Skip to content

v0.3.0

Choose a tag to compare

View all tags
@tstromberg tstromberg released this 14 Aug 02:07
· 15 commits to main since this release
v0.3.0
4b9ae24

Detection

  • Shape signals: a dense capability jump in few files, or a package that deletes its own tree, now escalates alone.
  • A patch or same-version repack that gains behavior is raised to High. Disproportion is the signal.
  • Source archives read whole — build macros, fixtures, payload carriers stay in the diff.
  • Two new shapes named: a build macro growing a joined shell eval, and an unchanged loader over a changed compressed carrier. The xz shape.
  • Archive roots normalized, so pkg-1.2.3/ and pkg-1.2.4/ pair as one member.
  • Cleanups score as cleanups: disabled handlers, removed traits, falling risk read Notable, not hostile.

False positives, gone

  • absent → present identity is not drift. Only stripped identity is.
  • Filename-only identity never compared against manifest identity.
  • Empty identity objects likewise.
  • Absolute ML risk no longer condemns. Only a worsening band moves the verdict.

The model

  • Its verdict now raises displayed severity, and the risk bar with it. It never lowers.
  • The gate stays deterministic. A hallucination must not fail your build.
  • Raised numbers are labeled azoth+llm.
  • Prompt rewritten around an evidence order, and taught what remediation looks like.
  • --format interpret prints the exact payload and never calls out.

Output

  • --explain removed. One view. If isomer speaks, it shows everything.
  • Gained capabilities render as a tree: + new class, ↑ grown.
  • Removed high-risk behavior gets its own section.
  • Hunks name the member, dim the path, wrap instead of truncate.

Distribution

  • 20 targets: Linux gnu/musl (x86_64 → riscv64, s390x, ppc64le, loongarch64, arm), macOS, Windows, the BSDs, illumos, Solaris, Haiku, Hurd.
  • macOS binaries signed and notarized; a preflight proves the credentials before any build.
  • Sigstore provenance attestation, checksums, per-target retry, dry runs.
  • Runtime smoke tests on OpenIndiana, Tribblix, GhostBSD, openEuler, BlissOS.

Build

  • New release-lto profile — fat LTO, one codegen unit — for shipped binaries. Everyday cargo build --release gets thin LTO.
  • cleave and atomdrift-scan rev pins dropped; Cargo.lock holds the commit.

Full Changelog: v0.2.0...v0.3.0

Assets 2
Loading