v1.87.0.0 feat: add verified CSO audits and replayable repair bundles

[garrytan]

Why (in your own words)

Today /cso can describe security risks, but it cannot reliably prove that a vulnerability is reachable, that a proposed repair fixes the same assertion, or that the finding stays closed against current source. This release adds a fail-closed local evidence pipeline: capture the real source safely, distinguish supported findings from hypotheses and coverage gaps, reproduce candidates only in qualified containment, issue replayable repair bundles, and recheck closure from a fresh snapshot.

Live evidence

I ran the compiled helper against a local vulnerable Node fixture containing a query parameter concatenated into SQL:

$ bin/gstack-cso-launcher start --repo <local-node-fixture> --code --offline --budget 300
$ bin/gstack-cso-launcher submit <run-id> <evidence.json>
$ bin/gstack-cso-launcher finish <run-id>

{
  "status": "finished",
  "completeness": "complete",
  "findingCount": 1,
  "finding": {
    "severity": "high",
    "confidence": "high",
    "evidence": "supported",
    "reproduction": "not_attempted",
    "repair": "not_attempted",
    "closure": "open",
    "title": "Query parameter is concatenated into a SQL statement"
  },
  "gaps": []
}

This is the intended daily-mode behavior: a complete static assessment can support a finding without falsely claiming runtime reproduction or repair.

Scope

• Changed: CSO v3 evidence and report contracts; application modeling and independent challenge rules; native launcher, snapshots, private state, retention, recovery, and watchdogs; Node/Bun/Python/Rails preparation; SQLite/PostgreSQL policies; six scanner adapters plus SARIF import; repair, replay, and fresh-source recheck flows; qualified runtime/scanner release workflows; 40 vulnerable/fixed evaluation pairs; setup/build/docs integration; and the authenticated @garrytan PR-liveness exemption.
• Verified live by: the compiled daily audit above; 582 CSO tests; the strict 596-file repository suite; a selected model-driven CSO diff audit; exact-head native macOS, Windows, Docker, and ten-platform runtime-image CI; build and generated-skill freshness checks; independent final reviews; and credential/pre-push scans.
• Did NOT test: the full paid matched-model v2/v3 40-pair qualification matrix. Runtime and scanner catalogs intentionally remain unpromoted until protected qualification, so static audits work while comprehensive target execution fails closed with a precise prerequisite.

Liveness proof (required for external contributors)

Authenticated PR author is @garrytan, verified with gh api user --jq .login. The repository-owner exemption applies; no screenshot is required.

Checklist

• Liveness screenshot attached (GSTACK PR typed live into a real surface) or PR author is @garrytan (owner exemption)
• This is not a generated-file-only diff (the source templates and implementation were edited, then regenerated)
• No ETHOS.md edits, and no changes to voice / founder perspective / YC references
• New public command / external service / host adapter has an accepted issue linked (N/A: accepted implementation plan in this workspace)
• Linked issue or reproduction: N/A; vulnerable Node fixture and observed helper output are included above

Summary

Verified audits and repair lifecycle

• Adds --doctor, --resume, --replay, and --recheck while preserving bounded daily static audits and existing scope/diff flags.
• Separates severity, confidence, evidence, reproduction, repair assurance, and current-source closure. Reports always state completeness and material coverage gaps.
• Persists replayable bundles with source/runtime/dependency identities. Expired snapshots require explicitly supplied matching source.
• Preserves redacted v2 reports as integrity-bound, read-only legacy evidence that can be inspected later without upgrading old VERIFIED claims.

Contained execution and environment support

• Adds a native launcher that strips runtime injection state, captures dirty source without staging or hooks, validates private persistence paths, and supervises cleanup independently.
• Containment applies only to target execution launched through the trusted helper; it does not sandbox the host agent, Docker daemon, or host kernel.
• Adds qualified, offline target preparation for Node, Bun, Python, and Rails, including SQLite and disposable PostgreSQL.
• Normalizes Gitleaks, OSV-Scanner, Semgrep, zizmor, Trivy, Schemathesis, and SARIF as untrusted candidate evidence with explicit failures and freshness.

Qualification and release safety

• Adds protected runtime/scanner build, qualification, and promotion workflows, SBOM/provenance contracts, an immutable 40-pair evaluation corpus, and fail-closed completeness/accounting gates.
• Hardens runtime qualification canaries, DNS cancellation, bounded maintenance, replay expiry, and deterministic retention/recheck locking.
• Keeps runtime-tested external assertions distinct from project-test completion, which remains self_reported; the stronger tested label stays reserved for a future target-independent completion witness.
• Records the repository-owner PR-liveness exemption for authenticated @garrytan; external contributors retain the live GSTACK PR requirement.

Test Coverage

• CSO release lane: 582 passed, 22 platform/Docker skips, 0 failed across 42 files, 3,875 assertions.
• Strict free suite: 10,000 tests discovered across 596 files in six duration-balanced shards; one sharding self-test timed out under parallel load, passed the required serial retry, and the suite exited 0.
• Diff-selected paid gate: 6/6 slices green; the selected CSO diff audit passed its redacted v3 report assertions in 244 seconds. Three unrelated planned shards skipped every test and were explicitly reported as verifying nothing.
• Deterministic recheck/retention overlap: 12/12 focused repetitions and 6/6 full-file tests.
• bun run build: passed.
• bun run skill:check: all generated host variants fresh; 54 Codex skills present.

Platform-specific Docker, macOS, and Windows scenarios are explicit skips locally and mandatory in their dedicated CI jobs.

Pre-Landing Review

No P0-P2 issues found. Independent native, security, cross-platform, and release reviews covered exact head b2ad371e. The added-line credential scan found 0 high-severity findings; 74 PII/internal advisories were reviewed as public test inputs and version-like fixture values.

Design Review

No production frontend changed; design review was skipped.

Eval Results

The free evaluation-contract suite validates 40 vulnerable/fixed pairs across Node, Bun, Python, and Rails, three-repetition accounting, precision/recall gates, held-out repair assertions, and no false repair certification. Paid matched-model runs were not executed in this workspace and remain a promotion prerequisite.

Plan Completion

Implementation tasks T1-T6 are present: contracts, trusted execution primitives, Node repair workflow, Bun/Python/Rails preparation, scanner adapters, and distribution/release qualification. Catalog publication and release-metric claims remain gated on protected CI and paid evaluation evidence.

Verification Results

• Current bun test test/cso-*.test.ts: PASS (582 tests, 22 expected skips)
• Exact-head free suite: PASS (10,000 tests across 596 files; one timeout passed the required serial retry)
• Exact-head native CI: PASS (signed macOS loader-injection gate, Windows launcher/static workflow, Docker containment, and all ten runtime-image architecture rows)
• Exact-head paid gate: PASS (selected model-driven CSO diff audit; 6/6 slice jobs and fail-closed accounting report green)
• Generated artifacts and skill contracts: PASS
• Secret scan: PASS (0 high, 74 non-blocking fixture/PII advisories)
• Pre-push redaction guard: PASS (0 high; 74 non-blocking medium findings reviewed across the branch; final commit clean)
• Protected GitHub environments cso-runtime-release and cso-scanner-release: configured with required @garrytan review and branch policy.

TODOS

No TODO items were completed in this PR.

Test plan

• bun test test/cso-*.test.ts: 582 passed, 22 expected skips, 0 failed
• xvfb-run -a bun run test:free: 10,000 tests across 596 files; one timeout passed the required serial retry; final exit 0
• bun run build: compiled helpers and regenerated all host skill variants
• bun run skill:check: generated files fresh and host skill manifests complete

Generated with OpenAI Codex.

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here

[github-actions]

E2E Evals: ✅ PASS

1/1 tests passed | $.87 total cost | reconcile exit: 0

Shard	Result	Status	Cost
e2e-cso/skill-e2e-cso	1/1	✅	$0.87

Fail-closed reconciliation

[test:paid] report: 6/6 slices, 5 planned shards, tier=gate
  slice 1  passed              0s  test/llm-judge-recommendation.test.ts
  slice 2  passed            244s  test/skill-e2e-cso.test.ts
  slice 3  passed              0s  test/skill-llm-eval-spec.test.ts
  slice 4  passed              0s  test/skill-llm-eval.test.ts
  slice 5  passed              0s  test/skill-routing-e2e.test.ts
[test:paid] report: ⚠ 3 shard(s) passed with EVERY test skipped — they verified nothing:
  ⚠ test/llm-judge-recommendation.test.ts (1 skipped — external service missing or tier mismatch)
  ⚠ test/skill-llm-eval.test.ts (25 skipped — external service missing or tier mismatch)
  ⚠ test/skill-routing-e2e.test.ts (10 skipped — external service missing or tier mismatch)
[test:paid] report: every planned shard accounted and passed

---

Sliced lane: diff-selected gate census via scripts/test-paid-shards.ts (planner → 6 executors → fail-closed report)