts (see CLOUD_SENTINEL_HOSTS above) skip the guard.
+/**
+ * The CLI's scan-target SSRF guard (exported so tests drive the REAL code — 1.3.0 lane 1 E).
+ * Cloud sentinels (aws/gcp/azure) skip it. NSA_ALLOW_ALL_HOSTS (1/true/yes/on only) lifts the WHOLE
+ * guard on the CLI, loopback and metadata included — documented, and the local-network smoke tests
+ * scan loopback that way. Otherwise a literal is classified by value in any spelling, and anything
+ * that is not a literal is resolved with EVERY answer checked. Before 1.3.0 a digits-and-dots string
+ * skipped resolution (/^[\\d.:[\\]]+$/), so '6425673729' — which the OS reads as 127.0.0.1 — was
+ * scanned unchecked.
+ *
+ * PINNED SINCE EE 2.0.0 (R1b — the operator's ruling "CLI pins too"): it RETURNS the answer set it resolved, and
+ * scanSingleHost runs the plugins inside `runPinned` with it, so the scan connects to the addresses this check looked at.
+ * NSA_ALLOW_ALL_HOSTS relaxes WHICH answers are admitted, never whether one may change between the check and the connect:
+ * under it the name is resolved WITHOUT a refusal and still pinned (an unresolvable name scans unpinned, as before).
+ * @param {string} host
+ * @param {Record<string,string|undefined>} [env]
+ * @returns {Promise<Array<{ address: string, family: 4|6 }> | null>} the answers to pin; null for a literal or a sentinel
+ */
+export async function assertScanTargetAllowed(host, env = process.env) {
   const isCloudSentinel = typeof host === 'string' && CLOUD_SENTINEL_HOSTS.has(host.toLowerCase());
-
-  if (!process.env.NSA_ALLOW_ALL_HOSTS && !isCloudSentinel) {
-    if (isBlockedIp(host)) {
-      throw new Error(`Scanning blocked address range is not allowed: ${host}`);
-    }
-    // Hostname (not literal IP) — resolve and validate the resolved address
-    if (!/^[\d.:[\]]+$/.test(host)) {
-      try {
-        await resolveAndValidate(host);
-      } catch (err) {
-        throw new Error(`Host rejected by SSRF guard: ${err.message}`);
-      }
+  if (isCloudSentinel) return null;
+  if (allowAllHosts(env)) {
+    if (canonicalIp(host)) return null;
+    try { return await resolveAndValidateAll(host, { checkAnswers: false }); } catch { return null; }
+  }
+  if (isBlockedIp(host)) {
+    throw new Error(`Scanning blocked address range is not allowed: ${host}`);
+  }
+  if (!canonicalIp(host)) {
+    try {
+      return await resolveAndValidateAll(host);
+    } catch (err) {
+      throw new Error(`Host rejected by SSRF guard: ${err.message}`);
     }
   }
+  return null;
+}
+
+export async function scanSingleHost(pm, host, plugins, opts, promptMode) {
+  // SSRF guard — block loopback, private ranges, cloud metadata endpoints.
+  // NSA_ALLOW_ALL_HOSTS=1 lifts this whole guard for local network auditing — loopback and metadata included (the MCP
+  // server's guard admits private ranges only).
+  // Cloud-sentinel hosts (see CLOUD_SENTINEL_HOSTS above) skip the guard.
+  const answers = await assertScanTargetAllowed(host);
 
   // `manifest` classifies every selected plugin as ran|skipped|timeout|error with a reason.
   // Discarding it is what makes "no findings" ambiguous between a clean estate and one whose
   // plugins never loaded — see utils/run_record.mjs.
-  const { results, conclusion, manifest: pluginStatus = [] } = await pm.run(host, plugins || 'all', opts);
+  // R1b: the plugins connect to the addresses the check resolved (utils/scan_pin.mjs), never to a second answer.
+  const { results, conclusion, manifest: pluginStatus = [] } = await runPinned(answers ? { [host]: answers } : null,
+    () => pm.run(host, plugins || 'all', opts));
 
   // Enrich conclusion with MITRE ATT&CK technique mapping
   const techniques = getAllTechniques(conclusion);
@@ -993,6 +1141,18 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
       // delta as findings RESOLVED — measured on a live run, three such rows.
       pluginStatus,
       onWarn: (msg) => console.warn(`[EE] ${msg}`),
+      // EE 2.0.0 (the drift file). The run id and the root the run records are written under (the SAME resolver
+      // `appendHostWritten` below uses), so EE compares with the run `report --since prior` names; and `watch`, true
+      // only from the watch loop, where EE writes no drift file. Pinned by tests/ee_drift_forwarding.test.mjs.
+      runId: opts?.runId ?? null,
+      runRecordRoot: resolveBaseOutDir(),
+      watch: opts?.watch === true,
+      // EE 2.0.0 (cargo 3, D3/D4): the opt-in drift notification, forwarded verbatim; EE validates every value again
+      // and sends only on a compared drift that crossed a trigger. Pinned by tests/cli_notify_flags.test.mjs.
+      notifyWebhook: opts?.notifyWebhook ?? null,
+      notifyFormat: opts?.notifyFormat ?? null,
+      notifySeverity: opts?.notifySeverity ?? null,
+      notifyPayload: opts?.notifyPayload ?? null,
     }) : null;
     hostScopeScanned = eeEnrichment?.scopeScanned ?? null;
     // ⚠️ Read from `exploitIntel.stores`, NOT a top-level `exploit` key — measured against
@@ -1034,6 +1194,9 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
 
   // --- Scan history: record & compare ---
   let scanDiff = null;
+  // The per-host summary [ScanHistory] records — also what a --watch cycle compares (1.3.0 items 4 + 11). Null when the
+  // history step failed before building it; the watch delta reads null as NOT COMPARED, never as an empty scan.
+  let scanSummary = null;
   // Whether THIS host actually landed in the run record's `hostsWritten` — distinct from
   // whether the scan itself succeeded. `appendHostWritten` can fail independently (a
   // malformed argument, a disk fault) while the rest of the scan completes cleanly, and the
@@ -1107,15 +1270,8 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
     }
 
     const services = conclusion?.result?.services ?? [];
-    const serviceFindingsCount = services.reduce((n, svc) => {
-      if (svc.anonymousLogin === true) n++;
-      if (svc.axfrAllowed === true) n++;
-      if (Array.isArray(svc.weakAlgorithms)) n += svc.weakAlgorithms.length;
-      if (Array.isArray(svc.dangerousMethods)) n += svc.dangerousMethods.length;
-      const cves = svc.cves || svc.cve || [];
-      if (Array.isArray(cves)) n += cves.length;
-      return n;
-    }, 0);
+    // The legacy fallback's service share, graded by the shared service-flag table (1.3.0 (s1)) like every other reader.
+    const serviceFindingsCount = conclusionFindings(conclusion, host).length;
     // review fold R-1: cloud plugins emit findings on `results[].result.findings`,
     // NOT as service-level attrs — so a cloud (--host aws) scan recorded
     // findingsCount:0 in scan_history over a 201-finding scan (a false-clean
@@ -1155,7 +1311,7 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
         + 'legacy sum and marking the line as un-based, so no comparison is made across it.');
     }
 
-    const scanSummary = {
+    scanSummary = {
       timestamp: new Date().toISOString(),
       host,
       servicesCount: services.length,
@@ -1171,10 +1327,9 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
       // unreachable in production while its unit tests stay green.
       tier: getTierFromEnv(),
       cloudFindingsCount,
-      services: services.map((s) => ({
-        port: s.port, protocol: s.protocol ?? 'tcp',
-        service: s.service ?? null, version: s.version ?? null,
-      })),
+      services: services.map(historyServiceEntry),
+      // 1.3.0 (s1) B: the basis stamp and the host-level service checks (a domain's DNS posture, wherever it landed).
+      ...historyHostEntry(conclusion),
     };
 
     // Retrieve previous scan for this host before recording the new one
@@ -1201,6 +1356,11 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
     host, results, conclusion, ai_file_paths, ai_conclusion, ai_status, ai_error, scanDiff,
     // Additive, consumed only by main()'s top-level KEV/EPSS aggregation for the run record.
     hostAppended, kevDataAsOf, epssDataAsOf, nvdCache,
+    // Additive (1.3.0 items 4 + 11): what a --watch cycle compares, host by host.
+    scanSummary,
+    // Additive (1.3.0 build 4, Gate 3-A F-1): the plugin manifest, so the Markdown report says an audit that did not run
+    // — 060's decline of an IP address — the same way scan_host's does. The run record already carries it.
+    pluginStatus,
   };
 }
 
@@ -1241,13 +1401,6 @@ function aggregateStoreLoad(writtenOutputs, field, label) {
 
 const SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
 
-/**
- * Determine the maximum severity level present in a conclusion's services.
- * Checks security findings (anonymousLogin, axfrAllowed, weakAlgorithms,
- * dangerousMethods, CVEs) as well as open service status.
- * @param {object} conclusion
- * @returns {number} highest severity rank found (0-4)
- */
 async function readSecretFromStdin(keyName) {
   if (!process.stdin.isTTY) {
     // Piped input
@@ -1269,33 +1422,18 @@ async function readSecretFromStdin(keyName) {
   });
 }
 
+/**
+ * The highest severity rank (0-4) among the findings a conclusion carries — the `--fail-on` gate.
+ * @param {object} conclusion
+ * @returns {number} highest severity rank found (0-4); any concluded scan is at least info (0)
+ */
 export function maxSeverityInConclusion(conclusion) {
-  const services = conclusion?.result?.services || [];
-  let max = 0;
-
-  for (const svc of services) {
-    // anonymousLogin or axfrAllowed → Critical
-    if (svc.anonymousLogin === true) max = Math.max(max, SEVERITY_RANK.critical);
-    if (svc.axfrAllowed === true) max = Math.max(max, SEVERITY_RANK.critical);
-
-    // weakAlgorithms or dangerousMethods → Medium
-    if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length > 0) max = Math.max(max, SEVERITY_RANK.medium);
-    if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length > 0) max = Math.max(max, SEVERITY_RANK.medium);
-
-    // CVEs
-    const cves = svc.cves || svc.cve || [];
-    if (Array.isArray(cves)) {
-      for (const cve of cves) {
-        const sev = typeof cve === 'string' ? 'high' : String(cve?.severity || 'high').toLowerCase();
-        max = Math.max(max, SEVERITY_RANK[sev] ?? SEVERITY_RANK.high);
-      }
-    }
-
-    // Open service → Info (baseline)
-    if (svc.status === 'open') max = Math.max(max, SEVERITY_RANK.info);
-  }
-
-  return max;
+  // Every grade comes from the shared service-flag table (utils/service_flags.mjs, 1.3.0 (s1)) — the gate reads what the
+  // Markdown report, SARIF and the CSV read, including a payload that landed in the conclusion's evidence. An open service
+  // is graded OPEN_SERVICE_SEVERITY, the grade SARIF gives it ((s2)); any concluded scan is at least info.
+  const open = (conclusion?.result?.services || []).some((s) => s.status === 'open');
+  return Math.max(SEVERITY_RANK.info, open ? flagSeverityRank(OPEN_SERVICE_SEVERITY) : -1,
+    maxRank(conclusionFindings(conclusion, '')));
 }
 
 /**
@@ -1637,7 +1775,7 @@ export async function runReport(args, caps) {
 
 export async function main(testHooks = {}) {
   const args = await parseArgs(process.argv);
-  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, complianceHistory, slaPolicy, attestWindow, framework, awsRegion, approvalArgs, feedArgs } = args;
+  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, alertEveryCycle, alertPayload, notifyWebhook, notifyFormat, notifySeverity, notifyPayload, ports, compliance, complianceScope, complianceHistory, slaPolicy, attestWindow, framework, awsRegion, approvalArgs, feedArgs } = args;
 
   // Version: handled before license verification so it works without a key.
   // CE-0.1.30.1 — closes the discovery-flag UX gap where pre-fix
@@ -1676,32 +1814,57 @@ Scan options:
                                region-scoped checks use AWS_REGION, else one region (with an
                                incomplete-coverage notice); CloudTrail trail discovery,
                                GuardDuty/Inspector and EC2 instances attempt every region.
-  --plugins <list|all>         Plugins to run (e.g. 001,003,020 or "all"; default: all)
+  --plugins <list|all>         Plugins to run (e.g. 001,003,011 or "all"; default: all)
   --ports <list>               Ports ADDED to the default set (e.g. 22,80,443 or 161/udp;
                                a range such as 1-1000 is not parsed and adds nothing)
   --out <dir>                  Output directory for scan artifacts
   --parallel <n>               Parallel host concurrency (default 1)
-  --fail-on <severity>         Exit 1 if a gated flag ≥ severity: anonymous FTP / zone
-                               transfer (critical; tested only with FTP_CHECK_ANON /
-                               DNS_CHECK_AXFR set), weak SSH algorithms (medium); any
-                               concluded scan is info. Dangerous HTTP methods are read
-                               but never reach the conclusion today. Not SNMP community,
-                               weak TLS, MCP checks, CVEs or agent findings — exit 0 is
-                               not a clean host. Exit 2: unknown severity or no conclusion.
+  --fail-on <severity>         Exit 1 if a finding ≥ severity — the findings the md /
+                               SARIF / CSV reports count, graded by one shared table:
+                               SNMP default community, weak SSH / TLS, MCP checks, SMB
+                               null session, self-signed / expired certificates, the
+                               040 / 050 / 060 audits (060: the domain's SPF / DMARC /
+                               NS), and Dangerous HTTP methods (medium) only where an
+                               Allow header was read. Anonymous FTP / zone transfer /
+                               null session only with FTP_CHECK_ANON / DNS_CHECK_AXFR
+                               or DNS_AUDIT_AXFR_CHECK (060) / SMB_NULL_SESSION set;
+                               not tested never trips it; any concluded scan is info.
+                               Not CVEs or agent findings — exit 0 is not a clean host.
+                               Exit 2: unknown severity or no conclusion.
   --output-format <fmt>        Additional report format: sarif | csv | md
   --insecure-https             Skip TLS validation on probed HTTPS targets
-  --watch                      CTEM continuous ALERTING mode: re-scan on --interval,
-                               compare each host with its previous scan ([ScanHistory]
-                               lines); --webhook-url does NOT fire on a service, version or
-                               finding change in this release. NOT an evidence cadence —
+  --watch                      CTEM continuous ALERTING mode: re-scan on --interval and
+                               compare each host with the previous cycle. --webhook-url
+                               alerts a host whose scan changed (a service, its finding
+                               count or a service check, or a comparison that could not be
+                               made) and that has a finding at or above --alert-severity.
+                               The first cycle sets the baseline and alerts nobody; a host
+                               whose scan failed is reported on stdout and does not alert in
+                               this release. NOT an evidence cadence —
                                it adds no retention or cross-run aggregation, skips SARIF/
                                CSV/Markdown output and --fail-on, and dies with this process.
                                Each tick is an ordinary scan, so with --compliance it writes
                                that tick's artifacts; nothing relates them across ticks. For
                                SOC 2 Type II history use a scheduler (cron/systemd/CI).
+                               Watch mode scans each distinct host once per cycle; a
+                               one-shot --host X,X scans X twice.
   --interval <minutes>         Watch interval (default 60)
   --webhook-url <url>          Send --watch alerts (must be public; private/loopback blocked)
   --alert-severity <sev>       Min severity to alert on (default: high)
+  --alert-every-cycle          Alert every host with a finding at or above --alert-severity
+                               on every --watch cycle, the first included (default: only
+                               hosts whose scan changed)
+  --alert-payload <mode>       full (default) | minimal — minimal drops the host, service and
+                               description from each --watch alert
+  --notify-webhook <url>       Enterprise, one-shot scans with --compliance only (never --watch):
+                               POST the scan's drift (scan_drift_<fw>.json) when a control goes
+                               to fail, a control loses measurement, or a new violation is at or
+                               above --notify-severity. Public https URLs only; off by default
+  --notify-format <fmt>        generic (default) | slack | teams (a Teams Workflows webhook)
+  --notify-severity <sev>      critical | high (default) | medium | low | info — for new
+                               violations only
+  --notify-payload <mode>      minimal (default: no hostnames, resources, account ids or
+                               finding text) | full
   --compliance <framework>     Map findings to controls. 'all' = all 8 frameworks, or a CSV of
                                soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171
                                (aliases nist/pci/iso/cis, and 800-171 or cmmc for nist-800-171 --
@@ -1810,7 +1973,9 @@ Environment:
   NSA_MCP_AUTH_KEY               MCP server auth key — read by mcp_server at startup;
                                  client supplies via Claude Desktop config env block
   NSA_MCP_AUTH_DISABLE=1         Skip MCP auth check (CI/dev escape hatch — emits warn)
-  NSA_ALLOW_ALL_HOSTS=1          Permit RFC1918 / loopback (local-network auditing)
+  NSA_ALLOW_ALL_HOSTS=1          Local-network auditing. CLI: lifts the whole scan-entry
+                                 guard, loopback and metadata included. MCP server:
+                                 admits RFC 1918 / CGNAT / fc00::/7 only
   CLOUD_PROVIDER=aws|gcp|azure   Required for cloud scanner plugins (020/021/022/023/030)
   AI_PROVIDER=openai|claude|ollama   AI provider for report generation
   NSAUDITOR_TSA_URL              RFC 3161 timestamp authority for compliance attestation.
@@ -2690,30 +2855,45 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
         }
       }
     } else if (subCmd === 'verify-call') {
-      // CE 0.1.36 (Thread L Phase 2): cryptographic ground truth for
-      // "did Claude actually call the MCP server, or hallucinate a
-      // response?" Server mints a fresh UUID per tools/call, embeds it
-      // in the response text, AND appends to ~/.nsauditor/mcp-calls.log.
-      // Customer pastes the UUID here; we grep the log. UUID present →
-      // proven real call. UUID absent → fabricated (or log was rotated/
-      // deleted; we say "unverifiable" rather than "fake").
+      // 1.3.0 (s6): BIND THE RESPONSE TEXT, not only the id. The server logs each call's id and a digest of the response
+      // body (utils/mcp_call_digest.mjs); this recomputes the digest from the text the user saved. The id alone proves
+      // only that the server issued it once — an AI client that has seen an earlier response can paste a real id under
+      // a fabricated one — so an id with no text is INDETERMINATE, never "verified".
+      // Exit: 0 verified · 1 refuted (never issued, or the text does not match) · 2 usage · 3 indeterminate.
       const { readFile, stat } = await import('node:fs/promises');
       const { join: _join } = await import('node:path');
       const { homedir: _homedir } = await import('node:os');
+      const { responseDigest, bodyOf } = await import('./utils/mcp_call_digest.mjs');
       const logPath = _join(_homedir(), '.nsauditor', 'mcp-calls.log');
       const uuid = rawArgs[2];
-      if (!uuid) {
-        console.error('Usage: nsauditor-ai mcp verify-call <uuid>');
-        console.error('  Paste the call_id from the MCP tool response footer.');
+      const respAt = rawArgs.indexOf('--response');
+      const respPath = respAt > 0 ? rawArgs[respAt + 1] : null;
+      if (!uuid || (respAt > 0 && !respPath)) {
+        console.error('Usage: nsauditor-ai mcp verify-call <uuid> --response <file|->');
+        console.error('  Save the whole tool response (footer included) to a file, or pipe it in with --response -.');
         process.exit(2);
       }
-      // Conservative UUID v4 shape check — avoid grepping the log with
-      // arbitrary user input.
+      // Conservative UUID v4 shape check — avoid grepping the log with arbitrary user input.
       if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(uuid)) {
         console.error(`✗ Not a valid UUID: ${uuid}`);
         console.error('  Expected format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx');
         process.exit(2);
       }
+      let responseText = null;
+      if (respPath) {
+        try {
+          if (respPath === '-') {
+            const chunks = [];
+            for await (const c of process.stdin) chunks.push(c);
+            responseText = Buffer.concat(chunks).toString('utf8');
+          } else {
+            responseText = await readFile(respPath, 'utf8');
+          }
+        } catch (err) {
+          console.error(`✗ Could not read the response from ${respPath}: ${err.message}`);
+          process.exit(2);
+        }
+      }
       let logExists = false;
       try { await stat(logPath); logExists = true; } catch { /* missing */ }
       if (!logExists) {
@@ -2726,33 +2906,50 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       const raw = await readFile(logPath, 'utf8');
       // Look for an exact JSON-string match on call_id to avoid prefix collisions.
       const needle = `"call_id":"${uuid.toLowerCase()}"`;
-      const lines = raw.split('\n').filter((l) => l.includes(needle));
-      if (lines.length === 0) {
+      const entries = raw.split('\n').filter((l) => l.includes(needle))
+        .map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+      if (entries.length === 0) {
         console.log(`✗ call_id not found in ${logPath}`);
         console.log('');
         console.log(`  ${uuid}`);
         console.log('');
         console.log('  This UUID was NOT issued by this MCP server. Most likely cause:');
-        console.log('  Claude Desktop fabricated the response without invoking the server.');
-        console.log('  (See README §"Verifying that Claude actually called the MCP server".)');
+        console.log('  the AI client fabricated the response without invoking the server.');
+        console.log('  (See docs/mcp-verification.md.)');
         process.exit(1);
       }
-      try {
-        const entry = JSON.parse(lines[lines.length - 1]);
-        console.log(`✓ Verified MCP call`);
-        console.log(`  call_id: ${entry.call_id}`);
-        console.log(`  tool:    ${entry.tool}`);
-        console.log(`  ts:      ${entry.ts}`);
-        console.log(`  log:     ${logPath}`);
-        console.log('');
-        console.log('  This UUID was issued by the local MCP server, so the response');
-        console.log('  bearing it was a genuine tool call (not a hallucination).');
-        process.exit(0);
-      } catch {
-        console.log(`✓ Verified MCP call (matched ${lines.length} log line(s) for this UUID)`);
+      const issued = entries.find((e) => e.tool) ?? entries[0];
+      const ago = (() => {
+        const ms = Date.now() - Date.parse(issued.ts ?? '');
+        if (!Number.isFinite(ms)) return 'at an unrecorded time';
+        const units = [['day', 86400000], ['hour', 3600000], ['minute', 60000]];
+        for (const [u, n] of units) if (ms >= n) { const k = Math.floor(ms / n); return `${k} ${u}${k === 1 ? '' : 's'} ago`; }
+        return 'less than a minute ago';
+      })();
+      const issuedLine = `${issued.tool ?? 'an unrecorded tool'}, issued ${ago} (${issued.ts ?? 'no timestamp'})`;
+      const digests = entries.map((e) => e.digest).filter((d) => typeof d === 'string');
+      if (digests.length === 0) {
+        console.log(`? call_id ${uuid} was issued by this server for ${issued.tool ?? 'an unrecorded tool'} ${ago} (${issued.ts ?? 'no timestamp'}).`);
+        console.log('  This call predates response binding: no digest of its response was recorded, so the text');
+        console.log('  cannot be bound to it. The id alone does not verify a response.');
+        process.exit(3);
+      }
+      if (responseText == null) {
+        console.log(`? call_id ${uuid} was issued by this server for ${issued.tool ?? 'an unrecorded tool'} ${ago} (${issued.ts ?? 'no timestamp'}).`);
+        console.log('  That alone does not verify the text you are reading: an id from an earlier response can be');
+        console.log('  pasted under a fabricated one. Save the raw tool response and run:');
+        console.log(`    nsauditor-ai mcp verify-call ${uuid} --response <file>`);
+        process.exit(3);
+      }
+      if (digests.includes(responseDigest(bodyOf(responseText)))) {
+        console.log(`✓ This response text was produced by this server for that call — ${issuedLine}.`);
         console.log(`  log: ${logPath}`);
         process.exit(0);
       }
+      console.log(`✗ The text does not match what this server sent for that call (${issuedLine}).`);
+      console.log('  Either it was altered after copying (rendering, re-wrapping) or it was not produced by this');
+      console.log('  call — re-copy the RAW tool output and verify again.');
+      process.exit(1);
     } else {
       console.log('Usage:');
       console.log('  nsauditor-ai mcp install-key            Generate a new key, persist, print Claude config');
@@ -2761,7 +2958,7 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       console.log('  nsauditor-ai mcp rotate-key             Replace the stored key with a fresh one');
       console.log('  nsauditor-ai mcp status                 Show storage source without revealing the key');
       console.log('  nsauditor-ai mcp tier                   Print actual MCP server tier (ground truth, bypasses Claude AI synthesis)');
-      console.log('  nsauditor-ai mcp verify-call <uuid>     Prove a tool response came from the real MCP server (not Claude hallucination)');
+      console.log('  nsauditor-ai mcp verify-call <uuid> --response <file|->   Check that a saved tool response is the text this server produced for that call');
       console.log('');
       console.log('Environment variables:');
       console.log(`  ${MCP_AUTH_ENV_VAR}        Read by mcp_server.mjs at startup; client supplies via Claude config`);
@@ -3191,18 +3388,29 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
     opts.complianceTrackSla = true;
   }
   if (awsRegionIntent) opts.awsRegionIntent = awsRegionIntent;
+  // EE 2.0.0: the drift notification needs a framework to drift — refused here, where --env has already loaded.
+  const notifyRefused = notifyRefusal({ notifyWebhook, compliance, envCompliance: process.env.COMPLIANCE_FRAMEWORKS });
+  if (notifyRefused) {
+    console.error(notifyRefused.message);
+    process.exit(notifyRefused.code);
+  }
+  if (notifyWebhook) Object.assign(opts, { notifyWebhook, notifyFormat, notifySeverity, notifyPayload });
   const pm = await PluginManager.create(`${__dirname}/plugins`);
+  // Before the watch loop, the run record or any host: a --plugins list that names no plugin is refused by name.
+  const selectionRefused = pluginSelectionRefusal(plugins, pm);
+  if (selectionRefused) throw selectionRefused;
   const promptMode = String(process.env.OPENAI_PROMPT_MODE || 'basic').toLowerCase().trim();
 
   // --- CTEM: continuous watch mode ---
   if (watch) {
     const intervalMs = intervalMinutes * 60 * 1000;
-    console.log(`[CTEM] Watch mode enabled. Interval: ${intervalMinutes}m, Concurrency: ${parallel}, Hosts: ${hosts.length}`);
-    if (webhookUrl) console.log(`[CTEM] Webhook URL: ${webhookUrl}, Alert severity: ${alertSeverity}`);
-
     let previousCycleResults = null;
+    // EE 2.0.0: every scan in this loop tells Enterprise it is a watch cycle, so no drift file is written per cycle (the
+    // drift file is the one-shot path's; the operator's ruling). `opts.runId` is already unset here.
+    opts.watch = true;
 
-    const scheduler = createScheduler({
+    // `testHooks._createScheduler`: a test seam, absent in every real invocation — it lets a leg run one watch cycle.
+    const scheduler = (testHooks?._createScheduler ?? createScheduler)({
       intervalMs,
       hosts,
       parallel,
@@ -3216,44 +3424,21 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       onCycleComplete: async (results) => {
         console.log(`[CTEM] Cycle complete. Scanned ${results.size} host(s).`);
 
-        // Build delta report
-        if (previousCycleResults) {
-          const delta = buildDeltaReport(results, previousCycleResults);
-          console.log(formatDeltaSummary(delta));
-
-          // Send webhook alerts for significant changes
-          if (webhookUrl && hasSignificantChanges(delta)) {
-            const sevRank = SEVERITY_RANK[alertSeverity] ?? SEVERITY_RANK.high;
-
-            for (const [h, scanOut] of results) {
-              if (!scanOut?.conclusion) continue;
-              const hostSev = maxSeverityInConclusion(scanOut.conclusion);
-              if (hostSev >= sevRank) {
-                const services = scanOut.conclusion?.result?.services || [];
-                const findings = services.filter((svc) => {
-                  let svcSev = 0;
-                  if (svc.anonymousLogin === true || svc.axfrAllowed === true) svcSev = SEVERITY_RANK.critical;
-                  if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length) svcSev = Math.max(svcSev, SEVERITY_RANK.medium);
-                  if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length) svcSev = Math.max(svcSev, SEVERITY_RANK.medium);
-                  const cves = svc.cves || svc.cve || [];
-                  if (Array.isArray(cves) && cves.length) svcSev = Math.max(svcSev, SEVERITY_RANK.high);
-                  return svcSev >= sevRank;
-                });
-
-                if (findings.length > 0) {
-                  const payload = buildAlertPayload(h, findings, alertSeverity);
-                  const webhookResult = await sendWebhook(webhookUrl, payload, { retries: 2, retryDelayMs: 1000 });
-                  if (webhookResult.success) {
-                    console.log(`[CTEM] Webhook alert sent for ${h}`);
-                  } else {
-                    console.warn(`[CTEM] Webhook alert failed for ${h}: ${webhookResult.error}`);
-                  }
-                }
-              }
+        // What stdout says and whom the webhook alerts, both from ONE predicate (utils/watch_cycle.mjs, 1.3.0 items 4 + 11).
+        const { text, alerts } = watchCycle(results, previousCycleResults,
+          { alertRank: SEVERITY_RANK[alertSeverity] ?? SEVERITY_RANK.high, everyCycle: alertEveryCycle });
+        console.log(text ?? '[CTEM] First cycle complete — it establishes the baseline. Delta reporting begins on the next cycle.');
+        if (webhookUrl) {
+          for (const { host: h, findings } of alerts) {
+            const payload = buildAlertPayload(h, findings, alertSeverity, { payload: alertPayload });
+            // `testHooks._sendWebhook`: a test seam, absent in every real invocation.
+            const webhookResult = await (testHooks?._sendWebhook ?? sendWebhook)(webhookUrl, payload, { retries: 2, retryDelayMs: 1000 });
+            if (webhookResult.success) {
+              console.log(`[CTEM] Webhook alert sent for ${h}`);
+            } else {
+              console.warn(`[CTEM] Webhook alert failed for ${h}: ${webhookResult.error}`);
             }
           }
-        } else {
-          console.log('[CTEM] First cycle complete. Delta reporting will begin on next cycle.');
         }
 
         previousCycleResults = results;
@@ -3270,6 +3455,14 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);
 
+    // The banner reads the scheduler's own distinct list: a cycle scans each host once (1.3.0 lane 4, item 10).
+    const dropped = scheduler.duplicatesDropped
+      ? ` (${scheduler.duplicatesDropped} duplicate host(s) dropped — watch mode scans each host once per cycle)` : '';
+    console.log(`[CTEM] Watch mode enabled. Interval: ${intervalMinutes}m, Concurrency: ${parallel}, Hosts: ${scheduler.hosts.length}${dropped}`);
+    // The HOST only: a Slack or Teams webhook URL carries its own credential in the path or the query (EE 2.0.0).
+    if (webhookUrl) console.log(`[CTEM] Webhook: ${new URL(webhookUrl).host}, Alert severity: ${alertSeverity}, alerting `
+      + (alertEveryCycle ? 'every host with such a finding, every cycle' : 'hosts whose scan changed (the first cycle sets the baseline)'));
+
     scheduler.start();
     return; // keep process alive via setInterval
   }
@@ -3476,6 +3669,7 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
         host: scanOut.host,
         conclusion: scanOut.conclusion,
         toolVersion: TOOL_VERSION,
+        manifest: scanOut.pluginStatus ?? [],
       });
       const mdFileName = scanOutputs.length > 1
         ? `scan_${safeHost(scanOut.host)}.md`
@@ -3513,6 +3707,46 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
   }
 }
 
+/**
+ * An explicit --plugins list, resolved against the loaded plugins before anything is scanned or written: a token that names
+ * no plugin is refused BY NAME, and so is a list that names none. Until 1.0.0 both were dropped without a word, and a list
+ * that resolved to nothing ran ZERO plugins — exit 0, "Security findings: 0", and with --compliance every in-scope control
+ * PASS at zero evidence. `all` must stand alone: inside a list it was dropped too, silently running only the rest.
+ * Returns an EFLAGVALUE error (exit 2 through exitOnMainRejection), or null when the selection stands.
+ * @param {string[]|string|undefined} plugins  parseArgs' `plugins`: 'all', or the list's trimmed tokens
+ * @param {{ findPlugin(name: string): object|null }} pm
+ */
+export function pluginSelectionRefusal(plugins, pm) {
+  if (!Array.isArray(plugins)) return null;
+  const refuse = (msg) => Object.assign(new Error(msg), { code: 'EFLAGVALUE' });
+  if (plugins.length === 0) return refuse('--plugins named no plugin — give plugin ids or names, or all');
+  const quote = (t) => JSON.stringify(t);
+  const withAll = plugins.some((t) => t.toLowerCase() === 'all');
+  const unknown = plugins.filter((t) => t.toLowerCase() !== 'all' && !pm.findPlugin(t));
+  if (unknown.length) {
+    return refuse(`--plugins: no plugin matches ${unknown.map(quote).join(', ')}${withAll ? '; "all" must be given alone' : ''}`
+      + ' — name each plugin by its id or name (nsauditor-ai license --plugins lists them)');
+  }
+  if (withAll) return refuse('--plugins: "all" must be given alone — it already selects every plugin');
+  return null;
+}
+
+/**
+ * What a rejected main() exits with — the ONE copy of this mapping. Both entry points call it: the block below when
+ * cli.mjs is run directly, and bin/nsauditor-ai.mjs, the command npm installs (which imports main(), so cli.mjs is never
+ * the entry point for an installed user). A flag refusal is an operator error, not a crash: name it and exit 2, this
+ * CLI's "could not do what you asked" code. Everything else keeps the stack and exit 1. `error` and `exit` are seams for
+ * the suite (tests/cli_bin_entrypoint.test.mjs).
+ */
+export function exitOnMainRejection(err, { error = console.error, exit = process.exit } = {}) {
+  if (err?.code === 'EFLAGSHAPE' || err?.code === 'EFLAGVALUE') {
+    error(`[ERROR] ${err.message}`);
+    return exit(2);
+  }
+  error(err?.stack || err);
+  return exit(1);
+}
+
 // Only auto-run main() when this file is the process entrypoint. Importing
 // cli.mjs (e.g. unit tests pulling in `parseArgs`) must NOT trigger a scan.
 const _isEntrypoint = (() => {
@@ -3523,14 +3757,5 @@ const _isEntrypoint = (() => {
   }
 })();
 if (_isEntrypoint) {
-  main().catch((err) => {
-    // A flag-shape refusal is an operator error, not a crash: name it and exit 2, this CLI's
-    // "could not do what you asked" code. Everything else keeps the stack and exit 1.
-    if (err?.code === 'EFLAGSHAPE') {
-      console.error(`[ERROR] ${err.message}`);
-      process.exit(2);
-    }
-    console.error(err?.stack || err);
-    process.exit(1);
-  });
+  main().catch((err) => exitOnMainRejection(err));
 }