From 8cc31f1e5f18801af6ccedf44100c9343cb9fb86 Mon Sep 17 00:00:00 2001 From: haelyra <49814733+haelyra@users.noreply.github.com> Date: Mon, 7 Sep 2026 16:41:45 -0400 Subject: [PATCH] docs(release): record reviewed 2.2.1 bug fixes and verification boundaries --- docs/releases/2.2.1/patch-execution.md | 21 +++++++-- docs/releases/2.2.1/release-notes.md | 62 ++++++++++++++++++++++++-- 2 files changed, 77 insertions(+), 6 deletions(-) diff --git a/docs/releases/2.2.1/patch-execution.md b/docs/releases/2.2.1/patch-execution.md index 6f0b7d8a9..bc8fcd2d3 100644 --- a/docs/releases/2.2.1/patch-execution.md +++ b/docs/releases/2.2.1/patch-execution.md @@ -62,14 +62,29 @@ outside this patch. | GateGuard exemptions | #2979, #2921 | 192 cases; relative globs constrained to project, explicit absolute globs retained | | Plugin dependency loading | #2994, #2822 | 10 cases; help/list paths need no third-party modules, required dependency failures are explicit | | Yarn dependency security | Dependabot alert #62 | toml 4.3.0 matches npm lock; immutable Yarn install and recursive audit pass | +| PowerShell security | #2961 | 52 classifier cases, combined governance and GateGuard regressions; late-assignment bypass repaired | +| Manual Claude hooks | #2992, #2982 | 36 settings, 66 lifecycle, 42 install-apply cases; concurrent-edit and observed parent-swap tests | +| Installer data protection | #2980, #2981, #2956 | 23 ownership, 13 uninstall cases; all 15 target collision checks and failed-checkpoint regressions | +| Observer retention | #2971, #2673 | Merged cf065358 after 45 green hosted checks and independent review | +| Harness setup instructions | #2977, #2958, #2957 | 4 regressions; documented CLI, pinned real optional memory package, no fabricated scheduling server | Plugin dependency handling does not bundle or automatically install modules. Database and schema-validation features still require declared runtime packages. -The high-priority installer and manual Claude registration candidates remain -under independent review and have not yet been included in this integration. +The installer, PowerShell, and manual Claude registration fixes are now combined +and independently reviewed. Conflict resolutions preserve both project-scoped +exemptions and PowerShell enforcement, plus Claude settings locking and installer +ownership/checkpoint protections. Focused combined suites pass. + +Claude settings pathname checks detect observed parent swaps and concurrent +edits; they are not a native filesystem isolation boundary. The residual race +between a final check and rename remains a follow-up, not a race-free claim. +Successful managed-file upgrades retain their existing replacement semantics. ## Completion evidence -Pending integration, hosted validation, signed tag, publication, registry +First batch 82bfd225 passed 4,215/4,215 tests and lint. Integrated full validation +and hosted checks are pending. Signing remains unavailable locally. + +Pending final hosted validation, signed tag, publication, registry integrity readback, and clean lifecycle canaries. This document does not claim that 2.2.1 has shipped. diff --git a/docs/releases/2.2.1/release-notes.md b/docs/releases/2.2.1/release-notes.md index b8d7d5795..d56c4f4ae 100644 --- a/docs/releases/2.2.1/release-notes.md +++ b/docs/releases/2.2.1/release-notes.md @@ -1,8 +1,53 @@ # ECC 2.2.1 -ECC 2.2.1 is the signed ECC 2.2 patch release. It keeps the published `v2.2.0` -history immutable while shipping the reviewed release-surface hardening that -landed after the original 2.2.0 tag. +ECC 2.2.1 is a bug and security patch for ECC 2.2. It keeps the published +`v2.2.0` history immutable. These notes describe the prepared patch; publication +and signing evidence are tracked separately in the release checklist. + +## Security and data protection + +- GateGuard and governance capture recognize destructive PowerShell commands, + including the native PowerShell tool path. Dynamic command handling prevents + later variable assignments from concealing earlier unresolved invocations + ([#2961](https://github.com/affaan-m/ECC/pull/2961)). +- Relative GateGuard exemption globs stay within the project root. Explicit + absolute exemptions remain supported + ([#2921](https://github.com/affaan-m/ECC/issues/2921)). +- Installer writes reject collisions with untracked user-owned files. Failed + installs checkpoint only files they actually wrote, preserving the previous + ownership hashes of untouched managed files + ([#2964](https://github.com/affaan-m/ECC/issues/2964)). +- Uninstall respects `ECC_DRY_RUN=1`, including legacy Codex paths, and rejects + invalid dry-run values instead of silently allowing deletion + ([#2952](https://github.com/affaan-m/ECC/issues/2952)). +- Observer analysis retains observations on unsuccessful or unconfirmed + processing. Exit code zero alone no longer permits archival + ([#2971](https://github.com/affaan-m/ECC/pull/2971)). +- The Yarn lockfile updates `toml` to 4.3.0, matching the npm lockfile and + removing the affected older resolution. + +## Hooks and installation + +- Manual Claude installs register ECC-owned hook entries in Claude settings. + Repair, consent changes, and uninstall reconcile those entries while + preserving unrelated settings. Atomic settings updates check directory + identity and retry detected concurrent edits + ([#2992](https://github.com/affaan-m/ECC/pull/2992)). +- Direct hook entrypoints handle larger JSON payloads with bounded, UTF-8-safe + reads instead of silently truncating valid inputs. Existing production + wrapper limits remain unchanged + ([#2924](https://github.com/affaan-m/ECC/issues/2924)). +- The Pi adapter selects an actual Node runtime instead of recursively + executing a compiled OMP host as Node + ([#2909](https://github.com/affaan-m/ECC/issues/2909)). +- Installer listing and control-pane help avoid eager third-party dependency + loading. Features that require absent runtime packages report the missing + dependency explicitly + ([#2994](https://github.com/affaan-m/ECC/pull/2994)). +- Autonomous harness setup documentation replaces nonexistent package names + and unsupported CLI flags with documented interfaces, and distinguishes + session scheduling from a durable external scheduler + ([#2957](https://github.com/affaan-m/ECC/issues/2957)). ## Installer and release-surface hardening @@ -32,6 +77,17 @@ landed after the original 2.2.0 tag. - `v2.2.0` remains the immutable historical unsigned exception. Do not move, recreate, or reuse that tag. +## Scope and limitations + +- Plugin dependency handling does not bundle or automatically install missing + modules. Database and schema-validation features require their declared + runtime dependencies. +- Ownership protection covers untracked collisions and failed-install + checkpoints. Successful upgrades retain the existing contract for replacing + previously managed files. Back up intentional edits before upgrading. +- This patch does not introduce new harness platforms or claim that every + open community issue is resolved. + ## Upgrade Install or update the published package, then run the same ECC command path you