Vartovii logo

Release notes

Vartovii Changelog

Release archive
3.2.281

SECURITY-READINESS-CONTRACT-SPRINT (Security) & SECURITY-READINESS-DEMO-REVIEW-GATE (Docs)

Release v3.2.281 focuses on SECURITY-READINESS-CONTRACT-SPRINT (Security), SECURITY-READINESS-DEMO-REVIEW-GATE (Docs), and SECURITY-READINESS-BRIEF-PACKET (Security).

AddedImprovedFixedInternal
SECURITY-READINESS-CONTRACT-SPRINT (Security) & SECURITY-READINESS-DEMO-REVIEW-GATE (Docs)

Release digest

Added

  • SECURITY-READINESS-CONTRACT-SPRINT (Security) — Promoted the Security Readiness Module into a bounded service/data-contract sprint and added the deterministic security_readiness.v1 service prototype with four readiness states, evidence-category coverage, missing-evidence preservation, reviewer inputs, sources, and required non-audit disclaimer.
  • SECURITY-READINESS-DEMO-REVIEW-GATE (Docs) — Added the internal demo report outline and manual reviewer checklist required before private pilot outreach or paid readiness-brief delivery.
  • SECURITY-READINESS-BRIEF-PACKET (Security) — Added the deterministic security_readiness_brief.v1 manual pilot packet around the readiness contract, including offer boundary, intake gaps, demo-report requirement, reviewer checklist, delivery decision, blockers, and willingness-to-pay feedback capture fields without checkout or plan enforcement, plus a deterministic Markdown renderer for internal demo/reviewer handoff briefs.
  • SECURITY-READINESS-REVIEW-GATE (Security) — Added a deterministic security_readiness_brief_review.v1 manual review gate that records approved, missing-check, insufficient-evidence, and high-risk escalation outcomes before any readiness-brief delivery.
  • SECURITY-READINESS-DEMO-CLI (Security) — Added a fixture-backed scripts/render_security_readiness_demo_brief.py utility for local Markdown demo/reviewer brief generation with optional review-gate outcome details.
  • SECURITY-READINESS-DEMO-BRIEF-ARTIFACT (Docs) — Added an internal fixture-backed Ready Protocol demo brief under docs/reports/sprints/ to satisfy the public-safe demo artifact requirement before outreach.
  • SECURITY-READINESS-PILOT-FEEDBACK (Security) — Added a deterministic security_readiness_pilot_feedback.v1 record for buyer feedback, willingness-to-pay capture, and offer-validation evidence while keeping checkout, pricing gates, and plan enforcement disabled.
  • SECURITY-READINESS-DEMO-FEEDBACK-OUTPUT (Security) — Extended the demo brief CLI with optional --feedback-json rendering so pilot feedback records can be appended to local Markdown demo artifacts.
  • SECURITY-READINESS-PILOT-OUTREACH (Security) — Added a deterministic security_readiness_pilot_outreach.v1 private outreach candidate contract for consent-basis capture, manual outreach eligibility, and bounded next actions while keeping checkout, pricing gates, and plan enforcement disabled.
  • SECURITY-READINESS-PILOT-SELECTION (Security) — Added a deterministic security_readiness_pilot_candidate_selection.v1 batch-selection contract for 3-5 consent-safe private pilot candidates while keeping CRM writes, checkout, pricing gates, and plan enforcement disabled.
  • SECURITY-READINESS-PILOT-SELECTION-DEMO (Security) — Added Markdown rendering and fixture-backed CLI output for private pilot candidate selection packets, plus an internal demo artifact under docs/reports/sprints/.
  • SECURITY-READINESS-PILOT-RUN-PACKET (Security) — Added the deterministic security_readiness_pilot_run_packet.v1 internal runbook contract for ready and blocked manual private pilot runs while keeping CRM writes, checkout, pricing gates, and plan enforcement disabled.
  • SECURITY-READINESS-PILOT-RUN-PACKET-DEMO (Security) — Added Markdown rendering and fixture-backed CLI output for private pilot run packets through explicit --include-run-packet demo generation.
  • SECURITY-READINESS-PILOT-RUN-PACKET-ARTIFACT (Docs) — Added an internal fixture-backed pilot run packet demo artifact under docs/reports/sprints/ for reviewer workflow validation before private outreach.

Improved

  • SECURITY-READINESS-CONTRACT-SPRINT-CLOSURE (Planning) — Closed the merged and CI-verified contract sprint and promoted gate-based private pilot validation as the active Now slice.
  • SECURITY-READINESS-COMMERCIAL-SEQUENCING (Planning) — Replaced the calendar-driven sequence with consent, delivery, buyer-feedback, willingness-to-pay, and paid-pilot decision gates.

Fixed

  • SECURITY-READINESS-EVIDENCE-NORMALIZATION (Security) — Treat missing-value sentinels such as unknown, not attached, and n/a as absent evidence before readiness coverage checks run, and require concrete audit details before attaching audit coverage.
  • PLANNING-AUTOSYNC-SYNTHETIC-MERGE-PARITY (CI) — Exclude GitHub Actions synthetic PR merge commits from planning autosync signals and normalize head hashes so local branch checks and PR merge-checkout checks converge.

Internal

  • Added fixture-backed regression coverage for READY_FOR_AUDIT, NEEDS_HARDENING, HIGH_RISK, and INSUFFICIENT_EVIDENCE, including coverage/confidence calculation, missing-proof preservation, disclaimer presence, source de-duplication, and additive Trust Score behavior.
  • Added regression coverage for missing-value sentinel filtering, placeholder audit evidence, and synthetic PR merge planning autosync convergence.
  • Added regression coverage for security_readiness_brief.v1 delivery modes, blockers, manual commercial handling, feedback capture fields, and non-billing boundaries.
  • Added regression coverage for Markdown brief rendering, source/timestamp visibility, gap-only blockers, and canonical safety language.
  • Added regression coverage for manual review gate approval, missing reviewer checks, insufficient evidence blockers, and high-risk escalation outcomes.
  • Added CLI regression coverage for stdout and output-file demo brief rendering across approved and gap-only review outcomes.
  • Added regression coverage for pilot feedback records, missing willingness-to-pay signals, and insufficient-evidence offer-validation blockers.
  • Added CLI regression coverage for rendering pilot feedback records from feedback JSON while keeping commercial boundaries disabled.
  • Added regression coverage for private pilot outreach candidate records, missing consent blockers, insufficient-evidence blockers, and CLI --outreach-json Markdown rendering.
  • Added fixture-backed regression coverage for private pilot candidate selection packets, thin batches, oversized batches, blocked-candidate preservation, and disabled CRM/billing boundaries.
  • Added regression coverage for private pilot selection Markdown rendering and demo CLI --selection-json output.
  • Added regression coverage for pilot run packets, blocked selection handling, reviewer steps, feedback capture fields, and disabled CRM/billing boundaries.
  • Added regression coverage for private pilot run packet Markdown rendering, fixture-backed CLI output, and the --include-run-packet selection requirement.
  • Generated and reviewed the internal fixture-backed pilot run packet demo artifact with manual run steps, feedback fields, canonical safety language, and disabled CRM/billing boundaries.
  • Verified pytest -q tests/test_security_readiness_service.py, pytest -q tests/test_security_readiness_demo_cli.py, and pytest -q tests/test_planning_autosync_convergence.py.
  • Recorded PR #12 green CI and contract-sprint closure evidence under docs/reports/sprints/.
  • Updated canonical project, sprint, Q3 roadmap, and Security Readiness strategy docs; added docs/architecture/SECURITY_READINESS.md as the stable security_readiness.v1 contract reference and added an internal implementation note for the demo/report review gate.
  • Public docs were not changed because this release adds internal service, data-contract, and manual pilot packet behavior and does not change customer-facing route, API, setup, or public documentation behavior.
  • Contract closure and pilot promotion also change internal execution status only, so no public docs update is required.

Technical notes