Repository Detective v0.1.0-beta.5

Repository Detective v0.1.0-beta.5

Public Beta — CAH trust-boundary hardening, issue-create race fix, SQLite test-mode, SBOM UX, learning/AI assist.

Identity

Field	Value
Version	v0.1.0-beta.5
Image digest	sha256:e26caafb19e3252230119929bd89681feb6b91166b9427c8253bc0e372130215
E2E forge	Gitea 1.22.3 (same baseline as beta.3/4)
License	AGPL-3.0-or-later
Release posture	Public beta — forge issue filing on by default (auto_create_issues: true); severity/confidence gates still apply

What's new since v0.1.0-beta.4

CAH / AI trust boundary

• System-level data-only guardrails on auditor, analysis, attack-surface, debater, and PoC prompts
• Stable untrusted-file delimiters (RD_UNTRUSTED_REPO_FILE_*) around repository source
• OpenClaw advisory system prompt documents the same trust boundary for redacted packets

Issue filing

• Default is on (auto_create_issues: true) — filing forge issues is the product path so findings can be corrected
• In-process serialization of fingerprint lookup → create (prevents duplicate forge issues under concurrency)
• Cross-process forge deduplication remains NOT_PROVEN (fingerprint + local mappings still apply; multi-process proof pending)
• Per-scan report-only dry-run remains available when you need a no-forge pass

SQLite test reliability

• Test binaries select journal_mode=MEMORY before any WAL transition (fixes suite timeouts)

Self-scan / learning / SBOM (dogfood)

• golang.org/x/net v0.60.0 (CVE-2026-78669)
• SBOM detects pyproject.toml / setup.py / setup.cfg
• UI no longer claims “SBOM file missing on disk” for sbom_no_supported_manifest
• AI-assisted learning: advisory ingest → calibration auto-apply; U1000 blocked from auto-downgrade

Install (container)

docker pull git.commsnet.org/commstech/repository-detective:v0.1.0-beta.5
# optional public mirror
docker pull ghcr.io/commstech/repository-detective:v0.1.0-beta.5

Also tagged :v0.1.0-beta.5-all-in-one when published via the release pipeline.

Pin with compose:

export RD_IMAGE=git.commsnet.org/commstech/repository-detective:v0.1.0-beta.5
docker compose up -d

Known limitations (honest)

• Remediation PR execution remains disabled by default
• LLM auditors remain off by default (cost control); advisory AI is optional and budget-capped
• Cross-process issue idempotency and ClusterMGR restart/recovery proofs remain NOT_PROVEN
• Image signing remains CHECKSUM_ONLY (no cosign yet)
• CAH fallback scanner still reports fixture/example noise (zero weaponizability)

Security

Report privately — see SECURITY.md.

Mirror note

Canonical development history lives on Gitea. GitHub is the public mirror; tag SHAs may differ while trees match.

Repository Detective v0.1.0-beta.4

Repository Detective v0.1.0-beta.4

Public Beta — AI harness hardening + cookie security closeout.

Identity

Field	Value
Version	v0.1.0-beta.4
Source commit (Gitea canonical)	63672b5a (product tip 0c4ceed4 + release docs + Go 1.25 govulncheck image pin)
Container digest	sha256:8d6f224b66870c761c4b1b3f87b74bad98dae215edaba3a381c871d7ba1264ea
E2E forge	Gitea 1.22.3 (same baseline as beta.3)
License	AGPL-3.0-or-later

What's new since v0.1.0-beta.3

AI harness hardening (ponytail-influenced)

• Cross-auditor shared cancel + abort-on-first-timeout + per-scan failure budget
• RunAuditor single-flight and immediate cancel respect
• Lean defaults: auto_after_scan=false, CAH max candidates 6, token budget 1200
• ai_recommendations_value_mode=actionable_security — prefer security/workflow findings; skip GRAPH-ORPHAN / HEALTH / LINT noise
• Preflight skip when recent llm_auditor_timeout / ai_advisory_failed counts are high or the AI endpoint probe fails
• Harness contract rd-cah-v3
• Global ENABLE_LLM_AUDITORS=false kill-switch still wins over deep/profile overrides; cost lockdown remains the safe default

Learning / cost lockdown (included)

• Disposition-only FP rates; AI advisory calibrate ingest; auditor timeout learning events
• 24h auditor timeout circuit-breaker

Security closeout

• Fixed gosec G124 on UI API-key cookies (ui/api_key_auth.go, ui/api_key_cookie.go) via gin SetCookie / SetSameSite
• Secure still follows public_url (HTTPS → secure; HTTP homelab unlock still works)
• Product forge issues #478 / #479 closed as resolved-verified

Install (binaries)

Download assets from this release, verify SHA256SUMS, then run the binary for your OS/arch with your existing .env / compose setup.

sha256sum -c SHA256SUMS

Container

All-in-one image published to Gitea Package Registry and GHCR:

docker pull git.commsnet.org/commstech/repository-detective:v0.1.0-beta.4
docker pull ghcr.io/commstech/repository-detective:v0.1.0-beta.4
# digest pin (preferred)
docker pull ghcr.io/commstech/repository-detective@sha256:8d6f224b66870c761c4b1b3f87b74bad98dae215edaba3a381c871d7ba1264ea

Also tagged :v0.1.0-beta.4-all-in-one, :all-in-one, and :latest on both registries.

Known limitations (honest)

• Same product limitations as beta.3 unless noted above
• Remediation PR execution remains disabled by default
• LLM auditors / auto-after-scan AI remain off by default (intentional cost control)
• Image signing remains CHECKSUM_ONLY (no cosign yet)

Security

Report privately — see SECURITY.md.

Mirror note

Canonical development history lives on Gitea. GitHub is the public mirror; tag SHAs may differ while trees match.

Repository Detective v0.1.0-beta.3

Repository Detective v0.1.0-beta.3

Public Beta — accepted baseline.

Identity

Field	Value
Version	v0.1.0-beta.3
OCI digest	sha256:6a615548c8a1fc2494140e73f1c3bd3f78f0ed54a7b15eaa7a1025e83e308727
E2E forge	Gitea 1.22.3 only
Source commit (in image)	e130bfb
License	AGPL-3.0-or-later

Same digest is published to:

• git.commsnet.org/commstech/repository-detective
• ghcr.io/commstech/repository-detective (public mirror)

What this release is

Self-hosted, Gitea-first repository investigation: deterministic analysis, canonical finding lifecycle, owner-defined policy evaluation, and remediation planning. AI is optional. Remediation PR execution remains disabled by default.

Proof (links)

• Acceptance evidence — clean-install + published-image E2E on this digest
• Scanner coverage
• Verify release — digest + SBOM checksums
• Container SBOM (SPDX + CycloneDX for the digest above)

Install

docker pull ghcr.io/commstech/repository-detective@sha256:6a615548c8a1fc2494140e73f1c3bd3f78f0ed54a7b15eaa7a1025e83e308727
# or clone and use docker compose (pin RD_IMAGE to the digest above)

See QUICKSTART.

Known limitations (honest)

• Gitea 1.22.3 is the only E2E-proven forge/version
• Forgejo not proven; GitLab not implemented; GitHub issue-provider experimental
• Multi-user/RBAC not production-ready
• Class-B remediation sandbox NOT_PROVEN; remediation PR execution disabled by default
• Upgrade E2E NOT_PROVEN
• Image signing: CHECKSUM_ONLY (digest + SBOM checksums; no cosign yet)

Security

Report privately — see SECURITY.md. Do not post exploit details in public issues.

Mirror note

This GitHub tag is a sanitized public snapshot of the Gitea release source. Canonical development history lives on Gitea. See GITHUB_MIRROR.md.