v1.0.0 — agentic retest console, evaluation, and a deployable stack

revalid 1.0 — an AI-driven system for the revalidation of pentest findings.

Feed it a pentest report; it extracts the findings, drafts a retest goal for each, and works one
finding at a time inside an egress-locked sandbox — proposing a command, waiting for you to approve
it, reading the real output, and deciding what to try next. It never declares a finding fixed
without evidence, and it hands back rather than guessing.

This release closes M5 (Evaluation) and M6 (Agentic interactive retest), and makes the tool
deployable.

---

Deploy it

make deploy      # → http://127.0.0.1:8000

Docker is the only prerequisite — no Python or Node toolchain. The stack is the app (backend + built
SPA) plus the pinned Juice Shop lab, both loopback-bound. Your LLM stays on your host, so no model
weights are pulled in. See ADR-0044, which also states
plainly what mounting the Docker socket grants and why it is accepted only under the single-operator
threat model.

The retest model changed completely

v0.4.0 retested by generating a batch of typed HTTP probes, approving the batch, and running it.
One weak payload spoiled the whole batch and could produce a false "fixed" — the one verdict a
revalidation tool must never get wrong.

That path is deleted (ADR-0033). In its place is
an interactive agentic console (FR-17) where the agent reasons, runs one command, observes the
real output, and decides the next — with a human approving every command before it touches the
target.

• Egress-locked sandbox. Each session gets a Docker --internal network with only the scoped
  target attached — no gateway, no route out. Command content is never inspected because it cannot
  matter: there is nowhere else to reach. Online targets go through a deny-all-by-default
  allowlisting proxy instead (ADR-0041).
• Guided by default. The agent does one action per turn and hands back, so you drive. Flip
  Auto-run and it drives itself (ADR-0040).
• One agent, one voice. Type into the console at any point — including at an approval prompt,
  which withdraws the pending command and steers instead
  (ADR-0042).
• You own the goal, you conclude, you can reopen a verdict you think was premature
  (ADR-0043), and the append-only transcript is
  what every verdict is derived from.

Also new since v0.4.0

• Reports chat (FR-18) — a read-only assistant over the whole corpus with typed query tools,
  answering token-by-token over SSE.
• CVSS + MITRE ATT&CK enrichment (FR-19) — copied verbatim when the report states them,
  derived and explicitly flagged inferred when it does not.
• Kali toolbox sandbox image, operator lifecycle controls (start/stop/resume/restart/reopen),
  streamed model reasoning, and scope-driven sandbox targeting.

Evaluation (FR-15) — the honest numbers

Twelve findings from a real external Juice Shop report, against the pinned unpatched v17.1.1 lab,
on a local qwen3.6 27B backend:

Correct	8
Inconclusive (safe hedge)	4
Confidently wrong	0

NFR-01's safety constraint held — the system never issued a false clearance, and hedged on the
four it could not confirm rather than guessing. Its ≥70% accuracy bar was missed at 67%, entirely
on those safe hedges.

The timing study is less flattering and is reported as such: a lean manual pass over the same twelve
findings took ≈60 min and resolved all twelve, against the guided run's 52 min and 8/12. Removing
the approval gate bought no meaningful speed (29.7 min vs 32.5 on the nine non-browser findings),
because the bottleneck is model latency, not the human. On this backend the tool is neither faster
nor more accurate than a careful operator; what it adds is that it constructs the checks, keeps an
append-only audit trail, and never issues a false clearance.

One report, one target, one operator, one backend. A first data point, not a study — the thesis says
so in its threats to validity.

Project state

• 44 ADRs, all accepted or superseded — none left proposed.
• 287 unit + 75 integration backend tests; 160 frontend tests.
• mypy --strict, ruff, xenon --max-absolute C, radon average A, vulture clean, pylint
  duplicate-code 9.99.
• Thesis: 104 pages, zero undefined references, Evaluation chapter included.

Full changelog: v0.4.0...v1.0.0