RedDock v0.8.0 — Phase 7 Advanced / Lab

RedDock v0.8.0 completes Phase 7 — Advanced / Lab.

Highlights:

• Separately gated, short-lived per-Dockyard authorization for one fixed extended TCP service-discovery profile
• Append-only lab policy audit history carried into technical reports and DockPacks
• Bounded, data-only detector manifests with strict startup validation and content-addressed provenance
• Qwen3.5 4B through Ollama documented as the default local-AI path, with compatible providers remaining configurable
• Refreshed v0.8.0 Lab and detector-provenance screenshots

Security:

• Exact single-host enforcement at request, execution, and adapter boundaries
• Arbitrary Host headers rejected for the loopback application
• Detection snapshots fail closed before reconciliation when bounded state would be incomplete
• Declarative plugin output stops at the central rejection threshold
• Full repository security review completed with the validated findings remediated

Verification:

• GitHub CI backend, frontend, dependency audit, production build, and container smoke jobs passed
• 346 backend tests passed locally
• 28 frontend tests passed locally
• Default and lab-enabled production-image smoke tests passed end to end

See CHANGELOG.md, SECURITY.md, and ROADMAP.md for the complete release record.

RedDock v0.7.0 — Phase 6 Reporting

Phase 6 — Reporting

RedDock v0.7.0 adds deterministic, evidence-backed reporting without adding a new active security capability.

Highlights

• Technical JSON and Markdown reports plus an executive Markdown summary
• Complete SHA-256 evidence manifest linking findings, runs, and retained artifacts
• Portable, byte-reproducible DockPack ZIP exports
• Reporting workspace with immutable history, previews, manifest review, and download
• Dockyard-scoped reporting API documented in Swagger/OpenAPI
• Real reporting and Swagger screenshots in the project README

Security properties

• Empty report request body: no target, URL, output path, command, prompt, model, or source selector
• Database-referenced evidence only, with containment and hash re-verification
• Bounded queries, evidence reads, archive membership, and total DockPack size
• Atomic retained-state snapshot and restart cleanup of partial reports
• Delimiter-safe literal Markdown rendering for untrusted retained strings
• Deterministic member ordering, timestamps, modes, canonical JSON, and package hashes

Verification

• 307 backend tests passed, 1 skipped
• Ruff passed
• Frontend lint, type-check, 26 tests, and production build passed
• npm audit reported 0 known vulnerabilities
• End-to-end Docker smoke test passed through Phase 6 and verified identical DockPacks for unchanged state
• GitHub CI passed backend, frontend, container build, health, and smoke jobs

See the updated README, SECURITY.md, architecture guide, ADR 0011, and DockPack format documentation for details.

RedDock v0.6.0 — Phase 5 Intelligence

RedDock Phase 5 — Intelligence

Phase 5 adds reviewable, evidence-grounded AI advice while preserving RedDock's local-first safety model and DockGuard's separation between evidence, findings, and operator actions.

Highlights

• Adds an optional OpenAI-compatible intelligence provider for local or cloud deployments.
• Keeps intelligence disabled by default and requires explicit environment configuration.
• Builds each request from the latest completed correlation snapshot and its retained evidence-linked findings.
• Shows the exact packet and SHA-256 digest before approval; approval is bound to the reviewed packet, provider, model, destination, locality, and prompt version.
• Stores hashed input, output, and execution metadata for provenance and later review.
• Returns structured advice and limitations only. Intelligence cannot execute tools, mutate RedDock findings, or create operator actions.

Security boundaries

• External or credentialed providers require verified HTTPS; unauthenticated HTTP is limited to loopback providers.
• Provider redirects are disabled.
• Absolute request deadlines and independent decoded-response, raw-wire, and read-iteration limits constrain provider responses.
• Strict schemas reject unexpected output and references outside the approved evidence packet.
• Atomic approval claiming prevents duplicate sends, and interrupted runs recover to a failed state.
• FastAPI, Starlette, and pytest dependencies were refreshed after audit review.

Validation

• 293 backend tests passed with Ruff clean.
• 23 frontend tests passed with lint, TypeScript checks, and production build clean.
• npm audit and pip-audit found no known dependency vulnerabilities.
• Docker build, health check, and Phase 0–5 smoke validation passed locally.
• Branch and tag GitHub CI passed frontend, backend, and container jobs.
• Two final security review passes were completed; the identified low-severity issues were fixed and independently verified.

The README, roadmap, changelog, security guidance, architecture documentation, and ADRs are updated for v0.6.0. RedDock's mixed-AI development approach documents contributions made with Claude Code and OpenAI Codex.

RedDock v0.5.0 — Phase 4 Correlation

Phase 4 adds deterministic, evidence-linked correlation over RedDock's stored state and introduces the RedPath visualization.

Highlights

• Immutable correlation snapshots with hashed normalized and metadata evidence
• Exact-address web-to-host asset relationships backed by retained discovery evidence
• Same-asset and related-asset finding correlations carrying both findings' evidence hashes
• Fixed, versioned CWE mappings that classify findings without changing them
• RedPath graph APIs and UI, with every relationship explaining its basis
• Additive schema-upgrade, API, isolation, frontend, and end-to-end smoke coverage

Safety properties

Correlation accepts no target, selector, weight, script, or plugin and has no network or process capability. Missing evidence causes a relationship to be omitted. RedPath does not claim reachability, exploitability, causation, likelihood, or aggregate risk, and snapshots are capped at 5,000 edges.

Verification

The Phase 3-to-Phase 4 security diff review completed with full coverage and no findings. GitHub CI passed backend tests and lint, frontend audit/lint/typecheck/tests/build, and the production container smoke test on both the release commit and the v0.5.0 tag.

Full changelog: v0.4.0...v0.5.0

RedDock v0.4.0 — Phase 3 Validation

Phase 3 — Validation

• Adds approval-gated, non-destructive HTTP-origin rechecks for eligible findings.
• Re-evaluates DockGuard immediately before contact and retains denied attempts in the audit trail.
• Records confirmed, not reproduced, or indeterminate outcomes with separate confidence.
• Retains hash-linked raw, normalized, metadata, and manifest evidence artifacts.
• Adds validation API, workspace UI, smoke coverage, tests, and architecture documentation.

This release introduces no arbitrary targets, payloads, credentials, commands, redirects, response-body reads, or browser automation.