49 lines
3.3 KiB
Markdown
49 lines
3.3 KiB
Markdown
# STATE — llm-security
|
||
|
||
**Active focus:** NONE active. v7.8.0 RELEASED; security-fix track (F-1/F-2/F-3) +
|
||
TRG/SIG/AST scanners ALL DONE; **internal codename fully scrubbed from Forgejo + force-pushed
|
||
(DONE this session).** Only loose end = **F-4 (optional, LOW)**. Clean, quiescent state.
|
||
|
||
## Codename scrub (THIS session — operator: "must not appear anywhere on Forgejo") — DONE
|
||
- Full history-rewrite via `git filter-repo` + **force-push** (`d11de9a` → `a19e9eb`).
|
||
Verified: 0 occurrences in any blob across all refs, 0 in any commit message, 0 filenames.
|
||
- Tip prose reworded by hand (CHANGELOG, CLAUDE.md, README, docs/version-history.md, STATE.md);
|
||
scanners now referred to as TRG/SIG/AST only.
|
||
- Two `docs/plans/` docs (a gap-analysis + its trekplan, both named after the codename)
|
||
deleted from ALL history via `--invert-paths` (the `.html` render was git-ignored — deleted
|
||
locally only). Leftover historical blobs + 2 commit messages scrubbed via
|
||
`--replace-text`/`--replace-message` (`(?i)<codename> ==> TRG/SIG/AST`).
|
||
- Backup of pre-scrub history: `/tmp/llm-security-pre-scrub-backup.bundle` (all refs; old HEAD
|
||
`d11de9a`) — LOCAL only, never on Forgejo; delete once satisfied.
|
||
- RESIDUAL (server-side): old unreachable objects may linger on Forgejo until git GC. To
|
||
guarantee physical removal, run repo housekeeping/GC as Forgejo admin (`ktg`).
|
||
|
||
## What shipped (DONE — do NOT re-derive)
|
||
- **v7.8.0 release — Session C. DONE** (pure version-sync; no production code). Bumped
|
||
7.7.2 → 7.8.0 across `.claude-plugin/plugin.json`, `package.json`, `README.md` badge,
|
||
`CLAUDE.md` header + range sentinel; CHANGELOG `[7.8.0]`, version-history section, README
|
||
"Recent versions" row, CLAUDE.md highlights added. Release gate: `node --test` 1863/0.
|
||
Tagged `v7.8.0` (annotated, commit `6d3c4b5`) + pushed; catalog `ref`/README synced
|
||
7.7.2 → 7.8.0 (catalog commit `843254d`) — version-consistency gate → OK.
|
||
- **TRG/SIG/AST scanners — Steps 1–7. DONE** (`54115a9`..`d19abf0`, SHAs change after rewrite).
|
||
Three deterministic deep-scan scanners: `scanners/trigger-scanner.mjs` (TRG, LLM06/AST04),
|
||
`scanners/signature-scanner.mjs` (SIG, rules `knowledge/signatures.json`, LLM03/LLM02),
|
||
`scanners/ast-taint-scanner.mjs` (AST, parse-only `scanners/lib/py-ast-taint.py` + regex
|
||
fallback, LLM01/LLM02/AST02). Wired into orchestrator + policy; prefixes in `output.mjs`.
|
||
- **Security-fix track — F-1/F-2/F-3 + F-5/F-6. DONE** (Sessions A+B). All shell-injection /
|
||
path-traversal sinks closed. Brief: `docs/security-fix-brief-2026-06-20.md`.
|
||
|
||
## Still open (optional only)
|
||
- **F-4 — optional, LOW** (by-design MCP spawn; confirm-gate is a judgment call). NOT required.
|
||
- Residual gap (inline in F-2 fix): prefix containment in `auto-cleaner.mjs` does not stop a
|
||
symlink inside the tree pointing out. Known, accepted.
|
||
|
||
## COLD START (next session)
|
||
1. `pwd` + `git status`. Tip should be `a19e9eb` (or later) on `origin/main`.
|
||
2. No active task queued. Options: F-4 confirm-gate if wanted, or a new direction. Do NOT
|
||
invent scope — ask. (If the codename ever needs re-checking: `git grep -i <codename>
|
||
$(git rev-list --all)` must stay empty.)
|
||
|
||
## Continuity notes
|
||
- origin = Forgejo `open/llm-security` (never GitHub). Push window: weekdays 20:00–23:00;
|
||
weekends/holidays anytime.
|