1.8 KiB
v1.2.0-alpha.1
Experimental pre-push security safety net for AI-accelerated development. Python package
version: 1.2.0a1. This alpha is not a rollout GO; no real hook capability is enabled.
- Analyze immutable pushed commits across refs without changing the working tree or replacing existing hooks. Share one deadline across preparation, analysis and reporting.
- Keep the existing ranker responsible for scope and physically exclude vendor code from graph inputs. Reuse only compatible, complete immutable graph and answer artifacts.
- Gate advisory and blocking alerts on the same actionable change/witness/repair evidence. Preserve explicit incomplete coverage; optional model assistance cannot create evidence.
- Add frozen runtime and PHP/Node/Python evaluation records with honest populations, missing-target accounting and versioned eligibility that rejects stale evidence.
- Repair the pinned JavaScript frontend's Gruntfile omission and incomplete-census handling. The real NodeGoat input now retains 44/44 files; native PHP/JavaScript smoke passes.
Implementation verification: 1321 tests passed, nine skipped; detector/map/local-pair gates and packaged partition smoke passed. These checks verify implementation contracts, not useful hook precision, recall or latency.
Rollout remains blocked by representative changed-code latency/completion, VAmPI query/context/transitive evidence and independent reviewed per-capability populations. The earlier eligibility artifact is stale under the repaired identities and enables nothing. See current spec status for the owners, unchanged thresholds and required revalidation. Pre-push implementation stands at 26/27 tasks; task 8.3 remains blocked. C arithmetic/bounds detection is unsupported.