Skip to content

docs: v3.2.0 VSIX provenance, inventory, dependency audit, scans + reproducibility (THQ-132-136) - #518

Merged
vkgeorgia merged 7 commits into
mainfrom
transitrix-studio/132-vsix-provenance-acquire
Aug 12, 2026
Merged

docs: v3.2.0 VSIX provenance, inventory, dependency audit, scans + reproducibility (THQ-132-136)#518
vkgeorgia merged 7 commits into
mainfrom
transitrix-studio/132-vsix-provenance-acquire

Conversation

@transitrix

@transitrix transitrix commented Aug 11, 2026 •
edited by vkgeorgia
Loading

Copy link
Copy Markdown
Owner

Summary

  • THQ-132 — acquires the four published v3.2.0 platform VSIX files from Open VSX (Actions artefacts for the Marketplace publish run were not retained — 0 results) and fixes their identity via SHA-256, cross-checked against Open VSX's own published .sha256.
  • THQ-133 — path-level + binary inventory: every one of the 517 paths in each artefact classified as repository source, generated build output (naming the extension:prep script), or a dependency at its resolved exact version — evidence-based against git ls-tree, the build scripts, and each package's own package.json. No stop-and-report trigger. Separate binary/machine-generated-bundle table with runtime-required status. Cross-platform note: 3 of 4 artefacts are byte-identical except each platform's own native @resvg/resvg-js binary; win32-x64 additionally carries CRLF line endings in 13 small text/JSON/SVG files (real difference in the published bytes, consistent with a Windows CI checkout).
  • THQ-134 — dependency-tree reconstruction (7 direct + 19 transitive) and advisory check. Finding: extension/ is not an npm workspace member and its build step installs with --no-package-lock in an isolated temp dir, so root package-lock.json never governed these versions — the published artefact itself (already inventoried in feat(cli): add transitrix bin alias, deprecate cervin (P1) #133) is the only authoritative record. All 26 packages queried against OSV.dev: zero vulnerabilities. Registry metadata (publish date, maintainers, signatures/provenance) recorded per package. Cross-checked against the repo's 4 open Dependabot alerts — none overlap the shipped dependency set (they're all root-workspace tooling deps).
  • THQ-135 — two independent third-party scan engines (Microsoft Defender local on-demand scan; VirusTotal hash-lookup-then-upload) across all four .vsix and their unpacked binary components. Zero malicious/suspicious verdicts on every artefact, every engine.
  • THQ-136 — rebuild from tag v3.2.0, win32-x64 target (the only build host available). Byte-for-byte content match against the published win32-x64 artefact: 519/519 files, zero content-hash mismatches; the outer .vsix hash differs only by zip-entry timestamps (build nondeterminism, not content). The other three published platforms are not independently rebuilt (no matching build host in this run's environment) — path-diffed instead against the local rebuild and against feat(cli): add transitrix bin alias, deprecate cervin (P1) #133's existing cross-platform inventory, with the only delta being each platform's own declared, version-pinned native binary, explained not remediated. Writes the epic's finding.

Together these close THQ-130 (provenance and binary-content audit, opened after the VS Marketplace listing was removed as Malware — THQ-127) with finding (a): every file in every published artefact traces to a declared, pinned, published dependency version or to repository source, with hashes. The Marketplace artefacts themselves could not be examined (no retrievable bytes — see #132's amendment); the finding is scoped to the Open VSX artefacts, which is stated explicitly rather than silently substituted.

.vsix binaries are not committed (.gitignore already excludes *.vsix); the Open VSX URLs are stable so later tasks can re-fetch identical bytes on demand. The one local .vsix build performed for the reproducibility check (THQ-136) was explicitly authorised by Valerii for that single purpose and was never published.

Test plan

  • sha256sum on each downloaded .vsix matches the corresponding Open VSX .sha256 file
  • Every path in every artefact traces to a git-tracked source, a named generating script, or a package@version read from that package's own package.json
  • Resolved versions of all 7 direct runtime dependencies satisfy the semver ranges declared in extension/package.json
  • All 26 shipped packages queried against OSV.dev — zero vulnerabilities
  • Two independent scan engines report zero malicious/suspicious across all four artefacts
  • Rebuild from tag v3.2.0 (win32-x64) matches the published artefact byte-for-byte on content; every remaining difference (zip timestamps, other-platform native binary, CRLF/LF) is explained
  • No registry/release/artefact was published, modified, or deleted (read-only constraint), except the single authorised local, unpublished .vsix build for the reproducibility check
  • No packaging/publishing workflow changed

@transitrix
docs: record v3.2.0 VSIX provenance and SHA-256 (transitrix-hq#132)
e643d41 
Acquires the four published platform VSIX files from Open VSX (Actions
artefacts for the publish run were not retained) and fixes their
identity via SHA-256, cross-checked against Open VSX's own published
hashes. Feeds the epic transitrix-hq#130 audit opened after the VS
Marketplace listing was removed as Malware (transitrix-hq#127).

Signed-off-by: transitrix <279946036+transitrix@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

📊 Metrics Regression Report

✅ All metrics within tolerance

Summary

  • Diagrams tested: 9
  • Successful: 9
  • Failed: 0
  • Violations: 0

Details

ai-expense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 1868 1868 0.00 (0.0%) ✓
waypointDensity 2.6 2.6 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.48125 0.48125 0.00 ✓
portViolations 0 0 0.00 ✓

feature-release.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 13 13 0.00 ✓
edgeLength 3428 3428 0.00 (0.0%) ✓
waypointDensity 3 3 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5500909090909091 0.5500909090909091 0.00 ✓
portViolations 0 0 0.00 ✓

large-cyclic-workflow.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 2 2 0.00 ✓
bends 28 28 0.00 ✓
edgeLength 7479 7479 0.00 (0.0%) ✓
waypointDensity 3.12 3.12 0.00 (0.0%) ✓
spineDeviation 66 66 0.00 ✓
emptyArea 0.793134974640294 0.793134974640294 0.00 ✓
portViolations 1 1 0.00 ✓

order-fulfillment.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 2 2 0.00 ✓
edgeLength 728 728 0.00 (0.0%) ✓
waypointDensity 2.3333333333333335 2.3333333333333335 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5622894736842106 0.5622894736842106 0.00 ✓
portViolations 0 0 0.00 ✓

parallel-tracks.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 2104 2104 0.00 (0.0%) ✓
waypointDensity 2.6666666666666665 2.6666666666666665 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.6834468042259194 0.6834468042259194 0.00 ✓
portViolations 0 0 0.00 ✓

simple-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 8 8 0.00 ✓
edgeLength 1450 1450 0.00 (0.0%) ✓
waypointDensity 3.142857142857143 3.142857142857143 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.7764882411250177 0.7764882411250177 0.00 ✓
portViolations 0 0 0.00 ✓

simple-linear.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 0 0 0.00 ✓
edgeLength 440 440 0.00 (0.0%) ✓
waypointDensity 2 2 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5258771929824562 0.5258771929824562 0.00 ✓
portViolations 0 0 0.00 ✓

small-dense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 14 14 0.00 ✓
edgeLength 2066 2066 0.00 (0.0%) ✓
waypointDensity 3.272727272727273 3.272727272727273 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.8091206777597997 0.8091206777597997 0.00 ✓
portViolations 0 0 0.00 ✓

xlarge-stress-test.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 1 +1.00 ✓
bends 62 64 +2.00 ✓
edgeLength 11526 11674 +148.00 (1.3%) ✓
waypointDensity 3.1481481481481484 3.185185185185185 +0.04 (1.2%) ✓
spineDeviation 132 132 0.00 ✓
emptyArea 0.8201716840253008 0.8201716840253008 0.00 ✓
portViolations 0 0 0.00 ✓

@transitrix
docs: path-level + binary inventory of v3.2.0 VSIX (transitrix-hq#133)
a9d7d02 
Classifies every one of the 517 paths in each of the four platform
VSIX (repo source / generated build output / dependency@version),
all evidence-based against git-tracked paths, extension:prep's
generating scripts, and each node_modules package's own package.json
- no stop-and-report trigger, nothing untraced. Separately inventories
every binary/machine-generated entry with runtime-required status.
Extends the transitrix-hq#132 audit folder per that task's own PR-reuse
instruction.

Signed-off-by: transitrix <279946036+transitrix@users.noreply.github.com>
@transitrix transitrix changed the title docs: record v3.2.0 VSIX provenance and SHA-256 (transitrix-hq#132) docs: v3.2.0 VSIX provenance, SHA-256 and path inventory (transitrix-hq#132, #133) Aug 11, 2026
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

📊 Metrics Regression Report

✅ All metrics within tolerance

Summary

  • Diagrams tested: 9
  • Successful: 9
  • Failed: 0
  • Violations: 0

Details

ai-expense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 1868 1868 0.00 (0.0%) ✓
waypointDensity 2.6 2.6 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.48125 0.48125 0.00 ✓
portViolations 0 0 0.00 ✓

feature-release.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 13 13 0.00 ✓
edgeLength 3428 3428 0.00 (0.0%) ✓
waypointDensity 3 3 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5500909090909091 0.5500909090909091 0.00 ✓
portViolations 0 0 0.00 ✓

large-cyclic-workflow.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 2 2 0.00 ✓
bends 28 28 0.00 ✓
edgeLength 7479 7479 0.00 (0.0%) ✓
waypointDensity 3.12 3.12 0.00 (0.0%) ✓
spineDeviation 66 66 0.00 ✓
emptyArea 0.793134974640294 0.793134974640294 0.00 ✓
portViolations 1 1 0.00 ✓

order-fulfillment.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 2 2 0.00 ✓
edgeLength 728 728 0.00 (0.0%) ✓
waypointDensity 2.3333333333333335 2.3333333333333335 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5622894736842106 0.5622894736842106 0.00 ✓
portViolations 0 0 0.00 ✓

parallel-tracks.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 2104 2104 0.00 (0.0%) ✓
waypointDensity 2.6666666666666665 2.6666666666666665 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.6834468042259194 0.6834468042259194 0.00 ✓
portViolations 0 0 0.00 ✓

simple-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 8 8 0.00 ✓
edgeLength 1450 1450 0.00 (0.0%) ✓
waypointDensity 3.142857142857143 3.142857142857143 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.7764882411250177 0.7764882411250177 0.00 ✓
portViolations 0 0 0.00 ✓

simple-linear.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 0 0 0.00 ✓
edgeLength 440 440 0.00 (0.0%) ✓
waypointDensity 2 2 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5258771929824562 0.5258771929824562 0.00 ✓
portViolations 0 0 0.00 ✓

small-dense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 14 14 0.00 ✓
edgeLength 2066 2066 0.00 (0.0%) ✓
waypointDensity 3.272727272727273 3.272727272727273 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.8091206777597997 0.8091206777597997 0.00 ✓
portViolations 0 0 0.00 ✓

xlarge-stress-test.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 1 +1.00 ✓
bends 62 64 +2.00 ✓
edgeLength 11526 11674 +148.00 (1.3%) ✓
waypointDensity 3.1481481481481484 3.185185185185185 +0.04 (1.2%) ✓
spineDeviation 132 132 0.00 ✓
emptyArea 0.8201716840253008 0.8201716840253008 0.00 ✓
portViolations 0 0 0.00 ✓

@transitrix
docs: v3.2.0 dependency tree + advisory check (transitrix-hq#134)
38c7d0e 
Reconstructs the 7 direct + 19 transitive runtime dependencies from
the exact versions already inventoried in transitrix-hq#133 (read out
of the published VSIX itself, not reinstalled). Finding: extension/ is
not an npm workspace member and its own build step installs with
--no-package-lock in an isolated temp dir, so root package-lock.json
never governed these versions - the artefact itself is the only
authoritative record, which is what this check uses. All 26 packages
queried against OSV.dev: zero vulnerabilities. Registry metadata
(publish date, maintainers, signatures/provenance) recorded for each.

Signed-off-by: transitrix <279946036+transitrix@users.noreply.github.com>
@transitrix
docs: cross-check dependency audit against Dependabot alerts (transit…
9ca975e 
…rix-hq#134)

Confirms the 4 open repo-level Dependabot alerts are all root
package-lock.json (tooling) dependencies, none overlapping the 26
packages shipped inside the VSIX.

Signed-off-by: transitrix <279946036+transitrix@users.noreply.github.com>
@transitrix transitrix changed the title docs: v3.2.0 VSIX provenance, SHA-256 and path inventory (transitrix-hq#132, #133) docs: v3.2.0 VSIX provenance, inventory and dependency audit (transitrix-hq#132-134) Aug 11, 2026
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

📊 Metrics Regression Report

✅ All metrics within tolerance

Summary

  • Diagrams tested: 9
  • Successful: 9
  • Failed: 0
  • Violations: 0

Details

ai-expense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 1868 1868 0.00 (0.0%) ✓
waypointDensity 2.6 2.6 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.48125 0.48125 0.00 ✓
portViolations 0 0 0.00 ✓

feature-release.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 13 13 0.00 ✓
edgeLength 3428 3428 0.00 (0.0%) ✓
waypointDensity 3 3 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5500909090909091 0.5500909090909091 0.00 ✓
portViolations 0 0 0.00 ✓

large-cyclic-workflow.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 2 2 0.00 ✓
bends 28 28 0.00 ✓
edgeLength 7479 7479 0.00 (0.0%) ✓
waypointDensity 3.12 3.12 0.00 (0.0%) ✓
spineDeviation 66 66 0.00 ✓
emptyArea 0.793134974640294 0.793134974640294 0.00 ✓
portViolations 1 1 0.00 ✓

order-fulfillment.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 2 2 0.00 ✓
edgeLength 728 728 0.00 (0.0%) ✓
waypointDensity 2.3333333333333335 2.3333333333333335 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5622894736842106 0.5622894736842106 0.00 ✓
portViolations 0 0 0.00 ✓

parallel-tracks.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 2104 2104 0.00 (0.0%) ✓
waypointDensity 2.6666666666666665 2.6666666666666665 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.6834468042259194 0.6834468042259194 0.00 ✓
portViolations 0 0 0.00 ✓

simple-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 8 8 0.00 ✓
edgeLength 1450 1450 0.00 (0.0%) ✓
waypointDensity 3.142857142857143 3.142857142857143 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.7764882411250177 0.7764882411250177 0.00 ✓
portViolations 0 0 0.00 ✓

simple-linear.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 0 0 0.00 ✓
edgeLength 440 440 0.00 (0.0%) ✓
waypointDensity 2 2 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5258771929824562 0.5258771929824562 0.00 ✓
portViolations 0 0 0.00 ✓

small-dense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 14 14 0.00 ✓
edgeLength 2066 2066 0.00 (0.0%) ✓
waypointDensity 3.272727272727273 3.272727272727273 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.8091206777597997 0.8091206777597997 0.00 ✓
portViolations 0 0 0.00 ✓

xlarge-stress-test.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 1 +1.00 ✓
bends 62 64 +2.00 ✓
edgeLength 11526 11674 +148.00 (1.3%) ✓
waypointDensity 3.1481481481481484 3.185185185185185 +0.04 (1.2%) ✓
spineDeviation 132 132 0.00 ✓
emptyArea 0.8201716840253008 0.8201716840253008 0.00 ✓
portViolations 0 0 0.00 ✓

1 similar comment
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

📊 Metrics Regression Report

✅ All metrics within tolerance

Summary

  • Diagrams tested: 9
  • Successful: 9
  • Failed: 0
  • Violations: 0

Details

ai-expense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 1868 1868 0.00 (0.0%) ✓
waypointDensity 2.6 2.6 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.48125 0.48125 0.00 ✓
portViolations 0 0 0.00 ✓

feature-release.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 13 13 0.00 ✓
edgeLength 3428 3428 0.00 (0.0%) ✓
waypointDensity 3 3 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5500909090909091 0.5500909090909091 0.00 ✓
portViolations 0 0 0.00 ✓

large-cyclic-workflow.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 2 2 0.00 ✓
bends 28 28 0.00 ✓
edgeLength 7479 7479 0.00 (0.0%) ✓
waypointDensity 3.12 3.12 0.00 (0.0%) ✓
spineDeviation 66 66 0.00 ✓
emptyArea 0.793134974640294 0.793134974640294 0.00 ✓
portViolations 1 1 0.00 ✓

order-fulfillment.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 2 2 0.00 ✓
edgeLength 728 728 0.00 (0.0%) ✓
waypointDensity 2.3333333333333335 2.3333333333333335 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5622894736842106 0.5622894736842106 0.00 ✓
portViolations 0 0 0.00 ✓

parallel-tracks.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 2104 2104 0.00 (0.0%) ✓
waypointDensity 2.6666666666666665 2.6666666666666665 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.6834468042259194 0.6834468042259194 0.00 ✓
portViolations 0 0 0.00 ✓

simple-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 8 8 0.00 ✓
edgeLength 1450 1450 0.00 (0.0%) ✓
waypointDensity 3.142857142857143 3.142857142857143 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.7764882411250177 0.7764882411250177 0.00 ✓
portViolations 0 0 0.00 ✓

simple-linear.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 0 0 0.00 ✓
edgeLength 440 440 0.00 (0.0%) ✓
waypointDensity 2 2 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5258771929824562 0.5258771929824562 0.00 ✓
portViolations 0 0 0.00 ✓

small-dense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 14 14 0.00 ✓
edgeLength 2066 2066 0.00 (0.0%) ✓
waypointDensity 3.272727272727273 3.272727272727273 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.8091206777597997 0.8091206777597997 0.00 ✓
portViolations 0 0 0.00 ✓

xlarge-stress-test.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 1 +1.00 ✓
bends 62 64 +2.00 ✓
edgeLength 11526 11674 +148.00 (1.3%) ✓
waypointDensity 3.1481481481481484 3.185185185185185 +0.04 (1.2%) ✓
spineDeviation 132 132 0.00 ✓
emptyArea 0.8201716840253008 0.8201716840253008 0.00 ✓
portViolations 0 0 0.00 ✓

@transitrix
docs: partial third-party scan of v3.2.0 VSIX (transitrix-hq#135)
1d3e40f 
Records clean Microsoft Defender verdicts (local, on-demand, fresh
signatures) against all four published VSIX and the full unpacked
tree covering every binary/non-plaintext component from
transitrix-hq#133. A second independent engine is blocked: no
scanner API key is available (VirusTotal/MetaDefender-class services
all require one) and ClamAV is not installed locally - acquiring
either is a new external dependency, not this run's call to make.
Issue stays open pending that decision.

Signed-off-by: transitrix <279946036+transitrix@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

📊 Metrics Regression Report

✅ All metrics within tolerance

Summary

  • Diagrams tested: 9
  • Successful: 9
  • Failed: 0
  • Violations: 0

Details

ai-expense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 1868 1868 0.00 (0.0%) ✓
waypointDensity 2.6 2.6 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.48125 0.48125 0.00 ✓
portViolations 0 0 0.00 ✓

feature-release.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 13 13 0.00 ✓
edgeLength 3428 3428 0.00 (0.0%) ✓
waypointDensity 3 3 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5500909090909091 0.5500909090909091 0.00 ✓
portViolations 0 0 0.00 ✓

large-cyclic-workflow.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 2 2 0.00 ✓
bends 28 28 0.00 ✓
edgeLength 7479 7479 0.00 (0.0%) ✓
waypointDensity 3.12 3.12 0.00 (0.0%) ✓
spineDeviation 66 66 0.00 ✓
emptyArea 0.793134974640294 0.793134974640294 0.00 ✓
portViolations 1 1 0.00 ✓

order-fulfillment.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 2 2 0.00 ✓
edgeLength 728 728 0.00 (0.0%) ✓
waypointDensity 2.3333333333333335 2.3333333333333335 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5622894736842106 0.5622894736842106 0.00 ✓
portViolations 0 0 0.00 ✓

parallel-tracks.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 2104 2104 0.00 (0.0%) ✓
waypointDensity 2.6666666666666665 2.6666666666666665 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.6834468042259194 0.6834468042259194 0.00 ✓
portViolations 0 0 0.00 ✓

simple-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 8 8 0.00 ✓
edgeLength 1450 1450 0.00 (0.0%) ✓
waypointDensity 3.142857142857143 3.142857142857143 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.7764882411250177 0.7764882411250177 0.00 ✓
portViolations 0 0 0.00 ✓

simple-linear.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 0 0 0.00 ✓
edgeLength 440 440 0.00 (0.0%) ✓
waypointDensity 2 2 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5258771929824562 0.5258771929824562 0.00 ✓
portViolations 0 0 0.00 ✓

small-dense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 14 14 0.00 ✓
edgeLength 2066 2066 0.00 (0.0%) ✓
waypointDensity 3.272727272727273 3.272727272727273 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.8091206777597997 0.8091206777597997 0.00 ✓
portViolations 0 0 0.00 ✓

xlarge-stress-test.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 1 +1.00 ✓
bends 62 64 +2.00 ✓
edgeLength 11526 11674 +148.00 (1.3%) ✓
waypointDensity 3.1481481481481484 3.185185185185185 +0.04 (1.2%) ✓
spineDeviation 132 132 0.00 ✓
emptyArea 0.8201716840253008 0.8201716840253008 0.00 ✓
portViolations 0 0 0.00 ✓

@github-actions github-actions Bot added the needs:human-merge Mergeable but not simple - requires human review/merge label Aug 11, 2026
@vkgeorgia @transitrix
docs: complete v3.2.0 VSIX third-party scan with VirusTotal (transitr…
bd5c538 
…ix-hq#135)

Second independent engine, unblocked by Valerii's VirusTotal API key decision
on transitrix-hq#135. All four published VSIX hashes verified clean.

Signed-off-by: transitrix <279946036+transitrix@users.noreply.github.com>
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

📊 Metrics Regression Report

✅ All metrics within tolerance

Summary

  • Diagrams tested: 9
  • Successful: 9
  • Failed: 0
  • Violations: 0

Details

ai-expense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 1868 1868 0.00 (0.0%) ✓
waypointDensity 2.6 2.6 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.48125 0.48125 0.00 ✓
portViolations 0 0 0.00 ✓

feature-release.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 13 13 0.00 ✓
edgeLength 3428 3428 0.00 (0.0%) ✓
waypointDensity 3 3 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5500909090909091 0.5500909090909091 0.00 ✓
portViolations 0 0 0.00 ✓

large-cyclic-workflow.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 2 2 0.00 ✓
bends 28 28 0.00 ✓
edgeLength 7479 7479 0.00 (0.0%) ✓
waypointDensity 3.12 3.12 0.00 (0.0%) ✓
spineDeviation 66 66 0.00 ✓
emptyArea 0.793134974640294 0.793134974640294 0.00 ✓
portViolations 1 1 0.00 ✓

order-fulfillment.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 2 2 0.00 ✓
edgeLength 728 728 0.00 (0.0%) ✓
waypointDensity 2.3333333333333335 2.3333333333333335 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5622894736842106 0.5622894736842106 0.00 ✓
portViolations 0 0 0.00 ✓

parallel-tracks.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 2104 2104 0.00 (0.0%) ✓
waypointDensity 2.6666666666666665 2.6666666666666665 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.6834468042259194 0.6834468042259194 0.00 ✓
portViolations 0 0 0.00 ✓

simple-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 8 8 0.00 ✓
edgeLength 1450 1450 0.00 (0.0%) ✓
waypointDensity 3.142857142857143 3.142857142857143 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.7764882411250177 0.7764882411250177 0.00 ✓
portViolations 0 0 0.00 ✓

simple-linear.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 0 0 0.00 ✓
edgeLength 440 440 0.00 (0.0%) ✓
waypointDensity 2 2 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5258771929824562 0.5258771929824562 0.00 ✓
portViolations 0 0 0.00 ✓

small-dense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 14 14 0.00 ✓
edgeLength 2066 2066 0.00 (0.0%) ✓
waypointDensity 3.272727272727273 3.272727272727273 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.8091206777597997 0.8091206777597997 0.00 ✓
portViolations 0 0 0.00 ✓

xlarge-stress-test.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 1 +1.00 ✓
bends 62 64 +2.00 ✓
edgeLength 11526 11674 +148.00 (1.3%) ✓
waypointDensity 3.1481481481481484 3.185185185185185 +0.04 (1.2%) ✓
spineDeviation 132 132 0.00 ✓
emptyArea 0.8201716840253008 0.8201716840253008 0.00 ✓
portViolations 0 0 0.00 ✓

@transitrix
docs: v3.2.0 reproducibility check + epic finding (transitrix-hq#136)
fc3a07b 
Rebuild from tag v3.2.0 (win32-x64 target, the only build host available
this run) matches the published Open VSX artefact byte-for-byte across all
519 files; the outer .vsix hash differs only by zip-entry timestamps. The
other three published platforms are not independently rebuilt here (no
matching build host) but path-diff cleanly against the local rebuild and
against transitrix-hq#133's existing cross-platform inventory, with every
delta explained. Closes the epic (transitrix-hq#130) with finding (a).

Signed-off-by: Valerii Korobeinikov <vkgeorgia@icloud.com>
Signed-off-by: transitrix <279946036+transitrix@users.noreply.github.com>
@transitrix transitrix changed the title docs: v3.2.0 VSIX provenance, inventory and dependency audit (transitrix-hq#132-134) docs: v3.2.0 VSIX provenance, inventory, dependency audit, scans + reproducibility (transitrix-hq#132-136) Aug 11, 2026
@github-actions

github-actions Bot commented Aug 11, 2026

Copy link
Copy Markdown

📊 Metrics Regression Report

✅ All metrics within tolerance

Summary

  • Diagrams tested: 9
  • Successful: 9
  • Failed: 0
  • Violations: 0

Details

ai-expense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 1868 1868 0.00 (0.0%) ✓
waypointDensity 2.6 2.6 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.48125 0.48125 0.00 ✓
portViolations 0 0 0.00 ✓

feature-release.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 1 1 0.00 ✓
bends 13 13 0.00 ✓
edgeLength 3428 3428 0.00 (0.0%) ✓
waypointDensity 3 3 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5500909090909091 0.5500909090909091 0.00 ✓
portViolations 0 0 0.00 ✓

large-cyclic-workflow.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 2 2 0.00 ✓
bends 28 28 0.00 ✓
edgeLength 7479 7479 0.00 (0.0%) ✓
waypointDensity 3.12 3.12 0.00 (0.0%) ✓
spineDeviation 66 66 0.00 ✓
emptyArea 0.793134974640294 0.793134974640294 0.00 ✓
portViolations 1 1 0.00 ✓

order-fulfillment.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 2 2 0.00 ✓
edgeLength 728 728 0.00 (0.0%) ✓
waypointDensity 2.3333333333333335 2.3333333333333335 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5622894736842106 0.5622894736842106 0.00 ✓
portViolations 0 0 0.00 ✓

parallel-tracks.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 6 6 0.00 ✓
edgeLength 2104 2104 0.00 (0.0%) ✓
waypointDensity 2.6666666666666665 2.6666666666666665 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.6834468042259194 0.6834468042259194 0.00 ✓
portViolations 0 0 0.00 ✓

simple-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 8 8 0.00 ✓
edgeLength 1450 1450 0.00 (0.0%) ✓
waypointDensity 3.142857142857143 3.142857142857143 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.7764882411250177 0.7764882411250177 0.00 ✓
portViolations 0 0 0.00 ✓

simple-linear.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 0 0 0.00 ✓
edgeLength 440 440 0.00 (0.0%) ✓
waypointDensity 2 2 0.00 (0.0%) ✓
spineDeviation 0 0 0.00 ✓
emptyArea 0.5258771929824562 0.5258771929824562 0.00 ✓
portViolations 0 0 0.00 ✓

small-dense-approval.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 0 0.00 ✓
bends 14 14 0.00 ✓
edgeLength 2066 2066 0.00 (0.0%) ✓
waypointDensity 3.272727272727273 3.272727272727273 0.00 (0.0%) ✓
spineDeviation 33 33 0.00 ✓
emptyArea 0.8091206777597997 0.8091206777597997 0.00 ✓
portViolations 0 0 0.00 ✓

xlarge-stress-test.bpmn.transitrix.yaml

Metric Baseline Current Delta Status
crossings 0 1 +1.00 ✓
bends 62 64 +2.00 ✓
edgeLength 11526 11674 +148.00 (1.3%) ✓
waypointDensity 3.1481481481481484 3.185185185185185 +0.04 (1.2%) ✓
spineDeviation 132 132 0.00 ✓
emptyArea 0.8201716840253008 0.8201716840253008 0.00 ✓
portViolations 0 0 0.00 ✓

@vkgeorgia
vkgeorgia merged commit 13e4243 into main Aug 12, 2026
8 checks passed
@vkgeorgia
vkgeorgia deleted the transitrix-studio/132-vsix-provenance-acquire branch August 12, 2026 15:04
@vkgeorgia vkgeorgia changed the title docs: v3.2.0 VSIX provenance, inventory, dependency audit, scans + reproducibility (transitrix-hq#132-136) docs: v3.2.0 VSIX provenance, inventory, dependency audit, scans + reproducibility (THQ-132-136) Aug 28, 2026
@transitrix transitrix mentioned this pull request Sep 28, 2026
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

needs:human-merge Mergeable but not simple - requires human review/merge

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@transitrix @vkgeorgia