@surlymochan/evalid 0.5.17 → 0.5.18

package/CHANGELOG.md

@@ -3,6 +3,15 @@
 All notable changes to this project are documented here. Detailed notes live in
 [RELEASE_NOTES.md](RELEASE_NOTES.md).
 
+## [0.5.18] - 2026-11-09
+
+### Added
+- **Export proof verdicts as SARIF for code scanning (#92, closes #73)**: sealed-proof failures now surface as code scanning alerts, not just a red check and a PR comment. `action/sarif.mjs` maps each proof-failure verdict to a SARIF 2.1.0 rule — binding_mismatch / snapshot_mismatch / green_tree_mismatch / reexec_* and the other validator failures (level error; warning for tests_skipped_or_todo / tests_counts_unknown) — one result per named file (file-level location; the validator records no line numbers), degrading to the proof file itself when a verdict has no file location. Stable `partialFingerprints` (`change-id/phase/attempt/verdict/file`) so re-runs of the same proof update the existing alert instead of opening a duplicate; merging upserts per proof, so a valid proof clears its alert. `valid` / `not_required` / infrastructure verdicts produce zero results. `verify-proof.mjs` gains `--sarif-out <path>` (with matching `sarif-out` input and `sarif_path` / `sarif_written` outputs in action.yml); `proof-ledger.yml` passes `--sarif-out evalid-proof.sarif` per proof and uploads with `github/codeql-action/upload-sarif` (`security-events: write`; upload runs on `always()` so it fires exactly when a proof failed, and is `continue-on-error` so fork PRs stay green). Test evidence: 11 new tests in `test/github-action-sarif.test.js` (verdict→rule mapping + levels, per-file locations, no-file degradation, fingerprint stability, merge upsert / valid-clears-alert, SARIF 2.1.0 shape, action.yml declarations, CLI end-to-end on a real sealed proof); PR CI runs verify 42567046823 and ledger 42567046908 both pass; merged main CI run 42567609280 success.
+
+Issue #73 — **closed with end-to-end evidence** (comment 2026-11-09T05:46:16Z, demo PR #94, closed unmerged): a sealed green proof with a tampered `test/demo-sarif.test.js` went red — ledger run 42568411445 fail, verdict `green_tree_mismatch`, files `[test/demo-sarif.test.js]` only; SARIF upload success, analysis 2124250892 (results_count 1), code scanning alert #1 visible in the Security tab (rule `evalid/green-tree-mismatch`, severity error). Re-run (attempt 2, analysis 2124258699) opened no duplicate alert, and the same fingerprint from the earlier demo PR #93 did not create a new alert either. Restoring the test file cleared it — ledger run 42568823086 pass, verdict `valid`, analysis 2124265677 (results_count 0), alert #1 state `fixed` on refs/pull/94/merge. A green PR produces no alert (PR #92 itself has no sealed proof: no SARIF upload, no analysis; main branch alerts 0).
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2 / P1-3 / P2-1 / P2-3 still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is stopped on MiniMax Token Plan quota exhaustion. No bench numbers are claimed in this release.
+
 ## [0.5.17] - 2026-11-09
 
 ### Added

package/RELEASE_NOTES.md

@@ -1,5 +1,15 @@
 # Release Notes
 
+## 0.5.18 - Proof verdicts as SARIF for code scanning (issue #73 closed)
+
+Patch release. One merged PR since 0.5.17, verified end to end in CI and locally, with the Security-tab acceptance evidence from a demo PR.
+
+**Export proof verdicts as SARIF for code scanning (#92, closes #73).** Sealed-proof failures now surface as code scanning alerts, not just a red check and a PR comment. `action/sarif.mjs` maps each proof-failure verdict to a SARIF 2.1.0 rule (binding / snapshot / green-tree / reexec failures at error level; skipped-tests and unknown-counts at warning), one result per named file, with stable fingerprints so re-runs update the existing alert instead of duplicating it and a valid proof clears its alert. `verify-proof.mjs` gains `--sarif-out`, and `proof-ledger.yml` uploads the SARIF per proof (fires exactly when a proof failed; fork PRs stay green). Test evidence: 11 new tests in `test/github-action-sarif.test.js`; PR CI runs verify 42567046823 and ledger 42567046908 both pass; merged main CI run 42567609280 success.
+
+**Issue #73 — closed with end-to-end evidence** (demo PR #94, closed unmerged): a sealed green proof with a tampered `test/demo-sarif.test.js` went red — ledger run 42568411445 fail, verdict `green_tree_mismatch`, files `[test/demo-sarif.test.js]` only; SARIF upload success, analysis 2124250892 (results_count 1), code scanning alert #1 visible in the Security tab (rule `evalid/green-tree-mismatch`, severity error). A re-run opened no duplicate alert, and restoring the test file cleared it — ledger run 42568823086 pass, verdict `valid`, analysis 2124265677 (results_count 0), alert #1 state `fixed` on refs/pull/94/merge. A green PR produces no alert (main branch alerts 0).
+
+Acceptance debt, stated plainly: the bench-number acceptance for P1-2, P1-3, P2-1 and P2-3 — the wall-clock/token/resolved lines from issue #5 — still awaits the MiniMax full-matrix batch (15 instances × 4 arms × reps 3), which is stopped on MiniMax Token Plan quota exhaustion. No bench numbers are claimed in this release.
+
 ## 0.5.17 - I6d assertion-execution gate (milestone M3 accepted)
 
 Patch release. Three merged PRs since 0.5.16, all verified end to end in CI and locally.

package/docs/launch-dossier.md

@@ -1,6 +1,6 @@
 # evalid Launch Dossier
 
-Generated: 2026-11-08T23:43:07.000Z
+Generated: 2026-11-09T05:51:48.645Z
 Mode: post_publish
 Verdict: conditionally ready: engine and adoption evidence are strong, registry publication remains required for a splash launch
 Launch ready: not yet
@@ -117,7 +117,7 @@ Evidence:
 - Adoption records: 1; status: pass
 - Goal audit: pass; goal: Keep evalid credible as an open-source agent delivery runtime: repo-owned workflow contracts, executable verification gates, durable project context, and honest benchmark evidence.
 - Package evidence: missing; source: registry_json
-- Package name/version: @surlymochan/evalid@0.5.17
+- Package name/version: @surlymochan/evalid@0.5.18
 
 ## Passing Evidence
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@surlymochan/evalid",
-  "version": "0.5.17",
+  "version": "0.5.18",
   "description": "Claimed != verified: a runtime verification layer for coding agents. It seals each test run and replays it from a clean snapshot, with a zero-judge gate pipeline (spec clarification, code review, TDD proof) and the xflow CLI.",
   "keywords": [
     "ai-agents",