Kjell Tore Guttormsen
887691490d
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TcQyMTQfyrsAapaCMPxTtQ
43 lines
3.4 KiB
Markdown
43 lines
3.4 KiB
Markdown
# STATE — llm-security
|
||
|
||
**👉 NESTE — START HER: v7.8.3 SHIPPED. Next is the v8.0.0 planning (PARKED behind a visibility decision).**
|
||
v7.8.3 is fully released: 12 commits pushed to Forgejo (tip `3219996`), tag `v7.8.3` pushed, catalog ref
|
||
bumped v7.8.2→v7.8.3 (catalog commit `9d42292`), `check-versions.mjs` = **0 ERROR** (lone WARN `okr`,
|
||
pre-existing/unrelated). Suite **2016/0**. Nothing pending on v7.8.3.
|
||
Next body of work is **v8.0.0** (deprecation cleanup + behaviour-preserving commons extraction + the
|
||
deferred items below), but it is **PARKED** behind an operator visibility decision on the 3 untracked
|
||
`docs/*.md` (v8 strategy, DO NOT PUSH — public mirror). Decide that first before starting v8.
|
||
|
||
## v7.8.3 — what shipped (the MEDIUM sweep + 1)
|
||
52 open completion-review findings triaged (5 Opus verifiers) → 48 confirmed, 3 feature-requests, 1 non-defect.
|
||
Corrected severity: **0 CRITICAL/HIGH, 21 MEDIUM, 27 LOW** (every review-claimed HIGH fell to MEDIUM).
|
||
Shipped **47 MEDIUM-tier fixes + 1 live-protocol fix** (`post-mcp-verify` now reads PostToolUse
|
||
`tool_response` — MCP-output injection scanning was silently inert in live sessions). Full triage:
|
||
`docs/medium-triage.local.md` (gitignored).
|
||
**Deferred to v8:** #11 persistence detector (only its doc fix shipped), #27 AST-taint f-string recall,
|
||
#34/#35/#37 missing AST09/AST10/MCP05 detectors (feature-requests), #49 non-defect.
|
||
|
||
## Ground truth (verified 2026-07-18, post-release)
|
||
- `npm test` = **2016/0**. plugin.json == package.json == README badge == **7.8.3**; test badge 2013;
|
||
posture 16 categories, red-team 72 scenarios, 14 orchestrated scanners; doc-consistency 30/30.
|
||
- #30 is SCOPED: `decodeEmbedded` is OPT-IN on `normalizeForScan` (default off — appending a decoded copy
|
||
double-counted content-extractor's per-match findings; caught by skill-scanner-narrative). Only
|
||
signature-scanner opts in. **Do NOT re-broaden it into the shared normalizer.**
|
||
- Scanner `VERSION` constants are frozen at 7.5.0 (unbumped since; left as-is — pre-existing, out of scope).
|
||
|
||
## Guardrails that bit this session (keep)
|
||
- **NEVER `git add -A`; stage explicit paths — AND check `git status` for surprise PRE-STAGED files before
|
||
every commit.** An external pre-staged change (post-mcp-verify) rode into a commit via a plain
|
||
`git commit`; caught it with `reset --soft` + `restore --staged`. (It was later shipped intentionally.)
|
||
- A commit MESSAGE containing the literal pipe-to-shell pattern is blocked by the voyage pre-bash hook — reword.
|
||
- Test-pollution trap: `jetbrains-parser.test.mjs` asserts no `llmsec-jb-*` mkdtemp survives — use another prefix.
|
||
- The completion review's own text is a premiss, not a fact — re-verify every finding against current code
|
||
(severities in particular did not survive: all review-claimed HIGHs downgraded).
|
||
|
||
## Continuity
|
||
origin = Forgejo `open/llm-security` (PUBLIC, never GitHub). STATE.md intentionally TRACKED
|
||
(`.gitignore:19-20` NOTE). Disclosure: fix committed, HELD until its release tag exists (satisfied for v7.8.3).
|
||
Push window: weekdays 20:00–23:00; weekends/holidays anytime. **DO NOT PUSH** the 3 untracked `docs/*.md`
|
||
(parked v8 strategy) — they reference a private sibling. Release mechanics: push commits →
|
||
`release-plugin.mjs <plugin> --version X.Y.Z --create-tag` → `--write --commit --push` → check-versions 0 ERROR.
|
||
Position (v8): llm-security consolidates; growth at family level (security-commons + `llm-retrieval-guard`).
|