Secure Engine 0.1.9

Secure Engine 0.1.9 is a semantics-preserving large-repository performance release.

Highlights

• Replaces repeated whole-program graph searches with deterministic indexes by file, function, and output.
• Preserves the complete 0.1.8 analysis semantics, rules, limits, evidence, ordering, and public contracts.
• Adds deterministic reference-equivalence tests for the optimized lookup paths.
• Refreshes the project README with current installation, evaluation, architecture, and contribution information.

Measured performance

On a controlled OpenStatus scan using release binaries, --no-cache, and default limits:

• graph analysis: 110.033 s → 6.089 s median;
• internal scan: 115.061 s → 11.403 s median;
• end-to-end scan including full JSON: 118.77 s → 14.20 s;
• peak resident memory: +1.36%.

The before/after reports retained exactly 81,306 facts, 250,000 graph nodes, 368,983 edges, ten findings, and the same report fingerprint. Results depend on repository and hardware; this is a bounded performance measurement, not a security-coverage claim.

Compatibility and verification

Taxonomy 1.0.0, Evidence Contract v2, secure-json-v1, SARIF 2.1.0, rule IDs, fingerprints, CLI/desktop behavior, baselines, history, suppressions, private cache v16, and optional AI behavior remain compatible. No dependencies or rules changed.

The Fedora 44 x86_64 RPM was built twice from independent clean targets with network isolation. Both RPMs and all staged/extracted CLI and desktop binaries were byte-identical. Formatting, strict Clippy, 195 active offline tests, RustSec, cargo-deny, RPM metadata/extraction, AppStream validation, and graphical desktop smoke tests passed.

The full evidence JSON remains intentionally complete and can be large; compact export is not part of this release.

Secure Engine 0.1.8

Secure Engine 0.1.8

Secure Engine 0.1.8 freezes the corrections already integrated through Phase 6.13. It retains
the Phase 6.12 bounded summaries and exact value identities from RC1 and adds:

• bounded forward propagation only from proven earlier scalar and exact static-property records;
• an explicit boundary that refuses to infer protected operations or exposed handlers from generic
  mutations, names, comments, or arbitrary exports; and
• exact outbound policy projection to the same unmodified constructed URL or its href, while
  rejecting mutable, shadowed, ambiguous, exceptional, cyclic, or depth-exhausted evidence.

The public version remains 0.1.8. Taxonomy 1.0.0, Evidence Contract v2, secure-json-v1, SARIF
2.1.0, existing rule IDs, unaffected fingerprints, CLI/desktop parity, baselines, history,
suppressions, privacy, bounds, cancellation, and disabled-by-default AI validation remain
compatible. Structured 0.1.7 reports remain compatible secure-json-v1 inputs. The private parse
cache is v16; v15 and older entries produce safe misses. No dependency or new rule is part of this
release.

RC1 remains a retired-corpus erratum outside the Engine's sound data-flow boundary. This release
has not received an independent holdout evaluation and supports no benchmark, ranking,
superiority, production-readiness, or complete-coverage claim. Computed dispatch and properties,
reflection, ambiguous calls/imports, unresolved callbacks, and unproven runtime filesystem state
remain conservative limitations.

Qualification requires two fresh, isolated, offline and locked Fedora 44 builds from this signed
release commit. The RPM, staged CLI and desktop binaries, and RPM-extracted CLI and desktop
binaries must be byte-identical, carry identical GNU build IDs, and contain no physical checkout or
target paths.

Secure Engine 0.1.7

Secure Engine 0.1.7 completes the Phase 6.11 generalization work and keeps the existing public report, schema, taxonomy, SARIF, rule-ID, baseline, history, suppression, privacy, cancellation, and disabled-by-default AI contracts stable.

Highlights:

• bounded local convergence independent of configured call depth;
• authorization bound to the same protected resource;
• structural resolution of a final unshadowed dynamic sequence-expression callee;
• composed filesystem path identity with separator-aware confinement;
• exact-origin proof for constructed redirects over the same URL value;
• outbound property and destructuring connectivity through supported helpers and imports; and
• private parse cache v10, with older cache envelopes producing safe misses.

Verification

• Candidate commit: 1e3d300cb7092097f21be164b6c403b71f2b2520
• Candidate tree: 8f08ac800a43afcd39eb70cecd29c8643a24157b
• GitHub Actions CI: formatting, strict Clippy, tests, RustSec, and cargo-deny passed.
• Two clean Fedora 44 x86_64 package builds produced byte-identical RPMs.
• RPM SHA-256: 8f26b69981c7ba88081496b0c1dd1fce9da62c03a38927e07b3d64541cf45f75

Post-freeze holdout evidence

After the release candidate was frozen, it was evaluated once on a new 56-pair/112-case holdout in its native lane. The certified result was TP 23, FP 9, TN 47, FN 33: precision 0.718750, recall 0.410714, F1 0.522727, specificity 0.839286, and balanced accuracy 0.625000.

The evaluation required a post-open recovery of one preserved raw observation and a later evidence-only certification of the CLI's documented exit-status semantics. Across the complete study, every scanner/case combination was executed at most once and no scanner was retried.

Native and capability-normalized lanes remain methodologically separate. These results do not support a direct ranking or superiority claim against other scanners, nor claims of complete coverage or production readiness.

Known limits

Computed dispatch, computed or dynamic properties, reflection, ambiguous calls/imports, unresolved callbacks, and unproven runtime filesystem behavior remain conservative limitations.

Secure Engine 0.1.6

Experimental pre-1.0 release of the local-first Secure Engine CLI and native desktop application. Findings require human validation; a clean report is not a security guarantee.

Phase 6.10 generalizes fail-closed authorization summaries for authenticated-principal wrappers and request-bound boolean helpers. Compound checks now retain the relationship between authenticated principals and server-selected identity values. Alias, destructuring, and value-identity propagation are more precise across supported helpers and imports. Exceptional control flow models authorization rejection through try/catch/finally structurally, including unconditional rethrows, returns, and resolved terminating helpers, while preserving findings when execution can still reach a sensitive operation.

Supported alias and import resolution now includes bounded @/ mappings derived from TypeScript configuration. Unresolved helpers, ambiguous or dynamic imports, callbacks, recursion, reflective dispatch, framework middleware, and runtime-only policy remain conservative limitations. The implementation relies on value connectivity and reachability rather than application names, paths, comments, fingerprints, or suppressions.

The complete offline workspace suite passes 137 tests, and two Fedora RPM builds are byte-identical. Iterative read-only dogfood against CMS Nova reduced the original 56 false-positive fingerprints to zero without suppressions or application-specific exceptions. CMS Nova was iterative dogfood used to verify successive generic fixes, not a one-shot or independent benchmark.

Evidence Contract v2, taxonomy 1.0.0, secure-json-v1, deterministic SARIF, CLI/desktop parity, local-only behavior, and disabled-by-default AI validation remain preserved. This release makes no benchmark ranking, superiority, production-readiness, complete-coverage, or future-holdout performance claim.

RPM SHA-256: 0f336a262d1c1cac51a73c625a7398c392feb9f3ecad2aa81f62cbc128a62a64

Secure Engine 0.1.5

Experimental pre-1.0 release of the local-first Secure Engine CLI and native desktop application. Findings require human validation; a clean report is not a security guarantee.

Phase 6.9 improves exact source identity and source-span propagation through supported aliases and transformations. Value connectivity now preserves argument positions, object properties, helper parameters, return values, and supported imports. Guards, sanitizers, and dominance checks must protect the same propagated value, reducing overbroad control findings while retaining findings for weak, late, non-terminating, or wrong-value barriers.

The private parse cache advances to v6. Evidence Contract v2, taxonomy 1.0.0, secure-json-v1, deterministic SARIF, CLI/desktop parity, local-only behavior, and disabled-by-default AI validation remain preserved.

Dynamic imports, ambiguous aliases, callbacks, recursion, reflective dispatch, unresolved imports, framework middleware, and runtime-only policy remain conservative limitations. This release makes no benchmark ranking, superiority, production-readiness, complete-coverage, or future-holdout performance claim.

RPM SHA-256: b8d6a86bf9d7be7f5d8200056896189b684838e4af8818f61ec4960de4e20c64

Secure Engine 0.1.4

Experimental pre-1.0 release of the local-first Secure Engine CLI and native desktop application. This release includes Evidence Contract v2 output, deterministic JSON and SARIF export, multi-language analysis, baselines, local history, and optional consent-gated AI validation. Findings require human validation; a clean report is not a security guarantee.

RPM SHA-256: c470f8bab478c937d6924f4d1bf7f6328da564cc392624622b4cc234130c0aef