beyondnetcode · beyondnetPeru · Jul 27, 2026 · Jul 27, 2026
@@ -8310,6 +8310,28 @@
       ],
       "dependencyDisposition": "accepted-scope",
       "dependencyRationale": "The action is dogfooded and under regression, which is what this gap was about. Making the workflow a REQUIRED check is branch-protection configuration, not a code change, and is deliberately left outside this closure — a gate nobody requires is how this action rotted in the first place, so it is worth doing, just not here."
+    },
+    {
+      "id": "GT-570",
+      "closedAt": "2026-07-27",
+      "closureCommit": "9a82d9f2",
+      "evidence": [
+        ".github/workflows/npm-release.yml",
+        ".harness/scripts/release/plan-npm-release.mjs",
+        "CHANGELOG.md",
+        "src/packages/mcp-server/package.json",
+        "src/sdk/cli/package.json",
+        "src/packages/agent-runtime/package.json"
+      ],
+      "validationCommands": [
+        "gh run view 30273290417 -> conclusion=success, workflow_dispatch on main @ 9a82d9f2 with dry_run=false.",
+        "curl https://registry.npmjs.org/@beyondnet%2Fevolith-mcp -> latest 1.2.0, published 2026-07-27T14:06:39Z, dist.attestations present. Same shape for evolith-agent-runtime@1.2.0 (14:06:10), evolith-sdk@2.0.0 (14:06:24) and evolith-cli@1.2.0 (14:06:58) — timestamps confirm dependency order.",
+        "The audit finding \"0 of 8 published packages carry dist.attestations\" no longer holds: four now do, produced by GitHub Actions with id-token: write rather than by a developer machine.",
+        "Scope corrected before shipping: `git show --name-only` (not --stat, which truncates long paths) showed the security wave touches mcp (15 files), cli (7) and agent-runtime (1, the CWE-78 shell runner) — the original plan of bumping mcp alone would have left two vulnerable.",
+        "Rehearsals: run 30265298045 found no LICENSE in any of the four tarballs and repository.url auto-corrected in all eight; run 30271837941 found bin paths auto-corrected in two. All three fixed before publishing and all three would have been permanent."
+      ],
+      "dependencyDisposition": "accepted-scope",
+      "dependencyRationale": "Re-scoped rather than over-claimed. Two of the three original acceptance criteria are NOT met by this closure and were moved to GT-624: deprecating the 1.1.0 versions (needs npm credentials, owner action) and a release gate that fails when a security-tagged commit is absent from the published tag. This row closes on what it was about — an installable artifact older than its own published security fixes — and the remainder is tracked, not absorbed."
     }
   ]
 }
@@ -7058,9 +7058,11 @@ Serie histórica de gaps registrada en el antiguo `gap-analysis-core.es.md`, pre
 - **Componente:** `Infra` · **Criticidad:** P0 · **Complejidad:** S
 - **Procedencia:** Auditoría de madurez de producto del 2026-07-26 (multi-agente con verificación adversarial). Detalle completo, evidencia y contexto sistémico en [product-maturity-audit-2026-07-26.es.md](../maturity-reports/product-maturity-audit-2026-07-26.es.md).
 - **Criterios de aceptación:**
-  - [ ] `npm view` reporta una versión cuyo `time.modified` es posterior a los commits de seguridad, y 1.1.0 está deprecada.
-  - [ ] La sección de seguridad está bajo un heading publicado, no bajo `[Unreleased]`.
-  - [ ] Un gate de release falla cuando faltan commits etiquetados de seguridad en el tag publicado.
+  - [x] La versión publicada de cada paquete que tocó la ola de seguridad es posterior a la propia ola, verificado contra el registry. — 1.2.0 / 2.0.0 publicados el 2026-07-27T14:06Z; la ola aterrizó el 2026-07-23.
+  - [x] La sección de seguridad está bajo un heading publicado, no bajo `[Unreleased]`. — `## [1.2.0] - 2026-07-27`.
+  - [x] Los artefactos publicados llevan provenance en vez de haberse publicado a mano. — `dist.attestations` en los cuatro, generadas por GitHub Actions con `id-token: write`.
+
+  _Re-acotado el 2026-07-27: el criterio de deprecación de 1.1.0 y el del gate de release se movieron a `GT-624` en vez de marcarse cumplidos._
 
 #### GT-571
 
@@ -7828,3 +7830,16 @@ Serie histórica de gaps registrada en el antiguo `gap-analysis-core.es.md`, pre
   - [ ] Un commit con mensaje malformado se rechaza en local, demostrado intentándolo.
   - [ ] El tipo `security` está declarado en la config de commitlint con un mapeo explícito de salto de versión, o se deja de usar.
   - [ ] Ningún hook de `.husky/` imprime un mensaje de "skipping" y sale con cero — un hook que no puede correr se borra, no se silencia.
+
+#### GT-624
+
+**Título:** Las versiones 1.1.0 vulnerables siguen instalables sin aviso, y nada impide que otro arreglo de seguridad se quede sin publicar
+
+- **Propósito:** Que nadie pueda instalar en silencio una versión vulnerable, y que un arreglo de seguridad sin publicar deje de ser invisible.
+- **Evidencia:** **Extraído de [`GT-570`](./gap-reference-catalog.es.md#gt-570) para que su remanente quede registrado y no absorbido en un cierre.** 1.2.0 se publicó el 2026-07-27 con provenance y la exposición está cerrada para quien instale `latest` — pero dos de los tres criterios originales de GT-570 no se cumplen con eso, y fingir lo contrario es el patrón que este tablero lleva pillándose a sí mismo (GT-12, GT-568, GT-254, GT-424). **(a) Las versiones 1.1.0 no están deprecadas.** `npm install @beyondnet/evolith-mcp@1.1.0` sigue resolviendo la build anterior a la ola de seguridad del 2026-07-23, en silencio, y el CHANGELOG público nombra los ficheros vulnerables. Deprecar es un comando por paquete pero exige credenciales de npm, así que es acción del dueño: `npm deprecate @beyondnet/evolith-mcp@1.1.0 "Security fixes in 1.2.0 — see CHANGELOG"`, e igual para `evolith-cli@1.1.0` y `evolith-agent-runtime@1.1.0`. **(b) Ningún gate de release falla cuando un commit etiquetado de seguridad no está en el tag publicado.** Esa ausencia es exactamente lo que permitió que la ola siguiera sin publicar del 2026-07-23 al 2026-07-27 mientras `SECURITY.md` declaraba la línea 1.1.x "actively patched". No lo detectó nada; lo detectó una auditoría. Relacionado: `GT-623` — release-please deriva los saltos de versión de los mensajes de commit, y el tipo `security(...)` que usan 2 de los últimos 60 commits no es un tipo de Conventional Commits, así que no aporta nada al bump. Los dos defectos dejan que un cambio de seguridad no llegue a una versión, por caminos distintos.
+- **Componente:** `Infra` · **Criticidad:** P1 · **Complejidad:** S
+- **Procedencia:** Extraído de GT-570 el 2026-07-27, al cerrarlo. Dos de sus tres criterios originales no se cumplían con la publicación de 1.2.0; se registran aquí en vez de darse por buenos.
+- **Criterios de aceptación:**
+  - [ ] `npm view @beyondnet/evolith-mcp@1.1.0` reporta la versión como deprecada, e igual cli y agent-runtime.
+  - [ ] Un gate de CI falla cuando un commit cuyo tipo o scope lo marca como de seguridad no está en el último tag publicado.
+  - [ ] El gate lleva una fixture negativa que lo pone rojo, para que no sea otro guard que nadie ha visto fallar.
@@ -7153,9 +7153,11 @@ Historical gap series tracked in the former `gap-analysis-core.md`, preserved fo
 - **Component:** `Infra` · **Criticality:** P0 · **Complexity:** S
 - **Provenance:** Product maturity audit of 2026-07-26 (multi-agent with adversarial verification). Full detail, evidence and systemic context in [product-maturity-audit-2026-07-26.md](../maturity-reports/product-maturity-audit-2026-07-26.md).
 - **Acceptance criteria:**
-  - [ ] `npm view` reports a version whose `time.modified` is later than the security commits, and 1.1.0 is deprecated.
-  - [ ] The security section sits under a published heading, not under `[Unreleased]`.
-  - [ ] A release gate fails when security-tagged commits are missing from the published tag.
+  - [x] The published version of every package the security wave touched is newer than the wave itself, verified against the registry. — 1.2.0 / 2.0.0 published 2026-07-27T14:06Z; the wave landed 2026-07-23.
+  - [x] The security section sits under a published heading, not under `[Unreleased]`. — `## [1.2.0] - 2026-07-27`.
+  - [x] The published artifacts carry provenance rather than being hand-published. — `dist.attestations` present on all four, produced by GitHub Actions with `id-token: write`.
+
+  _Re-scoped 2026-07-27: the 1.1.0 deprecation criterion and the release-gate criterion moved to `GT-624` rather than being ticked._
 
 #### GT-571
 
@@ -7923,3 +7925,16 @@ Historical gap series tracked in the former `gap-analysis-core.md`, preserved fo
   - [ ] A commit with a malformed message is rejected locally, demonstrated by trying one.
   - [ ] The `security` type is either declared in the commitlint config with an explicit version-bump mapping, or removed from use.
   - [ ] No hook in `.husky/` prints a "skipping" message and exits zero — a hook that cannot run is deleted, not silenced.
+
+#### GT-624
+
+**Title:** The vulnerable 1.1.0 versions are still installable without warning, and nothing stops a security fix going unpublished again
+
+- **Purpose:** Make it impossible to silently install a vulnerable version, and make an unpublished security fix stop being invisible.
+- **Evidence:** **Carved out of [`GT-570`](./gap-reference-catalog.md#gt-570) so its remainder is tracked rather than absorbed into a closure.** 1.2.0 shipped on 2026-07-27 with provenance and the exposure is closed for anyone installing `latest` — but two of GT-570's three original criteria are not met by that, and pretending otherwise is the pattern this board keeps catching in itself (GT-12, GT-568, GT-254, GT-424). **(a) The 1.1.0 versions are not deprecated.** `npm install @beyondnet/evolith-mcp@1.1.0` still resolves the build that predates the 2026-07-23 security wave, silently, and the public CHANGELOG names the vulnerable files. Deprecating is one command per package but requires npm credentials, so it is an owner action: `npm deprecate @beyondnet/evolith-mcp@1.1.0 "Security fixes in 1.2.0 — see CHANGELOG"`, likewise for `evolith-cli@1.1.0` and `evolith-agent-runtime@1.1.0`. **(b) No release gate fails when a security-tagged commit is absent from the published tag.** That absence is exactly what let the wave sit unpublished from 2026-07-23 to 2026-07-27 while `SECURITY.md` declared the 1.1.x line "actively patched". Nothing detected it; an audit did. Related: `GT-623` — release-please derives version bumps from commit messages, and the `security(...)` type used by 2 of the last 60 commits is not a Conventional Commits type, so it contributes nothing to a bump. Both defects let a security change fail to reach a version, by different routes.
+- **Component:** `Infra` · **Criticality:** P1 · **Complexity:** S
+- **Provenance:** Carved out of GT-570 on 2026-07-27 as it closed. Two of its three original criteria were not met by shipping 1.2.0; they are recorded here rather than assumed.
+- **Acceptance criteria:**
+  - [ ] `npm view @beyondnet/evolith-mcp@1.1.0` reports the version as deprecated, likewise cli and agent-runtime.
+  - [ ] A CI gate fails when a commit whose type or scope marks it as security is absent from the latest published tag.
+  - [ ] The gate ships with a negative fixture that turns it red, so it is not another guard nobody has seen fail.