open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

chore(llm-security): STATE — v8.0.0 plan approved; next = Phase 1 (supply-chain-recheck Berry TDD)

Browse source 
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
This commit is contained in:
Kjell Tore Guttormsen 2026-07-20 07:26:10 +02:00
commit 46b4c1b48d
1 changed files with 37 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

77
STATE.md
View file

@ -1,46 +1,43 @@
# STATE — llm-security # STATE — llm-security
**👉 NESTE — START HER: v8.0.0 planning is UNPARKED. Start with the plan in `docs/roadmap.local.md`.** **👉 NESTE — START HER: v8.0.0-planen er GODKJENT (operatør, 2026-07-20). Start Fase 1 i
The visibility decision is MADE (operator, 2026-07-18): the v8 strategy docs are LOCAL-ONLY. All 4 `docs/v8.0.0-plan.local.md` — TDD: failing test først for Berry-lockfile-parsing i
(`FAMILY-MAP`, `JOBS-TO-BE-DONE`, `commons-extraction-plan`, `roadmap`) were renamed to `scanners/supply-chain-recheck.mjs` (porter hookens parser, `pre-install-supply-chain.mjs:322-351`).**
`docs/*.local.md` (gitignored via the `*.local.md` pattern; cross-refs updated). `roadmap.md` was a Planen har 6 faser, hver grønn før neste: (1) B8-fixes: supply-chain-recheck Berry + nested-v1-rekursjon
4th family member previously hidden only by accident — the root-level `ROADMAP.md` ignore pattern + content-extractor per-occurrence attribution; (2) B10 docs-konsistens + utvidet doc-consistency-test;
matched it case-insensitively. `git status` is clean; nothing untracked can leak to the public mirror. (3) B11 BREAKING: fjern de 4 EnvWarn-wirede env-varsene + `riskScoreV1` (null konsumenter, verifisert),
Next body of work: **v8.0.0** (deprecation cleanup + behaviour-preserving commons extraction + the redefiner posture-scannerens TRIFECTA_MODE-grep-heuristikk, ~44 test-migreringer via CLAUDE_PROJECT_ROOT;
deferred items below). Read `docs/roadmap.local.md` first — it is the product roadmap the plan hangs off. (4) commons step 0: nytt repo `llm-security-commons` v0.1.0 — **prereq: operatør oppretter Forgejo-repoet
v7.8.3 remains fully released: tag `v7.8.3` pushed, catalog ref bumped (catalog commit `9d42292`), FØR Fase 4**; (5) extraction med golden byte-identisk gate per tabell-swap; (6) release 8.0.0.
`check-versions.mjs` 0 ERROR, suite **2016/0**. Nothing pending on it. Alle 4 beslutningspunkter godkjent per planens anbefalinger: ghost-vars = doc-fix (SCR_OFFLINE/OFFLINE
fjernes fra docs, ikke implementeres); synthesizer «(12 scanners)» = verifiser-så-bump i Fase 2;
JAR-hardening = valgfritt, avgjøres ved Fase 1-review.
## v7.8.3 — what shipped (the MEDIUM sweep + 1) ## Ground truth for v8-planen (verifisert 2026-07-18 mot `0e2601f` av 4 read-only agenter)
52 open completion-review findings triaged (5 Opus verifiers) → 48 confirmed, 3 feature-requests, 1 non-defect. - **Roadmap-korreksjoner:** B8 krympet 6→2,5 (items 1/2/5 alt fikset i v7.8.3; item 4 zip-bomb IKKE
Corrected severity: **0 CRITICAL/HIGH, 21 MEDIUM, 27 LOW** (every review-claimed HIGH fell to MEDIUM). reproduserbar — cap-før-lesing siden v6.4.0). B10: 2/7 lukket, 5 gjenstår.
Shipped **47 MEDIUM-tier fixes + 1 live-protocol fix** (`post-mcp-verify` now reads PostToolUse - **B11-removal-settet er nøyaktig** de 4 varsene gjennom `getPolicyValueWithEnvWarn`
`tool_response` — MCP-output injection scanning was silently inert in live sessions). Full triage: (policy-loader.mjs:217): INJECTION_MODE, TRIFECTA_MODE, ESCALATION_WINDOW, AUDIT_LOG
`docs/medium-triage.local.md` (gitignored). (+ DEPRECATION_QUIET dør med mekanismen). 6 vars UTEN policy-ekvivalent beholdes.
**Deferred to v8:** #11 persistence detector (only its doc fix shipped), #27 AST-taint f-string recall, - **Commons-seeding låst i planen:** tier som eksplisitt felt; TRE divergerende homoglyph-tabeller
#34/#35/#37 missing AST09/AST10/MCP05 detectors (feature-requests), #49 non-defect. flyttes AS-IS (ingen unifisering); secret-egress seedes fra hookens 18-entry tabell (ikke
knowledge/secrets-patterns.md — PCRE-flavored, agent-consumed, forblir separat);
`signature-scanner`s loadRules() er malen for commons-loader.mjs; hooks krever synkron lokal lesing.
- v7.8.3 fullt released: tag pushet, catalog-ref `9d42292`, check-versions 0 ERROR, suite **2016/0**.
- #30 SCOPED: `decodeEmbedded` er OPT-IN på `normalizeForScan` — kun signature-scanner. IKKE re-broaden.
- Scanner `VERSION`-konstanter frosset på 7.5.0 (pre-existing, out of scope).
## Ground truth (verified 2026-07-18, post-release) ## Guardrails (keep)
- `npm test` = **2016/0**. plugin.json == package.json == README badge == **7.8.3**; test badge 2013; - **ALDRI `git add -A`; stage eksplisitte stier — og sjekk `git status` for pre-stagede filer før commit.**
posture 16 categories, red-team 72 scenarios, 14 orchestrated scanners; doc-consistency 30/30. - Commit-MESSAGE med literal pipe-to-shell-mønster blokkeres av voyage pre-bash-hooken — omformuler.
- #30 is SCOPED: `decodeEmbedded` is OPT-IN on `normalizeForScan` (default off — appending a decoded copy - Test-pollution: `jetbrains-parser.test.mjs` asserter at ingen `llmsec-jb-*` mkdtemp overlever.
double-counted content-extractor's per-match findings; caught by skill-scanner-narrative). Only - Reviews/roadmaps er premisser, ikke fakta — re-verifiser mot dagens kode før handling
signature-scanner opts in. **Do NOT re-broaden it into the shared normalizer.** (B8/B10-krympingen over er nettopp dette; zip-bomb-påstanden overlevde ikke verifisering).
- Scanner `VERSION` constants are frozen at 7.5.0 (unbumped since; left as-is — pre-existing, out of scope).
## Guardrails that bit this session (keep)
- **NEVER `git add -A`; stage explicit paths — AND check `git status` for surprise PRE-STAGED files before
every commit.** An external pre-staged change (post-mcp-verify) rode into a commit via a plain
`git commit`; caught it with `reset --soft` + `restore --staged`. (It was later shipped intentionally.)
- A commit MESSAGE containing the literal pipe-to-shell pattern is blocked by the voyage pre-bash hook — reword.
- Test-pollution trap: `jetbrains-parser.test.mjs` asserts no `llmsec-jb-*` mkdtemp survives — use another prefix.
- The completion review's own text is a premiss, not a fact — re-verify every finding against current code
(severities in particular did not survive: all review-claimed HIGHs downgraded).
## Continuity ## Continuity
origin = Forgejo `open/llm-security` (PUBLIC, never GitHub). STATE.md intentionally TRACKED origin = Forgejo `open/llm-security` (PUBLIC, aldri GitHub). STATE.md bevisst TRACKED
(`.gitignore:19-20` NOTE). Disclosure: fix committed, HELD until its release tag exists (satisfied for v7.8.3). (`.gitignore:19-20` NOTE). v8-strategidokumentene + v8-planen ligger i `docs/*.local.md`
Push window: weekdays 20:00–23:00; weekends/holidays anytime. The v8 strategy docs live in (gitignored — refererer privat søsken; hold LOCAL-ONLY). Push-vindu: hverdager 20:00–23:00;
`docs/*.local.md` (gitignored — they reference a private sibling; keep them LOCAL-ONLY). Release mechanics: push commits → helg/helligdag når som helst. Release-mekanikk: push commits → `release-plugin.mjs <plugin>
`release-plugin.mjs <plugin> --version X.Y.Z --create-tag` → `--write --commit --push` → check-versions 0 ERROR. --version X.Y.Z --create-tag` → `--write --commit --push` → check-versions 0 ERROR.
Position (v8): llm-security consolidates; growth at family level (security-commons + `llm-retrieval-guard`). Posisjon (v8): llm-security konsoliderer; vekst på familienivå (security-commons + `llm-retrieval-guard`).