ArkheionX v10.1.0-rc1

Release candidate for ArkheionX v10.1.0.

This RC prepares the public ArkheionX surface:

• repository rename to Yudis-bit/arkheionx
• public documentation cleanup
• case-study structure
• reviewer/protocol feedback templates
• website refresh
• release-readiness checks

ArkheionX is local-first review infrastructure for smart contract security. It does not replace auditors. It gives reviewers a better map of value paths, roles, assumptions, reachable flows, missing tests, evidence, and unresolved review gaps.

Status:

• v10.1.0 release candidate
• stable release remains v8.0.1

Arkheionx v8.0.1 — Clean Product Surface

Arkheionx v8.0.1 — Clean Product Surface

This patch release cleans the root README and website so Arkheionx presents as one
current product instead of a version-heavy project archive.

No RPC. No live-chain scanning. No auto-submit. Human review required.

Changes

• Rewrote the root README around the current Arkheionx workflow.
• Rebuilt the homepage into a smaller, clearer product page.
• Simplified docs navigation into a guided path with older version pages archived
  lower.
• Removed current-surface version noise and target-specific wording.
• Preserved engine behavior, CLI commands, the review and review-map
  workflows, tests, schemas, and safety boundaries.

Not a new engine release

v8.0.1 is a product-surface patch. It adds no engine behavior, no CLI command, and
no analysis change. The v8.0.0 arkheionx review workflow, Protocol Lens Packs,
review-map, schemas, and exit-code contract are unchanged.

Boundaries

• Arkheionx does not confirm vulnerabilities.
• Arkheionx does not replace audits.
• Arkheionx does not scan live chains.
• Arkheionx does not auto-submit reports.
• Arkheionx does not assign final severity.

Human review and local proof are required.

Arkheionx v8.0.0 — Final Engine

Arkheionx v8.0.0 — Final Engine

Arkheionx v8.0.0 consolidates the product into one clean, local-first Ethereum
security research workflow for Solidity and DeFi repositories. It turns scope, value
flow, protocol behavior, invariants, and local evidence into focused review lanes
before report writing.

No RPC. No live-chain scanning. No auto-submit. Human review required.

Highlights

• One-command review. Adds the primary arkheionx review command. It builds a
  single local review pack — run context, scope map, value-flow map, interaction
  map, assumptions, review lanes, evidence tasks, evidence rubric, report filter,
  agent input, plus review.json and manifest.json.
• Protocol Lens Packs are generic. Lenses are presented as protocol-family
  models. Passing --lens fixed-credit-market adds protocol-aware artifacts
  (protocol model, behavior promises, economic invariants, temporal windows, lens
  review lanes, lens evidence tasks). The public surface is no longer
  target-specific.
• Schema-backed artifacts. Adds schemas/manifest.schema.json and
  schemas/review-pack.schema.json; review artifacts carry schema_version,
  arkheionx_version, artifact_type, and generated_at.
• Kill conditions. Every evidence task now carries a kill condition so a weak
  hypothesis can be dropped quickly.
• Cleaner surface. Reworked README, docs, and website; documented the
  heuristic exit-code-1 contract for CI.

Boundaries

• Arkheionx does not confirm vulnerabilities.
• Arkheionx does not replace audits.
• Arkheionx does not scan live chains.
• Arkheionx does not auto-submit reports.
• Arkheionx does not assign final severity.
• A review lane is not a vulnerability; evidence quality is not vulnerability
  validity; a candidate with evidence is not automatically valid. Human review and
  local proof are required.

Compatibility

The v4 review-map workflow and the v5/v6/v7/v7.5 commands continue to work. The new
arkheionx review command orchestrates these existing layers; it adds no new
analysis and changes no exit-code behavior.

Arkheionx v7.5.0 — Protocol Lens Packs

v7.5.0 — Protocol Lens Packs (Morpho Midnight)

Ships in the v7.5.0 package. The package version is 7.5.0; the protocol-lens
layer additionally carries its own lens schema version for its JSON artifacts. Nothing in
the v4 review-map workflow or the v5/v6/v7 commands changes. Local/static and
heuristic: no RPC, no live-chain calls, no transaction execution, no private keys,
no exploit automation, no external AI API calls, no severity, and no vulnerability
claims.

V5 shows where to look. V6 shows what is proven, unresolved, and still uncovered.
V7 turns audit scope into review lanes, tasks, evidence requirements, and report
filters. V7.5 adds protocol lenses, which model a specific protocol family so
the lanes, tasks, and evidence requirements are protocol-aware.

Added

• A reusable protocol-lens architecture under arkheionx/protocol_lens/: typed
  models, a ProtocolLens base class, a registry, an extractor, builders for
  lanes/tasks/evidence/blind-spots/report-filter, pure-Python renderers, and a
  pack writer.
• The first lens, Morpho Midnight (morpho-midnight): a fixed-maturity credit
  market modeled with 14 behavior promises (PROMISE-MM-01..14), 12 economic
  invariants (INV-MM-01..12), 10 review lanes (LANE-01..10), four temporal windows,
  and five extraction groups.
• New commands: lens-list, lens-map, lens-lanes, lens-tasks, lens-pack,
  lens-evidence, lens-report-filter. Each accepts --lens (default
  morpho-midnight), --scope-file, --out, --top, --json, --no-write.
• lens-pack generates a 16-file local pack (00-run-context .. 13-report-filter,
  agent-input.md, and a machine-readable lens-pack.json).
• Nine evidence statuses, an A-F evidence rubric with six decisions, a transparent
  blind-spot score, and a 15-point report-filter checklist with six outcomes.
• A synthetic toy fixture, tests/fixtures/morpho_midnight_toy/ (invented
  contracts, not Morpho source), and tests for the registry, lens model, scope
  parser, pack generation, lanes, tasks, evidence map, report filter, and the
  private-scope leak guard.
• Docs: docs/V7_5_PROTOCOL_LENS.md and
  docs/MORPHO_MIDNIGHT_LENS.md, plus a website
  page.

Boundaries

A lens is not a finding. A review lane is not a vulnerability. An evidence score is
not vulnerability validity. A candidate with evidence is not confirmed. Lane and
task priority are not severity. The report filter never says "submit now". Human
review is required for every conclusion. No protocol source is modified.

Arkheionx v7.0.0 — Scope-Aware Orchestration

Arkheionx v7.0.0 — Scope-Aware Orchestration

Release title: Arkheionx v7.0.0 — Scope-Aware Orchestration

Summary: V7 adds scope-aware orchestration: scope map, review lanes, scope
tasks, evidence judging, report filtering, and complete scope packs for
local/static, human-reviewed smart-contract security research.

Release metadata is finalized locally and is pending the founder's push, tag,
GitHub release, and site deploy. The package version is 7.0.0; the last published
tag remains v4.0.0.

New commands

Command	Purpose
arkheionx scope-map	Parse a scope note into structured review rules
arkheionx scope-lanes	Generate scope-aware review lanes
arkheionx scope-tasks	Turn lanes into precise, testable tasks
arkheionx scope-pack	Bundle a complete local scope-aware research pack
arkheionx evidence-judge	Grade whether local tests prove the intended task
arkheionx report-filter	Classify candidates against scope before submission

Positioning

V7 turns audit scope into review lanes, task packs, evidence requirements, and
report filters so AI-assisted security review starts from rules and evidence
instead of vague prompts.

Known limitations

Local/static and heuristic. No bug prediction. No severity. No exploit automation.
No live-chain or RPC. No auto-submission. Human review is required. Private scope
files are local only and must not be committed.

Docs

• SCOPE_ORCHESTRATION.md
• V7_WORKFLOW.md
• SCOPE_MAP.md
• SCOPE_TASKS.md
• EVIDENCE_JUDGE.md
• REPORT_FILTER.md

Arkheionx v6.0.0 — Evidence Graph and Interaction Matrix

Arkheionx v6.0.0 — Evidence Graph and Interaction Matrix

Local/static and heuristic. An evidence state is not a vulnerability claim.
Confirmed-candidate is not a confirmed vulnerability. Interaction priority is
not severity. Unresolved does not mean vulnerable. Human review is required.

V6 adds evidence graphing and interaction matrix analysis so high-impact DeFi
review surfaces can be classified as tested, rejected with evidence, unresolved,
insufficient evidence, or needs human review. It builds on the stable v4.0.0
review-map workflow and the v5 Blind Spot Intelligence layer without removing or
changing them.

V5 shows where to look. V6 shows what is proven, what is unresolved, and which
interactions still lack evidence.

Highlights

• Evidence Graph (arkheionx evidence-graph) — classify every important
  review surface into one of eight evidence states with an evidence strength.
• Interaction Matrix (arkheionx interaction-matrix) — detect dangerous
  combinations of surfaces, scored by a transparent interaction priority.
• Unresolved Map (arkheionx unresolved-map) — everything important that
  local evidence does not yet close.
• Complete Review (arkheionx complete-review, headline) — the full local,
  vendor-agnostic V6 review package with a model-agnostic agent input and a human
  review checklist.

Boundaries

Local/static only. No RPC, no live-chain calls, no private keys, no exploit
automation, no auto-submit, no severity, no vulnerability claims, no audit
replacement, and no guaranteed bug discovery. Evidence quality still depends on
the tests that exist and on human review.

Release status

The package version is 6.0.0; the latest stable release is v6.0.0. The
release metadata is finalized locally and pending the founder push, tag, GitHub
release, and site deploy. Full notes: ../../release-notes/v6.0.0.md.

Founder release commands

git push origin main
git tag -a v6.0.0 -m "Arkheionx v6.0.0 — Evidence Graph and Interaction Matrix"
git push origin v6.0.0
gh release create v6.0.0 \
  --title "Arkheionx v6.0.0 — Evidence Graph and Interaction Matrix" \
  --notes-file docs/releases/V6_RELEASE_NOTES.md \
  dist/arkheionx-6.0.0-py3-none-any.whl \
  dist/arkheionx-6.0.0.tar.gz

Arkheionx v5.0.0 — Blind Spot Intelligence

Arkheionx v5.0.0 — Blind Spot Intelligence

Status: release metadata finalized locally; pending founder push, tag, GitHub
release, and site deploy. The package version is 5.0.0. The last published
tag remains v4.0.0, and the source installers and the GitHub Action still pin
to the last actually-tagged stable release, v3.1.0. Nothing here is published
to PyPI.

1. What V5 adds

V5 adds a Blind Spot Intelligence layer on top of the stable v4 review-map
workflow and the v4.1 research-memory commands. It is the first major step beyond
mapping:

• V4 maps the protocol — where value moves, the assumptions that guard each
  path, and which paths have no tests.
• V5 maps where research attention is weakest relative to how much could go
  wrong if a bug existed there.

2. Why V5 exists

A reviewer's scarcest resource is attention. V5 is an attention-allocation engine:
it ranks high-impact surfaces with weak review evidence, estimates criticality
potential (blast radius), and turns guarding assumptions into testable
counterfactuals, so a human or an AI agent spends limited time where it matters.

3. New commands

• arkheionx blind-spots — likely blind-spot candidates with a transparent
  additive score (impact + review-gap + complexity + assumption).
• arkheionx criticality-map — criticality potential (heuristic blast radius,
  not severity) across surfaces.
• arkheionx counterfactuals — "what if this assumption is false?" research
  prompts with local test directions and stop conditions.
• arkheionx research-pack — a complete local, vendor-agnostic research pack
  (headline). Writes by default.

4. Compatibility

review-map and its focused views (value-paths, assumptions, test-gap-map,
proof-plan) and the v4.1 research-memory commands (agent-brief,
hypothesis-log, case-study) are unchanged. The v5 commands build directly on
review-map output.

5. Quickstart

python3 -m pip install -e .
arkheionx review-map      examples/blind-spot-fixture
arkheionx blind-spots     examples/blind-spot-fixture
arkheionx criticality-map examples/blind-spot-fixture
arkheionx counterfactuals examples/blind-spot-fixture
arkheionx research-pack   examples/blind-spot-fixture --out .arkheionx/research-pack

6. V5 demo

examples/blind-spot-fixture is a small generic protocol — PriceOracle,
CreditVault, ClaimGate, BundleRouter, MockToken — whose test covers only
deposit. The value exit, the oracle/debt path, liquidation, the signature and
Merkle authorization surfaces, and the periphery batch are deliberately untested,
so ArkheionX surfaces them as likely blind spots. No planted vulnerabilities.

7. JSON schemas

schemas/blind-spots.schema.json, schemas/criticality-map.schema.json,
schemas/counterfactuals.schema.json, and
schemas/research-pack-manifest.schema.json. Every JSON output is parseable and
schema-validated by the test suite.

8. Safety boundaries

Local and static only. No RPC, no live-chain calls, no exploit automation, no
private-key handling, no auto-submit. Blind spot candidates are not
vulnerabilities; criticality potential is not severity; counterfactuals are
research prompts, not findings. ArkheionX does not confirm vulnerabilities,
assign final severity, prove protocol safety, or replace an audit. Human review
is required.

9. Known limitations

• Heuristic and static; blind spot detection is not perfect.
• No bug prediction, no severity, no probability.
• Real-protocol validation is still required
  (../REAL_PROTOCOL_PROOF_PLAN.md).
• A finding is only ever confirmed by a human with independent local proof.

10. Validation matrix

Docs links, safety wording, version consistency, release readiness, the full
unit-test suite, make validate, the package build (python -m build +
twine check), and the website build all pass.

11. Documentation

• ../BLIND_SPOT_INTELLIGENCE.md — the model.
• ../V5_WORKFLOW.md — the end-to-end workflow.
• ../CLI_REFERENCE.md — command reference.
• ../BUG_BOUNTY_WORKFLOW.md — bounty triage flow.

12. GitHub release draft

Arkheionx v5.0.0 — Blind Spot Intelligence. V5 adds a local/static layer
that prioritizes high-impact surfaces with weak review evidence, generates
counterfactual research prompts, and packages the result into an AI/human-ready
research pack. It builds on the stable review-map workflow. No RPC, no
exploit automation, no severity, no bug claims; human review required.

13. Founder release commands

The package version is already finalized at 5.0.0 in this tree. To release:

git status --short --branch
make validate
git push origin main
git tag -a v5.0.0 -m "Arkheionx v5.0.0 — Blind Spot Intelligence"
git push origin v5.0.0
gh release create v5.0.0 \
  --title "Arkheionx v5.0.0 — Blind Spot Intelligence" \
  --notes-file docs/releases/V5_RELEASE_NOTES.md \
  dist/arkheionx-5.0.0-py3-none-any.whl \
  dist/arkheionx-5.0.0.tar.gz

The last tagged stable release stays v3.1.0 (the installer/action pin) until a
new stable tag is cut.

Arkheionx v4.0.0 — Stable local review-map workflow

Arkheionx v4.0.0 — Stable local review-map workflow

Status: v4.0.0 release candidate prepared locally; pending founder
push/tag/GitHub release/site deploy. This document describes the v4.0.0
release of the review-map workflow. The package version is finalized at 4.0.0;
the v4.0.0 git tag and GitHub Release are founder actions, and the last tagged
stable release remains v3.1.0 until that tag is cut. Nothing here is published
to PyPI.

1. What V4 stabilizes

V4 makes the local review-map workflow the stable, supported public surface:
review-map and its focused views (value-paths, assumptions,
test-gap-map, proof-plan), plus version and doctor.

2. Why V4 exists

DeFi review is not just checking whether the tests you wrote pass. Reviewers need
to know where value enters, moves, and exits, which assumptions protect each
path, and which value paths have no tests. V4 treats that workflow as stable so
teams can rely on it.

3. What changed

• The review-map workflow and focused views are the canonical, documented surface.
• The Test Gap Map prints honest Source: <file>:<line> evidence from parsed source.
• A coherent product surface across README, docs, website, CLI, and demo.
• New workflow docs: pre-audit and bug-bounty triage.
• Restructured documentation index and website (how-it-works, bug-bounty,
  pre-audit, V4 release pages).

4. Stable commands

arkheionx version, arkheionx doctor, arkheionx review-map,
arkheionx value-paths, arkheionx assumptions, arkheionx test-gap-map,
arkheionx proof-plan. These run on any install (editable or non-editable).

5. Quickstart

python3 -m pip install -e .
arkheionx doctor
arkheionx review-map .

6. V4 demo

arkheionx review-map examples/vault-strategy-oracle-fixture

Vault / Strategy / PriceOracle / MockToken. deposit is tested; the value exits
and admin setters are deliberately untested, so they surface as value paths and
test gaps. Output is real engine output, locked by tests.

7. Bug bounty workflow

Triage and hypothesis generation only. See
../BUG_BOUNTY_WORKFLOW.md. Do not submit ArkheionX
output as a vulnerability by itself; validate manually; authorized targets only.

8. Pre-audit workflow

Map value paths, close test gaps, hand a reviewer a clearer surface. See
../PRE_AUDIT_WORKFLOW.md.

9. Safety boundaries

Local and static only. No RPC, no live-chain calls, no exploit automation, no
private-key handling. ArkheionX does not confirm vulnerabilities, assign final
severity, prove protocol safety, or replace an audit. Human review is required.

10. Known limitations

• Static heuristics, not execution.
• Cross-contract value flow is surfaced as per-contract paths; end-to-end tracing
  is roadmap work.
• evidence_links is empty until you generate local proof/trace artifacts.
• Depth is shown on fixtures; real-protocol validation is planned
  (../REAL_PROTOCOL_PROOF_PLAN.md).
• Repository identity is an accepted risk for this release
  (../REPO_IDENTITY_MIGRATION.md).

11. Validation matrix

Docs links, safety wording, version consistency, release readiness, the full
unit-test suite, make validate, and the website build all pass. See
V4_RELEASE_CHECKLIST.md.

12. Package / install notes

No PyPI publication. Install from source (pip install -e . or pip install .).
The source-tree commands scan, test-plan, and search are not bundled in the
wheel and fail gracefully in a non-editable install. See
../PACKAGING.md.

13. Upgrade notes

No breaking changes to the review-map workflow. The focused views read the same
artifacts. Existing review-map users need no migration.

14. GitHub release draft

Arkheionx v4.0.0 — Stable local review-map workflow. V4 stabilizes the
local, static review-map workflow: value paths → assumptions → test gaps →
proof direction → human review. Local-first, no RPC, no exploit automation,
not an audit, human review required. See the release notes and docs/V4_STABLE_SCOPE.md.

15. Founder release commands

The package version is already finalized at 4.0.0 in this tree. To release:

git status --short --branch
git log --oneline --decorate -25
make validate
git push origin main
git tag -a v4.0.0 -m "Arkheionx v4.0.0 — stable local review-map workflow"
git push origin v4.0.0

The package metadata is already finalized at 4.0.0; the v4.0.0 tag marks the
stable review-map workflow milestone, and the last tagged stable release stays
v3.1.0 (the installer/action pin) until the tag is cut.

Arkheionx v3.1.0 — Protocol Review Map

Arkheionx v3.1.0 — Protocol Review Map

• Release date: 2026-05-31
• Package version: 3.1.0
• Latest stable release: v3.0.0 (moves to v3.1.0 in post-release cleanup)
• Current milestone: v3.1.0 · Next milestone: v3.2.0

Summary

Foundry tells you which tests passed. Arkheionx shows what the protocol still
needs to prove. v3.1.0 adds the Protocol Review Map: a structured,
developer-native review surface built on the workbench. The new
arkheionx review-map command turns a local DeFi repository into contracts,
value paths, assumptions, test gaps, proof suggestions, and links to any evidence
artifacts you have already produced — written as JSON and Markdown for reviewers.

It is local and static by default: no RPC, no private keys, no live-chain calls,
no Foundry required, and no network access. Review-map outputs are review
guidance, not confirmed vulnerabilities.

What changed since v3.0.0

• New public command: arkheionx review-map.
• New arkheionx/review_map/ package and schemas/review-map.schema.json.
• New docs/REVIEW_MAP.md; public-surface, CLI, stability, output, demo,
  roadmap, release-checklist, and v3-readiness docs updated.
• Version metadata is 3.1.0; latest stable stays v3.0.0 until publication.
• No existing command was removed or renamed; JSON output and safety boundaries
  are unchanged.

review-map command

arkheionx review-map .
arkheionx review-map . --top 5
arkheionx review-map . --target Vault.withdraw
arkheionx review-map . --json
arkheionx review-map . --no-write
arkheionx review-map . --out ./review-out
arkheionx review-map . --include-low-confidence

review-map artifacts

Written under <repo>/.arkheionx/out/review-map/ (gitignored):
review-map.json, review-map.md, value-paths.json, test-gaps.json,
assumptions.json, proof-plan.json, evidence-links.json,
review-summary.md, and review-map.mmd. All plain text (no ANSI).

Value paths

Each value path shows where value enters, how it moves, and where it can exit,
plus the conditions a reviewer should verify and the assumptions the path relies
on. High-priority paths (value leaving the system) are surfaced first.

Assumptions

Protective properties a value path appears to rely on — fresh oracle price,
standard ERC20 behavior, bounded admin role, monotonic reward index, proportional
share accounting, no unsafe re-entry, normalized decimals, bounded fees, bounded
liquidation math. They are review prompts, not findings.

Test gaps

Suggested local test scenarios for value-sensitive functions (for example
withdrawal boundary, stale oracle, double claim, slippage bound, access control).
Low-confidence gaps are hidden unless --include-low-confidence is passed. A test
gap is not a claim that a bug exists.

Proof suggestions

For high-priority gaps, a concrete local Foundry proof outline (objective, setup,
action, assertions) with a hint that reuses the existing
arkheionx prove --run workflow.

Evidence links

If proof / trace / evidence / report artifacts already exist under
.arkheionx/out/, they are linked to review-map targets by name with their
recorded evidence level. If none exist, the map says so.

Demo fixture support

The bundled oracle-staking, amm-swap, and lending-vault demos all produce a
full review map:

arkheionx demo --copy amm-swap ./arkheionx-demo
arkheionx review-map ./arkheionx-demo

Safety boundaries

• Local/static repository analysis only.
• No RPC, no live-chain calls, no deployed-contract scanning.
• No private keys, seed phrases, or secrets.
• No exploit automation, no transaction broadcasting, no auto-submit.
• Review guidance only — not a formal audit, not confirmed vulnerabilities, no
  final severity, no bounty eligibility. Human review remains required.

Known limitations

• Static/heuristic mapping: it may miss value paths and may suggest
  false-positive test gaps.
• It does not perform full Solidity semantic analysis (parsing is regex/static).
• It does not replace manual review.
• Most review-map signals start at HEURISTIC unless linked to proof, trace, or
  evidence artifacts.

Validation

• python3 -m unittest discover -s tests -p "test_*.py" — 387 tests pass.
• make validate — docs links, version consistency, safety wording, and release
  readiness all pass.
• python3 scripts/check_release_readiness.py --check — passes
  (v3.1.0, stable v3.0.0).
• review-map smoke on oracle-staking, amm-swap, and lending-vault: artifacts
  generated, JSON valid with no ANSI (including ARKHEIONX_COLOR=always), and
  --no-write writes nothing.
• sh -n install.sh, sh -n uninstall.sh, sh -n arkup — clean.

Upgrade instructions

Local install only (no PyPI):

sh arkup --update          # or
python3 -m pip install -e .
arkheionx version
arkheionx review-map .

Next milestone

v3.2.0 — Review Map Deepening / Test Gap Map: deepen value-path and test-gap
analysis and consider promoting review-map sub-outputs into focused commands.

Arkheionx v3.0.0 — Public Stable Launch

Arkheionx v3.0.0 — Public Stable Launch

Arkheionx v3.0.0 is the public stable launch of the local DeFi security
workbench. It is a consolidation milestone: it does not add new product
features. It documents, hardens, and presents the v2.x workbench as one coherent
public surface — so a researcher arriving from a link can install it, run a
guided demo, and understand exactly what Arkheionx does and does not do.

Release date: 2026-05-31. Package version 3.0.0. STABLE_RELEASE remains
v2.10.0 until v3.0.0 is published, then moves to v3.0.0 in post-release
cleanup. Not published to PyPI; no Homebrew, standalone binary, or domain
installer. Not a formal audit; no bounty or severity guarantee.

Summary

arkheionx version
Arkheionx package version: 3.0.0
Latest stable release: v2.10.0
Current milestone: v3.0.0
Next milestone: v3.1.0

Foundry proves behavior. Arkheionx helps researchers understand, prioritize,
package, and explain the evidence — locally, with no RPC and no secrets.

Why v3.0 matters

v3.0 is the first version meant to be shared widely. The command surface,
stability contract, install/update lifecycle, demo workflow, evidence model, and
safety boundaries are now documented and guarded by a release-readiness gate, so
the public surface stays coherent and honest as the project grows.

What changed since v2.10.0

• Root README redesigned as a public-stable launch landing page.
• Four v3 SVG visuals (architecture, public surface, demo fixtures, stability).
• Public-surface, stability-contract, and v3-readiness docs matured to launch
  candidate; roadmap and release checklist updated for v3.0.0 / v3.1.0.
• Readiness gate extended (GitHub Action tag and install/arkup stable tag track
  STABLE_RELEASE; required visuals exist; no stale dev wording on the live
  surface).
• Version metadata set to 3.0.0. No CLI behavior, demo, package-data,
  proof/trace/evidence/report, or safety-boundary changes.

Public command surface

18 CLI commands and three shell scripts (install.sh, uninstall.sh, arkup)
are inventoried with stability labels in docs/PUBLIC_SURFACE.md.
A contract test fails if a command in arkheionx --help is missing from the doc.

Stability contract

docs/STABILITY_CONTRACT.md defines what is
stable at v3.0: public command names, additive JSON/schema changes, plain JSON
and artifacts, the install/update lifecycle, and never-weakened safety
boundaries. Human-readable output may be polished; internal Python modules are
not a public import API.

Install / update lifecycle

sh install.sh (pipx or venv, no sudo), sh arkup --check/--update, and
sh uninstall.sh. The install receipt and stable/main/ref/local source model are
unchanged. Local install is the supported path; there is no PyPI package.

Guided demos and package-data fixtures

Three bundled toy fixtures — oracle-staking, amm-swap, lending-vault — ship
as package data, so arkheionx demo --copy <id> <dest> works from an installed
Arkheionx. They are demonstrations, not real protocols or vulnerability reports.

Evidence model

HEURISTIC → COMPILER_CONFIRMED → EXECUTION_CONFIRMED → EVIDENCE_READY.
A heuristic is a ranking signal, not a proven bug; a passing test does not prove
absence of bugs. Human review is required.

Artifact validation

arkheionx validate-artifacts checks generated proof/evidence/report artifacts
for required fields and safe evidence transitions. JSON output and artifact files
are always plain (no ANSI).

CLI color and output polish

Restrained, TTY-gated color (ARKHEIONX_COLOR=always|never|auto, honoring
NO_COLOR and CI). JSON output and files written under .arkheionx/out/ stay
plain.

Docs and visuals

A navigable docs map links the start path, core workflow, advanced topics, and
the stability/readiness docs. README carries four v3 SVG visuals plus the
workflow, evidence-ladder, and output-pipeline diagrams.

Release readiness gate

scripts/check_release_readiness.py --check aggregates version consistency,
docs links, and safety wording with readiness-specific checks and runs in
make validate.

Safety boundaries

• Local repository analysis only; no RPC by default; no live-chain mutation; no
  private keys or secrets; no transaction broadcasting; no automated
  exploitation; no auto-submission.
• No guaranteed vulnerability discovery; no severity guarantee; not an audit,
  certification, or replacement for manual review.
• Use only on repositories you own or are authorized to review.

Known limitations

• Heuristic-first; Foundry optional (without it the workbench stays in
  HEURISTIC mode); local-only; three bundled toy demos; not a formal audit.
• Not published to PyPI; no Homebrew, standalone binary, or domain installer.

Upgrade

git pull
sh arkup --update          # or: pip install -e .
arkheionx version

Next

v3.1.0 — incremental workbench improvements after the v3.0.0 cut. See
docs/ROADMAP.md and docs/V3_READINESS.md.