test(security): start dev-first 0.55.11 follow-up

openspec/CHANGE_ORDER.md

@@ -22,6 +22,17 @@ Independent security modules #511 and core #719/#718 and existing signing gates
 
 ## Authorized #747 dependency stack (2026-10-10)
 
+### Dev-first 0.55.11 security completion (2026-10-25)
+
+The owner requires the missing reviewed security updates to enter a PR to
+`dev` before the main release. The additive
+[`security-dependencies-0-55-11-dev`](changes/security-dependencies-0-55-11-dev/proposal.md)
+change tracks this follow-up under issue #780. Preserve the delivered #784
+change, original evidence and current dev runtime/three-audit protections.
+PR #785 remains an incomplete draft release prefix. Native bootstrap and
+CI-only signatures must be resolved through their legitimate gates. No merge
+or publication is authorized.
+
 ### Official dependency hotfix and temporary MCP exception (2026-10-21)
 
 [PR #782 / issue #780](changes/isolate-semgrep-security-runtime/proposal.md) retains

openspec/changes/security-dependencies-0-55-11-dev/.openspec.yaml

@@ -0,0 +1,2 @@
+schema: spec-driven
+created: 2026-10-25

openspec/changes/security-dependencies-0-55-11-dev/CHANGE_VALIDATION.md

@@ -0,0 +1,32 @@
+# Current validation
+
+The owner explicitly requires the missing security updates to enter `dev`
+before a main release. This new change covers only that additive follow-up.
+The delivered `isolate-semgrep-security-runtime` change and all original proof
+identities remain unchanged. No old exact-head grant transfers.
+
+At dev `9b5ad1e78430cc0b061cb16de42f73de96f4f312`, the new spec validates with
+`openspec validate security-dependencies-0-55-11-dev --strict`. Targeted Ruff
+0.15.20 checks pass. The network-enabled 15-case local failing-before run
+contains 15 intended assertion failures, zero errors and zero skips, with all
+recorded inputs unchanged. An earlier run's three installation failures remain
+setup evidence only, despite its matching pytest failure count.
+These observations are not full-project quality or native CI acceptance.
+
+Only spec/tests and authentic local proof have been prepared. The seven
+production inputs remain byte-identical to the dev base. The normal Hatch
+environment is initialized. Independent static and local behavioral reviews
+accepted the test prefix. Normal hooks passed for its first local snapshot.
+After the quality correction, actual Code Review reports zero findings and
+20 selected preservation controls pass. CI signing is still being prepared. No signed dev PR, native RED, production change, passing
+final wave or actual forge-ready state is claimed.
+
+Live issue #780 is open, status Todo, parent #747, with security/dependency
+labels and project assignment. Open blockers #783 and #523 remain recorded.
+An internal wiki mirror is required for the new scope and remains a separate
+bounded sibling-write item; the prior exact two-file grant is not reused.
+
+Current risks are the expired native bootstrap, accidental loss of dev's third
+audit/runtime protections, and stale authority after a head change. Keep the
+bootstrap prerequisite explicit, review scoped hunks, and obtain fresh final
+head/tree authority. No merge or release is authorized.

openspec/changes/security-dependencies-0-55-11-dev/TDD_EVIDENCE.md

@@ -0,0 +1,83 @@
+# Dev-first failing-before evidence
+
+On 26 October 2026 Europe/Berlin, the unchanged production inputs at dev
+`9b5ad1e78430cc0b061cb16de42f73de96f4f312` produced 15 assertion failures,
+zero errors and zero skips for this change's 15 mapped cases. The exact JUnit
+and execution/input receipt are retained under `requirements-proof/` as
+`local-red-behavior-20261026.xml.gz` and its companion receipt. Root inspected each
+failure message. The Git cases show rejection false, clone boundary reached
+and one clone call, rather than a wheel-installation error.
+
+The gzip transport decompresses to the original immutable XML bytes, SHA-256
+`cdbef78a51e9bbf66e43ac826a3cfb23335b06de6092b93ed71e37606d19c407`.
+Pytest's raw failure trace contains trailing whitespace. Compression preserves
+that report without normalizing its contents or changing formatter rules.
+
+The targeted local runner used Python 3.12.13, pytest 9.1.1 and the exact
+hash-pinned test-tool entries extracted from dev's CI export. It loaded normal
+repository conftest/configuration with third-party plugin autoload disabled.
+GitPython probes installed the exact frozen GitPython/gitdb/smmap wheels with
+hash checking, no dependency resolution and isolated `-I -S` execution.
+
+The failures observe the five old package versions, both old public floors,
+the old parser record, three missing exact OpenTelemetry admissions, three
+metadata submodule paths reaching clone, and two existing advisory exclusions
+where the required nine are expected. All recorded inputs stayed unchanged
+during execution. No production edit preceded this run.
+
+The first exploratory run had 15 failures and one passing preservation case.
+It is retained privately without relabeling. The already-satisfied shared-lane
+case was removed from this RED plan and remains an ordinary control. Independent
+review also required per-package advisory fixtures, parser hostile-fixture
+adaptation and exact deselection bounds before the corrected run. This evidence
+uses the corrected tests and mapping; it does not transfer the first run's
+identities.
+
+The pinned Requirements lifecycle initially rejected the automatic floor-case
+parameter IDs because comparison punctuation is not allowed in selectors.
+Explicit `gitpython-floor` and `pycparser-floor` IDs corrected the metadata;
+the assertions did not change. The next run had 12 intended assertion failures
+and three wheel-installation CalledProcessError failures. Its total of 15
+pytest failures did not establish complete behavioral RED. Independent review
+caught this distinction. That raw run and receipt remain unchanged and receive
+no behavioral acceptance. The separately approved network-enabled run then
+produced all 15 intended assertion failures, with unchanged inputs and no
+errors or skips. The actual pinned lifecycle accepts planned maturity with no
+findings, mapping digest
+`sha256:7025a000601cc44c1a1e6168367f2188681471d68ea5f044cfc81a94b734f8ff`
+and plan digest
+`sha256:dc90453d191b282ba5e47127bf067ee23b475072d7e94a0859c7c6a26677ce3a`.
+That planned-only result supplies no native RED or mapping review acceptance.
+
+This is local behavioral failing-before evidence. It is not accepted native CI
+RED, an origin attestation, exact-head authority, a production acceptance or
+merge readiness. Native bootstrap remains blocked before tests by the base's
+expired pycparser 2.22 review. No renewal or check waiver is claimed.
+
+Passing-after, full quality gates, genuine accepted native evidence, independent
+final review, CI-only Git signatures and actual forge readiness remain pending.
+
+## Test-prefix quality correction
+
+On 26 October 2026 Europe/Berlin, the normal Code Review identified duplicated
+trust fixtures and unknown member types inherited by the edited audit tests.
+The correction groups the five unchanged hostile fixture oracles and adds
+fixture/function annotations. Mapping YAML indentation changes parsed no data.
+A fresh independent review accepted these exact changes and their local results.
+
+The distinct `local-red-quality` run again produced 15 intended assertion
+failures, zero errors and zero skips. Its receipt binds all 13 input hashes.
+The separate `local-controls-quality` run passed 20 cases, including all nine
+original MCP scenarios, the grouped hostile fixtures and ordinary clone paths.
+These reports remain private local evidence and replace no native identity.
+
+The actual normal SpecFact Code Review run
+`review-f821c36e-2ff9-43f9-8f4c-1a403be11ec1` reports PASS with zero findings.
+Direct yamllint of the new YAML files passes. The repository-wide YAML hook
+prints inherited findings and returns success incorrectly; full YAML cleanliness
+is not claimed. That wrapper defect remains tracked separately in
+[issue #781](https://github.com/nold-ai/specfact-cli/issues/781).
+
+The local test prefix has passed normal hooks. Its unsigned source snapshot is
+not a published branch or accepted commit signature. A bounded create-only CI
+signer must produce and verify the delivered tree with dev as its sole parent.

openspec/changes/security-dependencies-0-55-11-dev/design.md

@@ -0,0 +1,37 @@
+# Design
+
+The data contract is the reviewed package/version table, two public dependency
+floors and three distinct advisory records. The existing frozen refresh and audit
+implementations remain the source of behavior. The existing selection test
+compares nonempty SHA-256 sets from lock artifacts and exported requirements.
+No new dependency resolver or advisory engine is needed.
+
+Use a new change root because Requirements selects the complete mapping for
+each changed root. Editing the delivered `isolate-semgrep-security-runtime`
+mapping would incorrectly demand new RED for cases already passing on dev.
+Keep that root and all historical evidence byte-identical.
+
+Tests inspect the canonical lock/export and metadata, invoke the existing audit
+gate with concrete hostile inputs, and exercise the frozen GitPython API with
+the clone boundary observed. Passing preservation and negative controls run
+alongside the selected genuinely failing cases but are not labeled RED.
+
+Only scoped hunks may enter existing dev files. Preserve its third audit,
+runtime-smoke graph, native artifact transport, trusted planning/proof bases and
+all other runtime behavior. Reuse reviewed official artifact metadata, then
+regenerate and verify the lock/export with normal tooling. Never hand-edit the
+generated dependency lists to force a resolver result.
+
+CI-only Git signing must bind the reviewed tree, exact dev parent and a new
+create-only branch using existing permissions. It grants no shared-history
+rewrite, protected ref change or merge. The test-only prefix must remain
+separate from later production commits.
+
+Native bootstrap is an explicit open delivery dependency. The base's expired
+parser record prevents test execution; changing that production record in the
+RED prefix is not a native proof fix. The concrete trusted bootstrap or exact
+admission prerequisite needs independent review and any separate protected
+deployment approval before adoption. No implementation is claimed here.
+
+Rollback before merge is disposal of the unmerged candidate branch. A later
+merged dependency correction can be reverted through an ordinary reviewed PR.

openspec/changes/security-dependencies-0-55-11-dev/proposal.md

@@ -0,0 +1,86 @@
+# Change: Complete the 0.55.11 security dependencies on dev
+
+## Why
+
+The owner requires the security patch to enter `dev` before a release PR can
+reach `main`. Dev commit `9b5ad1e78430cc0b061cb16de42f73de96f4f312` already
+contains merged #784, core 0.55.11, the certificate correction and the current
+Requirements controls. The reviewed dependency updates and their supporting
+records remain absent. PR #785 contains an incomplete test-only release prefix
+and is not a replacement for this dev follow-up.
+
+## What Changes
+
+- Select official GitPython 3.2.1, packaging 26.3, pycparser 3.12,
+  python-discovery 1.6.1, virtualenv 21.14.13, filelock 4.2.1, msgpack 1.2.3,
+  setuptools 84.1.0 and Semgrep 1.182.1 in the frozen graph/export.
+- Select official Pylint 4.0.9 in the separate Code Review input and lock to
+  fix GHSA-22qq-2fwx-7p67 without changing its six transitive selections.
+- Require GitPython >=3.2.1 and pycparser >=3.12, excluding the blocked 3.0
+  family, in both public dependency declarations.
+- Replace the expired pycparser 2.22 provenance record with the reviewed exact
+  official 3.12 artifact. Do not renew the expired record.
+- Add the separately owner-approved OpenTelemetry API 1.37.0 advisory record,
+  distinct from MCP 1.29.0. Preserve the original MCP record and add only
+  the three separately accepted MCP advisory identities in their exact
+  package/version record reviewed on 29 October 2026. All three records
+  end on 4 November 2026 inclusive. This accepts temporary residual risk;
+  it does not remediate MCP or OpenTelemetry.
+- Exercise GitPython submodule creation against metadata paths and ordinary
+  checkout controls through the exact frozen wheels.
+- Exclude only frozen-version assertions from the scheduled advisory resolver
+  lanes. Keep ordinary negative tests and every blocking job selected.
+- Preserve dev runtime changes, portable smoke fixtures, all three strict
+  audits, existing version 0.55.11 and all delivered Requirements controls.
+
+## Capabilities
+
+### New Capabilities
+
+- `dev-security-dependencies`: the remaining reviewed dependency selection,
+  provenance, bounded advisory treatment and compatibility controls.
+
+### Modified Capabilities
+
+None. The existing admission capability and its original evidence stay intact.
+
+## Impact
+
+This follow-up changes dependency inputs, their records and verification. It
+does not change application source or module manifests. The frozen graph's
+PyJWT remediation is not a claim about every public resolver outcome.
+
+Native CI currently rejects the base's expired parser record before tests.
+Local failing tests alone cannot replace native provenance. A legitimate
+trusted bootstrap or separately approved exact admission must resolve that
+boundary before production history is adopted. No old PR #785 or #784 grant
+transfers to this change, branch, PR, plan, head or tree.
+
+No merge, publication, protected deployment, local signing, access expansion,
+check waiver, exception renewal or advisory exception beyond these exact
+reviewed records is authorized. A later dependency-only release must retain the published v0.55.4 application payload;
+this dev PR does not authorize wholesale dev promotion.
+
+## Source Tracking
+
+- Repository: nold-ai/specfact-cli.
+- Issue: <https://github.com/nold-ai/specfact-cli/issues/780>.
+- Parent: #747. Live status on 25 October 2026 is Todo.
+- Open blockers #783 and #523 remain recorded; this proposal does not close them.
+- Supersedes no delivered change or historical proof.
+
+## Acceptance Criteria
+
+- Every selected new RED case fails for its specified missing behavior, without
+  errors or skips, before dependency/workflow edits.
+- Frozen refresh is generated normally and changes only the reviewed dependency
+  closure and declared metadata.
+- The lock and export contain equal nonempty SHA-256 artifact sets for each
+  reviewed package; a version-only export or substituted digest fails.
+- All three strict audits pass on the actual frozen CI, Code Review and
+  runtime-smoke graphs, including setuptools 84.1.0, with only the three exact
+  bounded records above. Skipped subjects or unrelated advisories fail.
+- Exact artifact, GitPython compatibility and preservation controls pass.
+- Native producer, fresh/final consumers, signatures, Code Review and every
+  required check pass for the actual final head under fresh authority.
+- The dev PR is reviewable and forge-ready. No merge occurs.