From 2f88683ba87de6de16455fb2a3bd33b732818541 Mon Sep 17 00:00:00 2001 From: AHMED YOUNIS Date: Fri, 9 Oct 2026 00:48:18 +0300 Subject: [PATCH 1/2] docs(v1): align security verdict and contributor intake with current stable release --- SECURITY.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 50369a46..72679c16 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -6,9 +6,9 @@ ExecSurface is a security-adjacent developer tool. ExecSurface is not a sandbox, EDR, antivirus or malware detector. -A future PASS verdict will mean only that under the recorded observer, normalization profile, baseline and policy, no disallowed execution-surface expansion was identified. +In the current **Stable v1.0.0** Linux x86_64 / native-`ptrace` contract, an ExecSurface `PASS` means only that under the selected observer, normalization profile, baseline and policy, no policy-relevant observed execution-surface drift was identified. It does **not** prove that the wrapped target command exited successfully: target exit status/signal are recorded separately and are not verdict-bearing in v1.0.0. -It will not prove that a program is safe or that unobserved behavior is impossible. +It does not prove program safety, sandboxing, malware freedom, fair benchmarking, determinism or completeness of all unobserved behavior. Keep the wrapped command's own success/failure gate when its correctness matters. ## Sensitive data @@ -16,4 +16,4 @@ Evidence and traces can be sensitive. Default product semantics prohibit collect ## Vulnerability reports -Use GitHub private vulnerability reporting when available. Avoid publishing exploitable details in a public issue before maintainers can assess them. +Use GitHub private vulnerability reporting when available. Avoid publishing exploitable details in a public issue before maintainers can assess them. For experimental external-trial tooling, the reported CI-output privacy boundary and its reviewed remediation are retained at [Issue #164](https://github.com/AETHERXGLOBAL/execsurface/issues/164); old pinned trial packet revisions do not receive fixes retroactively. From 0c8fc8ee5b06778c4181db00a821a18f94cb39cb Mon Sep 17 00:00:00 2001 From: AHMED YOUNIS Date: Fri, 9 Oct 2026 00:48:21 +0300 Subject: [PATCH 2/2] docs(v1): align security verdict and contributor intake with current stable release --- CONTRIBUTING.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index bfb6dc02..ea2c3397 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -2,6 +2,8 @@ ExecSurface prioritizes precision, reproducibility, explicit limitations, and evidence-preserving engineering. +**Current supported public release:** `v1.0.0` within the documented Linux x86_64/native-`ptrace` contract. Older Alpha.5 contribution tasks and examples remain useful historical evidence, but they must not be presented as the current stable consumer path without a new exact-v1 run, public artifact verification and fresh CI. + ## New to ExecSurface? Start with repository Issues labeled `good first issue` and `help wanted`. @@ -16,7 +18,7 @@ Current newcomer-scoped entry points include: These tasks are intentionally bounded so contributors can improve usability and integrations without silently changing runtime semantics, evidence authority, support claims or release guarantees. -Independent Alpha.5 evaluation and adversarial findings belong in [Issue #118](https://github.com/AETHERXGLOBAL/execsurface/issues/118). A contribution or self-test is valuable engineering work, but it is not automatically independent external validation. +Independent Alpha.5 findings remain preserved in [Issue #118](https://github.com/AETHERXGLOBAL/execsurface/issues/118). Current real-workload post-v1 evidence is tracked in [Issue #140](https://github.com/AETHERXGLOBAL/execsurface/issues/140). A contribution or self-test is valuable engineering work, but is not automatically independent external validation or product adoption. ## Before opening a change