v2.3.0 (15 Nov 2026)
- Full-collection structural audit and remediation, 34 of 36 skills touched. A two-round audit of every skill (round two adversarially re-verified all 60 findings against primary texts: EUR-Lex, eCFR, the Gazette of India, planalto, NIST OSCAL baselines, access-board.gov and more; 54 confirmed, 6 refined, 1 refuted), followed by three fix waves:
- Wave 1, the six requiring major updates: DPDPA (Section 7, chapters, penalty anchors, and DPDP Rules mapping rebuilt from the gazette), EU CRA (proposal-era annexes replaced with the real 19+4+3 classification), DORA (shifted article maps and inverted Art. 30(2)/(3) corrected; CDR 2025/301 incident clocks), CMMC (inverted POA&M rule fixed; Level 1 = 15; SPRS weights), LGPD (invented Art. 11 credit basis removed; adequacy kept with instrument numbers), VN-PDPL (real 5-chapter/39-article structure).
- Wave 2: ISO 27701 transition guide (invented 2019 control, EAR (country groups, de minimis, CIV to SPP, APR, eight ECP elements), ITAR license forms, SWIFT's 26+6 arithmetic restored, TSA's missing rail CRMP directive series added, Section 508's E-provision map, plus currency fixes in GDPR, HIPAA, and Saudi Arabia. FedRAMP's CR26 block was re-verified against fedramp.gov and vindicated, with one bad bullet rewritten per NTC-0009.
- Wave 3: CIS names/IG matrix with a genuine CSF 2.0 crosswalk, PCI requirement numbering and SAQ relabel, SOC 2 criteria re-homed, 800-53B baselines, ISO 42001's 6.1.4/8.4, NZISM, ISM's six functions, CCPA's defunct cure period, and a dozen minors.
- New structure guards in CI pin every audited-wrong claim as permanently forbidden; suite now 1,874 tests.
- Benchmark: 40 new structure-probing evals (IDs 396-435); headline 92% vs 53% (831/479 of 902, +39 points).
- Issues #62 and #63 fixed earlier in this cycle, credited to their reporters.