@clear-capabilities/agentic-security-scanner 0.192.0 → 0.194.0

package/CHANGELOG.md

@@ -9,6 +9,33 @@
 > make the history less accurate, not more.
 
 
+## 0.194.0 - The release closure runs side by side, and the Haskell container image goes into the container leg
+
+What the 0.193.0 ship measured: 53 minutes end to end (cold push 1040 s, hosted checks 743 s, the early gate about 29 minutes of which the closure is most, merge 6 s, post-merge verify 2 s, tag 2 s, release workflow 316 s, npm check 90 s and reported PENDING until `--resume`, which then confirmed it). The post-merge verify and the tag are now seconds; the early gate and a cold push are what is left.
+
+- **The closure's steps run three at a time.** `scripts/release-closure.mjs --run --jobs N` (or `AGENTIC_SECURITY_CLOSURE_JOBS`) runs the steps side by side, each in its own process group, with the step that rebuilds `dist` in place (`bundle-source`) first and alone, and records the steps in plan order, so the record, its digest and its verification are the same as a serial run's. `ship` sets three for the early gate. Measured once, in a separate worktree on an idle machine: 394 s, against 1062 s serial in the 0.192.0 run. In that worktree the `bundle-source` step failed and the tree was reported dirty (stray build chunks in the worktree), so that figure is a timing of the steps, not a passing closure; the real-checkout measurement is the next `TIMINGS` line. The serial path is unchanged and is the default.
+- **`test:loop` runs three files at once** instead of one. It is the longest closure step (567 s serial). One run of the whole suite passed 225 of 225 in 298 s. It contains real-time heartbeat and staleness tests, so a run on a loaded machine could flake; that has been run once, not characterised.
+- **The backfill script no longer moves the "Latest" badge.** Pages it creates are for old versions and are created with `--latest=false`; before, each one took the badge from the newest release and it had to be put back by hand.
+- **The `haskell:9` container image, first real-engine run: it failed, and the fault was found and fixed.** The `proof-container` job (which now pulls `haskell:9` and sets `AGENTIC_SECURITY_PROOF_CONTAINER_HASKELL=1`) failed on this pull request's first run with `missing toolchain: ghc`: the image keeps GHC in `/opt/ghc/<version>/bin`, and the container PATH named a directory that does not exist. `containerArgs` now resolves the versioned directory inside the container (a fixed `sh -c` wrapper, the argument vector unchanged after it). Run locally against a real engine after the fix (Docker 29.5.2 on Colima, macOS arm64, one round, with the scratch directory under `$HOME` because Colima shares nothing else): all four Haskell classes confirm the vulnerable fixture (4 of 4) and none confirms the mitigated one (0 of 4). That is a first macOS data point, one engine, one round. The second hosted run then failed the same way for a different reason, which the local run could not show because the maintainer's machine has GHC installed: `runAttempt` judged a container run by the HOST's toolchain, so every Haskell proof was `unsupported` on a runner without GHC however good the image. The toolchain check now follows where the program runs (the image's tools for a container, the host's otherwise), with a test that a host with no GHC still gets a container attempt and that the same host is still `unsupported` for a local run. Whether the hosted Linux job now passes is that job's result on this pull request; the skip in `measure.mjs` stays until it has.
+
+- **`@vscode/vsce` 4.1.0** in the VS Code extension (a newly published version made the `dependency-currency` check fail on the pull request).
+- **A failed blocking check now stops `ship` at once.** It used to wait until every workflow run had finished, including the 40 minute informational `local-model` job, so a failure at minute 5 was reported at minute 39 (this release's first attempt). It now stops when no blocking check is pending and nothing was just re-run. The closure, run three steps at a time in the real checkout during that attempt, took 412 s with every step passing on a clean, stable tree (1062 s serial in 0.192.0).
+- **A real second labeller on the fresh Haskell set, and what it showed.** The fresh set's 222 sites were labelled again by a different model, blind (`bench/dag/dev-haskell/fresh-labels-second.json`, `second-labeler-score.mjs`, section in that README). Agreement is 92.8% and Cohen's kappa 0.40. Twelve of the 16 disagreements are one unwritten policy: the first labeller counted vulnerabilities in example programs and a test server as true positives, the second did not. Scored by the second labeller's reading the fresh set has 7 true positives, not 21, so the recorded fresh precision of 17 of 45 depends on that policy. Nothing about the engine changed; the measurement's weak point is now on record. It was one pass with no adjudication, and one of the two sessions used 7 tool calls for 111 sites, so its reading depth is not established.
+- **The gitit password-hashing patch, type-checked against real packages, in isolation.** Building gitit itself is not possible on this host: `cabal` cannot resolve its dependencies under GHC 9.14 (`feed` requires `base < 4.22`), so no whole-project compile was run. The patched `hashPassword` function alone (PBKDF2 from `cryptonite` 0.30, hex from `base16-bytestring` 1.0.2.0, both installed from Hackage) type-checks with `ghc -fno-code`. That says the API calls are real, not that the patch is safe to apply: existing stored hashes would stop verifying, which is why the fixer still refuses the class.
+
+Not done: a cold push still runs the whole local suite when a gate script changes (17 minutes in 0.193.0); the duplicate closure steps (`compat-corpus`, `compat-layer-recall`) still run locally as well as in hosted CI; per-test line coverage for test selection is unbuilt.
+
+## 0.193.0 - A shorter release: no gate on a tag push, one early gate instead of two, a lighter tag-time workflow
+
+The 0.192.0 release took 64 minutes end to end (push 55 s, hosted checks 895 s, release gate 1350 s, tag 700 s, release workflow 592 s, npm 267 s). This release removes the parts of that which repeated work or waited without a reason. None of it was measured end to end at the time of writing: the next `TIMINGS` line is the measurement, and this entry does not quote a number it has not seen.
+
+- **A tag push is no longer gated.** The pre-push gate ran again, for 697 s, when ship pushed the release tag, although the tag names a commit that was already gated when its branch was pushed. A tag whose commit is already contained in a remote-tracking branch now counts as "no new commits". A tag on a commit the remote lacks is still gated, and a branch is never exempt.
+- **The early release gate is now actually used.** A defect found in the 0.192.0 run: right after a push, the pull request API can still report the previous head commit, so ship recorded the early gate's pass (and the pre-push pass) against a stale commit. The post-merge `verify` then found no matching early pass and ran 25 checks again, 1350 s that overlapped nothing. The pull request head is now taken from the branch on origin when that is the commit just pushed. `verify` after the merge then runs only the two checks that need the merge (`head-pushed`, `remote-ci-green`).
+- **A slow informational job no longer restarts the whole run.** The stuck-job detector counted informational jobs. A 40 minute `local-model` run made ship cancel and re-run the entire CI run, discarding the progress of every blocking job (about 40 minutes in the second 0.192.0 attempt). Informational jobs are now exempt from that detector.
+- **The tag-time release workflow runs less.** On a tag push only the `rest` leg runs its checks (changelog, version, catalogs, dependency currency and the hosted-CI check that requires every blocking pull-request check to be green for the commit). The test shards, both bench groups and the closure leg are marked `full_only` and run for real on a `workflow_dispatch` dry run. What this gives up is a clean-runner re-run, with the cache off, of those legs at tag time; the pull request's blocking jobs ran the same work for the same tree. A tag pushed for a commit that never had a pull request is guarded only by the hosted-CI check in `rest`, so run the dry run first in that case. `publish` still needs the gate job, still verifies the bundle and package shape on its own runner, and is still the only job with `id-token: write`.
+- **The npm check no longer holds the release open.** `ship` waits 90 s for the registry to show the version. If it is still behind, the release is reported as shipped with the npm check PENDING and marked "NOT YET VERIFIED"; `node scripts/ship.mjs --resume` re-runs only that check. It is never reported as verified before the registry shows the version with its provenance attestation.
+- **Not done, and why.** (a) Running the local release closure in parallel with the other early checks: the closure rebuilds `dist` in place, so overlapping it with checks that read the bundle on the same checkout is unsafe; it needs its own worktree. (b) Moving `language-tools-ghc` and `language-suites` to the informational tier: the early gate (the closure alone is 1080 s, of which `test:loop` is 567 s) is longer than the slowest hosted blocking job, so the change would remove a merge check and save no wall-clock time until the closure shrinks. (c) Dropping the hosted release workflow's remaining checks entirely: not done, and not recommended.
+
 ## 0.192.0 - Faster pushes: a fast gate tier, an early release gate, and the bench gates on the pull request
 
 - **What a push runs.** The default pre-push tier no longer repeats work the hosted pull-request CI already runs and blocks the merge on. It skips the CVE-replay corpus and layer-recall locally, runs self-scan and the Haskell precision check live only when the change touches code they measure (the first hosted run of the new \`bench-gates\` job failed on a self-scan drift that the fast tier had skipped, which is why self-scan stays local for scripts, hooks and engine changes), and runs only the unit-test files that can see the change (reverse import graph plus named-path mentions in `scripts/gate-select.mjs`) instead of the whole suite. A change it cannot bound, or a selection over 60% of the suite, runs everything. `--full` or `AGENTIC_SECURITY_PUSH_GATE=full` restores the old gate. Every skipped check is printed with its reason and is never reported as passed.