The anything-analyzer start path backgrounds `nohup pnpm dev`. On Ubuntu CI
that never invoked the pnpm stub, so the source-pin regression missed the
argv. Intercept nohup like sudo, and fall back to a plain background when
nohup is absent.
After Kali detection stopped using grep, Ubuntu CI reached python install
and called apt-get, which the macOS-oriented fixture never stubbed. Detect
Kali with builtins only, and accept brew or apt-get as the python sink.
is_kali called grep on every Linux run, so the PATH-stripped parser-bootstrap
regression aborted before the pin gate. Detect Kali from os-release with tr,
and write Unix stubs as LF/UTF-8 so Linux pwsh can execute them.
Windows CI failed because smoke.ps1 nested bare 'powershell' (often 5.1)
to run verify-routing-coherence.ps1. PS5.1 mis-parsed UTF-8 Chinese source
without BOM, so nested verify exited 1 while the standalone pwsh verify step passed.
- Resolve SmokeHostExe from current process (pwsh on GHA windows-latest)
- Rewrite nested invocations to use $SmokeHostExe
- Write UTF-8 BOM on smoke.ps1 and verify-routing-coherence.ps1 for PS5.1 safety
- radare2/ida-reverse/malware-analysis: MUST record imports as Evidence before next phase
- re-agent-workflow: triage gate blocks Dynamic without imports summary
- RULES (+zh) and agent-obedience: redo named step X, no substitute
- Merge duplicated Added/Fixed/Security sections and sort per the
Keep a Changelog convention: Added > Removed > Fixed > Security
- Pure reorder: all 39 entries preserved, verified before/after
- VERSION 1.0.1 still matches the newest release heading
- Evidence chain table gains severity/status columns plus a worked example
- Add contract-alignment block: E-xxx heading rule, severity/status
vocabularies, repro_command requirement, content_hash/artifact_path,
linked_workitem, and the --verify-hashes --strict self-check command
- Keeps Scope/Evidence/Finding headings so verify-routing-coherence
Assert-Fields stays green
- New verify-doc-facts.ps1: checks RULES.md / RULES_zh.md / skills/SKILL.md
capability lists (24), MCP servicePort/servicePortRange values, and the
Burp tool count against bootstrap-manifest.json and getToolList() source
- ci.yml: run it in the routing-tests matrix (pwsh)
- Local run: 16 checks all pass
- Refactor examples/ctf-demo to satisfy the review_case.py contract:
split evidence/E-001-E-003.md into per-record E-001/E-002/E-003.md
with ### E-xxx headings and severity/status/repro_command fields
- Add evidence/checksec-output.txt artifact with matching content_hash so
--verify-hashes has a real object to verify
- Convert report.md finding/path sections to structured F-01/P-01 blocks
- New case-contract CI job runs review_case.py --verify-hashes --strict on
examples/ctf-demo; local result: PASS (0 errors, 0 warnings)
- New skills/scripts/scan-leaks.ps1: PSParser-free regex scanner for
public IPv4 (RFC1918/link-local/CGNAT/doc ranges excluded), email
(sample domains allowed), CN mobile, JWT, AWS AKIA, OpenAI sk-/sk-proj-,
GitHub/npm/Slack tokens, Google API keys, Stripe live keys
- Exit 1 on findings (CI gate); -ReportOnly for local preview
- Baseline clean: 41 field-journal files, 0 findings
- New leak-scan CI job runs the scanner on skills/field-journal
- anonymization.md now references the shipped script
- New step in sh-syntax job runs [Parser]::ParseFile over all tracked
.ps1 files (no execution, syntax-only); fails the build on any parse
error with file/line/column annotations
- Baselines clean locally: 24 tracked .ps1 files, 0 parse errors
- Closes the gap where Windows was the primary platform but only .sh
scripts had a CI syntax check
- VERSION was bumped to 1.1.0 at the v1.0.1 release commit but no 1.1.0
release exists; align to 1.0.1 so VERSION == latest CHANGELOG release
- Add version-check job to ci.yml (VERSION must match latest CHANGELOG [x.y.z])
- Add docs/RELEASE-CHECKLIST.md for release + metadata sync steps
- Fix benchmark case count in CHANGELOG: 162 -> 163 (routing-benchmark.json
actually contains 163 cases; ci.yml was already correct)
Atirna