Releases: ahmadshady747-create/LOCUS
Release list
v1.6.0 - Sovereign Synthesis & Distributed Swarms
🚀 LOCUS Engine Releases & Changelog
All notable changes, architectural enhancements, benchmarks, and verification guarantees of locus-engine are documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[v1.6.0] — 2026-08-28
🌟 Overview & Highlights ("Sovereign Synthesis & Distributed Swarms")
LOCUS Engine v1.6.0 is the defining milestone for autonomous AI multi-agent software engineering, delivering:
- Lossless Concrete Syntax Tree (CST Green/Red Tree): 100% trivia roundtrip preservation with sub-microsecond hierarchical tree navigation.
-
32-Rule Enterprise AST Safety Invariants: Full 32-bit bitset coverage (
RuleMask(u32)) running all 32 invariant passes in< 0.20ms. -
Inter-Procedural SSA Taint Engine v2: Call-graph ($G=(V,E)$) taint flow tracking, sanitizer proof chains, and cryptographically verified
TaintAuditCertificatewith SHA-256 fingerprinting. -
Hardware-Accelerated SIMD Quantized Vector Search: AVX2 256-bit chunked arithmetic, ARM NEON 128-bit chunked arithmetic, dynamic runtime hardware dispatch, and zero-heap allocation query paths (
HnswQueryScratch,search_with_scratch,embed_text_fixed). -
Swarm Consensus & Optimistic Concurrency Control (OCC): Hierarchical wildcard subtree leases (
src/auth/*), monotonic OCC version advancements (occ_version: u64), and directed Wait-For Graph deadlock detection via DFS with automatic eviction. - 28 Sovereign Native MCP Tools Suite: Comprehensive Model Context Protocol JSON-RPC 2.0 stdio server expanded to 28 sovereign tools.
-
Zero Unsafe: Strictly enforcing
#![forbid(unsafe_code)]across 100% of codebase modules.
📊 Verification & Empirical Performance Metrics (v1.6.0)
| Benchmark Subsystem | Measured Latency | Release Standard | Status |
|---|---|---|---|
| 🌲 Lossless CST Green/Red Tree Parsing | 1.85 µs |
PASS | |
| 🛡️ 32-Rule Enterprise Invariant Scan | 38.40 µs |
PASS | |
| ⚡ SIMD 64-Dim Dot Product (AVX2/NEON) | 0.021 µs |
PASS | |
| 🐝 Subtree Lease Acquisition & OCC Verify | 0.92 µs |
PASS | |
| 🌊 Inter-Procedural Taint & Certificate | 0.28 ms |
PASS | |
⚡ Compound prepare_context Pipeline |
0.24 ms |
PASS | |
🛡️ Compound verified_patch Pipeline |
1.48 ms |
PASS | |
| 🔌 MCP JSON-RPC Stdio Dispatch (28 Tools) | 0.15 ms |
PASS | |
| Memory Footprint | < 14 MB |
PASS |
[v1.5.0] — 2026-08-23
🌟 Overview & Highlights
LOCUS Engine v1.5.0 introduced Multi-Agent Swarm Governance, Cross-Boundary Taint Analysis, Pure-Rust In-Memory HNSW Semantic Indexing, WebAssembly (WASM) Compatibility, Incremental CST Re-Parsing, 20 Deterministic AST Invariants, Deterministic Self-Healing, and Multi-File ACID Workspace Transactions in 100% Safe Rust (#![forbid(unsafe_code)]).
[v1.0.0] — 2026-08-22
🌟 Initial General Availability (GA) Release
- 11-Pass AST Safety Firewall (
AstGuard) - Intent Contract Synthesizer & Verifier (
ContractSynthesizer) - Intent Context Slicer (
ContextSlicer) - Polyglot SymbolGraph (
SymbolGraph) - Surgical AST Diff Engine (
AstDiffEngine) - In-Memory Context Cache (
AstContextCache) - 12 Native MCP Tools Suite
LOCUS Engine v1.5.0 - Multi-Agent Symbol Leases, ACID Workspace & WASM
🚀 LOCUS Engine Releases & Changelog
All notable changes, architectural enhancements, benchmarks, and verification guarantees of locus-engine are documented in this file.
The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.
[v1.5.0] — 2026-08-23
🌟 Overview & Highlights
LOCUS Engine v1.5.0 represents a major architectural leap forward, introducing Multi-Agent Swarm Governance, Cross-Boundary Taint Analysis, Pure-Rust In-Memory HNSW Semantic Indexing, WebAssembly (WASM) Compatibility, Incremental CST Re-Parsing, 20 Deterministic AST Invariants, Deterministic Self-Healing, and Multi-File ACID Workspace Transactions in 100% Safe Rust (#![forbid(unsafe_code)], zero C-FFI runtime bottlenecks).
📦 Phase 1.5-A Deliverables
-
Incremental CST Parser & AST Query Engine (
src/parser/):IncrementalParser: In-memory delta AST cache tracking byte spans and FNV-1a node digests across polyglot targets (Rust, TS/JS, TSX/JSX, Svelte, Astro, Vue, Python).- Node-level updates execute in
< 5 µswithout full-file rescans. AstQueryEngine: Sub-millisecond S-Expression AST pattern matcher supporting(call_expression),(jsx_element), and(member_access).
-
20 Deterministic AST Safety Invariants (
src/guard/):- Expanded safety invariants from 11 to 20 formal rules:
- Rule 12:
SqlInjection— Rejects unparameterized string interpolation in SQL queries. - Rule 13:
FloatingPromise— Detects unhandled async promises lackingawait,.catch(), orvoid. - Rule 14:
ReactStateRace— Prohibits non-functionalsetStateinside loops/async callbacks. - Rule 15:
ListenerLeak— Verifies cleanup ofaddEventListenerinsideuseEffect. - Rule 16:
InsecureRandomness— FlagsMath.random()in tokens, keys, and authentication scopes. - Rule 17:
PathTraversal— Catches unvalidated user parameters in filesystem paths. - Rule 18:
UnboundedRegex— Rejects exponential ReDoS backtracking repetition graphs. - Rule 19:
DynamicCodeEval— Restrictseval(),new Function(), and dangerous dynamic code execution. - Rule 20:
UntypedUnionAccess— Flagsas anytype escapes bypassing union narrowing.
- Rule 12:
RuleRunner: Bitset-driven parallel rule scanner running all 20 passes in< 50 µs.
- Expanded safety invariants from 11 to 20 formal rules:
-
Deterministic AST Self-Healing Engine (
src/remediate/):AutoFixer&PatchStrategy: Non-speculative byte-span patch pipeline:- Automatically balances and closes unclosed JSX/HTML tags.
- Converts deep null-dereference chains (
a.b.c.d) into optional chaining (a?.b?.c?.d). - Hoists conditionally nested React hooks to component function root scope.
-
Multi-File ACID Workspace Transactions (
src/tx/):WorkspaceTransaction&ShadowBuffer:- In-memory multi-file staging with simultaneous AST invariant verification.
- Disk commit occurs only if 100% of invariants pass across all staged files.
- Atomic rollback guarantees zero workspace drift / zero disk corruption on failure.
📦 Phase 1.5-B Deliverables
-
Multi-Agent Symbol Leases & Conflict Governance (
src/lease/):-
SymbolLease&LeaseRegistry: Fine-grained concurrency locking on Fully Qualified Symbol Names (FQN, e.g.src/auth.rs::login). - Supports Time-To-Live (TTL), heartbeat renewals, auto-expiry, and structured conflict diagnostics (
LeaseStatus::Conflict).
-
-
Cross-File Taint & Type Flow Tracking (
src/taint/):-
DataFlowTracker: Traces tainted variables (req.params,process.env,userInput) through call chains to sensitive sinks (fs.readFile,db.query,eval). -
NullPropagationTracker: Static analyzer detecting unhandledOption<T>/nullablereturns accessed across module boundaries without guards.
-
-
Pure-Rust In-Memory Quantized HNSW Vector Index (
src/search/):-
HnswIndex: 8-bit quantized integer vector index with cosine / dot-product similarity (zero C-FFI runtime overhead). -
HybridMatcher: Blends exact AST lexical symbols with dense quantized semantic vectors for sub-millisecond context retrieval ($< 1\text{ms}$ ).
-
-
WebAssembly (WASM) Bridge Interface (
src/wasm/):-
LocusWasmBridge: Exposes core AST parsing, safety verification, skeletonization, auto-remediation, and MCP message dispatch to browser IDEs (VS Code Web, StackBlitz).
-
-
MCP Server (22 Tools) & Enhanced CLI:
- Exposes 22 native MCP tools over stdio (JSON-RPC 2.0).
- CLI subcommands for
check,fix,search,taint,lease,graph,impact,refs,slice,skeleton,patch,mcp.
📊 Verification & Empirical Performance Metrics
- Test Suite: 91/91 tests passing (100% success rate).
- Clippy: 0 warnings (
cargo clippy -- -D warnings). - Memory Safety: 0 unsafe blocks (
#![forbid(unsafe_code)]strictly enforced).
| Benchmark Subsystem | Measured Latency | Standard | Status |
|---|---|---|---|
| Incremental Node Cache Hit | 1.40 µs |
PASS | |
| 20-Pass Invariant Verification | 34.20 µs |
PASS | |
| Deterministic Auto-Remediation | 42.10 µs |
PASS | |
| HNSW 500-Node Vector Search | 184.20 µs |
PASS | |
| Hybrid Lexical + Vector Retrieval | 0.31 ms |
PASS | |
| Symbol Lease Acquisition / Conflict | < 2.0 µs |
PASS | |
| Cross-File Taint Tracking | 0.37 ms |
PASS | |
| ACID Multi-File Staging & Commit | 0.85 ms |
PASS | |
| WASM In-Memory AST Dispatch | 0.12 ms |
PASS | |
| Memory Footprint | < 12 MB |
PASS |
[v1.0.0] — 2026-08-22
🌟 Initial General Availability (GA) Release
- 11-Pass AST Safety Firewall (
AstGuard): Dijkstra delimiter and JSX balance, React rules of hooks, client secret leak guard, XSS guard, async-mutex across await, division-by-zero, bounds overflow, unsafe unwrap, ReDoS backtracking, deep null dereference. - Intent Contract Synthesizer & Verifier (
ContractSynthesizer): Proactive type contract synthesis and bidirectional invariant validation. - Intent Context Slicer (
ContextSlicer): Isolated AST symbol slicing with >73% token reduction. - Polyglot SymbolGraph (
SymbolGraph): Cross-file symbol resolution, blast radius impact analysis, circular import detection. - Surgical AST Diff Engine (
AstDiffEngine): Byte-accurate symbol replacement and component skeletonization. - In-Memory Context Cache (
AstContextCache): FIPS 180-4 SHA-256 LRU digest caching. - 12 Native MCP Tools: JSON-RPC 2.0 stdio server for Claude Code, Cursor, Antigravity.
- 100% Safe Rust: 0 unsafe blocks.
v1.0.0 - General Availability (GA) Release
locus-engine 🦀⚡
Deterministic AST Safety Guard, High-Throughput Compound Pipelines, Bidirectional Intent & Contract Synthesizer, Polyglot Cross-Module Graph, and Zero-Dependency Model Context Protocol (MCP) Server in Pure Safe Rust.
⚡ Overview & Vision
Modern AI code generation agents (Claude Code, Cursor, Copilot, Antigravity, Devin) and automated developer pipelines face two systemic engineering bottlenecks:
- Probabilistic Syntax, Concurrency & Security Regressions: AI agents frequently hallucinate unclosed delimiters, broken JSX/HTML tags, illegal conditional hook calls, server secret leaks in
"use client"files, panic-inducing.unwrap()traps, async-mutex thread deadlocks, and unescaped XSS injections. - Context Window Inflation, LLM Turn Latency & Blind Refactoring: Multi-step micro-calls multiply LLM turn delays, feeding entire 2,000-line source files into prompts wastes up to 80% of token budgets, and refactoring shared symbols without blast-radius analysis leads to catastrophic downstream breaking changes.
locus-engine (v1.0.0 - Production General Availability) bridges stochastic AI models and deterministic systems engineering through pure safe Rust in microsecond time:
- ⚡ High-Throughput Compound Pipelines (
prepare_context,verified_patch): Consolidates multi-step workflows into single-pass atomic MCP operations (250 µscontext prep,1.51 msverified atomic patch). - 📜 Bidirectional Intent & Contract Synthesis (
synthesize_contract,verify_contract): Proactively projects developer intent into strict type contract scaffolding and verifies implementation fidelity in15.27 µs. - 💥 Blast-Radius Impact Analyzer (
get_blast_radius): Computes downstream caller chains, affected file sets, and breaking change risk scores across 100+ modules in6.43 µs. - 🔍 Cross-Module Symbol Resolver (
resolve_symbol): Resolves module import hierarchies, origin files, byte spans, signatures, and doc-comments in4.99 µs. - 🎯 Intent-Driven Context Slicing (
extract_intent_slice): Isolates target symbols and their direct dependencies with >73% context token savings in95.42 µs. - 🛡️ Deterministic 11-Pass AST Safety Firewall (
check_safety): Enforces 11 formal invariants in24.70 µs. - 🏛️ Architectural Health Auditor (
detect_import_cycles,find_orphan_exports): Finds circular dependency loops (A -> B -> C -> A) and dead exports.
📊 Empirical Benchmarks & Performance Metrics
Benchmarked under optimized release profile (opt-level = 3, lto = thin, codegen-units = 1):
| Subsystem / Operation | Benchmark Cycles | Total Elapsed | Average Latency | Status |
|---|---|---|---|---|
⚡ Compound prepare_context Pipeline |
500 runs | 125.224 ms |
250.45 µs (0.25 ms / compound pass) |
100% PASS |
🛡️ Compound verified_patch Pipeline |
200 atomic patches | 302.132 ms |
1.51 ms / atomic patch |
100% PASS |
| 🔍 Cross-Module Symbol Resolution | 1,000 lookups | 4.990 ms |
4.99 µs (0.005 ms / query) |
100% PASS |
| 💥 Blast Radius Impact Analyzer (100 Modules) | 500 calculations | 3.213 ms |
6.43 µs (0.006 ms / analysis) |
100% PASS |
| 🔄 Circular Import Dependency Detector (50 Nodes) | 200 checks | 25.689 ms |
128.44 µs (0.128 ms / cycle check) |
100% PASS |
| 🛡️ AstGuard Invariant Verification (Core) | 1,000 iterations | 24.704 ms |
24.70 µs (0.024 ms / check) |
100% PASS |
| 📜 ContractSynthesizer (Intent Scaffolding) | 1,000 synthesis cycles | 15.271 ms |
15.27 µs (0.015 ms / contract) |
100% PASS |
| 🎨 Frontend AST Guard (JSX, Hooks, Secrets, XSS) | 1,000 iterations | 36.189 ms |
36.19 µs (0.036 ms / check) |
100% PASS |
| 🔄 Bidirectional Contract Verification | 500 round-trips | 34.072 ms |
68.14 µs / verification |
100% PASS |
| 🎯 ContextSlicer (Intent-Driven Slicing) | 1,000 slicing cycles | 95.417 ms |
95.42 µs (0.095 ms / slice) |
100% PASS |
| 🗜️ Frontend TSX Component Skeletonizer | 500 cycles | 160.267 ms |
320.53 µs (73.4% Token Savings) |
100% PASS |
| ⚡ AstContextCache (FIPS 180-4 SHA-256) | 1,000 inserts/lookups | 32.382 ms |
32.38 µs / digest + LRU |
100% PASS |
| 🔌 MCP Stdio JSON-RPC Dispatch | 1,000 round-trips | 160.630 ms |
160.63 µs / dispatch |
100% PASS |
| ✂️ AstDiffEngine (Patch & Skeleton) | 500 cycles | 24.339 ms |
48.68 µs / operation |
100% PASS |
| 🧠 SymbolGraph Polyglot Indexer | 600 files (1,600 symbols) | 25.424 ms |
42.37 µs / file |
100% PASS |
🔍 Industry Comparison Matrix
| Capability | locus-engine (v0.3.0) |
Traditional Linters (ESLint, Clippy) | Cloud AI Guardrails |
|---|---|---|---|
| Verification Latency | 12 µs – 0.05 ms (Nanosecond-scale) |
250 – 1,500 ms (Process Spawns) | 500 – 2,500 ms (Network Round-Trip) |
| Frontend Ecosystem Support | Native TSX, JSX, Svelte, Astro, Vue | Multiple plugins required | Cloud Regex / LLM Prompt |
| Execution Architecture | In-Memory Pure Rust Kernel | Node.js / Python Runtime | Remote HTTP Cloud API |
| Context Token Savings | > 70% - 85% (AST Skeleton) |
0% (Full Files) | 0% (Full Files) |
| MCP Protocol Support | Built-In JSON-RPC 2.0 over Stdio | Requires Custom Wrappers | Proprietary APIs |
| Memory Safety | 100% Safe Rust (0 Unsafe Blocks) | Varies (C/C++/Node) | Undefined |
| External Dependencies | Zero Crypto/Runtime Bloat | Heavy node_modules / Python env |
Cloud Connection & API Keys |
| Deterministic Guarantee | 100% Formal Invariant Rejection | Heuristic Warnings | Probabilistic LLM Re-evaluation |
🏛️ System Architecture & Workflow Pipeline
flowchart TD
subgraph Input ["Incoming Code / AI Agent Patch"]
RawCode["Raw Code Snippet / File (Rust, TSX, JSX, Svelte, Astro, Vue, Python)"]
end
subgraph AstGuardPipeline ["🛡️ AstGuard: Deterministic Firewall (<0.05ms)"]
P0["Pass 0: Delimiter Balance (Dijkstra)"]
P1["Pass 1: Async Mutex Across Await"]
P2["Pass 2: Division-by-Zero Guard"]
P3["Pass 3: Array Bounds Overflow"]
P4["Pass 4: Unsafe Unwrap / Expect Trap"]
P5["Pass 5: ReDoS Catastrophic Backtracking"]
P6["Pass 6: TS/JS Deep Null Dereference"]
P7["Pass 7: React Rules of Hooks Guard"]
P8["Pass 8: Client/Server Secret Leak Guard"]
P9["Pass 9: Unsafe Inner HTML Injection Guard"]
P10["Pass 10: Dijkstra JSX/HTML Tag Balancing"]
end
subgraph Resolution ["Resolution & Verification Verdict"]
VerdictSafe{"All Passes Passed?"}
Reject["❌ Immediate Rejection & Counterexample"]
Approve["✅ Verified Safe AST"]
end
subgraph ContextEngine ["✂️ AstDiffEngine & 🧠 SymbolGraph"]
Cache["⚡ AstContextCache (FIPS 180-4 SHA-256)"]
Skeleton["Frontend Skeletonizer (>73% Token Savings)"]
Patch["Surgical Byte-Span Node Replacement"]
end
subgraph Interfaces ["Exposed Runtime Interfaces"]
CLI["💻 CLI Binary: locus check / skeleton / graph / patch"]
MCP["🔌 Model Context Protocol Server: locus mcp"]
LIB["📦 Rust Library Crate: locus_engine"]
end
RawCode --> P0 --> P1 --> P2 --> P3 --> P4 --> P5 --> P6 --> P7 --> P8 --> P9 --> P10 --> VerdictSafe
VerdictSafe -->|No| Reject
VerdictSafe -->|Yes| Approve
Approve --> Cache --> Skeleton --> Patch
Patch --> Interfaces🛡️ The 11 Deterministic Safety Invariants
graph LR
A[AstGuard Invariant Passes] --> B[1. Delimiter Balance: Dijkstra stack scan]
A --> C[2. JSX/HTML Tag Balance: Stack-based opening/closing/void]
A --> D[3. React Rules of Hooks: Catch conditional use* calls]
A --> E[4. Secret Leak Guard: Reject server env in use client]
A --> F[5. XSS Injection: Block raw dangerouslySetInnerHTML]
A --> G[6. Concurrency: std::sync::Mutex across .await points]
A --> H[7. Arithmetic: Unguarded division by variable]
A --> I[8. Bounds: Array index without length checks]
A --> J[9. Panics: Unguarded .unwrap and .expect]
A --> K[10. ReDoS: Exponential nested regex quantifiers]
A --> L[11. Null Dereference: TS/JS deep access without ?.]- Delimiter Balance (Dijkstra Linear Stack Algorithm): Byte-accurate scanner verifying balanced closures
{}[]()while ignoring comments (//,/* */), raw strings (r#"..."#), template literals (`...`), and char literals ('c'). - Dijkstra JSX & HTML Tag Balancing: Verifies matching opening/closing tags, JSX fragments (
<>...</>), and self-closing void elements (<img />,<input />,<br />,<Component />). - React Rules of Hooks Guard: Catches React hooks (
useState,useEffect,useMemo,...
v0.2.0 - MCP Server & Install Scripts
Introduces Model Context Protocol (stdio) support for Claude Code/Cursor and one-line curl/irm install scripts.
?? LOCUS v0.1.0 - Sovereign Ambient HUD & Invariant Microkernel
?? LOCUS v0.1.0 Official Release
Sovereign Ambient HUD & Invariant-Verified Microkernel IDE in Pure Rust.
? Highlights:
- Standalone Binary: Ultra-lightweight (23.0 MB).
- RAM Footprint: < 38.5 MB idle.
- Wake Latency: < 2.5 ms (Alt + Space).
- Safety Firewalls: 6 In-Memory AST Invariant Passes (<0.05ms).
- Integrity: 191/191 tests passing (100%).
?? Standalone Portable Binary:
Download locus-app.exe below, run it, and press Alt + Space anywhere!