v1.87.0.0 feat: add verified CSO audits and replayable repair bundles (#2852)

* feat(cso): add verified audits and replayable repair bundles

* fix(cso): harden qualification and setup boundaries

* fix(cso): assemble security canaries at runtime

* fix(cso): bound release proof and maintenance work

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): require complete evaluation reports

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): replay expired snapshots from supplied source

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): synchronize DNS cancellation assertion

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore(ship): exempt repository owner from liveness proof

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* test(cso): make recheck retention overlap deterministic

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: bump version and changelog (v1.85.0.0)

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass native release gates

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.86.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): resolve rechecks by finding

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* chore: move release to v1.87.0.0

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): pass macOS and Windows release gates

Normalize BSD wc output, compare Windows paths by filesystem identity, preserve portable snapshot race coverage, and narrow POSIX-only Windows fixtures.

Co-Authored-By: OpenAI Codex <noreply@openai.com>

* fix(cso): harden native verification gates

* fix(cso): refine Windows native diagnostics

* test(cso): isolate Windows Git startup failure

* test(cso): stabilize Windows native diagnostics

* fix(cso): support hardened Git on Windows

* fix(cso): close final verification gaps

* test(cso): bound cold Docker fixture setup

* fix(cso): restore cross-platform free-suite gates

---------

Co-authored-by: OpenAI Codex <noreply@openai.com>

cso/ACKNOWLEDGEMENTS.md

@@ -1,14 +1,17 @@
-# Acknowledgements
+# CSO research and source versions
 
-/cso v2 was informed by research across the security audit landscape. Credits to:
+CSO v3 separates supported static evidence, reproduction, proposed repair candidates, and current-source closure. The design is informed by [Mozilla's account of hardening Firefox](https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/) and [Codex Security's research-preview description](https://openai.com/index/codex-security-now-in-research-preview/): application context and reproducible verification inform the workflow. Their results are not measurements of CSO.
 
-- **[Sentry Security Review](https://github.com/getsentry/skills)** — The confidence-based reporting system (only HIGH confidence findings get reported) and the "research before reporting" methodology (trace data flow, check upstream validation) validated our 8/10 daily confidence gate. TimOnWeb rated it the only security skill worth installing out of 5 tested.
-- **[Trail of Bits Skills](https://github.com/trailofbits/skills)** — The audit-context-building methodology (build a mental model before hunting bugs) directly inspired Phase 0. Their variant analysis concept (found one vuln? Search the whole codebase for the same pattern) inspired Phase 12's variant analysis step.
-- **[Shannon by Keygraph](https://github.com/KeygraphHQ/shannon)** — Autonomous AI pentester achieving 96.15% on the XBOW benchmark (100/104 exploits). Validated that AI can do real security testing, not just checklist scanning. Our Phase 12 active verification is the static-analysis version of what Shannon does live.
-- **[afiqiqmal/claude-security-audit](https://github.com/afiqiqmal/claude-security-audit)** — The AI/LLM-specific security checks (prompt injection, RAG poisoning, tool calling permissions) inspired Phase 7. Their framework-level auto-detection (detecting "Next.js" not just "Node/TypeScript") inspired Phase 0's framework detection step.
-- **[Snyk ToxicSkills Research](https://snyk.io/blog/toxicskills-malicious-ai-agent-skills-clawhub/)** — The finding that 36% of AI agent skills have security flaws and 13.4% are malicious inspired Phase 8 (Skill Supply Chain scanning).
-- **[Daniel Miessler's Personal AI Infrastructure](https://github.com/danielmiessler/Personal_AI_Infrastructure)** — The incident response playbooks and protection file concept informed the remediation and LLM security phases.
-- **[McGo/claude-code-security-audit](https://github.com/McGo/claude-code-security-audit)** — The idea of generating shareable reports and actionable epics informed our report format evolution.
-- **[Claude Code Security Pack](https://dev.to/myougatheaxo/automate-owasp-security-audits-with-claude-code-security-pack-4mah)** — Modular approach (separate /security-audit, /secret-scanner, /deps-check skills) validated that these are distinct concerns. Our unified approach sacrifices modularity for cross-phase reasoning.
-- **[Anthropic Claude Code Security](https://www.anthropic.com/news/claude-code-security)** — Multi-stage verification and confidence scoring validated our parallel finding verification approach. Found 500+ zero-days in open source.
-- **[@gus_argon](https://x.com/gus_aragon/status/2035841289602904360)** — Identified critical v1 blind spots: no stack detection (runs all-language patterns), uses bash grep instead of Claude Code's Grep tool, `| head -20` truncates results silently, and preamble bloat. These directly shaped v2's stack-first approach and Grep tool mandate.
+The domain instructions in `sections/audit-phases.md.tmpl` identify the versions they use:
+
+- [OWASP Top 10:2025](https://owasp.org/Top10/2025/0x00_2025-Introduction/), including exceptional conditions and the revised supply-chain category.
+- [OWASP API Top 10:2023](https://owasp.org/API-Security/editions/2023/en/0x11-t10/).
+- Selected controls from [ASVS 5.0.0](https://owasp.org/www-project-application-security-verification-standard/); requirement IDs must carry their version.
+- [OWASP LLM Top 10 2026](https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/) and [Agentic Applications Top 10 2026](https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/), inspected September 9, 2026. Audits record the actual artifact/version used, rather than inferring content from a release announcement.
+- [MCP security guidance dated 2026-07-28](https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices).
+
+Execution details follow primary documentation: [Bun compiled executables](https://bun.com/docs/bundler/executables), [Docker contexts](https://docs.docker.com/engine/manage-resources/contexts/), [container networking](https://docs.docker.com/engine/network/), [Docker logging](https://docs.docker.com/engine/logging/configure/), [npm ci](https://docs.npmjs.com/cli/v11/commands/npm-ci/), [uv CLI](https://docs.astral.sh/uv/reference/cli/), and [RubyGems commands](https://guides.rubygems.org/command-reference/#gem-fetch). Compiling alone does not suppress Bun configuration or runtime injection variables. Offline dependency preparation must exclude local Python builds during acquisition and defer Gemfile evaluation until offline execution.
+
+Earlier CSO work drew on [Trail of Bits' skills](https://github.com/trailofbits/skills) for context building and variant analysis, [Sentry's skills](https://github.com/getsentry/skills) for research before reporting, and the broader community's security-skill reviews. v3 replaces inherited blanket false-positive exclusions and numerical confidence gates with explicit attacker/control/impact evidence and independent challenge.
+
+CSO accuracy, recall, setup success, and repair correctness are release measurements, not inherited vendor benchmark claims. Qualification requires matched models/budgets, held-out assertions, supported setup failures counted as misses, and zero falsely certified repairs. The presence of documentation or an adapter does not mean its runtime image or release gates have passed.