ci(release): revert the VT gate to zero tolerance

The pre-release ML false-positive tolerance (single-engine Microsoft "!ml"
verdicts downgradable with Defender endpoint evidence, DeusData#1340) is reverted by
owner decision: cbm does not ship binaries carrying a VirusTotal detection,
demonstrably false or not. A "trojan" badge on a release asset is a
reputation cost the project is not willing to price in, however good the
accompanying evidence.

The gate returns to its original form: any detection, by any engine, on any
artifact, on any version blocks the release. The endpoint verification tool
and the evidence side-channel are removed with it; the notes renderer keeps
its extracted-script form but only ever states a verified "0 detections".

False positives are resolved upstream instead: verify the bytes on a real
Defender endpoint, submit a Microsoft false-positive report for the exact
hashes, wait for the detection to clear, then RE-RUN the failed verify job --
which does not rebuild, so the cleared hashes are the shipped hashes.

tests/test_vt_gate_zero_tolerance_contract.sh pins the decision: clean
passes; 1 malicious and 1 suspicious each block across stable, -rc., -pre
and -alpha versions; plus a tripwire for the specific reverted evidence
mechanism returning. Loosening this gate again has to consciously delete
that contract.

The skip_tests dispatch input and the script-extracted notes step survive
the revert -- both are orthogonal to gating policy.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

Author: DeusData

.github/workflows/release.yml

@@ -233,22 +233,18 @@ jobs:
           vt_api_key: ${{ secrets.VIRUS_TOTAL_SCANNER_API_KEY }}
           files: binaries/*
 
-      # VERSION + GH_TOKEN enable the pre-release ML false-positive tolerance:
-      # the gate may downgrade a single-engine Microsoft "!ml" verdict to
-      # TOLERATED, but only for -rc./-pre versions and only when hash-pinned
-      # Defender ENDPOINT evidence is attached to the draft release
-      # (defender-endpoint-verification.txt, from scripts/ci/av-endpoint-verify.sh).
+      # ZERO tolerance: any detection on any artifact blocks the release.
+      # False positives are resolved upstream (Microsoft false-positive
+      # submission for the exact hashes, then re-run this job — no rebuild),
+      # never by loosening this gate.
       - name: Wait for VirusTotal results
         env:
           VT_API_KEY: ${{ secrets.VIRUS_TOTAL_SCANNER_API_KEY }}
           VT_ANALYSIS: ${{ steps.virustotal.outputs.analysis }}
-          VERSION: ${{ inputs.version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: scripts/ci/check-virustotal.sh
 
-      # Renders per-binary sha256 + VT links into the notes; when the gate
-      # tolerated an ML false positive it states that honestly instead of
-      # claiming "0 detections".
+      # Renders per-binary sha256 + VT links into the notes; only reachable
+      # after the zero-tolerance gate passed, so "0 detections" is verified.
       - name: Append VirusTotal scan links to release notes
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

scripts/ci/append-vt-notes.sh

@@ -1,28 +1,13 @@
 #!/usr/bin/env bash
 # Append the Security Verification section to the release notes: per-binary
-# sha256 + VirusTotal links, and — when the pre-release ML false-positive
-# tolerance fired (scripts/ci/check-virustotal.sh wrote /tmp/vt_tolerated.tsv)
-# — an honest annotation instead of a blanket "0 detections" claim.
+# sha256 + VirusTotal links. This step only runs after check-virustotal.sh
+# passed, and that gate is ZERO tolerance — any detection blocks the release —
+# so "0 detections" here is a verified statement, never an assumption.
 # Expects: GH_TOKEN, VERSION; run from the verify job workspace (binaries/).
 set -euo pipefail
 
-TOL=/tmp/vt_tolerated.tsv
-
 TABLE="\n\n## Security Verification\n\n"
-if [ -s "$TOL" ]; then
-  N=$(wc -l < "$TOL" | tr -d ' ')
-  TABLE+="All release binaries were scanned with 70+ antivirus engines. "
-  TABLE+="**${N} of them currently show a single machine-learning heuristic detection** "
-  TABLE+="(Microsoft \`Wacatac!ml\`) that we have verified to be a false positive: "
-  TABLE+="an up-to-date Microsoft Defender endpoint — signatures updated at scan time, "
-  TABLE+="real-time protection on — scans the identical bytes clean. The hash-pinned "
-  TABLE+="evidence is attached to this release as \`defender-endpoint-verification.txt\`, "
-  TABLE+="and a false-positive report for these exact hashes has been submitted to "
-  TABLE+="Microsoft. See **Antivirus false positives on release binaries** in the notes "
-  TABLE+="above for the full story and what we are doing about it.\n\n"
-else
-  TABLE+="All release binaries scanned with 70+ antivirus engines — **0 detections**.\n\n"
-fi
+TABLE+="All release binaries scanned with 70+ antivirus engines — **0 detections**.\n\n"
 TABLE+="| Binary | SHA-256 | VirusTotal |\n"
 TABLE+="|--------|---------|------------|\n"
 
@@ -34,13 +19,7 @@ for bin in binaries/codebase-memory-mcp-*; do
   label=$(echo "$name" | sed 's/^codebase-memory-mcp-//' | sed 's/\.exe$//')
   short="${sha256:0:20}..."
   vt_url="https://www.virustotal.com/gui/file/${sha256}/detection"
-  if [ -s "$TOL" ] && grep -q "^${name}	" "$TOL"; then
-    completed=$(grep "^${name}	" "$TOL" | cut -f6)
-    cell="[1/${completed} ⚠️ ML false positive, endpoint-verified clean](${vt_url})"
-  else
-    cell="[0 detections ✅](${vt_url})"
-  fi
-  TABLE+="| \`${label}\` | \`${short}\` | ${cell} |\n"
+  TABLE+="| \`${label}\` | \`${short}\` | [0 detections ✅](${vt_url}) |\n"
 done
 
 CURRENT=$(gh release view "$VERSION" \

scripts/ci/av-endpoint-verify.sh

@@ -1,37 +1,10 @@
 #!/usr/bin/env bash
 # Wait for VirusTotal scans to complete and check results.
 # Expects: VT_API_KEY, VT_ANALYSIS (comma-separated "file=URL" pairs)
-# Optional: VERSION (release tag) + GH_TOKEN — these enable the PRE-RELEASE
-#           single-ML-detection tolerance described below.
 set -euo pipefail
 
 MIN_ENGINES=60
-rm -f /tmp/vt_gate_fail /tmp/vt_suspects.tsv /tmp/vt_tolerated.tsv
-
-# ── Pre-release ML false-positive tolerance ──────────────────────────────────
-# A verdict may be downgraded from BLOCKED to TOLERATED only when ALL of:
-#   1. the version is a pre-release (-rc. / -pre / -alpha / -beta),
-#   2. every failing file was flagged by exactly ONE engine,
-#   3. that engine is Microsoft and the verdict is a machine-learning
-#      heuristic (result string ends in "!ml") — never a signature name,
-#   4. an up-to-date Microsoft Defender ENDPOINT has scanned the identical
-#      bytes clean, proven by a hash-pinned evidence file attached to the
-#      draft release (defender-endpoint-verification.txt, produced by
-#      scripts/ci/av-endpoint-verify.sh).
-#
-# Why this is sound: VT's "Microsoft" engine is a differently-configured
-# instance of the same engine that ships in Windows, and for our large
-# binaries it sits at an unstable ML decision boundary — across four release
-# cycles the Wacatac!ml flag appeared and disappeared with no code-side cause
-# (stripping, downloader removal and metadata changes each "fixed" it only
-# until the next build). The shipping product's verdict on identical bytes,
-# with signatures updated minutes before the scan, is the stronger statement
-# of Microsoft's own estimate. Multi-engine hits, signature-named verdicts,
-# non-Microsoft engines, timeouts and stable releases ALWAYS block.
-TOLERANCE_ELIGIBLE=false
-case "${VERSION:-}" in
-*-rc.* | *-pre* | *-alpha* | *-beta*) TOLERANCE_ELIGIBLE=true ;;
-esac
+rm -f /tmp/vt_gate_fail
 
 echo "=== Waiting for VirusTotal scans to fully complete ==="
 
@@ -95,22 +68,6 @@ print(f'{status},{malicious},{suspicious},{completed},{total}')
         echo "BLOCKED: $BASENAME flagged ($MALICIOUS malicious, $SUSPICIOUS suspicious / $COMPLETED engines)"
         echo "  $URL"
         echo "FAIL" >> /tmp/vt_gate_fail
-        # Record WHO flagged it so the tolerance can classify the failure.
-        FLAG_INFO=$(echo "$RESULT" | python3 -c "
-import json, sys
-d = json.loads(sys.stdin.read())
-res = d.get('data', {}).get('attributes', {}).get('results', {})
-flagged = [(e, (r.get('result') or '?')) for e, r in res.items()
-           if r.get('category') in ('malicious', 'suspicious')]
-engines = ';'.join(e for e, _ in flagged)
-verdicts = ';'.join(v for _, v in flagged)
-print(f'{len(flagged)}\t{engines}\t{verdicts}')
-" 2>/dev/null || printf 'parse-error\tparse-error\tparse-error\n')
-        SHA256=$( (sha256sum "$FILE" 2>/dev/null || shasum -a 256 "$FILE" 2>/dev/null) \
-          | awk 'NR==1{print $1}')
-        [ -n "$SHA256" ] || SHA256="unknown"
-        printf '%s\t%s\t%s\t%s\n' "$BASENAME" "$SHA256" "$FLAG_INFO" "$COMPLETED" \
-          >> /tmp/vt_suspects.tsv
       else
         echo "OK: $BASENAME clean ($COMPLETED engines, 0 detections)"
       fi
@@ -127,76 +84,8 @@ print(f'{len(flagged)}\t{engines}\t{verdicts}')
   fi
 done
 
-if [ ! -f /tmp/vt_gate_fail ]; then
-  echo "=== All VirusTotal scans passed ==="
-  exit 0
-fi
-
-# ── Classify the failures against the tolerance conditions ──────────────────
-FAILS=$(wc -l < /tmp/vt_gate_fail | tr -d ' ')
-SUSPECTS=0
-[ -f /tmp/vt_suspects.tsv ] && SUSPECTS=$(wc -l < /tmp/vt_suspects.tsv | tr -d ' ')
-
-TOLERABLE="$TOLERANCE_ELIGIBLE"
-# Timeouts and unparseable URLs produce FAIL lines with no suspect record —
-# those are never tolerable, and the counts diverging catches them.
-[ "$FAILS" -eq "$SUSPECTS" ] || TOLERABLE=false
-if [ "$TOLERABLE" = "true" ]; then
-  while IFS=$'\t' read -r _name _sha nflagged engines verdicts _completed; do
-    [ "$nflagged" = "1" ] || TOLERABLE=false
-    [ "$engines" = "Microsoft" ] || TOLERABLE=false
-    case "$verdicts" in
-    *'!ml') ;;
-    *) TOLERABLE=false ;;
-    esac
-  done < /tmp/vt_suspects.tsv
-fi
-
-if [ "$TOLERABLE" != "true" ]; then
+if [ -f /tmp/vt_gate_fail ]; then
   echo "BLOCKED: One or more VirusTotal checks failed"
   exit 1
 fi
-
-# ── Every failure matches the ML-FP pattern: require endpoint evidence ──────
-EVIDENCE=/tmp/defender-endpoint-verification.txt
-rm -f "$EVIDENCE"
-if ! gh release download "${VERSION:?}" \
-  --pattern defender-endpoint-verification.txt \
-  --output "$EVIDENCE" --repo "${GITHUB_REPOSITORY:-DeusData/codebase-memory-mcp}" \
-  2>/dev/null; then
-  echo "BLOCKED: all detections match the pre-release ML false-positive pattern"
-  echo "  (single engine, Microsoft, '!ml' verdict) but the release carries no"
-  echo "  Defender endpoint evidence. To verify Microsoft's shipping product"
-  echo "  against these exact bytes and attach the proof, run locally:"
-  echo ""
-  NAMES=$(cut -f1 /tmp/vt_suspects.tsv | sed 's/\.exe$//' | tr '\n' ' ')
-  echo "    scripts/ci/av-endpoint-verify.sh $VERSION $NAMES--upload"
-  echo ""
-  echo "  then RE-RUN THIS JOB (Re-run failed jobs — it does not rebuild, so"
-  echo "  the bytes and hashes stay identical)."
-  exit 1
-fi
-
-MISSING=false
-while IFS=$'\t' read -r name sha _rest; do
-  if grep -qE "^${sha}[[:space:]]+[^[:space:]]+[[:space:]]+CLEAN[[:space:]]*$" "$EVIDENCE"; then
-    echo "ENDPOINT-VERIFIED: $name ($sha) clean on a current Defender endpoint"
-  else
-    echo "BLOCKED: $name ($sha) has no CLEAN endpoint-evidence line"
-    MISSING=true
-  fi
-done < /tmp/vt_suspects.tsv
-if [ "$MISSING" = "true" ]; then
-  echo "  Evidence file present but stale or incomplete — regenerate it with"
-  echo "  scripts/ci/av-endpoint-verify.sh (hashes must match this build)."
-  exit 1
-fi
-
-cp /tmp/vt_suspects.tsv /tmp/vt_tolerated.tsv
-echo "=== TOLERATED (pre-release ML false-positive policy) ==="
-sed -n 's/^# //p' "$EVIDENCE"
-echo "Every remaining engine reports clean; the detections above are Microsoft"
-echo "ML heuristics that Microsoft's own shipping Defender does not reproduce."
-echo "The release notes will state this transparently, with the evidence file"
-echo "attached as a release asset."
-exit 0
+echo "=== All VirusTotal scans passed ==="