feat: ship deterministic SAST control plane and provider release readiness - #2

Merged

junit merged 163 commits into

mainfrom

Aug 4, 2026

Commits on Jul 20, 2026

feat: add controlled static analysis workflow
wifibaby4u
committed
1585def

Commits on Jul 25, 2026

docs: design Rust multi-analyzer orchestration
wifibaby4u
committed
3b642c0
docs: refine Rust static analysis roadmap
wifibaby4u
committed
d8162fc
docs: plan Rust static analysis deliveries
wifibaby4u
committed
c29d44a
refactor: expose Rust review library
wifibaby4u
committed
b1e6a63
refactor: extract authoritative review scope
wifibaby4u
committed
7de51db
feat: add Rust static analysis contracts
wifibaby4u
committed
2b590b9
feat: port static evidence parsing to Rust
wifibaby4u
committed
6d0faf2
feat: map Rust static evidence to review scope
wifibaby4u
committed
69f1adc
feat: build tracked candidate snapshots in Rust
wifibaby4u
committed
8336f2c
feat: execute authorized analyzers in Rust
wifibaby4u
committed
9011132
feat: emit Rust controlled analysis artifacts
wifibaby4u
committed
4f63e10
test: gate Rust static analysis parity
wifibaby4u
committed
c5789e4
feat: switch static analysis wrappers to Rust
wifibaby4u
committed
b397e14
build: package Rust static analysis binary
wifibaby4u
committed
5775d0b
refactor: remove Python static analysis runtime
wifibaby4u
committed
41cae8a
fix: stabilize analyzer path rejection
wifibaby4u
committed
e58b36d

Commits on Jul 26, 2026

feat: define static analysis orchestration contracts
wifibaby4u
committed
115e9e7
feat: preflight analyzer manifests
wifibaby4u
committed
abbe926
feat: share one analyzer snapshot
wifibaby4u
committed
0ec5e6e
feat: enforce orchestration budgets
wifibaby4u
committed
fa9c6d4
feat: schedule analyzers serially
wifibaby4u
committed
6a70a6d
fix: start analyzer timeout after spawn
wifibaby4u
committed
1aa0088
feat: union analyzer evidence independently
wifibaby4u
committed
c067c07
feat: expose static analysis orchestration
wifibaby4u
committed
715cef8
docs: integrate static analysis orchestration
wifibaby4u
committed
7aaaaf7
build: package static analysis orchestration
wifibaby4u
committed
3df4025
docs: design repository impact context
wifibaby4u
committed
fc01338
chore: ignore local worktrees
wifibaby4u
committed
4de2341
build: pin rust syntax parser dependencies
wifibaby4u
committed
b140d41
feat: add exact candidate content access
wifibaby4u
committed
28890f4
refactor: share candidate snapshot infrastructure
wifibaby4u
committed
37b4de8
feat: define impact context contracts
wifibaby4u
committed
f51d500
feat: add bounded impact context budgets
wifibaby4u
committed
93e9ab6
feat: extract rust syntax facts
wifibaby4u
committed
8648b64
feat: add bounded text context facts
wifibaby4u
committed
a003bd6
feat: normalize structural impact context
wifibaby4u
committed
9ef4b5a
feat: assemble fast impact context
wifibaby4u
committed
4606695
feat: expose fast repository impact context
wifibaby4u
committed
5cdd940
test: add impact context shadow metrics
wifibaby4u
committed
e656db7
feat: cut over to impact context contract
wifibaby4u
committed
46d8548
test: harden fast structural context
wifibaby4u
committed
5399242
build: distribute repository context cli
wifibaby4u
committed
723b44f
fix: harden structural context review findings
wifibaby4u
committed
33a1cbc
test: isolate unavailable sanitizer scenario
wifibaby4u
committed
a839e9c
feat: complete SAST release readiness
wifibaby4u
committed
8b1e7e3

Commits on Jul 27, 2026

build: add isolated sqlite storage spike
wifibaby4u
committed
113f558
chore: satisfy Rust 1.95 clippy
wifibaby4u
committed
6e3d746
test: define sqlite generation spike
wifibaby4u
committed
a2087a5
feat: prove immutable sqlite publication
wifibaby4u
committed
88c9053
test: harden sqlite crash and concurrency behavior
wifibaby4u
committed
4182e19
perf: measure sqlite graph generation
wifibaby4u
committed
c6c4ea4
ci: gate bundled sqlite storage spike
wifibaby4u
committed
ed3d530
ci: allow spike-only release validation
wifibaby4u
committed
019c58c
docs: record sqlite storage spike decision
wifibaby4u
committed
4939329
feat: define persistent index contracts
wifibaby4u
committed
cea24e6
feat: add exact repository manifests
wifibaby4u
committed
4419649
feat: extract full-file rust facts
wifibaby4u
committed
ae3fe7a
feat: persist content-addressed file facts
wifibaby4u
committed
4d98050
feat: add passive rust project model
wifibaby4u
committed
17ad74b
feat: resolve rust repository relationships
wifibaby4u
committed
f000938
feat: persist immutable repository graphs
wifibaby4u
committed
6b95e1b
feat: read immutable repository graphs
wifibaby4u
committed
11034f1
feat: overlay exact candidate graph changes
wifibaby4u
committed
40b8eb3
feat: traverse repository impact graph
wifibaby4u
committed
0aca3d1
feat: add repository graph impact context
wifibaby4u
committed
ec06d80
feat: add repository index operations
wifibaby4u
committed
ef3e166
feat: expose repository index workflow
wifibaby4u
committed
9d381b2
test: gate persistent repository indexing
wifibaby4u
committed
cac585f
fix: preserve repository index report structure
wifibaby4u
committed
93e212d
docs: document persistent repository indexing
wifibaby4u
committed
cd55a91
test: normalize repository index fixtures
wifibaby4u
committed
18e8793

Commits on Jul 28, 2026

fix(index): validate cached graph generations deeply
wifibaby4u
committed
e1710c9
feat(index): reuse immutable graphs in fast mode
wifibaby4u
committed
81f3103
fix: invalidate repository cache on scope drift
wifibaby4u
committed
b7c1736
fix(index): refresh reverse dependents in fast overlays
wifibaby4u
committed
d15a1e0
fix(index): bound repository cache cleanup
wifibaby4u
committed
eb510c3
test(index): exercise arbitrary repository graphs and SQLite scale
wifibaby4u
committed
854ddda
fix(index): sanitize repository stderr before fallback
wifibaby4u
committed
377b9bc
docs: define rust-analyzer context provider
wifibaby4u
committed
42cfd8e
docs: tighten rust-analyzer provider contract
wifibaby4u
committed
503f0f5
docs: plan rust-analyzer provider implementation
wifibaby4u
committed
a36cb31
feat(provider): define bound context contracts
wifibaby4u
committed
7b581a9
fix(provider): pin report and request kind
wifibaby4u
committed
fc9ef12
feat(provider): enforce snapshot and model identity
wifibaby4u
committed
b00af16
feat(provider): map bounded file URIs and ranges
wifibaby4u
committed
d5d3383
feat(provider): bound LSP framing and correlation
wifibaby4u
committed
bd6b593
refactor(runtime): share pinned managed child
wifibaby4u
committed
4a2d397
feat(provider): manage bounded LSP sessions
wifibaby4u
committed
854c129
feat(provider): gate linked-project rust-analyzer sessions
wifibaby4u
committed
33fc758
feat(provider): traverse bounded semantic call hierarchy
wifibaby4u
committed
87225df
feat(provider): finalize bound context runner
wifibaby4u
committed
16f7905
test(provider): gate bounded context provider
wifibaby4u
committed
069e364

Commits on Jul 29, 2026

docs: mark static analysis orchestration complete
wifibaby4u
committed
f210fa0
docs: design rust-analyzer provider CLI
wifibaby4u
committed
79cccd4
docs: plan rust-analyzer provider CLI
wifibaby4u
committed
6907f4c
feat(provider): define explicit CLI contracts
wifibaby4u
committed
b442412
feat(provider): build linked models from snapshots
wifibaby4u
committed
7fc6be4
feat(provider): expose explicit model CLI
wifibaby4u
committed
c76a7d3
feat(provider): run explicit registry entries
wifibaby4u
committed
ebde664
feat(provider): add explicit CLI wrapper
wifibaby4u
committed
88d91b9
build(provider): package explicit CLI
wifibaby4u
committed
988d2f0
docs(provider): document explicit CLI boundary
wifibaby4u
committed
e8284d1
docs(provider): design artifact distribution
wifibaby4u
committed
3a4601f
docs(provider): plan artifact distribution and release readiness
wifibaby4u
committed
925bba9
feat(artifacts): define third-party pack contracts
wifibaby4u
committed
9081e3b
feat(artifacts): verify normalized packs safely
wifibaby4u
committed
317b7c2
feat(artifacts): add bounded cache and target receipts
wifibaby4u
committed
6a82ac9
feat(artifacts): expose verify provision and doctor
wifibaby4u
committed
13805f1
feat(gitleaks): use the artifact manager
wifibaby4u
committed
189e805
build(release): add deterministic artifact pack builder
wifibaby4u
committed
936fcd3
build(release): publish platform core and Gitleaks packs
wifibaby4u
committed
06ac75c
fix(release): close artifact pack review gaps
wifibaby4u
committed
0720ddb
feat(install): make artifact provisioning transactional
wifibaby4u
committed
92f7a6c
ci(release): verify artifact trust and revocations
wifibaby4u
committed
071bf5d

Commits on Jul 30, 2026

test(artifacts): close Gitleaks distribution gates
wifibaby4u
committed
720ed47
feat(provider): lock rust-analyzer release inputs
wifibaby4u
committed
1ff28b2
build(provider): publish attested rust-analyzer packs
wifibaby4u
committed
d15b5ba
build(provider): gate reviewed manifest updates
wifibaby4u
committed
a55bbf1
feat(install): add explicit rust-analyzer provisioning
wifibaby4u
committed
84c734d
feat(provider): generate bound profile and registry
wifibaby4u
committed
f0c2700
feat(provider): enforce sampled process-tree memory
wifibaby4u
committed
fdbdb45
docs(provider): adapt release readiness for local delivery
wifibaby4u
committed
4b77af0
Revert "docs(provider): adapt release readiness for local delivery"
wifibaby4u
committed
2e70d1c
docs(provider): define exact release tag bootstrap
wifibaby4u
committed
72632b7
ci(provider): allow exact pack release tag
wifibaby4u
committed
3519b44
docs(provider): define immutable GNU Linux retry
wifibaby4u
committed
71b06ed
fix(provider): use glibc-compatible linux pack
wifibaby4u
committed
b35e01b
fix(provider): tighten linux host contracts
wifibaby4u
committed
0f2179c
docs(provider): define exact version probe retry
wifibaby4u
committed
dd67269
fix(provider): bind exact linux version output
wifibaby4u
committed
a177d5d
fix(provider): bind release inputs to exact tag
wifibaby4u
committed
8278f4c
fix(provider): restrict publish input to dispatch
wifibaby4u
committed
c1ec955

Commits on Jul 31, 2026

test(provider): add real rust-analyzer fixtures
wifibaby4u
committed
b0df6e2
test(provider): add isolated baseline measurement harness
wifibaby4u
committed
14b36e6

Commits on Aug 1, 2026

ci(provider): gate real servers fuzz and release trust
wifibaby4u
committed
b81eb5c

Commits on Aug 2, 2026

fix(artifacts): bound trusted runtime stack use
wifibaby4u
committed
0b39b67
docs(artifacts): record Windows stack remediation plan
wifibaby4u
committed
2ab28b8
fix(provider): make hosted gates platform-safe
wifibaby4u
committed
3461dd4
fix(provider): complete hosted measurement target contract
wifibaby4u
committed
e039e5d
fix(provider): close hosted Windows and baseline gates
wifibaby4u
committed
1af2529
fix(provider): stabilize hosted measurement execution
wifibaby4u
committed
f8b547a
chore(provider): trace hosted seed matching
wifibaby4u
committed
e884192
chore(provider): enable hosted seed trace
wifibaby4u
committed
51ae9ba
chore(provider): report hosted seed mismatch
wifibaby4u
committed
b0e29ba
fix(provider): retry transient empty call hierarchy seeds
wifibaby4u
committed
9bb9ae2
test(provider): expose Windows LSP root identity drift
wifibaby4u
committed
490ebf7
fix(provider): normalize linked project root paths
wifibaby4u
committed
4fd8111
fix(provider): normalize Windows snapshot URI paths
wifibaby4u
committed
04fab86
fix(provider): bind Windows hosted image identity
wifibaby4u
committed
b779cbd

Commits on Aug 3, 2026

fix(provider): compare hosted Git path identity
wifibaby4u
committed
53a583a
test(provider): establish pack-versioned latency baselines
wifibaby4u
committed
3a42ce6
docs(provider): record release readiness boundaries
wifibaby4u
committed
d6479aa
test(repository): isolate output limit from fast deadline
wifibaby4u
committed
c04579a
test(provider): emit malformed frame without handshake
wifibaby4u
committed
9a17b52
fix: harden release and provider test contracts
wifibaby4u
committed
159ce07
fix(provider): stabilize release gates
wifibaby4u
committed
4148b3e
fix(ci): stabilize cross-platform release gates
wifibaby4u
committed
671647e

Commits on Aug 4, 2026

test(provider): construct explicit file URI authority
wifibaby4u
committed
c13e733
test(static): use platform absolute profile paths
wifibaby4u
committed
3635213
fix(test): stabilize provider and fuzz gate timing
wifibaby4u
committed
3dc65cd
fix(ci): pin integration schema validator
wifibaby4u
committed
e6c7ca1
test(provider): synchronize postflight cancellation
wifibaby4u
committed
b99b9de