ShipProof v0.9.0

ShipProof v0.9.0 — Evidence Contracts and Analyzer Correctness

ShipProof v0.9.0 is the reviewed release after the post-v0.8.1 correctness audit. It keeps the default workflow offline, read-only, deterministic, and dependency-free while tightening evidence contracts and reducing analyzer false positives.

Highlights

• Cross-file analysis now uses the same changed-file, include, exclude, and byte limits as the regular scanner.
• JavaScript and TypeScript cross-file analysis masks comments and string-only text, rejects ambiguous cross-language/simple-name resolution, and transfers taint state in statement order.
• Git-history scanning is bounded, fail-closed, provenance-preserving, baseline-aware, and invokes Git with external diff/text conversion disabled.
• Scan JSON schemas cover real findings, fix scaffolds, cross-file statistics, and history provenance.
• Supply-chain detectors are scoped to their owning manifests and canonical Dockerfile/Containerfile names.
• The packed consumer smoke test is isolated from repository development dependencies; experimental IR stubs and the comparison harness remain development-only.
• Node, Python, plugin, lockfile, citation, README, and research metadata report the same version and rule count.

Stability boundary

check, scan, explain, gate, init, config validate, doctor, and mcp are the supported public commands. labs remains experimental and never supplies production proof. The legacy aliases remain warning-only until the planned 1.0 cleanup.

scan --history reports only bounded added patch lines. It does not prove credential rotation, deletion from every clone, or live credential validity; pair it with a dedicated history and rotation workflow.

Verification

The release must pass npm run check, the direct high-gate self-scan, real-output schema validation, cross-file changed-scope regressions, history integration tests, isolated packed-artifact smoke tests, and benchmark thresholds before the immutable v0.9.0 tag is created.