Sentinel Shield v2.2.0 — Engine-Only Feature Release

Sentinel Shield v2.2.0 — Engine-Only Feature Release

Sentinel Shield v2.2.0 is an engine-only feature release. It extends the engine from a
security/release-gate baseline into a broader engineering-governance baseline, adding
three additive, evidence-based gate families and folding in ten batches of full-repo review
fixes since v2.0.1.

Framework-validated release and full-platform GA are not claimed by this release. Laravel and
Symfony live-consumer validation remain out of scope.

Release source

• Engine commit (CI-proven): 99fcd2767560b257344211aae57e027ea39a5304
• Scope: engine-only, stage ga
• Tag target: the CI-proven engine commit (source == release)
• Baseline: v2.0.1 (engine commit 32812ed43289104af61b0eb2fc20c784ca2b72c1).

What's new since v2.0.1

Engineering-governance gate families (all additive; existing mode defaults unchanged)

• Testing-discipline governance — TDD evidence proxies (production-change-without-test-change,
  changed-line coverage, missing/empty test evidence), BDD executable-specification evidence, and
  ATDD acceptance evidence. New gates production_change_without_test_change,
  missing_test_change_evidence, missing_behavior_specification, orphan_behavior_specifications,
  acceptance_test_failures, missing_acceptance_evidence; new runners/collectors
  (test-change-evidence, behat, acceptance producers). Application profiles only for BDD/ATDD;
  libraries are never forced to carry them.
• Engineering-quality gates — coverage threshold/regression, mutation score, complexity,
  duplication, dead-code, and missing_coverage_evidence. Producer-emitted metrics only.
• Architecture governance v2 — normalized, multi-language architecture evidence (Deptrac for PHP;
  dependency-cruiser / ESLint boundaries for JS/TS; custom producers), gated by
  missing_architecture_evidence.

Hardening and correctness (full-repo review, 10 batches)

• Collectors fail closed on malformed/unknown-shape input (emit execution-error, never a
  fake-clean pass) with integer-count guards across the collector family.
• Runners honour the honest-absent contract — no fabricated reports; stale reports cleared up
  front so a prior run is never consumed as current evidence.
• DAST — committed-allowlist enforcement + tool-wiring integrity guard; bounded main
  tool-execution path (no unbounded runner hangs).
• Supply-chain / CI — verified acquisition on by default; mutable scanner-image warnings;
  restored the staging DAST reference workflow with skip-when-unconfigured semantics.
• Documentation-accuracy, reference-integrity, and gate-correctness fixes throughout.

See CHANGELOG.md (the [2.2.0] section) for the complete, itemised list.

Default-branch CI evidence (event=push, branch=master, head=99fcd2767560b257344211aae57e027ea39a5304)

All required release workflows completed successfully at the release source:

Workflow	Run ID
ci-self-test	30097790574
ci-pipeline	30097790636
ci-security	30097790702
ci-workflow-lint	30097790641
ci-adopter-validation	30097790545
ci-compatibility	30097790551
ci-production-readiness	30097790592

Upgrade

v2.2.0 is backward-compatible with v2.0.1: no stable CLI, exit code, env var, or schema was
renamed or removed. A project that upgrades and changes nothing sees no new blocking gate — the new
gate families are off by default in existing modes. To adopt them, opt in via mode (strict /
regulated) or gates.fail_on.

Scope statement

Allowed: engine-only feature release. Not claimed: framework-validated, full-platform GA,
Laravel validated, Symfony validated.