Changelog — v1.9.0 (5 Sep 2026)
Skills — September regulatory cycle (10 updated, all primary-source verified): GDPR (Uber €824.99M Art. 22 precedent; EDPB anonymisation + genAI-scraping guidelines), ITAR (USML VIII(a)(8) rule eff. Oct 13; XI(b) to 2028; $36M BAE benchmark), EAR (rewritten 9A012 drone logic; 9A610.a reversal), Vietnam PDPL (Decree 330/2026 sanctions regime), NIS2 (Dutch Cbw in force; CJEU referrals), PCI DSS (FAQ 1331 acquirer-approval rule), Australian ISM (September release: 44 new controls incl. agentic AI), CMMC (Task Force pending-status), HIPAA (NPRM → July 2027; self-funded-plan enforcement), NIST CSF (three August companion pubs).
Benchmark — 100 runs against fresh primary-source assertion sets: standouts VN-PDPL 88% vs 8% (+80), ISM 92% vs 16% (+76), EAR +60. Suite: 92% vs 63% on 827 assertions (+29 pts, +237) — with-skill dipped 1 pt on harder sets while baseline fell 11; published honestly from grading.json, no amendments needed.
New capabilities — ARD discoverability (ai-catalog.json + link tag per the v0.9 spec); client-side search & filter bar (region/category/domain facets, shareable URLs); September GRC Framework Updates (33 cards, August archived).
Engineering — skills.json manifest + generator now produce all derived tables with stats computed from grading data; full 1,696-test suite runs in CI and gates the Pages deploy; zip reference-file sync checks; README repairs (33 TOC anchors, eval-table rendering, download table completed).