- radare2/ida-reverse/malware-analysis: MUST record imports as Evidence before next phase
- re-agent-workflow: triage gate blocks Dynamic without imports summary
- RULES (+zh) and agent-obedience: redo named step X, no substitute
- Merge duplicated Added/Fixed/Security sections and sort per the
Keep a Changelog convention: Added > Removed > Fixed > Security
- Pure reorder: all 39 entries preserved, verified before/after
- VERSION 1.0.1 still matches the newest release heading
- Evidence chain table gains severity/status columns plus a worked example
- Add contract-alignment block: E-xxx heading rule, severity/status
vocabularies, repro_command requirement, content_hash/artifact_path,
linked_workitem, and the --verify-hashes --strict self-check command
- Keeps Scope/Evidence/Finding headings so verify-routing-coherence
Assert-Fields stays green
- New verify-doc-facts.ps1: checks RULES.md / RULES_zh.md / skills/SKILL.md
capability lists (24), MCP servicePort/servicePortRange values, and the
Burp tool count against bootstrap-manifest.json and getToolList() source
- ci.yml: run it in the routing-tests matrix (pwsh)
- Local run: 16 checks all pass
- Refactor examples/ctf-demo to satisfy the review_case.py contract:
split evidence/E-001-E-003.md into per-record E-001/E-002/E-003.md
with ### E-xxx headings and severity/status/repro_command fields
- Add evidence/checksec-output.txt artifact with matching content_hash so
--verify-hashes has a real object to verify
- Convert report.md finding/path sections to structured F-01/P-01 blocks
- New case-contract CI job runs review_case.py --verify-hashes --strict on
examples/ctf-demo; local result: PASS (0 errors, 0 warnings)
- New skills/scripts/scan-leaks.ps1: PSParser-free regex scanner for
public IPv4 (RFC1918/link-local/CGNAT/doc ranges excluded), email
(sample domains allowed), CN mobile, JWT, AWS AKIA, OpenAI sk-/sk-proj-,
GitHub/npm/Slack tokens, Google API keys, Stripe live keys
- Exit 1 on findings (CI gate); -ReportOnly for local preview
- Baseline clean: 41 field-journal files, 0 findings
- New leak-scan CI job runs the scanner on skills/field-journal
- anonymization.md now references the shipped script
- New step in sh-syntax job runs [Parser]::ParseFile over all tracked
.ps1 files (no execution, syntax-only); fails the build on any parse
error with file/line/column annotations
- Baselines clean locally: 24 tracked .ps1 files, 0 parse errors
- Closes the gap where Windows was the primary platform but only .sh
scripts had a CI syntax check
- VERSION was bumped to 1.1.0 at the v1.0.1 release commit but no 1.1.0
release exists; align to 1.0.1 so VERSION == latest CHANGELOG release
- Add version-check job to ci.yml (VERSION must match latest CHANGELOG [x.y.z])
- Add docs/RELEASE-CHECKLIST.md for release + metadata sync steps
- Fix benchmark case count in CHANGELOG: 162 -> 163 (routing-benchmark.json
actually contains 163 cases; ci.yml was already correct)
yhc