STE-Code REPOSITORY v1.3.0

STE-Code REPOSITORY v1.3.0

Tag family. REPOSITORY-v1.3.0 versions the repository - .agents/, the
root tooling, and the Makefile. It does not version the STE-Code standard.
STANDARD-1.1.0 remains the version of the standard and is unchanged by this
release. No STANDARD-* or FLAVOR-* tag is moved or created here.

Scope of this release. The range holds 69 commits, of which nine are the
security-audit work. The large diff below is dominated by a repo-wide
formatter and line-ending normalisation pass, not by security hardening -
the 594-file figure describes the whole range, not the audit.

Headline stats (all at 6dc5e4e)

Metric	Value
Tag	REPOSITORY-v1.3.0
Range	REPOSITORY-v1.2.0..HEAD
Base commit	0c510d3
Tip commit	6dc5e4e
Wall-clock span	~13h 21m, same day
Commits in range	69 (68 non-merge + 1 merge)
Files changed (release range)	594
Insertions / deletions	+35,530 / −14,791
Dominant contributor to that diff	repo-wide prettier/Markdown reformat + .gitattributes LF pass
Security-audit commits within the range	9
Benchmark self-test	181 → 202 checks (+21 capsule checks)
make check at HEAD	202/202, all policies pass (dev, user, bench)
New NETWORK_COMMANDS entries	9
Fuzz corpus seed	DEFAULT_FUZZ_SEED = 7
Absolute machine paths in skill front matter	0 (was 22 - closes a v1.2.0 OPEN item)
Standard version	STANDARD-1.1.0 unchanged

Test counts and policy results are facts at HEAD, not range measurements.
Every other row is measured across the release range.

This is a repository release

REPOSITORY v1.3.0 is a maintenance and hardening release for the machinery that
builds, tests, and confines STE-Code work. It does not change the STE-Code
standard.

The release does four things:

1. it closes a set of jail and benchmark audit findings;
2. it introduces a formatting toolchain and applies it across the repository;
3. it grows the hook suite and adds a confined child launcher for benchmark
   work;
4. it closes one release-hygiene item carried over from v1.2.0, and records one
   that regressed.

Most of the commits in the range belong to items 2 and 3. Most of the risk
reduction belongs to item 1.

Security audit

Nine commits in the range are audit work: e731f5b, 05400b5, c4f5767,
678cd39, b8cfa8d, 5338c46, 07b5561, 509f85d, 6dc5e4e.

I1 - the jail fails closed

e731f5b makes the jail plugin refuse rather than pass when it cannot judge a
call. _build_chain() now tracks missing components, and a hook-to-component
map lets a refusal name the component that failed to load. If the plugin cannot
load its chain, register still registers - but it registers a refusal hook
that blocks every tool call. Both failure paths are closed: a jail that cannot
judge a call refuses it. Guarded by 6/6 fail-closed checks in the jail suite.

B3 - new escalation tools are denied by default

678cd39 replaces a hardcoded bench deny list with a subtraction:

BENCH_ALLOWED_ESCALATION_TOOLS = frozenset({"delegate_task", "cronjob"})
denied_tools = NETWORK_TOOLS + [
    t for t in ESCALATION_TOOLS if t not in BENCH_ALLOWED_ESCALATION_TOOLS
]

The effective set is byte-equivalent to the previous one. The value is
anti-fail-open behaviour for future additions: a newly added escalation tool
is denied in the bench policy unless it is explicitly allowed. Guarded by 6/6
bench-escalation checks.

Attribution note. 678cd39 carries this code. Its sibling b8cfa8d has a
commit message describing the same change but a diff that does not contain it;
the two branches were developed in parallel and reconciled by a merge. Cite
678cd39 for B3.

B2 - modern package runners are blocked

07b5561 adds nine entries to NETWORK_COMMANDS: nix, guix, pipx, uvx,
uv, poetry, npx, bunx, deno. Matching is per command word, so
pnpm dlx and cargo install are already covered by the existing pnpm and
cargo denials. Guarded by 27/27 package-runner checks.

C2′ - the fuzz corpus is reproducible

509f85d gives the corpus generator DEFAULT_FUZZ_SEED = 7, threaded through
the generator constructor, its run loop, and the CLI. The previous behaviour
seeded from OS entropy, which made a corpus impossible to reproduce. The
effective seed is now written into the corpus header record, so a corpus states
the seed that produced it. Guarded by 4/4 fuzz-determinism checks.

C4′ - the capsule scheduler is tested

6dc5e4e adds capsule-scheduler tests to the benchmark self-test: missing
dependencies, escape-set scoping, a capsule with no sees, a capsule whose
dependency has no escapes on disk, multi-document YAML, and malformed YAML. The
self-test goes from 181 to 202 checks; the 21 new checks cover the
capsule scheduler.

The self-test counts in this note are measured at the tip, not taken from commit
messages: four commits in this range assert "make check 180/180", but the value
immediately before the capsule commit was 181.

D4 - the hook directory repairs itself safely

05400b5 gives link-hooks.sh classification predicates and a prune step.
--force never blind-deletes: it removes an entry only when that entry is
positively classified as disposable - a retired hook, a symlink into the
canonical source, or a stale copy of a canonical hook. When checksum comparison
cannot classify an entry, the script refuses instead of guessing.

Vocabulary scripts - a bug fix as well as a privacy fix

5338c46 replaces a hardcoded absolute JSON path in four vocabulary scripts
with a path derived from the script's own location. The commit's own message
records that the hardcoded path did not exist in this checkout, so those
scripts were provably non-functional before the fix, not merely leaking a local
path. This is a bug fix and a privacy fix, not path hygiene.

Test results

Suite / group	Result
make check total	202/202
Benchmark self-test	202/202 (was 181)
I1 fail-closed	6/6
B3 bench escalation	6/6
B2 package runners	27/27
C2′ fuzz determinism	4/4
Policy suite	dev, user, bench - all pass

The jail-suite groups are reported per group by the jail tests. They are not a
subset of the 202 and must not be added to it.

Tooling and formatting

The largest share of the range is a formatting programme, not a feature.

• A prettier-based format toolchain lands under .agents/format/: Format.sh,
  Markdown.py, prettier.config.js, .prettierignore, and .editorconfig.
• A repo-wide Markdown structural reformat pass (051788a) runs across
  ste-code/ and .agents/.
• .gitattributes enforces LF line endings (11e62a2).

This is what produces the headline diff. Files across .agents/benchmark/
show near-symmetric insert/delete profiles characteristic of reflowing rather
than of behaviour change - a documentation or configuration file that reports
several hundred changed lines with no functional delta is a formatting
signature.

The 594-file, +35,530 / −14,791 diff describes the whole range, whose majority is
the formatter and LF pass; the audit is nine commits inside that range, and its
diffs are small and targeted.

ste-code/ is touched in this range, unlike in v1.2.0 where it was near-zero.
The changes appear under ste-code/grouped/, ste-code/linguistics/, and
ste-code/templates/, and are consistent with the formatter pass. This note
does not repeat v1.2.0's claim that no artifact tier was rebuilt:
ste-code/artifacts/ was not measured separately for this release, so that
claim is not carried forward.

Hooks and confinement

• The hook suite grows: memory anonymisation, command scrubbing, shared hook
  helpers, prompt context, post-edit format QA, and a self-QA check, together
  with the link-hooks.sh and install.sh wiring described under D4.
• A confined child launcher for benchmark work lands alongside the benchmark
  runner and its lockdown documentation.
• Privacy-scrub jail plugins, a skills reorganisation, and memory and USER
  document rewrites round the programme out.

Narrow the confinement claim. The jail suite verifies that the covered
write-confinement escape cases are blocked. It does not make the shared write
gate universal - direct write calls outside the shared funnel remain, and that
v1.2.0 item is still open.

Release hygiene

One v1.2.0 open item closes in this range, and one regresses.

• Absolute machine paths in skill front matter - RESOLVED. The count goes
  from 22 to 0. Skill source: front matter no longer carries machine-local
  absolute paths, so a fresh clone reads the same values as the authoring
  machine.
• Commit hygiene - REGRESSED. The range introduces 1f7ea33 with an empty
  commit subject and ae5bbef with the subject "save". f3b8a3d packs four
  unrelated changes into one subject line. This is the exact changelog-generation
  hazard v1.2.0 flagged as open; it is worse in this range, not better.

Commit messages in this range are also unreliable as a source of numbers: four
of them assert a stale self-test count, and two carry a message that does not
match their diff, so the numbers here are measured from the tree rather than quoted
from the commit log.

Contradictions resolved (repository view)

Item	Status	Evidence
Jail passes calls it cannot judge	RESOLVED	e731f5b - refusal hook on load failure; 6/6 fail-closed checks
New escalation tools silently allowed	RESOLVED	678cd39 - deny by subtraction from ESCALATION_TOOLS; 6/6 checks
Modern package runners reach the network	RESOLVED	07b5561 - 9 new NETWORK_COMMANDS entries; 27/27 checks
Fuzz corpus not reproducible	RESOLVED	509f85d - DEFAULT_FUZZ_SEED = 7, seed in corpus header; 4/4 checks
Capsule scheduler untested	RESOLVED	6dc5e4e - self-test 181 → 202, +21 capsule checks
Hook directory pruned unsafely	RESOLVED	05400b5 - classified prune, refuses when it cannot classify
Vocabulary scripts broken and path-leaking	RESOLVED	5338c46 - path derived from the script location; path did not exist
Absolute paths in skill front matter (22)	RESOLVED	count is now 0
Write gate not universal	OPEN	direct write calls outside the shared funnel remain
Live scored benchmark run	OPEN	no scored artifact is published in this range
Merge re-introducing a lump commit	OPEN	the range adds one more merge
Empty-subject / non-conventional commits	OPEN, WORSE	1f7ea33 (empty), ae5bbef ("save"), f3b8a3d (four changes)

Not changed in this release

• The STE-Code standard. STANDARD-1.1.0 is unchanged, and no STANDARD-* or
  FLAVOR-* tag is created or moved.
• CITATION.cff's description of the ASD-STE100 source standard. Its
  fifty-three rules and nineteen technical-noun categories describe the source
  standard, alongside STE-Code's own 54 code-domain rules and 22 categories in
  the same sentence. Both figures are correct as written and were deliberately
  left alone.
• The benchmark's outstanding claims. A live, scored, end-to-end benchmark run
  is still not demonstrated.

Migration notes

After cloning or updating:

make skills-link
make skills-check
make check

make check reports 202/202 at this tip and runs the policy suite for the dev,
user, and bench profiles. The formatting toolchain under .agents/format/ is
the canonical formatter for the repository; run it before committing Markdown so
a later reformat pass does not swamp a feature diff again.

Version boundary

• REPOSITORY-v1.3.0 versions repository infrastructure, tooling, hooks, and
  the jail and benchmark machinery.
• STANDARD-1.1.0 remains the version of the STE-Code standard, unchanged by
  this release.
• The release range is REPOSITORY-v1.2.0..HEAD, base 0c510d3, tip 6dc5e4e,
  69 commits, linear first-parent ancestry, with no tag falling inside it.