@clear-capabilities/agentic-security-scanner 0.195.19 → 0.195.21

package/CHANGELOG.md

@@ -9,6 +9,31 @@
 > make the history less accurate, not more.
 
 
+## 0.195.21 - The GA programme ledger: every shipped surface owned, every acceptance record machine-checked, every expected hosted job required
+
+**Measured, 0.195.20:** `TIMINGS preflight=3s push=6s pr=1s checks=363s merge=5s verify=5s tag=2s release=192s npm=267s total=844s release-clock=204s`, shipped in 15 min 53 s on the second attempt (the first stopped in the hosted checks: the version bump had regenerated the scorecard before the support registry was re-measured, so the two carried different measurement dates; the scorecard was regenerated on the clean tree). The npm check was re-run once with `--resume`.
+
+The plan to bring every shipped capability to GA (the GA plan PRD, an untracked root working document) is a 24 to 32 week programme, most of which needs data, hardware, people and weeks. This release builds the part of it that is code, GA-01 (inventory and release evidence), and records the rest as unmet so that the distance is visible instead of assumed.
+
+- **The acceptance ledger** (`docs/ga-program/ledger.json`, `scripts/ga-program/ledger.mjs`, guide `docs/ga-program/README.md`). One record per shipped registry capability (36: 19 GA, 15 Preview, 2 Labs), in the record shape and the six states the PRD's section 8 specifies, with the workstreams of its section 5 tables and the GA-12 surfaces as tracked subcapabilities under a parent capability. Mechanical records (the GA bar, evidence identity, a current-engine independent record, every model path through the egress policy) are computed from the committed artifacts at render time and never typed; a manual `passed` is counted only with a source commit, a command, an evidence path that exists and a date inside the 30 day review window. Owners are roles until a person is named; none is invented. The generated `STATUS.md` reports verified GA against the registry's GA: **0 of 36**, because no capability has a current-engine independent accuracy record with identity (the scorecard says unmeasured; the independent record is engine 0.141.0 with no commit or bundle digest), and says so.
+- **Every shipped surface is owned.** `scripts/ga-program/inventory.mjs` reads 193 surfaces from the source that ships them (the CLI's dispatch switch, the format sets, `ALL_TOOLS`, slash commands, hooks, agents, skills, integration targets, ticket providers, distributions; environment variables are counted, not mapped) and the ledger maps each to a capability or a tracked subcapability. `ledger.mjs --check` fails on an orphan surface, a mapping whose surface no longer ships, a declared pass without evidence, a ledger that disagrees with the registry's maturity, a stale status page, or a documented count the checkout contradicts. It runs in `check-doc-drift --gate` (so in the hosted docs checks) and in `test:lifecycle`. Five documents and two plugin manifests said the MCP server has 17 tools; it registers 25. Corrected, and now gated.
+- **A missing expected hosted job fails the release gate.** `evaluateRemoteCi` judged only the check runs that reported for the commit, so a blocking workflow that silently stopped triggering could not turn it red (a pure-function probe with one green job and one required-but-absent job returned ok). Every blocking name in `.github/required-checks.json` is now expected: one that did not report is an error unless the file declares it path-filtered (`applicability`; `dependency-currency`'s paths, pinned equal to the workflow's own filter) and none of the commit's changed paths matches, in which case the gate prints why it was skipped; unknown changed paths fail closed; `--allow-unverified-ci` downgrades it to the UNVERIFIED warning and the result records the bypass. Eleven negative and positive pins.
+- **The all-GA milestone gate.** A new fast release check, `ga-milestone-gate`, evaluates the ledger on every release: not declared, every unmet reason is one warning (83 today); declared (`program.milestone.declared`), each is an error, and a release published with `--allow-unverified-ci` cannot claim the milestone. `release-prepare` now regenerates the inventory and the status page.
+- **What the new rule found on its first release.** The first ship of this version stopped at the post-merge verify: seven blocking jobs "did not report" for a commit whose pull-request checks were all green. The cause was in the gate, not the workflows: the check-runs query had never been paginated, and the release commit had 38 check runs against a page size of 30, so every earlier release gate had judged only the first page without knowing it. The query is paginated now (one run per line across pages), the one unclassified check run (`CodeQL`, the code-scanning service's summary, not a workflow job) stays deliberately unlisted and is judged whenever it reports, and the rule is pinned against a parsed paginated output.
+- **Side fixes.** `test:lifecycle` had been passing four test files (`workflow-confinement`, `check-bundle-source`, `ship`, `release-prepare`) to the description lint instead of to the test runner; the combined `npm test` still ran them through the union, the scoped script did not. They run in the scope now. The release-check header comments still said `--fast` skips three gates; it skips twenty.
+- **What the mechanical checks found.** `egress-all-model-paths` names two scripts that send a prompt without evaluating the egress policy, `scripts/synthesize-detector.mjs` (the PRD's finding) and `scripts/autopilot.mjs` (a second one the check found); the `model-egress-policy` record is `failed` until the next release routes both through the shared bounded call. Nothing in this release changes a maturity label.
+
+## 0.195.20 - Haskell remediation: the password-hash migration over the SHA package, and every refused class names its decision
+
+**Measured, 0.195.19:** `TIMINGS preflight=3s push=7s pr=5s checks=683s merge=5s verify=5s tag=2s release=315s npm=145s total=1170s release-clock=327s`, shipped in 21 min 10 s (the npm check was re-run once with `--resume`; the registry listed the version on the second check).
+
+The remediation survey after 0.195.19 (`bench/dag/dev-haskell/fix-real.mjs <project> --all` over the five projects holding labelled true positives) left one class of real true positive refused that a deterministic patch can cover: gitit's password hash (`src/Network/Gitit/State.hs:69`, three labelled sites carried on it), which hashes with the `SHA` package and declares no KDF library. The migration fixer required cryptonite or crypton in the file.
+
+- **`hs-password-kdf-migrate` gains a second backend.** When the file hashes with `Data.Digest.Pure.SHA` and imports no cryptonite/crypton module, PBKDF2-HMAC-SHA256 for one 32-byte block (RFC 8018 section 5.2) is written out in the file as `hashPasswordPbkdf2` over that package's `hmacSha256` (SHA 1.6.4.4, lazy bytes); the bytes of a `String` come from utf8-string when the file imports it, else from `text`. The tag, the kept legacy function, `NeedsRehash`, `Verify` and the comparison rewrite are the same migration as before. The construction is checked against the RFC 7914 section 11 vectors with the real package (the generated definition, count literal replaced; the test skips loudly where the package is absent, and ran on the measuring host). One hash at 600000 iterations measured 4.3 s of CPU on the maintainer's host with this pure-Haskell HMAC: the plan's consequences say seconds, not tenths, and that lowering the count weakens the hash. MITIGATION, as before.
+- **The rule recognises the construction.** `legacyVerifierOnly` counts a project function as a password KDF when it is the written-out derivation: an HMAC of a modelled module, `iterate`, and `xor` among its calls and its where-bound definitions, decided from the calls, never from a name (an iterated HMAC with no xor fold keeps the full finding, pinned). The SHA package's HMACs and digest readers are registered as rule APIs.
+- **Every refused class names its decision.** `CLASS_REASONS` gained CWE-248 (partial function on caller input), CWE-327 (broken cipher or ECB) and CWE-329 (static IV); the four IHP `!!` sites and the crypto rules now get a class reason instead of the generic refusal. Pinned over eleven classes.
+- **Real sites.** gitit `State.hs:69` verifies (syntax, rescan with the kept hash lowered to `info` as a legacy verifier, effective check; the compile gate did not run on that clone, as before, because its original does not type-check on this host). Labelled true positives with a verified patch: 20 of 27 (17 before). The 51 flagged fresh sites are unchanged (`bench:haskell-precision:check` passes unchanged).
+
 ## 0.195.19 - The end-of-programme measurement of the two untouched Haskell splits, recorded as measured
 
 **Measured, 0.195.18:** `TIMINGS preflight=3s push=26s pr=10s checks=360s merge=7s verify=5s tag=3s release=223s npm=359s total=996s release-clock=238s`, shipped in 18 min 18 s. The first attempt stopped in the hosted checks on the public-contract test (fixed in that release, see its entry); the second passed, and the npm check was re-run once with `--resume`. The release clock (merge to published release) was 238 s.

package/dist/{a77aa336d58c5d071a4d.json → 7feb08356355c30181a1.json}

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.195.19",
+  "version": "0.195.21",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -131,7 +131,7 @@
     "verification:conformance:check": "node ../scripts/verification-conformance-check.mjs",
     "verification:conformance:static": "node ../scripts/verification-conformance-check.mjs --static",
     "verification:replay-example": "node ../scripts/verification-replay-example.mjs",
-    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/gate-select.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/gate-warm.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
+    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/gate-select.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/gate-warm.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js test/ga-program.test.js test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/premortem.test.js test/context-intelligence/git-diff-candidates.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",