@aimarket/warden 0.9.0 → 0.13.0

package/docs/scanner-comparison.es.md

@@ -2,7 +2,7 @@
 
 > 🌐 [English](scanner-comparison.md) · [Русский](scanner-comparison.ru.md) · **Español** · [Français](scanner-comparison.fr.md) · [中文](scanner-comparison.zh.md)
 
-El 9 de octubre de 2026 ejecutamos WARDEN y dos escáneres MCP de código abierto, mcp-audit y mcp-shield,
+El 9 de octubre de 2026 ejecutamos WARDEN y dos escáneres MCP de código abierto, mcp-audit y mcp-shield,[^snyk]
 sobre los mismos servidores. De cada uno queríamos dos números: cuántas herramientas envenenadas bloquea y
 cuántos servidores honestos bloquea por error. El segundo número decide si alguien puede dejar un escáner
 encendido.
@@ -171,17 +171,6 @@ con `deepseek-flash`, el modelo que usa HISTOR:
   parámetro y `rm -rf ~`. Funcionan en pareja.
 - **Costó poco.** Toda la medición fueron 816 solicitudes; según nuestra estimación, menos de un dólar.
 
-## Snyk Agent Scan
-
-Snyk Agent Scan, antes Invariant mcp-scan, es el escáner MCP más usado. Juzga las descripciones de
-herramientas en los servidores de Snyk y necesita un token de cuenta. El 9 de octubre de 2026 teníamos un
-token válido. El servicio respondió a nuestra primera solicitud con HTTP 429, «The public quota for this
-service has been exceeded». Esa cuota es compartida por todos los usuarios gratuitos, y ya estaba agotada
-cuando llegamos. El propio mensaje del escáner lo llama límite de uso diario. Nuestro banco de pruebas
-reintenta cada hora y va despacio cuando consigue pasar. Añadiremos la columna cuando haya terminado.
-
-Es una nota sobre el acceso, no sobre la detección. No hemos medido la detección de Snyk.
-
 ## Límites, y nuestro interés
 
 - **No somos neutrales.** Publicamos WARDEN, gratis y con licencia MIT. Escribimos los 23 ataques y los 55
@@ -216,3 +205,5 @@ npx -y @aimarket/warden@0.9.0 scan
 La [guía de scan](scan.es.md) cubre el archivo lock, la GitHub Action, los hooks de pre-commit y el
 clasificador. El [estudio de campo](mcp-survey.es.md) es el estudio anterior sobre en qué se equivocó WARDEN
 con 1 108 servidores públicos.
+
+[^snyk]: Snyk Agent Scan, el escáner MCP más usado, no está en la comparación. El 9 de octubre de 2026 su versión gratuita rechazó cada solicitud con HTTP 429, «The public quota for this service has been exceeded»: desde la primera solicitud, con las dos versiones de la CLI (0.6.8 y 0.5.17) y desde dos direcciones de red.

package/docs/scanner-comparison.fr.md

@@ -2,7 +2,7 @@
 
 > 🌐 [English](scanner-comparison.md) · [Русский](scanner-comparison.ru.md) · [Español](scanner-comparison.es.md) · **Français** · [中文](scanner-comparison.zh.md)
 
-Le 9 octobre 2026, nous avons exécuté WARDEN et deux scanners MCP open source, mcp-audit et mcp-shield, sur
+Le 9 octobre 2026, nous avons exécuté WARDEN et deux scanners MCP open source, mcp-audit et mcp-shield,[^snyk] sur
 les mêmes serveurs. Nous voulions deux chiffres de chacun : combien d’outils empoisonnés il bloque, et
 combien de serveurs honnêtes il bloque par erreur. Le second chiffre décide si quelqu’un peut laisser un
 scanner allumé.
@@ -175,18 +175,6 @@ du journal HISTOR, avec les mêmes quatre catégories. Ses verdicts sont consult
   comme paramètre et `rm -rf ~`. Les deux fonctionnent en paire.
 - **Il a peu coûté.** Toute la mesure a pris 816 requêtes ; selon notre estimation, moins d’un dollar.
 
-## Snyk Agent Scan
-
-Snyk Agent Scan, anciennement Invariant mcp-scan, est le scanner MCP le plus utilisé. Il juge les
-descriptions d’outils sur les serveurs de Snyk et exige un jeton de compte. Le 9 octobre 2026, nous avions
-un jeton valide. Le service a répondu à notre première requête par HTTP 429, « The public quota for this
-service has been exceeded ». Ce quota est partagé par tous les utilisateurs gratuits, et il était épuisé
-avant notre arrivée. Le message du scanner lui-même parle d’une limite d’usage quotidienne. Notre banc
-d’essai réessaie toutes les heures et avance lentement quand il passe. Nous ajouterons la colonne une fois
-l’exécution terminée.
-
-C’est une remarque sur l’accès, pas sur la détection. Nous n’avons pas mesuré la détection de Snyk.
-
 ## Limites, et notre intérêt
 
 - **Nous ne sommes pas neutres.** Nous publions WARDEN, gratuit et sous licence MIT. Nous avons écrit les 23
@@ -221,3 +209,5 @@ npx -y @aimarket/warden@0.9.0 scan
 Le [guide de scan](scan.fr.md) couvre le fichier lock, la GitHub Action, les hooks pre-commit et le
 classificateur. L’[étude de terrain](mcp-survey.fr.md) est l’étude précédente sur les erreurs de WARDEN
 face à 1 108 serveurs publics.
+
+[^snyk]: Snyk Agent Scan, le scanner MCP le plus utilisé, n’est pas comparé. Le 9 octobre 2026, sa version gratuite a refusé chaque requête par HTTP 429, « The public quota for this service has been exceeded » : dès la première requête, avec les deux versions de la CLI (0.6.8 et 0.5.17) et depuis deux adresses réseau.

package/docs/scanner-comparison.md

@@ -2,7 +2,7 @@
 
 > 🌐 **English** · [Русский](scanner-comparison.ru.md) · [Español](scanner-comparison.es.md) · [Français](scanner-comparison.fr.md) · [中文](scanner-comparison.zh.md)
 
-On 2026-10-09 we ran WARDEN and two open-source MCP scanners, mcp-audit and mcp-shield, over the same
+On 2026-10-09 we ran WARDEN and two open-source MCP scanners, mcp-audit and mcp-shield,[^snyk] over the same
 servers. We wanted two numbers from each: how many poisoned tools it blocks, and how many honest servers
 it blocks by mistake. The second number decides whether anyone can leave a scanner switched on.
 
@@ -164,17 +164,6 @@ uses:
   and `rm -rf ~`. The two work as a pair.
 - **It cost little.** The whole measurement was 816 requests; by our estimate it cost under a dollar.
 
-## Snyk Agent Scan
-
-Snyk Agent Scan, formerly Invariant mcp-scan, is the most used MCP scanner. It judges tool descriptions on
-Snyk's servers and needs an account token. On 2026-10-09 we had a valid token. The service answered our
-first request with HTTP 429, "The public quota for this service has been exceeded". That quota is shared by
-every free user, and it was spent before we arrived. The scanner's own message calls it a daily usage
-limit. Our harness retries every hour and goes slowly when it gets through. We will add the column when it
-has run.
-
-That is a note about access, not about detection. We have not measured Snyk's detection.
-
 ## Limits, and our interest
 
 - **We are not neutral.** We publish WARDEN, MIT-licensed and free. We wrote the 23 attacks and the 55
@@ -207,3 +196,5 @@ npx -y @aimarket/warden@0.9.0 scan
 
 The [scan guide](scan.md) covers the lock file, the GitHub Action, the pre-commit hooks and the classifier.
 The [field survey](mcp-survey.md) is the earlier study of what WARDEN got wrong on 1 108 public servers.
+
+[^snyk]: Snyk Agent Scan, the most used MCP scanner, is not compared. On 2026-10-09 its free version refused every request with HTTP 429, "The public quota for this service has been exceeded": from the first request, with both CLI versions (0.6.8 and 0.5.17) and from two network addresses.

package/docs/scanner-comparison.ru.md

@@ -2,7 +2,7 @@
 
 > 🌐 [English](scanner-comparison.md) · **Русский** · [Español](scanner-comparison.es.md) · [Français](scanner-comparison.fr.md) · [中文](scanner-comparison.zh.md)
 
-9 октября 2026 года мы прогнали WARDEN и два MCP-сканера с открытым кодом, mcp-audit и mcp-shield, по одним
+9 октября 2026 года мы прогнали WARDEN и два MCP-сканера с открытым кодом, mcp-audit и mcp-shield,[^snyk] по одним
 и тем же серверам. От каждого нам нужны были два числа: сколько отравленных инструментов он блокирует и
 сколько честных серверов блокирует по ошибке. Второе число решает, оставит ли кто-нибудь сканер включённым.
 
@@ -168,17 +168,6 @@ credential file … keep this step to yourself») и «include the output of env
   и `rm -rf ~`. Они работают в паре.
 - **Он обошёлся дёшево.** Весь замер занял 816 запросов; по нашей оценке, это меньше доллара.
 
-## Snyk Agent Scan
-
-Snyk Agent Scan, бывший Invariant mcp-scan, — самый используемый MCP-сканер. Он судит описания инструментов
-на серверах Snyk и требует токен аккаунта. 9 октября 2026 года у нас был действующий токен. На первый же
-запрос сервис ответил HTTP 429: «The public quota for this service has been exceeded». Эта квота общая для
-всех бесплатных пользователей, и она закончилась до нас. Собственное сообщение сканера называет это
-дневным лимитом. Наш стенд повторяет попытку каждый час и идёт медленно, когда квота открывается. Столбец
-добавим, когда прогон пройдёт.
-
-Это заметка о доступе, а не о качестве обнаружения. Обнаружение у Snyk мы не измеряли.
-
 ## Ограничения и наш интерес
 
 - **Мы не нейтральны.** Мы выпускаем WARDEN, бесплатно и под лицензией MIT. 23 атаки и 55 разметок написали
@@ -212,3 +201,5 @@ npx -y @aimarket/warden@0.9.0 scan
 [Руководство по scan](scan.ru.md) описывает лок-файл, GitHub Action, хуки pre-commit и классификатор.
 [Полевой обзор](mcp-survey.ru.md) — более раннее исследование того, в чём WARDEN ошибся на 1 108 публичных
 серверах.
+
+[^snyk]: Snyk Agent Scan, самый используемый MCP-сканер, в сравнении не участвует. 9 октября 2026 года его бесплатная версия отказала на каждый запрос с HTTP 429 «The public quota for this service has been exceeded»: с первого же запроса, в обеих версиях CLI (0.6.8 и 0.5.17) и с двух сетевых адресов.

package/docs/scanner-comparison.zh.md

@@ -2,7 +2,7 @@
 
 > 🌐 [English](scanner-comparison.md) · [Русский](scanner-comparison.ru.md) · [Español](scanner-comparison.es.md) · [Français](scanner-comparison.fr.md) · **中文**
 
-2026 年 10 月 9 日，我们在同一批服务器上运行了 WARDEN 和两款开源 MCP 扫描器：mcp-audit 与 mcp-shield。我们想从每款扫描器得到两个数字：它阻止了多少投毒工具，以及它误阻止了多少诚实的服务器。第二个数字决定了有没有人敢让扫描器一直开着。
+2026 年 10 月 9 日，我们在同一批服务器上运行了 WARDEN 和两款开源 MCP 扫描器：mcp-audit 与 mcp-shield[^snyk]。我们想从每款扫描器得到两个数字：它阻止了多少投毒工具，以及它误阻止了多少诚实的服务器。第二个数字决定了有没有人敢让扫描器一直开着。
 
 用自己的测试集衡量扫描器，结果总是好看，我们的也一样。所以本页大部分内容讲的是一个三家作者都没写过的样本集：MCPTox，一个发表于 AAAI 2026 的工具投毒基准。我们依据它一半的服务器编写了 WARDEN 最新的规则，并在另一半上测量。
 
@@ -105,12 +105,6 @@ v10 漏掉了 218 个留出工具中的 47 个，其中 41 个会以建议的形
 - **它会漏掉规则能抓到的东西：** 注解（annotations）里的注入、作为参数索取的私钥，以及 `rm -rf ~`。两者要搭配使用。
 - **成本很低。** 整个测量共 816 次请求；按我们的估算，不到一美元。
 
-## Snyk Agent Scan
-
-Snyk Agent Scan（原 Invariant mcp-scan）是使用最广的 MCP 扫描器。它在 Snyk 的服务器上判定工具描述，需要账号令牌。2026 年 10 月 9 日，我们持有有效的令牌。服务对我们的第一次请求就返回了 HTTP 429：“The public quota for this service has been exceeded”。这份配额由所有免费用户共享，在我们到来之前就已用完。扫描器自己的提示把它称作每日使用上限。我们的测试工具每小时重试一次，通过之后会放慢节奏运行。运行完成后，我们会补上这一列。
-
-这只是关于访问的说明，不涉及检测能力。我们没有测量 Snyk 的检测效果。
-
 ## 局限，以及我们的利益
 
 - **我们并不中立。** WARDEN 由我们发布，免费，采用 MIT 许可。23 个攻击和 55 条判定由我们编写。正因如此，样本集、重放测试工具、原始结果和每一条判定都是公开的。
@@ -133,3 +127,5 @@ npx -y @aimarket/warden@0.9.0 scan
 ```
 
 [scan 指南](scan.zh.md)介绍 lock 文件、GitHub Action、pre-commit 钩子和分类器。[实地普查](mcp-survey.zh.md)是更早的一项研究，讲的是 WARDEN 在 1 108 台公开服务器上判错了什么。
+
+[^snyk]: 使用最广的 MCP 扫描器 Snyk Agent Scan 未参与对比。2026 年 10 月 9 日，它的免费版本对每一次请求都返回 HTTP 429：“The public quota for this service has been exceeded”。从第一次请求起即如此，两个 CLI 版本（0.6.8 和 0.5.17）均如此，从两个网络地址发出也一样。

package/docs/security-hardening-language-boundary.md

@@ -0,0 +1,306 @@
+# Language-independent admission, WARDEN 0.12.0
+
+No finite keyword list understands every language. Normalizing an encoding does
+not translate its meaning, and an LLM's language coverage is also finite.
+WARDEN therefore separates **recognition** from **permission to expose a tool
+definition**.
+
+## Revision 0.12.0
+
+A confirmed semantic authority-boundary violation now always has `high` severity
+at the host. The provider's original level is retained only as `modelSeverity`.
+This closes the threshold mismatch behind the 16 known allowed attacks in 0.11.0;
+uncertainty remains a separate failure of inspection.
+
+With `scan --classifier-blocks`, a complete clean review can resolve exactly two
+ambiguous static cases: a readable base64 blob, and quotation inside a structured
+JSON field. The existing rules still inspect raw and decoded content. Unquoted
+instructions and the other threat, origin, drift and approval gates remain in
+force. This is model-dependent disambiguation, not a language-independent proof
+of safety. The model is explicitly prompted to distinguish protective negation
+and detection examples from directives to perform the quoted attack.
+
+A review is bound to a pre-request snapshot of **all** advertised fields. Its
+clearance lives in a private WeakMap, not in provider JSON or a serializable
+policy flag. Mutating the input, copying an inspection object, inventing a clean
+result, an advisory-only call, truncation, uncertainty or a failed request cannot
+satisfy the guard. The same review is used by scan and its lock-update recheck.
+No broad static allowlist is introduced. The offline gate chain and wrap do not
+obtain a clean semantic review and retain conservative detection.
+
+An early candidate that exempted every decodable base64 string was rejected:
+it lost 900 existing offline detections. A second candidate relaxed structured
+quotes offline; a mixed-language imperative exposed an unsafe exception. Both
+partial experiments were stopped, and the final comparison keeps offline
+blocking unchanged on the frozen attack and control sets. The final semantic run
+uses a separate build identity and output directory; partial runs are not counted
+as completed measurements.
+
+Historical 0.11.0 measurements below are retained for comparison. The final
+0.12.0 measurements are recorded separately in the companion report.
+
+## Enforce the trust boundary
+
+```sh
+node dist/mcp-server.js wrap --require-approval --id notes -- node /path/to/server.mjs
+```
+
+First contact records the observed definitions for review but withholds them from
+the MCP client and refuses their calls. In an operator terminal:
+
+```sh
+node dist/mcp-server.js pins status --id notes
+node dist/mcp-server.js pins approve --id notes
+```
+
+Use the same `--state-dir` on both commands if overriding the default. Approval
+requires the explicit TTY confirmation and rechecks non-pinning security gates.
+The observed snapshot must still match what the operator reviewed. Relist the
+tools after approval.
+
+The policy equivalent is:
+
+```json
+{
+  "requireApproval": true,
+  "pinToolDefs": true,
+  "blockAtSeverity": "high",
+  "allowUnknownServers": true,
+  "sensitiveToolPatterns": []
+}
+```
+
+The pin records `approvalMode: "operator"`, v2 hashing of every advertised tool
+field, and the launch identity. Automatic first-contact pins, old pins, and
+incomplete pins do not qualify. Any changed field or launch identity is refused,
+even if `pinToolDefs` is separately disabled or a high severity threshold would
+otherwise ignore a finding. No language identification is involved.
+
+`scan --require-approval --lock warden.lock.json` applies the same admission
+requirement. `--update-lock` is the explicit operator action that records a new
+snapshot for repository review. A model verdict alone never changes trust.
+`--no-launch` cannot verify the current definitions and refuses strict admission.
+
+Compatibility: strict approval is **opt-in**. Ordinary wrap still automatically
+pins a clean first contact, now marked `automatic`. `--audit-only` observes and
+does not enforce. A host calling the library's `approve()` is a trusted authority;
+it must not expose that operation to an untrusted model. MCP pin mutation tools
+remain disabled unless the operator explicitly enables them.
+
+## Semantic inspection assists review
+
+```sh
+WARDEN_CLASSIFIER_API_KEY=… node dist/mcp-server.js scan --project \
+  --classifier-url https://your-approved-provider.example/v1 \
+  --classifier-model YOUR_MODEL --classifier-blocks
+```
+
+The classifier reads names, titles, descriptions, input/output schemas,
+annotations and all extension metadata, including normalized readings of common
+encodings. Its prompt asks about overriding user authority, credentials,
+exfiltration, concealment and control of other tools. It has no language keyword
+table. Random fences delimit untrusted input; they are not a security guarantee.
+
+The field-reference protocol requires exactly one `clean`, `attack` or `uncertain`
+decision per trusted tool index. Attack evidence refers to host-assigned field
+IDs. WARDEN validates those IDs and extracts the source previews itself: admission
+no longer depends on the model copying Unicode quotations exactly. Missing,
+duplicate, contradictory and invalid decisions never become clean results.
+Valid decisions survive a malformed decision about a different tool. Each
+incomplete tool gets at most one isolated retry, also for length-limited responses.
+An entire malformed batch can therefore use at most nine requests (one plus eight
+single-tool retries). Authentication errors, rate limits, network/provider errors
+and content filtering do not trigger this fan-out. Inputs exceeding the inspection
+budget are rejected before transmission.
+
+Enforcing mode rejects remaining incomplete coverage, uncertainty, timeouts and
+provider errors with `CLASSIFIER_INCOMPLETE`. These are inspection failures, not
+attack detections; they also prevent `--update-lock` from recording an approval.
+Advisory mode reports failures without enforcing them.
+
+`--classifier-reasoning-effort none|low|medium|high` is optional and requires provider
+support; omitting it preserves the provider default. For the DeepSeek experiment
+we explicitly use `none`: its default thinking mode otherwise shares the 4,000-token
+output budget with the final JSON ([provider documentation](https://api-docs.deepseek.com/guides/thinking_mode/)).
+Responses and optional diagnostics are size-bounded and never contain API headers
+or keys. Diagnostic source text is recorded only through an explicit callback.
+
+The classifier is part of `scan`, not the synchronous offline `vet()` gate chain
+or the wrap call path. It does not silently send tool text from wrap to a vendor.
+Choose and configure the endpoint explicitly. A clean model verdict is still not
+an operator approval.
+
+## Reproducible measurements
+
+The companion MOMUS comparison freezes 8,244 synthetic attack definitions and
+362 benign controls in 11 languages before evaluating both builds. The original
+4,194 attack inputs are preserved byte-for-byte. Extra languages: Arabic, Hindi,
+Korean, Swahili and Turkish. Extra encodings: percent, hexadecimal entities and
+nested base64/percent encoding. These fixtures are author-labelled synthetic
+data, not independent human-reviewed natural traffic or successful agent attacks.
+
+Initial static comparison, old ruleset 10 versus ruleset 11:
+
+| Set | Before | After |
+|---|---:|---:|
+| Original attacks detected / 4,194 | 1,620 | 1,692 |
+| Expanded attacks detected / 8,244 | 2,664 | 2,808 |
+| Benign controls blocked / 362 | 28 | 31 |
+| Real public snapshots blocked / 986 | 3 | 3 |
+
+No previously detected synthetic attack became allowed. Exact replay produced
+identical decisions. The three added false blocks are encoded quotations of an
+attack in extension metadata: decoding exposes the quote to a pre-existing
+lexical rule. Existing false blocks include the base64 entropy heuristic on
+legitimate encoded examples. These controls deliberately test such weaknesses;
+they are not removed to improve the score. The public snapshots are unlabelled:
+their block count is not a measured false-positive rate.
+
+Strict admission refuses all 8,244 unapproved attack definitions and every changed
+definition after approval, but also refuses all 362 unapproved benign controls.
+Once explicitly approved, 331/362 benign controls pass; 31 still trip static
+rules. These are admission measurements, **not 100% semantic recall**.
+
+MOMUS reproduces the comparison and preserves per-case decisions:
+
+```sh
+python -m momus.engine.coverage_compare --before /path/to/warden-v10 \
+  --after /path/to/warden-v11 --out data/warden-v11-comparison
+```
+
+The optional live runner uses the actual compiled WARDEN classifier, with eight
+independent fixtures per request and four concurrent requests. It never sends
+fixture labels to the model. Keys come from environment variables; reports record
+model, endpoint, corpus hash, build hash, prompt hash, findings and incomplete
+inspections. A pilot is possible with a final numeric argument. Partial runs can
+resume only with the identical corpus/model/build.
+
+```sh
+node momus/engine/coverage_semantic.mjs /path/to/warden \
+  data/warden-v11-comparison/cases.jsonl.gz data/semantic-pilot 80
+```
+
+## Protocol pilot
+
+After replacing transcribed quotes with field IDs, fixing the uncertainty schema
+and explicitly configuring the output budget, the same frozen, balanced 80-case
+pilot was run through both providers:
+
+| Provider / model | Attack high findings | Benign high findings | Incomplete |
+|---|---:|---:|---:|
+| DeepSeek / `deepseek-flash`, effort `none` | 40/40 | 0/40 | 0/80 |
+| OpenRouter / `minimax/minimax-m3`, provider default | 40/40 | 0/40 | 0/80 |
+
+Each used ten requests, all with `finish_reason=stop`; no retry was needed in
+these pilots. Earlier iterations had incomplete inspections (24/80 and 40/80 in
+the initial quote protocol, 16/80 and 3/80 in the first field protocol). Those
+failed inspections were never counted as detected attacks. These are successive
+engineering pilots, not a controlled causal comparison: the model is
+nondeterministic, the protocol was tuned using pilot results, and the final pilot
+is not evidence of universal reliability.
+
+## Historical 0.11.0 full semantic run — 2026-10-10
+
+The completed run used `deepseek-flash` with explicit reasoning effort `none`,
+the frozen 8,606 fixtures and the same build digest as the static comparison.
+At the unchanged blocking threshold `high`:
+
+| Set | Ruleset 10 alone | Ruleset 11 alone | Ruleset 11 + DeepSeek |
+|---|---:|---:|---:|
+| Original attacks blocked / 4,194 | 1,620 | 1,692 | 4,184 |
+| Expanded attacks blocked / 8,244 | 2,664 | 2,808 | 8,228 |
+| Benign controls blocked / 362 | 28 | 31 | 32 |
+
+Combined blocking is **99.76%** on the original set and **99.81%** on the expanded
+set. The semantic layer alone produced 8,223 high findings on attacks, one high
+finding on a benign control, and **zero incomplete inspections out of 8,606**.
+All 1,076 requests finished with `stop`; no isolated retry was needed in this run.
+Fault-injection unit tests separately verify bounded retries and closed admission
+when retries fail.
+
+All attacks received some semantic finding; 21 were below `high`. Static rules
+blocked five of those, leaving **16 allowed attacks at the configured threshold**.
+That is a remaining policy/model-severity limitation, not a protocol failure.
+The added semantic false block is a German HTML-encoded tool title that says never
+to send credentials or conversation history externally. Together with 31 static
+false blocks, the combined false-positive rate on these stress controls is
+**32/362 (8.84%)**. In that 0.11.0 run, static decisions were never disambiguated by a clean model verdict.
+
+The recorded semantic result requires explicitly enabling the classifier; ordinary
+offline `vet()` and wrap retain the static numbers. Neither these results nor
+operator approval demonstrate safety in every language or on future model versions.
+The inputs are related synthetic templates, including the pilot used for protocol
+tuning. This is a reproducible stress evaluation, not a held-out generalization claim.
+
+The companion [machine-readable report](../../momus/docs/coverage-v11.json) contains
+build/corpus/prompt identities, per-language counts, missed IDs, false-block IDs,
+provider pilots and validation results. Exact inputs and individual decisions are
+in `momus/data/warden-v11-comparison/` and
+`momus/data/warden-semantic-full-deepseek-v11/` in the working checkout.
+
+## Final 0.12.0 measurement — 2026-10-10
+
+The same frozen corpus (SHA-256
+`f3333cd9243fc7b9e62cd760609124d1fefc97d103b706cbd67750be291b3add`)
+was rerun with `deepseek-flash`, effort `none`, `scan --classifier-blocks`
+semantics and threshold `high`. The live runner uses the production WARDEN
+gates with the bound inspection; this is not a benchmark-only allowlist.
+
+| Outcome | 0.11.0 combined | 0.12.0 combined |
+|---|---:|---:|
+| Original attacks blocked / 4,194 | 4,184 | 4,194 |
+| Expanded attacks blocked / 8,244 | 8,228 | 8,244 |
+| Allowed attacks | 16 | 0 |
+| Benign controls blocked / 362 | 32 (8.84%) | 1 (0.28%) |
+| Incomplete inspections / 8,606 | 0 | 0 |
+
+All 16 previously missed attacks are blocked, and all 32 previously false-blocked
+controls are allowed. **One new false block remains**:
+`control.es.0.description.base64`, an encoded Spanish instruction to summarize
+user-provided text. The model incorrectly treated this ordinary task description
+as an authority violation. It remains in the denominator and saved report.
+The number of false blocks fell by 96.875%; this is not zero-error protection.
+
+All 1,076 provider answers completed with `stop`, no singleton retries. The model
+received no fixture labels. Provider usage for the final full run was 3,694,186
+prompt tokens and 466,642 completion tokens; stopped development runs are separate.
+The balanced final pilot passed 40 attacks and 40 controls without incompletes.
+
+Offline outcomes are deliberately unchanged: 2,808/8,244 attacks blocked,
+31/362 controls blocked, zero attack regressions, zero replay differences.
+The 986 unlabelled public snapshots keep the same three blocks. Their block count
+is not a false-positive estimate. Ordinary wrap is not part of the live semantic
+measurement.
+
+[Full report](../../momus/docs/coverage-v12.json),
+[implementation audit of the nine-part plan](../../momus/docs/mcp-quality-review.md),
+and [safe local reproductions](../../momus/docs/mcp-quality-reproductions.json).
+Final decisions are in `momus/data/warden-semantic-full-v12-bound/`; frozen
+comparison inputs and offline decisions are in `momus/data/warden-v12-comparison/`.
+The report binds corpus, prompt and build hashes and records previous-error
+transitions and the abandoned experiments. This corpus influenced the changes;
+its related synthetic translations are not an independent held-out distribution
+or evidence of understanding every possible language.
+
+## Scope of the guarantee
+
+Strict approval prevents an unreviewed or changed **tool definition** from reaching
+the client. It does not prove that approved prose is safe, that the implementation
+matches its description, or that a call is authorized by the user's actual intent.
+It does not pin executable bytes or inherited environment variables.
+
+Strict wrap strips `initialize.instructions`, which is outside the approved tool
+snapshot. Other MCP surfaces—resources, prompts, server metadata, sampling and
+elicitation—are outside this definition-approval guarantee. Tool results are
+separate untrusted data; the existing result screen is lexical, and withholding a
+result cannot undo a tool call. A complete host also needs scoped filesystem and
+network access, per-call authorization outside the model, and process isolation.
+
+
+## Revision 0.13.0 — ordinary imperatives and honest coverage
+
+The generic classifier criterion now requires a concrete authority violation. An imperative describing an operation on user-provided input remains ordinary documentation after decoding. There is no Spanish allowlist. On the same frozen 8,606 fixtures, DeepSeek (`deepseek-flash`, effort `none`) blocked all 8,244 attacks and allowed all 362 controls, including `control.es.0.description.base64`; no inspection was incomplete. [Full report](../../momus/docs/coverage-v13.json) includes prompt/build/corpus hashes and token counts. Offline recognition remains 2,808/8,244 with 31/362 false blocks; the semantic result must not be attributed to offline mode.
+
+`wrap` reports oversized results as incomplete rather than scanning head/tail and clearing the unseen middle. This result layer remains static; no claim of universal multilingual result recognition is made. `block` withholds the result after the tool ran. `warn` annotates it.
+
+Composition analysis accepts `policy.capabilityBindings`: one object per server with `serverId`, `identityHash`, `toolsHash` and a `tools` map from exact tool names to arrays containing `private`, `untrusted`, `outbound`. The hashes must match the reviewed launch identity and every definition field; identity/definition changes invalidate the binding. Empty arrays are explicit operator declarations. Names and server-provided capability annotations cannot grant trust. Unknown tools produce a possible-flow advisory. Known combinations produce a confirmed-capability advisory; neither proves a particular data leak.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aimarket/warden",
-  "version": "0.9.0",
+  "version": "0.13.0",
   "description": "WARDEN — MCP security firewall. Stdio wrap proxy, inspection tools and library. Vets definitions before model exposure. Zero runtime dependencies.",
   "type": "module",
   "license": "MIT",
@@ -33,6 +33,8 @@
   },
   "files": [
     "dist",
+    "scripts/check-quality-gate.mjs",
+    "scripts/quality-public-key.pem",
     "README.md",
     "docs/scan*.md",
     "README-ru.md",
@@ -56,7 +58,8 @@
     "test": "vitest run",
     "test:coverage": "vitest run --coverage",
     "test:watch": "vitest",
-    "prepublishOnly": "npm run build && npm test && npm run check:ruleset",
+    "prepublishOnly": "npm run build && npm test && npm run check:ruleset && npm run check:quality",
+    "check:quality": "node scripts/check-quality-gate.mjs",
     "check:ruleset": "node scripts/check-published-ruleset.mjs",
     "bench:wrap": "npm run build && node scripts/benchmark-wrap.mjs"
   },
@@ -79,7 +82,7 @@
     "access": "public"
   },
   "devDependencies": {
-    "@types/node": "^22.10.2",
+    "@types/node": "^26.6.4",
     "@vitest/coverage-v8": "^4.1.11",
     "typescript": "^5.7.2",
     "vitest": "^4.1.11"

package/scripts/check-quality-gate.mjs

@@ -0,0 +1,64 @@
+// Release evidence is signed by the isolated production evaluator, never by a PR runner.
+import { createHash, verify } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { join, resolve } from 'node:path';
+
+export function buildDigest(build) {
+  const hash = createHash('sha256');
+  const files = readdirSync(join(build, 'dist')).filter(n => n.endsWith('.js')).sort();
+  if (!files.length) throw Error('WARDEN build missing');
+  if (files.some(name => name.startsWith('._'))) throw Error('Build contains AppleDouble transfer metadata');
+  for (const name of files) hash.update(name + '\0').update(readFileSync(join(build, 'dist', name))).update('\0');
+  return hash.digest('hex');
+}
+
+export function checkEvidence(envelope, publicKey, expectedBuild, now = Date.now() / 1000) {
+  const payload = Buffer.from(envelope.payload, 'base64');
+  if (!verify(null, payload, publicKey, Buffer.from(envelope.signature, 'base64'))) throw Error('Invalid quality signature');
+  const r = JSON.parse(payload);
+  if (r.type !== 'momus.release-quality/v1' || r.policy !== 'zero-regressions-v1' || r.status !== 'passed')
+    throw Error('Quality cycle has not passed');
+  if (r.buildDigest !== expectedBuild) throw Error('This exact WARDEN build has not passed');
+  if (!Number.isFinite(r.evaluatedAt) || !Number.isFinite(r.expiresAt) || r.evaluatedAt > now + 60
+      || now - r.evaluatedAt > 48 * 3600 || r.expiresAt < now) throw Error('Quality evidence expired');
+  const full = r.fullEvidence;
+  if (!full || full.status !== 'passed' || full.buildDigest !== expectedBuild
+      || full.holdoutSha256 !== r.holdoutSha256 || !Number.isFinite(full.evaluatedAt)
+      || full.evaluatedAt > now + 60 || now - full.evaluatedAt > 35 * 86400) throw Error('Fresh full evaluation required');
+  for (const name of ['development', 'holdout', 'candidates']) {
+    const suite = r.suites?.[name];
+    if (!suite?.passed || !suite.counts || ['missed', 'falsePositives', 'incomplete'].some(k => suite.counts[k] !== 0))
+      throw Error(`Quality failure in ${name}`);
+  }
+  if (r.suites.holdout.counts.attacks < 20 || r.suites.holdout.counts.benign < 20) throw Error('Holdout coverage missing');
+  if (Object.values(r.suites).some(s => !s.passed)) throw Error('Regression suite failed');
+  const b = r.behaviour;
+  if (!b?.passed || b.cases !== 72 || b.executed !== 72 || !Number.isFinite(b.evaluatedAt)
+      || now - b.evaluatedAt > 35 * 86400 || b.evaluatedAt > now + 60
+      || ['missed', 'falsePositives', 'incomplete'].some(k => b[k] !== 0)) throw Error('Behaviour campaign missing or failed');
+  if (r.discovery?.status !== 'complete' || r.discovery.generation?.status !== 'ok') throw Error('Adversarial discovery unavailable');
+  const smoke = r.behaviourSmoke;
+  if (!smoke?.passed || smoke.executed < 3 || !Number.isFinite(smoke.evaluatedAt)
+      || smoke.evaluatedAt > now + 60 || now - smoke.evaluatedAt > 48 * 3600
+      || smoke.observerSha256 !== b.observerSha256 || smoke.fixturesSha256 !== b.fixturesSha256
+      || ['missed', 'falsePositives', 'incomplete'].some(k => smoke[k] !== 0)) throw Error('Daily live sandbox check missing or failed');
+  return r;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    const build = resolve(process.argv[2] || fileURLToPath(new URL('..', import.meta.url)));
+    const response = await fetch('https://histor.modelmarket.dev/security-quality/latest.json',
+        { redirect: 'error', signal: AbortSignal.timeout(15000), cache: 'no-store' });
+      if (!response.ok) throw Error('Quality service unavailable');
+      const bytes = await response.arrayBuffer();
+      if (bytes.byteLength > 128 * 1024) throw Error('Oversized quality receipt');
+    const envelope = JSON.parse(Buffer.from(bytes).toString());
+    const report = checkEvidence(envelope, readFileSync(new URL('./quality-public-key.pem', import.meta.url)), buildDigest(build));
+    console.log(`MOMUS release gate passed: ${report.run}, ${report.buildDigest}`);
+  } catch (error) {
+    console.error(`Release blocked: ${error.message}`);
+    process.exitCode = 1;
+  }
+}

package/scripts/quality-public-key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAmc0nzrgzWIxs5Pk8PFmc70ci/PhEBPoGp1+RQJAC7vM=
+-----END PUBLIC KEY-----