nsauditor-ai 0.2.8 → 0.2.9

package/README.md

@@ -17,9 +17,9 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.8 + Enterprise 0.19.3** (June 2026) — a **real CE bump** (MCP affordance): the `scan_cloud` tool description now enumerates the actual service coverage (AWS S3 / IAM / KMS / CloudTrail / CodePipeline-CodeBuild SoD / Lambda / API GW / DynamoDB / RDS / SQS-SNS / Secrets / Backup / VPC endpoints / SG perimeter / ElastiCache / SES / GuardDuty; Azure Key Vault / Storage / NSG / RBAC; GCP firewall / storage / impersonation) + all 6 compliance frameworks, so AI agents route service-named audit asks to the scanner; the evidence-gap list lines are badge-coherent (lead with the GAP clause) and carry the first ACTIONABLE clause as a companion that now survives findings-cap eviction; internal compliance-routing tags are stripped at the presentation layer so gap lines spend their budget on substance. Paired **EE 0.19.3** "MCP affordance + class-O truncation sweep": inline-credential Lambda env-var names + the `AWS_LAMBDA_` exclusion-prefix evasion bypass closed (1080); truncation/AccessDenied evidence-gaps across 8 AWS auditors now fail-close their native controls in all six frameworks instead of routing to zero (class-O sweep incl. the 1110 P-16 grant-bypass); a new Azure NSG dimension flags restricted-port exposure to the tenant-rentable `AzureCloud` service tags (1221); public-subnet Redis replication groups no longer silently downgrade (1180). Plugin count UNCHANGED at 28; all six coverage matrices UNCHANGED. **EE 0.19.3 requires CE 0.2.8+.**
+**Latest: CE 0.2.9 + Enterprise 0.19.4** (June 2026) — paired README-refresh bump (no Community Edition code change this cycle). **EE 0.19.4 "Routing-Integrity Hardening"** closes the routing false-clean class — a real finding (or a visible evidence-gap) that mapped to **zero** compliance controls while the verdict stayed green: a build-time **routing guard** (a complete-partition `nativeFrameworks` allowlist) so no marked gap routes nowhere + GuardDuty (1200) dedupe + class-O routing; a **deferred-scope unmark** across 8 plugins (a capability boundary is not an evidence-gap → the MCP "unverified" list shrinks); the 1160 AWS-default VPC-endpoint full-access policy down-rated **CRITICAL→MEDIUM** with cross-framework routing (PCI 1.4.1 / ISO A.8.22 / CIS 12.2 + SOC 2 CC6.6 / HIPAA 164.312(a)(1)); and 1150 SQS/SNS **alarm-independence** (alarm posture survives a `Get*Attributes` deny; all four `alarm-coverage-unverifiable` causes fail-close soc2{A1.2,CC7.2}+hipaa{164.312(b)}). **PCI DSS matrix shifts 20/8/39 → 19/9/39** (Req 7.2.2 covered→partial — an honest down-rate of a QSA-flagged overclaim, backed by 1030 over-privilege detection). Plugin count UNCHANGED at 28; the other five matrices UNCHANGED. **EE 0.19.4 requires CE 0.2.8+.**
 
-**Prior: CE 0.2.7 + Enterprise 0.19.2** — paired pin for EE 0.19.2 "Confirmed false-negative tail" (6 more silent misses closed: 1222/1021/1070/1100/1024/1040). See [CHANGELOG.md](./CHANGELOG.md).
+**Prior: CE 0.2.8 + Enterprise 0.19.3** — real CE bump (MCP `scan_cloud` routing description + actionable gap-list visibility) paired with EE 0.19.3 "MCP affordance + class-O truncation sweep" (1080/1221/1180 + class-O sweep across 8 AWS auditors). See [CHANGELOG.md](./CHANGELOG.md).
 
 → Full release history: **[CHANGELOG.md](./CHANGELOG.md)**
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,