Polychro v1.0.0-beta4 — "Barquentine"

What is Polychro?

Polychro is a deterministic linting engine for spec-driven development. It validates semi-structured specifications — YAML, JSON, XML, Markdown, and HTML — through composable layers (well-formedness, schema-model, ruleset, and format-aware validation) in a single embeddable pipeline with sub-second latency.

Built on Spectral's shoulders. Polychro adopts Spectral's given/then ruleset grammar — the de facto standard for API governance rules — and extends it into a fully self-contained, polyglot engine. Where Spectral requires Node.js and is narrowly focused on OpenAPI, Polychro runs as a single JVM binary with no external runtime, supports custom rule functions in JavaScript, Python, and Groovy, and lints YAML, JSON, XML, Markdown, and HTML in the same pipeline.

💡 Polychro is designed to work alongside Ikanos — validating capability specs before they reach the runtime — but it is fully standalone and works with any YAML, JSON, XML, Markdown, or HTML document.

This v1.0.0-beta4 release builds on v1.0.0-beta3 ("Brigantine") with a focus on supply-chain security and release-pipeline maturity: published CLI binaries and Maven artifacts are now scanned with Trivy before release, the long-declarative "iso-functionality with Spectral" claim gets its first mechanically-verified conformance harness, and a real config-resolution bug is fixed so .polychro.yml path values behave predictably regardless of the working directory. No breaking changes to the SPI or ruleset grammar.

✨ Highlights

🔬 Spectral Conformance Harness (#81, #125)

Polychro's "iso-functional with Spectral" claim moves from declarative to mechanically verified:

• New polychro-conformance Maven module — a golden-file test harness that runs the same ruleset against the same document through both Polychro and a real Spectral/Node installation, then diffs the normalized diagnostics
• ConformanceHarnessTest and BundledRulesetRegressionTest cover the built-in ai-safety, governance, and security rulesets against dedicated baseline documents
• Test-only and opt-in — the module is not published and only runs under the -Pconformance Maven profile, so it adds zero cost to the default build
• -Dpolychro.conformance.skipNodeBootstrap=true lets the harness self-skip cleanly on offline or restricted machines instead of failing
• -Dpolychro.conformance.updateGoldenFiles=true is the only supported way to author or refresh a golden fixture — hand-editing a golden JSON file directly is no longer the workflow

🐛 Config File Paths Now Resolve Relative to the Config File, Not the CWD (#126)

.polychro.yml path-valued keys (schemaPath, rulesetPath, customCheckDir, checkovPath) were resolved against the process's current working directory, so the same config file behaved differently depending on where polychro lint was invoked from.

• LinterConfig.load now resolves each relative path-config value against the config file's own parent directory — mirroring how extends entries in a ruleset are already resolved relative to the ruleset itself
• A candidate path is only rewritten when the resolved file actually exists next to the config, so values intentionally meant to resolve against the CWD or a classpath resource keep working exactly as before
• New unit coverage in LinterConfigTest and SchemaModelValidatorTest locks in the new resolution order

🔒 Supply-Chain Hardening on Published Artifacts (#115, #116, #117)

Both release pipelines gain a security gate before anything ships:

• Maven artifacts — a new scan-dependencies job builds a fully-resolved CycloneDX SBOM and scans it with Trivy ahead of the github-snapshot, maven-central, and github-release jobs, blocking publish on CRITICAL/HIGH findings. Scanning the resolved SBOM instead of the raw pom.xml closes a blind spot on BOM imports (e.g. jetty-bom) and inherited properties that Trivy's static parser otherwise silently skips. The SBOM is attached to the GitHub Release for supply-chain visibility.
• CLI binaries — a Trivy scan now runs before publish-cli-bin.yml publishes, and each binary (Linux amd64/arm64, macOS arm64, Windows amd64) gets a SHA256 checksum file alongside it for download verification
• Confirmed CVEs patched via dependencyManagement overrides: BouncyCastle (CVE-2025-14813, CRITICAL), Eclipse Jetty ×3 (CVE-2025-5115, CVE-2026-2332, CVE-2026-1605, all HIGH), and json-smart (CVE-2024-57699, HIGH)

⚡ Faster Release Builds (#123, #122)

Tag-triggered (v*) native-binary builds now run the macOS leg on a macos-15-xlarge (5-core, M2 Pro) runner instead of the standard 3-core macos-latest, cutting release build time from ~45 minutes to ~3 minutes. Nightly, PR, and manual triggers keep the standard runner unless a caller opts in. Maven dependency caching and an explicit NATIVE_IMAGE_OPTIONS thread count were added alongside, at no cost and no behavior change.

📦 Dependency Updates

• io.modelcontextprotocol.sdk:mcp-core bumped in polychro-capability, tracking the sibling Ikanos MCP SDK update
• vite 7.3.2 → 7.3.6 and postcss bumped in polychro-node

⚠️ Known Issues & Limitations

• XML source ranges — JSON ruleset and schema diagnostics resolve a real SourceRange, but XML (#35) still reports SourceMap.NONE; tracked under the source-ranges epic (#38)
• Tutorial known limitations carried over from beta1: non-string-key false positive on quoted HTTP status codes (#5) and .polychro.yml schema config not consumed in Step 4 (#6)
• CLI pre-built binary installation — running the binary directly is not straightforward on macOS (Gatekeeper quarantine: xattr -dr com.apple.quarantine) or Windows (SmartScreen warning, unsigned binary). Workaround: run via java -jar polychro.jar
• polychro-rulesets JaCoCo coverage — pre-existing gap on main; coverage gate not yet enforced for this module
• Checkov — requires a local Checkov installation; not bundled in the binary
• CLI pre-built binaries available for macOS ARM64, Linux AMD64, Linux ARM64, and Windows AMD64

🔢 By the Numbers

• 13 commits merged since v1.0.0-beta3
• 43 files changed, +6,379 / −38 lines (the large insertion count reflects the new polychro-conformance module and its golden-file fixtures, including a committed package-lock.json for the bundled Spectral toolchain)
• 4 contributors

🙏 Contributors

Huge thanks to the team for shipping this release:

• @neyeahmed — Spectral conformance harness (#125), parent POM revision fix, beta4 release coordination
• @jeremnaf (Jeremie Tarnaud) — config file path-resolution fix (#126)
• @farah-t-trigui (Farah Trigui) — Maven artifact Trivy scanning (#116), CLI binary security hardening (#117), faster macOS release builds (#122)
• dependabot[bot] — mcp-core, vite, and postcss bumps

Full Changelog: v1.0.0-beta3...v1.0.0-beta4