wardline 1.0.1 — first complete post-reboot release (SEI set-merge)#40

Merged

tachyon-beep merged 188 commits into

mainfrom

Jun 16, 2026

Commits on Jun 7, 2026

chore: untrack local filigree/loomweave workspace files

John Morrissey
and
claude
committed
delete: remove the comprehensive read-only audit report for the Wardline codebase conducted on 2026-06-04
John Morrissey
committed
docs(doctor): spec filigree federation-token check + repair

John Morrissey
and
claude
committed
docs(doctor): implementation plan for filigree.auth check

John Morrissey
and
claude
committed
feat(emit): add FiligreeEmitter.verify_token auth probe

John Morrissey
and
claude
committed
fix(install): preserve operator-pinned --filigree-url/--loomweave-url on repair

John Morrissey
and
claude
committed
feat(doctor): add filigree.auth federation-token check + repair

John Morrissey
and
claude
committed
feat(weft): bounded scan default, gate verdict, suppression_state, C-7 token msg

John Morrissey
and
claude
committed
feat(emit): echo emit destination so a wrong-project write is visible (N1 / C-10a)

John Morrissey
and
claude
committed
fix(install): make managed-block injector C-4 foreign-safe (wardline-906d19b29a)

John Morrissey
and
claude
committed
fix(install): close two C-4 review-panel findings in the block injector

John Morrissey
and
claude
committed
feat(filigree): read filigree's auto-minted federation token in the emit path (F1, weft-23574069a1)

John Morrissey
and
claude
committed

Commits on Jun 8, 2026

fix(taint): candidate-set lambda bindings close non-last-arm sink FN (wardline-383f83fafe)

John Morrissey
and
claude
committed
docs(changelog): note the non-last-arm lambda sink FN fix (wardline-383f83fafe)

John Morrissey
and
claude
committed
fix(test): repair the loomweave-e2e readiness-timeout diagnostic (UnboundLocalError)

John Morrissey
and
claude
committed
fix(agent-summary): partition total_findings across display buckets (W3 residual)

John Morrissey
and
claude
committed
style(taint): apply ruff format to test_variable_level.py

John Morrissey
and
claude
committed
fix(scrub): close 6 P1 correctness defects from the pre-1.0 rule scrub

John Morrissey
and
claude
committed
chore(git): ignore .worktrees/ isolated worktree workspaces

John Morrissey
and
claude
committed
fix(PY-WL-109): model with-blocks and infinite while-True in fall-through analysis

John Morrissey
and
claude
committed
docs(rust): architecture spec + slice-1 plan for the Rust frontend

John Morrissey
and
claude
committed
docs(rust): fold 7-reviewer panel into the Rust-frontend spec + plan

John Morrissey
and
claude
committed
fix(scrub): close 6 P2 correctness defects from the pre-1.0 rule scrub

John Morrissey
and
claude
committed
fix(PY-WL-118): close 3 SQLi false-negatives from the scrub-regression set

John Morrissey
and
claude
committed
docs(rust): conform the spec+plan to Loomweave ADR-049 (Rust qualname dialect FIXED)

John Morrissey
and
claude
committed
fix(PY-WL-104): metadata description omits constant-expression swallow + over-narrows tier

John Morrissey
and
claude
committed
test(rust): vendor Loomweave's qualname corpus + parity-test skeleton (drift-gate live)

John Morrissey
and
claude
committed
feat(rust): WP0 — wardline[rust] extra, tree-sitter loader, NodeId keying authority

John Morrissey
and
claude
committed
fix(weft-4a9d0f863c): make finding fingerprint invariant to taint-resolution drift

John Morrissey
and
claude
committed
test(wardline-obs-638a5d9fd1): lock PY-WL-101 actual_return=EXTERNAL_RAW for DB-cursor reads

John Morrissey
and
claude
committed

Commits on Jun 9, 2026

feat(rust): WP1 — suffix-parameterized discovery + .rs symlink confinement

John Morrissey
and
claude
committed
feat(rust): WP2 — parse + minimal index + ADR-049 qualname dialect

John Morrissey
and
claude
committed
feat(rust): WP3 — trust vocabulary + @trusted provider + cache-version

John Morrissey
and
claude
committed
fix(rust): conform WP2 to the ADR-049 amendment (Option b) + 2 robustness HIGHs

John Morrissey
and
claude
committed
feat(rust): WP4 — builder-dataflow L2 for std::process::Command

John Morrissey
and
claude
committed
feat(rust): WP5 — RS-WL-108/112 rules + RustAnalyzer (the verdict layer)

John Morrissey
and
claude
committed
fix(rust): fold WP4+WP5 adversarial panel — close idiomatic-terminator FNs

John Morrissey
and
claude
committed
feat(rust): WP6 — wire RustAnalyzer into run_scan + CLI --lang rust

John Morrissey
and
claude
committed
fix(rust): fold WP6 adversarial panel — enforce provisional identity, isolate per-file crashes

John Morrissey
and
claude
committed
docs(rust): WP7 — Rust preview guide, CLI reference, CHANGELOG, agent integration

John Morrissey
and
claude
committed
feat(rust): WP6 coverage posture — no vacuous green on an un-annotated repo

John Morrissey
and
claude
committed
fix(PY-WL-114): close stacked-identical-decorator fingerprint collision (wardline-377b896a87)
John Morrissey
committed
test(wardline-6102d4c833): lock the broad-except multi-emit precondition for the move-stability redesign
John Morrissey
committed
feat(engine): proactive fingerprint-collision guard (wardline-8fb773a7af)
John Morrissey
committed
test(rust): re-vendor Phase 1b qualname corpus + land the Loomweave change-set

John Morrissey
and
claude
committed
test(wardline-8fb773a7af): prove the collision guard on the real scan path + align member list
John Morrissey
committed
docs(rekey): land fingerprint-rekey plan spine + reconcile P2 to shipped reality

John Morrissey
and
claude
committed
fix(rust): clear a stale Command builder on a shadowing let-rebind

John Morrissey
and
claude
committed
fix(rust): fold the adversarial bug-hunt — 3 FP/correctness defects + 1 doc-honesty

John Morrissey
and
claude
committed
fix(rust): restore tokio/async command sinks the crate-aware matcher dropped

John Morrissey
and
claude
committed
feat(wardline-7da6f6df29): self-describing fingerprint scheme + loud-fail store loaders (P1 scheme-infra)

John Morrissey
and
claude
committed
fix(wardline-7da6f6df29): prefix the Filigree promote wire to match ingest + fold P1 review

John Morrissey
and
claude
committed
docs(rekey): mark P1 scheme-infra DONE in the three-deliverable runlist

John Morrissey
and
claude
committed
feat(wardline-8654423823): drop line_start from the fingerprint + entity-relative move-stable discriminators (P3 value-rekey, wlfp2)

John Morrissey
and
claude
committed
test(wardline-8654423823): add the S3 discriminator-shape lint + RuleMetadata.multi_emit (fold P3 review)

John Morrissey
and
claude
committed
docs(rekey): mark P3 value-rekey DONE in the three-deliverable runlist

John Morrissey
and
claude
committed
feat(wardline-cdfd2a7808): scan-driven `wardline rekey` migration — carry verdicts across wlfp1->wlfp2 (P4)

John Morrissey
and
claude
committed
fix(wardline-cdfd2a7808): fold P4 5-lens review — close the gate-regression + 5 secondary defects

John Morrissey
and
claude
committed
docs(rekey): mark P4 migration DONE — rekey spine P1-P4 complete

John Morrissey
and
claude
committed
docs(weft-171fc22a50): pin suppression_state as a first-class carried field in the emit contract (C-10(b))

John Morrissey
and
claude
committed
feat(rust): fold self-type generic args into the impl <Type> (ADR-049 amendment 3)

John Morrissey
and
claude
committed
fix(rekey): surface pre-scheme stores + broaden orphan diagnostics (holistic-review polish)

John Morrissey
and
claude
committed
merge(rust): fold the Rust tree-sitter frontend epic (WP0–WP7 + amendment-3) into the release line

John Morrissey
and
claude
committed
harden(legis): freeze the whole Wardline→legis scan-artifact wire key-set (producer half of weft seam S8 / G1)

John Morrissey
and
claude
committed
fix(taint): union pre-loop lambda bindings after the loop fixpoint (wardline-d6af917bde)

John Morrissey
and
claude
committed
fix(rust): model write!/writeln!/format_args! taint propagation (wardline-8a34187941)

John Morrissey
and
claude
committed
harden(federation): route .env/token reads through safe_project_file (wardline-db67828599)

John Morrissey
and
claude
committed
refactor(core): move ruleset_hash below the engine to cure the engine->attest inversion (wardline-9ec283d168)

John Morrissey
and
claude
committed
ci: gate the self-scan, fail-close the live oracles, add report-only import-linter (wardline-751a9ae71b, wardline-83d08aee75, wardline-9ec283d168)

John Morrissey
and
claude
committed
test(rekey): adversarial mixed-scheme + multi-store rollback coverage (wardline-85b418585b)

John Morrissey
and
claude
committed
test(rules): negative below-tier-gate tests for modulated + declaration-gated rules (wardline-f2cbf07013)

John Morrissey
and
claude
committed
refactor(core): add a LanguageFrontend registry so a 3rd language needs no run_scan edit (wardline-09c5808b5a)

John Morrissey
and
claude
committed
fix(taint): close raw-receiver taint laundering via module-name shadowing (wardline-f6a29ce23a)

John Morrissey
and
claude
committed
fix(taint): extend shadow guard to the attribute-READ path (_resolve_expr) — closes wardline-6b79150e79

John Morrissey
and
claude
committed
feat(install): resolve & persist the server-mode Filigree project scope

John Morrissey
and
claude
committed
fix(install): report & probe the server-mode Filigree scope consistently

John Morrissey
and
claude
committed
fix(install): don't churn an already-correctly-scoped loopback --filigree-url

John Morrissey
and
claude
committed
test(conformance): G1 — shared findings golden vector both repos load

John Morrissey
and
claude
committed
docs(plan): Rust SP2 + Phase-1b full-producer sprint plan (5-lens panel-reviewed, findings folded)
John Morrissey
committed
docs(spec): fold Phase 1b producer surface into SP2 (user-approved) + oracle ground-truth corrections

John Morrissey
and
claude
committed
fix(rust): fold ALL stacked #[cfg] predicates + mirror cfg reserved-char escape (oracle rows landed upstream) — closes wardline-4fdad782a7

John Morrissey
and
claude
committed
docs(integration): ADR-049 amendment requests — reserved-colon escape proposal + const-arg spacing

John Morrissey
and
claude
committed
feat(rust): full ADR-049 producer surface — six leaf kinds, impl entity, module→impl→method containment, per-kind cfg twins, full-set conformance

John Morrissey
and
claude
committed

Commits on Jun 10, 2026

Commits on Jun 11, 2026

fix(scan): N-3 scan-root guard — nested-scan-root FACT + loud CLI warning + help note; N-8 dossier resolve-against-scan-root error (closes wardline-8669de3576)

John Morrissey
and
claude
committed
feat(cli): N-2 wardline explain-taint CLI twin + N-5 case-insensitive closed-vocab filters & flat flags (closes wardline-0be02bf8e6, wardline-dc6f44707d)

John Morrissey
and
claude
committed
feat(mcp): A1 — scan tool lang arg, Rust frontend reachable over MCP (closes wardline-2ee1bbda82)

John Morrissey
and
claude
committed
feat(mcp): A2 — doctor MCP twin + server-freshness self-identification (closes wardline-4c5165e896)

John Morrissey
and
claude
committed
feat(mcp): A3 — rekey MCP twin, probe-by-default (closes wardline-d8cc650ab9)

John Morrissey
and
claude
committed
feat(mcp): A4 — fail_on_unanalyzed arg on MCP scan; unanalyzed gate folded into gate_decision (closes wardline-7fd0f3a82c)

John Morrissey
and
claude
committed
feat(mcp): B1+B2 — outputSchema/structuredContent, annotations+title on all 15 tools; protocol negotiation (closes wardline-47ff226ebe, wardline-e63204176b)

John Morrissey
and
claude
committed
fix(scanner): guard recursive lambda taint resolution
John Morrissey
committed
fix(scanner): resolve returns at their statement snapshots
John Morrissey
committed
fix(config): refuse symlinked published port files
John Morrissey
committed
fix(filigree): prioritize env token aliases over dotenv
John Morrissey
committed
fix(legis): sign scan scope in artifacts
John Morrissey
committed
fix(cli): guard default agent-summary output
John Morrissey
committed
fix(cli): honor scan-file-findings gate exit
John Morrissey
committed
fix(mcp): preserve strict defaults for SEI filters
John Morrissey
committed
fix(cli): fail stale attestation reproduction
John Morrissey
committed
fix(attest): disable repo fsmonitor during git state
John Morrissey
committed
fix(install): refuse attest key mint into tracked env
John Morrissey
committed
fix(assure): count unanalyzed files in coverage
John Morrissey
committed
fix(filigree): disable mark_unseen on unanalyzed scans
John Morrissey
committed
fix(taint): include seed dependencies in grammar fingerprint
John Morrissey
committed
fix(ci): pin setup-uv action
John Morrissey
committed
fix(make): refuse symlinked clean targets
John Morrissey
committed
docs: mark install unsafe for untrusted ci
John Morrissey
committed
fix(install): confine skill directory writes
John Morrissey
committed
fix(explain): verify taint fact freshness locally
John Morrissey
committed
fix(loomweave): cap client request bodies
John Morrissey
committed
fix(mcp): expose cli policy gates
John Morrissey
committed
docs: move scan cache outside checkout
John Morrissey
committed
fix(release): pin publish workflow inputs
John Morrissey
committed
fix(ci): isolate sarif upload permission
John Morrissey
committed
fix(sarif): refuse symlinked scan outputs
John Morrissey
committed
test(taint): pin match subject walrus propagation
John Morrissey
committed
fix(rules): ignore unreachable boundary rejections
John Morrissey
committed
fix(taint): preserve project submodule import taint
John Morrissey
committed
fix(taint): authenticate summary cache files
John Morrissey
committed
test(cli): reject forged summary cache entries
John Morrissey
committed
fix(cli): refuse symlinked jsonl output
John Morrissey
committed
fix(scanner): remove fail-open noop analyzer
John Morrissey
committed
fix(gitignore): retain legacy clarion runtime ignore
John Morrissey
committed
fix(coverage): guard decorator unparse recursion
John Morrissey
committed
fix(cli): redact taint-store urls in logs
John Morrissey
committed
fix(cli): escape assure human output
John Morrissey
committed
fix(loomweave): harden linkage total parsing
John Morrissey
committed
fix(dossier): bound source-derived shape text
John Morrissey
committed
test(cli): accept mcp policy args in install test
John Morrissey
committed
fix(explain): fail soft on malformed chain blobs
John Morrissey
committed
fix(loomweave): verify facts against analyzed bytes
John Morrissey
committed
fix(waivers): refuse symlinked waiver writes
John Morrissey
committed
docs: avoid fixed tmp pre-commit output
John Morrissey
committed
fix(baseline): refuse symlinked baseline writes
John Morrissey
committed
fix(taint): fail closed on dynamic trusted levels
John Morrissey
committed
fix(cli): write explicit relative outputs in place
John Morrissey
committed
fix(analyzer): fail closed on unanalyzable code
John Morrissey
committed
fix(diagnostics): narrow native import allowlist
John Morrissey
committed
fix(diagnostics): report unresolved plain imports
John Morrissey
committed
fix(resolver): fail closed on duplicate FQNs
John Morrissey
committed

Commits on Jun 12, 2026

fix(filigree-routes): one dialect-aware parser for every route derived from --filigree-url (dogfood-4 A3/A4, weft-d0df42c739)

John Morrissey
and
claude
committed
fix(autofix): resolve root before relativizing — fix crashed on any invocation with --root . (dogfood-4 A1, weft-6090d9f76d)

John Morrissey
and
claude
committed
fix(mcp-scan): suppress legis_artifact under summary_only unless explicitly requested (dogfood-4 B6, weft-74200b0acf)

John Morrissey
and
claude
committed
fix(doctor): url checks report the answering process's effective config with provenance (dogfood-4 B8, weft-dc7b805dc4)

John Morrissey
and
claude
committed
fix(rekey): probe judges each store against its own scheme; bounded orphan output (dogfood A7, weft-dda1a6d8dd)

John Morrissey
and
claude
committed
fix(explain): name the taint source on sink findings; honest-degrade markers per C-10(c) (dogfood B7, weft-0d24cf9152)

John Morrissey
and
claude
committed
test(conformance): C-13 hostile-input fixture — fail-degraded, never fail-dead (weft-b181c75e39, partial)

John Morrissey
and
claude
committed
test(golden): regen identity corpus for the additive TaintExplanation.sink field (weft-0d24cf9152)

John Morrissey
and
claude
committed

Commits on Jun 13, 2026

fix(taint): PY-WL-101 reads declared body taint; @trusted tolerates legacy to_level

John Morrissey
and
claude
committed
feat(scan): pollable file-backed scan jobs + Filigree-emit hardening

John Morrissey
and
claude
committed
docs: refresh README/docs/site for the RC5 surface; changelog scan-jobs + emit cap

John Morrissey
and
claude
committed
feat(discovery): gitignore-aware pruning walk + expanded skip floor (weft-7c2e573e28)

John Morrissey
and
claude
committed
fix(scan-jobs): clear 5 mypy strict errors in scan_jobs.py (RC5 CI gate)

John Morrissey
and
claude
committed

Commits on Jun 14, 2026

docs: add MCP-tool reference, extend CLI ref, drop compliance overclaim

John Morrissey
and
claude
committed
feat(site): build wardline.foundryside.dev on @weft/site-kit

John Morrissey
and
claude
committed
chore(ci): retire mkdocs + www/ gh-pages deploy (drop ci docs jobs + mkdocs.yml)

John Morrissey
and
claude
committed

Commits on Jun 15, 2026

chore: keep repo code-only — untrack local config/dev tooling

John Morrissey
and
claude
committed
fix(filigree-emit): earn the empty failed[] with per-finding failure tracking

John Morrissey
and
claude
committed
fix(doctor): probe filigree's published port so emit-time auth gaps surface

John Morrissey
and
claude
committed
feat(emit): conform FailedFinding reason surface to canonical weft-reason vocabulary (G1)

John Morrissey
and
claude
committed
feat(waiver): inline SEI-on-entry binding for waiver_add (doctrine spine)

John Morrissey
and
claude
committed
chore(release): cut 1.0.1 — drop rc from version, changelog, and docs

John Morrissey
and
claude
committed
fix(ci): clear lint + de-flake the L2 perf backstop on PR #40

John Morrissey
and
claude
committed
ci: drop the orphaned mkdocs docs-build/docs-deploy jobs

John Morrissey
and
claude
committed
fix(PY-WL-108): a quoted command word is not sanitized (close FN)

John Morrissey
and
claude
committed
fix(release): drop SHA256SUMS from dist/ before the PyPI publish

John Morrissey
and
claude
committed
fix(cli): default scan/baseline output not double-resolved under a relative root

John Morrissey
and
claude
committed
fix(security): symlink/TOCTOU hardening for untrusted-checkout scans

John Morrissey
and
claude
committed
fix(doctor): verify_token accepts only on post-auth statuses, not any non-401/403

John Morrissey
and
claude
committed
fix(scan-job): honest agent-summary artifacts + reject zero-size pages

John Morrissey
and
claude
committed
fix(security): 2026-06-15 review pass #2 — 4 more boundary/robustness fixes

John Morrissey
and
claude
committed
fix(security): scan-job agent-summary artifact write is no-follow

John Morrissey
and
claude
committed
fix(doctor): self-heal stale --filigree-url/--loomweave-url pins shadowing live discovery

John Morrissey
and
claude
committed

Commits on Jun 16, 2026

chore(release): pre-release cleanup for v1.0.1

John Morrissey
and
claude
committed