v0.5.1

v0.5.1 release evidence

Scope, audit, harden, and retest web projects with AI coding agents and reproducible evidence.

Web App Security Skill v0.5.1 is a compatibility patch over the v0.5.0 source-detection and
understandable-remediation release. It repairs independently reproduced tokenizer and case-study
reproduction defects without expanding the stable rule boundary or changing evidence states.

Release identity

• Version/tag: v0.5.1
• Source identity: the commit peeled from the SSH-signed annotated tag; the exact commit is recorded
  in web-app-security-skill-0.5.1.release.json and the provenance attestation.
• Runtime matrix: Node.js 22 and 24 on Ubuntu and macOS; Bash 3.2 remains covered on macOS.
• Stable corpus: 20 built-in risk rules, two evidence-integrity rules and eight opt-in external
  adapter rules, unchanged from v0.5.0.

This file is part of the source commit it describes and therefore does not embed a fabricated
self-referential source SHA. The signed tag, manifest and provenance establish the published source
identity.

Correctness fixes

JSX text boundary

The bounded JS/TS tokenizer now tracks JSX tag, child-text and brace-expression states. Text such as
skills/*.yaml or src/*.tsx no longer opens a JavaScript block comment, while expressions, tag
attributes and nested JSX return to code tokenization. A tokenizer failure still produces partial
coverage and explicit unknown evidence; it is never treated as a clean result.

Python raw-string boundary

The Python tokenizer now consumes backslash-quoted characters in raw as well as non-raw strings for
lexical delimiter handling. The reproduced raw regular expression compiles with CPython and now
completes tokenizer coverage. This remains a bounded tokenizer, not a claim of complete Python
grammar or data-flow analysis.

Reproducible ordinary-project evidence

The v0.5.0 five-project evidence retains each original report.json SHA-256 as an archival byte
identity and adds report.semanticDigest. The stable digest covers report schema, ruleset digest,
state summary and sorted finding ID/state pairs. Third parties can run:

node scripts/check-v050-ordinary-review.mjs \
  --report <project-id> /path/to/reproduced/report.json

Direct audits intentionally receive a random ephemeral subject, so their full report bytes are not
claimed to match the author's original report. The new comparison preserves subject isolation while
making the reviewed finding semantics reproducible.

Local TLS fixture isolation

The HTTPS hardening regression test removes inherited SSL_CERT_FILE before setting its owned
CURL_CA_BUNDLE. The reported enterprise-CA failure was not independently reproduced on the release
host; this change removes an unnecessary host-environment input from the fixture.

Compatibility and security boundary

• Finding/report v3, persisted-subject comparison and v2 migration semantics are unchanged.
• Syntax and external scanner matches remain suspected until independent evidence confirms them.
• Missing or failed source evidence remains unknown; no parser fix turns unavailable evidence into
  a pass.
• Passive network defaults, authorization acknowledgements and review-only repair behavior are
  unchanged.
• This release is not general SAST/DAST coverage, authenticated testing or proof that a project is
  secure.

Release verification

The release workflow runs npm run check, rebuilds all four release assets twice and compares every
byte, verifies archive structure, checksums, manifest and SPDX SBOM, exercises isolated install and
upgrade, then requests GitHub build provenance before publication.

Verify the signed tag:

git -c gpg.ssh.allowedSignersFile=.github/release-signers verify-tag v0.5.1

After publication, verify SHA256SUMS, compare the manifest source commit with
git rev-parse 'v0.5.1^{}', verify provenance, and only then add the immutable asset digests to the
verified installer. The mutable v1 alias moves only after the public consumer workflow passes.