625 Commits

• docs: record AgentShield fleet review items
  Affaan Mustafa · 2026-05-16 02:20:50 -04:00
  fc2d23de80
• docs: record ECC Tools harness fleet routing
  Affaan Mustafa · 2026-05-16 02:02:17 -04:00
  6976a2a7dd
• docs: record ECC Tools hosted finding evidence
  Affaan Mustafa · 2026-05-16 01:49:46 -04:00
  fb28e469f1
• docs: record ECC Tools fleet evidence consumption
  Affaan Mustafa · 2026-05-16 01:38:11 -04:00
  a1cf97e3f2
• docs: record AgentShield fleet routing evidence
  Affaan Mustafa · 2026-05-16 01:24:20 -04:00
  cc83a85eb8
• docs: record AgentShield evidence-pack inspect evidence
  Affaan Mustafa · 2026-05-16 01:03:06 -04:00
  fe49a31e9a
• docs: record AgentShield plugin-cache evidence
  Affaan Mustafa · 2026-05-16 00:27:48 -04:00
  1eb7b0809d
• chore: update statusline ANSI color palette

  - Replace blinking red (5;31m) with bold red (1;31m) for critical context bar
  - Replace cyan metrics (36m) with sky blue (38;5;117m)
  - Replace plain bold task (1m) with bold bright white (1;97m)
  - Update test assertion to match new bold red code

  Kris Pahel · 2026-05-15 23:18:01 -04:00
  50ac061f9e
• Cover advisory source renderer branches
  Affaan Mustafa · 2026-05-15 23:09:54 -04:00
  714200fd20
• Cover advisory source refresh branches
  Affaan Mustafa · 2026-05-15 23:09:54 -04:00
  2b387fb761
• Add supply-chain advisory source refresh
  Affaan Mustafa · 2026-05-15 23:09:54 -04:00
  a8e3bcb00f
• Cover operator dashboard render branches
  Affaan Mustafa · 2026-05-15 22:28:16 -04:00
  2d46c00763
• Include operator dashboard in publish surface test
  Affaan Mustafa · 2026-05-15 22:28:16 -04:00
  3315f0ed61
• Align platform audit with generated dashboard
  Affaan Mustafa · 2026-05-15 22:28:16 -04:00
  e26b5132c2
• Add repeatable operator readiness dashboard
  Affaan Mustafa · 2026-05-15 22:28:16 -04:00
  50f375bc2c
• Harden CI installs against supply-chain lifecycle hooks
  Affaan Mustafa · 2026-05-15 17:29:03 -04:00
  f7035b5644
• Add scheduled supply-chain watch workflow
  Affaan Mustafa · 2026-05-15 16:56:49 -04:00
  6951b8d5d2
• Add discussion audit gate
  Affaan Mustafa · 2026-05-15 16:26:57 -04:00
  6887f2952d
• Add operator readiness dashboard gate
  Affaan Mustafa · 2026-05-15 16:04:11 -04:00
  0b6763463f
• Refresh rc1 evidence for AgentShield provenance
  Affaan Mustafa · 2026-05-15 15:07:15 -04:00
  c0f8c3bc81
• docs: refresh rc1 publication evidence
  Affaan Mustafa · 2026-05-15 14:39:10 -04:00
  1949d75e18
• expand ioc user config targets (#1933)
  Affaan Mustafa · 2026-05-15 13:20:01 -04:00
  c0bac4d6ce
• add platform audit export output

  Adds JSON/markdown export and write-to-file support for the platform audit operator artifact.

  Affaan Mustafa · 2026-05-15 13:02:37 -04:00
  553d507ea6
• docs: verify Codex marketplace readiness (#1931)
  Affaan Mustafa · 2026-05-15 12:30:26 -04:00
  e4fa157d12
• docs: record ECC Tools billing announcement gate (#1929)
  Affaan Mustafa · 2026-05-15 09:34:59 -04:00
  5b617787d8
• docs: gate rc1 announcement live claims (#1928)
  Affaan Mustafa · 2026-05-15 09:14:25 -04:00
  1c079908e2
• docs: refresh rc1 preview pack manifest (#1927)
  Affaan Mustafa · 2026-05-15 08:56:51 -04:00
  1f901ab582
• feat: add platform and supply-chain audit commands (#1926)
  Affaan Mustafa · 2026-05-15 08:06:26 -04:00
  13585f1092
• security: add node-ipc IOC coverage (#1924)
  Affaan Mustafa · 2026-05-15 06:56:57 -04:00
  ee85e1482e
• docs: refresh rc1 publication evidence (#1922)
  Affaan Mustafa · 2026-05-15 06:38:32 -04:00
  5b9acd1d92
• Expand Mini Shai-Hulud IOC coverage (#1921)
  Affaan Mustafa · 2026-05-15 03:20:10 -04:00
  f04702bdac
• fix: harden supply-chain IOC scan (#1918)
  Affaan Mustafa · 2026-05-15 02:50:50 -04:00
  e8e9df52a6
• fix: harden dashboard canary and IOC coverage (#1917)

  fix: harden dashboard canary and IOC coverage

  Affaan Mustafa · 2026-05-15 02:25:48 -04:00
  5349d991c2
• docs: align rules README install namespace
  Affaan Mustafa · 2026-05-15 02:07:43 -04:00
  8af4b5dafb
• fix: harden dashboard canary and IOC coverage
  Affaan Mustafa · 2026-05-15 02:06:46 -04:00
  9af04f3965
• fix(hooks): close grouped command bypasses in gateguard (#1912)

  Inspect executable bodies inside plain subshells and brace groups before applying destructive command classifiers.\n\nCo-authored-by: Jamkris <82251632+Jamkris@users.noreply.github.com>

  SeungHyun · 2026-05-15 01:39:15 -04:00
  8cfadfea28
• feat: add command registry and coverage checks (#1906)

  Salvages the useful parts of #1897 without generated .caliber state or stale counts.
  
  - adds a deterministic command registry generator and drift check
  - commits the current command registry for 75 commands
  - validates the rc.1 README catalog summary against live counts
  - adds a single Ubuntu Node 20 coverage job instead of running coverage in every matrix cell
  
  Co-authored-by: jodunk <jodunk@users.noreply.github.com>

  Affaan Mustafa · 2026-05-14 22:02:36 -04:00
  f7315016c0
• fix: integrate recent hook and docs PRs (#1905)

  Integrates useful changes from #1882, #1884, #1889, #1893, #1898, #1899, and #1903:
  - fix rule install docs to preserve language directories
  - correct Ruby security command examples
  - harden dev-server hook command-substitution parsing
  - add Prisma patterns skill and catalog/package surfaces
  - allow first-time protected config creation while blocking existing configs
  - read cost metrics from Stop hook transcripts
  - emit suggest-compact additionalContext on stdout
  
  Co-authored-by: Jamkris <dltmdgus1412@gmail.com>
  Co-authored-by: Levi-Evan <levishantz@gmail.com>
  Co-authored-by: gaurav0107 <gauravdubey0107@gmail.com>
  Co-authored-by: richm-spp <richard.millar@salarypackagingplus.com.au>
  Co-authored-by: zomia <zomians@outlook.jp>
  Co-authored-by: donghyeun02 <donghyeun02@gmail.com>

  Affaan Mustafa · 2026-05-14 21:37:28 -04:00
  375d750b4c
• security: add supply-chain IOC scanner (#1904)
  Affaan Mustafa · 2026-05-14 21:15:35 -04:00
  7d15a2282b
• docs: sync ECC Tools judge execution (#1901)
  Affaan Mustafa · 2026-05-14 17:38:03 -04:00
  0e66c838c7
• docs: sync ECC Tools judge contract (#1900)
  Affaan Mustafa · 2026-05-14 17:15:54 -04:00
  cb9702ca99
• docs: sync ECC Tools retrieval planning (#1892)
  Affaan Mustafa · 2026-05-14 16:54:30 -04:00
  f9384427b8
• docs: sync ECC Tools hosted output scoring (#1891)
  Affaan Mustafa · 2026-05-13 23:02:23 -04:00
  4423f10cfb
• docs: sync ECC Tools hosted promotion readiness (#1890)
  Affaan Mustafa · 2026-05-13 22:39:01 -04:00
  3b12fb273f
• feat: add Ruby and Rails rules
  Affaan Mustafa · 2026-05-13 06:27:08 -04:00
  c2762dd569
• ci: gate observability on release safety evidence

  Add release-safety evidence coverage to observability readiness and refresh rc.1 publication gate docs.

  Affaan Mustafa · 2026-05-13 04:14:47 -04:00
  42f04edc03
• fix: harden GateGuard destructive bash tokenizer

  Co-authored-by: Jamkris <dltmdgus1412@gmail.com>

  SeungHyun · 2026-05-13 02:43:04 -04:00
  0e169fecbc
• ci: disable checkout credential persistence in privileged workflows (#1851)
  Affaan Mustafa · 2026-05-13 01:15:49 -04:00
  209abd403b
• docs: gate ECC progress sync readiness

  Make the ECC 2.0 GitHub/Linear/handoff/roadmap progress-sync model part of the local observability readiness gate instead of leaving it as roadmap prose only.
  
  - add `docs/architecture/progress-sync-contract.md` for GitHub, Linear, handoff, roadmap, and work-items sync
  - add a `Tracker Sync` check to `scripts/observability-readiness.js`
  - update observability tests with passing and missing-contract coverage
  - update observability and GA roadmap docs so the local readiness gate is now 18/18 and records #1848 supply-chain hardening evidence
  
  Validation:
  - node tests/scripts/observability-readiness.test.js (9 passed, 0 failed)
  - npm run observability:ready -- --format json (18/18, ready true)
  - npx markdownlint-cli 'docs/architecture/progress-sync-contract.md' 'docs/architecture/observability-readiness.md' 'docs/ECC-2.0-GA-ROADMAP.md'
  - git diff --check
  - node tests/docs/ecc2-release-surface.test.js (18 passed)
  - node tests/run-all.js (2378 passed, 0 failed)
  - GitHub CI for #1849 green across Ubuntu, Windows, and macOS
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:38:18 -04:00
  63f9bfc33f
• docs: add supply-chain incident response playbook

  Add a repo-level supply-chain incident response playbook for npm/GitHub Actions package-registry incidents, anchored on the May 2026 TanStack compromise and prior Shai-Hulud-style npm incidents.
  
  - add `docs/security/supply-chain-incident-response.md` with exposure checks, immediate response steps, workflow rules, publication rules, and escalation triggers
  - link the playbook from `SECURITY.md`
  - reject `pull_request_target` workflows that restore or save shared dependency caches
  - add a regression test for the new `pull_request_target + actions/cache` guardrail
  
  Validation:
  - node tests/ci/validate-workflow-security.test.js (12 passed, 0 failed)
  - node scripts/ci/validate-workflow-security.js (validated 7 workflow files)
  - npx markdownlint-cli 'SECURITY.md' 'docs/security/supply-chain-incident-response.md'
  - npx markdownlint-cli '**/*.md' --ignore node_modules
  - git diff --check
  - node tests/run-all.js (2377 passed, 0 failed)
  - GitHub CI for #1848 green across Ubuntu, Windows, and macOS
  
  No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

  Affaan Mustafa · 2026-05-13 00:22:28 -04:00
  cbecf5689d