The whole static / white-box pipeline now runs as the same controlled, few-persistent-session agentic runtime as mapping — plan once, assign clearly, stream progress and findings, validate before reporting.
Added
- Spec session ladder — 1-30→1, 31-90→3, 91-200→4, 201-500→5, 500+→6 persistent sessions, as a quota-gated ceiling (backs off when the subscription bucket is warm/cooling).
- Review as its own dimension — every feature tracks
review_status(pending / in_progress / reviewed_no_issue / candidate_found / needs_more_context / failed / duplicate) independently of mapping, plus per-item ledger fields. A failed review can no longer clobber a completed map. - Triage session ladder — source-review triage scales 1-20→1, 21-75→2, 76-200→3, 200+→4 (cap 4); black-box triage unchanged.
- Richer streamed candidates — mode, vulnerability_class, affected_files, affected_endpoint, exploit_hypothesis, requires_runtime_validation, recommendation, and a deterministic duplicate_key so the same source→sink flow collapses to one.
- Dashboard cards — Feature Coverage, Findings Pipeline, and a live Timeline feed; the plan line shows quota mode, planned-vs-active sessions, the sizing reason, and the triager's real session count.
- Freehand review accounting — a freehand candidate upgrades a feature from
reviewed_no_issuetocandidate_found.
Fixed
- Validation-truth bug: a
DISPROVENcandidate was relabelledSOURCE_CONFIRMED, and unconfirmed hypotheses were over-promoted.statusandconfirmation_statusnow derive from one canonical classifier and can't diverge. - A failed review marked its feature
blocked, wiping the mapping status — review outcomes now write the review dimension only. - Freehand findings were categorised as
freehand— the emitted vulnerability class is preserved. - In-run dedupe ignored
duplicate_key— it's now preferred over cwe|file|line|title.
Full changelog: https://github.com/ghostshift-content/ARCHON/blob/main/CHANGELOG.md