Security remediation: 0.9.4 release record

Status: released. Victor AI 0.9.4 was published on 2026-09-16 from
4e4e0d640 after release workflow run 35101110707 completed successfully. The
GitHub Release contains 14 assets, and the Python, native, binary and container
publication jobs passed. Victor Contracts 0.9.2 was published independently to
PyPI on 2026-09-17. As of that closeout, GitHub reports zero open Dependabot
alerts; the historical Trivy exposure uncertainty below remains part of the
record and is not evidence that historical credentials were unaffected.

Integrated security changes

The original batch replaced persisted Python-object caches with bounded data
formats, validated SQL/parser/editor inputs, preserved runtime policy failures,
made temporary overrides transactional, and corrected advisory scoring/pagination.
It removed unused dependencies, refreshed Python/JavaScript/Rust versions, made
optional RAG backends lazy and consolidated four container targets.
See dependency/deployment guidance and
security policy.

The closeout's independent review found an alternate MCP factory that retained
resource configuration outside the canonical reconnect path. The factory now
uses the configured MCPClient lifecycle for first connection, reconnection and
failed-initialization cleanup.

Native chunking could panic on Unicode or loop indefinitely on invalid parameters
and some valid overlapping inputs. Native and Python implementations now validate
parameters, advance monotonically and use consistent character offsets.
Cross-method offset checks, randomized Unicode comparisons and subprocess
deadlines exercise these failures against a rebuilt native 0.8.1 extension.

Semgrep now retains raw JSON/SARIF, logs and exit status from one scan. Operational
failures, missing/malformed reports and mismatched diagnostic inventories fail the
job. Findings remain advisory. PartialParsing warnings are explicit coverage gaps,
not silently interpreted as a complete parse. Only justified in-source findings
are filtered from the GitHub upload; the raw evidence remains available.

The hash disposition audit classifies 52 MD5/SHA-1
calls as non-security cache/deduplication/identifier uses. Explicit constructor
annotations preserve existing digests; B324 is removed from both the global
configuration and workflow skip arguments so future security misuse is visible.

Routine dependency PRs have a seven-day cooldown. Urgent security fixes continue
through separate triage. The CI batching rule
requires local validation and independent review before pushing, with no
unconditional commit/push after failed tests.

September 15 runner portability follow-up

1063 passed all 32 PR checks and merged at 35621ad08. The automatic develop

run then exposed two environment assumptions on self-hosted overflow runners:
the security action invoked an undeclared Python interpreter, and test collection
loaded LanceDB's native extension during vector-provider registration, causing
an illegal-instruction crash on that runner.

The follow-up declares Python setup inside the shared security action and defers
the LanceDB import until provider initialization, before opening model resources.
Registry and search imports no longer execute that optional backend. Provider
unit tests mock the backend without importing its native extension. Import
deferral does not establish that the LanceDB binary supports the runner's CPU;
actual backend execution still requires a compatible build and host.

The coding vertical's air-gapped integration tests execute LanceDB deliberately.
Those jobs use ubuntu-24.04 rather than the ubuntu-latest label also advertised
by the incompatible overflow host. An explicit native import probe verifies the
backend before the full vertical suite; no integration tests are skipped.

The Rust workspace test job also declares Python 3.12 and binds PyO3 to that
interpreter. Previously it discovered the overflow host's Python 3.8, then failed
to link its missing libpython3.8. Rust tests and crate packaging remain required.

Independent review approved the import and scanner changes. The affected suites
passed 407 tests, and full collection found 32,476 tests. The fresh-process
regression reproduces the eager native import on unchanged develop and passes
with the deferred import. With Python 3.12 selected explicitly, all 256 Rust
workspace tests pass and all four publishable crate archives verify locally.

The automatic post-merge run exposed one remaining dependency-resolution cost:
Strict Fallback Guards spent its eight-minute budget downloading more than 3 GB
of CUDA-enabled Torch artifacts, although the job is CPU-only. Every CI shell
step that resolves .[dev] now installs Torch from the CPU wheel index first.
A repository-wide policy test covers workflows and composite actions so a new
dev install cannot silently restore the CUDA dependency chain.

The follow-up candidate then proved that private runners advertising
ubuntu-latest were receiving ordinary jobs despite carrying different host
ABIs. Python 3.12 from the tool cache required newer glibc symbols on
anvai-wsl-2; documentation setup and PyO3 execution failed before their real
checks. Victor workflows now select the explicit GitHub-hosted ubuntu-24.04
image, and ABI-sensitive jobs verify Ubuntu and glibc before dependency work.
The self-hosted runner contract requires separate
capability labels and a preflight before private capacity is opted back in.
Docker-based release and scan steps do not imply that host-run tests execute in
containers.

The September 14 container digests below remain evidence for that audited tree;
release artifacts must be rebuilt and scanned from the final promoted commit.

September 14 alert reconciliation

Baseline develop: 71a6f466d; main: 6b6cbcc4c.
GitHub reports 73 Dependabot alerts (2 critical, 29 high, 36 medium, 6 low),
81 code-scanning alerts, and zero open secret-scanning alerts.
All 81 code-scanning instances refer to main. Counts must be refreshed after
promotion; source remediation does not itself close main's alerts.

Findings	Current source evidence	Remaining verification
59 npm alerts	Locked versions match none of the reported vulnerable ranges; both fresh npm audits report zero vulnerabilities	Verify packaged extension delivery and main graph refresh
5 Black / 3 PyO3 / 1 Pygments alerts	Patched manifest/lock versions on develop	Final installed environments and package publication
4 core Python alerts	Affected packages removed from core; embeddings separately updated	All enabled deployment environments
1 Trivy Action alert	Replaced by a pinned composite scan configuration using Trivy Action v0.35.0 and binary v0.74.0	Historical exposure review below
70 mutable Action findings	References replaced by commit/digest pins	Main Semgrep refresh
4 SQL findings	Purge values bound; backup identifier accepts only an ASCII timestamp, with negative tests	Two safe identifier heuristics have narrow inline justification
4 dynamic import findings	Current scan no longer reports these sites	Preserve current scan evidence
3 Trivy code findings	Fresh develop filesystem report has zero findings	Final artifacts and main scanner refresh

The final local Semgrep scan reports 1,078 files, zero unsuppressed findings,
34 in-source suppressions and 56 PartialParsing warnings. These warnings are
primarily embedded shell/GitHub expression parsing and remain a documented limit.

Validation and release conditions

Independent review approves the native, MCP and scanner-completeness changes.
The rebuilt native suite passed 333 tests, 11 skipped; independent checks
covered 14,000 randomized Unicode cases and 45 focused native/MCP cases.
Semgrep report validation passed 33 tests, including injected operational
errors. Targeted formatting, production Ruff and MyPy passed. Full collection
found 32,472 tests without errors outside sandbox permission restrictions.
The complete affected security/gate suite passed 615 tests, 5 skipped.
The full MCP client suite passed 58 tests, and SDK tests passed 337 tests
after correcting two stale assertions about the already-migrated executor class.
The hash-affected suites passed 865 tests, with one runtime-intelligence
integration timeout also reproduced against the unchanged baseline module in
an isolated process. Six hash-policy tests guard against reintroducing a global
B324 exclusion. The timeout is a validation limitation, not a passing test.

Fresh pip-audit checks of the complete pinned core, API and CPU-embedding
inventories report zero known vulnerabilities. Both npm audits and the complete
filesystem Trivy scan report zero findings. These inventory checks are not
substitutes for installed-environment or final-container audits.

A freshly resolved compatible extras/all-vertical environment contains 351
installed packages, passes pip check and a fresh OSV audit with zero findings
and zero skipped packages. The standalone installed docs environment similarly
audits 39 packages with zero findings or skips. Strict docs build and local
site links pass. The compatibility selection excludes aggregate aliases and
separately built native/platform-specific shapes; container/native checks cover
the Linux distribution shapes. It does not certify macOS/GPU installations.

The optional investment package is external to this tree: a fresh public-index
resolution of victor-invest>=0.5.0,<1.0.0 finds no distribution. Therefore the
invest and aggregate verticals extras cannot currently be certified as public
installations; use the individual available vertical packages. No security claim
is made for an unavailable/private investment distribution.

All four rebuilt targets pass offline runtime checks and the publication scan
gate: zero Python findings and zero high/critical/unknown findings.
Core/MCP/native retain 45 medium and 4 low OS findings each; full retains
55 medium and 4 low. None has a vendor fix in the scanned database. These
advisories remain visible; no threshold or exception was changed to erase them.

Rebuilt target	Local image content digest
core	c2623be71dea0ca71bf70b32f0370bcd16b7ebefbf1cd709b1238ad2400494f8
mcp	116d2947c769f634f99af419a0c1b5bffdd8745d03f3c79946652d4ceb253cd1
native	0dd35b5a874de3785e2cec5757392f009744d30378f2a51566354a0617dc25a9
full	ddb3bb94c69553338f34de88a662a9361e946fb47ba4e68a70d23e2e3a4f28a0

Inventories and SBOMs accompany each report. These are local image IDs, not
registry manifest digests. Native checks exercise the fixed Unicode/progress
cases in the release wheel; full checks load the bundled embedding model offline.

Historical Trivy exposure evidence

GHSA-69fq-xp46-6x23 concerns
compromised Trivy artifacts and Action references. Historical Victor workflows
referenced aquasecurity/trivy-action@master during the March 19–23 incident
period. Run 23309396211's security job 67792322004 started on March 19 at
18:04:38 UTC and failed. Its log now returns HTTP 410, preventing verification of
the resolved Action revision or whether malicious code executed.

This is an exposure uncertainty, not a confirmed compromise. Credential rotation
or incident-review evidence is still needed to close it. A current patched
dependency and zero open secret alerts cannot prove that historical credentials
were never exposed. Do not publish secret material in this record.

Release outcome

1. The final candidate passed independent review, required CI, deployment-lock
   audits and the documented artifact checks.
2. Victor Contracts 0.9.2 was tagged and published to PyPI on 2026-09-17.
3. The develop-to-main promotion merged as 4e4e0d640; tag v0.9.4 triggered
   release workflow run 35101110707, which completed successfully.
4. The v0.9.4 GitHub Release
   published 14 assets, including Victor AI packages, native wheels, standalone
   binaries and checksums. Docker and SBOM publication also passed.
5. The default-branch dependency graph now reports zero open Dependabot alerts.
   Current npm and Python deployment audits report no known actionable
   vulnerabilities. Lower-severity unfixed OS findings remain visible as recorded
   above.
6. The historical Trivy incident evidence remains incomplete. Publication closed
   the release gate after human review; it did not establish that the historical
   mutable action reference was harmless.