llm-security/STATE.md

STATE — llm-security

👉 NESTE — START HER: v7.8.3 SHIPPED. Next is the v8.0.0 planning (PARKED behind a visibility decision). v7.8.3 is fully released: 12 commits pushed to Forgejo (tip 3219996), tag v7.8.3 pushed, catalog ref bumped v7.8.2→v7.8.3 (catalog commit 9d42292), check-versions.mjs = 0 ERROR (lone WARN okr, pre-existing/unrelated). Suite 2016/0. Nothing pending on v7.8.3. Next body of work is v8.0.0 (deprecation cleanup + behaviour-preserving commons extraction + the deferred items below), but it is PARKED behind an operator visibility decision on the 3 untracked docs/*.md (v8 strategy, DO NOT PUSH — public mirror). Decide that first before starting v8.

v7.8.3 — what shipped (the MEDIUM sweep + 1)

52 open completion-review findings triaged (5 Opus verifiers) → 48 confirmed, 3 feature-requests, 1 non-defect. Corrected severity: 0 CRITICAL/HIGH, 21 MEDIUM, 27 LOW (every review-claimed HIGH fell to MEDIUM). Shipped 47 MEDIUM-tier fixes + 1 live-protocol fix (post-mcp-verify now reads PostToolUse tool_response — MCP-output injection scanning was silently inert in live sessions). Full triage: docs/medium-triage.local.md (gitignored). Deferred to v8: #11 persistence detector (only its doc fix shipped), #27 AST-taint f-string recall, #34/#35/#37 missing AST09/AST10/MCP05 detectors (feature-requests), #49 non-defect.

Ground truth (verified 2026-07-18, post-release)

• npm test = 2016/0. plugin.json == package.json == README badge == 7.8.3; test badge 2013; posture 16 categories, red-team 72 scenarios, 14 orchestrated scanners; doc-consistency 30/30.
• #30 is SCOPED: decodeEmbedded is OPT-IN on normalizeForScan (default off — appending a decoded copy double-counted content-extractor's per-match findings; caught by skill-scanner-narrative). Only signature-scanner opts in. Do NOT re-broaden it into the shared normalizer.
• Scanner VERSION constants are frozen at 7.5.0 (unbumped since; left as-is — pre-existing, out of scope).

Guardrails that bit this session (keep)

• NEVER git add -A; stage explicit paths — AND check git status for surprise PRE-STAGED files before every commit. An external pre-staged change (post-mcp-verify) rode into a commit via a plain git commit; caught it with reset --soft + restore --staged. (It was later shipped intentionally.)
• A commit MESSAGE containing the literal pipe-to-shell pattern is blocked by the voyage pre-bash hook — reword.
• Test-pollution trap: jetbrains-parser.test.mjs asserts no llmsec-jb-* mkdtemp survives — use another prefix.
• The completion review's own text is a premiss, not a fact — re-verify every finding against current code (severities in particular did not survive: all review-claimed HIGHs downgraded).

Continuity

origin = Forgejo open/llm-security (PUBLIC, never GitHub). STATE.md intentionally TRACKED (.gitignore:19-20 NOTE). Disclosure: fix committed, HELD until its release tag exists (satisfied for v7.8.3). Push window: weekdays 20:00–23:00; weekends/holidays anytime. DO NOT PUSH the 3 untracked docs/*.md (parked v8 strategy) — they reference a private sibling. Release mechanics: push commits → release-plugin.mjs <plugin> --version X.Y.Z --create-tag → --write --commit --push → check-versions 0 ERROR. Position (v8): llm-security consolidates; growth at family level (security-commons + llm-retrieval-guard).