- tests/lib/review-rounds.test.mjs: round 2 whose Claude Security payload
holds the round-1 BLOCKER only in out_of_scope keeps it counted through
the real finalize and verdict gate (BLOCK, gate exit 1, not under
Resolved since round 1); a clean run resolves it (F-V4; red under the
mutation that drops out_of_scope from raisedOutside).
- README.md, SECURITY.md: "blocks only at confidence high" names the
exception of decision 222 (counted at high in an earlier round, it stays
counted when it comes back below high or outside the scope) (F-V5).
- commands/trekreview.md Phase 5: an engine finding is held by a matching
finding in review.md (engine MAJOR/BLOCKER put back first) or a matching
below_threshold / out_of_scope entry; an engine MINOR or SUGGESTION the
coordinator left out holds nothing, a known issue (decision 226).
- tests/lib/review-prose-pins.test.mjs: both sentences pinned; red on the
old prose.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Two fail-closed checks in security-engine.mjs convert (decision 224), both
"not measured" (exit 2, the reason on stderr, nothing on stdout):
- the stamp's findings.total is not a non-negative integer, or the JSONL
holds another number of records (a JSONL that lost the only BLOCKER line
converted clean before; part 3 verifier, F3);
- the stamp's scope is not an empty list: a scan limited by --scope, an
absent scope or a non-list scope (Claude Security 0.12.0 writes scope: []
for an unscoped scan; F4).
The real Claude Security 0.12.0 probe report still converts: exit 0, one
BLOCKER, two below_threshold.
Decision 223, text only: the module header and SECURITY.md keep the
head/base check and say it is a trace, not a signature: code the reviewed
run executed can write a report folder of its own (convert reads the
matching one whose name sorts last) or delete the real one first (F2, a
known issue). /trekreview's not-measured list names the two new reasons.
The test helper writes the real stamp shape by default (findings.total =
the records in the JSONL written, scope: []). New tests for behaviour that
had none (F6): no fallback from an unverified newest match, a two-stamp
folder passed over, a symlinked stamp, JSONL or folder refused, a malformed
or absent scan_prefix, an unrecorded empty_diff or empty_scope.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase 4.7 of /trekreview runs security-engine.mjs choose first. Claude
Security runs through its own skill (scan changes --base {before_sha}
--effort high); its cost question goes to the operator, and "No", a
question nobody can answer or a missing Workflow tool records it as not
run, never a fallback to /security-review. /security-review runs only
when choose picked it. Its report is converted by security-engine.mjs
convert, never transcribed; below_threshold is declined as
engine:below-threshold. With no engine the expected reviewer
security-engine never reports, so the verdict gate exits 2 and the
summary says "security: not measured" and why, never 0. --quick keeps no
security engine. The Engine summary line, the template's ran line, the
hard rules (the engine's report folder, scan changes only) and the
allowed-tools (Workflow) follow.
Engine prose follows in commands/trekexecute.md, docs/command-modes.md,
docs/architecture.md, CLAUDE.md, README.md, SECURITY.md and Handover 6:
Claude Security recommended, proprietary so called by name and never a
manifest dependency; without it /security-review; with neither "not
measured".
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Wave-1 order 4 (P7, P12, the P9 test lock, the P3 plan-approval guard).
All command hooks; none runs a model.
- P12: pre-bash-executor answers permissionDecision "ask" before merge
into main, push, tag/publish and destructive git (holds in auto mode).
post-approval-log writes exactly what the person was asked to the K2
approval log: merge/push to main as `merge`, tag/publish as `release`,
with a one-hour expiry; nothing when no person was asked.
- P3: pre-plan-gate runs the K3 plan gate on a Voyage plan leaving plan
mode and sends a refused plan back; "not measured" asks, never passes.
- P9: lib/util/test-lock.mjs (K8). pre-write-executor refuses edits to
locked test files; stop-test-lock refuses "done" for the locking
session (stop_hook_active guarded).
- P7: post-edit-check runs the target repo's own formatter/linter per
edit, only during a Voyage plan run or after opt-in
(.claude/voyage-guards.json); lib/verification/step-check.mjs (K9) fails
the step on findings; no tool reads "not measured", never green.
- STORM cap matcher also names `Agent` (the tool's name since 2.1.63).
- Mod precondition stated in README, SECURITY.md and every PreToolUse stop
guard: Voyage's guards are deterministic only when no installed mod
handles `tool.check`.
K2, K3 and K5 are stubbed in tests until orders 2 and 3 are merged.
Two independent review rounds; every finding has a regression test.
Suite 1600 (1598 pass / 0 fail / 2 skipped).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
hooks.json wired pre-write-executor.mjs to the Write tool only, so Edit and
NotebookEdit reached .git/hooks/, .env, shell configs and the other protected
paths unguarded. The matcher is now Write|Edit|NotebookEdit.
The guard reads the target path per tool: file_path for Write and Edit (hooks
reference, PreToolUse tool_input tables), notebook_path for NotebookEdit (the
tool's input schema). When it cannot read a path (unparseable input, unknown
tool, missing field) it now blocks instead of allowing.
New tests resolve hooks.json with Claude Code's matcher semantics and run the
hooks that would fire per tool: 9 failed on the old code, all pass now. The two
fail-open pins in path-guard.test.mjs are flipped to fail closed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
README claimed four security layers including scoped per-child tool
access (gone with the launched children), an auto-dispatched Phase 7.6
recovery session and a launch template; architecture.md still pointed at
launch.sh. They now describe what 6.0.0 does: session specs plus
orders.md, a recovery order for a session the user opens, three layers.
operations.md gets a status note instead of a rewrite (decision record).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Forgejo registration is disabled instance-wide, so the documented
private-issue path required an account no external reporter could
create. Add security@fromaitochitta.com as the primary channel (matches
convention in repo-standard, llm-security, .profile) and keep the
private-issue path as a secondary option for reporters who already have
an account. Also fixes the issue-tracker URL, which pointed at
open/ktg-plugin-marketplace instead of this repo's own open/voyage.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHo7hCEHKzLCmAVRKXkJNJ
Step 12 of v3.4.1 plan. Surgical line-by-line generalization of references
to the ultra-cc-architect plugin (no longer publicly distributed):
- CLAUDE.md: 8 hits → "opt-in upstream architect plugin (not bundled)"
- README.md: 9 hits including bare slug at line 646 (removed entirely);
rephrased to "no longer publicly distributed" with the architecture/
filesystem slot still supported by /ultraplan-local
- SECURITY.md: 1 hit → generalized "Opt-in upstream architect step"
CHANGELOG.md historical references preserved per brief; appended a
2026-05-04 note at top of [3.0.0] block stating the plugin is no longer
publicly distributed but the architecture/overview.md slot remains
supported for any compatible producer.
The architecture/overview.md filesystem contract (Handover 3, EXTERNAL,
drift-WARN) is unchanged — anyone implementing a compatible producer
can plug in.
361 tests still green (no regressions). doc-consistency pins for
/ultracontinue-local and Handover 7 § Lifecycle still pass.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
