fix(vscode): DQS tooltip shows 🚨 SECURITY BREACH on Z201 status (LSP-FIX-015)

.bumpversion.toml

@@ -46,30 +46,3 @@ replace = 'git tag -s -m "Release v{new_version}" v{new_version}'
 filename = "RELEASE.md"
 search = "git push origin v{current_version}"
 replace = "git push origin v{new_version}"
-
-# ── README.md ─────────────────────────────────────────────────────────────────
-
-[[tool.bumpversion.files]]
-filename = "README.md"
-search = "Zenzic Core v{current_version} or higher"
-replace = "Zenzic Core v{new_version} or higher"
-
-[[tool.bumpversion.files]]
-filename = "README.md"
-search = "minimum required Core version (`v{current_version}`)"
-replace = "minimum required Core version (`v{new_version}`)"
-
-[[tool.bumpversion.files]]
-filename = "README.md"
-search = "virtual environment containing Core `v{current_version}` or higher"
-replace = "virtual environment containing Core `v{new_version}` or higher"
-
-[[tool.bumpversion.files]]
-filename = "CONTRIBUTING.md"
-search = "**Zenzic Core `v{current_version}`** (`MIN_CORE_VERSION = '{current_version}'` in `src/extension.ts`)."
-replace = "**Zenzic Core `v{new_version}`** (`MIN_CORE_VERSION = '{new_version}'` in `src/extension.ts`)."
-
-[[tool.bumpversion.files]]
-filename = "CONTRIBUTING.md"
-search = "| **Zenzic Core** | ≥ {current_version} |"
-replace = "| **Zenzic Core** | ≥ {new_version} |"

.github/workflows/ci.yml

@@ -15,10 +15,7 @@ permissions:
 jobs:
   verify:
     name: Verify & Package
-    strategy:
-      matrix:
-        os: [ubuntu-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v7

.github/workflows/codeql.yml

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: 2026 PythonWoods <dev@pythonwoods.dev>
+# SPDX-License-Identifier: Apache-2.0
+
+name: Zenzic VS Code CodeQL
+
+on:
+  push:
+    branches: [ main ]
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - '.github/workflows/codeql.yml'
+  pull_request:
+    branches: [ main ]
+    paths:
+      - 'src/**'
+      - 'package.json'
+      - '.github/workflows/codeql.yml'
+  schedule:
+    - cron: '24 3 * * 1'
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    if: vars.ENABLE_CODEQL == 'true'
+    name: Analyze
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ javascript-typescript ]
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3

CHANGELOG.md

@@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- **Suppression Code Actions (`LSP-FEAT-003`)**: Added support for automated inline suppressions. You can now use the Quick Fix (Lightbulb) menu to instantly inject `<!-- zenzic:ignore:ZXXX -->` comments above offending lines. This feature is intentionally disabled for Z2xx Security findings.
+
+### Fixed
+- **DQS Tooltip Rendering (`LSP-FIX-015`)**: Fixed a rendering issue where a `security_breach` status incorrectly displayed green checkmarks in the DQS tooltip. The tooltip now prominently displays a security breach warning.
+- **Core Baseline Alignment**: Realigned pinned Zenzic Core baseline to `0.26.3`.
+
 ## [0.26.2] - 2026-07-28
 
 ### Fixed

CONTRIBUTING.md

@@ -27,7 +27,7 @@ Zenzic is structured across three independent, dedicated repositories:
 
 - **Thin Client Sovereignty**: `zenzic-vscode` contains **zero** AST parsing, regex checks, or link validation rules. All analysis logic resides in Zenzic Core (`zenzic lsp`).
 - **Protocol Parity**: The extension communicates via standard Language Server Protocol (LSP) over stdio.
-- **Minimum Core Baseline**: Currently pinned to **Zenzic Core `v0.26.2`** (`MIN_CORE_VERSION = '0.26.2'` in `src/extension.ts`).
+- **Minimum Core Baseline**: Currently pinned to **Zenzic Core `v0.26.3`** (`MIN_CORE_VERSION = '0.26.3'` in `src/extension.ts`).
 
 ---
 
@@ -51,7 +51,7 @@ To maintain security, architectural integrity, and legal compliance, all contrib
 | **npm** | required | Package manager |
 | **just** | required | Task runner — `cargo install just` or via OS package manager |
 | **reuse** | required | SPDX license auditor (`uv tool install reuse`) |
-| **Zenzic Core** | ≥ 0.26.2 | Core engine (`uv tool install zenzic`) |
+| **Zenzic Core** | ≥ 0.26.3 | Core engine (`uv tool install zenzic`) |
 
 ---
 

README.md

@@ -29,8 +29,8 @@ Modify a heading or link in one file, and Zenzic's Virtual Site Map (VSM) instan
 ### 3. Adapter-Driven Config Hot-Reloading (`v0.25.0`)
 When framework configuration files (e.g. `mkdocs.yml`, `zensical.toml`, `.zenzic.toml`) are modified, the Language Server automatically reloads adapter metadata and rebuilds the Virtual Site Map without requiring an extension or editor restart.
 
-### 4. Inline Diagnostics & Quick Fixes
-Hover over any diagnostic to view the exact Z-Code, DQS score penalty, and remediation guidance. Apply automated Quick Fixes via `textDocument/codeAction` directly from the editor lightbulb menu.
+### 4. Inline Diagnostics, Quick Fixes & Automated Suppressions
+Hover over any diagnostic to view the exact Z-Code, DQS score penalty, and remediation guidance. Apply automated Quick Fixes or insert Automated Inline Suppressions (`<!-- zenzic:ignore:ZXXX -->`, except for `Z2xx` Security findings) via `textDocument/codeAction` directly from the editor lightbulb menu.
 
 ### 5. DQS Workspace UI
 Stream Document Quality Score (DQS) updates directly to the status bar, providing real-time visibility into overall repository health.
@@ -46,7 +46,7 @@ To guarantee sub-50ms performance, Zenzic operates with a strict separation of c
 
 ## Requirements
 
-This extension requires **Zenzic Core v0.26.2 or higher**.
+This extension requires **Zenzic Core v0.26.3 or higher**.
 
 We recommend installing or updating the global binary via `uv`:
 
@@ -101,12 +101,12 @@ The extension contributes the following commands to the Command Palette:
 
 ### Zenzic: Outdated Core
 
-- **Cause**: The executable resolved by the extension is older than the minimum required Core version (`v0.26.2`).
+- **Cause**: The executable resolved by the extension is older than the minimum required Core version (`v0.26.3`).
 - **Remediation**: Upgrade your global binary:
   ```bash
   uv tool install --force zenzic
   ```
-  Or point `zenzic.executablePath` in `settings.json` to a virtual environment containing Core `v0.26.2` or higher.
+  Or point `zenzic.executablePath` in `settings.json` to a virtual environment containing Core `v0.26.3` or higher.
 
 
 ### Zenzic: Not Found (ENOENT)

RELEASE.md

@@ -9,7 +9,7 @@
 | Field | Value |
 | :--- | :--- |
 | **Extension Version** | 0.26.2 |
-| **Pinned Core** | `zenzic>=0.26.2` |
+| **Pinned Core** | `zenzic>=0.26.3` |
 | **Date** | 2026-07-11 |
 
 ## 1. Pre-Flight Checklist

src/extension.ts

@@ -20,7 +20,7 @@ let dqsStatusBarItem: vscode.StatusBarItem | undefined;
 // A2 fix: guard flag prevents concurrent restart calls.
 let restarting = false;
 
-const MIN_CORE_VERSION = '0.26.2';
+const MIN_CORE_VERSION = '0.26.3';
 
 /**
  * Expand supported user-facing path variables in zenzic.executablePath.
@@ -415,18 +415,40 @@ export async function activate(context: vscode.ExtensionContext) {
                         const status = report.status ?? 'unknown';
                         const debt = report.suppression_debt_pts ?? 0;
 
-                        const icon = score >= 80 ? '$(dashboard)' : score >= 50 ? '$(warning)' : '$(error)';
-                        dqsStatusBarItem.text = `${icon} Zenzic DQS: ${score}/100`;
-
-                        const categoryLines = (report.categories ?? [])
-                            .map(c => `  ${c.name}: ${c.issues === 0 ? '✓' : `${c.issues} issue(s)`}`)
-                            .join('\n');
-                        dqsStatusBarItem.tooltip = [
-                            `Documentation Quality Score: ${score}/100`,
-                            `Status: ${status}`,
-                            debt > 0 ? `Technical Debt: -${debt}pts` : '',
-                            categoryLines ? `\nBreakdown:\n${categoryLines}` : '',
-                        ].filter(Boolean).join('\n');
+                        // LSP-FIX-015 Fix 3: security_breach (Z201) forces score to 0.
+                        // Do NOT show category checkmarks — they would be misleading.
+                        // A credential was detected; the status bar and tooltip must
+                        // communicate the breach prominently and unambiguously.
+                        const isSecurityBreach = status === 'security_breach';
+
+                        const icon = isSecurityBreach
+                            ? '$(shield)'
+                            : score >= 80 ? '$(dashboard)' : score >= 50 ? '$(warning)' : '$(error)';
+                        dqsStatusBarItem.text = isSecurityBreach
+                            ? `${icon} Zenzic DQS: SECURITY BREACH`
+                            : `${icon} Zenzic DQS: ${score}/100`;
+
+                        if (isSecurityBreach) {
+                            dqsStatusBarItem.tooltip = [
+                                '🚨 ZENZIC — SECURITY BREACH DETECTED 🚨',
+                                '',
+                                'A credential or hardcoded secret was found in the documentation.',
+                                'Score is forced to 0/100 — Z201 is non-suppressible.',
+                                '',
+                                '⚠️  Rotate the exposed credential immediately.',
+                                'Reference: https://zenzic.dev/docs/reference/finding-codes#Z201',
+                            ].join('\n');
+                        } else {
+                            const categoryLines = (report.categories ?? [])
+                                .map(c => `  ${c.name}: ${c.issues === 0 ? '✓' : `${c.issues} issue(s)`}`)
+                                .join('\n');
+                            dqsStatusBarItem.tooltip = [
+                                `Documentation Quality Score: ${score}/100`,
+                                `Status: ${status}`,
+                                debt > 0 ? `Technical Debt: -${debt}pts` : '',
+                                categoryLines ? `\nBreakdown:\n${categoryLines}` : '',
+                            ].filter(Boolean).join('\n');
+                        }
 
                     } catch {
                         dqsStatusBarItem.text = '$(error) Zenzic DQS: Parse Error';