Marius CiepluchandClaude Fable 5.1
8b66d5cb75
Add release-milestones.md as the executable outcome contract: prove one useful Node detection, make it fast, verify PHP/Python transfer, qualify on untouched cases, then enable a narrow advisory rollout. Link it from the roadmap, safety-net steering, requirements, tasks, status and spec.json. Split M1 after review. The raw NodeGoat <lambda>2 witness already exists in the 2026-09-14 post-census bundle; four admission vetoes discard it. M1a runs the vulnerable/fixed/unchanged revisions under a task-local experimental flag that records each veto instead of applying it, with a one-week box and a kill criterion if the fixed twin is not quiet. M1b repairs only the vetoes that fired and reruns through production rules. Existing approvals and thresholds unchanged. Co-Authored-By: Claude Fable 5.1 <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
5.3 KiB
Pre-push safety net status — v1.2.0-alpha.1
Updated 2026-09-14. Phase: implementation. Requirements, design and tasks are approved. 26/27 executable tasks complete; task 8.3 remains blocked. Rollout: NO-GO. The alpha tag publishes experimental implementation and evidence; it does not approve normal hook capabilities or production enforcement.
Next release milestone
M1a: show the NodeGoat detection with every admission veto recorded rather than applied, fixed twin analyzed and quiet, one-week time box. Then M1b: repair only the vetoes that fired and rerun through production rules. None of the five release milestones is verified yet. The 26/27 task count is implementation progress, not proximity to rollout. Follow the accepted release milestone spec: usefulness → speed → shared PHP/Python transfer → independent qualification → narrow advisory rollout.
Verified
Immutable pushed snapshots, shared multi-ref deadlines, ranker-owned scope, physical vendor exclusion, compatible immutable graph/result reuse, actionability admission, compact truthful reporting and non-destructive hook integration are implemented. Advisory and blocking share the same evidence bar; optional model output cannot bypass it.
Contributor-scan task 2.19 is verified: the pinned frontend now retains the original Gruntfile, bringing the real NodeGoat census from 43/44 to 44/44 files. Partial, absent and malformed census no longer masquerade as a complete result or a falsely empty graph. The final code verification recorded 1321 passed tests, nine skipped, passing canonical gates and a packaged native PHP/JavaScript partition smoke. See owner verification.
Rollout blockers
- Useful checks within the deadline are unproven. The fresh post-census profile completed all 21 measurements: all 18 changed/cold/growth/multi-ref transactions timed out; the three identical-tip replays took 18.521–18.874s with valid graph/query reuse. Still 0/24 declared target checks completed. Maximum observed cancellation/report overrun was 0.874s, below the two-second allowance. After M1 establishes the useful comparison, amortize engine startup/loading and rerun the frozen seven-class profile; require warm p95 <=30s and >=95% completed supported checks.
- Target and change-context evidence remains incomplete. VAmPI preserves raw findings at all three known sites, but the exact SQLI function question/transitive witness and supported authorization context are unresolved. Raw findings or rank positions cannot establish an actionable new regression. Repair this in the shared scan boundary and verify the actual associated query/path evidence.
- Independent quality qualification is missing. Freeze and review untouched Node API vulnerable/fixed/benign cases, including middleware/module/async context. Ghost remains reserved with missing reviewed inputs. PHP and Python need their own independent language/framework/family populations; Node results cannot qualify them. Require >=95% observed actionable precision with counts/intervals, >=90% supported recall, nonzero reviewed emitted alerts/positive controls and zero known fixed/benign false alerts.
- No current capability is eligible. The earlier registry is NO-GO and becomes stale under the repaired runtime/core identities. Loading it enables zero capabilities. After the preceding evidence passes together, regenerate exact-semantic eligibility and rerun packaged acceptance validation. Do not relabel old measurements as current.
C/libpng arithmetic and bounds remain explicitly unsupported; this is not a C/C++ detection qualification. Advisory rollout cannot be justified by silence from an unqualified registry.
Ownership and revalidation
Engine lifecycle, source/census and context/witness normalization belong to
contributor-scan. The hook consumes those contracts; no second engine, source IR,
ranker priority exceptions or differential graph mutation is introduced here. Graph
mutation would need a separate cold-equivalence experiment.
After owner fixes, refreeze identities and rerun ordinary scan gates, Python regressions, PHP-to-Node transfer, the representative cache/deadline profile, independent per-capability quality evaluation and packaged hook validation. Keep task 8.3 unchecked and the feature in implementation until those mandatory results are established.
Evidence: group 8 validation, post-census runtime scorecard, census repair.
The owner investigation now distinguishes missing family context producers, globally propagated vendor/correspondence gaps, and query-to-operation identity. See remediation research. These are next implementation prerequisites, not completed fixes or changed acceptance gates.
An isolated Joern session probe matched the full Node census with four warm requests in 0.221–0.467s and verified cancellation/reaping in 0.043s. It identifies a promising engine lifecycle change; full-query equivalence and changed-code performance remain unverified.