v9.4.0 — capability-scoped detection + documentation false-positive hardening

Additive minor. v9.4.0 sharpens detection so governed documentation workflows stop tripping execution-oriented detectors, while keeping every real attack governed. Execution-class detectors (SQL injection, dangerous commands) now skip tools whose input is prose rather than executable statements, the loose-verb and comment-based SQL-injection detectors are hardened against documentation text, and several fixes close a self-blocking override path, an empty signed decision chain, a response-plane fail-open on a policy-load error, and portal display and fresh-deploy issues. Three idempotent migrations (core/135, core/138, core/139) auto-apply on deploy.

Added

• Capability-scoped policy evaluation. (Community) Execution-class detectors (SQL injection and dangerous-command families) no longer evaluate tools positively classified as text-document tools (documentation editors whose input is prose, not executable statements), so legitimate documentation edits are no longer blocked as though they were code or SQL. Classification happens server-side against a built-in registry and is never taken from an untrusted caller; unknown or unclassified tools get full evaluation (fail-closed), and content-borne families (all PII, sensitive-data, compliance, and prompt-injection guards) evaluate everywhere, including for text-document tools. The AXONFLOW_CAPABILITY_SCOPING_DISABLED kill switch restores full evaluation on every tool in both editions. Enterprise deployments can extend the built-in registry with additional tool names via AXONFLOW_TEXT_DOCUMENT_TOOLS.
• Per-category detection corpus gate. (Community) A labeled per-category detection corpus (attack and benign cases) now scores recall on attacks and false-positive rate on benign input in CI, so a change that raises false positives or weakens recall on a governed category fails the build.

Fixed

• Documentation text no longer trips the loose-verb, agent-config, and IP detectors. (Community) Several false-positive-prone detectors matched plain English and Markdown as though it were executable input. The SQL-injection detectors for authentication bypass and for GRANT / REVOKE / DROP / CREATE USER now require SQL grammar (a quote or paren breakout, or a privilege-and-object clause) instead of a bare English verb; the dynamic-code-execution detector requires call syntax so a hyphenated identifier no longer matches; the agent-config-file detector requires a write or execute context rather than a filename mentioned in prose; and RFC-special and documentation IP ranges (for example the 0.0.0.0/0 allow-all shorthand in a hardening note) are no longer flagged as a person's address. Each replacement pattern is narrower than the one it replaces, so real attacks stay governed, proven by a paired attack corpus.
• Comment-out SQL-injection authentication bypass is now detected. (Community) The classic comment-out bypass (a string-literal terminator followed by a SQL line comment that comments out the rest of a WHERE clause, for example admin' --) passed clean through every governed input plane, because the existing comment detectors required a SQL keyword after the comment. A new detector matches a breakout string terminator directly followed by a line comment that ends the line, gated so ordinary quoted arguments and documentation prose (a balanced quoted token, or a comment carrying trailing text) do not match.
• Override justification no longer blocks its own override request. (Community) A policy-override request whose justification quoted the very content it was overriding was blocked by that justification, making some overrides impossible to submit. The override metadata is now exempt from content evaluation on the governance override tool only; the same content in the override's target scope, or on any other tool, is still evaluated normally.
• Response-plane now fails closed on a policy-load error. (Community) When the policy engine could not load its policies while processing a response, the response plane failed open and let the content through. It now fails closed on a policy-load error, matching the request plane.
• Signed decision chain is no longer silently empty. (Community) The non-repudiation decision chain stored no rows at all: the parent request identifier was written through a failing type cast, so every chain-record insert failed (silently, since the write is best-effort). The cast is fixed, so signed decision chains now persist and capture their parent references.
• Portal fixes: in-VPC deployment mode, policy count, synthetic-identity affordance, and more. (Enterprise) A sweep of customer-portal fixes: the portal now honors the in-VPC enterprise deployment mode, the dashboard shows the unified total policy count rather than the dynamic-only count, the audit Log Explorer gains a synthetic-identity affordance, and a further set of display and data-loading issues across the portal are resolved.

Migration

• core/135 (Community): hardens the false-positive-prone SQL-injection and dangerous-command detector patterns (pattern-row updates via a new migration; shipped migrations stay immutable). Each update is guarded on the original seeded pattern, so a tenant-customized row is never clobbered. Auto-applies on deploy.
• core/138 (Enterprise): re-applies the v9 org_id and row-level-security completion for enterprise tables created by later-numbered migrations (SSO and connector-config tables), which on a fresh enterprise deploy came up without org_id or their RLS policies, and additionally allows redact as an override action. Every step is guarded and idempotent: it is a no-op on upgraded deploys where the tables already carried the columns, and on community deploys where the tables do not exist. Auto-applies on deploy.
• core/139 (Community): seeds the comment-out SQL-injection detector row (security-sqli, warn base action). Idempotent insert; auto-applies on deploy.

---

Full docs: https://docs.getaxonflow.com/docs/releases/v9-4-0