|
|
|
|
@@ -61,6 +61,14 @@ As of 2026-05-13:
|
|
|
|
|
and added prioritized corpus accuracy recommendations to failed corpus gates,
|
|
|
|
|
mapping misses by category, missing rule, and config ID so enterprise
|
|
|
|
|
scanner-regression work has an actionable improvement plan.
|
|
|
|
|
- AgentShield PR #81 merged as `6583884e74ba2e896942113e1ce3146230e6fb76`
|
|
|
|
|
and added ordered remediation workflow phases to remediation plans, routing
|
|
|
|
|
safe auto-fixes, manual review, and verification through stable finding
|
|
|
|
|
fingerprints without copying raw evidence.
|
|
|
|
|
- AgentShield PR #82 merged as `51336ba074ad5e9fed2c0aa3237422be22147e76`
|
|
|
|
|
and expanded the built-in attack corpus with an env proxy hijack scenario
|
|
|
|
|
covering proxy/runtime mutation, env-token exfiltration, DNS exfiltration,
|
|
|
|
|
credential-store access, and clipboard access.
|
|
|
|
|
- JARVIS PR #13 merged as `127efabbfb5033ae53d7a53e1546aa3c33d6f962`
|
|
|
|
|
and hardened CI/deploy workflows with npm registry signature verification,
|
|
|
|
|
disabled persisted checkout credentials in write-permission jobs, and pinned
|
|
|
|
|
@@ -72,6 +80,48 @@ As of 2026-05-13:
|
|
|
|
|
and made `/ecc-tools followups sync-linear` track copy-ready PR drafts in
|
|
|
|
|
the Linear/project backlog when `open-pr-drafts` is not used, preserving
|
|
|
|
|
useful stale-PR salvage work without opening extra PR shells.
|
|
|
|
|
- ECC-Tools PR #55 merged as `5d8c112cce4794cfa089d5b0ea661ba87a178be1`
|
|
|
|
|
and added analysis-depth readiness to `/ecc-tools analyze` comments,
|
|
|
|
|
separating commit-history-only repos from evidence-backed and deep-ready repos
|
|
|
|
|
using CI/CD, security, harness, reference/eval, AI routing/cost-control, and
|
|
|
|
|
team handoff evidence.
|
|
|
|
|
- ECC-Tools PR #56 merged as `5b729c88641eafe80f65364bab3fc74d0270f57b`
|
|
|
|
|
and added the authenticated `/api/analysis/depth-plan` contract that maps
|
|
|
|
|
analysis-depth readiness into concrete hosted jobs for CI diagnostics,
|
|
|
|
|
security evidence review, harness compatibility, reference-set evaluation,
|
|
|
|
|
AI routing/cost review, and team backlog routing.
|
|
|
|
|
- ECC-Tools PR #57 merged as `4cc61112a4cc9feec7b07af09321f360e34af6a4`
|
|
|
|
|
and added the first executable hosted analysis job:
|
|
|
|
|
`/api/analysis/jobs/ci-diagnostics` now gates on CI/CD readiness, inspects
|
|
|
|
|
workflow/test-runner/failure-evidence artifacts, returns CI hardening
|
|
|
|
|
findings and next actions, and charges usage only after successful execution.
|
|
|
|
|
- ECC-Tools PR #58 merged as `ce09dd8d9b46f65c6b88dc4f48cfb6b6227ae0bf`
|
|
|
|
|
and added the second executable hosted analysis job:
|
|
|
|
|
`/api/analysis/jobs/security-evidence-review` now gates on security-evidence
|
|
|
|
|
readiness, inspects capped AgentShield evidence-pack, policy, baseline,
|
|
|
|
|
SBOM, SARIF, and security-scan artifacts, returns supply-chain evidence
|
|
|
|
|
findings and next actions, and charges usage only after successful execution.
|
|
|
|
|
- ECC-Tools PR #59 merged as `505b372dbd8f75f996d9e2ed079effd30cec5ba5`
|
|
|
|
|
and added the third executable hosted analysis job:
|
|
|
|
|
`/api/analysis/jobs/harness-compatibility-audit` now gates on harness-config
|
|
|
|
|
readiness, inspects capped Claude, Codex, OpenCode, MCP, plugin, and
|
|
|
|
|
cross-harness documentation artifacts, excludes local secret-bearing config
|
|
|
|
|
paths from fetches, returns portability findings and next actions, and
|
|
|
|
|
charges usage only after successful execution.
|
|
|
|
|
- ECC-Tools PR #60 merged as `b75e0a49ba5672b1ec9a2a4880ddcfa2d07dc557`
|
|
|
|
|
and added the fourth executable hosted analysis job:
|
|
|
|
|
`/api/analysis/jobs/reference-set-evaluation` now gates on reference-evidence
|
|
|
|
|
readiness, evaluates analyzer corpus, RAG/evaluator, PR salvage/review,
|
|
|
|
|
harness, security, and CI failure-mode evidence, excludes obvious
|
|
|
|
|
secret-bearing fixture paths from fetches, returns reference coverage
|
|
|
|
|
findings and next actions, and charges usage only after successful execution.
|
|
|
|
|
- ECC-Tools PR #61 merged as `7b01b67cae0b80774b311cb515b7eca0aa038c65`
|
|
|
|
|
and added the fifth executable hosted analysis job:
|
|
|
|
|
`/api/analysis/jobs/ai-routing-cost-review` now gates on AI routing/cost
|
|
|
|
|
readiness, evaluates model routing, token budget, usage-limit, rate-limit,
|
|
|
|
|
billing/entitlement, cost-regression, and cost-policy evidence, excludes
|
|
|
|
|
obvious secret-bearing paths from fetches, returns cost-control findings and
|
|
|
|
|
next actions, and charges usage only after successful execution.
|
|
|
|
|
- Handoff `ecc-supply-chain-audit-20260513-0645.md` under
|
|
|
|
|
`~/.cluster-swarm/handoffs/`
|
|
|
|
|
records the May 13 supply-chain sweep: no active lockfile/manifest hit for
|
|
|
|
|
@@ -255,6 +305,36 @@ As of 2026-05-13:
|
|
|
|
|
artifact contract so canonical bundle files now satisfy the taxonomy and
|
|
|
|
|
generated follow-up PRs point maintainers at
|
|
|
|
|
`agentshield scan --evidence-pack <dir>`.
|
|
|
|
|
- ECC-Tools PR #55 added the first hosted/deeper-analysis readiness signal:
|
|
|
|
|
analysis comments now classify a repo as commit-history-only,
|
|
|
|
|
evidence-backed, or deep-ready before routing work into CI, AgentShield,
|
|
|
|
|
harness, reference-set, RAG/evaluator, AI-routing, cost-control, and
|
|
|
|
|
Linear/project-tracking lanes.
|
|
|
|
|
- ECC-Tools PR #56 turned that signal into a hosted execution-plan contract:
|
|
|
|
|
`/api/analysis/depth-plan` returns ready/blocked jobs and next action text
|
|
|
|
|
without charging analysis usage or creating bundle PRs.
|
|
|
|
|
- ECC-Tools PR #57 implemented the first job-specific hosted executor:
|
|
|
|
|
`/api/analysis/jobs/ci-diagnostics` reuses the depth-readiness gate, internal
|
|
|
|
|
API auth, installation ownership, repo-access billing checks, capped workflow
|
|
|
|
|
file reads, and usage accounting to return concrete CI hardening findings.
|
|
|
|
|
- ECC-Tools PR #58 implemented the second job-specific hosted executor:
|
|
|
|
|
`/api/analysis/jobs/security-evidence-review` applies the same hosted gates
|
|
|
|
|
to AgentShield evidence-pack, policy, baseline, SBOM, SARIF, and security
|
|
|
|
|
scanner artifacts.
|
|
|
|
|
- ECC-Tools PR #59 implemented the third job-specific hosted executor:
|
|
|
|
|
`/api/analysis/jobs/harness-compatibility-audit` applies the same hosted
|
|
|
|
|
gates to Claude, Codex, OpenCode, MCP, plugin, and cross-harness evidence
|
|
|
|
|
while avoiding local secret-bearing harness config fetches.
|
|
|
|
|
- ECC-Tools PR #60 implemented the fourth job-specific hosted executor:
|
|
|
|
|
`/api/analysis/jobs/reference-set-evaluation` applies the same hosted gates
|
|
|
|
|
to analyzer corpus, RAG/evaluator, PR salvage, harness, security, and CI
|
|
|
|
|
failure-mode reference evidence while avoiding obvious secret-bearing fixture
|
|
|
|
|
fetches.
|
|
|
|
|
- ECC-Tools PR #61 implemented the fifth job-specific hosted executor:
|
|
|
|
|
`/api/analysis/jobs/ai-routing-cost-review` applies the same hosted gates to
|
|
|
|
|
model-routing, token-budget, usage-limit, rate-limit, billing/entitlement,
|
|
|
|
|
cost-regression, and cost-policy evidence while avoiding obvious
|
|
|
|
|
secret-bearing path fetches.
|
|
|
|
|
- ECC PR #1803 landed the contributor Quarkus handling branch after maintainer
|
|
|
|
|
cleanup, current-`main` alignment, full local validation, and preservation of
|
|
|
|
|
the author's removal of incomplete ja-JP and zh-CN Quarkus translations.
|
|
|
|
|
@@ -307,11 +387,11 @@ is not complete unless the evidence column exists and has been freshly verified.
|
|
|
|
|
| Naming and rename readiness | Naming matrix across package/plugin/docs/social surfaces | `docs/releases/2.0.0-rc.1/naming-and-publication-matrix.md` records current package, repo, Claude plugin, Codex plugin, OpenCode, and npm availability evidence | Complete for rc.1; post-rc rename remains future work |
|
|
|
|
|
| Claude and Codex plugin publication | Contact/submission path with required artifacts and status | Publication readiness, naming matrix, and May 12 dry-run evidence document plugin validation, clean-checkout Claude tag/install smoke, and Codex marketplace CLI shape | Needs explicit approval for real tag/push and marketplace submission |
|
|
|
|
|
| Articles, tweets, and announcements | X thread, LinkedIn copy, GitHub release copy, push checklist | Draft launch collateral exists under rc.1 release docs | Needs URL-backed refresh |
|
|
|
|
|
| AgentShield enterprise iteration | Policy gates, SARIF, packs, provenance, corpus, HTML reports, exception lifecycle audit, baseline drift Action/CLI surfaces, evidence-pack redaction, harness adapter registry, enterprise research roadmap, supply-chain hardened release path, CI-safe baseline fingerprints, corpus accuracy recommendations | PRs #53, #55-#64, #67-#69, and #78-#80 landed with test evidence; native PDF export deferred in favor of self-contained HTML plus print-to-PDF until explicit enterprise demand appears; `docs/architecture/agentshield-enterprise-research-roadmap.md` now has baseline drift, evidence-pack bundle, redaction, adapter-registry, supply-chain hardening, hashed baseline fingerprints, and corpus accuracy recommendation slices landed | Next remediation workflow depth or corpus expansion |
|
|
|
|
|
| ECC Tools next-level app | Billing audit, PR checks, deep analyzer, sync backlog, evaluator/RAG corpus | PRs #26-#43 plus #53/#54 landed with test evidence, including AgentShield evidence-pack gap routing, canonical bundle recognition, supply-chain signature gates, and PR draft follow-up Linear tracking | Needs hosted/deeper analysis follow-up |
|
|
|
|
|
| AgentShield enterprise iteration | Policy gates, SARIF, packs, provenance, corpus, HTML reports, exception lifecycle audit, baseline drift Action/CLI surfaces, evidence-pack redaction, harness adapter registry, enterprise research roadmap, supply-chain hardened release path, CI-safe baseline fingerprints, corpus accuracy recommendations, remediation workflow phases, env proxy hijack corpus coverage | PRs #53, #55-#64, #67-#69, and #78-#82 landed with test evidence; native PDF export deferred in favor of self-contained HTML plus print-to-PDF until explicit enterprise demand appears; `docs/architecture/agentshield-enterprise-research-roadmap.md` now has baseline drift, evidence-pack bundle, redaction, adapter-registry, supply-chain hardening, hashed baseline fingerprints, corpus accuracy recommendation, remediation workflow, and env proxy hijack corpus slices landed | Next hosted evidence-pack workflow depth |
|
|
|
|
|
| ECC Tools next-level app | Billing audit, PR checks, deep analyzer, sync backlog, evaluator/RAG corpus, analysis-depth readiness, hosted execution planning, hosted CI diagnostics, hosted security evidence review, hosted harness compatibility audit, hosted reference-set evaluation, hosted AI routing/cost review | PRs #26-#43 plus #53-#61 landed with test evidence, including AgentShield evidence-pack gap routing, canonical bundle recognition, supply-chain signature gates, PR draft follow-up Linear tracking, evidence-backed/deep-ready repository classification, the `/api/analysis/depth-plan` hosted job plan, `/api/analysis/jobs/ci-diagnostics`, `/api/analysis/jobs/security-evidence-review`, `/api/analysis/jobs/harness-compatibility-audit`, `/api/analysis/jobs/reference-set-evaluation`, and `/api/analysis/jobs/ai-routing-cost-review` | Needs the remaining hosted worker executor for team backlog routing |
|
|
|
|
|
| GitGuardian/Dependabot/CodeRabbit-style checks | Non-blocking taxonomy, deterministic follow-up checks, and local supply-chain gates | ECC-Tools risk taxonomy check plus follow-up signals landed, including Skill Quality, Deep Analyzer Evidence, Analyzer Corpus Evidence, RAG/Evaluator Evidence, PR Review/Salvage Evidence, and AgentShield evidence-pack evidence; #1846 added npm registry signature gates; #1848 added the supply-chain incident-response playbook and `pull_request_target` cache-poisoning validator guard; #1851 added the privileged checkout credential-persistence guard; AgentShield #78, JARVIS #13, and ECC-Tools #53 applied the same hardening outside trunk | Current supply-chain gate complete; deeper hosted review features remain future |
|
|
|
|
|
| Harness-agnostic learning system | Audit, adapter matrix, observability, traces, promotion loop | Audit/adapters/observability gates plus `docs/architecture/evaluator-rag-prototype.md`, `examples/evaluator-rag-prototype/`, and ECC-Tools PR #40 define read-only stale-salvage, billing-readiness, CI-failure-diagnosis, harness-config-quality, AgentShield policy-exception, skill-quality evidence, deep-analyzer evidence, and RAG/evaluator comparison scenarios with trace, report, playbook, verifier, and predictive-check artifacts | Local corpus complete; hosted integration remains future |
|
|
|
|
|
| Linear roadmap is detailed | Linear project status plus repo mirror | Repo mirror exists; issue creation was retried on 2026-05-12 and remains blocked by the workspace free issue limit; this May 13 sync adds ECC #1860, AgentShield #78/#79, JARVIS #13, ECC-Tools #53/#54, resolved queue/discussion counts, and Linear project status updates `59f630eb`/`c7ea6daf` | Needs recurring status updates after each merge batch |
|
|
|
|
|
| Linear roadmap is detailed | Linear project status plus repo mirror | Repo mirror exists; issue creation was retried on 2026-05-12 and remains blocked by the workspace free issue limit; this May 13 sync adds ECC #1860, AgentShield #78-#82, JARVIS #13, ECC-Tools #53-#61, resolved queue/discussion counts, and Linear project status updates through ECC-Tools #61 | Needs recurring status updates after each merge batch |
|
|
|
|
|
| Flow separation and progress tracking | Flow lanes with owner artifacts and update cadence | This roadmap defines lanes below and `docs/architecture/progress-sync-contract.md` makes GitHub/Linear/handoff/roadmap sync part of the readiness gate | Active |
|
|
|
|
|
| Realtime Linear sync | Project updates while issue limit is blocked; issues later | ECC-Tools #39 implements opt-in Linear API sync for deferred follow-up backlog items, and ECC-Tools #54 adds copy-ready PR drafts to that backlog when draft PR shells are not opened; `docs/architecture/progress-sync-contract.md` defines the local file-backed realtime boundary while issue capacity is blocked | Needs workspace capacity/config rollout |
|
|
|
|
|
| Observability for self-use | Local readiness gate, traces, status snapshots, HUD/status contract, risk ledger, progress-sync contract | `npm run observability:ready` reports 21/21 | Complete for local gate |
|
|
|
|
|
@@ -332,7 +412,7 @@ repo evidence and merge commits.
|
|
|
|
|
| Harness OS core | Audit, adapter matrix, observability docs, `ecc2/` | HUD/session-control acceptance spec | Weekly until GA |
|
|
|
|
|
| Evaluation and RAG | Reference-set validation, harness audit, traces, ECC-Tools corpus | Read-only evaluator/RAG prototype plus stale-salvage, billing-readiness, CI-failure-diagnosis, harness-config-quality, AgentShield policy-exception, skill-quality evidence, deep-analyzer evidence, and RAG/evaluator comparison fixtures | Hosted retrieval/check-run automation plan |
|
|
|
|
|
| AgentShield enterprise | AgentShield PR evidence and roadmap notes | Remediation workflow depth or corpus expansion follow-up | Next implementation batch |
|
|
|
|
|
| ECC Tools app | ECC-Tools PR evidence, billing audit, risk taxonomy, evaluator/RAG corpus | ECC-Tools #53 published the supply-chain workflow hardening branch and #54 tracks copy-ready PR drafts in the Linear/project backlog; next work is hosted/deeper analysis follow-up | Next implementation batch |
|
|
|
|
|
| ECC Tools app | ECC-Tools PR evidence, billing audit, risk taxonomy, evaluator/RAG corpus | ECC-Tools #53 published the supply-chain workflow hardening branch, #54 tracks copy-ready PR drafts in the Linear/project backlog, #55 classifies analysis-depth readiness, #56 exposes the hosted execution plan, #57 executes the first hosted CI diagnostics job, #58 executes the hosted security evidence review job, #59 executes the hosted harness compatibility audit, #60 executes the hosted reference-set evaluation, and #61 executes the hosted AI routing/cost review; next work is the team backlog routing executor | Next implementation batch |
|
|
|
|
|
| Linear progress | Linear project status updates, `docs/architecture/progress-sync-contract.md`, and this mirror | Status update with queue/evidence/missing gates | Every significant merge batch |
|
|
|
|
|
|
|
|
|
|
The project status update should always include:
|
|
|
|
|
@@ -545,13 +625,14 @@ Acceptance:
|
|
|
|
|
supply-chain incident class; PR #79 moved baseline/watch/remediation
|
|
|
|
|
fingerprints to hashed evidence and stopped writing raw evidence into new
|
|
|
|
|
baselines; PR #80 added prioritized corpus accuracy recommendations for
|
|
|
|
|
failed regression gates; and ECC-Tools PRs #42/#43 now route and recognize
|
|
|
|
|
evidence packs. The next slice is remediation workflow depth or corpus
|
|
|
|
|
expansion.
|
|
|
|
|
2. Keep ECC-Tools #53's supply-chain workflow gate and #54's PR-draft backlog
|
|
|
|
|
tracking in the recurring queue evidence, and use the org-scoped GitHub auth
|
|
|
|
|
path for future ECC-Tools maintenance while the narrow environment token
|
|
|
|
|
remains active.
|
|
|
|
|
failed regression gates; PR #81 added ordered remediation workflow phases;
|
|
|
|
|
PR #82 expanded corpus coverage for env proxy hijacks and out-of-band
|
|
|
|
|
exfiltration; and ECC-Tools PRs #42/#43 now route and recognize evidence
|
|
|
|
|
packs. The next slice is hosted evidence-pack workflow depth.
|
|
|
|
|
2. Extend the ECC-Tools hosted execution lane beyond #57's CI diagnostics,
|
|
|
|
|
#58's security evidence review, #59's harness compatibility audit, and
|
|
|
|
|
#60's reference-set evaluation, and #61's AI routing/cost review into the
|
|
|
|
|
remaining depth-plan job: team backlog routing.
|
|
|
|
|
3. Enable/configure the merged Linear backlog sync path after workspace issue
|
|
|
|
|
capacity clears or the Linear workspace is upgraded, then verify PR-draft
|
|
|
|
|
salvage items land in the expected project.
|
|
|
|
|
|
