Commits

Commits on Sep 14, 2026

merge: authorized-remote door - relax scope to authorized plus rail-protected, cited to committed tests and archive
Lang
committed
6b669c4
merge: hermetic remote-safety lock (C4) — non-vacuous fail-closed proofs; test-only
Lang
committed
072a4d8
docs: tighten remote-test citation (self-audit — avoid over-claim)
Lang
committed
d2dd7f8
docs+test(remote): open the authorized-remote door, backed by a committed e2e remote proof + archived run
Lang
committed
642cdb7
test(security): lock the remote / non-loopback safety rails (C4 gap)
Lang
committed
af04e90
merge: verify --target-file (P1) — human golden path builds op via build_op + spec_from_endpoints; no op.json/spec for the common case
Lang
committed
314b347
feat(verify): --target-file builds the op + synthesizes the spec from a saved Target (P1)
Lang
committed
a6fd863
merge: reconcile docs to code fact + public PROJECT_STATUS surface + commit 2 tracked tests
Lang
committed
45d44de
docs: reconcile docs to code fact + add a public status/direction surface
Lang
committed
8b2779d

Commits on Sep 12, 2026

merge: SSRF confirmation via OOB (first non-access-control type) + OOB client CTR/ordering fix
Lang
committed
fea5d45
feat(ssrf): SSRF confirmation via out-of-band interactsh callback — first non-access-control type
Lang
committed
30b939b
merge: fix 3 stale in-code comments (OAuth/FastAPI/hunter) to match shipped code
Lang
committed
d841dd4
docs(comments): fix 3 stale in-code comments/docstrings to match shipped code
Lang
committed
4f891c8
merge: doc reconciliation — VERIFY_ENGINE CLI reality + auth/provider docs + honesty on unproven claims
Lang
committed
d2e2a15
docs: document the auth layer + provider seam; keep remote/DeepSeek claims honest
Lang
committed
c016fa9
docs(verify-engine): reconcile VERIFY_ENGINE.md to the CLI-only reality (A1)
Lang
committed
513366b
merge: interactsh OOB client (infra) + D29 query-string IDOR end-to-end lab
Lang
committed
584a816
feat(oob+d29): interactsh OOB client (infra) + end-to-end query-string IDOR proof
Lang
committed
7cb2548
merge: remote-target confirmation + tiered-verdict framework
Lang
committed
98c62f4
docs: document remote-target support (+safety scope) and the tiered-verdict model
Lang
committed
7af342b
tiers: add an explicit verdict-strength framework with CONFIRMED reserved by construction
Lang
committed
7b94307
remote: enable authorized-remote targets with an SSRF/rebinding preflight
Lang
committed
63b0c96

Commits on Sep 11, 2026

action: shorten Marketplace description to under 125 chars
Lang
committed
b04fdd4
merge: GitHub Action confirmation gate (feat/github-action)
Lang
committed
5e9bdc7
docs: document the CI confirmation-gate GitHub Action
Lang
committed
937f14b
ci: self-test the confirmation-gate Action on every relevant push
Lang
committed
bde448e
ci: add the BOLA/IDOR confirmation-gate GitHub Action
Lang
committed
16788f2

Commits on Aug 24, 2026

site: publish "The 200 That Proved Nothing" + relocate its source to docs/writing/
Lang
committed
9ee6dc9

Commits on Aug 23, 2026

cli console: verify a SPEC-LESS target by synthesizing a minimal spec
Lang
committed
af06644
test(cli): land the real-process CLI harness + realproc tests; fix the rename staleness
Lang
committed
70f910d
docs: reproduction compares against the baseline instead of overwriting it
Lang
committed
4517e70
docs: state what the real-target archive can and cannot prove
Lang
committed
3197008
docs: report runs and model calls as different quantities (~1.8x, not 1x)
Lang
committed
8dc1133
docs: name sweep_highN.jsonl canonical and volunteer the 79-vs-77 delta
Lang
committed
a609e07
config: default GEMINI_PRO_MODEL to gemini-2.5-pro, the measured model
Lang
committed
e2efe08