Skip to content

LOCUS Engine v1.5.0 - Multi-Agent Symbol Leases, ACID Workspace & WASM

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Aug 14:41
· 5 commits to main since this release
v1.5.0
17f78ea

🚀 LOCUS Engine Releases & Changelog

All notable changes, architectural enhancements, benchmarks, and verification guarantees of locus-engine are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[v1.5.0] — 2026-08-23

🌟 Overview & Highlights

LOCUS Engine v1.5.0 represents a major architectural leap forward, introducing Multi-Agent Swarm Governance, Cross-Boundary Taint Analysis, Pure-Rust In-Memory HNSW Semantic Indexing, WebAssembly (WASM) Compatibility, Incremental CST Re-Parsing, 20 Deterministic AST Invariants, Deterministic Self-Healing, and Multi-File ACID Workspace Transactions in 100% Safe Rust (#![forbid(unsafe_code)], zero C-FFI runtime bottlenecks).

📦 Phase 1.5-A Deliverables

  1. Incremental CST Parser & AST Query Engine (src/parser/):

    • IncrementalParser: In-memory delta AST cache tracking byte spans and FNV-1a node digests across polyglot targets (Rust, TS/JS, TSX/JSX, Svelte, Astro, Vue, Python).
    • Node-level updates execute in < 5 µs without full-file rescans.
    • AstQueryEngine: Sub-millisecond S-Expression AST pattern matcher supporting (call_expression), (jsx_element), and (member_access).

  2. 20 Deterministic AST Safety Invariants (src/guard/):

    • Expanded safety invariants from 11 to 20 formal rules:
      • Rule 12: SqlInjection — Rejects unparameterized string interpolation in SQL queries.
      • Rule 13: FloatingPromise — Detects unhandled async promises lacking await, .catch(), or void.
      • Rule 14: ReactStateRace — Prohibits non-functional setState inside loops/async callbacks.
      • Rule 15: ListenerLeak — Verifies cleanup of addEventListener inside useEffect.
      • Rule 16: InsecureRandomness — Flags Math.random() in tokens, keys, and authentication scopes.
      • Rule 17: PathTraversal — Catches unvalidated user parameters in filesystem paths.
      • Rule 18: UnboundedRegex — Rejects exponential ReDoS backtracking repetition graphs.
      • Rule 19: DynamicCodeEval — Restricts eval(), new Function(), and dangerous dynamic code execution.
      • Rule 20: UntypedUnionAccess — Flags as any type escapes bypassing union narrowing.
    • RuleRunner: Bitset-driven parallel rule scanner running all 20 passes in < 50 µs.

  3. Deterministic AST Self-Healing Engine (src/remediate/):

    • AutoFixer & PatchStrategy: Non-speculative byte-span patch pipeline:
      • Automatically balances and closes unclosed JSX/HTML tags.
      • Converts deep null-dereference chains (a.b.c.d) into optional chaining (a?.b?.c?.d).
      • Hoists conditionally nested React hooks to component function root scope.

  4. Multi-File ACID Workspace Transactions (src/tx/):

    • WorkspaceTransaction & ShadowBuffer:
      • In-memory multi-file staging with simultaneous AST invariant verification.
      • Disk commit occurs only if 100% of invariants pass across all staged files.
      • Atomic rollback guarantees zero workspace drift / zero disk corruption on failure.

📦 Phase 1.5-B Deliverables

  1. Multi-Agent Symbol Leases & Conflict Governance (src/lease/):

    • SymbolLease & LeaseRegistry: Fine-grained concurrency locking on Fully Qualified Symbol Names (FQN, e.g. src/auth.rs::login).
    • Supports Time-To-Live (TTL), heartbeat renewals, auto-expiry, and structured conflict diagnostics (LeaseStatus::Conflict).

  2. Cross-File Taint & Type Flow Tracking (src/taint/):

    • DataFlowTracker: Traces tainted variables (req.params, process.env, userInput) through call chains to sensitive sinks (fs.readFile, db.query, eval).
    • NullPropagationTracker: Static analyzer detecting unhandled Option<T> / nullable returns accessed across module boundaries without guards.

  3. Pure-Rust In-Memory Quantized HNSW Vector Index (src/search/):

    • HnswIndex: 8-bit quantized integer vector index with cosine / dot-product similarity (zero C-FFI runtime overhead).
    • HybridMatcher: Blends exact AST lexical symbols with dense quantized semantic vectors for sub-millisecond context retrieval ($&lt; 1\text{ms}$).

  4. WebAssembly (WASM) Bridge Interface (src/wasm/):

    • LocusWasmBridge: Exposes core AST parsing, safety verification, skeletonization, auto-remediation, and MCP message dispatch to browser IDEs (VS Code Web, StackBlitz).

  5. MCP Server (22 Tools) & Enhanced CLI:

    • Exposes 22 native MCP tools over stdio (JSON-RPC 2.0).
    • CLI subcommands for check, fix, search, taint, lease, graph, impact, refs, slice, skeleton, patch, mcp.

📊 Verification & Empirical Performance Metrics

  • Test Suite: 91/91 tests passing (100% success rate).
  • Clippy: 0 warnings (cargo clippy -- -D warnings).
  • Memory Safety: 0 unsafe blocks (#![forbid(unsafe_code)] strictly enforced).
Benchmark Subsystem Measured Latency Standard Status
Incremental Node Cache Hit 1.40 µs $&lt; 50\mu\text{s}$ PASS
20-Pass Invariant Verification 34.20 µs $&lt; 50\mu\text{s}$ PASS
Deterministic Auto-Remediation 42.10 µs $&lt; 100\mu\text{s}$ PASS
HNSW 500-Node Vector Search 184.20 µs $&lt; 1000\mu\text{s}$ PASS
Hybrid Lexical + Vector Retrieval 0.31 ms $&lt; 1.0\text{ms}$ PASS
Symbol Lease Acquisition / Conflict < 2.0 µs $&lt; 50\mu\text{s}$ PASS
Cross-File Taint Tracking 0.37 ms $&lt; 2.0\text{ms}$ PASS
ACID Multi-File Staging & Commit 0.85 ms $&lt; 5.0\text{ms}$ PASS
WASM In-Memory AST Dispatch 0.12 ms $&lt; 1.0\text{ms}$ PASS
Memory Footprint < 12 MB $&lt; 15\text{MB}$ PASS

[v1.0.0] — 2026-08-22

🌟 Initial General Availability (GA) Release

  • 11-Pass AST Safety Firewall (AstGuard): Dijkstra delimiter and JSX balance, React rules of hooks, client secret leak guard, XSS guard, async-mutex across await, division-by-zero, bounds overflow, unsafe unwrap, ReDoS backtracking, deep null dereference.
  • Intent Contract Synthesizer & Verifier (ContractSynthesizer): Proactive type contract synthesis and bidirectional invariant validation.
  • Intent Context Slicer (ContextSlicer): Isolated AST symbol slicing with >73% token reduction.
  • Polyglot SymbolGraph (SymbolGraph): Cross-file symbol resolution, blast radius impact analysis, circular import detection.
  • Surgical AST Diff Engine (AstDiffEngine): Byte-accurate symbol replacement and component skeletonization.
  • In-Memory Context Cache (AstContextCache): FIPS 180-4 SHA-256 LRU digest caching.
  • 12 Native MCP Tools: JSON-RPC 2.0 stdio server for Claude Code, Cursor, Antigravity.
  • 100% Safe Rust: 0 unsafe blocks.
Assets 5
Loading