fix: harden stale baselines and benchmark provenance

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## v1.1.1 - 2026-10-20
+
+### Fixed
+
+- Matched baseline entries created under an older rule-semantics version now enter human review instead of remaining silently accepted.
+- Benchmark environment data now resolves Git revision and worktree state from the benchmark project root, and records a clean worktree explicitly.
+
 ## v1.1.0 - 2026-10-20
 
 ### Added

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["crates/*", "apps/desktop/src-tauri"]
 
 [workspace.package]
-version = "1.1.0"
+version = "1.1.1"
 edition = "2024"
 rust-version = "1.90"
 license = "Apache-2.0"

README.md

@@ -9,7 +9,7 @@ autonomous coding agent.
 [![CI](https://github.com/styayur/codeforge-engine/actions/workflows/ci.yml/badge.svg)](https://github.com/styayur/codeforge-engine/actions/workflows/ci.yml)
 [![License: Apache-2.0](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE)
 
-[Documentation](docs/README.md) · [Latest stable release: v1.1.0](https://github.com/styayur/codeforge-engine/releases/tag/v1.1.0) · [Changelog](CHANGELOG.md)
+[Documentation](docs/README.md) · [Latest stable release: v1.1.1](https://github.com/styayur/codeforge-engine/releases/tag/v1.1.1) · [Changelog](CHANGELOG.md)
 
 ## Why CodeForge
 
@@ -75,7 +75,7 @@ missing required tools do not count as a pass.
 ## Installation
 
 Download the CLI archive for your platform from the
-[v1.1.0 release](https://github.com/styayur/codeforge-engine/releases/tag/v1.1.0),
+[v1.1.1 release](https://github.com/styayur/codeforge-engine/releases/tag/v1.1.1),
 verify it against `checksums.txt`, and extract `codeforge` (`codeforge.exe` on
 Windows). Desktop packages are available on the same page. Windows requires
 WebView2; Linux desktop builds require WebKitGTK. Packages do not install optional
@@ -84,7 +84,7 @@ language tools.
 To build the CLI from the tagged source instead:
 
 ```bash
-git clone --branch v1.1.0 --depth 1 https://github.com/styayur/codeforge-engine.git
+git clone --branch v1.1.1 --depth 1 https://github.com/styayur/codeforge-engine.git
 cd codeforge-engine
 cargo install --locked --path crates/codeforge-cli
 codeforge --version
@@ -121,7 +121,7 @@ repository. See [Verification](docs/VERIFICATION.md) and
 [baseline setup](docs/baseline.md); a baseline must be reviewed, not generated
 merely to make CI green.
 
-Experimental commands included in the v1.1.0 package:
+Experimental commands included in the v1.1.1 package:
 
 ```bash
 codeforge context . --query verification --limit 10 --max-bytes 32768

SECURITY.md

@@ -1,7 +1,7 @@
 # Security policy
 
 Read the [security model](docs/SECURITY.md) for process, source and evidence
-boundaries. CodeForge Engine v1.1.0 is the latest stable release. There is no
+boundaries. CodeForge Engine v1.1.1 is the latest stable release. There is no
 long-term-support or security-response-time guarantee.
 
 Use [GitHub private vulnerability reporting](https://github.com/styayur/codeforge-engine/security/advisories/new)

apps/desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@codeforge/desktop",
   "private": true,
-  "version": "1.1.0",
+  "version": "1.1.1",
   "type": "module",
   "scripts": {
     "dev": "vite --host 127.0.0.1 --port 1420",

apps/desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "CodeForge Engine",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "identifier": "dev.codeforge.engine",
   "build": {
     "beforeDevCommand": "pnpm dev",

crates/codeforge-baseline/src/lib.rs

@@ -644,14 +644,23 @@ fn assessment_from_entry(
     entry: &BaselineEntry,
     match_kind: BaselineMatchKind,
 ) -> FindingAssessment {
+    let stale = is_rule_version_stale(entry);
     FindingAssessment {
         diagnostic_id: diagnostic.id.clone(),
         fingerprint: entry.fingerprint.clone(),
         rule_id: diagnostic.rule_id.clone(),
         path: entry.path.clone(),
         match_kind,
-        disposition: entry.disposition,
-        lifecycle: FindingLifecycle::Active,
+        disposition: if stale {
+            FindingDisposition::HumanReview
+        } else {
+            entry.disposition
+        },
+        lifecycle: if stale {
+            FindingLifecycle::Stale
+        } else {
+            FindingLifecycle::Active
+        },
     }
 }
 
@@ -1077,6 +1086,43 @@ mod tests {
         assert_eq!(store.entries().len(), 2);
     }
 
+    #[test]
+    fn matched_entry_with_old_rule_version_requires_human_review() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let path = temp.path().join("src/lib.rs");
+        std::fs::create_dir_all(path.parent().expect("parent")).expect("src");
+        std::fs::write(&path, "fn value() { let value = 1; }\n").expect("source");
+        let diagnosis = diagnostic(&path, 1, "known issue");
+        let fingerprint = fingerprint_diagnostic(&diagnosis, temp.path());
+        let entry = BaselineEntry {
+            fingerprint: fingerprint.exact.clone(),
+            structural_fingerprint: Some(fingerprint.structural.clone()),
+            context_fingerprint: Some(fingerprint.context.clone()),
+            rule_id: diagnosis.rule_id.clone(),
+            path: PathBuf::from("src/lib.rs"),
+            symbol: fingerprint.symbol.clone(),
+            context_hash: Some(fingerprint.context_hash.clone()),
+            source_context: SourceContext::Production,
+            disposition: FindingDisposition::Accepted,
+            reason: Some("reviewed under an older rule".to_owned()),
+            first_seen: Utc::now(),
+            last_reviewed: Some(Utc::now()),
+            rule_version: Some("0".to_owned()),
+            lifecycle: FindingLifecycle::Active,
+        };
+        let store = BaselineStore::from_file(BaselineFile {
+            schema_version: 1,
+            codeforge_version: env!("CARGO_PKG_VERSION").to_owned(),
+            entries: vec![entry],
+        })
+        .expect("store");
+        let assessments = store.classify_diagnostics(&[diagnosis], temp.path());
+        assert_eq!(assessments.len(), 1);
+        assert_eq!(assessments[0].match_kind, BaselineMatchKind::Exact);
+        assert_eq!(assessments[0].lifecycle, FindingLifecycle::Stale);
+        assert_eq!(assessments[0].disposition, FindingDisposition::HumanReview);
+    }
+
     #[test]
     fn prune_retains_stale_entries_and_requires_complete_scan() {
         let temp = tempfile::tempdir().expect("tempdir");

crates/codeforge-benchmark/Cargo.toml

@@ -14,3 +14,6 @@ serde.workspace = true
 thiserror.workspace = true
 tokio.workspace = true
 tracing.workspace = true
+
+[dev-dependencies]
+tempfile.workspace = true