ARCHON v1.2.0 — source-runtime parity

The whole static / white-box pipeline now runs as the same controlled, few-persistent-session agentic runtime as mapping — plan once, assign clearly, stream progress and findings, validate before reporting.

Added

• Spec session ladder — 1-30→1, 31-90→3, 91-200→4, 201-500→5, 500+→6 persistent sessions, as a quota-gated ceiling (backs off when the subscription bucket is warm/cooling).
• Review as its own dimension — every feature tracks review_status (pending / in_progress / reviewed_no_issue / candidate_found / needs_more_context / failed / duplicate) independently of mapping, plus per-item ledger fields. A failed review can no longer clobber a completed map.
• Triage session ladder — source-review triage scales 1-20→1, 21-75→2, 76-200→3, 200+→4 (cap 4); black-box triage unchanged.
• Richer streamed candidates — mode, vulnerability_class, affected_files, affected_endpoint, exploit_hypothesis, requires_runtime_validation, recommendation, and a deterministic duplicate_key so the same source→sink flow collapses to one.
• Dashboard cards — Feature Coverage, Findings Pipeline, and a live Timeline feed; the plan line shows quota mode, planned-vs-active sessions, the sizing reason, and the triager's real session count.
• Freehand review accounting — a freehand candidate upgrades a feature from reviewed_no_issue to candidate_found.

Fixed

• Validation-truth bug: a DISPROVEN candidate was relabelled SOURCE_CONFIRMED, and unconfirmed hypotheses were over-promoted. status and confirmation_status now derive from one canonical classifier and can't diverge.
• A failed review marked its feature blocked, wiping the mapping status — review outcomes now write the review dimension only.
• Freehand findings were categorised as freehand — the emitted vulnerability class is preserved.
• In-run dedupe ignored duplicate_key — it's now preferred over cwe|file|line|title.

Full changelog: https://github.com/ghostshift-content/ARCHON/blob/main/CHANGELOG.md

ARCHON v1.1.0 — Source Runtime redesign

Static and white-box source review now runs as a few persistent, Claude-Code-style worker sessions instead of many short-lived spawns — closer to how a human reviewer works, and far easier on the rate limit.

Added

• Source Runtime worker sessions — a planner sizes each run (session ladder by feature count, sharded by domain/risk, concurrency-capped); each worker maps many features in one long-lived context.
• Rate-limit-aware execution that never stalls coverage — a rate limit becomes a typed, retryable deferred_rate_limit that pauses and resumes, no longer conflated with a permanent blocked coverage gap. Quota health feeds back into session sizing (warm → fewer, cooling → pause to one).
• Honest mapping ledger — distinct counters for mapped / in-progress / queued / deferred / blocked / reviewed; progress reports real work done, not an accounted-for total that hid defers and blocks.
• Source Runtime dashboard card — live per-worker progress, plan/session breakdown, deferred and blocked counts, and a White-Box Validation section (GET /api/source-runtime).

Changed

• Explicit white-box source→runtime validation — a source candidate carries its live-validation target (affected endpoint + required black-box proof) to the board and the deferred pentest queue. A source-only finding stays SOURCE_CONFIRMED and is promoted to RUNTIME_CONFIRMED only with real captured runtime proof — never on a URL alone.

Full changelog: https://github.com/ghostshift-content/ARCHON/blob/main/CHANGELOG.md

ARCHON v1.0.2

Fixed

• Vulnerability-focus picker reappeared in black-box mode. v1.0.1 hid it via the hidden attribute, but the mode-toggle re-set display:block and overrode it. Removed that re-show line — the picker now stays hidden and every scan is full A→Z. (#11)

Drop-in upgrade from v1.0.1.

🤖 Generated with Claude Code

ARCHON v1.0.1

ARCHON v1.0.1 — patch release

Changed

• Disabled the black-box "Scan strategy → Vulnerability focus" class picker. Selecting a class (e.g. XSS) silently narrowed the strategist to that class only — which read as "the strategy scan isn't accurate." Every scan now runs the full A→Z deep dive by default, and dispatch is one step shorter. Backend focus handling is untouched, so the change is fully reversible. (#10)

No other behavior changes. Upgrade is drop-in from v1.0.0.

🤖 Generated with Claude Code

ARCHON v1.0.0

ARCHON v1.0.0 — first stable release

A durable multi-agent AI penetration tester for web applications. A lead agent plans a stack-specific attack, per-class specialists go deep in parallel, and independent verifiers reject anything they can't reproduce — confirmed, de-duplicated findings land live on your board. Runs entirely on a Claude subscription over OAuth (no metered API key).

Highlights

• Three engagement modes — black-box (URL), static/white-box (source, findings at file:line + vulnerable code block), and a combined white-box run that correlates source ↔ runtime into one report.
• Map-all-then-review code-review pipeline — every feature mapped before Phase 2, no head-of-line stalls; findings stream live.
• Honest confirmation status (RUNTIME_CONFIRMED / SOURCE_CONFIRMED / NEEDS_LIVE_VALIDATION / DISPROVEN) + an enforced evidence contract.
• Safety perimeter — fail-closed scope gate, impact-proving exploits off by default (3-gate opt-in), non-destructive, portal binds 127.0.0.1.
• Zero-build operator console — dispatch, live progress, triage, CVSS 3.1, on-demand reports.
• Flag-gated, off-by-default Autonomous Agent OS layer (byte-identical to the deterministic pipeline when off).

Field-tested

ARCHON's white-box review found a real broken-access-control flaw disclosed to GitLab via HackerOne, fixed in GitLab's May 2026 security release as CVE-2026-4524 (CVSS 6.5, CWE-288).

Install

git clone https://github.com/ghostshift-content/ARCHON.git archon && cd archon
bash setup.sh && npm start        # + npm run dashboard → http://localhost:4000

Requires Node ≥ 18 and the claude CLI logged in (Claude subscription). See the README and CHANGELOG.

⚠️ Authorized testing only. Only test systems you own or have explicit written permission to assess.

🤖 Generated with Claude Code