Changelog
Features
- 5d6810d: feat(ai-triage): add P1 shadow evaluation harness (@H1eu232)
- ef2ddc8: feat(ai-triage): add durable human review workflow (@H1eu232)
- 5ce338c: feat(ai-triage): add evidence-rich deterministic context (#512) (@VietSory)
- 2f2109a: feat(ai-triage): add observability budgets and resilience (#513) (@H1eu232)
- b7e6361: feat(ai-triage): annotate gate exemptions in SARIF (@XUanhoa04)
- 7e70d83: feat(ai-triage): bound per-scan LLM work (@XUanhoa04)
- 5b2a832: feat(ai-triage): cache decisions by complete context (#510) (@XUanhoa04)
- 9d722e9: feat(ai-triage): complete provider-independent verifier (P1.3) (#502) (@H1eu232)
- e494513: feat(ai-triage): curate reviewer feedback for evaluation (#553) (@VietSory)
- cf224c3: feat(ai-triage): detect input distribution drift (#555) (@XUanhoa04)
- b0667d4: feat(ai-triage): enforce P0 gate-exemption policy (#398) (@H1eu232)
- c432d51: feat(ai-triage): gate promotion against baseline (#554) (@XUanhoa04)
- 8bafbff: feat(ai-triage): gate promotion on adversarial invariance (#562) (@XUanhoa04)
- cffc82b: feat(ai-triage): govern model promotion and rollback (#559) (@H1eu232)
- 1c0c766: feat(ai-triage): reproducible eval CI gate + dataset coverage (#388) (#561) (@nghiadaulau)
- 2e06340: feat(appsec): add sanctioned source snapshot publishing (@VietSory)
- 42a23d0: feat(asset): add asset-centric security management (#474) (@nnatuan03)
- 7d00d60: feat(blueteam): agent-side detection engine, wired into the VM agent (#422 phase 3) (#504) (@nghiadaulau)
- 8c6649a: feat(blueteam): columnar telemetry tier for retro hunting (#424) (#507) (@nghiadaulau)
- 44284ad: feat(blueteam): detection engine domain — rules, events, coverage honesty (#422 phase 1) (#501) (@nghiadaulau)
- f187282: feat(blueteam): detections as hash-chained, attributable evidence (#423) (#505) (@nghiadaulau)
- 4bd89c8: feat(blueteam): eBPF detection sensor — host-wide observers per class (#422 phase 2) (#503) (@nghiadaulau)
- ffbe041: feat(blueteam): governed, reversible, audited response actions (#425) (#508) (@nghiadaulau)
- 62f1831: feat(code-quality): add immutable analysis source and diff workspace (#329) (@pho-veteran)
- 421bd56: feat(codequality): Rust rule pack — 87 rules (#197) (#333) (@nghiadaulau)
- 6727eb1: feat(codequality): add Azure Resource Manager rule pack (#349) (@VietSory)
- 84ff444: feat(codequality): add CSS correctness rule family (#332) (@VietSory)
- d253957: feat(codequality): add HTML correctness rule family (#336) (@VietSory)
- 0fa5eeb: feat(codequality): add HTML security rule family (#337) (@VietSory)
- de376df: feat(codequality): add Kotlin rule pack (#365) (@pho-veteran)
- e4ba787: feat(codequality): add PHP rule pack (#375) (@pho-veteran)
- be75134: feat(codequality): add Ruby and Rails rule pack (#373) (@VietSory)
- 32bcafa: feat(codequality): add Swift rule pack (#364) (@pho-veteran)
- 76337f6: feat(codequality): add Text rule pack with streaming scanner and structured finding identity (#350) (@pho-veteran)
- 001533b: feat(codequality): add VB.NET rule pack (#377) (@pho-veteran)
- ca5b92c: feat(codequality): complete CSS maintainability rule family (#335) (@VietSory)
- ad738c4: feat(codequality): complete HTML maintainability rule family (#348) (@VietSory)
- e0b6204: feat(correlation): gate cross-pillar promotions (#558) (@pho-veteran)
- eb59524: feat(correlation): unified per-asset risk story (#427) (#560) (@nghiadaulau)
- 8b365ae: feat(cspm): live cloud posture connectors for AWS, Azure and GCP (#511) (@pho-veteran)
- a3429ba: feat(dast): add governed authenticated scanning for issues 416 and 417 (@pho-veteran)
- 79cbdec: feat(fleet): Kubernetes collector for cluster inventory (#411) (#443) (@nghiadaulau)
- 87c9c55: feat(fleet): VM agent for host inventory (#410) (#439) (@nghiadaulau)
- 130d6d3: feat(fleet): VM host inventory ingest into the asset model (#446) (#449) (@nghiadaulau)
- 9300625: feat(fleet): agent certificate identity and revocation (#408) (#438) (@nghiadaulau)
- bc5a595: feat(fleet): agent clean-uninstall decommission lifecycle (#412) (#564) (@nghiadaulau)
- a91bb94: feat(fleet): agent health, per-asset coverage and freshness views (#413) (#454) (@nghiadaulau)
- 9582841: feat(fleet): agent version skew + self-update core + release foundation (#412) (#453) (@nghiadaulau)
- 40e4d50: feat(fleet): agent-facing API with agent identity and auth (#409) (#436) (@nghiadaulau)
- f33090f: feat(fleet): cluster snapshot ingest endpoint (#446) (#447) (@nghiadaulau)
- d52845a: feat(fleet): cluster-agent binary + read-only ClusterRole (#411) (#444) (@nghiadaulau)
- bf1abd8: feat(fleet): cluster-inventory to asset mapping core (#411) (#441) (@nghiadaulau)
- 20894da: feat(fleet): cluster-inventory usecase — persist mapped assets (#411) (#442) (@nghiadaulau)
- 037fdea: feat(fleet): fleet asset model, multi-tenant and RLS-enforced (#431) (#434) (@nghiadaulau)
- fb45896: feat(fleet): release-engineering gates, signed update manifest and rollout control (#412) (#472) (@nghiadaulau)
- 4b98f20: feat(fleet): scanned-image digest correlation for cluster coverage (#446) (#450) (@nghiadaulau)
- bfc98da: feat(fleet): web views for agent health and per-asset coverage (#413) (#456) (@nghiadaulau)
- 03ae54c: feat(fleet): wire cluster agent to enrol + report snapshots (#446) (#448) (@nghiadaulau)
- b071436: feat(fleet): work order model, addressed, signed and RLS-enforced (#407) (#435) (@nghiadaulau)
- 490bb49: feat(governance): ingest third-party SARIF under the same governance path (#415) (#465) (@nghiadaulau)
- 95fc793: feat(jsresolve): add R2A workspace metadata inventory (#404) (@VietSory)
- 1921306: feat(jsresolve): add R2B module specifier and alias resolution (#440) (@VietSory)
- b47f6d0: feat(modulegraph): add Phase 5A domain types and JSImportScanner port (#399) (@VietSory)
- 43b9162: feat(platform): Postgres Row Level Security foundation (#432) (#433) (@nghiadaulau)
- ed6a02b: feat(platform): fenced-lease leader election (#406) (#437) (@nghiadaulau)
- 34b9b21: feat(purple): detection coverage from emulation expected vs actual (#426) (#509) (@nghiadaulau)
- 15b6959: feat(reachability): Tier-2 JavaScript affected-export reachability (#378 R5) (#469) (@nghiadaulau)
- 76483cf: feat(reachability): add the Tier-1 JavaScript/TypeScript reachability analyzer (#401) (#461) (@nghiadaulau)
- fe0afa6: feat(reachability): correlate JS/TS imports to SBOM components by exact purl (#400) (#459) (@nghiadaulau)
- aa62033: feat(reachability): harden npm and pnpm lockfile evidence (@VietSory)
- 7e5b698: feat(reachability): implement the JS/TS module import scanner (#379, epic #378) (#458) (@nghiadaulau)
- 8202919: feat(reachability): integrate JavaScript Tier-1 reachability with SCA and judgments (#378 R4) (#462) (@nghiadaulau)
- fbf6fde: feat(reachability): resolve Yarn Berry importers from lockfile evidence (@VietSory)
- 1889557: feat(reachability): select a package version from lockfile importer context (#400) (#460) (@nghiadaulau)
- af6cd14: feat(redteam): add deterministic attack path graph (@pho-veteran)
- 645d8a6: feat(redteam): adversary emulation mapped to a taxonomy, measured against detection (#421) (@nghiadaulau)
- af8b621: feat(redteam): chained exploitation under governance with per-step proof (#420) (@nghiadaulau)
- 8e17581: feat(redteam): fleet-wide chain kill-switch registry (#418/#420 follow-up) (#500) (@nghiadaulau)
- 01207d4: feat(redteam): offensive governance policy, enforced register, kill switch and dry run (#418) (@nghiadaulau)
- a049cf5: feat(redteam): record the offensive-policy review at two authority levels (closes #418) (@nghiadaulau)
- 530e5f4: feat(sca): Tier-1 reachability for Rust, PHP and Ruby (#414) (#463) (@nghiadaulau)
- b1dd039: feat(sla): complete governed remediation lifecycle (#567) (@XUanhoa04)
- 18bc6a0: feat(sla): deterministic risk-based remediation SLA scoring (#80 Phase 0) (#563) (@nghiadaulau)
- 89bf0b8: feat(vulnerability): add continuous intelligence and risk lifecycle (#557) (@nnatuan03)
- 249dd80: feat(web): add security operations dashboard (#480) (@nnatuan03)
- 372e474: feat(web): security operations analytics on the dashboard (#485) (@nnatuan03)
- 1836629: feat(xml): implement XML maintainability rule pack (#327) (@VietSory)
- a4d3117: feat: separate engagement creation from queue (#565) (@nnatuan03)
Fixes
- 4f3e236: fix(agent): treat any segment before a Bedrock provider namespace as a geographic scope (@kai-techx)
- 0bf8baf: fix(ai): fail closed on malformed model output (#471) (@XUanhoa04)
- 7faa0c7: fix(ai-triage): fail closed on exemption evidence failure (#492) (@VietSory)
- 808774c: fix(ai-triage): finish P0 review follow-ups (#452) (@H1eu232)
- 4c027b4: fix(ai-triage): keep verifier assessments blind (@XUanhoa04)
- 6498cb6: fix(ai-triage): refuse system: machine principals, and assert TRUNCATE on the mechanism that guarantees it (@kai-techx)
- d7e2d72: fix(ai-triage): report the evaluation report's Close error instead of dropping it (@nghiadaulau)
- 673359c: fix(ai-triage): wire rollout mode through composition (@H1eu232)
- 524ac5c: fix(code-quality): retain immutable source snapshots (#347) (@pho-veteran)
- 8788730: fix(codequality): preserve Git source label after restart (#344) (@pho-veteran)
- a8e87b0: fix(dast): bind the replay path to an approval, and clear the lint the pipeline never got to run (@kai-techx)
- d0a1ed0: fix(k8s): declare the enrol-token volume, and stop treating a spent token as fatal (#473) (@nghiadaulau)
- 2e7b25e: fix(llm): enforce output token limits (#455) (@XUanhoa04)
- 428f62b: fix(llm): send an explicit temperature 0 (#397) (@thx2an)
- ae3421c: fix(redteam): gate legacy runtime projection (@pho-veteran)
- d1450cd: fix(redteam): preserve upstream behavior after rebase (@pho-veteran)
- f42b403: fix(redteam): validate projection mode after rebase (@pho-veteran)
- ee5039d: fix(sca): close the remaining audit findings in Rust/PHP/Ruby reachability (#414) (#464) (@nghiadaulau)
- a9085e6: fix(web): make New Engagement the single sidebar entry for the Engagement workspace (#484) (@nnatuan03)
- 5c3f4a8: fix: harden secret scans and evidence sealing (#386) (@pho-veteran)
Others
- 94a148e: Add VietSory to the list of engineers in README (#334) (@VietSory)
- b883598: Codex/207 scala rule pack (#351) (@VietSory)
- 4f6c5e8: Merge main into codex/400-r2c-sbom-purl-correlation (@kai-techx)
- 2f03bb0: Merge main into codex/457-lockfile-hardening, and stop gating the pnpm cross-check on a version literal (@kai-techx)
- 3459eca: Merge main into codex/p1-1-evaluation-shadow (@kai-techx)
- cec68cb: Merge main into codex/p1-2-human-review (@kai-techx)
- 5b61650: Merge main into feat/419-attack-path-graph, and make the attack-path Postgres tests runnable (@kai-techx)
- f51add8: Merge upstream/main into feat/ai-triage-request-budget (@XUanhoa04)
- f9aef80: chore(ai-triage): keep P0 follow-ups separate (@H1eu232)
- 3b4a02b: chore(deps): bump actions/deploy-pages from 4 to 5 (#340) (@dependabot[bot])
- 6cdd5ec: chore(deps): bump actions/setup-python from 6 to 7 (#339) (@dependabot[bot])
- 63e774b: chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 (#495) (@dependabot[bot])
- 85c414d: chore(deps): bump docker/login-action from 4.4.0 to 4.5.1 (#338) (@dependabot[bot])
- c4f5951: chore(deps): bump docker/login-action from 4.5.1 to 4.6.0 (#380) (@dependabot[bot])
- 4f2f222: chore(deps): bump helm/kind-action from 1.10.0 to 1.14.0 (#496) (@dependabot[bot])
- 5997c55: chore(deps): bump pnpm/action-setup from 6 to 6.0.9 (#382) (@dependabot[bot])
- ab10d6b: chore(deps): bump pnpm/action-setup from 6.0.9 to 6.0.10 (#497) (@dependabot[bot])
- 3d64599: chore(deps): bump the go-dependencies group with 2 updates (#381) (@dependabot[bot])
- cd12dd7: chore(deps): bump the go-dependencies group with 3 updates (#341) (@dependabot[bot])
- 8957c9a: chore(deps): bump the go-dependencies group with 5 updates (#498) (@dependabot[bot])
- 974a2c0: chore(deps): bump the web-dependencies group in /web with 3 updates (#499) (@dependabot[bot])
- ff347d6: chore(deps): bump the web-dependencies group in /web with 7 updates (#342) (@dependabot[bot])
- 27311f7: chore(deps): bump the web-dependencies group in /web with 8 updates (#383) (@dependabot[bot])
- e8c506c: chore(lint): fix all golangci-lint issues to unblock CI (#568) (@nghiadaulau)
- fc95ca8: chore(migrations): renumber 0067-0070 to 0068-0071 after #481 took 0067 (@kai-techx)
- f50a406: ci: run Postgres integration tests fail closed (@VietSory)
- 42233db: docs(adr): telemetry store decision for retro hunting (#424 gate) (#506) (@nghiadaulau)
- 976b28d: docs(site): refresh landing page for the full platform + team roster (#552) (@nghiadaulau)
- fd9d02d: test(fleet): kind integration + 10k-pod scale tests for cluster agent (#411) (#445) (@nghiadaulau)
- ca190e5: test(sca): guard the shadow boundary at the SARIF export seam (@kai-techx)
- 26115bf: test(sourceartifact): assert the publish endpoint stores only inventory-listed files (@kai-techx)
Contributors
dependabot, nghiadaulau, and 7 other contributors