Skip to content

wardline 1.0.1 — first complete post-reboot release (SEI set-merge) #40

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tachyon-beep merged 188 commits into from
Jun 16, 2026
Merged

wardline 1.0.1 — first complete post-reboot release (SEI set-merge) #40

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
188 commits
Select commit Hold shift + click to select a range
99c4841
chore: untrack local filigree/loomweave workspace files
Jun 7, 2026
b831db9
delete: remove the comprehensive read-only audit report for the Wardl…
Jun 7, 2026
33b8059
docs(doctor): spec filigree federation-token check + repair
Jun 7, 2026
665d0c6
docs(doctor): implementation plan for filigree.auth check
Jun 7, 2026
28b6fbf
feat(emit): add FiligreeEmitter.verify_token auth probe
Jun 7, 2026
ca08a8e
fix(install): preserve operator-pinned --filigree-url/--loomweave-url…
Jun 7, 2026
3cf87c3
feat(doctor): add filigree.auth federation-token check + repair
Jun 7, 2026
eea17d5
feat(weft): bounded scan default, gate verdict, suppression_state, C-…
Jun 7, 2026
25971c9
feat(emit): echo emit destination so a wrong-project write is visible…
Jun 7, 2026
c58da86
fix(install): make managed-block injector C-4 foreign-safe (wardline-…
Jun 7, 2026
779e3c5
fix(install): close two C-4 review-panel findings in the block injector
Jun 7, 2026
e3ee92e
feat(filigree): read filigree's auto-minted federation token in the e…
Jun 7, 2026
eff4eed
fix(taint): candidate-set lambda bindings close non-last-arm sink FN …
Jun 8, 2026
2efabce
docs(changelog): note the non-last-arm lambda sink FN fix (wardline-3…
Jun 8, 2026
d141067
fix(test): repair the loomweave-e2e readiness-timeout diagnostic (Unb…
Jun 8, 2026
f22aaa5
fix(agent-summary): partition total_findings across display buckets (…
Jun 8, 2026
d3f0096
style(taint): apply ruff format to test_variable_level.py
Jun 8, 2026
24b0a3e
fix(scrub): close 6 P1 correctness defects from the pre-1.0 rule scrub
Jun 8, 2026
a696006
chore(git): ignore .worktrees/ isolated worktree workspaces
Jun 8, 2026
f387b28
fix(PY-WL-109): model with-blocks and infinite while-True in fall-thr…
Jun 8, 2026
b1a336a
docs(rust): architecture spec + slice-1 plan for the Rust frontend
Jun 8, 2026
843c486
docs(rust): fold 7-reviewer panel into the Rust-frontend spec + plan
Jun 8, 2026
7d8d13f
fix(scrub): close 6 P2 correctness defects from the pre-1.0 rule scrub
Jun 8, 2026
4432141
fix(PY-WL-118): close 3 SQLi false-negatives from the scrub-regressio…
Jun 8, 2026
ad2c3f3
docs(rust): conform the spec+plan to Loomweave ADR-049 (Rust qualname…
Jun 8, 2026
13c1cdf
fix(PY-WL-104): metadata description omits constant-expression swallo…
Jun 8, 2026
043adf9
test(rust): vendor Loomweave's qualname corpus + parity-test skeleton…
Jun 8, 2026
89f24ce
feat(rust): WP0 — wardline[rust] extra, tree-sitter loader, NodeId ke…
Jun 8, 2026
705acfe
fix(weft-4a9d0f863c): make finding fingerprint invariant to taint-res…
Jun 8, 2026
c33b436
test(wardline-obs-638a5d9fd1): lock PY-WL-101 actual_return=EXTERNAL_…
Jun 8, 2026
63dabbc
feat(rust): WP1 — suffix-parameterized discovery + .rs symlink confin…
Jun 9, 2026
09b015f
feat(rust): WP2 — parse + minimal index + ADR-049 qualname dialect
Jun 9, 2026
4cf7ccf
feat(rust): WP3 — trust vocabulary + @trusted provider + cache-version
Jun 9, 2026
d14f830
fix(rust): conform WP2 to the ADR-049 amendment (Option b) + 2 robust…
Jun 9, 2026
5752807
feat(rust): WP4 — builder-dataflow L2 for std::process::Command
Jun 9, 2026
17776ee
feat(rust): WP5 — RS-WL-108/112 rules + RustAnalyzer (the verdict layer)
Jun 9, 2026
fa4d9e4
fix(rust): fold WP4+WP5 adversarial panel — close idiomatic-terminato…
Jun 9, 2026
4c2a2dd
feat(rust): WP6 — wire RustAnalyzer into run_scan + CLI --lang rust
Jun 9, 2026
b344aea
fix(rust): fold WP6 adversarial panel — enforce provisional identity,…
Jun 9, 2026
ed49189
docs(rust): WP7 — Rust preview guide, CLI reference, CHANGELOG, agent…
Jun 9, 2026
8c8dc94
feat(rust): WP6 coverage posture — no vacuous green on an un-annotate…
Jun 9, 2026
e3e1e7a
fix(PY-WL-114): close stacked-identical-decorator fingerprint collisi…
Jun 9, 2026
1797fa6
test(wardline-6102d4c833): lock the broad-except multi-emit precondit…
Jun 9, 2026
0a551c4
feat(engine): proactive fingerprint-collision guard (wardline-8fb773a…
Jun 9, 2026
c124f0c
test(rust): re-vendor Phase 1b qualname corpus + land the Loomweave c…
Jun 9, 2026
4928fbd
test(wardline-8fb773a7af): prove the collision guard on the real scan…
Jun 9, 2026
6b02bda
docs(rekey): land fingerprint-rekey plan spine + reconcile P2 to ship…
Jun 9, 2026
9c043b2
fix(rust): clear a stale Command builder on a shadowing let-rebind
Jun 9, 2026
0625458
fix(rust): fold the adversarial bug-hunt — 3 FP/correctness defects +…
Jun 9, 2026
e62a2d8
fix(rust): restore tokio/async command sinks the crate-aware matcher …
Jun 9, 2026
5ff986f
feat(wardline-7da6f6df29): self-describing fingerprint scheme + loud-…
Jun 9, 2026
30f55dc
fix(wardline-7da6f6df29): prefix the Filigree promote wire to match i…
Jun 9, 2026
e0e941e
docs(rekey): mark P1 scheme-infra DONE in the three-deliverable runlist
Jun 9, 2026
966cd9f
feat(wardline-8654423823): drop line_start from the fingerprint + ent…
Jun 9, 2026
979f94d
test(wardline-8654423823): add the S3 discriminator-shape lint + Rule…
Jun 9, 2026
ada200d
docs(rekey): mark P3 value-rekey DONE in the three-deliverable runlist
Jun 9, 2026
7bfe81b
feat(wardline-cdfd2a7808): scan-driven `wardline rekey` migration — c…
Jun 9, 2026
c3e3ce7
fix(wardline-cdfd2a7808): fold P4 5-lens review — close the gate-regr…
Jun 9, 2026
7221054
docs(rekey): mark P4 migration DONE — rekey spine P1-P4 complete
Jun 9, 2026
5ef7588
docs(weft-171fc22a50): pin suppression_state as a first-class carried…
Jun 9, 2026
385ba69
feat(rust): fold self-type generic args into the impl <Type> (ADR-049…
Jun 9, 2026
d5bcb97
fix(rekey): surface pre-scheme stores + broaden orphan diagnostics (h…
Jun 9, 2026
617d546
merge(rust): fold the Rust tree-sitter frontend epic (WP0–WP7 + amend…
Jun 9, 2026
21aeffa
harden(legis): freeze the whole Wardline→legis scan-artifact wire key…
Jun 9, 2026
282d41a
fix(taint): union pre-loop lambda bindings after the loop fixpoint (w…
Jun 9, 2026
d4c9b96
fix(rust): model write!/writeln!/format_args! taint propagation (ward…
Jun 9, 2026
62575ed
harden(federation): route .env/token reads through safe_project_file …
Jun 9, 2026
fbc6e03
refactor(core): move ruleset_hash below the engine to cure the engine…
Jun 9, 2026
d87db0c
ci: gate the self-scan, fail-close the live oracles, add report-only …
Jun 9, 2026
672ff12
test(rekey): adversarial mixed-scheme + multi-store rollback coverage…
Jun 9, 2026
4ebc058
test(rules): negative below-tier-gate tests for modulated + declarati…
Jun 9, 2026
87bcd00
refactor(core): add a LanguageFrontend registry so a 3rd language nee…
Jun 9, 2026
6750220
fix(taint): close raw-receiver taint laundering via module-name shado…
Jun 9, 2026
4bf60c6
fix(taint): extend shadow guard to the attribute-READ path (_resolve_…
Jun 9, 2026
c82045c
feat(install): resolve & persist the server-mode Filigree project scope
Jun 9, 2026
e171ddb
fix(install): report & probe the server-mode Filigree scope consistently
Jun 9, 2026
00e3168
fix(install): don't churn an already-correctly-scoped loopback --fili…
Jun 9, 2026
2441c1d
test(conformance): G1 — shared findings golden vector both repos load
Jun 9, 2026
93fcdb7
docs(plan): Rust SP2 + Phase-1b full-producer sprint plan (5-lens pan…
Jun 9, 2026
4c31433
docs(spec): fold Phase 1b producer surface into SP2 (user-approved) +…
Jun 9, 2026
ee233da
fix(rust): fold ALL stacked #[cfg] predicates + mirror cfg reserved-c…
Jun 9, 2026
b189b1c
docs(integration): ADR-049 amendment requests — reserved-colon escape…
Jun 9, 2026
457a920
feat(rust): full ADR-049 producer surface — six leaf kinds, impl enti…
Jun 9, 2026
7374b94
fix(rust): cfg discriminants survive comment interposition + in-predi…
Jun 10, 2026
175514b
feat(rust): SP2 whole-tree — Cargo.toml crate roots (tomllib, two-bra…
Jun 10, 2026
36c8adc
test(conformance): corpus drift alarm — upstream blob byte-pin + opt-…
Jun 10, 2026
226c4d2
feat(rust): anchored imports/implements edges (resolved-or-dropped, §…
Jun 10, 2026
a053ff2
test(identity): freeze the Rust finding-identity corpus (SP2 completi…
Jun 10, 2026
2c541ac
feat(rust)!: graduate RS-WL-* identity — baseline-eligible, provision…
Jun 10, 2026
b30d3d7
fix(rust)!: wlfp2 move-stable RS-WL-* fingerprints (entity-relative d…
Jun 10, 2026
5016cf3
Merge feat/rust-gold into rc5: Rust frontend → full ADR-049 producer …
Jun 10, 2026
aac2379
docs(integration): record owner sign-off on the ADR-049 amendment-req…
Jun 10, 2026
cb47c8a
feat(python)!: full-plugin hardening — engine soundness, boundary par…
Jun 10, 2026
1d81839
feat(rust): ADR-049 Amendments 4+5 lockstep — reserved-char escape on…
Jun 10, 2026
71866d6
feat(ci): enhance deployment process — assemble combined site tree fo…
Jun 10, 2026
5d6b534
feat(rust): ADR-049 Amendments 6-9 lockstep — residual-collision ladd…
Jun 10, 2026
005eeba
feat(loomweave): ADR-036 ResolveRequest plugin hint — client slice (c…
Jun 10, 2026
808fad2
fix(scan): N-3 scan-root guard — nested-scan-root FACT + loud CLI war…
Jun 11, 2026
6e257bf
feat(cli): N-2 wardline explain-taint CLI twin + N-5 case-insensitive…
Jun 11, 2026
a634006
feat(mcp): A1 — scan tool lang arg, Rust frontend reachable over MCP …
Jun 11, 2026
81e8d04
feat(mcp): A2 — doctor MCP twin + server-freshness self-identificatio…
Jun 11, 2026
9e5feb4
feat(mcp): A3 — rekey MCP twin, probe-by-default (closes wardline-d8c…
Jun 11, 2026
a67f22f
feat(mcp): A4 — fail_on_unanalyzed arg on MCP scan; unanalyzed gate f…
Jun 11, 2026
146ea19
feat(mcp): B1+B2 — outputSchema/structuredContent, annotations+title …
Jun 11, 2026
de50b7a
fix(scanner): guard recursive lambda taint resolution
Jun 11, 2026
508e48d
fix(scanner): resolve returns at their statement snapshots
Jun 11, 2026
84f3d4e
fix(config): refuse symlinked published port files
Jun 11, 2026
56aa0ad
fix(filigree): prioritize env token aliases over dotenv
Jun 11, 2026
49ef1f4
fix(legis): sign scan scope in artifacts
Jun 11, 2026
687345c
fix(cli): guard default agent-summary output
Jun 11, 2026
0546dee
fix(cli): honor scan-file-findings gate exit
Jun 11, 2026
668e2cc
fix(mcp): preserve strict defaults for SEI filters
Jun 11, 2026
aae950a
fix(cli): fail stale attestation reproduction
Jun 11, 2026
faf67c2
fix(attest): disable repo fsmonitor during git state
Jun 11, 2026
81b457f
fix(install): refuse attest key mint into tracked env
Jun 11, 2026
8b51b4c
fix(assure): count unanalyzed files in coverage
Jun 11, 2026
db14c3e
fix(filigree): disable mark_unseen on unanalyzed scans
Jun 11, 2026
cfc7489
fix(taint): include seed dependencies in grammar fingerprint
Jun 11, 2026
13936d6
fix(ci): pin setup-uv action
Jun 11, 2026
2844797
fix(make): refuse symlinked clean targets
Jun 11, 2026
855f171
docs: mark install unsafe for untrusted ci
Jun 11, 2026
13032e2
fix(install): confine skill directory writes
Jun 11, 2026
68fa667
fix(explain): verify taint fact freshness locally
Jun 11, 2026
72411e7
fix(loomweave): cap client request bodies
Jun 11, 2026
f9fa72c
fix(mcp): expose cli policy gates
Jun 11, 2026
a282891
docs: move scan cache outside checkout
Jun 11, 2026
7bd4d56
fix(release): pin publish workflow inputs
Jun 11, 2026
e7ed990
fix(ci): isolate sarif upload permission
Jun 11, 2026
37ab36b
fix(sarif): refuse symlinked scan outputs
Jun 11, 2026
2ae437b
test(taint): pin match subject walrus propagation
Jun 11, 2026
f051635
fix(rules): ignore unreachable boundary rejections
Jun 11, 2026
5bbe603
fix(taint): preserve project submodule import taint
Jun 11, 2026
12e3bd5
fix(taint): authenticate summary cache files
Jun 11, 2026
29a7c64
test(cli): reject forged summary cache entries
Jun 11, 2026
e8e1515
fix(cli): refuse symlinked jsonl output
Jun 11, 2026
955a916
fix(scanner): remove fail-open noop analyzer
Jun 11, 2026
687e498
fix(gitignore): retain legacy clarion runtime ignore
Jun 11, 2026
4c40c0a
fix(coverage): guard decorator unparse recursion
Jun 11, 2026
f5b270c
fix(cli): redact taint-store urls in logs
Jun 11, 2026
9a62efd
fix(cli): escape assure human output
Jun 11, 2026
060ae23
fix(loomweave): harden linkage total parsing
Jun 11, 2026
b19ff41
fix(dossier): bound source-derived shape text
Jun 11, 2026
dd9f543
test(cli): accept mcp policy args in install test
Jun 11, 2026
e8cd1df
fix(explain): fail soft on malformed chain blobs
Jun 11, 2026
9fa20c4
fix(loomweave): verify facts against analyzed bytes
Jun 11, 2026
1b547dc
fix(waivers): refuse symlinked waiver writes
Jun 11, 2026
41e381c
docs: avoid fixed tmp pre-commit output
Jun 11, 2026
fd8cc6c
fix(baseline): refuse symlinked baseline writes
Jun 11, 2026
82fa50e
fix(taint): fail closed on dynamic trusted levels
Jun 11, 2026
ed2bf38
fix(cli): write explicit relative outputs in place
Jun 11, 2026
207e121
fix(analyzer): fail closed on unanalyzable code
Jun 11, 2026
3826e24
fix(diagnostics): narrow native import allowlist
Jun 11, 2026
78f015a
fix(diagnostics): report unresolved plain imports
Jun 11, 2026
e426527
fix(resolver): fail closed on duplicate FQNs
Jun 11, 2026
be430be
fix(filigree-routes): one dialect-aware parser for every route derive…
Jun 12, 2026
64847ce
fix(autofix): resolve root before relativizing — fix crashed on any i…
Jun 12, 2026
a24d3ff
fix(mcp-scan): suppress legis_artifact under summary_only unless expl…
Jun 12, 2026
5f20f08
fix(doctor): url checks report the answering process's effective conf…
Jun 12, 2026
3e20f6c
fix(rekey): probe judges each store against its own scheme; bounded o…
Jun 12, 2026
235e6b4
fix(explain): name the taint source on sink findings; honest-degrade …
Jun 12, 2026
c330bb9
test(conformance): C-13 hostile-input fixture — fail-degraded, never …
Jun 12, 2026
7c97eaa
test(golden): regen identity corpus for the additive TaintExplanation…
Jun 12, 2026
7aa98af
fix(taint): PY-WL-101 reads declared body taint; @trusted tolerates l…
Jun 13, 2026
9e530c8
feat(scan): pollable file-backed scan jobs + Filigree-emit hardening
Jun 13, 2026
5781794
docs: refresh README/docs/site for the RC5 surface; changelog scan-jo…
Jun 13, 2026
3e72538
feat(discovery): gitignore-aware pruning walk + expanded skip floor (…
Jun 13, 2026
e252643
fix(scan-jobs): clear 5 mypy strict errors in scan_jobs.py (RC5 CI gate)
Jun 13, 2026
45118e8
docs: add MCP-tool reference, extend CLI ref, drop compliance overclaim
Jun 14, 2026
a56f6d7
feat(site): build wardline.foundryside.dev on @weft/site-kit
Jun 14, 2026
192462e
chore(ci): retire mkdocs + www/ gh-pages deploy (drop ci docs jobs + …
Jun 14, 2026
a39486a
chore: keep repo code-only — untrack local config/dev tooling
Jun 15, 2026
55c7cc9
fix(filigree-emit): earn the empty failed[] with per-finding failure …
Jun 15, 2026
6b59583
fix(doctor): probe filigree's published port so emit-time auth gaps s…
Jun 15, 2026
282efd4
feat(emit): conform FailedFinding reason surface to canonical weft-re…
Jun 15, 2026
1dc8148
feat(waiver): inline SEI-on-entry binding for waiver_add (doctrine sp…
Jun 15, 2026
59b71a6
chore(release): cut 1.0.1 — drop rc from version, changelog, and docs
Jun 15, 2026
9137d44
fix(ci): clear lint + de-flake the L2 perf backstop on PR #40
Jun 15, 2026
ad3fd30
ci: drop the orphaned mkdocs docs-build/docs-deploy jobs
Jun 15, 2026
ce7df05
fix(PY-WL-108): a quoted command word is not sanitized (close FN)
Jun 15, 2026
dc74594
fix(release): drop SHA256SUMS from dist/ before the PyPI publish
Jun 15, 2026
b30afb6
fix(cli): default scan/baseline output not double-resolved under a re…
Jun 15, 2026
73541d4
fix(security): symlink/TOCTOU hardening for untrusted-checkout scans
Jun 15, 2026
a33079e
fix(doctor): verify_token accepts only on post-auth statuses, not any…
Jun 15, 2026
fa1ca06
fix(scan-job): honest agent-summary artifacts + reject zero-size pages
Jun 15, 2026
929adcf
fix(security): 2026-06-15 review pass #2 — 4 more boundary/robustness…
Jun 15, 2026
274ad9f
fix(security): scan-job agent-summary artifact write is no-follow
Jun 15, 2026
caed35d
fix(doctor): self-heal stale --filigree-url/--loomweave-url pins shad…
Jun 15, 2026
02f533b
chore(release): pre-release cleanup for v1.0.1
Jun 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
325 changes: 0 additions & 325 deletions .agents/skills/filigree-workflow/SKILL.md
View file
Open in desktop

This file was deleted.

30 changes: 0 additions & 30 deletions .agents/skills/filigree-workflow/examples/sprint-plan.json
View file
Open in desktop

This file was deleted.

Loading
Loading