@clear-capabilities/agentic-security-scanner 0.195.20 → 0.195.21

package/CHANGELOG.md

@@ -9,6 +9,20 @@
 > make the history less accurate, not more.
 
 
+## 0.195.21 - The GA programme ledger: every shipped surface owned, every acceptance record machine-checked, every expected hosted job required
+
+**Measured, 0.195.20:** `TIMINGS preflight=3s push=6s pr=1s checks=363s merge=5s verify=5s tag=2s release=192s npm=267s total=844s release-clock=204s`, shipped in 15 min 53 s on the second attempt (the first stopped in the hosted checks: the version bump had regenerated the scorecard before the support registry was re-measured, so the two carried different measurement dates; the scorecard was regenerated on the clean tree). The npm check was re-run once with `--resume`.
+
+The plan to bring every shipped capability to GA (the GA plan PRD, an untracked root working document) is a 24 to 32 week programme, most of which needs data, hardware, people and weeks. This release builds the part of it that is code, GA-01 (inventory and release evidence), and records the rest as unmet so that the distance is visible instead of assumed.
+
+- **The acceptance ledger** (`docs/ga-program/ledger.json`, `scripts/ga-program/ledger.mjs`, guide `docs/ga-program/README.md`). One record per shipped registry capability (36: 19 GA, 15 Preview, 2 Labs), in the record shape and the six states the PRD's section 8 specifies, with the workstreams of its section 5 tables and the GA-12 surfaces as tracked subcapabilities under a parent capability. Mechanical records (the GA bar, evidence identity, a current-engine independent record, every model path through the egress policy) are computed from the committed artifacts at render time and never typed; a manual `passed` is counted only with a source commit, a command, an evidence path that exists and a date inside the 30 day review window. Owners are roles until a person is named; none is invented. The generated `STATUS.md` reports verified GA against the registry's GA: **0 of 36**, because no capability has a current-engine independent accuracy record with identity (the scorecard says unmeasured; the independent record is engine 0.141.0 with no commit or bundle digest), and says so.
+- **Every shipped surface is owned.** `scripts/ga-program/inventory.mjs` reads 193 surfaces from the source that ships them (the CLI's dispatch switch, the format sets, `ALL_TOOLS`, slash commands, hooks, agents, skills, integration targets, ticket providers, distributions; environment variables are counted, not mapped) and the ledger maps each to a capability or a tracked subcapability. `ledger.mjs --check` fails on an orphan surface, a mapping whose surface no longer ships, a declared pass without evidence, a ledger that disagrees with the registry's maturity, a stale status page, or a documented count the checkout contradicts. It runs in `check-doc-drift --gate` (so in the hosted docs checks) and in `test:lifecycle`. Five documents and two plugin manifests said the MCP server has 17 tools; it registers 25. Corrected, and now gated.
+- **A missing expected hosted job fails the release gate.** `evaluateRemoteCi` judged only the check runs that reported for the commit, so a blocking workflow that silently stopped triggering could not turn it red (a pure-function probe with one green job and one required-but-absent job returned ok). Every blocking name in `.github/required-checks.json` is now expected: one that did not report is an error unless the file declares it path-filtered (`applicability`; `dependency-currency`'s paths, pinned equal to the workflow's own filter) and none of the commit's changed paths matches, in which case the gate prints why it was skipped; unknown changed paths fail closed; `--allow-unverified-ci` downgrades it to the UNVERIFIED warning and the result records the bypass. Eleven negative and positive pins.
+- **The all-GA milestone gate.** A new fast release check, `ga-milestone-gate`, evaluates the ledger on every release: not declared, every unmet reason is one warning (83 today); declared (`program.milestone.declared`), each is an error, and a release published with `--allow-unverified-ci` cannot claim the milestone. `release-prepare` now regenerates the inventory and the status page.
+- **What the new rule found on its first release.** The first ship of this version stopped at the post-merge verify: seven blocking jobs "did not report" for a commit whose pull-request checks were all green. The cause was in the gate, not the workflows: the check-runs query had never been paginated, and the release commit had 38 check runs against a page size of 30, so every earlier release gate had judged only the first page without knowing it. The query is paginated now (one run per line across pages), the one unclassified check run (`CodeQL`, the code-scanning service's summary, not a workflow job) stays deliberately unlisted and is judged whenever it reports, and the rule is pinned against a parsed paginated output.
+- **Side fixes.** `test:lifecycle` had been passing four test files (`workflow-confinement`, `check-bundle-source`, `ship`, `release-prepare`) to the description lint instead of to the test runner; the combined `npm test` still ran them through the union, the scoped script did not. They run in the scope now. The release-check header comments still said `--fast` skips three gates; it skips twenty.
+- **What the mechanical checks found.** `egress-all-model-paths` names two scripts that send a prompt without evaluating the egress policy, `scripts/synthesize-detector.mjs` (the PRD's finding) and `scripts/autopilot.mjs` (a second one the check found); the `model-egress-policy` record is `failed` until the next release routes both through the shared bounded call. Nothing in this release changes a maturity label.
+
 ## 0.195.20 - Haskell remediation: the password-hash migration over the SHA package, and every refused class names its decision
 
 **Measured, 0.195.19:** `TIMINGS preflight=3s push=7s pr=5s checks=683s merge=5s verify=5s tag=2s release=315s npm=145s total=1170s release-clock=327s`, shipped in 21 min 10 s (the npm check was re-run once with `--resume`; the registry listed the version on the second check).

package/dist/{de59e9dc044605ecc699.json → 7feb08356355c30181a1.json}

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.195.20",
+  "version": "0.195.21",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -131,7 +131,7 @@
     "verification:conformance:check": "node ../scripts/verification-conformance-check.mjs",
     "verification:conformance:static": "node ../scripts/verification-conformance-check.mjs --static",
     "verification:replay-example": "node ../scripts/verification-replay-example.mjs",
-    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/gate-select.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/gate-warm.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
+    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/gate-select.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/gate-warm.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js test/ga-program.test.js test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js && node ../scripts/lint-command-descriptions.mjs",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/premortem.test.js test/context-intelligence/git-diff-candidates.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",