reconftw v5.0.0-beta.1

This is a pre-release of the Go rewrite — opt-in

releases/latest still resolves to bash v4.1. GitHub never points latest at a
pre-release, so if you do nothing you keep getting the bash release.

Three things are NOT done, and you should know them before installing:

1. Parity is measured against one target, not three to five. CUT-11 asks for 3-5
   canonical targets side-by-side against bash v1; one has been run. Differences on
   other targets are unmeasured, not verified-absent.
2. Throughput is unmeasured. No claim is made that this is faster than bash v1,
   or slower. Nobody has benchmarked them end to end.
3. Recon/<domain>/ is not created (CUT-08, open). The bash-shape tree is
   written under the workspace root as _compat/ instead. If your pipeline reads
   Recon/<domain>/, it will find nothing — please say so, that report is the input
   the decision is waiting on.

Full announcement, version-scheme rationale and feedback channel:
docs/V2-BETA-ANNOUNCEMENT.md

Changelog

• 1af3307: - LFI limits and timeouts to avoid unending hanging of child processes of ffuf. (@kleozzy)
• 871ca16: .gitignore (@six2dez)
• 52aae6a: Added exifray to installer (@six2dez)
• 1d236c1: Ax framework (@six2dez)
• 906b8f4: Fixed tests dry-run (@six2dez)
• e19a265: Fixes (@six2dez)
• d0c1ed4: Fixes #1026 #1027 #1028 (@six2dez)
• af7a0a8: Fixes and changelog (@six2dez)
• 0bafe13: Fixes axiom ls (@six2dez)
• 4fe052c: Fixes ffuf and other stuff (@six2dez)
• 015917e: Fray repo no longer public returns 404 , install via tool name only works (@kleozzy)
• 8a5f91c: Gitleaks removed (@six2dez)
• c703875: Installer fixes (@six2dez)
• 2689773: Installer fixes (@six2dez)
• ca41463: Installer log by default (@six2dez)
• 56de3bd: Merge branch 'dev' into patch-1 (@six2dez)
• 30dc70b: Merge branch 'six2dez:dev' into dev (@kleozzy)
• 21c2fa8: Merge pull request #1021 from kleozzy/dev (@six2dez)
• ab0f858: Merge pull request #1023 from kleozzy/dev (@six2dez)
• 86c2d11: Merge pull request #1024 from kleozzy/dev (@six2dez)
• 5fed7c9: Merge pull request #1029 from Luct0r/patch-1 (@six2dez)
• 5091cd7: Merge pull request #1034 from SpiritGun91/fix/mantra-module-path (@six2dez)
• 6c60943: Merge remote-tracking branch 'origin/dev' into dev (@six2dez)
• 9503a84: Pass postman urls , js endpoint checks urls into webs for more subdomains/urls to check , goes through scope checks to clear out irrelevant hosts. (@kleozzy)
• 07f8428: Small improvements (@six2dez)
• 2713658: Update install.sh (@Luct0r)
• 893fcb7: chore(02-01): add verify-0002.sh, interfaces_check/main.go, and root go.mod (@six2dez)
• e4128f7: chore(03-01): scaffold internal/core tree, bump Go 1.24, clean spike/python (@six2dez)
• 321d32c: chore(05-01): housekeeping WEB-02 wording + tools.lock Phase 5 additions (@six2dez)
• 48c97f1: chore(15-17): one command that runs every acceptance gate and the regression guard (@six2dez)
• 31fe756: chore(gitignore): never commit v2 secrets or a local reconftw.toml (@six2dez)
• 492f44d: chore(phase-03): begin phase 3 execution + activate chain flag (@six2dez)
• 21acb2c: chore: add project config (@six2dez)
• f787df6: chore: gitignore runtime data, web experimentation, and stray build artifacts (@six2dez)
• 4af9ecb: chore: gofumpt the spike tree (@six2dez)
• 081f340: chore: gofumpt the tree (@six2dez)
• 5d3f2cb: chore: merge executor worktree (worktree-agent-a0ae348f41b7053d3) (@six2dez)
• 999c6a3: chore: merge executor worktree (worktree-agent-a12183e60911af035) (@six2dez)
• 1bafff5: chore: merge executor worktree (worktree-agent-a22e0f28ea4bba1ec) — Plan 03-03 (@six2dez)
• 335af80: chore: merge executor worktree (worktree-agent-a24ac49c75ab44979) — Plan 03-02 (@six2dez)
• f8b77ab: chore: merge executor worktree (worktree-agent-a2ab11b535269d341) (@six2dez)
• a5ae86f: chore: merge executor worktree (worktree-agent-a2c12f516d01de533) (@six2dez)
• 9cda946: chore: merge executor worktree (worktree-agent-a339db4d95faee0fa) — Plan 03-04 (@six2dez)
• 23f6ba4: chore: merge executor worktree (worktree-agent-a4705b12ae0f01af9) (@six2dez)
• 658d9ac: chore: merge executor worktree (worktree-agent-a4f4a64b2d8160595) (@six2dez)
• 7c68eec: chore: merge executor worktree (worktree-agent-a69e9d800f0a6150a) (@six2dez)
• 277df21: chore: merge executor worktree (worktree-agent-a76121d844672454a) (@six2dez)
• aad6bd6: chore: merge executor worktree (worktree-agent-a7773b4f48eb3c5e6) (@six2dez)
• eedff41: chore: merge executor worktree (worktree-agent-a7922e2d73bd4098d) (@six2dez)
• 5f34f18: chore: merge executor worktree (worktree-agent-a7eeae09d3dcee460) (@six2dez)
• 17fd07a: chore: merge executor worktree (worktree-agent-a84526c90d4a397e7) — Plan 03-01 (@six2dez)
• 04dc8bd: chore: merge executor worktree (worktree-agent-a9aa70e0a74b2b729) (@six2dez)
• 41f0698: chore: merge executor worktree (worktree-agent-aabc50ea1300a9703) (@six2dez)
• f3ec2a6: chore: merge executor worktree (worktree-agent-aad4ae4981b01e14e) (@six2dez)
• 580ef7e: chore: merge executor worktree (worktree-agent-ab4e6975dae31454e) (@six2dez)
• d288e2d: chore: merge executor worktree (worktree-agent-abbd7cfa7583f7a98) (@six2dez)
• 4680de7: chore: merge executor worktree (worktree-agent-abd1d3cfe22a2af5a) (@six2dez)
• 8e02f8e: chore: merge executor worktree (worktree-agent-acfbca538bce23af1) — Plan 03-06 (@six2dez)
• 22c2784: chore: merge executor worktree (worktree-agent-ae7fdad6a58fd3d23) — Plan 03-05 (@six2dez)
• 408d8f8: chore: merge executor worktree (worktree-agent-afbd7f349b697bdb0) — Plan 03-07 (@six2dez)
• ca637f4: ci(03-01): wire Go CI pipeline + golangci-lint config + XCUT-07 sentinel gate (@six2dez)
• 1050e63: ci(15-07): make CI call the coverage gate instead of duplicating it (@six2dez)
• c54695a: ci(19-01): upload gate 13's log as an artifact so its verdict can be read (@six2dez)
• 6caba92: ci(19-02): give the release-gates runner the nuclei it has been skipping (@six2dez)
• 4163bfa: ci(docker): let the ARM64 gate run before cutover, and stop shadowing ci.yml (@six2dez)
• d93bc57: ci(docker): verify both platforms by running them, not by reading a manifest (@six2dez)
• 9481e5a: ci: make the gates able to fail — real E2E, patched toolchain, govulncheck (@six2dez)
• 814185f: ci: unblock the lint gate — pin the installer, fix the linter config (@six2dez)
• e9dd565: dev (@six2dez)
• dec8554: dev (@six2dez)
• 70a9ad3: docs(01): add code review report (@six2dez)
• 69ad29a: docs(01): add code review report (@six2dez)
• 696251e: docs(01): add gap-closure plans 01-04 and 01-05 (@six2dez)
• 0e8d93e: docs(01): capture Phase 1 context (Language ADR & Spike) (@six2dez)
• df7222c: docs(01): capture phase context (@six2dez)
• c8ea488: docs(01): create Phase 1 spike plans (5 plans, 4 waves) (@six2dez)
• ed7e020: docs(01): create phase plan (@six2dez)
• 6b17b55: docs(01): re-review after gap closure (0 critical, 3 warning, 3 info) (@six2dez)
• cc9306e: docs(01): research Phase 1 language ADR spike domain (@six2dez)
• 0cf965d: docs(01-01): complete resilient resume sentinel lifecycle plan (@six2dez)
• 32a102b: docs(01-01): complete spike harness scaffolding plan summary (@six2dez)
• 6c921b8: docs(01-02): complete Go spike plan summary with M1-M6 metrics and test results (@six2dez)
• 109e0f0: docs(01-02): complete boundary-only mid-run disk-full guard plan (@six2dez)
• 1ae798f: docs(01-03): complete PARALLEL_JOB_TIMEOUT_SECONDS + DNS timeout plan (@six2dez)
• d69a83e: docs(01-03): complete Python spike plan summary with M1-M6 metrics and test results (@six2dez)
• 48f1f04: docs(01-04): complete CR-01 clean-exit gate plan (@six2dez)
• 17ae1e1: docs(01-04): reconcile core.sh comment and D-02 with gated-trap semantics (@six2dez)
• 5b07e52: docs(01-05): complete CR-02 + CR-03 gap-closure plan (@six2dez)
• b4fd2e6: docs(02): add code review fix report (@six2dez)
• ccabe89: docs(02): add code review report (@six2dez)
• 3e5fea6: docs(02): add code review report (@six2dez)
• 4cd5ef1: docs(02): add verification report (4/5 must-haves; SC-5 needs human) (@six2dez)
• 9aadf6e: docs(02): capture phase context (@six2dez)
• e583fa8: docs(02): capture phase context (@six2dez)
• 65253cc: docs(02): plan phase — security quoting & supply-chain hygiene (@six2dez)
• 0ea6266: docs(02): research Phase 2 architecture v2 design (@six2dez)
• 245d169: docs(02-01): complete plan 02-01 scaffold — SUMMARY and ADR 0002 infrastructure (@six2dez)
• c3593a6: docs(02-01): complete safe_count eval removal plan — add SUMMARY.md (@six2dez)
• 0e896c1: docs(02-01): drop safe_count references from 5 doc files (@six2dez)
• 81a5e56: docs(02-01): scaffold ADR 0002 skeleton with 12 section stubs (@six2dez)
• cfbaa8e: docs(02-02): complete plan 02-02 — TOML Configuration Schema (@six2dez)
• 6a87296: docs(02-02): complete sendToNotify quoting pass + mantra path fix plan (@six2dez)
• 3b2c5fe: docs(02-02): populate §2 TOML Configuration Schema in ADR 0002 (@six2dez)
• 000524e: docs(02-03): complete AXIOM array refactor + SHA256 gates + tools.lock plan (@six2dez)
• 8e3f750: docs(02-03): populate §3 Output Tree + §4 Compat Symlink (recovered from stale-base worktree) (@six2dez)
• 0e510ea: docs(02-04): add plan 04 execution summary (@six2dez)
• f040890: docs(02-04): populate §5 Interface Signatures (Task, Backend, AppContext) (@six2dez)
• 0b45a1d: docs(02-04): populate §6 error hierarchy, §7 failure policy; update interfaces_check (@six2dez)
• 1dabd48: docs(02-05): complete plan 05 — §8 CLI Surface, §9 Test Ring Policy, §10 Logging Policy (@six2dez)
• 1a67ef3: docs(02-05): populate §10 Logging Policy & Secret Redaction in ADR 0002 (@six2dez)
• 3e2821e: docs(02-05): populate §8 CLI Surface and §9 Test Ring Policy in ADR 0002 (@six2dez)
• 490d1e4: docs(02-06): add TL;DR, Glossary, Reading Order; populate Consequences and References (@six2dez)
• d8795d0: docs(02-06): complete integration plan — SUMMARY.md (@six2dez)
• ff58acc: docs(02-06): populate §1 system diagram, §11 pre-sign gate, §12 amendment log (@six2dez)
• 121cf70: docs(02-07): complete plan 02-07 sign-off summary (@six2dez)
• eaf5752: docs(03): capture phase context (@six2dez)
• 5f24153: docs(03): create phase 3 plan (6 plans, 6 waves, 21 tasks) (@six2dez)
• 9ed9efe: docs(03): create phase 3 plan (7 plans, 7 waves, 23 tasks) (@six2dez)
• 633a2cd: docs(03-01): complete foundation kernel base layer plan (@six2dez)
• c8d1ed8: docs(03-02): complete layered config loader plan (@six2dez)
• b3d5f3d: docs(03-03): complete output + checkpoint plan (@six2dez)
• 49d8e86: docs(03-04): complete execution-engine primitives plan (@six2dez)
• 78a0de9: docs(03-05): complete dependency-kernel + orchestration-spine plan (@six2dez)
• 2442a0c: docs(03-06): complete CLI binary plan summary (@six2dez)
• c2bfe06: docs(03-07): complete Phase 3 closeout summary (@six2dez)
• b19fcda: docs(04): record live-run remediation state + next steps (@six2dez)
• fdc8d0a: docs(04-00): complete kernel-contract foundation plan — config fields, Tool.InputFlag, tools.lock x26, subdomains doc (@six2dez)
• aee7305: docs(04-01): complete passive subdomains plan — SUBD-01 + SUBD-05 addressed (@six2dez)
• 7c0e629: docs(04-02): complete active DNS resolution + brute-force plan (@six2dez)
• ccf53bf: docs(04-03): complete pure extractor packages + scraping Tasks plan (@six2dez)
• c36348c: docs(04-04): complete permutation + recursive Tasks plan with gopsutil OS memory provider (@six2dez)
• 68afc72: docs(04-05): complete enrichment tasks plan — takeover/buckets/ASN/geo/zonetransfer (@six2dez)
• 4b1648a: docs(04-06): complete integration plan — AxiomBackend+FailoverBackend+newSubsCmd pipeline (@six2dez)
• b24714d: docs(04-07): complete parity harness plan — SUBD-11 + AXIOM-09, stopped at human-verify checkpoint (@six2dez)
• 96cc569: docs(05): add code review report — 7 blockers (concurrent Append data-loss + others) (@six2dez)
• 52e83e1: docs(05): complete phase — DoD-2 leg(b) satisfied via real-data web smoke (15/15) (@six2dez)
• 4efdc50: docs(05): mark phase gaps-found — code review blockers override DoD acceptance (@six2dez)
• 660f177: docs(05): re-verify after gap closure + DAG fix — status human_needed (code complete, DoD-2 leg b VPS parity pending) (@six2dez)
• a71a56f: docs(05): refresh code review — 3 critical DAG blockers found after gap round (CR-01 circular DependsOn, CR-02 stage-order, CR-03 tests bypass DAG) (@six2dez)
• 27b4804: docs(05-01): complete web package scaffold plan (@six2dez)
• e5a80ca: docs(05-02): complete Group-A heavy tools (nuclei/screenshot/ffuf) plan (@six2dez)
• 3974ecd: docs(05-03): complete Group-A infra tools (waf/cdn/csp/favicon/vhost) plan (@six2dez)
• 7ce3167: docs(05-04): complete Group-B URL discovery + JS analysis + sourcemaps plan (@six2dez)
• 1211d66: docs(05-05): complete Group-C bypass + Group-D param discovery plan (@six2dez)
• 31bba87: docs(05-06): complete frozen-replay parity harness + realtools smoke plan (@six2dez)
• 4abbe9e: docs(05-07): Phase 5 acceptance — DoD-2 leg (a) done, leg (b) pending-VPS; VERIFICATION + SUMMARY (@six2dez)
• 4941193: docs(05-gap): finalize gap plans — favirecon co-change + urls single-writer dedup + sweep guard (plan-checker passed) (@six2dez)
• c4f363c: docs(05-gap): gap-closure plans 05-09..05-11 (staging contract + stage ordering + localized fixes) (@six2dez)
• dc94c33: docs(07): add gap-closure plans 07-08/07-09 (close code-review gaps) (@six2dez)
• 2e7a202: docs(07): reopen Phase 7 for gap-closure after code review (@six2dez)
• d57b3af: docs(07-02): complete osint domain/IP/email/spoof core plan (@six2dez)
• 5aabf18: docs(07-03): complete GitHub OSINT cluster plan (OSINT-04/05/06) (@six2dez)
• d469127: docs(07-04): complete cloud+API/SaaS-leak cluster (OSINT-07/08/09, D-O10) (@six2dez)
• 11291a0: docs(07-05): complete identity/fingerprint + metadata-fold plan (@six2dez)
• 0689261: docs(07-06): complete OSINT verification-machinery plan (@six2dez)
• 07a3d12: docs(07-07): complete OSINT E2E phase — DoD-2 real-run accepted (@six2dez)
• 20961ce: docs(07-08): mark GAP-01 osint stage-split plan complete (@six2dez)
• fb00804: docs(07-09): complete Backend env-seam + gato GH_TOKEN gap-closure plan (@six2dez)
• f794f0c: docs(09): capture phase context (@six2dez)
• 33c82f1: docs(09): create phase plan (@six2dez)
• dc37046: docs(09-01): summary — ConfigTransform hook + zen/deep profiles (@six2dez)
• 899101c: docs(09-02): summary — composite subcommands + RunCompositeAsync + passive hard-guard (@six2dez)
• 45be29e: docs(09-03): summary — v1 alias translation + --list batch + dry-run redaction (@six2dez)
• 0b89beb: docs(09-04): summary — stateful modes (gen-resolvers/refresh-cache/quick-rescan) (@six2dez)
• 7980d21: docs(13-01): complete subs resolve-core plan (SUMMARY + STATE + ROADMAP) (@six2dez)
• 615dfc4: docs(13-02): complete subs pipeline plan (STATE + ROADMAP) (@six2dez)
• 84173e4: docs(13-03): complete web active portscan + nerva plan (SUMMARY + STATE + ROADMAP) (@six2dez)
• 6a0450d: docs(13-04): complete web light-producers plan (SUMMARY + STATE + ROADMAP) (@six2dez)
• db921c6: docs(13-05): complete osint parity plan (STATE + ROADMAP) (@six2dez)
• 5520500: docs(13-06): complete osint github repo-secret scan plan (STATE + ROADMAP) (@six2dez)
• 1bd4619: docs(13-07): complete vulns spraying + bounded SSRF-OOB plan (STATE + ROADMAP) (@six2dez)
• ee25f1d: docs(13-08): complete domain-parity capstone (STATE + ROADMAP) (@six2dez)
• 39919ec: docs(14-05): add MIGRATION.md breaking changes, rollback, deprecation timeline (@six2dez)
• 1c94912: docs(14-05): add deferral ledger + documented-as-deferred process (@six2dez)
• 5f02285: docs(19-03): announce the beta by what it is not, and put that in the release body (@six2dez)
• b140c86: docs(19-03): track the beta opt-in doc set, and stop the front page promising a 404 (@six2dez)
• bf8b92a: docs(phase-01): collapse research to Go per D-03; mark Phase 1 complete (@six2dez)
• 891f943: docs(phase-01): complete phase execution (@six2dez)
• 1a09046: docs(phase-01): complete phase execution (@six2dez)
• 90a5a2a: docs(phase-01): evolve PROJECT.md after phase completion (@six2dez)
• 2a25b25: docs(phase-01): sign ADR 0001 — language choice (Go) per Phase 1 spike (@six2dez)
• c511dfa: docs(phase-01): update tracking after wave 1 (@six2dez)
• b3c2262: docs(phase-01): update tracking after wave 1 (@six2dez)
• a011402: docs(phase-01): update tracking after wave 2 (@six2dez)
• 2bd1cec: docs(phase-01): update tracking after wave 2 (01-02 + 01-03) (@six2dez)
• 94fe10b: docs(phase-01): update tracking after wave 2a (01-02) (@six2dez)
• 1ef92e4: docs(phase-01): update tracking after wave 3 (01-04 ADR draft) (@six2dez)
• 3c7b8ae: docs(phase-01): update tracking after wave 3 (gap closure) (@six2dez)
• 86ff87f: docs(phase-02): complete phase execution (@six2dez)
• 2825ee5: docs(phase-02): complete phase execution (@six2dez)
• 19705ad: docs(phase-02): create phase 2 architecture design plan (7 plans, 4 waves) (@six2dez)
• 869a66a: docs(phase-02): evolve PROJECT.md after phase completion (@six2dez)
• a1c7ee2: docs(phase-02): mark Phase 2 complete and record ARCH-v2 decision in PROJECT (@six2dez)
• a963bc8: docs(phase-02): sign ADR 0002 — architecture v2 design locked (@six2dez)
• 86c7f87: docs(phase-02): update tracking after 02-02 (TOML schema) (@six2dez)
• 06e9e74: docs(phase-02): update tracking after 02-03 (output tree + compat) (@six2dez)
• 106d16b: docs(phase-02): update tracking after 02-04 (interfaces + errors + failure_policy) (@six2dez)
• fdb661e: docs(phase-02): update tracking after 02-05 (CLI + tests + logging) (@six2dez)
• e2a8679: docs(phase-02): update tracking after 02-06 (integration: §1+§11+§12+TL;DR+glossary) (@six2dez)
• 397944e: docs(phase-02): update tracking after wave 1 (@six2dez)
• 7625c31: docs(phase-02): update tracking after wave 1 (02-01 ADR skeleton) (@six2dez)
• c4f0b73: docs(phase-02): update tracking after wave 2 (@six2dez)
• 4d77787: docs(phase-03): phase 3 verification report (@six2dez)
• 38e4ad8: docs(phase-03): update tracking after wave 1 (plan 03-01 complete) (@six2dez)
• 468647c: docs(phase-03): update tracking after wave 2 (plan 03-02 complete) (@six2dez)
• 6160595: docs(phase-03): update tracking after wave 3 (plan 03-03 complete) (@six2dez)
• b33a5e6: docs(phase-03): update tracking after wave 4 (plan 03-04 complete) (@six2dez)
• a2fcf29: docs(phase-03): update tracking after wave 5 (plan 03-05 complete) (@six2dez)
• e239da8: docs(phase-03): update tracking after wave 6 (plan 03-06 complete) (@six2dez)
• 845b724: docs(phase-03): update tracking after wave 7 (plan 03-07 complete) — phase complete (@six2dez)
• d9cf226: docs(phase-04): create phase 4 plan — subdomains E2E + axiom integration (@six2dez)
• 1f559ef: docs(phase-04): fix 4 blockers and 5 warnings in plans 00/04/05/06/07 (@six2dez)
• 698427a: docs(phase-04): replan — address all 6 REVIEWS verified findings (@six2dez)
• fbfbfea: docs(phase-04): revise plans 01/02/04/06/07 — address 4 blockers and 4 warnings (@six2dez)
• 48d2e61: docs(phase-07): complete OSINT E2E after gap-closure (@six2dez)
• 28402c6: docs(phase-07): mark Phase 7 complete in roadmap top-level + log WR-01 backlog (@six2dez)
• fe2afab: docs(phase-09): complete phase execution — composite modes (4/4 plans, 25/25 verified) (@six2dez)
• 443ccd0: docs(phase-09): evolve PROJECT.md — composite modes deliverable validated (@six2dez)
• b9d0463: docs(state): begin phase 02 execution (@six2dez)
• 6b866ff: docs(state): record phase 1 context session (@six2dez)
• bf93583: docs(state): record phase 2 context session (@six2dez)
• 6a49363: docs(state): record phase 2 context session (@six2dez)
• 43c6ece: docs(state): record phase 3 context session (@six2dez)
• 0b9d133: docs(state): record phase 3 verification session (@six2dez)
• a201e65: docs(state): record phase 9 context session (@six2dez)
• 4cf9a1c: docs: create milestone v2.0 roadmap (12 phases, 197 REQ-IDs) (@six2dez)
• 7d06758: docs: create roadmap (5 phases) (@six2dez)
• b81aa64: docs: define v1 requirements (@six2dez)
• 1ecfb67: docs: define v2.0 requirements (197 REQ-IDs, 17 deliverables) (@six2dez)
• 53a63f4: docs: initialize project (@six2dez)
• 330442f: docs: map existing codebase (@six2dez)
• 719fd51: docs: rewrite README for the v2 Go binary (@six2dez)
• 8befe78: docs: start milestone v2.0 Complete Core Migration (bash → Go/Python) (@six2dez)
• a72e27e: feat(01-01): add .inprogress_ sentinel lifecycle in start_func/end_func (@six2dez)
• 199f198: feat(01-01): add EXIT-only sentinel trap + resume banner in start() (@six2dez)
• bd70cb4: feat(01-01): create spike harness directory tree, .gitignore updates, and README (@six2dez)
• fc3b65b: feat(01-01): create spike test corpus, kill-tree mock, and bash v1 baseline placeholder (@six2dez)
• bab142b: feat(01-01): create spike/compare.sh comparison runner with all 6 metric extractors (@six2dez)
• 2a2013d: feat(01-02): add _check_disk_mid_run + _abort_disk_full helpers in utils.sh (@six2dez)
• c7927fb: feat(01-02): capture DEC-03 metrics (M4-M6) and session log; verify compare.sh (@six2dez)
• 54a1477: feat(01-02): implement passive fan-out (4 sources) + httpx probe + all tests (@six2dez)
• 912fc2f: feat(01-02): implement proc.Run subprocess wrapper + output.WriteJSONL atomic writer + tests (@six2dez)
• c6bee8f: feat(01-02): scaffold Go module, stubs, Makefile, and cmd/spike (@six2dez)
• f205abf: feat(01-02): wire _check_disk_mid_run into start_func + end_func boundaries (@six2dez)
• de0aea1: feat(01-03): add PARALLEL_JOB_TIMEOUT_SECONDS enforcement in heartbeat loops (@six2dez)
• 17fcba7: feat(01-03): capture DEC-03 metrics M3-M6 and session log; verify compare.sh (@six2dez)
• b70b3ad: feat(01-03): default DNS timeouts to 6h/4h, ship parallel timeout knobs (@six2dez)
• e0dda9c: feat(01-03): implement passive fan-out + httpx probe + PyInstaller binary (@six2dez)
• be9d599: feat(01-03): implement proc.Run subprocess wrapper, atomic_write_jsonl, and passing tests (@six2dez)
• 9d9ba7d: feat(01-03): scaffold Python spike project (pyproject.toml, venv, Makefile, package skeleton) (@six2dez)
• 4a8d889: feat(01-04): salvage spike comparison + ADR draft (socket-drop recovery) (@six2dez)
• 833ce94: feat(02-03): add tools.lock manifest and wire install_tools() to consume it (@six2dez)
• e5aa81c: feat(02-03): wire verify_sha256 into install_rust_uv() for SHA256 gating (@six2dez)
• 082d8a2: feat(03-01): implement 7-class typed error hierarchy with Is() sentinel bridge (@six2dez)
• 95adb96: feat(03-01): implement Secret + Redactor + RedactingHandler + log.New (two-layer defense) (@six2dez)
• 8803264: feat(03-02): implement Config struct + Defaults() mirroring ADR §2.2 (@six2dez)
• 9eb7ffc: feat(03-02): implement Load + Validate + 3 custom validators + [legacy] table mechanism (@six2dez)
• 96042e1: feat(03-02): implement WriteSnapshot with Secret redaction + 4-step atomic write (@six2dez)
• 90c628a: feat(03-03): W15 interfaces + W19 snapshot migration + W20 per-file gate (@six2dez)
• 8365eb2: feat(03-03): implement AtomicWriter (WriteJSONL + WriteFile) per ADR §3.5 (@six2dez)
• e321364: feat(03-03): implement CompatWriter skeleton + AtomicSymlink (@six2dez)
• f35d7b4: feat(03-03): implement OutputTree + ScopeFilter + Manifest + WorkspaceInit (@six2dez)
• b30b559: feat(03-03): implement SQLite checkpoint Store with WAL + InputHash (@six2dez)
• 3262650: feat(03-04): FOUND-10 AST-based raw-subprocess lint rule (@six2dez)
• 8749899: feat(03-04): GREEN — LocalBackend (kill-tree-safe) + AxiomBackend stub (@six2dez)
• 64cb0a9: feat(03-04): ToolRegistry (Critical tier) + RateLimiter + Runner (@six2dez)
• 5208db0: feat(03-05): AppContext.Boot + Target validator + Notifier stubs + UI dot-fill (W13) (@six2dez)
• a21ff84: feat(03-05): Task interface + Registry + topo sort + Scheduler + heartbeat (Blocker 4) (@six2dez)
• 45afb8f: feat(03-05): noop.demo Task — Phase 3 end-of-phase demo (CONTEXT default option (b)) (@six2dez)
• 338c8c5: feat(03-06): cobra root + 12 stub subcommands + v1 aliases + hidden kernel-demo (@six2dez)
• 060badc: feat(03-06): main.go ADR §10.3 init order + W14 parseEarlyFlags + Makefile XCUT-02 ldflags (@six2dez)
• 3ea1ca0: feat(03-06): version + health-check subcommands (D-04 fully working, Blocker 5) (@six2dez)
• 67e1dea: feat(03-07): GREEN — implement MockBackend + MockCheckpoint + MockOutputTree (FOUND-15) (@six2dez)
• f9bf9d6: feat(03-07): GREEN — tools.lock seed populates backend.Default at init() (FOUND-08) (@six2dez)
• 40bb664: feat(03-07): Phase 3 acceptance — integration smoke + interfaces_check upgrade + CI gate activation + ACCEPTANCE.md (@six2dez)
• f1d2300: feat(04): live-progress subs UI + stage failure-policy split (GAP-3) (@six2dez)
• 8da4983: feat(04-00): add MinResolvers, MinFreeMemGB, FailoverThreshold config fields (@six2dez)
• 7fb435e: feat(04-00): add Tool.InputFlag, expand tools.lock to 26 entries, create subdomains doc.go (@six2dez)
• beb1230: feat(04-01): delete demo scaffold; lock JSONL schemas; define MergeStage (@six2dez)
• a2309e0: feat(04-02): SubBruteTask + SubResolversHealthTask + MergeStage merged.txt output (@six2dez)
• af60dd1: feat(04-02): implement 6 active DNS resolution Tasks with staging-file pattern (@six2dez)
• c5ab17b: feat(04-03): implement SubScrapingTask/Analytics/NSDelegation with staging files (GREEN) (@six2dez)
• c274cb4: feat(04-03): implement pure extractor packages (GREEN) — favicon, js, analytics (@six2dez)
• 3a68d6e: feat(04-04): SubPermutTask + SubRegexPermutTask + SubDNSCewlTask + SubIAPermutTask + SubRecursivePassiveTask + SubRecursiveBruteTask (@six2dez)
• 5609363: feat(04-04): sysinfo.MemProvider interface + OSMemProvider using gopsutil/v3 (@six2dez)
• 7639de4: feat(04-05): implement SubGeoTask (ipinfo real geo) + ZoneTransferTask (AllowTransfer gate) (@six2dez)
• b6a21fc: feat(04-05): implement TakeoverSubzy/DNSTake/Buckets/ASN enrichment tasks (@six2dez)
• a6680b3: feat(04-06): AxiomBackend + FailoverBackend + boot.go 3-arg signature (@six2dez)
• 769bf78: feat(04-06): newSubsCmd real RunE — sequential 5-stage pipeline + filterByModuleAndEnabled + B2/B3 fixes (@six2dez)
• e20aed1: feat(04-07): AXIOM-09 equivalence test + FailoverBackend fallback parity (@six2dez)
• bb8dc38: feat(04-07): parity harness + v1-capture-gated fixture stubs (B4 fix, D-03) (@six2dez)
• 2e6a81a: feat(04-08): add realtools smoke test + audit 10 stage files for arg drift (@six2dez)
• 3ec8992: feat(04-09): GAP-2 policy + ScopeError re-propagation in best_effort (@six2dez)
• f9be6f7: feat(04-09): wire passive RunStage with subdomains.passive + add soft-fail tests (@six2dez)
• d26b59b: feat(04-10): add StageProgress reusable live-progress UI (GAP-3) (@six2dez)
• b09be81: feat(04-10): wire StageProgress into subs pipeline (GAP-3) (@six2dez)
• c59260d: feat(05-01): web package scaffold + HTTPXTask DAG root + web cmd RunE (@six2dez)
• 8874f4f: feat(05-02): FfufTask (fuzz.jsonl with Backend.Stream heartbeat, FFUF_THREADS_MAX cap) (@six2dez)
• 586d57c: feat(05-02): NucleiTask + ScreenshotTask (findings.jsonl + content-addressed screenshots) (@six2dez)
• 32ce1c2: feat(05-03): extractor siblings waf, csp, favicon.ExtractWeb (D-W3) (@six2dez)
• 76d96fe: feat(05-03): infra Tasks wafw00f, cdncheck, hakoriginfinder, csprecon, favirecon, VhostFinder (@six2dez)
• 067d5ef: feat(05-04): URL discovery + JS analysis Tasks (katana/urlfinder/waymore/urldedup/subjs/jsluice/mantra/jsa/sourcemapper) (@six2dez)
• 02cbcfb: feat(05-04): extractor extensions — js/secrets.go, extract/urls, extract/sourcemap (@six2dez)
• 2e4de6a: feat(05-05): Group-C bypass pipeline (Nomore403Task + ShortscanTask) (@six2dez)
• 368768a: feat(05-05): Group-D param discovery pipeline (GxssTask + ArjunTask) (@six2dez)
• 6c248cc: feat(05-06): DoD-1 smoke_test.go — all 23 Phase-5 tool golden arg vectors (@six2dez)
• 8f61098: feat(05-06): frozen-replay parity harness + testdata fixtures (D-W7, WEB-16) (@six2dez)
• 9fc15fc: feat(05-09): switch URL-producing tasks to staging files; fix jsa race; update doc.go (CR-01/CR-02) (@six2dez)
• ded833b: feat(05-09): switch findings/waf tasks to staging; rewrite urldedup single-writer; fix shortscan (CR-01/CR-02/CR-05/WR-01) (@six2dez)
• 4be28e2: feat(05-10): split web pipeline into 8 sequential stages (CR-04 fix) (@six2dez)
• e1a44f2: feat(06-01): D-V6 config struct additions + vulns package scaffold (doc.go + gf.go) (@six2dez)
• 172477b: feat(06-01): merge.go + tools.lock expansion + newVulnsCmd RunE + blank-import (@six2dez)
• 7d57b60: feat(06-02): CRLFTask — crlfuzz scanner (VULN-06) (@six2dez)
• 7d2980e: feat(06-02): XSSTask — dalfox pipe via Gxss reflection filter (VULN-01) (@six2dez)
• 7a8fe7d: feat(06-03): CMDITask — commix command injection scanner with XCUT-09 heartbeat (VULN-08) (@six2dez)
• ea4b7dd: feat(06-03): SQLiTask — dual-engine sqlmap+ghauri with XCUT-09 heartbeat (VULN-02) (@six2dez)
• a781cef: feat(06-04): LFITask — ffuf param-fuzz with lfi_wordlist, LFI_MAX_URLS=150 cap (VULN-04) (@six2dez)
• 7d68696: feat(06-04): SSTITask — TInjA/SSTImap engine-switch SSTI scanner (VULN-05) (@six2dez)
• e93fc60: feat(06-05): SSRFTask — qsreplace+ffuf + interactsh-client OOB session (VULN-03) (@six2dez)
• 9554cd9: feat(06-06): add SecondOrderTask — broken-link/second-order injection (VULN-12) (@six2dez)
• 1f22c31: feat(06-06): add SmugglingTask + WebCacheTask (VULN-07, VULN-09) (@six2dez)
• 491deeb: feat(06-07): Bypass4xxTask — nomore403 4xx bypass VULN-13 (@six2dez)
• 51e77b7: feat(06-07): NucleiDASTTask + FuzzparamsTask — nuclei -dast VULN-11 (@six2dez)
• 3e72966: feat(06-08): add GraphQLTask, GRPCTask, LLMTask, WebsocketTask (D-V3 web.sh orphans) (@six2dez)
• a48a1d2: feat(06-08): add TestSSLTask + FrayTask (D-V3 vulns.sh orphans) (@six2dez)
• 9ab917d: feat(06-10): add vulns-smoke.sh + lab/dvwa-seed-urls.txt for DoD-2 lab E2E (@six2dez)
• 15aa8ab: feat(07-01): scaffold osint package + extend config/tools.lock (@six2dez)
• 6fb4fcc: feat(07-01): wire newOSINTCmd RunE + osint blank import (@six2dez)
• f71faf4: feat(07-02): add DomainInfoTask + IPInfoTask (OSINT-01/02) (@six2dez)
• a283774: feat(07-02): add EmailsTask + SpoofyTask (OSINT-03/10) (@six2dez)
• 0dfd295: feat(07-03): GitHub dorks + Actions audit tasks, key-gated with redaction (OSINT-04, OSINT-06) (@six2dez)
• a484b61: feat(07-03): GitHub repos + leaks tasks with XCUT-07 three-layer redaction (OSINT-05) (@six2dez)
• ba43ec2: feat(07-04): add CloudEnumTask (OSINT-07) + MisconfigTask (D-O10 fold-in) (@six2dez)
• afd9398: feat(07-04): add PostmanTask (OSINT-08) + SwaggerTask (OSINT-09) — XCUT-07 redacted (@six2dez)
• 4bc5f62: feat(07-05): GQLSpectionTask (OSINT-13) + CewlerTask (OSINT-14) + XnldorkerTask (OSINT-15) + MetadataTask (D-O10 fold) (@six2dez)
• 8876734: feat(07-05): MSFTReconTask (OSINT-11) + CMSeeKTask + FaviReconTask (OSINT-12) (@six2dez)
• a8a51f7: feat(07-07): osint-smoke.sh DoD-2 real-target E2E driver + category-presence soft gate (@six2dez)
• b9fc8d0: feat(07-08): split osint pipeline into sequential stages (github_repos before github_leaks) (@six2dez)
• 80f014e: feat(07-09): add backward-compatible Backend env-injection seam (ExecEnv/StreamEnv) (@six2dez)
• db7580e: feat(08): MCP server — handlers, auth, scope, session, tools + docs/mcp.md (@six2dez)
• c728e8a: feat(09): composite/alias/batch/stateful subcommands (@six2dez)
• 2fbd278: feat(10-01): implement GetLatestCompletedScanForTarget query (@six2dez)
• d0c7999: feat(10-02): boot.go real-webhook wiring + notify --test subcommand (@six2dez)
• f9b5516: feat(10-02): real webhook notifiers + Flusher interface + DigestCoalescer + EventFilter (@six2dez)
• da76963: feat(10-03): implement internal/core/report package (GREEN phase) (@six2dez)
• 10b6713: feat(10-03): replace newReportCmd exit-64 stub with real implementation (@six2dez)
• c734351: feat(10-04): RunMonitorAsync handler — loop, diff, dedup, incremental seed, EventFilter, Flusher (@six2dez)
• 2e73526: feat(10-04): replace newMonitorCmd exit-64 stub with real CLI wiring (@six2dez)
• a829704: feat(11-01): tools.lock 98 versioned tools + Tool/schema install metadata + XPLAT-06 tests (@six2dez)
• bb2a82f: feat(11-02): internal/installer package — per-kind handlers, SHA-256 bootstrap, version-probe idempotency (@six2dez)
• e730955: feat(11-03): real reconftw install subcommand + health-check reuse + update-tools-lock.sh (@six2dez)
• eafba96: feat(11-04): GoReleaser config + release workflow + Homebrew source-build tap template (@six2dez)
• 267cb2c: feat(11-05): multi-stage non-root Docker image + setcap + ghcr multi-arch publish (@six2dez)
• 6463b0c: feat(11-06): CI platform-smoke matrix (Linux+macOS build/smoke/size gate) (@six2dez)
• 9b0ceb2: feat(13-01): SubDNSTask persists dnsregs + subdomains_ips.txt + hakip2host reverse-IP (@six2dez)
• 792c99f: feat(13-01): resolve tasks degrade on tool error; remove dead SubPTRTask (@six2dez)
• 86a82f5: feat(13-01): tls/reverse-ip default-on + tools.lock nmap/nerva/brutus/titus/Scopify (@six2dez)
• 3b45229: feat(13-02): SubCspreconTask — CSP-header subdomain discovery in subs stage (@six2dez)
• 748ee15: feat(13-02): dsieve top-N recursion seed selection (replace naive first-N slice) (@six2dez)
• fe1e3f5: feat(13-03): WebPortscanTask — IP-seed → cdncheck → passive smap/shodan + active naabu→nmap (@six2dez)
• 82625a7: feat(13-03): fold nerva service fingerprint into WebPortscanTask (@six2dez)
• f887da0: feat(13-04): WebURLExtTask — sensitive-extension URL bucketing (url_ext parity) (@six2dez)
• 0fc69a7: feat(13-04): WebWellKnownTask — .well-known metadata endpoint pivots (@six2dez)
• 4c280d0: feat(13-04): WebWordlistGenTask — roboxtractor + getjswords wordlists (pydictor deferred) (@six2dez)
• b165e83: feat(13-05): fold LeakSearch password-leak search into EmailsTask (PAR-03) (@six2dez)
• adf6407: feat(13-05): fold Scopify scope enumeration into DomainInfoTask (PAR-03) (@six2dez)
• 802a025: feat(13-05): restore WHOISXML reverse-IP + IP-target support in IPInfoTask (PAR-03) (@six2dez)
• 1c361e6: feat(13-06): company-repo secret scan (titus + trufflehog) in GithubReposTask (@six2dez)
• 6831888: feat(13-07): bounded interactsh-client auto-start restores SSRF OOB (@six2dez)
• 26ea133: feat(13-07): password spraying task (brutespray default + brutus deep-gated) (@six2dez)
• 96fa45e: feat(13-08): wire wave-1/2 task prefixes into all stage-list sites (@six2dez)
• b115a67: feat(14): CUT-08 real WriteCompat content-transform writer + extended V1ToV2Mapping (@six2dez)
• 6c2775f: feat(14): wire WriteCompat into live scan finalization (CUT-08) (@six2dez)
• d54e553: feat(14-01): add cfg→TOML migrator engine + full legacyAliasMap (@six2dez)
• db12bc8: feat(14-01): wire real 'reconftw migrate' subcommand, drop exit-64 stub (@six2dez)
• febfb9e: feat(14-04): CUT-11 operator-run bash-v1-vs-Go-v2 core-set parity harness (@six2dez)
• 1006c18: feat(15-01): adopt legacy workspaces safely on the identity-slug migration (@six2dez)
• cce5235: feat(15-01): canonical target identity for workspace addressing (F2) (@six2dez)
• 51b74c0: feat(15-02): add backend.Drain/Collect and surface the terminal stream error (@six2dez)
• 49a0061: feat(15-03): add StageJSONL/StageLines/PublishArtefact staging lifecycle (@six2dez)
• f18d54f: feat(15-04): add a PRAGMA user_version migration runner for store.db (@six2dez)
• 53d9e1c: feat(15-09): add non-blocking per-workspace advisory flock (@six2dez)
• e272be0: feat(15-09): claim the workspace in the boot path, reject the second run (@six2dez)
• 8c44b66: feat(15-11): per-scan report directories, a render manifest and an honest report tool (@six2dez)
• fc035b8: feat(15-16): persist monitor generation, baseline and notified fingerprints (@six2dez)
• 552d48f: feat(15-18): per-scan asset queries, observation counter and recon_dir update (@six2dez)
• 7c5167e: feat(15-18): target-scoped finding identity and enforced observation uniqueness (@six2dez)
• a4f54e0: feat(15-18): v1 to v2 store migration splits findings and repoints observations (@six2dez)
• b7860dd: feat(cli): add 'config show|sources', --version, and a health-check summary (@six2dez)
• 7b6e3b8: feat(core): passive backend, resolvers generator, scheduler limiter test, task filter, zen/deep profiles (@six2dez)
• a36ca05: feat(findings): SARIF findings schema + mapper (@six2dez)
• 0811e09: feat(scripts): add parity-check.sh — DoD-2 leg(b) web-pipeline v2-vs-v1 parity harness (@six2dez)
• bede6ba: feat(scripts): add web-smoke.sh — fast real-data web-pipeline smoke (@six2dez)
• 20eaf9c: feat(store): hand-maintained sqlc store layer (queries + models) (@six2dez)
• c62eead: feat(v2): phase 12 integration hardening — store, resume, notifications, rate-limiter, AI/Ollama, monitor (@six2dez)
• 26541a8: fix(01-03): move asyncio import to top of subfinder.py (@six2dez)
• 79967d7: fix(01-04): flip _RECON_CLEAN_EXIT=true as last statement of end() (CR-01) (@six2dez)
• 5fbbbf1: fix(01-04): gate _cleanup_inprogress on _RECON_CLEAN_EXIT (CR-01) (@six2dez)
• 3ad3bdf: fix(01-05): add _kill_tree helper and refactor _timeout_kill_job (CR-03) (@six2dez)
• d9a5a01: fix(01-05): decouple timeout-enforcement gate from verbosity gate (CR-02) (@six2dez)
• 68b6697: fix(02): CR-01 guard called_fn_dir before touch in end_func/end_subfunc (@six2dez)
• 5b738c5: fix(02): CR-02 register_secret for slack_auth before curl in sendToNotify (@six2dez)
• 574b8b0: fix(02): CR-03 warn loudly in verify_sha256 when no hash tool is found (@six2dez)
• 25e9f22: fix(02): WR-01 quote AXIOM_RESOLVERS_PATH/TRUSTED_PATH at all call sites (@six2dez)
• 7dd02c4: fix(02): WR-02 remove literal backslash-quotes from mantra -ua in local mode (@six2dez)
• 2b0bcf1: fix(02): WR-03 separate cat from wc in process_results fallback path (@six2dez)
• 378d5cd: fix(02): WR-04 pin six high-privilege Go tools in tools.lock (@six2dez)
• 0ed61a1: fix(02): WR-05 warn when download_sha256 key exists but has no pinned hash (@six2dez)
• 7c7931f: fix(02): replace literal triple-backtick in §11 prose to avoid awk fence false-match (@six2dez)
• 46aed84: fix(02-01): delete safe_count() eval injection vector from lib/common.sh (@six2dez)
• e7a066c: fix(02-02): full-function quoting pass on sendToNotify() in modules/core.sh (@six2dez)
• 5de0a72: fix(02-02): lowercase Brosck→brosck in axiom-exec mantra install path (FIX-01/D-06) (@six2dez)
• d31fe4d: fix(04): correct real-tool invocations + plain-hostname staging (@six2dez)
• 9fec6f0: fix(04): resilient subdomains pipeline — best_effort stages, scope default, merge union (@six2dez)
• 92a9bb3: fix(04): subs honors --config / --secrets (@six2dez)
• fb2c42d: fix(04-00): add MinResolvers/MinFreeMemGB/FailoverThreshold defaults (@six2dez)
• 71bc1c7: fix(04-00): align Tool struct-guard test with InputFlag; revert unplanned puredns critical promotion (@six2dez)
• a257143: fix(04-06): retire subs stub-exit-64 tests after newSubsCmd was wired (@six2dez)
• 2de5f57: fix(04-08): fix CrtTask args to positional (GAP-1 root cause) (@six2dez)
• 301208c: fix(05-11): CR-03 jsa direct exec, CR-07 per-tool timeouts, CR-06 per-host hako run (@six2dez)
• 74ee5cd: fix(05-11): WR-02..WR-09 + IN-01 localized warning fixes and co-changes (@six2dez)
• 657f0a0: fix(06): lint — lfi context-cancel break (SA4011) + remove 3 unused helpers (unused linter) (@six2dez)
• 5f534db: fix(06-02): allowlist vulns/xss.go for FOUND-10 (dalfox pipe + Gxss need stdin, like web/gxss.go) (@six2dez)
• 65d4160: fix(06-10): strip port from vulns-smoke --target (NewTarget rejects host:port; URLs keep :port via scope url.Hostname()) (@six2dez)
• 19efc4a: fix(07-07): admit company-seeded osint findings (no host/url) in Tree.Append (@six2dez)
• 70c98fa: fix(07-09): authenticate gato via registered-secret GH_TOKEN env + omit raw side-file (@six2dez)
• a81263d: fix(10-04): remove signal.NotifyContext mentions from monitor.go comments (@six2dez)
• f26194d: fix(13): CR-01 refuse redirects in web.wellknown to close SSRF pivot (@six2dez)
• 310bb92: fix(13): IN-01 register PDCP key with Redactor on ipinfo.io geo path (@six2dez)
• c5567d4: fix(13): IN-02 document Portscan Strategy/Naabu.Enabled coupling (no default change) (@six2dez)
• c7d2246: fix(13): IN-03 dedup hosts merge by decoded host identity (one line per host) (@six2dez)
• adacda9: fix(13): IN-04 remove .tmp/github raw-secret scan outputs after merge (@six2dez)
• 83bc6df: fix(13): IN-05 align github_repos docstrings with hybrid SecretsEngine default (@six2dez)
• 28da1d5: fix(13): WR-01 defer Axiom Shutdown after stage loop in subs/web/vulns/osint (@six2dez)
• dae42d3: fix(13): WR-03 confine spray credential output to 0600 and register with Redactor (@six2dez)
• a0c13e7: fix(13): WR-04 validate scheme and add -- separator to git clone (@six2dez)
• ce2c528: fix(13): WR-05 gate enumerepo plaintext fallback on JSON parse failure (@six2dez)
• 2f8e2d4: fix(14): WR-01 write migrated config 0o600 (not world-readable) (@six2dez)
• 6f6569a: fix(14): WR-02 clamp out-of-range migrated values to v2 field caps (@six2dez)
• 6990afe: fix(14): composite recon produced 0 live hosts — passive merge ran after enrichment (@six2dez)
• ad2ea63: fix(14): composite recon/all skipped passive subdomain stage (0-subdomains bug) (@six2dez)
• f52199d: fix(14): parity harness compared finding taxonomies apples-to-oranges (@six2dez)
• a18363f: fix(14): parity harness — drop phantom v2 --no-update flag + match stable workspace path (@six2dez)
• 4798c85: fix(15-01): reject syntactically invalid hostnames in NewTarget (F20) (@six2dez)
• 64ef83e: fix(15-03): publish empty artefacts on an empty merge union, never truncate (@six2dez)
• 3817ca5: fix(15-04): make the store.db version advance single-writer safe (@six2dez)
• b6740eb: fix(15-05): gate every handler on --dry-run before any filesystem mutation (@six2dez)
• 58b447e: fix(15-05): remove the pre-cobra boot and assert zero dry-run mutations (@six2dez)
• d6037a0: fix(15-07): make the critical-coverage gate statement-weighted and able to fail (@six2dez)
• a09e062: fix(15-08): pin real per-OS/arch toolchain digests, error on lookup miss (@six2dez)
• c0092be: fix(15-08): remove downloaded artefacts and probe a pre-existing Go version (@six2dez)
• a7962a7: fix(15-10): make ingest atomic with truthful terminal states and counters (@six2dez)
• 191678f: fix(15-11): scope report assets to the rendered scan by JOIN, with paging and an explicit historical opt-in (@six2dez)
• 46ed554: fix(15-12): match refresh-cache workspaces by identity, drop the orphan scan row (@six2dez)
• 0848b77: fix(15-12): read --dry-run before every mutation in the stateful subcommands (@six2dez)
• ab2e9c4: fix(15-13): consume the terminal stream error at all ten web and subdomains sites (@six2dez)
• fbc3826: fix(15-13): empty hosts/fuzz/origins/urls from their own direct writer on a zero-result run (@six2dez)
• f725d5f: fix(15-13): route every web and subdomains staging write through StageJSONL/StageLines (@six2dez)
• e175e0f: fix(15-14): attribute spray findings to the IP and carry every hostname (F20) (@six2dez)
• c6e307c: fix(15-14): consume the terminal stream error at all 13 vulns + osint sites (@six2dez)
• a16eed6: fix(15-14): migrate vulns + osint staging onto the F3 write-or-remove contract (@six2dez)
• eeaf22e: fix(15-15): MCP owns the lifetime of what it starts (F9) (@six2dez)
• 8069476: fix(15-15): cancel_scan must refuse entries that are not cancellable runs (@six2dez)
• b5f6f41: fix(15-15): capture MCP session scope atomically, once, for every tool (F8) (@six2dez)
• 3ed035d: fix(15-15): run MCP scans under the config the server was started with (F7) (@six2dez)
• f10a1fc: fix(15-16): clamp the monitor interval and make the loop keep its promises (@six2dez)
• 18b915c: fix(19-01): stop gate 13's verdict depending on how big its log is (@six2dez)
• 184c067: fix(19-03): make the produced archive name the one README tells users to fetch (@six2dez)
• 394c943: fix(backend/axiom): make --axiom safe — selection, results, teardown, timeouts (@six2dez)
• 1236615: fix(cli): honour --log-level and -o/--output; make errors readable (@six2dez)
• d7066cb: fix(config): resolve the system, user and project config layers (@six2dez)
• 7635e51: fix(docker): cross-compile the binary in-image per target platform (@six2dez)
• 10eddcb: fix(docker): put /usr/sbin and /sbin on PATH, and stop setcap failing silently (@six2dez)
• 855b6b5: fix(findings): stop discarding findings at the scope boundary (@six2dez)
• 58ae9a3: fix(lint): satisfy errcheck on the five test sites CI flagged (@six2dez)
• 4cedba9: fix(mcp,cli,backend): report outcomes honestly (@six2dez)
• c90fb67: fix(output): fold internationalised hostnames to punycode instead of rejecting (@six2dez)
• 5ad213f: fix(output): make the dir-fsync carve-out fire on darwin, and testable (@six2dez)
• e602a6e: fix(scope,store): IP/CIDR targets, per-scan reports, real record schemas (@six2dez)
• c3949f7: fix(subdomains): skip brute when the subs wordlist is unusable (@six2dez)
• a7e8a86: fix(vulns): guard nil tool results and read the resolved URL corpus (@six2dez)
• 392b0fd: fix(vulns.d-v5): honor --urls seed in all URL-corpus scanners via resolveURLInput (@six2dez)
• f7ada47: fix(vulns.ssrf): gate OOB behind explicit COLLAB_SERVER + bound task with timeout (@six2dez)
• 403f41c: fix(web): break web DAG cycle and order urls-dedup before bypass (@six2dez)
• 61abe1b: fix(web): drop out-of-scope URLs before Append instead of losing the batch (@six2dez)
• 6c9bbeb: fix(web): surface swallowed errors, clean temp files, validate origin IPs (@six2dez)
• f64383c: fix: correct mantra module path case (Brosck → brosck) (@SpiritGun91)
• 70554f6: fix: resolve every golangci-lint finding (41 -> 0) (@six2dez)
• f436d2e: fixes (@six2dez)
• 0080685: fixes (@six2dez)
• abda80a: ignore (@six2dez)
• 7ef5ff8: merge(15-01): wave 1 of phase 15 release gates (@six2dez)
• a90e3d5: merge(15-02): wave 1 of phase 15 release gates (@six2dez)
• f29a447: merge(15-03): wave 1 of phase 15 release gates (@six2dez)
• dce6a43: merge(15-04): wave 1 of phase 15 release gates (@six2dez)
• 0207ee5: merge(15-05): wave 2 of phase 15 release gates (@six2dez)
• 3ea143a: merge(15-06): wave 1 of phase 15 release gates (@six2dez)
• ca76bf9: merge(15-07): wave 1 of phase 15 release gates (@six2dez)
• d3c4ed6: merge(15-08): wave 1 of phase 15 release gates (@six2dez)
• c0b4b8c: merge(15-09): wave 3 of phase 15 release gates (@six2dez)
• 6e21a99: merge(15-10): wave 3 of phase 15 release gates (@six2dez)
• 4f8d9c1: merge(15-11): wave 3 of phase 15 release gates (@six2dez)
• 796ee44: merge(15-12): wave 2 of phase 15 release gates (@six2dez)
• f95acb8: merge(15-13): wave 2 of phase 15 release gates (@six2dez)
• b3cdd85: merge(15-14): wave 3 of phase 15 release gates (@six2dez)
• 8ba3258: merge(15-15): wave 4 of phase 15 release gates (@six2dez)
• 5cc4c1e: merge(15-16): wave 4 of phase 15 release gates (@six2dez)
• c35269e: merge(15-17): wave 5 of phase 15 release gates (@six2dez)
• 37a3db5: merge(15-18): wave 2 of phase 15 release gates (@six2dez)
• 1f2db13: refactor(02-03): migrate AXIOM_EXTRA_ARGS to global array AXIOM_EXTRA_ARGS_ARR (@six2dez)
• 7165398: remove pinned versions (@six2dez)
• 09ccfca: test(01): close UAT items after maintainer approval (@six2dez)
• f5c7855: test(01): persist human verification items as UAT (@six2dez)
• c83c173: test(01): record verification report (gaps_found) (@six2dez)
• f872cc7: test(02): persist human verification items as UAT (@six2dez)
• bdcba92: test(02): verify phase 2 goal achievement (5/5 must-haves) (@six2dez)
• 9626e51: test(03-01): add failing tests for 7-class typed error hierarchy (@six2dez)
• 9830702: test(03-01): add failing tests for Secret + Redactor + RedactingHandler + logger (@six2dez)
• 19578f3: test(03-02): add failing tests for Config struct + Defaults() + log.Secret typing (@six2dez)
• 4083b39: test(03-02): add failing tests for Load + Validate + 3 custom validators + property fuzz (@six2dez)
• 5d91b0d: test(03-02): add failing tests for WriteSnapshot + Secret redaction + atomic write (@six2dez)
• 258183e: test(03-03): add failing interface-shape gates (W15) (@six2dez)
• 91b7e70: test(03-03): add failing tests for AtomicWriter + FOUND-04 atomicity (@six2dez)
• e90802e: test(03-03): add failing tests for CompatWriter + AtomicSymlink (@six2dez)
• 799b884: test(03-03): add failing tests for OutputTree + ScopeFilter + Manifest (@six2dez)
• 6a4dd85: test(03-03): add failing tests for checkpoint Store + InputHash (@six2dez)
• e8f18ae: test(03-04): RED — Backend interface + Tool/Event/Result + Axiom/Local backend test scaffolds (@six2dez)
• 6c98654: test(03-07): RED — failing tests for MockBackend + MockCheckpoint + MockOutputTree + fixtures (@six2dez)
• 1730539: test(03-07): RED — failing tests for tools.lock seed (FOUND-08 Phase 4 default) (@six2dez)
• 482305b: test(04): real-arg-vector smoke test replaces --help liveness probe (@six2dez)
• edaadc3: test(04-01): add scope cross-check + passive Task tests (RED); implement 6 passive Tasks (GREEN) (@six2dez)
• f888395: test(04-02): add failing tests for 6 active DNS resolution Tasks (TDD RED) (@six2dez)
• 4b81358: test(04-02): add failing tests for SubBruteTask + SubResolversHealthTask (TDD RED) (@six2dez)
• 5e6e14e: test(04-03): add failing tests for SubScrapingTask/Analytics/NSDelegation (RED) (@six2dez)
• ce0403a: test(04-03): add failing tests for pure extractor packages (RED) (@six2dez)
• 65f34ff: test(04-04): add TDD RED tests for permut + recursive tasks (all 14 fail) (@six2dez)
• 7465448: test(04-04): add failing TDD RED tests for sysinfo.MemProvider + OSMemProvider (@six2dez)
• e1aafd6: test(04-05): add RED tests for takeover/buckets/ASN/geo/zonetransfer tasks (@six2dez)
• 563b035: test(04-06): TDD RED — AxiomBackend real impl + FailoverBackend tests (@six2dez)
• 0fa0ecd: test(05-07): populate httpx + nuclei fixtures from real hackerone.com capture (DoD-2 leg a) (@six2dez)
• ceca024: test(05-09): add multi-writer integration tests for MergeAllWebArtefacts (@six2dez)
• 7fb5ec9: test(05-11): add hakoriginfinder behavioral tests for CR-06 and CR-03 (@six2dez)
• 75e92c0: test(06-09): DoD-1 realtools smoke — argv golden for all 18 Phase 6 vuln tools (@six2dez)
• 9b53a39: test(06-09): vulns DAG guard + frozen-replay parity harness + synthetic fixtures (@six2dez)
• 666ab99: test(06-10): add testasp.vulnweb.com seed URLs (testphp.vulnweb.com unreachable) (@six2dez)
• b0c6df9: test(06-10): add testphp.vulnweb.com seed URLs for no-auth DoD-2 lab run (@six2dez)
• 682fe99: test(07-01): remove osint from stub-exit-64 list (now wired) (@six2dez)
• 5235d8a: test(07-06): DoD-1 realtools argv-golden smoke for every Phase 7 tool (@six2dez)
• b2226a0: test(07-06): osint DAG guard + frozen-replay parity harness (D-O6) (@six2dez)
• a26995c: test(07-08): guard osint stage order honors DependsOn (execution-path, not task.Build) (@six2dez)
• 4a771fe: test(10-01): add failing test for GetLatestCompletedScanForTarget (@six2dez)
• 61c8579: test(10-03): add failing tests for report package (RED phase) (@six2dez)
• e94a817: test(13-06): add failing company-repo secret-scan tests + clone seam (@six2dez)
• 9264859: test(14): CUT-08 real-extraction compat writer tests (@six2dez)
• 5b5a67c: test(14-01): golden fixtures + corpus/round-trip migrator validation (@six2dez)
• 4dab566: test(14-03): add >=75% lib coverage gate + report-pkg uplift, wire both gates into ci (@six2dez)
• 55b38c2: test(14-03): close critical-path coverage gaps + extend >=90% gate to all 4 SPEC paths (@six2dez)
• a072f94: test(14-04): XCUT-01 retune throughput gate to 10% + real-baseline slot (@six2dez)
• e55ca8f: test(14-04): XCUT-03 v1-bats -> v2-test parity map + stdlib drift guard (@six2dez)
• 54fc49a: test(15-02): add the stream-contract ratchet with a 23-site allowlist (@six2dez)
• ffc62eb: test(15-03): add staging-glob-triggered staging-contract guard (allowlist 38) (@six2dez)
• 3522687: test(15-09): cover the workspace lock's argument and degradation paths (@six2dez)
• 826d678: test(15-10): prove the ingest terminal states with a real failure-injection seam (@six2dez)
• 2c6ead8: test(15-11): prove the report half of acceptance gate 3 end to end (@six2dez)
• 19b6327: test(15-17): close both module contract ratchets and add the cross-cutting gate tests (@six2dez)
• cb84062: test(checkpoint,scheduler): close the statement-weighted coverage gate (@six2dez)
• 2339e18: test(config): anchor the golden NCPU normalization to FFUF_THREADS (@six2dez)
• 2b6f029: test(web): add DAG-build + topo-order regression guard for web pipeline (@six2dez)
• 8f6c80b: updates (@six2dez)