Secure Engine 0.1.6

Experimental pre-1.0 release of the local-first Secure Engine CLI and native desktop application. Findings require human validation; a clean report is not a security guarantee.

Phase 6.10 generalizes fail-closed authorization summaries for authenticated-principal wrappers and request-bound boolean helpers. Compound checks now retain the relationship between authenticated principals and server-selected identity values. Alias, destructuring, and value-identity propagation are more precise across supported helpers and imports. Exceptional control flow models authorization rejection through try/catch/finally structurally, including unconditional rethrows, returns, and resolved terminating helpers, while preserving findings when execution can still reach a sensitive operation.

Supported alias and import resolution now includes bounded @/ mappings derived from TypeScript configuration. Unresolved helpers, ambiguous or dynamic imports, callbacks, recursion, reflective dispatch, framework middleware, and runtime-only policy remain conservative limitations. The implementation relies on value connectivity and reachability rather than application names, paths, comments, fingerprints, or suppressions.

The complete offline workspace suite passes 137 tests, and two Fedora RPM builds are byte-identical. Iterative read-only dogfood against CMS Nova reduced the original 56 false-positive fingerprints to zero without suppressions or application-specific exceptions. CMS Nova was iterative dogfood used to verify successive generic fixes, not a one-shot or independent benchmark.

Evidence Contract v2, taxonomy 1.0.0, secure-json-v1, deterministic SARIF, CLI/desktop parity, local-only behavior, and disabled-by-default AI validation remain preserved. This release makes no benchmark ranking, superiority, production-readiness, complete-coverage, or future-holdout performance claim.

RPM SHA-256: 0f336a262d1c1cac51a73c625a7398c392feb9f3ecad2aa81f62cbc128a62a64