chore(llm-security): STATE — v7.8.3 shipped; next = v8.0.0 planning (parked)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ

STATE.md

@@ -1,50 +1,43 @@
 # STATE — llm-security
 
-**👉 NESTE — START HER: v7.8.3 is CODE-COMPLETE LOCALLY but NOT released.**
-10 commits on `main` (tip `4cffa30`), suite **2016/0**, gitleaks clean, NOT pushed/tagged/catalog-synced.
-Two things gate "done", both need an operator decision:
-1. **PUSH the release** (public mirror `open/llm-security`). Saturday → window open, but the commits
-   carry exploit descriptions; held for explicit go. Release mechanics (in order, per convention):
-   `git push origin` → `release-plugin.mjs llm-security --version 7.8.3 --create-tag`
-   → `release-plugin.mjs llm-security --version 7.8.3 --write --commit --push` → `check-versions.mjs` = 0 ERROR.
-   (release-plugin REFUSES until plugin.json == README badge == 7.8.3 AND the tag exists — both true now / by step 2.)
-2. **`post-mcp-verify.mjs` uncommitted change** (in working tree, NOT in any commit): reads
-   `tool_response ?? tool_output` instead of only `tool_output` — a REAL latent bug (live PostToolUse
-   sends `tool_response`, so MCP-output injection scanning silently never fired live). +3 tests, green.
-   BUT it is **unattributed** (appeared pre-staged mid-session, not one of the 52 findings) and OUT of the
-   approved v7.8.3 scope. Decide: ship as a 48th fix (own commit), hold for a follow-up, or it's your edit.
+**👉 NESTE — START HER: v7.8.3 SHIPPED. Next is the v8.0.0 planning (PARKED behind a visibility decision).**
+v7.8.3 is fully released: 12 commits pushed to Forgejo (tip `3219996`), tag `v7.8.3` pushed, catalog ref
+bumped v7.8.2→v7.8.3 (catalog commit `9d42292`), `check-versions.mjs` = **0 ERROR** (lone WARN `okr`,
+pre-existing/unrelated). Suite **2016/0**. Nothing pending on v7.8.3.
+Next body of work is **v8.0.0** (deprecation cleanup + behaviour-preserving commons extraction + the
+deferred items below), but it is **PARKED** behind an operator visibility decision on the 3 untracked
+`docs/*.md` (v8 strategy, DO NOT PUSH — public mirror). Decide that first before starting v8.
 
-## What v7.8.3 is (the MEDIUM sweep)
-52 open completion-review findings triaged (5 Opus verifiers) → **48 confirmed, 3 feature-requests, 1 non-defect**.
+## v7.8.3 — what shipped (the MEDIUM sweep + 1)
+52 open completion-review findings triaged (5 Opus verifiers) → 48 confirmed, 3 feature-requests, 1 non-defect.
 Corrected severity: **0 CRITICAL/HIGH, 21 MEDIUM, 27 LOW** (every review-claimed HIGH fell to MEDIUM).
-Shipped: **47 fixes** (48 minus #27, deferred). Full triage: `docs/medium-triage.local.md` (gitignored).
-Deferred to v8: **#11** persistence detector (kept only its doc fix), **#27** AST f-string recall,
-**#34/#35/#37** missing AST09/AST10/MCP05 detectors (feature-requests), **#49** non-defect.
+Shipped **47 MEDIUM-tier fixes + 1 live-protocol fix** (`post-mcp-verify` now reads PostToolUse
+`tool_response` — MCP-output injection scanning was silently inert in live sessions). Full triage:
+`docs/medium-triage.local.md` (gitignored).
+**Deferred to v8:** #11 persistence detector (only its doc fix shipped), #27 AST-taint f-string recall,
+#34/#35/#37 missing AST09/AST10/MCP05 detectors (feature-requests), #49 non-defect.
 
-## The 10 commits (all HELD until tag)
-`b224e18` yaml/workflow (#32,33,43) · `21c6c2b` normalization+SIG (#21,23,30,36,42,52,55) ·
-`8a59d61` hooks (#9,10,12,13,#11-doc) · `66e8ce2` misc (#20,22,50,54,56) · `76f190c` AST (#28,29) ·
-`196517f` supply-chain (#14-19,48) · `f3aaf54` trigger/toxic/policy (#26,38,39,40,41,57) ·
-`207385f` robustness/DoS (#24,25,31,51,53) · `1407016` tests (#58,59) · `4cffa30` docs+v7.8.3 bump (#8,44,45,46,47).
-NOTE: `git log` order differs (parallel waves); hashes above are the authoritative finding→commit map.
-
-## Ground truth (verified 2026-07-18)
-- `npm test` = **2016/0** (2013 release + 3 post-mcp-verify). Release tip `4cffa30` = 2013/0.
-- plugin.json == package.json == README badge == **7.8.3**; test badge 2013; doc-consistency 30/30.
-- #30 was scoped: `decodeEmbedded` is OPT-IN on `normalizeForScan` (default off — appending a decoded
-  copy double-counted content-extractor's per-match findings; caught by skill-scanner-narrative). Only
-  signature-scanner opts in. Do NOT re-broaden it into the shared normalizer.
-- Scanner `VERSION` constants are frozen at 7.5.0 (not bumped since; left as-is — out of scope).
+## Ground truth (verified 2026-07-18, post-release)
+- `npm test` = **2016/0**. plugin.json == package.json == README badge == **7.8.3**; test badge 2013;
+  posture 16 categories, red-team 72 scenarios, 14 orchestrated scanners; doc-consistency 30/30.
+- #30 is SCOPED: `decodeEmbedded` is OPT-IN on `normalizeForScan` (default off — appending a decoded copy
+  double-counted content-extractor's per-match findings; caught by skill-scanner-narrative). Only
+  signature-scanner opts in. **Do NOT re-broaden it into the shared normalizer.**
+- Scanner `VERSION` constants are frozen at 7.5.0 (unbumped since; left as-is — pre-existing, out of scope).
 
 ## Guardrails that bit this session (keep)
-- **NEVER `git add -A`; stage explicit paths.** A pre-staged external change (post-mcp-verify) still
-  rode into commit J via a plain `git commit` — had to `reset --soft` + `restore --staged` to amend it out.
-  Check `git status` for surprise staged/modified files BEFORE every commit.
-- A commit MESSAGE containing the pipe-to-shell literal is blocked by the voyage pre-bash hook — reword release notes.
+- **NEVER `git add -A`; stage explicit paths — AND check `git status` for surprise PRE-STAGED files before
+  every commit.** An external pre-staged change (post-mcp-verify) rode into a commit via a plain
+  `git commit`; caught it with `reset --soft` + `restore --staged`. (It was later shipped intentionally.)
+- A commit MESSAGE containing the literal pipe-to-shell pattern is blocked by the voyage pre-bash hook — reword.
 - Test-pollution trap: `jetbrains-parser.test.mjs` asserts no `llmsec-jb-*` mkdtemp survives — use another prefix.
+- The completion review's own text is a premiss, not a fact — re-verify every finding against current code
+  (severities in particular did not survive: all review-claimed HIGHs downgraded).
 
 ## Continuity
-origin = Forgejo `open/llm-security` (PUBLIC, never GitHub). STATE.md is intentionally TRACKED
-(`.gitignore:19-20` NOTE). Disclosure: fix committed, HELD until its release tag exists. Push window:
-weekdays 20:00–23:00; weekends/holidays anytime. **DO NOT PUSH** the 3 untracked `docs/*.md` (parked v8 strategy).
+origin = Forgejo `open/llm-security` (PUBLIC, never GitHub). STATE.md intentionally TRACKED
+(`.gitignore:19-20` NOTE). Disclosure: fix committed, HELD until its release tag exists (satisfied for v7.8.3).
+Push window: weekdays 20:00–23:00; weekends/holidays anytime. **DO NOT PUSH** the 3 untracked `docs/*.md`
+(parked v8 strategy) — they reference a private sibling. Release mechanics: push commits →
+`release-plugin.mjs <plugin> --version X.Y.Z --create-tag` → `--write --commit --push` → check-versions 0 ERROR.
 Position (v8): llm-security consolidates; growth at family level (security-commons + `llm-retrieval-guard`).