open/llm-security
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity Actions
llm-security/STATE.md

3.3 KiB
Raw Permalink Blame History

STATE — llm-security

Active focus: NONE active. v7.8.0 RELEASED; security-fix track (F-1/F-2/F-3) + TRG/SIG/AST scanners ALL DONE; internal codename fully scrubbed from Forgejo + force-pushed (DONE this session). Only loose end = F-4 (optional, LOW). Clean, quiescent state.

Codename scrub (THIS session — operator: "must not appear anywhere on Forgejo") — DONE

  • Full history-rewrite via git filter-repo + force-push (d11de9a → a19e9eb). Verified: 0 occurrences in any blob across all refs, 0 in any commit message, 0 filenames.
  • Tip prose reworded by hand (CHANGELOG, CLAUDE.md, README, docs/version-history.md, STATE.md); scanners now referred to as TRG/SIG/AST only.
  • Two docs/plans/ docs (a gap-analysis + its trekplan, both named after the codename) deleted from ALL history via --invert-paths (the .html render was git-ignored — deleted locally only). Leftover historical blobs + 2 commit messages scrubbed via --replace-text/--replace-message ((?i)<codename> ==> TRG/SIG/AST).
  • Backup of pre-scrub history: /tmp/llm-security-pre-scrub-backup.bundle (all refs; old HEAD d11de9a) — LOCAL only, never on Forgejo; delete once satisfied.
  • RESIDUAL (server-side): old unreachable objects may linger on Forgejo until git GC. To guarantee physical removal, run repo housekeeping/GC as Forgejo admin (ktg).

What shipped (DONE — do NOT re-derive)

  • v7.8.0 release — Session C. DONE (pure version-sync; no production code). Bumped 7.7.2 → 7.8.0 across .claude-plugin/plugin.json, package.json, README.md badge, CLAUDE.md header + range sentinel; CHANGELOG [7.8.0], version-history section, README "Recent versions" row, CLAUDE.md highlights added. Release gate: node --test 1863/0. Tagged v7.8.0 (annotated, commit 6d3c4b5) + pushed; catalog ref/README synced 7.7.2 → 7.8.0 (catalog commit 843254d) — version-consistency gate → OK.
  • TRG/SIG/AST scanners — Steps 1–7. DONE (54115a9..d19abf0, SHAs change after rewrite). Three deterministic deep-scan scanners: scanners/trigger-scanner.mjs (TRG, LLM06/AST04), scanners/signature-scanner.mjs (SIG, rules knowledge/signatures.json, LLM03/LLM02), scanners/ast-taint-scanner.mjs (AST, parse-only scanners/lib/py-ast-taint.py + regex fallback, LLM01/LLM02/AST02). Wired into orchestrator + policy; prefixes in output.mjs.
  • Security-fix track — F-1/F-2/F-3 + F-5/F-6. DONE (Sessions A+B). All shell-injection / path-traversal sinks closed. Brief: docs/security-fix-brief-2026-06-20.md.

Still open (optional only)

  • F-4 — optional, LOW (by-design MCP spawn; confirm-gate is a judgment call). NOT required.
  • Residual gap (inline in F-2 fix): prefix containment in auto-cleaner.mjs does not stop a symlink inside the tree pointing out. Known, accepted.

COLD START (next session)

  1. pwd + git status. Tip should be a19e9eb (or later) on origin/main.
  2. No active task queued. Options: F-4 confirm-gate if wanted, or a new direction. Do NOT invent scope — ask. (If the codename ever needs re-checking: git grep -i <codename> $(git rev-list --all) must stay empty.)

Continuity notes

  • origin = Forgejo open/llm-security (never GitHub). Push window: weekdays 20:00–23:00; weekends/holidays anytime.