v1.2.0 — incident record split into nine pages

v1.2.0 — the incident record split into nine pages

Documentation release: the vendor-sourced incident report is distributed across the wiki so that
each question has one home, instead of being appended to a single digest page.

New pages

• 06 · Ecosystem matrix — the exposure rule, risk per data path, vulnerable and fixed versions for
  libbrotli, Node.js, Bun, Python, .NET, Envoy and Istio, the distribution table with advisories
  (DLA-4855-1, DSA-6582-1, Ubuntu notices), and an explicit map of what this repository does not cover.
• 07 · Inventory — commands for packages, runtimes, container images, statically linked copies and
  application decode paths, the live /proc scan, exposure classes, and the fields every inventory row
  must carry.
• 08 · Remediation playbooks — five principles, P0–P3 priority, procedures per runtime, and the
  closure evidence a finished row needs.
• 09 · Interim mitigations — 415 at the edge, framework defaults for request decompression,
  outbound decode restrictions, workload isolation, detection signals, post-mitigation validation, and
  what each control does not cover.

Changed

• 05 · Advisory digest rewritten around the incident record: GHSA-3wvj-j6qm-62mr, the three public
  aliases (Node2Shell, HTTP2Shell, Broccoli2Shell), root cause in one paragraph, disclosure timeline,
  both severity scales, what the record does not settle, and sources with their evidence level.
• 10 · Operations (renamed from 06-Operations) gains a verification checklist; 11 · Traps
  (renamed from 07-Traps) gains four rows: end-of-life runtimes, default request decompression,
  control plane versus data plane, and the rebuild that a package update does not perform.
• SUPPORT.md and the issue template follow the rename; the wiki navigation is regrouped into Start,
  The audit, The record, Do the work, Operate.

Measured before this release

Check	Result
Wiki build and verify (ghagent wiki build, wiki verify)	12 pages, pass
Repository hygiene (ghagent audit)	100.0%, 0 findings
Documents and privacy (ghagent doc)	0 errors, 0 warnings
Changelog conformance	pass
Live pages	12 of 12 answer 200; retired names fall back to Home
Encoding	no BOM, no CRLF, final newline everywhere

v1.1.0 — English canonical docs, five translations, operator wiki

v1.1.0 — English canonical documentation, five translations, operator wiki

Documentation release. The scripts change only where ShellCheck found a real defect; no remediation
logic changes.

Documentation

• README.md rewritten: five badges, the rendered social preview, a contents list, the four
  questions an audit owes, the verdict contract with exit codes, the audit surface, an explicit
  limitations list, the language matrix.
• AGENTS.md: repository boundaries, ten invariants, commands, a verification block and a trap table.
• SKILL.md: three-step orchestration, the audit surface, scope limits, safety rules — front matter
  unchanged so an agent runtime keeps loading it.
• docs/FIELD-REPORT.md: rewritten as an evidence record — for each of the nine field defects, what
  was visible, what the cause was, and the measurement that found it.
• English is the canonical language; the Russian originals moved to .ru.md with git mv.

Translations

• German, Spanish, Hindi and Chinese for every document; Russian regenerated from the canonical
  source. Structure, table shapes and code fences identical to the source, verified across six
  languages (0 documents with structural drift).
• Language switcher in each README. The Hindi contents list is unlinked on purpose: the anchor slug
  of the project checker drops Devanagari combining marks.

Wiki

Seven operator pages plus Home, published and verified: why a version check is not an audit,
deployment, the repository contract, field cases with root causes and fixes, the advisory digest with
evidence levels and sources, the operating runbook, the trap register.

Repository hygiene

CHANGELOG.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, SUPPORT.md, CITATION.cff,
.editorconfig, .gitattributes, .shellcheckrc, issue forms, pull request template, CODEOWNERS,
dependabot.yml, a CI workflow that runs bash -n, ShellCheck, the encoding checks, the language-set
check and the tag-to-CITATION.cff check, plus .ghagent.json so the repository audits itself.

Fixed in the scripts

• Unused local removed from the consumer loop; the changelog check written as an explicit
  if/else; the two intentional word-splittings and the fixed ls pattern declared inline with
  reasons. shellcheck src/*.sh exits 0.

Measured before this release

Check	Result
Repository hygiene (ghagent audit)	100.0%, 34 items, 0 findings
Documents and privacy (ghagent doc)	0 errors, 0 warnings across 40 files
Changelog conformance	pass
Wiki build and verify	8 pages, pass
Shell syntax	bash -n clean, ShellCheck 0.11 clean
Classification matrix	12 of 12 expected verdicts, run against common.sh
Encoding	no BOM, no CRLF, final newline in every text file

v1.0.0 — CVE-2026-111497 Brotli remediation agent

v1.0.0 — агент устранения CVE-2026-111497 (Brotli OOB-write)

Детерминированный агент аудита и устранения CVE-2026-111497 (out-of-bounds запись
в декодере Google Brotli, CWE-787, CVSS 4.0 — 9.2). Цель — аудит той же полноты, что и
ручной разбор, с минимальным расходом токенов LLM: вся разведка, применение патча и
верификация вынесены в скрипты, возвращающие компактный машиночитаемый вердикт.

Состав

• src/detect.sh — read-only аудит: вердикт (SAFE/VULNERABLE/NOT_INSTALLED) + JSON-отчёт + снимок «до»
• src/remediate.sh — бэкап → гейт подлинности (changelog ссылается на CVE) → dry-run → установка → перезапуск серверных потребителей
• src/verify.sh — проверка фактического эффекта (версия / CVE-ссылка / старый inode / failed units)
• SKILL.md, AGENTS.md, README.md, docs/ (модель угроз, плейбук, полевой отчёт)

Полевая отработка

Проверено и устранено на трёх хостах: Ubuntu 26.04 (libbrotli 1.2.0), Debian 12 (1.0.9),
Ubuntu 24.04 (1.1.0). Везде применён официальный backport из -security после проверки
changelog на CVE-2026-111497.

Устранённые в ходе отработки дефекты

SIGPIPE/pipefail, парсинг state-файлов, склейка имён юнитов в cgroup, захват inode по
symlink, перезапуск шаблонных юнитов (name@N.service), классификация desktop/infra
потребителей как «deferred».