From 6e35f080fa89ae5fe380304c0da4b1c82593a546 Mon Sep 17 00:00:00 2001 From: "fig-ai-agent[bot]" <310751119+fig-ai-agent[bot]@users.noreply.github.com> Date: Wed, 9 Sep 2026 07:45:22 +0000 Subject: [PATCH] docs(changelog): clean up Sep 9 section + record PRs #145, #148 --- CHANGELOG.md | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8c10b9a..39caf81 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -10,20 +10,22 @@ All notable changes to this repository. Dates are UTC. - **PR #158** — docs: added root `RELEASE.md` release guide (semantic-versioning policy, release flow, release-drafter auto-label mapping, verification checklist, rollback guidance). - **PR #156** — docs: filled `SECURITY.md` with a real security policy (supported versions, private-advisory reporting flow, expected-response SLA by severity, repo security practices); added default `.github/PULL_REQUEST_TEMPLATE.md` pointing typed changes to the 6 specialized templates. - **PR #150** — docs: added `deliverables/gemini-cli-skills/`: research brief on google-gemini/gemini-cli docs & skills architecture, `AGENTS.md` + `SKILLS.md` overlay index, `@zyntroai` skill overlay templates (github/pull-request, coding/typescript, devops/ci-cd, security/secret-scan), canonical `templates/skill-template.ts`. +- **PR #148** — feat(security): added `deliverables/cwe1321-protection-suite/` — CWE-1321 Prototype Pollution Protection Suite: JS rules (ESLint config, Semgrep, CodeQL query, `sanitize.js` utility) + Python rules (Bandit config, Semgrep, `safe_parser.py` FastAPI/Pydantic-safe loader), `manifest.json`, `SKILL.md`, README, test report, and runnable tests (`sanitize.test.mjs` + `test_safe_parser.py`). - **PR #147** — docs: added dev/prod `.bicepparam` examples (F1 / P1v2) under `deliverables/azure-cli-2026/examples/bicepparam/`. - **PR #146** — docs: added full Bicep/IaC appendix to `deliverables/azure-cli-2026/azure-cli-2026.md` (`az bicep` build/decompile/lint/publish, standard file structure, sample templates, CLI deploy + what-if + security, GitHub Actions workflow commands); new `docs/README.md` + `deliverables/README.md` indexes; new `docs/github-actions/workflow-commands-reference.md`; new example workflow `deliverables/azure-cli-2026/examples/azure-bicep-deploy.yml`. +- **PR #145** — docs: added Azure CLI 2026 flashcards & one-page cheat sheet to `deliverables/azure-cli-2026/azure-cli-2026.md`. +- **PR #142** — extended `deliverables/notebooklm-access-suite/` to full sub-skill set: validate/guide/link_security/provenance/verify/knowledge (read-only, evidence-based). Suite now 22 tests. +- **PR #140** — added `deliverables/notebooklm-access-suite/`: NotebookLM access-artifact suite core P0 (resolver/access/artifact), evidence-based read-only access classification. 12 tests. +- **PR #138** — added `deliverables/agent-skill-template/`: standard agent-skill template (JSON+YAML), progressive-disclosure loader (`load_skill`/`resolve_layers`/`verify_gates`/`prepare_skill`), NotebookLM filled example. 11 tests. +- **PR #136** — added `deliverables/notebooklm-link-share/`: NotebookLM link-share skill (`notebooklm_link_share`), normalize/validate/share-templates, pure stdlib, SKILL.yaml. 9 tests. +- **PR #134** — added `runpod_client.py` to `deliverables/agent-security-suite/`: RunPod client (lazy import), ACTION_SCHEMA validation, audit hook, `connect_runpod()`. Suite now 28 tests. +- **PR #132** — added `ci_ops` module to `deliverables/agent-security-suite/`: permission-aware checks (contents:write ≠ workflows:write), SHA-pin scan, CI root-cause fingerprint. Suite now 21 tests. +- **PRs #125–#130** — Dependabot: docker base bumps (alpine 3.24, node 26, python 3.14), npm (vercel), pip (production-deps), npm dev-deps. +- **PR #122** — extended `deliverables/agent-security-suite/`: LangGraph time-travel recovery (`recovery.py`) + MCP client (`mcp_client.py`), lazy-imported (core runs without them). Now 11 tests. +- **PR #120** — `deliverables/agent-security-suite/`: runnable core (ISO-27001-style SQLite audit log with SHA-256 payload hash, JSON-schema validation, stdlib-only Slack alert). 7 tests. +- **PR #118** — `skills/research/`: multi-source knowledge synthesis (ResearchSkill.run) built on fetching — dedupe, cross-validation to 0.0–1.0 confidence, contradiction flags, provenance graph + checksum. 7 tests. +- **PR #116** — `skills/fetching/` extended with async GraphQL (`clients/graphql.py`, TTL cache) and WebSocket (`clients/websocket.py`, wss/ws, lazy `websockets`) clients; `ssrf.check_ws()`. Now 17 tests. - **PR #114** — `skills/fetching/`: SSRF-safe async HTTP fetch skill (httpx) with retry + TTL cache + provenance; SSRF guard blocks private/local/metadata hosts; GitHub source. 9 tests. -- **PR #116** -- **PR #118** -- **PR #120** -- **PR #122** -- **PRs #125–#130** -- **PR #132** -- **PR #134** -- **PR #136** -- **PR #138** -- **PR #140** -- **PR #142** — extended `deliverables/notebooklm-access-suite/` to full sub-skill set: validate/guide/link_security/provenance/verify/knowledge (read-only, evidence-based). Suite now 22 tests. — added `deliverables/notebooklm-access-suite/`: NotebookLM access-artifact suite core P0 (resolver/access/artifact), evidence-based read-only access classification. 12 tests. — added `deliverables/agent-skill-template/`: standard agent-skill template (JSON+YAML), progressive-disclosure loader (`load_skill`/`resolve_layers`/`verify_gates`/`prepare_skill`), NotebookLM filled example. 11 tests. — added `deliverables/notebooklm-link-share/`: NotebookLM link-share skill (`notebooklm_link_share`), normalize/validate/share-templates, pure stdlib, SKILL.yaml. 9 tests. — added `runpod_client.py` to `deliverables/agent-security-suite/`: RunPod client (lazy import), ACTION_SCHEMA validation, audit hook, `connect_runpod()`. Suite now 28 tests. — added `ci_ops` module to `deliverables/agent-security-suite/`: permission-aware checks (contents:write ≠ workflows:write), SHA-pin scan, CI root-cause fingerprint. Suite now 21 tests. — Dependabot: docker base bumps (alpine 3.24, node 26, python 3.14), npm (vercel), pip (production-deps), npm dev-deps. — extended `deliverables/agent-security-suite/`: LangGraph time-travel recovery (`recovery.py`) + MCP client (`mcp_client.py`), lazy-imported (core runs without them). Now 11 tests. — `deliverables/agent-security-suite/`: runnable core (ISO-27001-style SQLite audit log with SHA-256 payload hash, JSON-schema validation, stdlib-only Slack alert). 7 tests. — `skills/research/`: multi-source knowledge synthesis (ResearchSkill.run) built on fetching — dedupe, cross-validation to 0.0–1.0 confidence, contradiction flags, provenance graph + checksum. 7 tests. — `skills/fetching/` extended with async GraphQL (`clients/graphql.py`, TTL cache) and WebSocket (`clients/websocket.py`, wss/ws, lazy `websockets`) clients; `ssrf.check_ws()`. Now 17 tests. - **PR #112** — Reference deliverables under `deliverables/`: GitHub DevOps Toolkit (PR templates, SHA-pinned gatekeeper workflows, externalized branch-protection config, Terraform module) + AI Agents Decision Pack (comparison matrix, Notion/Figma/Miro assets). Docs/config only. ## [2026-09-08] — Skill-native architecture, secrets cleanup, and GraphQL API