Sentinel Shield v2.2.0 — Engine-Only Feature Release

Sentinel Shield v2.2.0 — Engine-Only Feature Release

Sentinel Shield v2.2.0 is an engine-only feature release. It extends the engine from a
security/release-gate baseline into a broader engineering-governance baseline, adding
three additive, evidence-based gate families and folding in ten batches of full-repo review
fixes since v2.0.1.

Framework-validated release and full-platform GA are not claimed by this release. Laravel and
Symfony live-consumer validation remain out of scope.

Release source

• Engine commit (CI-proven): 99fcd2767560b257344211aae57e027ea39a5304
• Scope: engine-only, stage ga
• Tag target: the CI-proven engine commit (source == release)
• Baseline: v2.0.1 (engine commit 32812ed43289104af61b0eb2fc20c784ca2b72c1).

What's new since v2.0.1

Engineering-governance gate families (all additive; existing mode defaults unchanged)

• Testing-discipline governance — TDD evidence proxies (production-change-without-test-change,
  changed-line coverage, missing/empty test evidence), BDD executable-specification evidence, and
  ATDD acceptance evidence. New gates production_change_without_test_change,
  missing_test_change_evidence, missing_behavior_specification, orphan_behavior_specifications,
  acceptance_test_failures, missing_acceptance_evidence; new runners/collectors
  (test-change-evidence, behat, acceptance producers). Application profiles only for BDD/ATDD;
  libraries are never forced to carry them.
• Engineering-quality gates — coverage threshold/regression, mutation score, complexity,
  duplication, dead-code, and missing_coverage_evidence. Producer-emitted metrics only.
• Architecture governance v2 — normalized, multi-language architecture evidence (Deptrac for PHP;
  dependency-cruiser / ESLint boundaries for JS/TS; custom producers), gated by
  missing_architecture_evidence.

Hardening and correctness (full-repo review, 10 batches)

• Collectors fail closed on malformed/unknown-shape input (emit execution-error, never a
  fake-clean pass) with integer-count guards across the collector family.
• Runners honour the honest-absent contract — no fabricated reports; stale reports cleared up
  front so a prior run is never consumed as current evidence.
• DAST — committed-allowlist enforcement + tool-wiring integrity guard; bounded main
  tool-execution path (no unbounded runner hangs).
• Supply-chain / CI — verified acquisition on by default; mutable scanner-image warnings;
  restored the staging DAST reference workflow with skip-when-unconfigured semantics.
• Documentation-accuracy, reference-integrity, and gate-correctness fixes throughout.

See CHANGELOG.md (the [2.2.0] section) for the complete, itemised list.

Default-branch CI evidence (event=push, branch=master, head=99fcd2767560b257344211aae57e027ea39a5304)

All required release workflows completed successfully at the release source:

Workflow	Run ID
ci-self-test	30097790574
ci-pipeline	30097790636
ci-security	30097790702
ci-workflow-lint	30097790641
ci-adopter-validation	30097790545
ci-compatibility	30097790551
ci-production-readiness	30097790592

Upgrade

v2.2.0 is backward-compatible with v2.0.1: no stable CLI, exit code, env var, or schema was
renamed or removed. A project that upgrades and changes nothing sees no new blocking gate — the new
gate families are off by default in existing modes. To adopt them, opt in via mode (strict /
regulated) or gates.fail_on.

Scope statement

Allowed: engine-only feature release. Not claimed: framework-validated, full-platform GA,
Laravel validated, Symfony validated.

Sentinel Shield v2.0.1 — Engine-Only Maintenance Release

Sentinel Shield v2.0.1 — Engine-Only Maintenance Release

Sentinel Shield v2.0.1 is an engine-only maintenance release.

It refreshes post-v2.0.0 release evidence after documentation reconciliation
and workflow-action maintenance. Laravel and Symfony live-consumer validation
remain out of scope.

Framework-validated release and full-platform GA are not claimed by this release.

Release source

• Engine commit (CI-proven): 32812ed43289104af61b0eb2fc20c784ca2b72c1
• Scope: engine-only, stage ga
• Tag target: engine commit (source == release; the tag targets the CI-proven engine commit)
• Baseline: v2.0.0 (engine commit 13be630a64d044e0ffca8850e3424c2f0799aebf).

What changed since v2.0.0

No executable engine change. The diff from the v2.0.0 evidence merge
(c9013b5e81d1c10534230fc0aef10c52439951f4) to this release source is limited to:

• Documentation reconciliation (PR #37): CHANGELOG.md, README.md,
  docs/product-status.md, docs/support-policy.md.
• Workflow-action maintenance (SHA-pinned Dependabot upgrades, CI infrastructure only):
  • actions/upload-artifact 4.6.2 → 7.0.1 (PR #6)
  • actions/checkout 4.2.2 → 7.0.0 (PR #7)
  • actions/setup-node 4.4.0 → 6.4.0 (PR #8)
  • github/codeql-action/autobuild 3.36.2 → 4.36.2 (PR #34)
  • actions/download-artifact 4.3.0 → 8.0.1 (PR #35)

No scripts/, schemas/, config/, profiles/, or tests/ runtime change.

Default-branch CI evidence (event=push, branch=master, head=32812ed)

All required release workflows completed successfully at the release source:

Workflow	Run ID
ci-self-test	29042343620
ci-pipeline	29042343666
ci-security	29042343578
ci-workflow-lint	29042343707
ci-adopter-validation	29042343550
ci-compatibility	29042343592
ci-production-readiness	29042343552

(Also green on the source: ci-php 29042343595, ci-node 29042343633,
ci-docker 29042343569, ci-codeql 29042343619, security-incident-validation 29042343629.)

What was validated

• Static/lint: sh -n, shellcheck -S error, actionlint, zizmor — all clean.
• Artifacts: 16 CI artifacts downloaded, digest-verified, owned, unexpired (0 failures).
• Release manifest: reproducible; self-consistency verified (body sha256 8b7079a9…).
• Security posture: live ci-security acceptance — decision accepted, 0 blocking
  findings, 0 violations.
• Compatibility: matrix complete, bound to 32812ed; nothing missing.
• Adopter usability: scorecard pass, 7 offline sessions.
• Lifecycle: upgrade validation (2.0.0 → 2.0.1) pass; rollback validation pass
  (0 failures each), both bound to 32812ed.

Validation terminology (used precisely)

• engine-tested
• standalone-consumer-tested
• black-box-adopter-harness-tested

This release does not claim production-adopted, framework-validated, or
full-platform-ready.

Known limitations

See docs/v2.0.1-known-limitations.md.

Sentinel Shield v2.0.0 — Engine-Only Production Release

Sentinel Shield v2.0.0 — Engine-Only Production Release

Sentinel Shield v2.0.0 is an engine-only production release.

The Sentinel Shield engine, installer, recovery system, security controls,
release-governance tooling, PHP-library consumer harnesses, Node/React
consumer harnesses, and black-box adopter validation have passed the
published engine-only production gates.

Laravel and Symfony profiles have not been independently validated in
live consumer repositories. Framework-validated release and full-platform
GA are not claimed by this release.

Release source

• Engine commit (CI-proven): 13be630a64d044e0ffca8850e3424c2f0799aebf
• Scope: engine-only, stage ga
• Tag target: engine commit (source == release; the tag targets the CI-proven engine commit)
• v2.0.0-rc.1 was published 2026-07-08 from the same engine commit; the RC→GA source is
  unchanged (evidence/docs metadata only). See known-limitations for the soak waiver.

Default-branch CI evidence (event=push, branch=master, head=13be630)

All required release workflows completed successfully at the release source:

Workflow	Run ID
ci-self-test	28827885695
ci-pipeline	28827885654
ci-security	28827885649
ci-workflow-lint	28827885684
ci-adopter-validation	28827885656
ci-compatibility	28827885655
ci-production-readiness	28827885648

(Also green on the source: ci-php, ci-node, ci-docker, ci-codeql,
security-incident-validation.)

What was validated

• Static/lint: sh -n, shellcheck -S error, actionlint, zizmor — all clean.
• Self-test: full all suite exit 0; production-readiness group PASS.
• Artifacts: 16 CI artifacts downloaded, digest-verified, owned, unexpired (0 failures).
• Release manifest: reproducible; self-consistency verified (body sha256 b6b3d543…).
• Security posture: live ci-security acceptance — decision accepted, 0 critical,
  0 high, 0 blocking findings, 0 violations.
• Compatibility: matrix complete; covered os, arch, shell, git, jq; nothing missing.
• Adopter usability: scorecard pass, 7 offline sessions, all 8 blocking criteria pass.
• Lifecycle: upgrade validation pass; rollback validation pass (0 failures each).

Validation terminology (used precisely)

• engine-tested
• standalone-consumer-tested
• black-box-adopter-harness-tested

This release does not claim production-adopted, framework-validated, or
full-platform-ready.

Known limitations

See docs/v2.0.0-known-limitations.md.

Sentinel Shield v2.0.0-rc.1 — Engine-Only Release Candidate

Sentinel Shield v2.0.0-rc.1 — Engine-Only Release Candidate

Sentinel Shield v2.0.0-rc.1 is an engine-only release candidate.

The Sentinel Shield engine, installation and recovery system, security
controls, release-governance tooling, PHP-library consumers, Node/React
consumers, and black-box adopter harness have been validated according
to the published engine-only RC criteria.

Laravel and Symfony profiles have not been independently validated in
live consumer repositories. Framework-validated RC and full-platform GA
are not claimed by this release.

Release source

• Engine commit (CI-proven): fd3501b2718f8cef898bc7b8516c438502465b46
• Tree: dc31ac8e767480febbd521bf438040a0d9e88bdd
• Scope: engine-only
• Tag target: engine commit (source == release; the tag targets the CI-proven engine commit itself)

Default-branch CI evidence (event=push, branch=master, head=fd3501b)

All required release workflows completed successfully at the release source:

Workflow	Run ID
ci-self-test	28743340042
ci-pipeline	28743340046
ci-security	28743340067
ci-workflow-lint	28743340004
ci-adopter-validation	28743340013
ci-compatibility	28743340070
ci-production-readiness	28743340018

(Also green on the source: ci-php 28743340039, ci-node 28743339999, ci-docker 28743340006,
ci-codeql 28743340010, security-incident-validation 28743340020.)

What was validated

• Static/lint: sh -n, shellcheck -S error, actionlint, zizmor — all clean.
• Self-test: syntax PASS, production-readiness PASS (48/48 suites), full all suite.
• Artifacts: 14 CI artifacts downloaded, digest-verified, owned, unexpired.
• Release manifest: reproducible; self-consistency + reconstruction verified.
• Security posture: CI-built security summary — 0 critical, 0 high, 0 secrets, 1 medium,
  no blocking categories; the production security-acceptance engine is proven fail-closed
  (tests/prod/261-production-security.sh, blocking in ci-security).
• Operational health: health.sh proven healthy on a clean adoption fixture; offline-safe
  (network probe skipped unless --check-network).

Validation terminology (used precisely)

• engine-tested
• standalone-consumer-tested
• black-box-adopter-harness-tested

This release does not claim production-adopted, framework-validated, or
full-platform-ready.

Known limitations

See docs/v2.0.0-rc.1-known-limitations.md.

Sentinel Shield v2.0.0-beta.1 — Engine-only Beta

⚠️ Engine-only beta — read before adopting

Sentinel Shield v2.0.0-beta.1 is an engine-only beta release.

This release validates the Sentinel Shield policy engine, release gates, transactional installation and recovery model, workflow security controls, deterministic profile fixtures, and GitHub-verified engine CI.

Laravel and Symfony profiles are engine-tested and fixture-tested, but they were not independently validated in real consumer repositories for this release.

This release does not claim framework-validated, release-candidate, or general-availability readiness. The stable, supported line remains v1.x (latest v1.9.2). Adopt this beta for the engine itself — not for a production Laravel or Symfony application.

Under the engine-only release scope the evidence proves the reusable engine via its own default-branch CI (GitHub-verified), not any framework in a real adopter repository. required_evidence.laravel and required_evidence.symfony remain false, consumer_runs is empty, and the release validator prints FRAMEWORK LIVE-VALIDATION NOT INCLUDED.

What this release validates

• Profile-policy resolution and effective-profile composition
• Required / recommended / optional / one-of gate semantics and fail-closed enforcement
• Local pipeline orchestration and stale-report protection
• Source-acquisition safety and path-safety guards
• Transactional install / sync / migration with fail-closed recovery
• Release-evidence validation (structural + GitHub-verified)
• Engine GitHub Actions workflows, workflow pinning, and security linting
• Deterministic fixture validation

Deferred (not in this release)

• Real Laravel consumer CI
• Real Symfony consumer CI
• Independent production-project adoption proof
• External maintainer usability proof

Promotion to framework-validated or full-platform scope in a later cycle would require the corresponding real-consumer live-validation evidence.

Release evidence

• Machine-readable release evidence — evidence/releases/v2.0.0-beta.1.json
• GitHub-verified engine CI evidence — docs/v2-merge-commit-ci-evidence.md
• v2 release scope (engine-only) — docs/v2-release-scope.md
• Release notes — docs/v2.0.0-release-notes.md

Verify locally: sh scripts/validate-release-evidence.sh --verify-github

Migration documentation

• v1 → v2 Migration Guide — docs/v2-migration-guide.md
• Profile tool-policy contract — docs/profile-tool-policy.md

Engine-only scope details

• Release scope: engine-only
• Engine commit: becec20ed3890032d722a6118deee4a2314d39e9 (PR #11 merge)
• Engine CI: GitHub-verified ci-self-test + ci-pipeline (and supporting workflows) green on master at the engine commit

v1.9.2

Patch: audit-github-actions-pins.sh now matches uses:/image:/container: only as YAML keys, not substrings — fixes a false positive on run: shell blocks that mention those words (e.g. a grep pattern), which failed the unsafe_github_actions gate on projects with no actual unpinned ref. Adds a regression test to self-test.sh. (PR #2)