everything-claude-code

fix(rules/ruby): correct brakeman flag and unify bundle-audit invocation

Two issues from the post-merge review of #1860:

1. **`brakeman --no-pager` is not a real flag.** Brakeman has no
   `--no-pager` option (that's `git` / `gh` style). It appeared in
   three locations:
   - `rules/ruby/hooks.md` L18 (bullet recommendation)
   - `rules/ruby/hooks.md` L32 (CI gate snippet)
   - `rules/ruby/security.md` L38 (dependency check snippet)

   Replaced with `--no-progress`, which is the closest valid option
   (suppresses the progress bar while keeping warning output —
   what hook contexts usually want). `-q` / `--no-color` would also
   be valid alternatives but `--no-progress` matches the original
   intent best.

2. **`bundle-audit` invocation was inconsistent across the two
   files.** `rules/ruby/security.md` L37 used the
   `bundle audit check --update` Bundler plugin subcommand form,
   while `rules/ruby/hooks.md` L20 used the direct
   `bundle exec bundle-audit check --update` binary form.

   Both invoke the same `bundler-audit` gem but look different
   enough to confuse readers. Standardized on the
   `bundle exec bundle-audit` form (the portable invocation that
   works across bundler-audit gem versions without depending on the
   plugin registering a `bundle audit` subcommand).

Both issues were also flagged in PR #1860 review comments (#1, #2 of
my comprehensive review; the bundle-audit one was independently
caught by greptile-apps and coderabbitai bots).

Full test suite (`node tests/run-all.js`): 2382 passed, 0 failed.
`markdownlint-cli` clean on both files.

zomia · 2026-05-14 09:27:59 +09:00

f3f63dee4e

docs: sync roadmap after ECC-Tools depth-plan check

Affaan Mustafa · 2026-05-13 20:10:38 -04:00

6cdac19764

docs: sync roadmap after ECC-Tools team backlog job (#1880 )

Affaan Mustafa · 2026-05-13 19:44:49 -04:00

af3a206412

docs: sync roadmap after ECC-Tools AI cost job (#1878 )

Affaan Mustafa · 2026-05-13 19:26:48 -04:00

20f00c1410

docs: sync roadmap after ECC-Tools reference-set job (#1877 )

Affaan Mustafa · 2026-05-13 19:09:35 -04:00

e7a6f137e5

docs: sync roadmap after ECC-Tools harness job (#1876 )

Affaan Mustafa · 2026-05-13 18:50:45 -04:00

7596502092

docs: sync roadmap after ECC-Tools security evidence job (#1875 )

Affaan Mustafa · 2026-05-13 18:32:06 -04:00

c04baa8c25

docs: sync roadmap after ECC-Tools CI diagnostics (#1874 )

Affaan Mustafa · 2026-05-13 18:12:31 -04:00

9082bdedac

docs: sync roadmap after ECC-Tools hosted planning (#1872 )

Affaan Mustafa · 2026-05-13 12:48:50 -04:00

3243a1c5d3

docs: sync roadmap after ECC-Tools depth readiness (#1871 )

Affaan Mustafa · 2026-05-13 12:26:32 -04:00

69401b28b3

docs: sync roadmap after AgentShield corpus expansion

Records AgentShield PR #82 and moves the next AgentShield roadmap slice to hosted evidence-pack workflow depth.

Affaan Mustafa · 2026-05-13 09:04:34 -04:00

9a5ed3223a

docs: sync roadmap after AgentShield remediation workflows

Records AgentShield PR #81 and advances the next AgentShield roadmap slice after remediation workflow phases landed.

Affaan Mustafa · 2026-05-13 08:46:07 -04:00

d844bd6bfc

docs: sync roadmap after AgentShield corpus recommendations

Syncs the ECC 2.0 GA roadmap after AgentShield PR #80 landed corpus accuracy recommendations.

Affaan Mustafa · 2026-05-13 08:28:12 -04:00

cf54c791e4

docs: sync roadmap after ECC-Tools PR draft tracking (#1865 )

Affaan Mustafa · 2026-05-13 08:11:09 -04:00

bd4369e1d5

docs: sync roadmap after AgentShield fingerprint hardening

Affaan Mustafa · 2026-05-13 07:53:15 -04:00

f2be190dcb

docs: sync roadmap after ECC-Tools hardening

Affaan Mustafa · 2026-05-13 07:32:55 -04:00

2afef0f18b

docs: mark JARVIS backend audit clean

Affaan Mustafa · 2026-05-13 07:15:13 -04:00

967e5c6922

docs: sync ECC 2.0 GA roadmap after hardening pass

Affaan Mustafa · 2026-05-13 06:59:20 -04:00

2d29643dd4

feat: add Ruby and Rails rules

Affaan Mustafa · 2026-05-13 06:27:08 -04:00

c2762dd569

docs: sync AgentShield adapter roadmap

Record AgentShield #68/#69 in the ECC GA roadmap and update the next enterprise slice.

Affaan Mustafa · 2026-05-13 04:43:58 -04:00

cb3509ee19

ci: gate observability on release safety evidence

Add release-safety evidence coverage to observability readiness and refresh rc.1 publication gate docs.

Affaan Mustafa · 2026-05-13 04:14:47 -04:00

42f04edc03

fix: fall back to ASCII instinct status bars

Fixes #1855

Affaan Mustafa · 2026-05-13 02:59:58 -04:00

d4728a0d80

fix: harden GateGuard destructive bash tokenizer

Co-authored-by: Jamkris <dltmdgus1412@gmail.com>

SeungHyun · 2026-05-13 02:43:04 -04:00

0e169fecbc

docs: sync AgentShield evidence-pack roadmap (#1854 )

Affaan Mustafa · 2026-05-13 02:22:05 -04:00

b2506f82f6

docs: record post-hardening rc1 release evidence (#1852 )

Affaan Mustafa · 2026-05-13 01:32:58 -04:00

f6e13ab520

ci: disable checkout credential persistence in privileged workflows (#1851 )

Affaan Mustafa · 2026-05-13 01:15:49 -04:00

209abd403b

harden: remove shell access from read-only analyzers (#1850 )

Affaan Mustafa · 2026-05-13 01:00:26 -04:00

2486732714

docs: gate ECC progress sync readiness

Make the ECC 2.0 GitHub/Linear/handoff/roadmap progress-sync model part of the local observability readiness gate instead of leaving it as roadmap prose only.

- add `docs/architecture/progress-sync-contract.md` for GitHub, Linear, handoff, roadmap, and work-items sync
- add a `Tracker Sync` check to `scripts/observability-readiness.js`
- update observability tests with passing and missing-contract coverage
- update observability and GA roadmap docs so the local readiness gate is now 18/18 and records #1848 supply-chain hardening evidence

Validation:
- node tests/scripts/observability-readiness.test.js (9 passed, 0 failed)
- npm run observability:ready -- --format json (18/18, ready true)
- npx markdownlint-cli 'docs/architecture/progress-sync-contract.md' 'docs/architecture/observability-readiness.md' 'docs/ECC-2.0-GA-ROADMAP.md'
- git diff --check
- node tests/docs/ecc2-release-surface.test.js (18 passed)
- node tests/run-all.js (2378 passed, 0 failed)
- GitHub CI for #1849 green across Ubuntu, Windows, and macOS

No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

Affaan Mustafa · 2026-05-13 00:38:18 -04:00

63f9bfc33f

docs: add supply-chain incident response playbook

Add a repo-level supply-chain incident response playbook for npm/GitHub Actions package-registry incidents, anchored on the May 2026 TanStack compromise and prior Shai-Hulud-style npm incidents.

- add `docs/security/supply-chain-incident-response.md` with exposure checks, immediate response steps, workflow rules, publication rules, and escalation triggers
- link the playbook from `SECURITY.md`
- reject `pull_request_target` workflows that restore or save shared dependency caches
- add a regression test for the new `pull_request_target + actions/cache` guardrail

Validation:
- node tests/ci/validate-workflow-security.test.js (12 passed, 0 failed)
- node scripts/ci/validate-workflow-security.js (validated 7 workflow files)
- npx markdownlint-cli 'SECURITY.md' 'docs/security/supply-chain-incident-response.md'
- npx markdownlint-cli '**/*.md' --ignore node_modules
- git diff --check
- node tests/run-all.js (2377 passed, 0 failed)
- GitHub CI for #1848 green across Ubuntu, Windows, and macOS

No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

Affaan Mustafa · 2026-05-13 00:22:28 -04:00

cbecf5689d

docs: refresh rc1 release readiness evidence

Add the May 13 rc.1 publication evidence refresh and update the release-readiness/GA roadmap gates after #1846.

- record current queue, security-gate, harness audit, adapter, observability, Node, markdownlint, release-surface, npm publish-surface, and ecc2 Rust evidence
- update the publication-readiness checklist with the May 13 evidence artifact
- normalize zh-CN CLAUDE list markers so markdownlint passes

Validation:
- node tests/docs/ecc2-release-surface.test.js
- node tests/docs/harness-adapter-compliance.test.js
- node tests/docs/stale-pr-salvage-ledger.test.js
- npx markdownlint-cli '**/*.md' --ignore node_modules
- git diff --check
- node tests/run-all.js (2376 passed, 0 failed)
- npm run harness:audit -- --format json (70/70)
- npm run harness:adapters -- --check
- npm run observability:ready -- --format json (16/16)
- node tests/scripts/npm-publish-surface.test.js
- cd ecc2 && cargo test (462 passed, 0 failed)

No release, tag, npm publish, plugin tag, marketplace submission, or announcement was performed.

Affaan Mustafa · 2026-05-13 00:05:51 -04:00

da04a6e344

ci: require npm audit signature checks

Require npm registry signature verification wherever workflow npm audit checks run.

- add npm audit signatures to CI Security Scan and maintenance security audit jobs
- teach the workflow security validator to reject npm audit without signature verification
- keep the repair and Copilot prompt tests portable across Windows path/case and CRLF frontmatter behavior

Validation:
- node tests/run-all.js (2376 passed, 0 failed)
- CI current-head matrix green on #1846

Affaan Mustafa · 2026-05-12 23:48:56 -04:00

797f283036

feat: add GitHub Copilot prompt support

Adds GitHub Copilot VS Code instruction and prompt files for ECC workflows, with VS Code prompt frontmatter/settings aligned to current docs and tests covering the surface.

Co-authored-by: Girish Kanjiyani <girish.kanjiyani5040@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Girish Kanjiyani · 2026-05-12 23:00:00 -04:00

766f4ee1d8

docs: tighten agent capability posture

Remove shell access from two agents that do not need it and reword PyTorch autograd guidance that AgentShield flagged as encoded-payload-like text. AgentShield remains B/75 while findings drop 316->310 and high findings drop 26->21. Local tests passed 2369/2369; full GitHub Actions matrix green.

Affaan Mustafa · 2026-05-12 22:44:39 -04:00

ff1594ea99

fix: close block-no-verify bypass holes

Backport Jamkris's fix for case-insensitive core.hooksPath overrides and the git commit -tn template-path false positive. Verified locally on current main with 25/25 block-no-verify tests and node tests/run-all.js passing 2369/2369.

SeungHyun · 2026-05-12 22:28:12 -04:00

6be241a463

docs: add prompt defense baselines

Add compact prompt-defense baselines to active ECC prompt surfaces and copied CLAUDE examples. AgentShield prompt-defense findings are now zero; local tests passed 2366/2366.

Affaan Mustafa · 2026-05-12 22:22:57 -04:00

393d397efa

ci: harden workflow install boundaries

- run non-test workflow installs with npm ci --ignore-scripts where lifecycle scripts are not needed\n- reject plain npm ci in workflows with write permissions\n- reject actions/cache in id-token: write workflows to reduce OIDC publish cache-poisoning risk

Affaan Mustafa · 2026-05-12 21:55:36 -04:00

daf0355531

ci: ignore install scripts in release workflows (#1839 )

Affaan Mustafa · 2026-05-12 21:36:36 -04:00

33db548be3

feat: add homelab config skills (VLAN segmentation, Pi-hole DNS, WireGuard VPN) (#1838 )

* feat: add homelab config skills (VLAN, Pi-hole, WireGuard)

Adds three homelab configuration skills, extracted from the stale PR #1413
with the same safety treatment applied to the previously accepted batch:

- homelab-vlan-segmentation: IoT/guest/trusted/server VLAN design for UniFi,
  pfSense/OPNsense, and MikroTik. All firewall rules add isolation, not remove
  protections. Added change-window guidance and AP trunk port clarification.

- homelab-pihole-dns: Pi-hole install, blocklists, DNS-over-HTTPS, local DNS
  records, troubleshooting. Docker is now the lead install method; bare-metal
  uses inspect-first pattern before running the installer script.

- homelab-wireguard-vpn: WireGuard server, peer config, split tunnel, DDNS.
  Replaced broad iptables FORWARD ACCEPT with scoped directional rules
  (wg0→eth0 forward + established return only). Credentials moved to env
  files with explicit notes against inline secrets and version control.

Continues the contribution from PR #1413; the eight skills/agents from
that PR are already in main via #1729 and #1731.

* docs: harden homelab skill pack

---------

Co-authored-by: Affaan Mustafa <affaan@dcube.ai>