SYRTH v1-prod

SYRTH v1-prod

SYRTH is a static analyser for Python that reports the nearest vulnerability
class to your code, with the evidence and a likelihood, and verifies its own
patches. It is a risk-surface mapper, not a verdict machine: it does not
decide whether code is safe, and it never deletes a finding to improve a number.

This is the first production release. The tag is v1-prod; the packaged version
is 1.0.0+prod, because PEP 440 can only carry the channel name as a local
version segment after a +.

What is measured

On the built corpus (350 records, 175 vulnerable/patched pairs, 24 repositories),
against an independent AST scan that shares no code with the analyser:

Measurement	Result
category coverage	95.7% (111/116)
rank agreement	100% (22/22)
rename invariance	100% (350/350)
patch kill rate	89.0% (89/100)
determinism	100% (350/350)

No precision or recall figure is published. The corpus has no reliable negative
class, so a precision number would measure the corpus rather than the analyser.
The full methodology and the six-instrument comparison are in docs/benchmark.md.

This release

v1-prod is the first release of the rewritten history. The analyser is
functionally unchanged from the withdrawn 1.0.1; what changed is what the
repository publishes.

• Internal working material, unpublished paper drafts, raw prompt transcripts and
  machine-specific paths are gone from the tree and from the repository history.
• The retired v1 pipeline and its benchmark artefacts are gone from history.
  docs/withdrawn-v1.md records what that pipeline claimed and why every
  quantitative result was withdrawn.
• Commit metadata is normalised: no personal email address is published.
• Releases 1.0.0 and 1.0.1 are withdrawn. Their artefacts described a tree that is
  no longer published, and v1-prod replaces them.

Install

Python 3.10+. Runtime dependencies are tree-sitter and tree-sitter-python; no
PyTorch, no model server, no network.

pip install syrth-1.0.0+prod-py3-none-any.whl
syrth --file app.py

PyPI publishing is not enabled, so the wheel and sdist attached to this release
are the distribution channel.

Verify

• python -m pytest tests -q — 624 tests.
• ruff check syrth tests benchmarks tools — clean.
• CI runs the suite on Ubuntu, Windows and macOS at Python 3.10 and 3.12, builds
  the artefacts from the tagged commit, and checks that the tag and the version
  agree.