PortunusMCP Sentinel rule catalog

Current v93 accepted Phase 22 closeout

Phase 22 is technically complete under the explicitly accepted revised scope. The user accepted the delivered V92 technical proposal, including all historical and practical limitations. Proxmox remains unsupported and recovery is deferred; its original and exposed failures remain failed. Ordinary FAF completion within 1,800 seconds remains unestablished; V68 remains unapproved and unimplemented.

The accepted-closeout packet is v93-accepted-closeout/. Its immutable acceptance receipt and 493-row audit preserve all previous evidence: 30 explicitly accepted limitation rows, two existing paid/pilot deferrals and unchanged raw measurements. The supplemental delivery-verification and final-audit receipts bind actual closeout completion to the exact delivered revision. Technical acceptance and that verified delivery are distinct events; the sealed audit preserves its honest pre-delivery state.

Unchanged engineering at 5142a3f retains 2,596 tests / 36 skips locally and in all 12 hosted suites, 29 normal jobs/docs, 90.28% combined / 86.23% branch coverage, six zero-call production replays and 19 runtime bindings. Taskwarrior and earlier qualified conditions retain their actual measured sources and narrow qualifications. Current Proxmox: six completed observations / three equal ordered pairs, two missed vulnerable reads and four unsupported negatives. No failure becomes a retroactive pass.

Git remains 312/1,040 incomplete, 728 deferred; the 396-request paid benchmark and pilots remain user-deferred, Phase 21 incomplete and Phase 24/15 unchanged. No new correction, scan, profile, retry, comparator, target execution or paid call occurred. Historical spend $0.071799; zero new paid calls. Accepted Phase 22 completion does not authorize merge, ready-state change, release, outreach, launch or Phase 23.

Historical v92 technical review: Proxmox limitation accepted, technical acceptance pending

The user explicitly approved retaining Proxmox upload-root as unsupported and deferring further recovery. Its original and exposed failures remain failed: at current 5142a3f, six observations completed with three equal ordered pairs, but both vulnerable reads were missed and all four fixed/safe paths were unsupported. The exact decision is recorded in the V92 Proxmox limitation receipt. No further correction, scan, profile, retry, comparator, target execution or paid call ran.

The complete technical acceptance packet is v92-technical-acceptance/. All 490 requirements retain exact evidence: six Proxmox limitation rows are explicitly accepted; 24 other historical/practical limitations await technical acceptance. Every raw failure, unresolved surface, original qualification and closed budget remains visible. Taskwarrior and earlier qualified conditions retain their actual measured sources; exposed follow-ups do not establish fresh accuracy.

Unchanged engineering retains 2,596 tests / 36 skips locally and in all 12 hosted suites, 29 normal jobs/docs, 90.28% combined / 86.23% branch coverage, six zero-call production replays and 19 runtime bindings. The 105 unaffected V87 observations retain original source/report identities and compatibility proof. This review adds affected documentation/package checks, not a new hosted code pass.

Ordinary FAF completion within 1,800 seconds remains unestablished; its six approved uncapped observations took 2,297.758–2,735.386 seconds. The proposal explicitly leaves V68 unapproved and unimplemented. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark/pilots remain user-deferred, Phase 21 incomplete and Phase 24/15 unchanged. Historical spend $0.071799; zero new paid calls. Phase 22 remains incomplete until separate explicit human technical acceptance of the delivered complete packet and subsequent verified accepted-closeout delivery. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v91 Proxmox regression: failed gate, disposition pending

The approved six Proxmox observations at engineering-tested 5142a3f completed with all three entire ordered pairs equal, verified cleanup and zero remaining budget. Both vulnerable reads were missed; all four fixed/safe observations remain unsupported. All six complete reports equal their failed 884d376 references; zero findings, six metadata warnings and six unsupported registration surfaces are fully source-assessed. Raw failures remain unchanged.

Source review identifies the conservative builtin-protection guard rejecting importlib.metadata package-version imports when literal dictionary copies occur. This is a sufficient source-visible rejection, not a runtime trace or proof that removing it establishes downstream support. No further correction, scan, profile, retry, comparator or paid call occurred during this continuation.

Unchanged engineering retains 2,596 tests / 36 skips locally and in all 12 hosted suites, 29 normal jobs/docs, 90.28% combined / 86.23% branch coverage, six zero-call production replays and 19 runtime bindings. The 105 unaffected V87 observations retain their original source/report identities and compatibility proof. This continuation adds assessment and affected docs/package verification, not a new hosted code pass or speedup claim.

All 486 requirements and 30 unaccepted limitation proposals remain. The concrete next decision is whether to retain Proxmox as unsupported for Phase 22 or continue focused recovery. Neither is inferred from numerical approval. Ordinary FAF completion within 1,800 seconds remains unestablished; V68 is unapproved/unimplemented. Phase 22 is incomplete: failed-gate disposition, explicit human technical acceptance and verified accepted-closeout delivery remain. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. Historical spend $0.071799; zero new paid calls. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v89 literal metadata correction: engineering passed, regression approval pending

The approved V87 regression at 884d376 completed 111 observations / 48 equal entire ordered pairs, with verified cleanup and zero remaining budget. Taskwarrior, Lightning, Engram and prior Python conditions retain their exact qualifications, including two Meta nominal-fixed operator errata. Proxmox still fails: two missed vulnerable reads and four unsupported negatives. All 3,959 findings, 343,791 diagnostic occurrences, 5,686 surfaces and complete ordered differences are assessed. Ten Meta reports retain 268 assessed changed occurrences; original failures remain.

The authorized literal metadata correction is engineering-verified at 5142a3f: 2,596 tests / 36 skips locally and all 12 hosted suites, 29 normal jobs and docs, coverage 90.28% combined / 86.23% branch-only. Six zero-call production requests and 19 approved runtime bindings pass. Literal dictionary copies preserve dispatch only with proved builtin, mapping and mutation/escape boundaries. Initial deletion and typing failures remain preserved. No current candidate corpus scan or speedup is claimed.

The exact six-observation Proxmox regression is unapproved and unexecuted: three unchanged exposed inputs, vulnerable/fixed/safe then repeat, three entire ordered pairs. Normal 1,800-second input / 10-second Semgrep / 15-second cleanup / four-worker limits remain; 200 minutes plus 15 seconds outer cleanup is a worst-case cap. Source-only inventory proves the other 105 V87 observations cannot reach the changed metadata code; their original 884d376 report/source bindings remain, with no new scans.

All 479 requirements and 28 unaccepted limitation proposals remain. Ordinary FAF completion within 1,800 seconds is unestablished; V68 stays unapproved/unimplemented. Phase 22 is incomplete, pending the remaining actual gate, updated complete review, explicit human technical acceptance and verified accepted-closeout delivery. Git remains 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. Historical spend $0.071799; zero new paid calls. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v86 correctness recovery: engineering passed, regression approval pending

The approved Python module-dispatch and conservative global receiver correction is engineering-verified at 884d376: 2,553 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs plus docs, combined coverage 90.26%, branch-only 86.20%. Six zero-call production requests and 19 approved runtime component bindings pass. The failed 8f0639f candidate, its 45-pass interrupted local suite and cancelled CI remain preserved. Candidate 1ee96cb passed its 2,549/36 local suite, then failed a class-call mutation control; its CI was cancelled. The final correction removes that unproved class-call exception. No speedup is claimed.

The exact 111-observation exposed regression is unapproved and unexecuted: 12 Proxmox/Taskwarrior, 12 Lightning/Engram and 87 earlier Python observations, 63 input records across 10 existing repositories, 48 entire ordered pairs and 15 development singles. Normal 1,800-second input / 10-second Semgrep / 15-second cleanup / four-worker limits remain; the 3,455-minute outer cap is a worst-case bound, not an estimate. No new repository, retry, profile, comparator, target execution or paid call.

All 463 requirements retain previous states and evidence; 26 limitation proposals remain unaccepted. Original V80 Proxmox misses and unsupported negatives remain failed. Actual corrected-source support is pending regression. Historical V73/V75 results remain bound to cec0322; ordinary FAF completion within 1,800 seconds remains unestablished. V68 is unapproved and unimplemented.

Phase 22 remains incomplete, pending actual affected regression, explicit human technical acceptance and verified accepted-closeout delivery. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. Historical spend $0.071799; zero new paid calls. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v81 technical review: unseen check complete, one failed gate

The separately approved V80 check completed 12 observations / six equal ordered pairs at cec0322, using normal 1,800s input / 10s Semgrep / 15s cleanup and four-worker limits. Taskwarrior passes narrow shell discrimination; Proxmox misses the vulnerable upload read and leaves both negatives unsupported on each pass. Its computed module-table dispatcher remains unsupported. All four findings, 504 diagnostics, 12 surfaces, 18 contexts and 14 ordered comparisons are assessed. The initial V78 metadata failure remains one incomplete before analysis, zero reports, eleven unstarted closed. Both budgets are closed; zero new paid calls or target execution.

All 448 requirements and 26 unaccepted limitation proposals remain explicit. Existing V73/V75 retain 205 exposed observations / 95 pairs; unchanged engineering retains 2,450 tests / 36 skips, all 12 hosted suites, 29 normal jobs/docs, six captured production requests and 19 runtime bindings. Normal FAF completion within 1,800s remains unestablished; V68 is unopened. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged.

Phase 22 remains incomplete until explicit human technical acceptance of artifacts/phase22/integration/v81-technical-acceptance/, including the failed Proxmox gate and all historical/practical limits, and verified accepted-closeout delivery. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v79 metadata correction: new evaluation approval pending

The approved V77 sequence stopped in V78 before scanner analysis: one incomplete, zero reports, eleven unstarted closed, zero remaining, with verified cleanup. Strict identity comparison caught three omitted optional null fields in the proposal. The corrected proposal binds complete validated inputs; all six source identities and 36 negative controls pass. Scanner, source archives, configurations, conditions, order and normal limits remain unchanged. The original failed attempt remains visible.

Two repositories / six records / twelve proposed observations at cec0322 are separately unapproved: Taskwarrior TypeScript and Proxmox Python. Normal input 1,800s, Semgrep 10s, cleanup 15s, maximum four workers; outer 380 minutes plus 15s cleanup. See artifacts/phase22/integration/v79-unseen-metadata-correction/. All 440 requirements remain; 24 proposed historical/practical limitations are unaccepted. Existing 205 exposed observations / 95 pairs and unchanged 2,450 tests / 36 skips retain their actual bindings. Normal FAF completion remains unestablished; V68 remains unopened. Git 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. Zero new paid calls.

Phase 22 is incomplete pending the requested evaluation, updated delivered review, explicit human technical acceptance and verified accepted closeout. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v77 unseen-source preparation: exact evaluation approval pending

Two previously unused repository cases are prepared at frozen cec0322: TypeScript Taskwarrior shell interpolation and Python Proxmox upload containment. The exact proposal is 6 source records × 2 passes = 12 observations, unapproved and unexecuted, using normal 1,800-second input / 10-second Semgrep / 15-second cleanup, four-worker maximum, 380-minute outer limit plus 15-second cleanup. Source novelty, complete upstream pairs, license qualifications and synthetic approval/stop/cleanup checks are retained in artifacts/phase22/integration/v77-unseen-preparation/.

All 435 requirements (422 retained + 13 new) remain explicit. V73/V75 retain 205 exposed observations and 95 equal entire ordered pairs; unchanged cec0322 engineering remains 2,450 tests / 36 skips. The 23 historical/practical limitations remain unaccepted, including ordinary FAF completion within 1,800 seconds and leaving V68 unopened. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark and pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. Zero new paid calls.

Phase 22 remains incomplete pending the additional unseen check, a newly delivered complete review, explicit human technical acceptance and verified accepted closeout. No merge, ready-state, release, outreach or Phase 23.

Historical v76 technical review: source gates passed, human acceptance pending

At engineering-tested cec0322, the separately approved 24 four-repository observations and 181 prior-language observations are complete, with all 95 entire ordered pairs equal, verified cleanup and both budgets closed. No-bash, Lightning, Engram and FAF pass their narrow exposed conditions; TypeScript 94 and Python 87 preserve compatibility, including caller-specific DDG CGNAT support and two retained nominal-fixed Meta operator errata. Calculator reports add two source-assessed findings outside the original metadata condition. Fourteen qualified Git repository-copy findings retain physical/identity uncertainty. Raw findings, unresolved surfaces and original fresh failures remain visible.

Normal FAF completion within 1,800 seconds remains unestablished. Its six approved uncapped observations took 2,297.758–2,735.386 seconds; the ordinary 1,800-second policy remains unchanged. The 181 language observations used normal 1,800-second input / 10-second Semgrep limits, 15-second cleanup and the existing four-worker maximum. No speedup, isolated benchmark or broader runtime safety is claimed. The V68 performance proposal remains unapproved and unimplemented.

Unchanged cec0322 engineering retains 2,450 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs, combined coverage 90.11%, branch-only 85.97%, six zero-call production request replays and 19 approved runtime component bindings. This continuation adds static assessment and affected documentation/package checks, not a new hosted code pass. All 422 requirements (89 original + 333 added) retain their previous states and exact evidence. Historical failures and practical limits are proposed for explicit acceptance.

Phase 22 remains incomplete until explicit human technical acceptance of the review packet and subsequent verified accepted-closeout delivery. The packet is artifacts/phase22/integration/v76-technical-acceptance/; its summary, complete audit and acceptance proposal enumerate every proposed limitation. Git stays 312/1,040 incomplete, 728 deferred; the 396-request paid benchmark and pilots are deferred, Phase 21 is incomplete, and Phase 24/15 are unchanged. Historical paid spend stays $0.071799; zero new paid calls. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v72 correctness recovery: engineering passed, regression pending

Ordinary approved-contract recovery is verified at cec0322. Supported TypeScript constructor parameter properties retain actual argument/default and receiver identity; Python initial URL guard qualification survives only proved trailing-slash/path-suffix derivation. Wrong/escaped receivers, ambiguous field initialization, hostname fallbacks, formatting and authority changes remain conservative, including rejection of prototype-mutating __proto__ properties. The first candidate 42d6c7c failed that additional control; its local suite was interrupted after 1,408 passes/36 skips and CI 34845266890 cancelled. Initial five synthetic failures, subset-coverage configuration and helper-normalization failure also remain retained with their corrections; no partial suite becomes a pass.

Local and all 12 hosted suites pass 2,450 tests / 36 skips; all 29 normal CI jobs and docs pass in 34846514312 / 34846514328. Combined coverage is 90.11%, branch-only 85.97%. Exact checkout/package bindings, six unchanged zero-call production requests and 19 approved runtime component bindings pass. No speedup is established.

The new 24-observation corrected four-repository proposal is unapproved and unexecuted: 12 inputs twice, 12 entire ordered pairs, 18 non-FAF observations then six FAF. It proposes the previously tested experiment-only uncapped policy, with finite 15-second cleanup and unchanged normal 1,800-second deadline. All 10 complete synthetic policy comparisons and cancellation/approval boundaries pass. 181 earlier Python/TypeScript observations remain outside this proposal.

The completed V70 experiment at 4145d35 remains unchanged: 24/24 complete, 12/12 ordered pairs equal, FAF 2,212.22–2,341.48 seconds; no-bash/Engram narrow passes, FAF detection/support and Lightning negative-qualification failures. Those results do not establish current-source gates. All 407 requirements (89 original + 318 added), original fresh failures and six unaccepted historical closure proposals remain. V68 performance optimization stays unapproved and unimplemented. No new corpus/profile/comparator/target execution or paid call.

Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete with 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v70 uncapped experiment: complete run, two failed gates

The user-approved 24-observation uncapped four-repository experiment at 4145d35 completed, with all 12 entire ordered report pairs equal, verified cleanup and zero remaining budget. The 18 non-FAF observations took 6.28–10.72 seconds each. FAF took 2212.221735–2341.484236 seconds per input. 6 observations exceeded the ordinary 1,800-second policy, which remains unchanged; no speedup is established.

No-bash and Engram pass their narrow exposed conditions, retaining the exact lexical/physical and initial-home/reconstructed-use qualifiers. Lightning fails fixed/safe qualification; FAF misses the vulnerable read and leaves both negative paths unsupported. All 260 findings, 52,492 diagnostic occurrences, 282 surfaces, 4,963 source contexts and full ordered reference differences are source-assessed. The original fresh failures remain source-bound and unchanged.

The pending v68 literal-serialization optimization remains unapproved and unimplemented. No source tuning, profile, retry, comparator, target execution or paid call ran during this experiment. The earlier Python/TypeScript schedule's 181 observations are outside this approval; current compatibility is pending.

All 399 requirements (89 original + 310 added) and all historical failures remain, including the explicit v68 audit-status correction. Unchanged engineering retains 2,419 tests / 36 skips locally and in all 12 hosted suites, 29 normal jobs and docs passed; combined coverage 90.08%, branch-only 85.92%. Six zero-call production replays and approved runtime bindings remain. This is no new hosted code pass, broad accuracy result, accepted limitation or independent validation.

Phase 22 remains incomplete, pending the failed current-source gates, earlier-language compatibility, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete with 728 deferred; paid benchmark/pilots are deferred, Phase 21 is incomplete, and Phase 24/15 are unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v68 invalidation profile: source-only decision pending

The approved FAF profile at frozen 4145d35 timed out after 1800.013225 seconds, retaining 148,001 verified parent samples and no report. Cleanup passed after forced termination; the periodic snapshot does not confirm final snapshot completion or timer restoration. No worker snapshot exists; worker launch history and costs are unestablished. The one-use budget is closed. Registration discovery is 99.86% inclusive; literal serialization is 3.85% of parent leaf samples. These overlapping partial shares establish no speedup, removable fraction, detection or compatibility.

v68-invalidation-sampling/optimization-proposal.json prepares one unapproved, unimplemented source-only literal serialization reuse attempt: a bounded per-program cache for exact strings, with fresh Values and all analysis/state updates retained. Full identity, cold/warm/eviction, error/deadline and ordered report equivalence plus engineering are required. No corpus/profile/retry, resource/deadline revision, target execution or paid call is included.

An initial read-only launch preflight failed before any input/token because files had disappeared. Verified recovery restored 25,941 tracked files, six worktree links, 7,667 expanded evidence files and two protected user documents without overwriting existing bytes. The cause remains unknown. User-authorized Docker cleanup removed five unused public base images; project images, all containers and volumes remain. Logical image storage fell 2.89GB; delayed physical recovery is separately recorded. The same unused profile approval then ran once.

All 391 requirements (89 original + 302 added) remain, including seven native timeouts, six valid partial profiles, invalid stale-root preparation, both singleton failures, the original strict invalidation failure and six unaccepted historical closure proposals. Product retains tested 4145d35: 2,419 tests / 36 skips locally and all 12 hosted suites, 29 normal CI jobs and docs passed. Combined coverage is 90.08%, branch-only 85.92%; six zero-call production replays and approved runtime bindings remain. This continuation adds profile/recovery assessment and docs/package checks, not another hosted code pass.

Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete, with 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v67 invalidation regression: timed out, budget closed

The approved 205-observation sequence at frozen 4145d35 stopped on its first FAF vulnerable input after 1800.008716 seconds whole-input time. One incomplete, zero reports, 204 unstarted closed, zero remaining. Cleanup passed within its separate 15-second allowance. Findings, detection, fixed/control support and ordered repeats remain unknown. No retry, profile or paid call ran.

v67-invalidation-regression/diagnostic-proposal.json prepares one unapproved, unexecuted parent-and-worker sampled FAF input, maximum 1800 seconds plus 15 seconds cleanup. It reuses the existing sampler and worker layout with actual source identities verified before timers/target access. Synthetic identity, completion/interruption, timer and missing-approval controls pass. The older 1948bf9 parent profile cannot establish residual costs after the accumulator change. No optimization, resource/deadline revision or native speedup is included.

All 383 requirements (89 original + 294 added) remain, including seven native timeouts, five valid partial profiles, invalid stale-root preparation, both singleton failures, the original strict invalidation failure and six unaccepted historical closure proposals. Product retains tested 4145d35: 2,419 tests / 36 skips locally and all 12 hosted suites, 29 normal CI jobs and docs passed. Combined coverage is 90.08%, branch-only 85.92%; six zero-call production replays and approved runtime/image bindings remain compatible. This continuation adds outcome, preparation and docs/package checks, not another hosted code pass.

Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete, with 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v66 invalidation contract: engineering passed, regression approval pending

The explicitly approved private mutation-domain revision and one source-only If accumulator attempt are verified at 4145d35, source 41dd31a167c454bd9db3d720ce75ce6287312ce0e7799bbda1b2e59c61f77ea6. All seven shipped flow classes preserve monotone private invalidations and independent arm baselines. The candidate reuses the first completed arm; all guard, statement and conservative union work remains. The source-bound guard rejects removal/export/reflection mutations. Verification passes 256 ordinary, 766 complete production-flow and 252 production-boundary comparisons, 125 ordered discovery comparisons and six complete serial/parallel results. Only the two explicitly named injected scanner callbacks are outside the prospective domain; their exact deltas and v65 strict failure remain retained. No other failure is excluded; no native speedup or 1800-second completion is proved.

Local and all 12 hosted suites pass 2,419 tests / 36 skips; all 29 normal CI jobs and docs pass in 34808261686 / 34808261635. Combined coverage is 90.08%, branch-only 85.92%. Six complete production requests replay identically with zero model calls; approved runtime/image bindings remain. Verification-helper failures and their actual corrections remain preserved.

v66-invalidation-contract/evaluation-proposal.json prepares 205 exposed observations on 110 inputs / 95 ordered pairs, unapproved and unexecuted: 24 four-source, 94 TypeScript and 87 Python. Bounds remain 1800 seconds per input, 15 seconds cleanup and a 6275-minute worst-case outer cap, not an estimate. No retry/profile/comparator, new repository, target execution or paid call.

All 376 requirements (89 original + 287 added) retain every prior failed gate, six native timeouts, five separately bound partial profiles, invalid stale-root preparation, both singleton failures, the strict accumulator failure and six unaccepted historical closure proposals. Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23 is authorized.

Historical v65 invalidation attempt: strict-equivalence failure retained

The approved If invalidation-accumulator attempt passes 256 ordinary full-state comparisons, then fails the required synthetic captured-arm alias and shrinking-arm controls. Error/interruption states agree. Shipped source has no matching removal or arm-set export; real-target reachability remains unestablished. The strict proposal still required these controls. One failed attempt closed; exact tested 1948bf9 source restored. The candidate and the initial helper-deadline correction remain.

v65-if-invalidation-accumulator/optimization-proposal.json prepares an unapproved explicit mutation-domain revision and one new source-only attempt. Every shipped writer/reader/subclass must first prove monotone private sets with no escaping arm alias. Only the two named injected callbacks would become negative controls outside that prospective domain after explicit approval; their original failures stay failed. No current reclassification, implementation, corpus/profile/retry, paid call, resource change or timeout revision is authorized. Full engineering remains required if a later explicitly approved attempt passes its complete prerequisites.

All 365 requirements (89 original + 276 added) and every earlier failed gate remain. Restored 1948bf9 retains 2,418 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 90.08%, branch-only 85.92%. Six zero-call production replays and approved runtime bindings remain compatible. This adds failed-attempt/restoration and docs/package checks, not a new candidate engineering or hosted code pass.

Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v64 parent-and-worker profile: source-only decision pending

The approved single FAF profile at frozen 1948bf9 timed out after 1800.010375 seconds, retaining 148,764 partial samples from 1 verified process snapshot(s): parent. Cleanup passed; no report exists and the one-use budget is closed. Parent and worker denominators are separate. Missing worker snapshots do not prove workers never launched. Partial shares establish no native speedup, removable-cost fraction or detection.

v64-shared-discovery-sampling/optimization-proposal.json prepares one unapproved source-only attempt to avoid redundant If invalidation-accumulator construction. The original baseline and every per-arm copy, guard, traversal and state update remain. Complete branch-isolation, alias/state and report equivalence plus full engineering are required. No implementation, corpus/profile/retry, paid call, resource change or timeout revision is included. The 1800-second policy remains.

All 358 requirements (89 original + 269 added) and every earlier failed gate remain. Product retains tested 1948bf9: 2,418 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed. Combined coverage is 90.08%, branch-only 85.92%; six zero-call replays and approved runtime bindings remain compatible. This continuation adds profile assessment and docs/package checks.

Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v63 shared-discovery regression: timed out, budget closed

The approved 205-observation sequence at frozen 1948bf9 stopped on its first FAF vulnerable input after 1800.010893 seconds whole-input time. One incomplete, zero reports, 204 unstarted closed, zero remaining. Cleanup passed in its separate 15-second allowance. Detection, findings, fixed/control support and ordered repeats remain unknown. No retry, profile, target execution or paid call ran.

v63-shared-discovery-regression/diagnostic-proposal.json prepares one unapproved, unexecuted parent-and-worker sampled FAF input, maximum 1800 seconds plus 15 seconds cleanup. Completed discovery now runs in the parent before worker dispatch; old worker-only samples cannot establish current costs. Reuse the same CPU-timer sampler in the parent and existing workers, with actual source identities verified before timers/target access. Six-vector, stale-root, parent completion/interruption and missing-approval controls pass. Sampling overhead and incomplete intervals remain explicit; no optimization, resource/deadline change or speedup claim is included.

All 352 requirements (89 original + 263 added) remain, including six native timeouts, four valid partial profiles, invalid stale-root preparation, both singleton failures and six unaccepted historical closure proposals. Product retains tested 1948bf9: 2,418 tests/36 skips locally and all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 90.08%, branch-only 85.92%. Six zero-call production replays and approved runtime/image bindings remain compatible; this adds outcome/preparation and final docs/package checks, not another hosted code pass.

Phase 22 remains incomplete, pending actual current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23 is authorized.

Historical v62 shared discovery: engineering passed, regression approval pending

The approved single source-only discovery-reuse attempt is engineering-verified at 1948bf9, source 8f88940210e0f382f8c1cfa1b8af3bf7464ecb891122ae23539de1e4806fc408. The original traversal is preserved; completed TypeScript registration discovery is shared through the existing four-worker IPC and parent coverage. Ordered warnings, source-node aliases, option effects and all rule-specific analyses remain intact. Synthetic checks include 125 complete baseline comparisons, complete worker reports, empty/failed/deadline cases and one producer with every detector still invoked. No native speedup or 1800-second completion has been established.

Local and all 12 hosted suites pass 2,418 tests / 36 skips; all 29 normal CI jobs and docs pass in 34793663094 / 34793663105. Combined statement/branch coverage is 90.08%, branch-only 85.92%. Six complete production requests replay identically with zero paid calls; approved runtime/image bindings remain compatible. Initial fixture/import/format check errors retain their corrections.

v62-shared-tool-discovery/evaluation-proposal.json prepares 205 exposed observations, 110 inputs and 95 entire ordered pairs, unapproved and unexecuted: 24 four-source, 94 TypeScript and 87 Python. The shared 1800-second input limit, 15-second cleanup, 120-second informational target and 6275-minute outer cap remain unchanged. The outer cap is a worst-case bound, not a duration estimate. No retry/profile/comparator, new repository, target execution or paid call is included.

All 345 requirements (89 original + 256 added) retain every earlier failed gate, five native timeouts, four valid partial profiles, invalid stale-root preparation, both singleton failures and six unaccepted historical closure proposals. No old budget is reopened. Phase 22 remains incomplete, pending current-source gates, separate explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

Historical v61 thirty-minute profile: source-only decision pending

The approved FAF profile at frozen 7bf4c6e timed out after 1800.090669 seconds, retaining four verified worker identities and 432,756 partial samples. Cleanup passed; no report exists and the one-use budget is closed. Registration discovery appears in 99.93–99.93% of each worker's retained samples. These overlapping partial shares do not prove native speedup, removable-cost fraction, detection or compatibility.

v61-faf-long-timeout-sampling/optimization-proposal.json prepares one unapproved source-only attempt to reuse completed TypeScript tool discovery across the existing workers and coverage. Preserve ordered warnings and source-node identity; all rule-specific analysis still executes. Full synthetic/engineering verification is required. No implementation, corpus/profile/retry/comparator, target execution, paid call, resource change or timeout revision is included in current approval. The shared 1800-second policy remains in place.

All 335 requirements (89 original + 246 added) and every earlier failed gate remain. Product/tests retain verified 7bf4c6e: 2,403 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed. Combined coverage is 89.98%, branch-only 85.86%; six zero-call replays and approved runtime bindings remain compatible. This continuation adds profile assessment and docs/package checks.

Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v60 thirty-minute regression: timed out, budget closed

The approved 205-observation sequence at frozen 7bf4c6e stopped on the first FAF vulnerable input after 1800.021672 seconds. One incomplete, zero reports, 204 unstarted closed and zero remaining; cleanup passed. Findings, detection, fixed/control discrimination and ordered repeats remain unknown. The approved 1800-second shared policy remains in place; extending the deadline alone did not establish completion. No retry, profile or paid call occurred.

v60-long-timeout-regression/diagnostic-proposal.json prepares one sampled FAF input, unapproved and unexecuted, with a 1800-second maximum and 15-second cleanup allowance. Existing sampler/worker layout, synthetic identity/timer and missing-approval checks pass. Older a36f696 samples do not establish current costs. No optimization, uninstrumented run, comparator or target execution is included.

All 329 requirements (89 original + 240 added) remain, including five native timeouts, three valid partial profiles, invalid stale-root preparation, both singleton failures and six unaccepted historical closure proposals. Product and tests remain verified 7bf4c6e: 2,403 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed. Combined coverage is 89.98%, branch-only 85.86%; six zero-call replays and approved runtime bindings remain. This continuation adds outcome, preparation and docs/package checks.

Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v59 timeout policy: engineering passed, evaluation pending

The user confirmed 30 minutes per input. The shared static deadline is now 1,800 seconds at 7bf4c6e, source 40c194dcd47a152f78c9b9dc57b40e5e77026f6052035841c0af63b83f234af6; 120 seconds remains informational. Source proof establishes one product AST literal change; detector logic and cleanup are unchanged from dc73715. Local and all 12 hosted suites pass 2,403 tests / 36 skips; all 29 normal jobs and docs pass in 34784085204 / 34784085193. Six production requests replay with zero paid calls. Actual engineering and runtime bindings are retained.

v59-timeout-policy/evaluation-proposal.json is unapproved and unexecuted: 205 exposed observations, 110 input records, 95 ordered pairs; 30-minute input ceiling, 15-second cleanup and 6,275-minute outer cap. This is a worst-case cap, not a duration estimate. All original conditions, support requirements and 11 volatile exclusions remain. No retry, profile, comparator, new repository, target execution or paid call. The pending v58 diagnostic is preserved unexecuted.

All four earlier native timeouts, partial/invalid profiles, singleton failures and original fresh failures remain source-bound and unaccepted. No speedup, current-source compatibility or new unseen-source discrimination is established. The audit retains 323 rows (89 original + 234 added), including all 314 prior rows and six unaccepted historical closure proposals. Phase 22 is incomplete: actual regression, source assessment, explicit human acceptance and closeout remain. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

Historical v58 credential regression timeout: budget closed

The approved 205-observation sequence at frozen dc73715 stopped on the first FAF vulnerable input at 300.005621 seconds whole-input time. One incomplete, zero reports, 204 unstarted closed, zero remaining; cleanup passed. Detection, findings, fixed/control discrimination and ordered repeats are unknown. Current-source four-repository and prior-language gates remain unresolved. No retry, profile, comparator, target execution or paid call occurred.

v58-credential-regression/diagnostic-proposal.json prepares one sampled FAF input, unapproved and unexecuted, with a 300-second maximum and 15-second cleanup allowance. The existing sampler and worker layout remain unchanged; actual worker/flow/source identities are verified before timer or target access. Synthetic identity/timer checks and the missing-approval boundary pass. Earlier a36f696 samples do not establish residual costs at the corrected source. No optimization, resource/deadline change or further measurement is authorized.

All 314 requirements (89 original + 225 added) remain. All four native timeouts, three partial profiles, invalid stale-root preparation, both singleton failures and six unaccepted historical closure proposals retain their actual source bindings. Product and tests remain engineering-tested dc73715: 2,399 tests / 36 skips locally and in all 12 hosted suites, all 29 normal CI jobs and docs passed. Combined coverage is 89.98%, branch-only 85.86%; six zero-call production replays and approved runtime/image bindings remain compatible.

Phase 22 remains incomplete, pending current-source gates, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v57 joint correction: engineering passed, regression pending

The approved equal-marker credential correction and canonical unknown bypass are verified at dc73715, source 4f3e5b2e9c89f61d179ac82db94ced06e83033f9cf1640644cefb53326e96eb9. Across 4,050 correction cases, 552 marker and 552 derived cache-input deltas retain the explicitly revised join contract; guard results agree. The bypass then passes 2,430 complete Python/TypeScript state comparisons and two saturated-cache evictions against a preserved correction-only reference. Seven existing synthetic HTTP patterns preserve entire ordered rule output: four detections, three negatives. Both original singleton failures remain reproduced, closed and unaccepted.

Local and all 12 hosted suites pass 2,399 tests / 36 skips; all 29 normal CI jobs and docs pass in 34779741236 / 34779741226. Combined local coverage is 89.98%, branch-only 85.86%. Packages, strict quality checks, six identical zero-call production requests and approved runtime bindings pass. Initial synthetic fixture, import-root and test-format check failures retain their individual corrections.

v57-credential-merge/evaluation-proposal.json is unapproved/unexecuted: 205 exposed observations on 110 inputs / 95 ordered pairs, comprising 24 four-source, 94 TypeScript and 87 Python observations. 120-second target, 300-second whole/native maximum, 15-second cleanup, 1,150-minute outer sequence; zero retries, profiles, comparators, target execution or paid calls. No speedup or 300-second completion is established. All old timeouts, partial/invalid profiles and fresh failures remain source-bound; no partial subsets become new whole Linux batches.

The audit retains 308 requirements (89 original + 219 added), including six unaccepted historical closure proposals and both failed singleton rows. Phase 22 remains incomplete, awaiting actual regression, explicit human technical acceptance and accepted closeout. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v56 canonical bypass: eviction failure retained

The approved canonical UNKNOWN_VALUE bypass passes the two retained ordinary identity cases, then fails synthetic environment equivalence after LRU eviction. Skipping an empty entry changes whether a tainted value remains interned; the identity-only credential-marker join then returns different environments. Full flow fields agree and inputs are unchanged. Real-target reachability/impact of the adversarial contained-false marker remains unestablished. One attempt consumed, zero remaining; exact tested a36f696 source restored.

v56-canonical-unknown/optimization-proposal.json prepares an unapproved prospective contract revision: equal immutable credential markers would join consistently by identity or complete equality, followed by the canonical bypass. The specified baseline marker delta must remain visible; bypass equivalence must then hold against a correction-only reference with no exclusions. Neither edit is implemented. No speedup or 300-second completion is promised. No corpus, profile, retry, target execution or paid call is included.

All prior native/profile/fresh failures and both singleton failures remain source-bound and closed. The audit retains 297 rows (89 original + 208 added), including six unaccepted historical closure proposals. Restored a36f696 retains 2,386 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 89.98%, branch-only 85.85%. This is no new hosted code pass. Phase 22 remains incomplete. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23.

Historical v55 singleton attempt: equivalence failure retained

The approved broad singleton cache bypass failed its synthetic environment equivalence prerequisite and was reverted. A warm cache interns equal Values; direct return changes identity-sensitive credential-marker merging for a tainted contained-false internal state. Real-target reachability of that state is not established. Initial whole-flow comparison flags were a helper-object comparison defect; structural reassessment preserves equal full flow state and confirms the independent environment delta. All evidence remains visible. One failed attempt consumed, zero remaining; product restored exactly to tested a36f696.

v55-singleton-combine/optimization-proposal.json prepares one unapproved, unimplemented attempt restricted to the canonical UNKNOWN_VALUE singleton and empty requested key. Every other input must retain cache dispatch. Complete state and interning checks remain required; eligibility frequency and speedup are unknown. No corpus/profile/retry, target execution or paid call is authorized.

All three native timeouts, partial profiles, invalid stale-root attempt and original fresh failures remain source-bound. The audit retains 290 rows (89 original + 201 added), including six unaccepted historical closure proposals and the new unresolved equivalence failure. Restored a36f696 retains 2,386 tests / 36 skips in local and all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 89.98%, branch-only 85.85%. This is no new hosted code pass. Phase 22 remains incomplete. Git remains 312/1,040 incomplete; paid benchmark and pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v54 sampled timeout: source-only decision pending

The approved single profile at frozen a36f696 retains four verified worker identities and 78,769 partial samples. Whole input 300.007176 seconds; cleanup passed, no report exists and the one-use budget is closed. Registration traversal dominates; merge is 33.09–33.73% inclusive and shared combine/cache call is 7.40–7.64% leaf sample share. These overlapping partial shares establish no native speedup, removable-cost fraction or 300-second completion.

v54-faf-fastpath-sampling/optimization-proposal.json proposes one unapproved source-only singleton fast path before the existing value-combination cache. Only an unchanged sole Value with no key override or required safety stripping could bypass the tuple/cache call. All other paths, cache and complete flow state must remain compatible, including cold/warm and identity-sensitive controls. No implementation, corpus/profile/retry, new cache, resource/deadline change or paid call is authorized. Eligible-case prevalence remains unmeasured.

All three native timeouts/204 closed remainders, prior partial profiles, invalid stale-worker preparation and original fresh failures remain unchanged. The audit retains 283 requirements (89 original + 194 added) and six unaccepted historical closure proposals. Product retains tested a36f696: 2,386 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 89.98%, branch-only 85.85%, six unchanged zero-call production requests and runtime bindings. Phase 22 remains incomplete. Git stays 312/1,040 incomplete with 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v53 fast-path regression timeout: budget closed

The approved 205-observation sequence at frozen a36f696 stopped on its first FAF vulnerable input at 300.000481 seconds whole-input time. One incomplete, zero reports, 204 unstarted closed, zero remaining; cleanup passed. Findings, guards, negative discrimination and ordered repeats are unknown. Corrected four-source and prior-language compatibility gates remain unestablished. No retry, profile, target execution or paid call occurred. All earlier failures and original fresh outcomes remain preserved with their actual scanner identities.

The next single 300-second sampled FAF input is prepared, unapproved and unexecuted in v53-fastpath-regression/diagnostic-proposal.json. It retains the existing CPU-timer sampler, source/configuration and worker layout, with verified actual worker/flow/scanner identities before timer or target snapshot access. The stale-root synthetic control and missing-approval boundary pass. Earlier 6e4fd67 samples cannot establish remaining costs after the current reorder. No further optimization, retry, resource/deadline change or paid call is authorized.

All 277 requirements (89 original + 188 added) remain, including six unaccepted historical closure proposals and the unresolved invalid stale-worker preparation. Product/tests/workflows remain a36f696: 2,386 tests / 36 skips locally and in all 12 hosted suites; 29 normal CI jobs and docs passed, combined coverage 89.98% and branch-only 85.85%. Six zero-call production requests and runtime bindings persist. Phase 22 remains incomplete. Git stays 312/1,040 incomplete with 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v52 equal-value fast path: regression approval pending

The one approved source-only merge reorder is engineering-verified at a36f696. It checks eligible equal values actually present in every branch before preparing record fallbacks. 10,944 synthetic comparisons preserve environment, complete flow state and inputs; eight intended cases skip the registry lookup and all 13 needed defaults remain. No native speedup or 300-second completion is established. Full local and all 12 hosted suites pass 2,386 tests / 36 skips; local combined statement/branch coverage 89.98%, branch-only 85.85%. All 29 normal CI jobs and docs pass in 34767417083 / 34767417081, with exact checkout/package bindings. Six unchanged production requests checked-replay with zero model calls. No new corpus observation, profile or Git campaign ran.

The 205-observation exposed regression is prepared, unapproved and unexecuted: 24 four-source + 94 TypeScript + 87 Python, 110 inputs and 95 whole ordered pairs. Bounds: 120-second target, 300-second native/whole maximum, 15-second cleanup, one 1,150-minute serial local sequence. No retries, profiles, comparators, new repository, target execution or paid calls. See v52-merge-fastpath/evaluation-proposal.json and launcher-binding.json. Earlier shared recovery still lacks completed corpus validation, so both language schedules remain necessary; they are no new whole Linux batch. Every original label, qualifier and source-support condition remains.

Both earlier native timeouts/204 closed remainders, sampled timeouts, invalid stale worker preparation and all original fresh failures remain preserved. The corrected v51 partial profile does not erase the invalid attempt or establish a native pass. All 271 requirements (89 original + 182 added) remain; six historical closure proposals, corrected gates and human technical acceptance are unresolved. Phase 22 remains incomplete. Git stays 312/1,040 incomplete with 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v51 bound profile: source-only decision pending

The approved corrected profile at frozen 6e4fd67 retains four verified worker identities and 79,307 partial samples. Its whole input timed out at 300 seconds; cleanup passed, no report exists, and the one-use budget is closed. Shared TypeScript branch merge is 43.02–44.46% inclusive sample share; its missing-branch predicate is 8.40–9.08% leaf share. These are not speedup or removable-cost claims. The review packet proposes one unapproved source-only optimization: recognize eligible all-present equal branch values before fallback preparation. No implementation, corpus/profile/retry, resource change or paid call is authorized. The invalid old-root profile and V49 preparation failure remain preserved; this passes current diagnostic attribution only. Original native/fresh failures remain. Product retains tested 6e4fd67: 2,384 tests / 36 skips locally and in all 12 hosted suites, 29 normal jobs and docs passed; combined coverage 89.98%, branch-only 85.85%. All 265 requirements remain. Phase 22 is incomplete; explicit human acceptance is separate. Git stays 312/1,040 incomplete, paid benchmark and pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

Historical v50 profile binding failure: stopped and closed

The approved single profile was deliberately stopped when the reused sampler's worker import root was found to be 17b4784 instead of approved 6e4fd67. One invalid interrupted attempt, no report or sample snapshot, zero remaining. Cleanup inventory is empty. Parent identity does not prove worker identity; V49-DIAGNOSTIC-PREPARATION is corrected to unresolved with its prior row preserved. The review packet retains this agent preparation error and the diagnostic-only correction: actual worker/flow imports and full scanner identity checked before sampling or target snapshot access, with a stale-root rejection control. A new single 300-second profile is unapproved and unexecuted; no retry, optimization or paid call is authorized. Prior native timeouts and all four first-frozen failures remain unchanged. Product retains tested 6e4fd67: 2,384 tests / 36 skips locally and in all 12 hosted suites; 29 normal jobs and docs passed, combined coverage 89.98%, branch-only 85.85%. All 259 requirements remain. Phase 22 is incomplete; human acceptance is separate. Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

Historical v49 allocation regression timeout: budget closed

The approved 205-observation sequence at frozen 6e4fd67 stopped on its first FAF vulnerable input at the 300-second whole-input maximum: one incomplete, zero completed reports, 204 unstarted closed, zero remaining. Cleanup passed. No finding, guard, negative-path or ordered-repeat result is available; corrected four-repository and prior-language compatibility gates remain unestablished. The review packet retains the failure and an unapproved single 300-second CPU-sampling diagnostic on the same FAF input. No new retry, profile, target execution or paid call occurred in this sequence. The v47 profile remains bound to the earlier scanner; another optimization is not authorized. All original fresh failures and historical source-bound passes remain unchanged. Engineering retains 6e4fd67: 2,384 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 89.98%, branch-only 85.85%. The audit retains all 253 requirements. Phase 22 remains incomplete; no failure/limitation or human technical acceptance is inferred. Git stays 312/1,040 incomplete; paid benchmark and pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23.

Historical v48 allocation candidate: regression approval pending

The approved single source-only merge optimization is engineering-verified at 6e4fd67. It avoids constructing unused record fallbacks; 10,944 synthetic comparisons preserve environment, complete flow state and inputs. Allocation checks preserve needed fallbacks. Full local and all 12 hosted suites pass 2,384 tests / 36 skips; local combined statement/branch coverage is 89.98%, branch-only 85.85%. All 29 normal CI jobs and docs pass in 34743452798 / 34743452818, with exact candidate checkout/package bindings. Six production requests checked-replay unchanged with zero model calls; Git runtime/image remains compatible. No new corpus observation or profile ran.

The new 205-observation exposed regression is prepared, unapproved and unexecuted: 24 four-repository, 94 TypeScript and 87 Python, on 110 inputs and 95 ordered repeat pairs. Bounds are 120-second target, 300-second native/whole maximum, 15-second cleanup and one 1,150-minute serial local sequence; no retry, profile, comparator, new repository, target execution or paid call. Exact scope is in v48-merge-allocation/evaluation-proposal.json and launcher-binding.json. The earlier shared source recovery still lacks completed corpus validation, so both prior-language schedules remain necessary. Synthetic allocation reduction establishes no native speedup or 300-second completion. The old native timeout and 204 unstarted closed, sampled timeout and all original fresh failures remain unchanged. No closed budget is reused and no failed gate is waived.

The audit retains all 247 requirements, including 89 original and 158 added rows. Corrected corpus gates, six historical closure decisions and explicit human technical acceptance remain unresolved. Phase 22 remains incomplete. Git campaigns stay 312/1,040 incomplete with 728 deferred; paid benchmark/pilots stay deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Historical v47 sampled timeout: source-only proposal pending

The separately approved single FAF worker profile at frozen 17b4784 timed out at 300 seconds with verified cleanup: one incomplete sampled input, four partial snapshots / 86,659 samples, no report, zero budget remaining. The review packet attributes 58.36–59.06% of worker samples inclusively to TypeScript branch merging and 25.78–26.41% as leaves in its fallback Value constructor. These overlapping sample shares are not promised savings; unused allocations remain uncounted. One narrow source-only fallback-allocation optimization is proposed, unapproved and unstarted, with zero new corpus/profile/paid budget. The prior regression's one incomplete attempt and 204 closed unstarted observations remain unchanged. Corrected detection/compatibility gates remain unresolved. Engineering retains tested 17b4784: 2,380 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 89.98%, branch-only 85.85%. All 239 audit rows and original fresh failures remain. Phase 22 is incomplete; no limitation or human technical acceptance is inferred. Git remains 312/1,040 incomplete, paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No optimization, retry, paid call, target execution, merge, ready-state, release, outreach or Phase 23 occurred or is newly authorized.

Historical v46 regression timeout: budget closed

The approved 205-observation sequence at frozen 17b4784 stopped on its first FAF vulnerable input at the 300-second whole-input maximum: one incomplete, zero completed reports, 204 unstarted closed, zero remaining. Cleanup passed. No finding, guard, negative-path or ordered-repeat result is available; corrected four-repository and prior-language compatibility gates remain unestablished. The review packet retains the failure and an unapproved single 300-second CPU-sampling diagnostic on the same FAF input. No retry, profile, target execution or paid call has occurred. All original fresh failures and historical source-bound passes remain unchanged. Engineering retains 17b4784: 2,380 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 89.98%, branch-only 85.85%. The audit retains all 233 requirements. Phase 22 remains incomplete; no failure/limitation or human technical acceptance is inferred. Git stays 312/1,040 incomplete; paid benchmark and pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state change, release, outreach or Phase 23.

Historical v45 source recovery: verified, regression approval pending

Source recovery at 17b4784 passes 2,380 tests / 36 skips locally and in all 12 hosted suites; all 29 normal CI jobs and docs pass. Local combined branch-enabled coverage is 89.98% (branch-only 85.85%). Packaging, isolation and six exact zero-call production replays are verified. The review packet binds the corrected scanner and an unapproved 205-observation exposed/compatibility proposal: 24 four-repository + 94 prior TypeScript + 87 prior Python observations, 110 inputs, 95 ordered pairs; 120-second target, 300-second maximum, one 1,150-minute sequence. No corrected-scanner corpus observation or paid call has occurred. Original 24 first-frozen observations and all four failed fresh gates at 2e0efb2 remain unchanged. Later passes would be exposed regression. Accurate lexical/physical and resolved-copy qualifiers retain their source prerequisites and unresolved safety. The audit retains all 227 requirements; no historical failure or limitation is accepted. Phase 22 remains incomplete pending separate evaluation approval, source assessment, explicit technical acceptance and verified closeout. Git stays 312/1,040 incomplete, paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

Historical v44 four-repository result: failed fresh gates, recovery proposed

The approved first-frozen batch at 2e0efb2 completes 24/24 observations; all 12 entire ordered report pairs agree, all within 120 seconds (maximum 51.378262 seconds; sequence 455.321356 seconds). All four repository gates fail: FAF, Lightning's Python member and Engram miss their named vulnerable sinks; no-bash detects the vulnerable overwrite but falsely alerts on both fixed/safe inputs per pass. Quiet negatives lack established named-path support. The completed review packet source-assesses all 236 findings, 46,486 diagnostics and 270 surfaces and proposes focused source-only recovery. No correction or limitation waiver is inferred. All 24 observations are consumed, zero budget remains, and no extra paid/target/comparator/retry/profile call occurred. All prior source-bound results and failures remain preserved; product/test/workflow bytes still equal tested 2e0efb2. Phase 22 remains incomplete: actual failed-gate disposition/recovery, separate explicit technical acceptance and closeout remain. Git 312/1,040 stays incomplete, paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

Historical v43 four-repository preparation: exact evaluation approval pending

Two new TypeScript repositories (FAF and no-bash) and two Python repositories (Lightning's Python member and Engram) are source-prepared at frozen 2e0efb2. The reviewable preparation packet proposes 24 native observations; zero have run and no evaluation approval has been received. Actual fixed-path support and first-frozen detection/discrimination remain unmeasured. All prior results, failures, closed budgets and proposed historical limitations remain intact. The v42 acceptance-readiness statement below is historical and superseded by this new requirement. Phase 22 remains incomplete pending exact evaluation approval, execution/source assessment, explicit human technical acceptance and verified closeout. No new paid calls; Git 312/1,040 remains incomplete, paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 gates unchanged. No merge, ready-state, release, outreach or Phase 23 is authorized.

Historical v42 regression result and pending technical acceptance

The approved 94-observation exposed TypeScript regression passes at frozen scanner 2e0efb2, source SHA-256 0eac8832012e213744d752c6c33a0ba6a2e378f6230e273030f5043f00cf6ebb. All 47 input records completed twice, with all 47 entire ordered report pairs equal after only the established 11 volatile exclusions. There were 94 observations within the 120-second target and 0 using the extended allowance; the maximum whole input was 106.857020 seconds, within the uniform 300-second maximum. The serial sequence took 3936.245 seconds. All 94 observations are consumed and the budget is closed, with zero remaining. No comparator, retry, profile, new repository, target execution or paid call occurred.

Memory-keeper passes both original three-input batches: one vulnerable import read hit and zero matching alerts on the fixed and safe inputs in each batch. The source assessment establishes the canonical operator root, component-bounded guard, checked helper return and supported actual read. Exactly four matching fixed/control false-alert occurrences and their derived counters disappear. All other ordered findings, warnings, unresolved flows, coverage and surfaces equal their bound references. The report has no positive per-sink guard trace; recognition is established by the code/source path, measured delta, evaluated rule and synthetic controls. Its unnamed MCP dispatch remains unresolved. Broader export and Git-message candidates and the upstream fixture-secret false positive remain visible.

All affected prior TypeScript conditions pass: SearXNG, fetch-mcp, open-webSearch and Lighthouse each retain two vulnerable hits and zero matching negative alerts per five-input batch; the precise initial-destination qualifiers remain intact. The ten TypeScript development records pass twice (four vulnerable hits and six valid negatives per batch), and the 14 historical TypeScript records pass twice (six vulnerable hits and eight valid negatives per batch). These language subsets are never pooled into a new whole historical/development execution. The whole 45+45 Linux timing/condition passes and explicitly reused whole 25 development batch retain their actual 1f3f72f evidence and Meta operator erratum. All 87 Python regression observations at 8c62567 remain source-compatible. The frozen DDG manifest's TypeScript label error remains disclosed: its actual hash-bound execution configuration selected Python.

The original fresh memory-keeper result remains unchanged: at 8c62567, one vulnerable hit and two matching fixed/control false alerts per batch, six complete observations and three equal report pairs. The repository was absent from eight prior manifests and 100 prior effective source trees. This demonstrates one narrow vulnerable detection on a project-unused repository before tuning; its discrimination correction is now exposed regression. It does not establish clean unseen vulnerable/fixed discrimination at the final corrected scanner. DDG's original fresh detections and initially unsupported fixed send, Lighthouse's original misses, and all earlier corrections/failures remain source-bound. The original held-out baseline stays 10 completed, 10 unsupported and five incomplete, with zero hits among four completed vulnerable inputs out of ten vulnerable inputs total. Same-agent curation/review is not independent human validation, training-data novelty, broad accuracy or runtime safety proof.

Product, tests, workflows, schemas and lock remain identical to engineering-tested 2e0efb2: local and all 12 hosted suites passed 2,317 tests / 36 skips, local branch coverage 89.92%, all 29 normal CI jobs passed in 34712751779, and docs passed in 34712751789. Those are retained source-bound passes; this continuation adds report validation, source assessments and final docs/package checks, not a new hosted code pass. Six zero-call production replays and the approved Git image/runtime bindings remain compatible. Git campaigns remain incomplete at 312/1,040, as requested. Paid benchmark and pilots remain deferred; Phase 21 is incomplete and Phase 24/15 gates are unchanged.

The audit retains all 89 original requirements: 84 passed, two user-deferred, two proposed documented limitations and one unresolved human acceptance. All 115 added requirements remain: 109 passed and six historical closure proposals awaiting decision. R66/R88 and V39-EVALUATION explicitly propose accepting the preserved fresh discrimination failure plus the later verified exposed correction. Five older failed optimization/preparation/execution attempts also retain their individual proposed closure decisions. None is relabeled as a historical pass or silently waived. The exact proposed acceptance scope and consequences are in v42-path-guard-regression/acceptance-proposal.json. Phase 22 remains incomplete until explicit human technical acceptance and subsequent closeout delivery. No merge, ready-state change, release, outreach or Phase 23 is authorized.

Every rule emits the canonical Finding contract and has a stable permanent ID. Static severity begins from impact and theoretical exploitability; dynamic proof raises exploitability to confirmed. GPT review may confirm, suppress, or abstain, but it cannot change a rule's identity or delete its audit trail.

Static findings may be suppressed in included Python or TypeScript source with an exact reason-bearing directive:

# sentinel: ignore[SENT-005] reason=reviewed fixture credential
// sentinel: ignore[SENT-005] reason=reviewed fixture credential

A standalone directive binds the next physical line; a trailing directive binds its own line. Static rules SENT-001–SENT-007 and SENT-012–SENT-016 are supported. The finding stays in rule, report, JSON, and SARIF counts with status suppressed, its reason and directive location remain visible, and GPT review is skipped for that finding. Malformed, duplicate, unknown-rule, or reasonless directives fail with exit 2; valid directives that match no finding emit inline_suppression_unused.

Narrow TypeScript URL guard evidence

The TypeScript flow follows source-bound low-level CallToolRequestSchema handlers through factory-created Server instances and McpServer.server aliases, including the parser's optional else branch. Replaced or escaped receivers lose that binding.

Module-level class construction and constructor registration also follow source order. SDK prototype wrappers retain the original setter only when the source forwards the actual schema, handler and SDK receiver through the saved method. Replaced callbacks, wrong receivers and escaped methods do not establish that registration. Unused classes do not create tool entries.

SENT-015 can qualify a broader SSRF candidate with narrow source-established literal loopback IPv4 rejection. Local hostname prefix checks and net.isIP comparisons preserve the actual URL identity. A default-only qualifier requires every normal guard exit either to enforce that check or to require an unshadowed, unmutated process.env option explicitly compared to "true". Missing hardening options, unknown conditions, URL replacement and environment mutation cannot establish this protection. The scanner does not read the target environment or suppress the broader candidate. DNS, redirects, IPv6 and other destinations remain unestablished; this is source analysis, not runtime proof.

Lighthouse calls are recognized URL sinks. A literal 169.254. hostname rejection can qualify a candidate as excluding initial link-local IPv4 destinations, while retaining the broader finding. Ordered prefix-table guards require a known array and at most 32 iterations. Indexed aliases, unknown mutations, unresolved loop control, swallowed failures and checks on another URL cannot establish this qualification. This does not imply loopback, DNS, redirect or IPv6 protection. An allowlist branch restricted to exact ::1 or [::1] hostname literals can preserve the narrower IPv4 link-local exclusion at a helper's normal-return join.

At 2ac39aa, the full exposed SearXNG source retains this qualifier on both fixed variants. Receiver invalidations stay local to mutually exclusive if arms and are conservatively unioned at their join; unknown effects in an HTTP branch no longer contaminate its stdio alternative. Both five-input native batches detect both vulnerable variants with zero matching fixed/control alerts. Broader candidates and unresolved dispatch remain visible. The earlier 6eb482c fixed false alerts are preserved; neither result establishes complete redirect coverage or runtime protection. See the current Phase 22 status and audit.

SENT-001

Overly broad tool permission scope

• Engine: MCP-aware Python AST/TypeScript analysis plus sentinel.permissions.yaml
• Impact: High
• OWASP: ASI03:2026 — Identity & Privilege Abuse
• Boundary: literal filesystem/network use in official SDK and FastMCP tools; dynamic paths are treated as broad
• False-positive risk: Medium; broad capabilities may carry an explicit justification
• Remediation: narrow each capability to the resources the handler needs

SENT-002

Unsafe execution from tool input

• Engine: pinned Semgrep plus bounded Python AST/TypeScript helper-flow analysis
• Impact: Critical
• OWASP: ASI05:2026 — Unexpected Code Execution
• Boundary: eval, exec, unsafe deserialization, and shell-enabled subprocess sinks reached by tool input, including top-level same-file named helpers, explicit argument bindings, assignments, and helper returns
• False-positive risk: Low
• Remediation: use explicit parsers and fixed command allowlists

Helper findings point to the tool's call site and identify the known sink. Python helper flow also recognizes imported subprocess.check_call and subprocess.check_output with literal shell=True; fixed commands, locally rebound callees and calls without an established shell do not match those sinks. TypeScript shell calls also use shared SDK registration and source bindings to follow imported helpers, low-level request dispatch and command reassignment. These findings cite the external sink with cross-file source evidence. exec and execSync invoke shells; execFile/spawn forms require established shell: true for this added shell flow. Separate argv without a shell is not a shell-injection finding. The existing command-option rule covers its own contract. Recursion, ambiguous bindings and unsupported control or mutation paths can emit static_flow_unresolved. Shared TypeScript flow has a 64-frame recursion bound; the existing scan deadline also applies. static_review_context_incomplete means a traced flow exceeds the unchanged GPT context window. An unresolved flow is not evidence of safety.

SENT-003

Missing tool input validation

• Engine: MCP-aware Python AST/TypeScript analysis
• Impact: Medium
• OWASP: ASI02:2026 — Tool Misuse & Exploitation
• Boundary: consumed input in decorated tools and SDK dispatchers; primitive framework schemas, Pydantic/Zod parsed results, enforced JSON Schema/Ajv checks, and recognized custom type/allowlist guards before use
• False-positive risk: Medium for unrecognized custom validators
• Remediation: validate every declared field before handler behavior

The relevant field must be protected on each continuing path. Unrelated validation, discarded parsed outputs, late checks, and replacement after validation do not exempt the consumed value. Ordinary branches and rejecting exits are recognized; arbitrary custom validation remains outside this boundary.

SENT-004

Unsanitized tool content in prompt

• Engine: intraprocedural Python AST/TypeScript taint analysis
• Impact: High
• OWASP: ASI01:2026 — Agent Goal Hijack
• Boundary: tool-controlled content entering prompts or model-request fields
• False-positive risk: Medium–High; trusted sanitizers must be configured
• Remediation: sanitize tool-controlled text before prompt construction

Configured sanitizers are an explicit trust decision. Only their returned value loses taint; discarded output and reintroduced raw content remain candidates. Recognition does not prove that text sanitization prevents prompt injection.

SENT-005

Hardcoded secret

• Engine: Semgrep candidates plus deterministic signature, entropy, redaction, fingerprint, and paired allowlist checks
• Impact: Critical
• OWASP: ASI03:2026 — Identity & Privilege Abuse
• Boundary: supported Python/TypeScript/configuration files; evidence is redacted
• False-positive risk: Low–Medium
• Remediation: use an external secret store or runtime environment injection

SENT-006

Missing or ineffective route authentication

• Engine: framework-aware Python AST/TypeScript analysis
• Impact: High
• OWASP: ASI03:2026 — Identity & Privilege Abuse
• Boundary: recognized FastAPI dependencies, Starlette authentication plus authenticated permissions, Express middleware, and Hono bearer authentication; application/path scope, trusted credential anchors, and rejecting failure paths
• False-positive risk: Low; intentional public routes require configuration
• Remediation: verify identity and reject invalid credentials before route code

Middleware installation or an authentication-related name is insufficient. Wrong applications/paths, bypassed checks, ignored results, and request-derived trust anchors cannot establish a protected route. Unrecognized authentication implementations can retain a finding for review.

SENT-007

Unverified tool manifest

• Engine: Python AST/TypeScript ordering plus integrity-sidecar validation
• Impact: Medium
• OWASP: ASI04:2026 — Agentic Supply Chain Vulnerabilities
• Boundary: JSON/YAML manifest loads with enforced SHA-256 comparison or native Ed25519, RSA-PSS-SHA256, or ECDSA-SHA256 verification over the consumed bytes; literal anchors or validated integrity-sidecar references
• False-positive risk: Low
• Remediation: verify a pinned digest or trusted detached signature before parsing

Computing a hash is insufficient. The check must reject a mismatch before consumption; verifying different bytes, ignoring Node's boolean verification result, or overwriting verified bytes does not establish integrity. Python's native signature verifier rejects by raising. Recognition is bounded to the supported source forms and does not execute the target.

SENT-008

Out-of-scope tool execution

• Engine: Docker-isolated dynamic probe
• Impact: Critical
• OWASP: ASI02:2026 — Tool Misuse & Exploitation
• Evidence: a successful granted-tool control followed by successful processing of valid arguments by a listed ungranted tool
• Remediation: reject calls not granted by the active capability policy

The permissions sidecar declares expectations; it does not enforce a runtime boundary. This probe tests tool-name grants, not path or network containment. An unknown-name rejection is a completed negative; success for an unknown name is inconclusive because real tool execution is unproven.

SENT-009

Size-limit violation or attributable resource failure

• Engine: Docker-isolated dynamic probe
• Impact: Medium
• OWASP: ASI05:2026 — Unexpected Code Execution
• Evidence: successful processing beyond an explicit maxLength, maxItems, or maxProperties limit, or Docker-observed OOM/crash after a successful baseline
• Control: legitimate large-input success produces no finding; timeout alone is inconclusive, and scanner shutdown/startup failure is not crash proof
• Remediation: enforce byte and schema limits before invoking handlers

SENT-010

Injection payload executed

• Engine: Docker-isolated scratch-canary probe
• Impact: Critical
• OWASP: ASI05:2026 — Unexpected Code Execution
• Evidence: the canary was absent before/after the separate baseline and before the attack, then present after the attack, even if the response reports an error
• Control: pre-existing canaries are inconclusive; inspection failure fails infrastructure
• Remediation: treat tool arguments as inert data and remove execution sinks

SENT-011

Malformed schema input processed

• Engine: Docker-isolated dynamic probe
• Impact: Low
• OWASP: ASI02:2026 — Tool Misuse & Exploitation
• Evidence: a missing or wrong-type required argument produced a successful non-error response
• Remediation: validate required fields and declared types before handler entry

SENT-011 preserves valid sibling arguments and verifies the complete mutation against the actual schema before calling. Only an actually missing required field or invalid type supports proof. Every dynamic finding carries baseline and attack evidence; completed negative attempts do not establish general safety.

SENT-012

Path containment failure

• Engine: bounded Python and TypeScript source flow using the installed parsers
• Impact: High
• OWASP: ASI02:2026 — Tool Misuse & Exploitation; a caller can exceed the filesystem or repository resource boundary of a tool
• Boundary: recognized Python tool inputs reaching supported open, pathlib, OS/shutil filesystem APIs, Git repository selection or Repo.index.add; literal component containment after canonical resolution is recognized
• TypeScript boundary: included imports/re-exports, official SDK registrations and statically recoverable Mastra tool objects; supported Node filesystem calls, helper returns, destructured parameters, callbacks and literal dispatch branches
• False-positive risk: Medium; intentionally unrestricted tools, unsupported validators and unresolved bindings require review
• Remediation: resolve the path and allowed root, enforce component containment before access, and use the validated value. String prefix checks alone allow sibling-prefix collisions; lexical normalization alone does not resolve symlinks

The development implementation follows included local imports, re-exports, unambiguous aliases and explicitly bound methods. It recognizes nested literal dispatchers, helper return values and rejecting validators. Discarded Boolean checks, checks of unrelated values, swallowed exceptions and later replacement do not establish protection. An optional operator root is analyzed under the condition that it is configured; a caller-controlled root is not trusted. relative_to with true or dynamic walk_up is not a rejecting containment check: Python permits parent components in that mode. Checking an expanded home-directory path does not validate the original unexpanded value. See the Python API contract.

An actual function-local pathlib import retains its identity through aliases; replacement, namespace mutation and escape to an unknown call invalidate that identity. Resolving a path produces a distinct value. A guard on that resolved copy does not suppress a later use of the original path. A remaining candidate can record that the originating path's resolved copy passed containment while explicitly leaving reconstruction, subsequent derivation, working-directory changes and physical containment unresolved. The checked value itself must reach the operation to establish protection.

Recursive or deeper-than-64 helper/binding chains and unresolved calls are disclosed. This is source analysis, with no race-free filesystem or runtime symlink guarantee. static_review_context_incomplete discloses traced evidence outside the current review blocks. TypeScript recognizes enforced rejection of parent components and absolute destinations from a relative path after canonical resolution, including Boolean aliases and imported guards. Unsupported dispatch, computed members, schemas and calls remain explicit gaps. Technical rule acceptance, the new independent corpus evaluation and reviewed-tier measurements remain pending; this draft implementation does not complete Phase 22.

Included tool decorators are followed through their returned callable and captured arguments. The exact registration position determines which wrappers affect the registered handler. A wrapper that substitutes a fixed path or never invokes the handler does not establish the original caller-to-sink flow. Unresolved decorators remain an explicit limitation, including nondefault or impersonated wraps.

The current integration also follows explicit parameterless FastMCP launches and their preceding module-global assignments, retaining the analyzed transports in findings. Replaced or unresolved launch methods retain unconfigured analysis. Source-bound openpyxl workbook loads and saves are filesystem sinks; unknown or replaced workbook receivers do not establish that API identity. Python parent-directory findings retain an enforced check on the original path without claiming that its parent is contained. When launch modes differ, the finding names the transports on which that original check was established. An unguarded alternative in the same transport removes that qualification; the parent-directory candidate remains visible for review.

TypeScript boolean status fields can carry enforced helper-return conditions. Discarding the field, replacing it, or letting its record escape to an unknown call does not establish protection. A retained candidate can distinguish an initial normalized root-prefix check from the containment of paths derived afterward. That initial check does not establish component, parent-fallback or symlink safety. While loops receive zero-or-one-iteration source interpretation; later loop-carried state is explicitly unresolved. No target loop is executed.

Actual module startup can construct an imported local class and register its handlers; an unused class alone does not establish registration. Compound component-prefix-or-root checks retain their shared lexical fact through checked record returns, without suppressing physical-path concerns. Nonempty root collections can survive a checked fallback and map; empty alternatives and mutations remain conservative. An unconditional, break-free path-canonicalization loop has a narrow source summary: locals are widened before collecting returns, and only known path operations and intact local arrays are supported. Its termination remains unresolved; arbitrary calls or mutations do not receive that summary.

A TypeScript module root assigned once inside a top-level try can retain its canonical path when failure branches throw or call a proven global process.exit. This narrow proof excludes finally blocks, nested declarations, later writes, destructuring/loop rebinding and direct eval. Shadowed, replaced or escaped process and unknown termination stay conservative. Code after proven process termination does not register a reachable handler. This is source reasoning, not a runtime filesystem or race-safety guarantee.

The TypeScript interpreter also follows the documented mobilecli screenrecord --output contract through ordered arguments and included class helpers to genuine Node process calls. It requires a literal mobilecli command or a caller-independent path in its named npm package with the binary prefix mobilecli-. Findings explicitly qualify this source-selected executable; operator overrides and a functioning device/toolchain require separate verification. An arbitrary executable or an unresolved or repeated option sequence does not establish this contract. A conditional output guard is retained only for the same truthy returned value. These are static source findings, not observed file writes or Node runtime support.

SENT-013

Tool-description poisoning

• Engine: the existing Python AST and installed Semgrep TypeScript parser
• Impact: High; the existing theoretical-exploitability rubric initially reports Medium severity, with candidate-bound review kept separate
• OWASP: ASI01:2026 — Agent Goal Hijack; metadata attempts to replace the agent's instructions, disclose secrets, or redirect its use of tools
• Boundary: Python tool docstrings, declared descriptions and parameter metadata; TypeScript SDK/Mastra descriptions, schema descriptions and statically recovered low-level tools/list metadata, including included imports and literal concatenation
• False-positive risk: Medium; ordinary imperatives and explicit quoted security warnings are controls. Security tools may still need review of remaining directives
• Remediation: remove unrelated instruction overrides, secret-disclosure requests and tool redirection from descriptions; describe the tool's intended operation

The rule recognizes bounded explicit wording, including supported invisible Unicode and ANSI representations. Suspicious vocabulary alone is insufficient. Labeling an active directive “Warning” does not exempt it. Ordinary prerequisites such as fetching a project ID from another tool are distinct from secret-directed redirection. Dynamically generated descriptions remain unresolved and are disclosed; this is not independent semantic discovery or a guarantee against all prompt attacks.

The rule is enabled by default and uses existing rule selection, reason-bearing inline suppression, baseline identities and severity thresholds. Descriptions remain untrusted source evidence, never instructions to Sentinel. Native reports continue to use the canonical static Finding shape.

SENT-014

Command option injection

• Engine: shared Python flow analysis and the installed Semgrep TypeScript parser
• Impact: Critical; theoretical exploitability initially produces High severity
• OWASP: ASI05:2026 — Unexpected Code Execution; an attacker-controlled argument can select executable command behavior even when the invocation is shell-free
• Boundary: GitPython raw command methods, supported TypeScript child-process and simple-git argument positions, and Python subprocess argument lists
• Controls: enforced leading-hyphen rejection of the actual value; rejection of every split selector token; supported Git terminators before caller arguments
• Remediation: reject option-like inputs before use, retain the checked value, and use command-specific safe positions or object APIs
• False-positive risk: Medium; unrestricted administrative tools, other command parsers and unresolved wrappers require source review

A list of arguments prevents shell interpretation but does not prevent an argument from being parsed as an option. A terminator after caller input cannot protect it. Git object methods such as repo.commit(ref) are distinguished from raw Git command methods. The supported terminator checks are limited to Git revision/path commands; they do not exempt arbitrary programs. Git documents path separation in checkout and untrusted revision handling in rev-parse.

Python flows include local helpers, nested handlers, source-established registration wrappers, list append/extend/insert, copying, and selector-list construction. TypeScript Git and simple-git calls consume the evaluated ordered array, including aliases, helper appends, conditional appends and zero-argument slice copies. Arrays are bounded to 32 layouts of 256 positions; unknown escapes and computed updates retain visible uncertainty and cannot establish a safe terminator. Unsupported indexing and dynamic binding remain conservative. The rule does not establish that a fixed option's value is safe for every command-specific feature. The current Git terminator model covers diff, show, log, checkout and rev-parse. It retains a known false alarm for git add --, whose separator is defined by the Git add reference, and conservative candidates for date/commit filter values; these require separate source review.

# Vulnerable: caller text can become additional dbt options.
args.extend(["--select"] + node_selection.split())

# Enforced token rejection protects this selector condition.
tokens = node_selection.split()
if any(token.startswith("-") for token in tokens):
    raise ValueError("option-like selector")
args.extend(["--select"] + tokens)

Default enablement, explicit --rules SENT-014, reason-bearing inline suppression, baseline matching and severity thresholds use the existing canonical Finding pipeline. Independent development measurements, fresh holdout, reviewed retention and human acceptance remain separate gates in the Phase 22 status record.

SENT-015

• Title: Server-side request forgery
• OWASP: ASI02:2026 — Tool Misuse & Exploitation. A caller can use the server's outbound request capability to address destinations outside the intended boundary.
• Impact: High; theoretical likelihood produces initial Medium severity.
• Engine: Source-only Python and TypeScript flow through shared discovered handlers and bounded local helpers.
• Remediation: Restrict schemes to HTTP(S), require intended destinations, reject private/loopback addresses, and validate each requested value and redirect.
• False-positive risk: Medium. Intentionally unrestricted network tools and custom request clients/validators require source review.

Python requests/httpx functions and recognized requests/httpx/aiohttp client instances are request sinks, as is urllib's URL opener. TypeScript supports global fetch, recognized node-fetch/undici/axios imports, and Node HTTP(S) requests. Python entry points include discovered MCP tools and source-established HTTP routes; FastAPI dependency-injected parameters are not ordinary caller input. Guard facts follow the actual URL binding; a discarded predicate, unrelated guard, caught failure that continues to the request, or replacement input is insufficient. Exact scheme/hostname allowlists are supported in both languages. Python also supports enforced standard-library IP-address predicates and a statically nonempty literal-address validation loop. The exception path for nonliteral hostname resolution does not establish DNS safety.

TypeScript caller fields also flow through supported genuine Zod schemas and async static class helpers. Schema parsing alone does not restrict destinations. An enforced imported private-ip predicate on the same parsed URL's hostname credits only literal IPv4 rejection. Checking the whole URL, ignoring the result, or escaping/replacing the URL object does not establish that guard. A guarded path can retain a residual finding for restrictions that remain unestablished; that finding does not claim the initial private-IPv4 request is permitted.

Genuine Atlassian Jira/Confluence clients retain their current base URL at REST get, post, put, patch, delete, request and Jira myself() calls. Construction alone does not establish a request. The SDK REST contract joins relative paths to that base; explicit absolute=True selects the supplied path. Replaced URL values are checked at the call, while unknown sessions, escaped clients and replaced request methods remain unresolved. Other SDK methods and middleware-to-tool request-state relationships are not established by this support.

This rule's destination condition covers prohibited schemes and literal private/loopback destinations. Hostname resolution, DNS rebinding, and complete redirect-policy verification are not established by these checks. Ambiguous bindings and unsupported wrappers remain disclosed rather than treated as proof of protection. A finding is a static candidate, not an observed network request.

The frozen SearXNG evaluation missed both vulnerable variants at 7555a9d. Its MCP tool surface was not recognized, so completed scans of the optional HTTP routes did not establish coverage of the ordinary stdio URL reader. The exposed correction at 2ac39aa now passes the narrow detection gate while retaining unresolved dispatch coverage. See the current assessment for the preserved first results and remaining limitations.

# Caller input reaches the server's network capability.
return requests.get(url)

# An enforced exact destination boundary for the initial requested URL.
parsed = urlparse(url)
if parsed.scheme != "https" or parsed.hostname != "images.example.com":
    raise ValueError("destination not allowed")
return requests.get(url, allow_redirects=False)

The rule is enabled by default and uses canonical Finding evidence, explicit --rules SENT-015 selection, inline suppression, baseline matching and severity thresholds. Development measurements, held-out evaluation, reviewed retention and human acceptance remain separate Phase 22 gates.

SENT-016

• Title: Unauthorized operator-credential fallback
• OWASP: ASI03:2026 — Identity & Privilege Abuse. A request without caller credentials can inherit the server operator's authority at an outbound service.
• Impact: High; theoretical likelihood produces initial Medium severity.
• Engine: Python and TypeScript source flow from registered HTTP handlers to supported requests/httpx credential arguments and source-bound Jira/Confluence token or password constructor arguments, including caller headers obtained through the source-established SDK HTTP request getter.
• Remediation: Reject absent or invalid caller credentials before invoking the protected operation. Keep operator credentials separate from caller sessions.
• False-positive risk: An intentionally operator-authorized public service requires review of that authorization policy; merely omitting authentication does not establish permission to act with operator credentials.

The current implementation follows environment-derived operator credentials into auth arguments, recognized credential fields in headers/parameters/payloads, and the token/password keywords of imported atlassian.Jira and atlassian.Confluence clients. Replaced imports, local impersonating modules and caller-shadowed constructors do not establish those external sinks. Client URL and username arguments alone are not treated as credential use. Explicit request credentials are also recognized on source-established httpx.Client, httpx.AsyncClient, requests.Session and aiohttp.ClientSession receivers. URL and credential checks share that identity; method replacement and unknown escape invalidate it. Session authentication, header and supported query defaults flow to the actual request; constructing a session alone is not a credential sink. Request overrides follow each supported library's authentication and mapping precedence. Header names are case-insensitive, while query keys retain their case. Httpx constructor/setter mappings are copied; requests member assignments retain aliases. Known Basic Auth fields are tracked, including requests field mutation; aiohttp default auth follows a known base origin, and conflicting auth/header arguments are disclosed as invalid. Custom authentication hooks remain unresolved. Receiver factories are evaluated once per call, and positional argument effects precede credential keyword values. It distinguishes caller-token rejection from checks of unrelated values and values replaced after validation. Dictionary member writes, copies and helper mutations retain the relevant credential selection. A local stdio tool's use of its owner's credentials alone does not establish an HTTP caller boundary.

The integration also follows negative caller-authentication branches into a separately constructed operator client, including helper calls. A successfully acquired SDK HTTP context retains its branch state separately from the getter's non-HTTP alternative. For a prepared HTTP request, constant local assignments immediately after the genuine getter survive exception entry unless later writes or nonlocal/global mutation invalidate them. Different caller-absence conditions remain separate through a try/except's continuation when it has no finally. General exception side effects remain a bounded-flow limitation. Enforced environment comparisons can annotate a fallback with the setting whose declared default would reject that path. The candidate remains visible: the effective environment and intended authorization policy still require review. Ignored checks, optional helper returns, replaced predicates and a shared sink with an unqualified path do not establish that qualification. Returned clients and credential fields retain the conditions under which operator credentials were selected. An unguarded operator alternative removes the qualification; unknown mutation cannot preserve it. This includes selecting configuration initialized at startup; unrelated absence checks do not erase the selected credential’s condition. Enforced literal allowlists retain possible string choices across helpers. Known assigned fields remain present even when their values are unknown; repeated lifespan analysis does not make declared dataclass fields optional. The exposed Atlassian authentication pair and its helper-renaming mutations completed at 34220b7, with two vulnerable condition hits and no fixed-condition alerts at the declared default. This is source adjudication, not runtime proof, fresh holdout evidence or the final repeated benchmark.

TypeScript follows source-established Express module/factory route registrations, including imported handlers, re-exports and ordered use/route middleware, into global fetch, node-fetch, and undici.fetch credential headers. It tracks process.env fallback selected by ||, ??, or an enforced absent-token branch, and checks the actual caller value when rejection returns or throws. Rebound application, environment and request bindings remain unresolved. Plain request configurations retain header updates through aliases, included helpers, named fields and literal string indexes. Branch merges retain possible credential flow without treating an absent field as an enforced guard. Unknown mutation and prototype replacement invalidate protection. Python follows genuine ContextVar allocation, defaults and request-local get/set/matching single-use reset through included helpers, including token clearing and separate request state. These operations follow the Python context variable contract. TypeScript middleware guards qualify the same caller value only when actual next() forwarding reaches the callback. Unknown mount paths, error forwarding and nested routers cannot establish protection. Literal arrays are bounded to 256 entries and synchronous continuation depth to 32; larger layouts remain unresolved. Manual Python context switching and spawned tasks remain unsupported; route tests do not establish SDK lifecycle conditions.

The genuine FastMCP HTTP getter retains current request state across included helpers within a tool entry, following the SDK request-context contract. Separate tool entries do not inherit each other's state. This does not infer middleware attachment from a class name or an unrelated HTTP route.

token = request.headers.get("Authorization")
# Candidate: an unauthenticated caller selects the operator credential.
token = token or os.environ["OPERATOR_TOKEN"]
return requests.get("https://api.example.com/", headers={"Authorization": token})

The rule is enabled by default and produces canonical Finding evidence with source locations and remediation. CLI regressions cover explicit rule selection, inline suppression, baseline matching, and calculated severity thresholds. This integration remains incomplete for the approved cross-middleware, service-factory and TypeScript conditions. Direct HTTP regressions are not evidence that the historical or frozen development conditions pass. See Phase 22 implementation status for remaining measurement, reviewed-retention and acceptance gates.