ShipProof v0.7.0

ShipProof v0.7.0 — Contract Hardening, Evidence-Gated Rules, and Explainable Decisions

ShipProof v0.7.0 hardens the production gate around trustworthy command contracts, low-noise detection, release safety, and inspectable evidence. The executable scanner now contains 571 rules; the much larger research catalogs remain explicitly non-executable until their positive, negative, and adversarial fixtures meet the promotion policy.

Highlights

• Fail-closed contracts: init now generates a policy that immediately round-trips through check; missing or invalid targets, negative cost inputs, unsafe policy paths, unavailable analyzers, stale Action reports, and mismatched release tags return the documented evidence-unavailable exit.
• Scanner correctness and precision: previously unreachable file types are scanned, bounded multiline rules operate on structural context, changed-file discovery supports Unicode and repository subdirectories, secret renderers do not rehydrate credentials, and autofix success requires a clean verification scan.
• Evidence-gated detector growth: eleven promoted cloud, Kubernetes, CI/CD, security, and supply-chain detectors include stable IDs, official-source grounding, CWE/control mappings, remediation, false-positive analysis, and positive/negative/adversarial fixtures.
• Research without noisy bulk activation: 7,800 deduplicated candidate records cover 2021–2026 incident signals and language-specific security, reliability, performance, and scale risks. These records are prioritization inputs, not scanner findings.
• Simpler public CLI: stable workflows center on check, scan, and explain; deterministic primitives live under gate, heuristic analyzers under labs, configuration can be validated without running gates, and the unverifiable static badge command is retired.
• Progressive context and decision trace: explain and AI fix prompts support summary, overview, and full detail. Repository scans can opt into a deterministic, content-free --trace that reports selection, filtering, suppression, and gate counts without source, paths, secrets, timings, telemetry, or network calls.
• Release and package assurance: command outputs are checked against versioned schemas, MCP tools are handshake-tested with strict schemas, SARIF remains available after a blocking scan, the package file set and size are allowlisted, and the packed artifact is smoke-tested as a real consumer install.
• Project maturity: the English and Thai READMEs now state the trust boundary, evidence levels, supported ecosystems, limitations, governance, citation, contribution, conduct, security, and release policies in a consistent public contract.

Compatibility

• Node.js 20 or newer for the CLI and adapters.
• Python 3.10 or newer for scanning and Python-backed gates.
• Policy version 1 and evidence schema version 1.0 remain compatible.
• full remains the default context level, so existing explanation and fix-prompt workflows retain their detailed behavior.
• Exit codes remain 0 for pass, 1 for a measured gate failure, and 2 for invalid or unavailable evidence.

Verification

The release commit must pass npm run check, packed-artifact smoke testing, and a direct repository self-scan at the high threshold before the exact v0.7.0 tag is created.