v1.50.0
secure-code-auditor v1.50.0
The language pass. The whole reference corpus is now written in ASD-STE100
Simplified Technical English, converted across three waves and released here as
one version. This release changes how the skill reads, and nothing about what it
says: no control, example, or caveat is added, removed, or reordered, no
reference file is added, and the reference count stays at twenty-four.
Wave 1 took the method and access-control family. Wave 2 took the attack-class
family. Wave 3 took the data, runtime, and interface family, together with
scripts/README.md, the SKILL.md prose, and the AGENTS.md, GEMINI.md, and
.cursor cascade.
The rules applied
The grammar is the standard's: short sentences, the active voice, the imperative
mood for an instruction, one instruction to a sentence, the present tense for a
fact, no gerund or participle as a noun or a verb, noun clusters of three words
or fewer, articles kept, approved phrasal verbs only, one term for one thing, a
warning before the instruction it applies to, and no slang, metaphor, or
rhetorical question.
Vocabulary substitution stops there. In this corpus the verb is frequently the
rule, so log, redact, retain, erase, restore, promote, quarantine, scan,
throttle, lock, commit, and roll back each still name what they named before.
Delete and erase remain two words in the privacy file, and retain and keep are
still not interchangeable there.
What did not move
Every heading is byte-identical, at every level, so every anchor still resolves:
the docs-integrity check passes with twenty-four reference files, no orphan,
balanced fences, and 297 anchored links across thirty-three markdown files.
Every fenced code block, table, cross-reference, identifier, severity word,
threshold, date, and version claim was diffed per file against its previous
state and is unchanged. The dated library index keeps its dates, its
classifications, and its version pins, and its index date does not move. Every
Wrong, Unsafe, Correct, and Write-time label keeps the pairing it marks.
The MUST and NEVER register is preserved, and no rule is softened, hedged, or
widened.
The frontmatter description is byte-identical at 1013 characters, measured the
way the validation workflow measures it. SKILL.md is 33860 of the 40960 bytes
the docs-integrity workflow allows.
The documented script contract does not move either. The exit-code statement,
the kind: "summary" output shape, and the --selftest CI wording are
byte-identical; all twenty-nine rule identifiers still match between
scripts/README.md and dangerous_patterns.py; --selftest passes 49 fixtures
with 29 of 29 rules covered; and all three scanners report zero findings against
this repository.
Sentence length
The eleven files wave 3 names carry no prose sentence over 25 words, against 562
before the wave.
Waves 1 and 2 left 82 such sentences between them across the fourteen files they
touched. Those are fixed here, so the whole of references/ now carries exactly
one: the verbatim SP 800-63B-4 blocklist requirement in
a07-authentication-failures.md. It is kept intact because splitting it would
falsify a quoted normative SHALL.
Also released here
The boundary scrub, which has been unreleased since v1.49.0. Three passages
named a repository that is not public, and each is rewritten by capability
rather than deleted, so the seam and its direction survive without the name. Two
seams the final checkpoint reported as unmarked gained a boundary sentence each,
in deployment-and-runtime.md and graphql-and-alternative-api-surfaces.md.
Two historical changelog rows lost the two names they carried, with no date,
number, claim, or verdict moved.
Upgrading
Nothing to do. This release is documentation only. No setting, script flag, exit
code, output shape, rule identifier, or heading anchor changes, so an existing
integration that pins SKILL.md and references/ keeps working unchanged.
Full Changelog: v1.49.0...v1.50.0