Metadata-Version: 2.5
Name: portunusmcp-sentinel
Version: 1.4.0
Summary: Build-time security scanner for MCP servers
Project-URL: Repository, https://github.com/BashaarJavaid/MCP-Sentinel
Project-URL: Documentation, https://bashaarjavaid.github.io/MCP-Sentinel/
Project-URL: Changelog, https://github.com/BashaarJavaid/MCP-Sentinel/blob/main/CHANGELOG.md
Project-URL: Issues, https://github.com/BashaarJavaid/MCP-Sentinel/issues
License-Expression: MIT
License-File: LICENSE
Keywords: ai-agents,dynamic-analysis,mcp,model-context-protocol,owasp,sarif,security,static-analysis
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3 :: Only
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: <3.14,>=3.10
Requires-Dist: jsonschema<5,>=4.25.1
Requires-Dist: mcp<2,>=1.29.0
Requires-Dist: openai<3,>=2.46.0
Requires-Dist: packaging<26,>=25.0
Requires-Dist: pathspec<2,>=1.1.1
Requires-Dist: platformdirs<5,>=4.10.0
Requires-Dist: pydantic<3,>=2.13.4
Requires-Dist: pyyaml<7,>=6.0.3
Requires-Dist: sarif-om<2,>=1.0.4
Requires-Dist: semgrep==1.176.0
Requires-Dist: tiktoken<1,>=0.12.0
Requires-Dist: tomli<3,>=2.4.1; python_version < '3.11'
Requires-Dist: typer<1,>=0.27.0
Provides-Extra: dev
Requires-Dist: build<2,>=1.5.0; extra == 'dev'
Requires-Dist: mypy<2,>=1.20.2; extra == 'dev'
Requires-Dist: pip-audit<3,>=2.10.1; extra == 'dev'
Requires-Dist: pre-commit<5,>=4.6.2; extra == 'dev'
Requires-Dist: pytest-cov<7,>=6.3.0; extra == 'dev'
Requires-Dist: pytest<10,>=8.4.2; extra == 'dev'
Requires-Dist: ruff<1,>=0.15.22; extra == 'dev'
Requires-Dist: types-jsonschema<5,>=4.26.0.20260518; extra == 'dev'
Requires-Dist: types-pyyaml<7,>=6.0.12.20260518; extra == 'dev'
Requires-Dist: uv==0.11.15; extra == 'dev'
Provides-Extra: docs
Requires-Dist: mkdocs-material<10,>=9.7.7; extra == 'docs'
Description-Content-Type: text/markdown

# PortunusMCP Sentinel

## Current v93 accepted Phase 22 closeout

**Phase 22 is technically complete under the explicitly accepted revised scope.**
The user accepted the delivered V92 technical proposal, including all historical and
practical limitations. **Proxmox remains unsupported and recovery is deferred**;
its original and exposed failures remain failed. Ordinary **FAF completion within
1,800 seconds remains unestablished**; V68 remains unapproved and unimplemented.

The accepted-closeout packet is **`v93-accepted-closeout/`**. Its immutable acceptance
receipt and **493-row audit** preserve all previous evidence: **30 explicitly accepted
limitation rows**, two existing paid/pilot deferrals and unchanged raw measurements.
The supplemental delivery-verification and final-audit receipts bind actual closeout
completion to the exact delivered revision. Technical acceptance and that verified
delivery are distinct events; the sealed audit preserves its honest pre-delivery state.

Unchanged engineering at **`5142a3f`** retains **2,596 tests / 36 skips** locally and
in all 12 hosted suites, 29 normal jobs/docs, **90.28% combined / 86.23% branch coverage**,
six zero-call production replays and 19 runtime bindings. Taskwarrior and earlier
qualified conditions retain their actual measured sources and narrow qualifications.
Current Proxmox: six completed observations / three equal ordered pairs, two missed
vulnerable reads and four unsupported negatives. No failure becomes a retroactive pass.

Git remains **312/1,040 incomplete, 728 deferred**; the 396-request paid benchmark and
pilots remain user-deferred, Phase 21 incomplete and Phase 24/15 unchanged. No new
correction, scan, profile, retry, comparator, target execution or paid call occurred.
Historical spend **$0.071799; zero new paid calls**. Accepted Phase 22 completion does
not authorize merge, ready-state change, release, outreach, launch or Phase 23.

## Historical v92 technical review: Proxmox limitation accepted, technical acceptance pending

The user explicitly approved retaining **Proxmox upload-root as unsupported** and
**deferring further recovery**. Its original and exposed failures remain failed:
at current **`5142a3f`**, six observations completed with three equal ordered pairs,
but both vulnerable reads were missed and all four fixed/safe paths were unsupported.
The exact decision is recorded in the V92 Proxmox limitation receipt. No further
correction, scan, profile, retry, comparator, target execution or paid call ran.

The complete technical acceptance packet is **`v92-technical-acceptance/`**.
All **490 requirements** retain exact evidence: **six Proxmox limitation rows are
explicitly accepted; 24 other historical/practical limitations await technical
acceptance**. Every raw failure, unresolved surface, original qualification and
closed budget remains visible. Taskwarrior and earlier qualified conditions retain
their actual measured sources; exposed follow-ups do not establish fresh accuracy.

Unchanged engineering retains **2,596 tests / 36 skips** locally and in all 12
hosted suites, 29 normal jobs/docs, **90.28% combined / 86.23% branch coverage**,
six zero-call production replays and 19 runtime bindings. The 105 unaffected V87
observations retain original source/report identities and compatibility proof.
This review adds affected documentation/package checks, not a new hosted code pass.

Ordinary **FAF completion within 1,800 seconds remains unestablished**; its six
approved uncapped observations took 2,297.758–2,735.386 seconds. The proposal explicitly
leaves V68 unapproved and unimplemented. Git stays **312/1,040 incomplete, 728 deferred**;
paid benchmark/pilots remain user-deferred, Phase 21 incomplete and Phase 24/15 unchanged.
Historical spend **$0.071799; zero new paid calls**. **Phase 22 remains incomplete**
until separate explicit human technical acceptance of the delivered complete packet
and subsequent verified accepted-closeout delivery. No merge, ready-state change,
release, outreach or Phase 23 is authorized.

## Historical v91 Proxmox regression: failed gate, disposition pending

The approved **six Proxmox observations** at engineering-tested **`5142a3f`**
completed with **all three entire ordered pairs equal**, verified cleanup and
zero remaining budget. **Both vulnerable reads were missed; all four fixed/safe
observations remain unsupported.** All six complete reports equal their failed
`884d376` references; zero findings, six metadata warnings and six unsupported
registration surfaces are fully source-assessed. Raw failures remain unchanged.

Source review identifies the conservative builtin-protection guard rejecting
`importlib.metadata` package-version imports when literal dictionary copies occur.
This is a sufficient source-visible rejection, not a runtime trace or proof that
removing it establishes downstream support. No further correction, scan, profile,
retry, comparator or paid call occurred during this continuation.

Unchanged engineering retains **2,596 tests / 36 skips** locally and in all 12
hosted suites, 29 normal jobs/docs, **90.28% combined / 86.23% branch coverage**,
six zero-call production replays and 19 runtime bindings. The 105 unaffected V87
observations retain their original source/report identities and compatibility
proof. This continuation adds assessment and affected docs/package verification,
not a new hosted code pass or speedup claim.

All **486 requirements and 30 unaccepted limitation proposals** remain. The concrete
next decision is whether to retain Proxmox as unsupported for Phase 22 or continue
focused recovery. Neither is inferred from numerical approval. Ordinary FAF
completion within 1,800 seconds remains unestablished; V68 is unapproved/unimplemented.
**Phase 22 is incomplete:** failed-gate disposition, explicit human technical
acceptance and verified accepted-closeout delivery remain. Git stays 312/1,040
incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete,
Phase 24/15 unchanged. Historical spend **$0.071799; zero new paid calls**.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v89 literal metadata correction: engineering passed, regression approval pending

The approved V87 regression at **`884d376`** completed **111 observations / 48 equal
entire ordered pairs**, with verified cleanup and zero remaining budget. Taskwarrior,
Lightning, Engram and prior Python conditions retain their exact qualifications,
including two Meta nominal-fixed operator errata. **Proxmox still fails: two missed
vulnerable reads and four unsupported negatives.** All 3,959 findings, 343,791
diagnostic occurrences, 5,686 surfaces and complete ordered differences are assessed.
Ten Meta reports retain 268 assessed changed occurrences; original failures remain.

The authorized literal metadata correction is engineering-verified at **`5142a3f`**:
**2,596 tests / 36 skips** locally and all 12 hosted suites, **29 normal jobs and docs**,
coverage **90.28% combined / 86.23% branch-only**. Six zero-call production
requests and 19 approved runtime bindings pass. Literal dictionary copies preserve
dispatch only with proved builtin, mapping and mutation/escape boundaries. Initial
deletion and typing failures remain preserved. No current candidate corpus scan or
speedup is claimed.

The exact **six-observation Proxmox regression is unapproved and unexecuted**:
three unchanged exposed inputs, vulnerable/fixed/safe then repeat, three entire ordered
pairs. Normal **1,800-second input / 10-second Semgrep / 15-second cleanup / four-worker**
limits remain; **200 minutes plus 15 seconds outer cleanup** is a worst-case cap.
Source-only inventory proves the other 105 V87 observations cannot reach the changed
metadata code; their original `884d376` report/source bindings remain, with no new scans.

All **479 requirements** and **28 unaccepted limitation proposals** remain. Ordinary
FAF completion within 1,800 seconds is unestablished; V68 stays unapproved/unimplemented.
**Phase 22 is incomplete**, pending the remaining actual gate, updated complete review,
explicit human technical acceptance and verified accepted-closeout delivery. Git remains
312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete
and Phase 24/15 unchanged. Historical spend **$0.071799; zero new paid calls**.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v86 correctness recovery: engineering passed, regression approval pending

The approved Python module-dispatch and conservative global receiver correction
is engineering-verified at **`884d376`**: **2,553 tests / 36 skips** locally and in
all 12 hosted suites, **29 normal CI jobs plus docs**, combined coverage **90.26%**,
branch-only **86.20%**. Six zero-call production requests and 19 approved
runtime component bindings pass. The failed `8f0639f` candidate, its 45-pass
interrupted local suite and cancelled CI remain preserved. Candidate `1ee96cb`
passed its 2,549/36 local suite, then failed a class-call mutation control; its CI
was cancelled. The final correction removes that unproved class-call exception. No speedup is claimed.

The exact **111-observation exposed regression is unapproved and unexecuted**:
12 Proxmox/Taskwarrior, 12 Lightning/Engram and 87 earlier Python observations,
63 input records across 10 existing repositories, 48 entire ordered pairs and
15 development singles. Normal
1,800-second input / 10-second Semgrep / 15-second cleanup / four-worker limits
remain; the 3,455-minute outer cap is a worst-case bound, not an estimate.
No new repository, retry, profile, comparator, target execution or paid call.

All **463 requirements** retain previous states and evidence; **26 limitation
proposals remain unaccepted**. Original V80 Proxmox misses and unsupported
negatives remain failed. Actual corrected-source support is pending regression.
Historical V73/V75 results remain bound to `cec0322`; ordinary FAF completion
within 1,800 seconds remains unestablished. V68 is unapproved and unimplemented.

**Phase 22 remains incomplete**, pending actual affected regression, explicit human
technical acceptance and verified accepted-closeout delivery. Git stays 312/1,040
incomplete, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete,
Phase 24/15 unchanged. Historical spend **$0.071799; zero new paid calls**.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v81 technical review: unseen check complete, one failed gate

The separately approved V80 check completed **12 observations / six equal ordered
pairs** at **`cec0322`**, using normal 1,800s input / 10s Semgrep / 15s cleanup and
four-worker limits. **Taskwarrior passes narrow shell discrimination; Proxmox misses
the vulnerable upload read and leaves both negatives unsupported** on each pass.
Its computed module-table dispatcher remains unsupported. All four findings,
504 diagnostics, 12 surfaces, 18 contexts and 14 ordered comparisons are assessed.
The initial V78 metadata failure remains one incomplete before analysis, zero reports,
eleven unstarted closed. Both budgets are closed; zero new paid calls or target execution.

All **448 requirements** and **26 unaccepted limitation proposals** remain explicit.
Existing V73/V75 retain 205 exposed observations / 95 pairs; unchanged engineering
retains 2,450 tests / 36 skips, all 12 hosted suites, 29 normal jobs/docs, six captured
production requests and 19 runtime bindings. Normal FAF completion within 1,800s
remains unestablished; V68 is unopened. Git stays 312/1,040 incomplete, 728 deferred;
paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged.

**Phase 22 remains incomplete** until explicit human technical acceptance of
`artifacts/phase22/integration/v81-technical-acceptance/`, including the failed
Proxmox gate and all historical/practical limits, and verified accepted-closeout
delivery. No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v79 metadata correction: new evaluation approval pending

The approved V77 sequence stopped in V78 before scanner analysis: **one incomplete,
zero reports, eleven unstarted closed, zero remaining**, with verified cleanup.
Strict identity comparison caught three omitted optional null fields in the proposal.
The corrected proposal binds complete validated inputs; all six source identities and
36 negative controls pass. Scanner, source archives, configurations, conditions,
order and normal limits remain unchanged. The original failed attempt remains visible.

**Two repositories / six records / twelve proposed observations at `cec0322`** are
separately unapproved: Taskwarrior TypeScript and Proxmox Python. Normal input 1,800s,
Semgrep 10s, cleanup 15s, maximum four workers; outer 380 minutes plus 15s cleanup.
See `artifacts/phase22/integration/v79-unseen-metadata-correction/`.
All **440 requirements** remain; **24 proposed historical/practical limitations are
unaccepted**. Existing 205 exposed observations / 95 pairs and unchanged 2,450 tests /
36 skips retain their actual bindings. Normal FAF completion remains unestablished;
V68 remains unopened. Git 312/1,040 incomplete, 728 deferred; paid benchmark/pilots
deferred, Phase 21 incomplete, Phase 24/15 unchanged. Zero new paid calls.

**Phase 22 is incomplete** pending the requested evaluation, updated delivered review,
explicit human technical acceptance and verified accepted closeout. No merge,
ready-state change, release, outreach or Phase 23 is authorized.

## Historical v77 unseen-source preparation: exact evaluation approval pending

Two previously unused repository cases are prepared at frozen **`cec0322`**:
TypeScript Taskwarrior shell interpolation and Python Proxmox upload containment.
The exact proposal is **6 source records × 2 passes = 12 observations**, unapproved
and unexecuted, using normal **1,800-second input / 10-second Semgrep / 15-second
cleanup**, four-worker maximum, **380-minute outer limit plus 15-second cleanup**.
Source novelty, complete upstream pairs, license qualifications and synthetic
approval/stop/cleanup checks are retained in
`artifacts/phase22/integration/v77-unseen-preparation/`.

All **435 requirements (422 retained + 13 new)** remain explicit. V73/V75 retain
205 exposed observations and 95 equal entire ordered pairs; unchanged `cec0322`
engineering remains 2,450 tests / 36 skips. The 23 historical/practical limitations
remain unaccepted, including ordinary FAF completion within 1,800 seconds and
leaving V68 unopened. Git stays 312/1,040 incomplete, 728 deferred; paid benchmark
and pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. **Zero new paid calls.**

**Phase 22 remains incomplete** pending the additional unseen check, a newly
delivered complete review, explicit human technical acceptance and verified
accepted closeout. No merge, ready-state, release, outreach or Phase 23.

## Historical v76 technical review: source gates passed, human acceptance pending

At engineering-tested **`cec0322`**, the separately approved **24 four-repository
observations and 181 prior-language observations are complete**, with **all 95
entire ordered pairs equal**, verified cleanup and both budgets closed. No-bash,
Lightning, Engram and FAF pass their narrow exposed conditions; TypeScript 94
and Python 87 preserve compatibility, including caller-specific DDG CGNAT support
and two retained nominal-fixed Meta operator errata. Calculator reports add two
source-assessed findings outside the original metadata condition. Fourteen qualified
Git repository-copy findings retain physical/identity uncertainty. Raw findings,
unresolved surfaces and original fresh failures remain visible.

**Normal FAF completion within 1,800 seconds remains unestablished.** Its six
approved uncapped observations took **2,297.758–2,735.386 seconds**; the ordinary
1,800-second policy remains unchanged. The 181 language observations used normal
1,800-second input / 10-second Semgrep limits, 15-second cleanup and the existing
four-worker maximum. No speedup, isolated benchmark or broader runtime safety is
claimed. The V68 performance proposal remains unapproved and unimplemented.

Unchanged `cec0322` engineering retains **2,450 tests / 36 skips** locally and in
all 12 hosted suites, **29 normal CI jobs and docs**, combined coverage **90.11%**,
branch-only **85.97%**, six zero-call production request replays and 19 approved
runtime component bindings. This continuation adds static assessment and affected
documentation/package checks, not a new hosted code pass. All **422 requirements
(89 original + 333 added)** retain their previous states and exact evidence.
Historical failures and practical limits are proposed for explicit acceptance.

**Phase 22 remains incomplete** until explicit human technical acceptance of the
review packet and subsequent verified accepted-closeout delivery. The packet is
`artifacts/phase22/integration/v76-technical-acceptance/`; its summary, complete audit
and acceptance proposal enumerate every proposed limitation. Git stays **312/1,040
incomplete, 728 deferred**; the 396-request paid benchmark and pilots are deferred,
Phase 21 is incomplete, and Phase 24/15 are unchanged. Historical paid spend stays
**$0.071799; zero new paid calls**. No merge, ready-state change, release, outreach
or Phase 23 is authorized.

## Historical v72 correctness recovery: engineering passed, regression pending

Ordinary approved-contract recovery is verified at **`cec0322`**. Supported
TypeScript constructor parameter properties retain actual argument/default and
receiver identity; Python initial URL guard qualification survives only proved
trailing-slash/path-suffix derivation. Wrong/escaped receivers, ambiguous field
initialization, hostname fallbacks, formatting and authority changes remain
conservative, including rejection of prototype-mutating `__proto__` properties.
The first candidate `42d6c7c` failed that additional control; its local suite was
interrupted after 1,408 passes/36 skips and CI 34845266890 cancelled. Initial five
synthetic failures, subset-coverage configuration and helper-normalization failure
also remain retained with their corrections; no partial suite becomes a pass.

Local and all 12 hosted suites pass **2,450 tests / 36 skips**; all 29 normal CI
jobs and docs pass in **34846514312 / 34846514328**. Combined coverage is
**90.11%**, branch-only **85.97%**.
Exact checkout/package bindings, six unchanged zero-call production requests and
19 approved runtime component bindings pass. No speedup is established.

The new **24-observation corrected four-repository proposal is unapproved and
unexecuted**: 12 inputs twice, 12 entire ordered pairs, 18 non-FAF observations
then six FAF. It proposes the previously tested experiment-only uncapped policy,
with finite 15-second cleanup and unchanged normal **1,800-second** deadline.
All 10 complete synthetic policy comparisons and cancellation/approval boundaries
pass. **181 earlier Python/TypeScript observations remain outside this proposal.**

The completed V70 experiment at `4145d35` remains unchanged: 24/24 complete,
12/12 ordered pairs equal, FAF 2,212.22–2,341.48 seconds; no-bash/Engram narrow
passes, FAF detection/support and Lightning negative-qualification failures.
Those results do not establish current-source gates. All **407 requirements
(89 original + 318 added)**, original fresh failures and six unaccepted historical
closure proposals remain. V68 performance optimization stays unapproved and
unimplemented. No new corpus/profile/comparator/target execution or paid call.

**Phase 22 remains incomplete**, pending current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete with
728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15
unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v70 uncapped experiment: complete run, two failed gates

The user-approved **24-observation uncapped four-repository experiment** at
**`4145d35`** completed, with **all 12 entire ordered report pairs equal**,
verified cleanup and zero remaining budget. The 18 non-FAF observations took
6.28–10.72 seconds each. FAF took **2212.221735–2341.484236
seconds** per input. **6 observations exceeded the ordinary
1,800-second policy**, which remains unchanged; no speedup is established.

**No-bash and Engram pass their narrow exposed conditions**, retaining the exact
lexical/physical and initial-home/reconstructed-use qualifiers. **Lightning
fails fixed/safe qualification; FAF misses the vulnerable read and leaves both
negative paths unsupported.** All 260 findings, 52,492 diagnostic occurrences,
282 surfaces, 4,963 source contexts and full ordered reference differences are
source-assessed. The original fresh failures remain source-bound and unchanged.

The pending v68 literal-serialization optimization remains **unapproved and
unimplemented**. No source tuning, profile, retry, comparator, target execution
or paid call ran during this experiment. The earlier Python/TypeScript schedule's
**181 observations are outside this approval**; current compatibility is pending.

All **399 requirements (89 original + 310 added)** and all historical failures
remain, including the explicit v68 audit-status correction. Unchanged engineering
retains **2,419 tests / 36 skips** locally and in all 12 hosted suites, 29 normal
jobs and docs passed; combined coverage 90.08%, branch-only 85.92%. Six zero-call
production replays and approved runtime bindings remain. This is no new hosted
code pass, broad accuracy result, accepted limitation or independent validation.

**Phase 22 remains incomplete**, pending the failed current-source gates,
earlier-language compatibility, explicit human technical acceptance and accepted
closeout. Git stays 312/1,040 incomplete with 728 deferred; paid benchmark/pilots
are deferred, Phase 21 is incomplete, and Phase 24/15 are unchanged. No merge,
ready-state change, release, outreach or Phase 23 is authorized.

## Historical v68 invalidation profile: source-only decision pending

The approved FAF profile at frozen **`4145d35`** timed out after **1800.013225
seconds**, retaining **148,001 verified parent samples** and no report. Cleanup
passed after forced termination; the periodic snapshot does not confirm final
snapshot completion or timer restoration. No worker snapshot exists; worker
launch history and costs are unestablished. The one-use budget is closed.
Registration discovery is 99.86% inclusive; literal serialization is 3.85% of
parent leaf samples. These overlapping partial shares establish no speedup,
removable fraction, detection or compatibility.

`v68-invalidation-sampling/optimization-proposal.json` prepares **one unapproved,
unimplemented source-only literal serialization reuse attempt**: a bounded
per-program cache for exact strings, with fresh Values and all analysis/state
updates retained. Full identity, cold/warm/eviction, error/deadline and ordered
report equivalence plus engineering are required. No corpus/profile/retry,
resource/deadline revision, target execution or paid call is included.

An initial read-only launch preflight failed before any input/token because files
had disappeared. Verified recovery restored 25,941 tracked files, six worktree
links, 7,667 expanded evidence files and two protected user documents without
overwriting existing bytes. The cause remains unknown. User-authorized Docker
cleanup removed five unused public base images; project images, all containers
and volumes remain. Logical image storage fell 2.89GB; delayed physical recovery
is separately recorded. The same unused profile approval then ran once.

All **391 requirements (89 original + 302 added)** remain, including seven native
timeouts, six valid partial profiles, invalid stale-root preparation, both
singleton failures, the original strict invalidation failure and six unaccepted
historical closure proposals. Product retains tested `4145d35`: **2,419 tests /
36 skips** locally and all 12 hosted suites, 29 normal CI jobs and docs passed.
Combined coverage is 90.08%, branch-only 85.92%; six zero-call production replays
and approved runtime bindings remain. This continuation adds profile/recovery
assessment and docs/package checks, not another hosted code pass.

**Phase 22 remains incomplete**, pending current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete, with
728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15
unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v67 invalidation regression: timed out, budget closed

The approved 205-observation sequence at frozen **`4145d35`** stopped on its first
FAF vulnerable input after **1800.008716 seconds** whole-input time.
**One incomplete, zero reports, 204 unstarted closed, zero remaining.** Cleanup
passed within its separate 15-second allowance. Findings, detection, fixed/control
support and ordered repeats remain unknown. No retry, profile or paid call ran.

`v67-invalidation-regression/diagnostic-proposal.json` prepares **one unapproved,
unexecuted parent-and-worker sampled FAF input**, maximum 1800 seconds plus
15 seconds cleanup. It reuses the existing sampler and worker layout with actual
source identities verified before timers/target access. Synthetic identity,
completion/interruption, timer and missing-approval controls pass. The older
`1948bf9` parent profile cannot establish residual costs after the accumulator
change. No optimization, resource/deadline revision or native speedup is included.

All **383 requirements (89 original + 294 added)** remain, including seven native
timeouts, five valid partial profiles, invalid stale-root preparation, both
singleton failures, the original strict invalidation failure and six unaccepted
historical closure proposals. Product retains tested `4145d35`: **2,419 tests /
36 skips** locally and all 12 hosted suites, 29 normal CI jobs and docs passed.
Combined coverage is 90.08%, branch-only 85.92%; six zero-call production replays
and approved runtime/image bindings remain compatible. This continuation adds
outcome, preparation and docs/package checks, not another hosted code pass.

**Phase 22 remains incomplete**, pending current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete, with
728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15
unchanged. No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v66 invalidation contract: engineering passed, regression approval pending

The explicitly approved private mutation-domain revision and one source-only If
accumulator attempt are verified at **`4145d35`**, source
`41dd31a167c454bd9db3d720ce75ce6287312ce0e7799bbda1b2e59c61f77ea6`. All seven shipped flow classes preserve
monotone private invalidations and independent arm baselines. The candidate reuses
the first completed arm; all guard, statement and conservative union work remains.
The source-bound guard rejects removal/export/reflection mutations. Verification
passes 256 ordinary, 766 complete production-flow and 252 production-boundary
comparisons, 125 ordered discovery comparisons and six complete serial/parallel
results. Only the two explicitly named injected scanner callbacks are outside the
prospective domain; their exact deltas and **v65 strict failure remain retained**.
No other failure is excluded; no native speedup or 1800-second completion is proved.

Local and all 12 hosted suites pass **2,419 tests / 36 skips**; all **29 normal CI
jobs** and docs pass in **34808261686 / 34808261635**. Combined coverage is
**90.08%**, branch-only **85.92%**. Six complete production requests
replay identically with zero model calls; approved runtime/image bindings remain.
Verification-helper failures and their actual corrections remain preserved.

`v66-invalidation-contract/evaluation-proposal.json` prepares **205 exposed
observations on 110 inputs / 95 ordered pairs**, **unapproved and unexecuted**:
24 four-source, 94 TypeScript and 87 Python. Bounds remain 1800 seconds per input,
15 seconds cleanup and a 6275-minute worst-case outer cap, not an estimate.
No retry/profile/comparator, new repository, target execution or paid call.

All **376 requirements (89 original + 287 added)** retain every prior failed gate,
six native timeouts, five separately bound partial profiles, invalid stale-root
preparation, both singleton failures, the strict accumulator failure and six
unaccepted historical closure proposals. **Phase 22 remains incomplete**, pending
current-source gates, explicit human technical acceptance and accepted closeout.
Git stays 312/1,040 incomplete, 728 deferred; paid benchmark/pilots deferred,
Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state, release,
outreach or Phase 23 is authorized.

## Historical v65 invalidation attempt: strict-equivalence failure retained

The approved If invalidation-accumulator attempt passes **256 ordinary full-state
comparisons**, then fails the required synthetic captured-arm alias and shrinking-arm
controls. Error/interruption states agree. Shipped source has no matching removal or
arm-set export; real-target reachability remains unestablished. The strict proposal
still required these controls. **One failed attempt closed; exact tested `1948bf9`
source restored.** The candidate and the initial helper-deadline correction remain.

`v65-if-invalidation-accumulator/optimization-proposal.json` prepares an **unapproved
explicit mutation-domain revision and one new source-only attempt**. Every shipped
writer/reader/subclass must first prove monotone private sets with no escaping arm
alias. Only the two named injected callbacks would become negative controls outside
that prospective domain after explicit approval; their original failures stay failed.
No current reclassification, implementation, corpus/profile/retry, paid call,
resource change or timeout revision is authorized. Full engineering remains required
if a later explicitly approved attempt passes its complete prerequisites.

All **365 requirements (89 original + 276 added)** and every earlier failed gate
remain. Restored `1948bf9` retains **2,418 tests / 36 skips** locally and in all 12
hosted suites, 29 normal CI jobs and docs passed; combined coverage 90.08%,
branch-only 85.92%. Six zero-call production replays and approved runtime bindings
remain compatible. This adds failed-attempt/restoration and docs/package checks,
not a new candidate engineering or hosted code pass.

**Phase 22 remains incomplete**, pending current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v64 parent-and-worker profile: source-only decision pending

The approved single FAF profile at frozen **`1948bf9`** timed out after
**1800.010375 seconds**, retaining **148,764 partial samples**
from **1 verified process snapshot(s): parent**. Cleanup passed;
no report exists and the one-use budget is closed. Parent and worker denominators
are separate. Missing worker snapshots do not prove workers never launched.
Partial shares establish no native speedup, removable-cost fraction or detection.

`v64-shared-discovery-sampling/optimization-proposal.json` prepares **one unapproved
source-only attempt** to avoid redundant If invalidation-accumulator construction.
The original baseline and every per-arm copy, guard, traversal and state update remain.
Complete branch-isolation, alias/state and report equivalence plus full engineering
are required. No implementation, corpus/profile/retry, paid call,
resource change or timeout revision is included. The 1800-second policy remains.

All **358 requirements (89 original + 269 added)** and every earlier failed gate
remain. Product retains tested `1948bf9`: **2,418 tests / 36 skips** locally and in
all 12 hosted suites, 29 normal CI jobs and docs passed. Combined coverage is
90.08%, branch-only 85.92%; six zero-call replays and approved runtime bindings
remain compatible. This continuation adds profile assessment and docs/package checks.

**Phase 22 remains incomplete**, pending current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v63 shared-discovery regression: timed out, budget closed

The approved 205-observation sequence at frozen **`1948bf9`** stopped on its first
FAF vulnerable input after **1800.010893 seconds** whole-input time.
**One incomplete, zero reports, 204 unstarted closed, zero remaining.** Cleanup passed
in its separate 15-second allowance. Detection, findings, fixed/control support and
ordered repeats remain unknown. No retry, profile, target execution or paid call ran.

`v63-shared-discovery-regression/diagnostic-proposal.json` prepares **one unapproved,
unexecuted parent-and-worker sampled FAF input**, maximum 1800 seconds plus 15 seconds
cleanup. Completed discovery now runs in the parent before worker dispatch; old
worker-only samples cannot establish current costs. Reuse the same CPU-timer sampler
in the parent and existing workers, with actual source identities verified before
timers/target access. Six-vector, stale-root, parent completion/interruption and
missing-approval controls pass. Sampling overhead and incomplete intervals remain
explicit; no optimization, resource/deadline change or speedup claim is included.

All **352 requirements (89 original + 263 added)** remain, including six native timeouts,
four valid partial profiles, invalid stale-root preparation, both singleton failures
and six unaccepted historical closure proposals. Product retains tested `1948bf9`:
**2,418 tests/36 skips** locally and all 12 hosted suites, 29 normal CI jobs and docs passed;
combined coverage 90.08%, branch-only 85.92%. Six zero-call production replays and
approved runtime/image bindings remain compatible; this adds outcome/preparation
and final docs/package checks, not another hosted code pass.

**Phase 22 remains incomplete**, pending actual current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete, 728 deferred;
paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15 unchanged. No merge,
ready-state, release, outreach or Phase 23 is authorized.

## Historical v62 shared discovery: engineering passed, regression approval pending

The approved single source-only discovery-reuse attempt is engineering-verified at
**`1948bf9`**, source `8f88940210e0f382f8c1cfa1b8af3bf7464ecb891122ae23539de1e4806fc408`.
The original traversal is preserved; completed TypeScript registration discovery is
shared through the existing four-worker IPC and parent coverage. Ordered warnings,
source-node aliases, option effects and all rule-specific analyses remain intact.
Synthetic checks include 125 complete baseline comparisons, complete worker reports,
empty/failed/deadline cases and one producer with every detector still invoked.
No native speedup or 1800-second completion has been established.

Local and all 12 hosted suites pass **2,418 tests / 36 skips**; all **29 normal CI
jobs** and docs pass in **34793663094 / 34793663105**. Combined statement/branch
coverage is **90.08%**, branch-only **85.92%**. Six complete production
requests replay identically with zero paid calls; approved runtime/image bindings
remain compatible. Initial fixture/import/format check errors retain their corrections.

`v62-shared-tool-discovery/evaluation-proposal.json` prepares **205 exposed observations,
110 inputs and 95 entire ordered pairs**, **unapproved and unexecuted**: 24 four-source,
94 TypeScript and 87 Python. The shared 1800-second input limit, 15-second cleanup,
120-second informational target and 6275-minute outer cap remain unchanged. The outer
cap is a worst-case bound, not a duration estimate. No retry/profile/comparator,
new repository, target execution or paid call is included.

All **345 requirements (89 original + 256 added)** retain every earlier failed gate,
five native timeouts, four valid partial profiles, invalid stale-root preparation,
both singleton failures and six unaccepted historical closure proposals. No old budget
is reopened. **Phase 22 remains incomplete**, pending current-source gates, separate
explicit human technical acceptance and accepted closeout. Git stays **312/1,040
incomplete**, 728 deferred; paid benchmark/pilots deferred, Phase 21 incomplete and
Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

## Historical v61 thirty-minute profile: source-only decision pending

The approved FAF profile at frozen **`7bf4c6e`** timed out after
**1800.090669 seconds**, retaining **four verified worker identities
and 432,756 partial samples**. Cleanup passed; no report exists and the
one-use budget is closed. Registration discovery appears in **99.93–99.93%**
of each worker's retained samples. These overlapping partial shares do not prove
native speedup, removable-cost fraction, detection or compatibility.

`v61-faf-long-timeout-sampling/optimization-proposal.json` prepares **one unapproved
source-only attempt** to reuse completed TypeScript tool discovery across the
existing workers and coverage. Preserve ordered warnings and source-node identity;
all rule-specific analysis still executes. Full synthetic/engineering verification
is required. No implementation, corpus/profile/retry/comparator, target execution,
paid call, resource change or timeout revision is included in current approval.
The shared 1800-second policy remains in place.

All **335 requirements (89 original + 246 added)** and every earlier failed gate
remain. Product/tests retain verified `7bf4c6e`: **2,403 tests / 36 skips** locally
and in all 12 hosted suites, 29 normal CI jobs and docs passed. Combined coverage
is 89.98%, branch-only 85.86%; six zero-call replays and approved runtime bindings
remain compatible. This continuation adds profile assessment and docs/package checks.

**Phase 22 remains incomplete**, pending current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v60 thirty-minute regression: timed out, budget closed

The approved 205-observation sequence at frozen **`7bf4c6e`** stopped on the first
FAF vulnerable input after **1800.021672 seconds**. **One incomplete,
zero reports, 204 unstarted closed and zero remaining**; cleanup passed. Findings,
detection, fixed/control discrimination and ordered repeats remain unknown.
The approved 1800-second shared policy remains in place; extending the deadline
alone did not establish completion. No retry, profile or paid call occurred.

`v60-long-timeout-regression/diagnostic-proposal.json` prepares **one sampled FAF
input**, **unapproved and unexecuted**, with a 1800-second maximum and 15-second
cleanup allowance. Existing sampler/worker layout, synthetic identity/timer and
missing-approval checks pass. Older `a36f696` samples do not establish current costs.
No optimization, uninstrumented run, comparator or target execution is included.

All **329 requirements (89 original + 240 added)** remain, including five native
timeouts, three valid partial profiles, invalid stale-root preparation, both
singleton failures and six unaccepted historical closure proposals. Product and
tests remain verified `7bf4c6e`: **2,403 tests / 36 skips** locally and in all 12
hosted suites, 29 normal CI jobs and docs passed. Combined coverage is 89.98%,
branch-only 85.86%; six zero-call replays and approved runtime bindings remain.
This continuation adds outcome, preparation and docs/package checks.

**Phase 22 remains incomplete**, pending current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v59 timeout policy: engineering passed, evaluation pending

The user confirmed **30 minutes per input**. The shared static deadline is now
1,800 seconds at **`7bf4c6e`**, source `40c194dcd47a152f78c9b9dc57b40e5e77026f6052035841c0af63b83f234af6`;
120 seconds remains informational. Source proof establishes one product AST
literal change; detector logic and cleanup are unchanged from `dc73715`.
Local and all 12 hosted suites pass **2,403 tests / 36 skips**; all 29 normal jobs
and docs pass in 34784085204 / 34784085193. Six production requests replay with
zero paid calls. Actual engineering and runtime bindings are retained.

`v59-timeout-policy/evaluation-proposal.json` is **unapproved and unexecuted**:
205 exposed observations, 110 input records, 95 ordered pairs; 30-minute input
ceiling, 15-second cleanup and 6,275-minute outer cap. This is a worst-case cap,
not a duration estimate. All original conditions, support requirements and
11 volatile exclusions remain. No retry, profile, comparator, new repository,
target execution or paid call. The pending v58 diagnostic is preserved unexecuted.

All four earlier native timeouts, partial/invalid profiles, singleton failures
and original fresh failures remain source-bound and unaccepted. No speedup,
current-source compatibility or new unseen-source discrimination is established.
The audit retains **323 rows (89 original + 234 added)**, including all 314 prior
rows and six unaccepted historical closure proposals. **Phase 22 is incomplete**:
actual regression, source assessment, explicit human acceptance and closeout remain.
Git stays 312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete
and Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

## Historical v58 credential regression timeout: budget closed

The approved 205-observation sequence at frozen **`dc73715`** stopped on the first
FAF vulnerable input at **300.005621 seconds** whole-input time.
**One incomplete, zero reports, 204 unstarted closed, zero remaining**; cleanup
passed. Detection, findings, fixed/control discrimination and ordered repeats are
unknown. Current-source four-repository and prior-language gates remain unresolved.
No retry, profile, comparator, target execution or paid call occurred.

`v58-credential-regression/diagnostic-proposal.json` prepares **one sampled FAF
input**, **unapproved and unexecuted**, with a 300-second maximum and 15-second
cleanup allowance. The existing sampler and worker layout remain unchanged;
actual worker/flow/source identities are verified before timer or target access.
Synthetic identity/timer checks and the missing-approval boundary pass.
Earlier `a36f696` samples do not establish residual costs at the corrected source.
No optimization, resource/deadline change or further measurement is authorized.

All **314 requirements (89 original + 225 added)** remain. All four native
timeouts, three partial profiles, invalid stale-root preparation, both singleton
failures and six unaccepted historical closure proposals retain their actual
source bindings. Product and tests remain engineering-tested `dc73715`: **2,399
tests / 36 skips** locally and in all 12 hosted suites, all 29 normal CI jobs and
docs passed. Combined coverage is 89.98%, branch-only 85.86%; six zero-call
production replays and approved runtime/image bindings remain compatible.

**Phase 22 remains incomplete**, pending current-source gates, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v57 joint correction: engineering passed, regression pending

The approved equal-marker credential correction and canonical unknown bypass
are verified at **`dc73715`**, source `4f3e5b2e9c89f61d179ac82db94ced06e83033f9cf1640644cefb53326e96eb9`.
Across 4,050 correction cases, 552 marker and 552 derived cache-input deltas retain
the explicitly revised join contract; guard results agree. The bypass then
passes 2,430 complete Python/TypeScript state comparisons and two saturated-cache
evictions against a preserved correction-only reference. Seven existing synthetic
HTTP patterns preserve entire ordered rule output: four detections, three negatives.
Both original singleton failures remain reproduced, closed and unaccepted.

Local and all 12 hosted suites pass **2,399 tests / 36 skips**; all 29 normal CI jobs
and docs pass in 34779741236 / 34779741226. Combined local coverage is
89.98%, branch-only 85.86%. Packages, strict quality checks, six identical zero-call
production requests and approved runtime bindings pass. Initial synthetic fixture,
import-root and test-format check failures retain their individual corrections.

`v57-credential-merge/evaluation-proposal.json` is **unapproved/unexecuted**:
205 exposed observations on 110 inputs / 95 ordered pairs, comprising 24 four-source,
94 TypeScript and 87 Python observations. 120-second target, 300-second whole/native
maximum, 15-second cleanup, 1,150-minute outer sequence; zero retries, profiles,
comparators, target execution or paid calls. No speedup or 300-second completion
is established. All old timeouts, partial/invalid profiles and fresh failures
remain source-bound; no partial subsets become new whole Linux batches.

The audit retains **308 requirements (89 original + 219 added)**, including six
unaccepted historical closure proposals and both failed singleton rows.
**Phase 22 remains incomplete**, awaiting actual regression, explicit human
technical acceptance and accepted closeout. Git stays 312/1,040 incomplete;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v56 canonical bypass: eviction failure retained

The approved canonical `UNKNOWN_VALUE` bypass passes the two retained ordinary
identity cases, then fails synthetic environment equivalence after LRU eviction.
Skipping an empty entry changes whether a tainted value remains interned; the
identity-only credential-marker join then returns different environments. Full
flow fields agree and inputs are unchanged. Real-target reachability/impact of
the adversarial contained-false marker remains unestablished. **One attempt
consumed, zero remaining; exact tested `a36f696` source restored.**

`v56-canonical-unknown/optimization-proposal.json` prepares an **unapproved
prospective contract revision**: equal immutable credential markers would join
consistently by identity or complete equality, followed by the canonical bypass.
The specified baseline marker delta must remain visible; bypass equivalence must
then hold against a correction-only reference with no exclusions. Neither edit
is implemented. No speedup or 300-second completion is promised. No corpus,
profile, retry, target execution or paid call is included.

All prior native/profile/fresh failures and both singleton failures remain
source-bound and closed. The audit retains **297 rows (89 original + 208 added)**,
including six unaccepted historical closure proposals. Restored `a36f696`
retains 2,386 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI
jobs and docs passed; combined coverage 89.98%, branch-only 85.85%. This is no
new hosted code pass. **Phase 22 remains incomplete.** Git stays 312/1,040
incomplete; paid benchmark/pilots deferred, Phase 21 incomplete, Phase 24/15
unchanged. No merge, ready-state change, release, outreach or Phase 23.

## Historical v55 singleton attempt: equivalence failure retained

The approved broad singleton cache bypass failed its synthetic environment
equivalence prerequisite and was reverted. A warm cache interns equal Values;
direct return changes identity-sensitive credential-marker merging for a tainted
contained-false internal state. Real-target reachability of that state is not
established. Initial whole-flow comparison flags were a helper-object comparison
defect; structural reassessment preserves equal full flow state and confirms the
independent environment delta. All evidence remains visible. **One failed attempt
consumed, zero remaining; product restored exactly to tested `a36f696`.**

`v55-singleton-combine/optimization-proposal.json` prepares one **unapproved,
unimplemented** attempt restricted to the canonical `UNKNOWN_VALUE` singleton
and empty requested key. Every other input must retain cache dispatch. Complete
state and interning checks remain required; eligibility frequency and speedup
are unknown. No corpus/profile/retry, target execution or paid call is authorized.

All three native timeouts, partial profiles, invalid stale-root attempt and
original fresh failures remain source-bound. The audit retains **290 rows
(89 original + 201 added)**, including six unaccepted historical closure proposals
and the new unresolved equivalence failure. Restored `a36f696` retains 2,386 tests /
36 skips in local and all 12 hosted suites, 29 normal CI jobs and docs passed;
combined coverage 89.98%, branch-only 85.85%. This is no new hosted code pass.
**Phase 22 remains incomplete.** Git remains 312/1,040 incomplete; paid benchmark
and pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge,
ready-state change, release, outreach or Phase 23 is authorized.

## Historical v54 sampled timeout: source-only decision pending

The approved single profile at frozen **`a36f696`** retains **four verified worker
identities and 78,769 partial samples**. Whole input **300.007176 seconds**;
cleanup passed, no report exists and the one-use budget is closed. Registration
traversal dominates; merge is 33.09–33.73% inclusive and shared combine/cache call
is 7.40–7.64% leaf sample share. These overlapping partial shares establish no
native speedup, removable-cost fraction or 300-second completion.

`v54-faf-fastpath-sampling/optimization-proposal.json` proposes **one unapproved
source-only singleton fast path** before the existing value-combination cache.
Only an unchanged sole Value with no key override or required safety stripping
could bypass the tuple/cache call. All other paths, cache and complete flow state
must remain compatible, including cold/warm and identity-sensitive controls.
No implementation, corpus/profile/retry, new cache, resource/deadline change or
paid call is authorized. Eligible-case prevalence remains unmeasured.

All three native timeouts/204 closed remainders, prior partial profiles, invalid
stale-worker preparation and original fresh failures remain unchanged. The audit
retains **283 requirements (89 original + 194 added)** and six unaccepted historical
closure proposals. Product retains tested `a36f696`: 2,386 tests / 36 skips locally
and in all 12 hosted suites, 29 normal CI jobs and docs passed; combined coverage 89.98%,
branch-only 85.85%, six unchanged zero-call production requests and runtime bindings.
**Phase 22 remains incomplete.** Git stays 312/1,040 incomplete with 728 deferred;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v53 fast-path regression timeout: budget closed

The approved 205-observation sequence at frozen **`a36f696`** stopped on its first
FAF vulnerable input at **300.000481 seconds** whole-input time.
**One incomplete, zero reports, 204 unstarted closed, zero remaining**; cleanup
passed. Findings, guards, negative discrimination and ordered repeats are unknown.
Corrected four-source and prior-language compatibility gates remain unestablished.
No retry, profile, target execution or paid call occurred. All earlier failures
and original fresh outcomes remain preserved with their actual scanner identities.

The next **single 300-second sampled FAF input** is prepared, **unapproved and
unexecuted** in `v53-fastpath-regression/diagnostic-proposal.json`. It retains the
existing CPU-timer sampler, source/configuration and worker layout, with verified
actual worker/flow/scanner identities before timer or target snapshot access.
The stale-root synthetic control and missing-approval boundary pass. Earlier
`6e4fd67` samples cannot establish remaining costs after the current reorder.
No further optimization, retry, resource/deadline change or paid call is authorized.

All **277 requirements (89 original + 188 added)** remain, including six unaccepted
historical closure proposals and the unresolved invalid stale-worker preparation.
Product/tests/workflows remain `a36f696`: 2,386 tests / 36 skips locally and in all
12 hosted suites; 29 normal CI jobs and docs passed, combined coverage 89.98% and
branch-only 85.85%. Six zero-call production requests and runtime bindings persist.
**Phase 22 remains incomplete.** Git stays 312/1,040 incomplete with 728 deferred;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v52 equal-value fast path: regression approval pending

The one approved source-only merge reorder is engineering-verified at **`a36f696`**.
It checks eligible equal values actually present in every branch before preparing
record fallbacks. **10,944 synthetic comparisons** preserve environment, complete
flow state and inputs; eight intended cases skip the registry lookup and all 13
needed defaults remain. No native speedup or 300-second completion is established.
Full local and all 12 hosted suites pass **2,386 tests / 36 skips**; local combined
statement/branch coverage **89.98%**, branch-only **85.85%**. All 29 normal CI jobs
and docs pass in **34767417083 / 34767417081**, with exact checkout/package bindings.
Six unchanged production requests checked-replay with zero model calls. No new
corpus observation, profile or Git campaign ran.

The **205-observation exposed regression** is prepared, **unapproved and unexecuted**:
24 four-source + 94 TypeScript + 87 Python, 110 inputs and 95 whole ordered pairs.
Bounds: 120-second target, 300-second native/whole maximum, 15-second cleanup, one
1,150-minute serial local sequence. No retries, profiles, comparators, new repository,
target execution or paid calls. See `v52-merge-fastpath/evaluation-proposal.json`
and `launcher-binding.json`. Earlier shared recovery still lacks completed corpus
validation, so both language schedules remain necessary; they are no new whole
Linux batch. Every original label, qualifier and source-support condition remains.

Both earlier native timeouts/204 closed remainders, sampled timeouts, invalid stale
worker preparation and all original fresh failures remain preserved. The corrected
v51 partial profile does not erase the invalid attempt or establish a native pass.
All **271 requirements (89 original + 182 added)** remain; six historical closure
proposals, corrected gates and human technical acceptance are unresolved.
**Phase 22 remains incomplete.** Git stays 312/1,040 incomplete with 728 deferred;
paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged.
No merge, ready-state change, release, outreach or Phase 23 is authorized.

## Historical v51 bound profile: source-only decision pending

The approved corrected profile at frozen `6e4fd67` retains **four verified worker
identities and 79,307 partial samples**. Its whole input timed out at 300 seconds;
cleanup passed, no report exists, and the one-use budget is closed. Shared
TypeScript branch merge is 43.02–44.46% inclusive sample share; its missing-branch
predicate is 8.40–9.08% leaf share. These are not speedup or removable-cost claims.
The [review packet](artifacts/phase22/integration/v51-faf-bound-sampling/summary.md) proposes **one unapproved source-only optimization**:
recognize eligible all-present equal branch values before fallback preparation.
No implementation, corpus/profile/retry, resource change or paid call is authorized.
The invalid old-root profile and V49 preparation failure remain preserved; this
passes current diagnostic attribution only. Original native/fresh failures remain.
Product retains tested `6e4fd67`: 2,384 tests / 36 skips locally and in all 12 hosted
suites, 29 normal jobs and docs passed; combined coverage 89.98%, branch-only
85.85%. All **265 requirements** remain. **Phase 22 is incomplete**; explicit
human acceptance is separate. Git stays 312/1,040 incomplete, paid benchmark and
pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge,
ready-state, release, outreach or Phase 23.


## Historical v50 profile binding failure: stopped and closed

The approved single profile was deliberately stopped when the reused sampler's
worker import root was found to be `17b4784` instead of approved `6e4fd67`.
**One invalid interrupted attempt, no report or sample snapshot, zero remaining.**
Cleanup inventory is empty. Parent identity does not prove worker identity;
V49-DIAGNOSTIC-PREPARATION is corrected to unresolved with its prior row preserved.
The [review packet](artifacts/phase22/integration/v50-faf-allocation-sampling/summary.md) retains this agent preparation error and the diagnostic-only
correction: actual worker/flow imports and full scanner identity checked before
sampling or target snapshot access, with a stale-root rejection control.
A new **single 300-second profile is unapproved and unexecuted**; no retry,
optimization or paid call is authorized. Prior native timeouts and all four
first-frozen failures remain unchanged. Product retains tested `6e4fd67`:
2,384 tests / 36 skips locally and in all 12 hosted suites; 29 normal jobs and
docs passed, combined coverage 89.98%, branch-only 85.85%. All 259 requirements
remain. **Phase 22 is incomplete**; human acceptance is separate. Git stays
312/1,040 incomplete; paid benchmark/pilots deferred, Phase 21 incomplete and
Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.


## Historical v49 allocation regression timeout: budget closed

The approved 205-observation sequence at frozen `6e4fd67` stopped on its first
FAF vulnerable input at the 300-second whole-input maximum: **one incomplete,
zero completed reports, 204 unstarted closed, zero remaining**. Cleanup passed.
No finding, guard, negative-path or ordered-repeat result is available; corrected
four-repository and prior-language compatibility gates remain unestablished.
The [review packet](artifacts/phase22/integration/v49-allocation-regression/summary.md) retains the failure and an **unapproved single
300-second CPU-sampling diagnostic** on the same FAF input. No new retry, profile,
target execution or paid call occurred in this sequence. The v47 profile remains
bound to the earlier scanner; another optimization is not authorized. All original fresh failures and
historical source-bound passes remain unchanged. Engineering retains `6e4fd67`:
2,384 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and
docs passed; combined coverage 89.98%, branch-only 85.85%. The audit retains all
253 requirements. **Phase 22 remains incomplete**; no failure/limitation or human
technical acceptance is inferred. Git stays 312/1,040 incomplete; paid benchmark
and pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge,
ready-state change, release, outreach or Phase 23.


## Historical v48 allocation candidate: regression approval pending

The approved single source-only merge optimization is engineering-verified at
**`6e4fd67`**. It avoids constructing unused record fallbacks; **10,944 synthetic
comparisons** preserve environment, complete flow state and inputs. Allocation
checks preserve needed fallbacks. Full local and all 12 hosted suites pass
**2,384 tests / 36 skips**; local combined statement/branch coverage is
**89.98%**, branch-only **85.85%**. All **29 normal CI jobs** and docs
pass in **34743452798 / 34743452818**, with exact candidate checkout/package
bindings. Six production requests checked-replay unchanged with zero model calls;
Git runtime/image remains compatible. No new corpus observation or profile ran.

The new **205-observation exposed regression** is prepared, **unapproved and
unexecuted**: 24 four-repository, 94 TypeScript and 87 Python, on 110 inputs and
95 ordered repeat pairs. Bounds are 120-second target, 300-second native/whole
maximum, 15-second cleanup and one 1,150-minute serial local sequence; no retry,
profile, comparator, new repository, target execution or paid call. Exact scope
is in `v48-merge-allocation/evaluation-proposal.json` and `launcher-binding.json`.
The earlier shared source recovery still lacks completed corpus validation, so
both prior-language schedules remain necessary. Synthetic allocation reduction
establishes no native speedup or 300-second completion. The old native timeout
and 204 unstarted closed, sampled timeout and all original fresh failures remain
unchanged. No closed budget is reused and no failed gate is waived.

The audit retains **all 247 requirements**, including 89 original and 158 added
rows. Corrected corpus gates, six historical closure decisions and explicit human
technical acceptance remain unresolved. **Phase 22 remains incomplete.** Git
campaigns stay 312/1,040 incomplete with 728 deferred; paid benchmark/pilots stay
deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge, ready-state
change, release, outreach or Phase 23 is authorized.

## Historical v47 sampled timeout: source-only proposal pending

The separately approved single FAF worker profile at frozen `17b4784` timed out
at 300 seconds with verified cleanup: **one incomplete sampled input, four partial
snapshots / 86,659 samples, no report, zero budget remaining**. The [review packet](artifacts/phase22/integration/v47-faf-sampling/summary.md)
attributes 58.36–59.06% of worker samples inclusively to TypeScript branch merging
and 25.78–26.41% as leaves in its fallback Value constructor. These overlapping
sample shares are not promised savings; unused allocations remain uncounted.
One narrow **source-only fallback-allocation optimization** is proposed, unapproved
and unstarted, with zero new corpus/profile/paid budget. The prior regression's
one incomplete attempt and 204 closed unstarted observations remain unchanged.
Corrected detection/compatibility gates remain unresolved. Engineering retains
tested `17b4784`: 2,380 tests / 36 skips locally and in all 12 hosted suites,
29 normal CI jobs and docs passed; combined coverage 89.98%, branch-only 85.85%.
All 239 audit rows and original fresh failures remain. **Phase 22 is incomplete**;
no limitation or human technical acceptance is inferred. Git remains 312/1,040
incomplete, paid benchmark/pilots deferred, Phase 21 incomplete and Phase 24/15
unchanged. No optimization, retry, paid call, target execution, merge, ready-state,
release, outreach or Phase 23 occurred or is newly authorized.


## Historical v46 regression timeout: budget closed

The approved 205-observation sequence at frozen `17b4784` stopped on its first
FAF vulnerable input at the 300-second whole-input maximum: **one incomplete,
zero completed reports, 204 unstarted closed, zero remaining**. Cleanup passed.
No finding, guard, negative-path or ordered-repeat result is available; corrected
four-repository and prior-language compatibility gates remain unestablished.
The [review packet](artifacts/phase22/integration/v46-four-source-regression/summary.md) retains the failure and an **unapproved single
300-second CPU-sampling diagnostic** on the same FAF input. No retry, profile,
target execution or paid call has occurred. All original fresh failures and
historical source-bound passes remain unchanged. Engineering retains `17b4784`:
2,380 tests / 36 skips locally and in all 12 hosted suites, 29 normal CI jobs and
docs passed; combined coverage 89.98%, branch-only 85.85%. The audit retains all
233 requirements. **Phase 22 remains incomplete**; no failure/limitation or human
technical acceptance is inferred. Git stays 312/1,040 incomplete; paid benchmark
and pilots deferred, Phase 21 incomplete and Phase 24/15 unchanged. No merge,
ready-state change, release, outreach or Phase 23.


## Historical v45 source recovery: verified, regression approval pending

Source recovery at `17b4784` passes **2,380 tests / 36 skips** locally and in all
12 hosted suites; all 29 normal CI jobs and docs pass. Local combined branch-enabled
coverage is 89.98% (branch-only 85.85%). Packaging, isolation and six exact zero-call
production replays are verified. The [review packet](artifacts/phase22/integration/v45-four-source-recovery/summary.md) binds the corrected
scanner and an **unapproved 205-observation exposed/compatibility proposal**:
24 four-repository + 94 prior TypeScript + 87 prior Python observations, 110 inputs,
95 ordered pairs; 120-second target, 300-second maximum, one 1,150-minute sequence.
**No corrected-scanner corpus observation or paid call has occurred.** Original
24 first-frozen observations and all four failed fresh gates at `2e0efb2` remain
unchanged. Later passes would be exposed regression. Accurate lexical/physical and
resolved-copy qualifiers retain their source prerequisites and unresolved safety.
The audit retains all 227 requirements; no historical failure or limitation is
accepted. **Phase 22 remains incomplete** pending separate evaluation approval,
source assessment, explicit technical acceptance and verified closeout. Git stays
312/1,040 incomplete, paid benchmark/pilots deferred, Phase 21 incomplete and
Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

## Historical v44 four-repository result: failed fresh gates, recovery proposed

The approved first-frozen batch at `2e0efb2` completes **24/24 observations**;
all **12 entire ordered report pairs agree**, all within 120 seconds (maximum
51.378262 seconds; sequence 455.321356 seconds). **All four repository gates fail**:
FAF, Lightning's Python member and Engram miss their named vulnerable sinks;
no-bash detects the vulnerable overwrite but falsely alerts on both fixed/safe
inputs per pass. Quiet negatives lack established named-path support.
The [completed review packet](artifacts/phase22/integration/v44-four-fresh-evaluation/summary.md) source-assesses all 236 findings,
46,486 diagnostics and 270 surfaces and proposes focused source-only recovery.
No correction or limitation waiver is inferred. All 24 observations are consumed,
zero budget remains, and no extra paid/target/comparator/retry/profile call occurred.
All prior source-bound results and failures remain preserved; product/test/workflow
bytes still equal tested `2e0efb2`. **Phase 22 remains incomplete**: actual failed-gate
disposition/recovery, separate explicit technical acceptance and closeout remain.
Git 312/1,040 stays incomplete, paid benchmark/pilots deferred, Phase 21 incomplete,
Phase 24/15 unchanged. No merge, ready-state, release, outreach or Phase 23.

## Historical v43 four-repository preparation: exact evaluation approval pending

Two new TypeScript repositories (FAF and no-bash) and two Python repositories
(Lightning's Python member and Engram) are source-prepared at frozen `2e0efb2`.
The [reviewable preparation packet](artifacts/phase22/integration/v43-four-fresh-preparation/summary.md) proposes 24 native observations;
**zero have run and no evaluation approval has been received**. Actual fixed-path
support and first-frozen detection/discrimination remain unmeasured. All prior
results, failures, closed budgets and proposed historical limitations remain intact.
The v42 acceptance-readiness statement below is historical and superseded by this
new requirement. **Phase 22 remains incomplete** pending exact evaluation approval,
execution/source assessment, explicit human technical acceptance and verified closeout.
No new paid calls; Git 312/1,040 remains incomplete, paid benchmark/pilots deferred,
Phase 21 incomplete and Phase 24/15 gates unchanged. No merge, ready-state, release,
outreach or Phase 23 is authorized.

## Historical v42 regression result and pending technical acceptance

The approved **94-observation exposed TypeScript regression passes** at frozen
scanner **`2e0efb2`**, source SHA-256 **`0eac8832012e213744d752c6c33a0ba6a2e378f6230e273030f5043f00cf6ebb`**.
All **47 input records completed twice**, with all **47 entire ordered report
pairs equal** after only the established 11 volatile exclusions. There were
**94 observations within the 120-second target** and
**0 using the extended allowance**; the maximum whole input was
**106.857020 seconds**, within the uniform 300-second maximum.
The serial sequence took **3936.245 seconds**. All 94 observations
are consumed and the budget is closed, with zero remaining. No comparator, retry,
profile, new repository, target execution or paid call occurred.

**Memory-keeper passes both original three-input batches:** one vulnerable import
read hit and zero matching alerts on the fixed and safe inputs in each batch.
The source assessment establishes the canonical operator root, component-bounded
guard, checked helper return and supported actual read. Exactly **four matching
fixed/control false-alert occurrences** and their derived counters disappear.
All other ordered findings, warnings, unresolved flows, coverage and surfaces equal
their bound references. The report has no positive per-sink guard trace; recognition
is established by the code/source path, measured delta, evaluated rule and synthetic
controls. Its unnamed MCP dispatch remains unresolved. Broader export and Git-message
candidates and the upstream fixture-secret false positive remain visible.

All affected prior TypeScript conditions pass: SearXNG, fetch-mcp, open-webSearch
and Lighthouse each retain two vulnerable hits and zero matching negative alerts
per five-input batch; the precise initial-destination qualifiers remain intact.
The ten TypeScript development records pass twice (four vulnerable hits and six
valid negatives per batch), and the 14 historical TypeScript records pass twice
(six vulnerable hits and eight valid negatives per batch). These language subsets
are never pooled into a new whole historical/development execution. The whole
45+45 Linux timing/condition passes and explicitly reused whole 25 development
batch retain their actual **`1f3f72f`** evidence and Meta operator erratum.
All 87 Python regression observations at **`8c62567`** remain source-compatible.
The frozen DDG manifest's TypeScript label error remains disclosed: its actual
hash-bound execution configuration selected Python.

**The original fresh memory-keeper result remains unchanged:** at **`8c62567`**,
one vulnerable hit and two matching fixed/control false alerts per batch, six
complete observations and three equal report pairs. The repository was absent
from eight prior manifests and 100 prior effective source trees. This demonstrates
one narrow vulnerable detection on a project-unused repository before tuning;
its discrimination correction is now exposed regression. It does **not** establish
clean unseen vulnerable/fixed discrimination at the final corrected scanner.
DDG's original fresh detections and initially unsupported fixed send, Lighthouse's
original misses, and all earlier corrections/failures remain source-bound.
The original held-out baseline stays 10 completed, 10 unsupported and five
incomplete, with zero hits among four completed vulnerable inputs out of ten
vulnerable inputs total. Same-agent curation/review is not independent human
validation, training-data novelty, broad accuracy or runtime safety proof.

Product, tests, workflows, schemas and lock remain identical to engineering-tested
**`2e0efb2`**: local and all 12 hosted suites passed **2,317 tests / 36 skips**,
local branch coverage **89.92%**, all 29 normal CI jobs passed in **34712751779**,
and docs passed in **34712751789**. Those are retained source-bound passes; this
continuation adds report validation, source assessments and final docs/package
checks, not a new hosted code pass. Six zero-call production replays and the
approved Git image/runtime bindings remain compatible. **Git campaigns remain
incomplete at 312/1,040**, as requested. Paid benchmark and pilots remain deferred;
Phase 21 is incomplete and Phase 24/15 gates are unchanged.

The audit retains **all 89 original requirements: 84 passed, two user-deferred,
two proposed documented limitations and one unresolved human acceptance**.
All **115 added requirements** remain: **109 passed and six historical closure
proposals awaiting decision**. R66/R88 and V39-EVALUATION explicitly propose
accepting the preserved fresh discrimination failure plus the later verified
exposed correction. Five older failed optimization/preparation/execution attempts
also retain their individual proposed closure decisions. None is relabeled as a
historical pass or silently waived. The exact proposed acceptance scope and
consequences are in `v42-path-guard-regression/acceptance-proposal.json`.
**Phase 22 remains incomplete until explicit human technical acceptance and
subsequent closeout delivery.** No merge, ready-state change, release, outreach
or Phase 23 is authorized.


[![PyPI](https://img.shields.io/pypi/v/portunusmcp-sentinel)](https://pypi.org/project/portunusmcp-sentinel/)
[![CI](https://github.com/BashaarJavaid/MCP-Sentinel/actions/workflows/ci.yml/badge.svg)](https://github.com/BashaarJavaid/MCP-Sentinel/actions/workflows/ci.yml)
[![Documentation](https://github.com/BashaarJavaid/MCP-Sentinel/actions/workflows/docs.yml/badge.svg)](https://bashaarjavaid.github.io/MCP-Sentinel/)

**Build-time security scanning for MCP servers.**

PortunusMCP Sentinel scans local MCP server source before deployment. It combines
deterministic Python and TypeScript analysis, GPT-5.6 semantic review, optional
Docker-isolated runtime probes, OWASP Agentic Top 10 mappings, and validated
SARIF output for GitHub code scanning.

## Install

Sentinel supports Python 3.10–3.13 on Linux, macOS, and Windows. Install the
current package with [pipx](https://pipx.pypa.io/):

```bash
pipx install portunusmcp-sentinel
```

Or use uv:

```bash
uv tool install portunusmcp-sentinel
```

Rules-only commands below require **1.3.0 or newer**. Upgrade an existing install
with `pipx upgrade portunusmcp-sentinel` or `uv tool upgrade portunusmcp-sentinel`.

Reports expose observed handlers and recognition gaps, actual rule visits,
per-session runtime catalogs and sent attacks, and separate static/dynamic review
activity. Default findings include bounded evidence and repair guidance. Static
surface totals remain unknown; zero findings are not proof of safety. See the
[coverage and schema compatibility guide](docs/sarif.md#coverage-and-review-activity-native-160).
Phase 22 adds bounded imported handlers/schemas and containment flows;
computed registrations and unresolved source forms remain coverage gaps.
Permission sidecars express intended grants; they do not enforce runtime
boundaries. The Phase 22 integration source schedules bounded rounds across discovered
tools and supported fields (24 started attempts or 120 seconds by default).
Native 1.7.0 and campaign verification remain in progress; published releases
and historical evidence retain their recorded versions.

## Quickstart

From a local Python or TypeScript MCP server repository:

```bash
sentinel scan . --rules-only
```

Rules-only needs no model credentials, review cache, network, Docker, target
configuration, or target execution. It ignores inactive LLM settings even when
credentials and endpoint overrides are present. Installation and dependency
auditing need network access separately.

The Phase 22 integration source allows deterministic static analysis up to 1,800
seconds (30 minutes), with a 120-second informational target. Fast scans return
immediately;
expiry remains an incomplete scan. Model review and dynamic budgets are separate.
See the [timing policy](docs/phase22-timeout-policy.md) for measurement limits and
the retained failures; this change is not yet a published release.

Optionally run `sentinel init` afterward to generate a deny-by-default
`sentinel.permissions.yaml`; review scopes before granting them. It never imports
or executes source and needs no main guard or launch inference. Existing files
require `--force` for replacement; symlinks are rejected.

For Python runtime scaffolding, run `sentinel init --dynamic`, then
`sentinel scan . --no-rules-only`. Adding missing runtime configuration preserves
and validates an existing permissions file. Dynamic scans require Docker,
model credentials, source-context transmission, and model cost; dependency
installation also needs network access. TypeScript does not support `--dynamic`.
If generated arguments cannot complete a legitimate tool call, add known valid
[`probe_baselines`](docs/configuration.md#dynamic-outcomes-and-valid-examples) to
`sentinel.target.yaml`; an unsuccessful baseline leaves analysis incomplete.

Exit `0` and exit `1` both mean the scan completed: `0` means no finding reached
the configured threshold, while `1` means at least one did. Exit `2` is a target
or configuration error; exit `3` means analysis was incomplete.

## Analysis tiers

| Tier | Command | Requirements | Result |
|---|---|---|---|
| Rules-only | `sentinel scan . --rules-only` | None beyond Sentinel | Deterministic findings remain `needs_review` and fail-on eligible |
| Static + GPT review | `sentinel scan . --static-only` | `OPENAI_API_KEY` | GPT reviews every selected deterministic candidate |
| Full dynamic proof | `sentinel scan .` | `OPENAI_API_KEY`, Docker, and a Python target | GPT review plus four isolated runtime probes |

`--allow-degraded` permits unavailable review; it still calls the model when a
key is available. Use `--rules-only` to disable review explicitly. Completion
describes the selected analysis tier and does not prove a server is secure.

TypeScript support is static-only and covers `.ts`, `.mts`, and `.cts` sources
using the official MCP SDK v1 and server v2 shapes. JavaScript, TSX, declaration
files and Node execution are outside the supported boundary. Declared uv, npm
and pnpm workspaces support aggregate static scans with root Sentinel settings.
Bounded local imports, package exports and TypeScript source aliases feed
containment and handler inventory. Other rules retain their documented flow
limits. Dynamic targets are individual local Python 3.10–3.12 MCP packages.

Version 1.3.0 includes Phase 16 static-correctness changes: same-file
named-helper execution flows and value-specific validation, authentication,
integrity, and configured-sanitizer checks. Unsupported flows remain unresolved;
see the [rule boundaries](docs/rules.md) and
[verification record](docs/phase16-verification.md).

Phase 17 source changes add validated dynamic baselines, explicit probe outcomes,
and proof-preserving review in native JSON 1.6.0. The current replay bundle uses
one approved runtime-review refresh and four unchanged static captures. See the
[Phase 17 verification record](docs/phase17-verification.md) for gates and acceptance status.

This integration source emits native JSON 1.7.0 with ordered runtime attempts
and workspace coverage. Final Phase 22 verification and acceptance remain open;
historical reports and release evidence retain their recorded schema versions.

## Rules

Every finding uses a stable rule ID and maps to the OWASP Agentic Top 10.

| Rule | Detection | OWASP | Impact |
|---|---|---|---|
| [SENT-001](docs/rules.md#sent-001) | Overly broad tool permission scope | ASI03:2026 | High |
| [SENT-002](docs/rules.md#sent-002) | Tool input reaches unsafe execution | ASI05:2026 | Critical |
| [SENT-003](docs/rules.md#sent-003) | Missing tool input validation | ASI02:2026 | Medium |
| [SENT-004](docs/rules.md#sent-004) | Unsanitized tool content enters a prompt | ASI01:2026 | High |
| [SENT-005](docs/rules.md#sent-005) | Hardcoded credential | ASI03:2026 | Critical |
| [SENT-006](docs/rules.md#sent-006) | Missing or ineffective route authentication | ASI03:2026 | High |
| [SENT-007](docs/rules.md#sent-007) | Unverified tool manifest | ASI04:2026 | Medium |
| [SENT-008](docs/rules.md#sent-008) | Out-of-scope tool execution | ASI02:2026 | Critical |
| [SENT-009](docs/rules.md#sent-009) | Size-limit breach or observed OOM/crash | ASI05:2026 | Medium |
| [SENT-010](docs/rules.md#sent-010) | Injection payload executed | ASI05:2026 | Critical |
| [SENT-011](docs/rules.md#sent-011) | Malformed schema input processed | ASI02:2026 | Low |
| [SENT-012](docs/rules.md#sent-012) | Path containment failure | ASI02:2026 | High |
| [SENT-013](docs/rules.md#sent-013) | Tool-description poisoning | ASI01:2026 | High |
| [SENT-014](docs/rules.md#sent-014) | Command option injection | ASI05:2026 | Critical |
| [SENT-015](docs/rules.md#sent-015) | Server-side request forgery | ASI02:2026 | High |
| [SENT-016](docs/rules.md#sent-016) | Unauthorized operator-credential fallback | ASI03:2026 | High |

Published IDs are compatibility contracts: an ID is never renumbered or reused
for a different detection. The [rule catalog](docs/rules.md) documents each
engine, boundary, false-positive risk, evidence, and remediation.

## GitHub Action

The Marketplace Action runs the full Python pipeline, validates SARIF before
upload, and preserves Sentinel's exit contract.

```yaml
name: PortunusMCP Sentinel

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read
  security-events: write

jobs:
  sentinel:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - id: sentinel
        uses: BashaarJavaid/MCP-Sentinel@v1
        with:
          target-path: .
          fail-on: high
          openai-api-key: ${{ secrets.OPENAI_API_KEY }}
```

The Action exposes `sarif-path`, `findings-count`, and `highest-severity`.
Forked pull requests, where secrets are withheld, run visibly degraded analysis
and skip upload. High-assurance consumers can replace `@v1` with the immutable
commit SHA for the selected release.

## Architecture

```mermaid
flowchart LR
    A[Untrusted MCP repository] --> B[AST + Semgrep rules]
    B --> C[Canonical candidates]
    C --> D[GPT-5.6 semantic review]
    D --> E[Bounded ordered probe attempts]
    E --> F[Docker sandbox]
    F --> G[Reviewed dynamic evidence]
    D --> H[Deduplication + provenance merge]
    G --> H
    H --> I[Console]
    H --> J[JSON 1.7.0]
    H --> K[SARIF 2.1.0]
    K --> L[GitHub code scanning]
```

Static analysis never imports or executes target code. GPT receives bounded,
redacted context and can only review existing candidates or order four permanent
inert probes. Dynamic analysis mounts local Python source read-only in fresh
containers with no runtime network, resource limits, and forced cleanup. All
stages feed one canonical Finding model consumed by console, JSON, and SARIF.

PortunusMCP Sentinel is the build-time plane of the PortunusMCP family. The
[PortunusMCP Gateway](https://github.com/BashaarJavaid/PortunusMCP) provides
runtime enforcement in a separate repository, while PortunusMCP Identity is the
separate short-lived credential-broker plane. Neither is required by Sentinel.

## Configuration and adoption

Configuration precedence is CLI → `SENTINEL_*` environment → target-root
`sentinel.toml` → built-in defaults. A normal full scan also requires
`sentinel.target.yaml` and `sentinel.permissions.yaml`; `--static-only` does not
require launch configuration.

Create a baseline from a complete native JSON report, then compare later scans:

```bash
sentinel scan . --allow-degraded --format json --output sentinel-baseline.json
sentinel scan . --allow-degraded --baseline sentinel-baseline.json
```

Matched findings remain visible but do not affect `--fail-on`. Sentinel never
updates a baseline automatically.

Suppress a reviewed static source finding with a reason-bearing directive:

```python
# sentinel: ignore[SENT-005] reason=test credential is inert and rotated
api_key = "ghp_example"
```

Only static `SENT-001`–`SENT-007` and `SENT-012`–`SENT-016` findings can be suppressed. Applied
suppressions remain visible in every report; malformed, duplicate, unknown-rule,
or reasonless directives fail configuration validation.

Use Sentinel from pre-commit:

```yaml
repos:
  - repo: https://github.com/BashaarJavaid/MCP-Sentinel
    rev: v1.4.0
    hooks:
      - id: mcp-sentinel
```

See the [configuration guide](https://bashaarjavaid.github.io/MCP-Sentinel/configuration/)
for LLM endpoint trust, rule selection, baselines, suppressions, and pre-commit.

## CLI and report reference

```bash
# Full static, GPT, and Docker analysis
sentinel scan ./path/to/server

# Static analysis with required GPT review
sentinel scan ./path/to/server --static-only

# Validated SARIF
sentinel scan ./path/to/server --format sarif --output results.sarif

# Select rules and change the failure threshold
sentinel scan ./path/to/server --rules SENT-001,SENT-005 --fail-on critical

# Exercise the packaged reference pipeline
sentinel demo --replay-review --verbose
```

`--fail-on` accepts `critical`, `high`, `medium`, `low`, or `informational`.
Console output is the default; `--format json` and `--format sarif` are stable
machine-readable paths. Validate reports offline with:

```bash
python -m sentinel.schema check
python -m sentinel.report.validate_sarif results.sarif
```

The production reviewer uses GPT-5.6 Sol through the Responses API with
`store: false`, medium reasoning effort, strict Structured Outputs, bounded
context, and host-validated evidence. Sentinel's public OpenAI cost calculation
uses the rates recorded on 2026-09-04: $4/M input, $0.40/M cached input, and
$20/M output, with cache writes at 1.25× input. See the official
[GPT-5.6 Sol model and pricing page](https://developers.openai.com/api/docs/models/gpt-5.6-sol)
and [Responses API create reference](https://developers.openai.com/api/reference/cli/resources/responses/methods/create).
Compatible endpoints retain token usage but report pricing as unavailable.

## Project resources

- [Scan a real MCP server before release](https://bashaarjavaid.github.io/MCP-Sentinel/walkthrough/)
- [Marketplace Action](https://github.com/marketplace/actions/mcp-sentinel)
- [Documentation](https://bashaarjavaid.github.io/MCP-Sentinel/)
- [Architecture contract](ARCHITECTURE.md)
- [Roadmap](ROADMAP.md)
- [Contributing](CONTRIBUTING.md)
- [SARIF guide](https://bashaarjavaid.github.io/MCP-Sentinel/sarif/)
- [Changelog](CHANGELOG.md)
- [Security policy](SECURITY.md)
- [Project history](docs/hackathon.md)

PortunusMCP Sentinel is MIT licensed. Dependency licenses and packaged notices
are recorded in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
