Jankurai v1.7.2

Jankurai v1.7.2 is the first release built on our own build hosts and signed with
the Jankurai release key. GitHub is now only where releases are published.

Public products are the Jankurai auditor, the Tuiwright CLI, and the UX QA npm CLI
package. Each native tarball holds the binary, its license, the family lock, the
Cargo lock, and build provenance (jankurai.release/v2). The provenance names the
tag, source commit and tree, lock digests, member commits, and toolchain. Every
asset has a SHA-256 checksum and a cosign key signature bundle (.cosign.bundle).
The release public key is attached, and its SHA-256 is pinned in the installer.

Install with the attached jankurai-installer.sh. It bootstraps temporary
verifiers with embedded version and SHA-256 pins, checks the key pin, checksum,
signature, archive inventory, and provenance, and runs the staged binary before
it atomically replaces an installed version. It needs no GitHub login or compiler.
Releases up to v1.7.1 keep verifying under their original GitHub workflow
signatures and attestations.

See CHANGELOG.md for the changes in this release.

Jankurai v1.7.1

Jankurai 1.7.0 makes GitHub the primary home for the independently editable component family.

The hub provides setup, pull, build, check, and status commands, locked combined builds,
protected component updates, and verified release downloads.

Public products are the Jankurai auditor, Tuiwright CLI, and the UX QA npm CLI package.
Linux x86-64 and Apple Silicon macOS tarballs include the family lock, Cargo lock,
and build provenance. Each release asset has a SHA-256 checksum and Sigstore bundle;
Downloadable GitHub attestation bundles bind the downloads to the release workflow,
tag, hosted runner, and source commit. The installer bootstraps temporary verifiers
with embedded version and SHA-256 pins, requires no GitHub login or compiler, and
runs the staged binary before atomically replacing an installed version.

All public CLI products report 1.7.0. Standard and schema versioning is independent.

Jankurai v1.7.0

Jankurai 1.7.0 makes GitHub the primary home for the independently editable component family.

The hub provides setup, pull, build, check, and status commands, locked combined builds,
protected component updates, and verified release downloads.

Public products are the Jankurai auditor, Tuiwright CLI, and the UX QA npm CLI package.
Linux x86-64 and Apple Silicon macOS tarballs include the family lock, Cargo lock,
and build provenance. Each release asset has a SHA-256 checksum and Sigstore bundle;
Downloadable GitHub attestation bundles bind the downloads to the release workflow,
tag, hosted runner, and source commit. The installer bootstraps temporary verifiers
with embedded version and SHA-256 pins, requires no GitHub login or compiler, and
runs the staged binary before atomically replacing an installed version.

All public CLI products report 1.7.0. Standard and schema versioning is independent.

Jankurai 1.6.11 (Jeryu family pin)

Jankurai 1.6.11 is the pinned auditor for the Jeryu family.

This release attaches the already-governed Linux x86_64 binary. The installed binary SHA-256 is:

9e6b8857a26f6004d4c74e510e13b06d880f2e2ae0c89502698889ed690c5d6c

Tag v1.6.11-deadlang-precision-split.3 is unchanged (b88562fdb124aa86dedd70ab972e7d0d87e58be1).

Verify after install:

jankurai --version
sha256sum "$(command -v jankurai)"

The tagged installer still expects GitHub Actions Sigstore + attestation. This asset set includes the tarball, SHA-256 sidecar, and the tagged installer. A stranger can extract the tarball and verify the inner jankurai binary against the pin above without rebuilding.

Do not cargo install jankurai. Family pin stays 1.6.11; do not treat v1.7.0 as the Jeryu pin.

v1.5.1

Fixed

• Re-sync version bindings missed in the 1.5.0 release. Cargo.toml moved to
  1.5.0 but VERSION, AUDITOR_VERSION, agent/standard-version.toml,
  packages/ux-qa/package.json, package-lock.json, and the standard-version
  template stayed at 1.4.3, breaking the versions_smoke test and the
  release-audit-gate tag/VERSION check. No code behavior change.

v1.5.0 — jankurai diff-audit subcommand

New

• jankurai diff-audit subcommand for fast pre-PR / pre-push lanes. Composes the existing proof (lane routing) + audit (changed-fast scoring) primitives on the diff vs a base ref, with sensible defaults so per-repo shell wrappers can shrink to a one-line exec jankurai diff-audit "$@".
  • Base-ref resolution precedence: --base-ref > JANKURAI_DIFF_BASE > origin/$GITHUB_BASE_REF (GHA PR) > $CI_MERGE_REQUEST_DIFF_BASE_SHA (GitLab MR) > origin/main
  • Collects changed files from committed-vs-base ∪ staged ∪ worktree so pre-commit hooks see the staged set
  • Writes target/jankurai/diff/{changed.lst, diff-score.{json,md}, proof-plan.{json,md}} — RepoScore schema reused so existing SARIF / JUnit / step-summary renderers ingest unchanged
  • Exits non-zero on hard findings (high|critical|error) or new caps unless --advisory-only. --skip-proof for repos without agent/owner-map.json. --out-dir to relocate artifacts.
  • Honors JANKURAI_SKIP_HOOKS=1. Internally bypasses CI git wrappers (JERYU_GIT_BYPASS=1, JERYU_GIT_INTERNAL=1) so diff collection stays consistent under wrapper layers.

Tests

crates/jankurai/tests/diff_audit_smoke.rs — 4 integration smoke tests + 3 unit tests inside commands/diff_audit.rs.

Compatibility

Purely additive. audit and proof surfaces unchanged. Output schemas (RepoScore) reused. proofbind and proofmark sub-crates remain at 0.8.0.

PR: #12

v1.4.3

Fixed

• Tuned HLT-001 and HLT-010 scans to avoid context-blind false positives from
  comments, test scaffolding, changelog prose, local variable names, and regex
  examples while preserving runtime marker, direct DB, and token-literal hits.
• Updated coverage evidence to recognize the current cargo-mutants
  target/mutants/mutants.out/outcomes.json format and native
  scenario.Mutant outcome shape.

Changed

• Local and GitHub coverage CI now generate both Rust LCOV and changed-code
  cargo-mutants evidence, so jankurai coverage audit no longer reports a
  missing Rust mutation source after the producer lane runs.
• Guard documentation and first-run prompts now lead with no-daemon workflows:
  audit-file, guard run, foreground watcher sessions, and Linux-only
  foreground FUSE mounts. macOS no longer advertises unsupported macFUSE
  pre-write blocking.

v1.4.1

Release 1.4.1

See CHANGELOG.md for details.

v1.4.0 — jankurai guard: realtime per-file audit gate for every AI agent

What's new

jankurai audit-file — single-file save-gate engine

A new subcommand that audits one candidate file before it reaches disk. It overlays the candidate bytes on the in-memory Vec<FileInfo> inventory, runs the full 10-dimension + 43-rule audit pipeline scoped to "file-plus-control" (the candidate + AGENTS.md/CLAUDE.md/Cargo.*/package.json/Justfile/agent configs/.github/workflows/** + sibling modules), and returns a delta-based verdict:

Exit	Meaning
0	Pass — no new findings
2	Advisory — new soft findings only
3	Block — new hard finding, worsened severity, or always-block rule
4	Error — could not complete audit

Delta logic: findings are classified by (rule_id, category, normalized_problem) key ignoring line number. Pre-existing repo debt never blocks — only new or worsened findings do.

Always-block rules (regardless of delta): secrets, unresolved TODO markers, HLT-class violations, security-critical severity.

CLI:
```
jankurai audit-file --path [--candidate <file|->] [--op create|modify|delete|rename] [--mode save-gate|advisory] [--format agent|json]
```

Candidate bytes can be piped via stdin with --candidate -.

jankurai guard — enforcement runtime

A new enforcement crate that wires audit-file into a live filesystem guard. Provider-neutral: works with Claude, Codex, Gemini, OpenCode, or any agent that writes files. No per-agent hook API required.

Two backends

Watcher backend (macOS + Ubuntu, always compiled):

Works today on every platform. After a file is written, the guard debounces the event, runs audit-file on the candidate, and enforces the verdict:

• Pass: nothing happens.
• Block: file reverts to its last-good snapshot, a language-aware poison header is written (.rs → compile_error!(…), .ts/.js → throw new Error(…), .py → raise RuntimeError(…), etc.), a failure report lands at .jankurai/guard/LAST_FAILURE.md, and a banner is injected into the agent's PTY.

Honest limit: watcher mode is post-write — it cannot prevent the initial save. It can revert within ~150 ms and poison the file so the agent cannot proceed without fixing the problem.

FUSE backend (Linux only, feature="fuse"):

True pre-write blocking: writes are intercepted at the commit boundary (release/fsync) before they reach the backing repository. On block, the kernel returns EACCES to the agent and the backing repo is never touched.

The fuser dependency is target-gated ([target.'cfg(target_os = "linux")'.dependencies]) — cargo build --all-features on macOS pulls no kernel-extension code.

Enforcement modes

Mode	Behavior
observe	Report only — never modifies files
enforce	Revert + quarantine + poison + PTY banner (default)
strict	Enforce + lock path for writes until failure report is read

Mode resolves as: flag > agent/guard-policy.toml > enforce.

Poison mechanism

Language-aware un-ignorable error headers by file extension. Original rejected bytes are preserved between JANKURAI-POISON-BEGIN/END sentinels so a re-save with the header still present is automatically recovered. In FUSE mode the poison is a virtual read overlay (backing repo stays clean); in watcher mode it is written to disk.

PTY injection

guard run -- <agent>: portable-pty spawns the agent in its own process group, and the denial bus subscriber writes the failure banner directly into the PTY master so the agent sees the block inline.

First-run FUSE setup prompt

On the first jankurai guard invocation, if FUSE is not available, a platform-specific notice is printed to stderr:

macOS:
```
┌─────────────────────────────────────────────────────────────┐
│ jankurai guard — FUSE not installed │
│ │
│ For pre-write blocking on macOS, install macFUSE: │
│ brew install --cask macfuse │
│ │
│ After install: System Settings → Privacy & Security │
│ → approve the macFUSE kernel extension, then restart. │
│ │
│ Watcher mode is active (detects and reverts writes). │
│ This notice appears once. Re-run after FUSE install. │
└─────────────────────────────────────────────────────────────┘
```

Ubuntu/Linux (no FUSE feature build):
```
┌─────────────────────────────────────────────────────────────┐
│ jankurai guard — FUSE dev library not found │
│ │
│ For pre-write blocking, install libfuse3 and rebuild: │
│ sudo apt-get install libfuse3-dev │
│ cargo install jankurai --features guard-fuse │
│ │
│ Watcher mode is active (detects and reverts writes). │
│ This notice appears once. Re-run after rebuild. │
└─────────────────────────────────────────────────────────────┘
```

The notice is suppressed after the first display via ~/.jankurai/guard-fuse-prompted. Watcher mode is used automatically until FUSE is installed and the binary is rebuilt — no configuration required.

CLI surface

```
jankurai guard mount [--mode] [--mount-point] [--foreground]
jankurai guard run [--mode] -- <agent...>
jankurai guard watch [--mode] [--poll]
jankurai guard status [--json]
jankurai guard doctor [--json]
jankurai guard install [--yes|--dry-run]
jankurai guard unmount
jankurai guard failures [--last|--json]
jankurai guard quarantine list|restore
```

Policy file (agent/guard-policy.toml)

```toml
mode = "enforce" # observe | enforce | strict
block_on = ["error", "critical"]
warn_on = ["warning"]
debounce_ms = 80
stable_ms = 50
fail_closed = true # errors treated as blocks
quarantine_new_files = true
respect_gitignore = true
```

Tests

699 #[test] functions total (62 in jankurai-guard, covering: transaction logic, poison roundtrip, policy parsing, denial formatting, watcher, FUSE lifecycle).

Upgrade notes

New workspace member crates/jankurai-guard. After pulling:

```bash
cargo build --workspace
```

No breaking changes to existing jankurai audit or jankurai copy-code commands.

Linux with pre-write blocking:
```bash
sudo apt-get install libfuse3-dev
cargo install jankurai --features guard-fuse
jankurai guard watch
```

macOS / Ubuntu (watcher mode, no setup required):
```bash
jankurai guard watch
```

v1.3.0 — copy-code volume ranking, narrow hard-fail, allowlist, jscpd bridge

What's new

Copy-code audit lane — v1.3 hardening

Narrow hard-fail surface (inexcusable cases only):

• Exact file duplicates in active source (ExactFile)
• Same-name function/method copies across two or more active-source files (ExactUnitSameName), ≥10 lines / 100 tokens

All other detections (ExactUnitDifferentName, TokenBlock) are advisory-only and never reduce score.

Volume-ranked output:

• New fields on every class: instance_count, total_redundant_lines/tokens/bytes, effective_severity, hard_fail, fingerprint
• Sort order now ranks by total redundant volume across all instances (n-1) × per_instance, not per-instance size

New CLI subcommand: jankurai copy-code rank [--top N] [--by lines|tokens|bytes] [--kind all|hard-only|...]

Allowlist (agent/copy-code-allowlist.toml): stable fingerprint suppression with optional expires date; suppressed classes still appear in report under suppressed.by="allowlist"

Optional jscpd cross-check (--cross-check jscpd): advisory only, never affects score

False-positive carve-outs:

• Workspace manifests (Cargo.toml, package.json, tsconfig.json, pyproject.toml, setup.cfg) → WarningOnly
• #[derive(, #[serde(, bare impl ... { headers filtered from token-window matching

Score: shape penalty −10 (was −18); cap at 70 unchanged
Schema: copy-code 1.1.0; standard 1.9.0; auditor 1.3.0

Tests

610 #[test] functions (16 new copy-code tests covering FP carve-outs, allowlist, rank ordering, rename invariance, schema roundtrip, jscpd bridge)

Upgrade notes

Copy-code schema bumped to 1.1.0 — new fields are required in the schema; existing reports are incompatible. Regenerate with:

cargo run -p jankurai -- copy-code . --json target/jankurai/copy-code.json