[mohgupta-ship-it]

This v2.13.1 maintenance release is based on published v2.13.0. It fixes false incomplete scans from ordinary code and prose, quoted version metadata, supported passive documentation images, and Office workbook handling while retaining genuine security findings and incomplete-analysis safeguards.

The latest addition addresses two separate workbook issues. A worksheet identified by Office content types and workbook relationships can use the existing 16 MiB analysis allowance; unrelated archive entries retain their 1 MB limit. Cumulative expansion, compression-ratio, member-count, path, CRC and runtime checks remain enforced. The scanner keeps the complete admitted bytes for local static analysis and YARA.

Printer settings lose the filename-based executable classification only when Office relationships, content types and the complete DEVMODEW envelope agree. Executable signatures, executable permission bits, malformed records and ambiguous metadata retain their safeguards. Printable text keeps its existing analysis; opaque driver-private bytes retain explicit binary scope boundaries and bounded instruction checks. This is not a claim that arbitrary .bin files or printer-driver data are safe.

Included changes:

• Follow-up: the bounded worksheet admission and printer metadata classification described above.
• Follow-up: preserve quote ownership across inline JSON and later YAML examples, and recognize ordinary nested Markdown list continuations and inline placeholders without hiding shell bodies or uncertain blocks.
• Follow-up: retain shell heredoc quote ownership so a closing Python formatted-string quote does not start a false shell word.
• Follow-up: recognize explicitly documented dotted configuration fields when no bundled artifact matches. Explicit file uses and existing or ambiguous matches retain reference accounting.
• fix(static): stop code comparisons from reading as tag marker directives #777, fix(analyzer): keep Python and Perl syntax from exhausting the shell parser #778, fix(static): let validated Python string literals own their quotes in marker parsing #784, fix(analyzer): stop prose apostrophes and Python report strings from marking files partial #849: code comparisons, Python/Perl ownership, quoted Python text, prose apostrophes and report strings. This includes the parser bundle from release: prepare minimal SkillSpector 2.13.1 parser patch #878.
• fix(python): inspect imported initialization callables #897: inspect imported setup callables in the bounded helper proof; prevent shell execution from producing a false complete/SAFE result.
• fix(references): distinguish quoted versions from file references #525: recognize quoted YAML version metadata without hiding real numeric file references.
• fix: admit corroborated passive documentation PNG and JPEG references #877: corroborate supported passive PNG/JPEG documentation references without format-only AE1 findings. Image coverage remains partial; executable uses, malformed bytes and independent findings retain their safeguards.
• Fix P2 HTML comment boundary matching #452: keep hidden-instruction matching within individual HTML comments.
• fix(analyzer): reuse tool-misuse context indexes and honor deadlines #790: reuse analyzer context and enforce analysis deadlines.
• fix: report incomplete batch gap-fill analysis #797: preserve findings and report failed batch gap-fill as incomplete.
• fix: prevent report output symlink races #798, including the correction tracked in fix(output): clear inherited report ACLs before writing #896: atomic report/baseline writes, with inherited report ACLs cleared before content is written.
• fix(tm1): use the final repeated assignment target #820: handle repeated Python assignments correctly.
• fix(cli): reject shipped baselines in recursive multi-skill scans #823: reject unsupported recursive shipped-baseline combinations.
• fix(report): align recursive risk recommendations #836: preserve MEDIUM/CAUTION recommendations in recursive reports.
• fix(mp3): recognize descriptive hardware reset states #837: avoid hardware-reset false positives while detecting instructions to adopt agent memory.
• Reject unsupported skill options in registry mode #840: reject unsupported registry-scan option combinations.

Only the curl token prerequisite from #697 and the prohibition-context prerequisite used by MP3 from #658 are included. The SC8 CPU-budget correction #828 is inherited from v2.13.0. #827/#895 remain excluded.

Current candidate: 9832c437bf7e1638deed319a521c3ea7e4a377e0.

• Fresh final wheel and source distribution built and validated. Wheel SHA-256: d6c6e281cd9a1ee0f72fca0dfa0c2a332243703ccb242eeda7eabb355ed2bd40.
• The final commit only sorts test imports. Its runtime source and fresh wheel are byte-identical to 026f3356, on which the broad checks below ran. Final-head targeted tests passed again: 653 per source/installed-wheel mode; lint and formatting passed. The earlier lint failure is corrected.
• Broad core suite: 12,177 passed per mode, with 23 skipped, 4 expected failures and 137 deselected. Targeted tests overlap that total. Offline integration: 118 passed per mode. All 88 Node extension tests passed.
• Replayed the original reported skill snapshot, its current snapshot and the exact workbook in a minimal wrapper, comparing the previous and current runtime in both source and wheel modes. All 12 customer runs have matching source/wheel reports. The complete 1,969,921-byte worksheet matches the original bytes and all 15 static pattern analyzers positively complete its inspection.
• Exactly five false printer-settings SC9 findings disappear from each customer case. All 41 other findings in the original skill and all 35 in the current skill remain. The wrapper retains its three independent findings; printer binary-analysis boundaries remain explicit. This is not a whole-skill SAFE claim.
• The 25 functional skill cases meet their scoped expectations with source/wheel parity after documented fixture/oracle corrections. Controls cover late prompt instructions and destructive commands, malformed/executable printer records, missing/external/ambiguous relationships, CRC failures, compression limits, unrelated oversized members and worksheet size limits. The original failed checks remain recorded; the corrected command fixture still requires TM1, and corrupt CRC input still must fail with exit 2.
• All 12 catalog skills match the previous candidate and each other across source/wheel modes (48 fresh scans).
• One separate stress case remains a performance limitation: a workbook containing two 14 MiB worksheets exceeds the shared 25 MiB expansion budget. The original 240-second harness deadline expired before a report. A diagnostic run with unchanged scanner defaults produced reports in 283.8 seconds (wheel) and 305.8 seconds (source). Both correctly report partial coverage and CAUTION, with the second worksheet blocked by the shared budget; the source run also records analyzer runtime limits on the first worksheet. Findings match, but exact coverage parity does not. This is not complete-coverage or performance sign-off for very large worksheets.

Historical qualification, retained separately for 7cfdc0ffc0d0abfc8f88ec5fca45c462a6b83d90:

• Fresh wheel/source distribution validated; 12,138 core tests passed per mode, with 23 skipped, 4 expected failures and 137 deselected. The 3,039 targeted tests overlap that total.
• Offline integration: 118 passed per mode. All 88 Node extension tests, formatting and lint checks passed.
• All 24 original customer snapshots passed the frozen checks: 218 existing files fully inspected and all 149 independent findings preserved. The affected 36-file snapshot had both parser limits and both false field references corrected; its two causal incomplete-reference findings were removed.
• All 189 CLI skill cases met their expectations with source/wheel parity. All 12 catalog reports matched the preceding candidate. The six-file Markdown regression and ten-file shell-helper regression discovered during qualification were corrected.
• These results belong to the earlier commit; they are not substitutes for the current-head reruns above. Greptile completed the comparison from c528e513 to 7cfdc0ff with zero findings.

Remaining qualification gaps:

• The large-worksheet stress case above still has runtime/coverage variability; the recovered 1.97 MB customer worksheet completes in both modes.
• Earlier live NVIDIA Build checks did not pass complete qualification. Connection/deadline failures affected published v2.13.0 and the previous candidate; these offline fixes do not establish live-provider closure.
• Some other original customer inputs remain unavailable. Existing conservative limits remain for trailing plural possessives and relative-submodule helper proof. The recovered customer skills retain independent findings, reference/parser limitations and explicit binary scopes.
• Historical provider-specific semantic failures and downstream evaluator acceptance are outside this scanner-only qualification. Native macOS ACL evidence is retained from the byte-identical previously verified implementation; no new native macOS run is claimed.
• Greptile completed the workbook comparison 7cfdc0ff to 026f3356 with zero findings. Its exact final import-only follow-up also completed with zero findings. CodeRabbit has not returned a completed review because its service failed; that review gap remains open.

Hosted CI for the final commit has passed lint/format, extension tests, DCO and Docker smoke checks. The unit-test job is still running. The preceding run's setup-uv failure did not recur.

Release qualification remains incomplete while the gaps and hosted checks above remain open. This update does not tag or publish a release.