NSAuditor AI Enterprise 0.45.0: Evidence That Says Only What It Can Prove

NSAuditor AI Enterprise 0.45.0 makes every compliance evidence pack a document whose words never outrun its proof. Report time now comes from a Time-Stamp Authority the customer chooses, the artifact states in its own cover block exactly what the scanner measured and what it did not, and the change ships as a minor version so an auditor can find it in the version series itself. Nsasoft US LLC published the release on 7 September 2026 alongside Community Edition 0.2.52 and the agent skill 0.2.50 — the 105th consecutive trio.

Timestamps from an authority you choose, never the scanner’s clock

An evidence pack is only as trustworthy as the time written on it. In 0.45.0 the answer to “when was this taken?” is anchored by RFC 3161 trusted timestamping, opt-in via the NSAUDITOR_TSA_URL environment variable: point it at the Time-Stamp Authority your assessor already trusts, and every compliance artifact gets a .tsr sidecar whose time comes from that authority rather than from the scanning host. A wrong host clock cannot corrupt a token, because the token never asked the host what time it was.

That design pays off at review time. An assessor comparing a pack’s generation time against the token’s signing time reads host skew from a signed record, reproducible with stock openssl ts -verify and none of Nsasoft’s software in the path. The roughly 990 sidecars already produced by that opt-in path in Nsasoft’s own evidence archive are unaffected by this release — each token is bound to the bytes that existed when it was taken.

An artifact that names its own limits

Every pack opens with a scope attestation, the auditor’s single source of truth for what was assessed. In 0.45.0 that block says, in the artifact itself, what the scanner does not do: its ntp section is frozen at six keys with constant values and a plain-prose note that this scanner does not measure its own clock, pointing the reader at the timestamping path instead. The nsauditor.scope-attestation/v1 schema is unchanged — every pack a customer already holds carries the same six keys with the same values — so nothing an auditor’s tooling reads has moved, and a contract test now pins the key set and the constants so they cannot drift.

Consistent with that standard, the NTP clock-attestation probe is WITHDRAWN as of EE 0.45.0: it attested the scanner’s own host clock, while every framework control about time synchronisation — PCI DSS 10.6, NIST SP 800-171 3.3.7, ISO/IEC 27001:2022 A.8.17, CIS Controls v8 8.4, NIST CSF PR.PS-04 — asks about the customer’s estate. The wording that described it was patterned into the company’s claim guard in the same commit that removed the code, so it cannot quietly reappear in a brochure. “A capability nobody can switch on is a marketing claim, not a control,” a company spokesperson said. “We would rather the pack say less and prove all of it.”

A version series an auditor can read

Nsasoft shipped 0.45.0 as a minor version rather than a patch on purpose. A patch says same capabilities, defects fixed; a change to what the product claims belongs where an auditor will look for it. The Community Edition 0.2.52 release carries no scanner behaviour change — its guard over customer-facing capability descriptions simply learns the published wording — and the agent skill 0.2.50 extends the same discipline to AI assistants: asked whether the scanner measures clock drift, an assistant running the skill answers no and points at the timestamping path.

What did not change

The plugin catalogue is unchanged at 29 Enterprise auditors — 28 cloud auditors across AWS, Azure and Google Cloud plus one Zero Trust posture check — for 56 plugins overall beside Community Edition’s 27. All eight compliance coverage matrices are unchanged: SOC 2, HIPAA Security Rule §164.312, NIST CSF 2.0, PCI DSS v4.0.1, ISO/IEC 27001:2022, CIS Controls v8, GDPR Article 32 (Security of Processing infrastructure substrate only, not GDPR compliance) and NIST SP 800-171 Rev 2 as evidence substrate for CMMC Level 2 preparation. No mapping file changed. Enterprise 0.45.0 requires Community Edition 0.2.49 or newer; the floor did not move, because nothing in this release depends on newer Community behaviour.

The previous release, 0.44.0, introduced the scan you can send — nsauditor-ai report --from <run> --format executive renders a finished scan as one self-contained, print-ready HTML report that states on its cover what it could and could not read. 0.45.0 applies the same principle one layer down, to the time written on the evidence itself.

Availability

NSAuditor AI Enterprise 0.45.0, Community Edition 0.2.52 and the agent skill 0.2.50 are available now. Community Edition is free and open; Enterprise adds the cloud auditors and the eight-framework compliance engine. Details, documentation and the plugin catalogue are at nsauditor.com/ai/enterprise/.