Release 1.3.0

audit v1.3.0

A release focused on fitting audit into real workflows — CI pipelines, pull requests, and the human triage loop — plus closing the loop after a scan with auto-fixes, a triage UI, and cost
visibility, and inbound-report triage.

✨ Highlights

CI / pull-request workflow

• Diff-aware scanning — audit run --base <ref> (PR mode, merge-base) or --since <ref> (incremental) constrains Recon to the changed files plus their blast radius
  (callers/callees/importers). A PR scan costs cents instead of dollars.
• Baseline & delta — audit baseline snapshots a run's findings into a committable file; --baseline <path> then suppresses known issues and reports NEW / FIXED / STILL-PRESENT.
  Findings are matched by a line-shift-robust fingerprint (vuln_class + normalized path + sink-code hash), so reformatting and code movement don't resurface old noise.
• SARIF + exit-code gating — audit report --format sarif emits SARIF 2.1.0 for the GitHub Advanced Security tab, GitLab SAST, and other triage tooling. Because audit produces
  reachability traces, each result carries a codeFlows entry (entry-point → sink), richer than typical single-location SAST output, plus partialFingerprints for cross-run dedupe.
  --fail-on <severity> exits 4 when a finding crosses the threshold — and with a baseline, only new findings can trip the gate.

Close the loop after the report

• Auto-fix (Stage 9, opt-in) — audit fix generates a minimal patch and a regression test for each confirmed and reachable finding. Each fix is produced inside a throwaway git
  worktree, so your working tree is never touched; patches are saved for review. --apply lands them on a branch (clean tree required) and --open-pr opens a draft PR via gh.
  Human-in-the-loop by design — it never auto-merges.
• Interactive triage viewer — audit report --serve opens a local web UI (127.0.0.1) reading straight from SQLite: filter by severity / reachability / status, inspect the call chain,
  and mark findings confirm / false-positive / won't-fix. Export your suppressions straight to a baseline.
• Cost observability — audit stats breaks spend down by stage and model, with token usage, prompt-cache hit ratio, and cost-per-confirmed / cost-per-reachable finding — so you can
  tune stages.yaml with data instead of guesswork. --json for automation.

Bug-bounty / VDP triage

• audit triage --report <path> — ingest an inbound researcher submission, reproduce it against the real code, run it through the same adversarial Validate stage (skeptical,
  different model) and reachability Trace gate, and dedupe it against your known issues (--against <run-id> / --baseline). Outcomes one verdict — accept / reject / duplicate /
  needs_info / not_reproduced — with the trace attached. The reachability gate is decisive: a confirmed-but-unreachable claim is recommended reject (real defect, but out of scope), giving
  triagers the "can't reach this, likely invalid" signal that cuts through low-quality reports. Supports stdin (--report -), JSON output, and live-target reproduction.

🛠Improvements

• Added audit --version (-V).
• All CLI output now flows through a single logger, including a new chrome-free log.print for tables and machine output, keeping piped JSON/SARIF artifacts clean.
• Fixed the live progress line flooding the terminal when activity text exceeded the terminal width (it now clamps to one row).

📝 Notes

• Auto-fix requires a git repository; --apply requires a clean working tree, and --open-pr opens a draft PR and never merges.
• New CLI exit code: 4 = --fail-on gate tripped (distinct from 2 usage / 3 budget abort).
• Diff mode and triage dedupe assume a git repo.