llm-security/STATE.md

STATE — llm-security

👉 NESTE — START HER: v8.0.0 planning is UNPARKED. Start with the plan in docs/roadmap.local.md. The visibility decision is MADE (operator, 2026-07-18): the v8 strategy docs are LOCAL-ONLY. All 4 (FAMILY-MAP, JOBS-TO-BE-DONE, commons-extraction-plan, roadmap) were renamed to docs/*.local.md (gitignored via the *.local.md pattern; cross-refs updated). roadmap.md was a 4th family member previously hidden only by accident — the root-level ROADMAP.md ignore pattern matched it case-insensitively. git status is clean; nothing untracked can leak to the public mirror. Next body of work: v8.0.0 (deprecation cleanup + behaviour-preserving commons extraction + the deferred items below). Read docs/roadmap.local.md first — it is the product roadmap the plan hangs off. v7.8.3 remains fully released: tag v7.8.3 pushed, catalog ref bumped (catalog commit 9d42292), check-versions.mjs 0 ERROR, suite 2016/0. Nothing pending on it.

v7.8.3 — what shipped (the MEDIUM sweep + 1)

52 open completion-review findings triaged (5 Opus verifiers) → 48 confirmed, 3 feature-requests, 1 non-defect. Corrected severity: 0 CRITICAL/HIGH, 21 MEDIUM, 27 LOW (every review-claimed HIGH fell to MEDIUM). Shipped 47 MEDIUM-tier fixes + 1 live-protocol fix (post-mcp-verify now reads PostToolUse tool_response — MCP-output injection scanning was silently inert in live sessions). Full triage: docs/medium-triage.local.md (gitignored). Deferred to v8: #11 persistence detector (only its doc fix shipped), #27 AST-taint f-string recall, #34/#35/#37 missing AST09/AST10/MCP05 detectors (feature-requests), #49 non-defect.

Ground truth (verified 2026-07-18, post-release)

• npm test = 2016/0. plugin.json == package.json == README badge == 7.8.3; test badge 2013; posture 16 categories, red-team 72 scenarios, 14 orchestrated scanners; doc-consistency 30/30.
• #30 is SCOPED: decodeEmbedded is OPT-IN on normalizeForScan (default off — appending a decoded copy double-counted content-extractor's per-match findings; caught by skill-scanner-narrative). Only signature-scanner opts in. Do NOT re-broaden it into the shared normalizer.
• Scanner VERSION constants are frozen at 7.5.0 (unbumped since; left as-is — pre-existing, out of scope).

Guardrails that bit this session (keep)

• NEVER git add -A; stage explicit paths — AND check git status for surprise PRE-STAGED files before every commit. An external pre-staged change (post-mcp-verify) rode into a commit via a plain git commit; caught it with reset --soft + restore --staged. (It was later shipped intentionally.)
• A commit MESSAGE containing the literal pipe-to-shell pattern is blocked by the voyage pre-bash hook — reword.
• Test-pollution trap: jetbrains-parser.test.mjs asserts no llmsec-jb-* mkdtemp survives — use another prefix.
• The completion review's own text is a premiss, not a fact — re-verify every finding against current code (severities in particular did not survive: all review-claimed HIGHs downgraded).

Continuity

origin = Forgejo open/llm-security (PUBLIC, never GitHub). STATE.md intentionally TRACKED (.gitignore:19-20 NOTE). Disclosure: fix committed, HELD until its release tag exists (satisfied for v7.8.3). Push window: weekdays 20:00–23:00; weekends/holidays anytime. The v8 strategy docs live in docs/*.local.md (gitignored — they reference a private sibling; keep them LOCAL-ONLY). Release mechanics: push commits → release-plugin.mjs <plugin> --version X.Y.Z --create-tag → --write --commit --push → check-versions 0 ERROR. Position (v8): llm-security consolidates; growth at family level (security-commons + llm-retrieval-guard).