Secure Engine 0.1.9

Secure Engine 0.1.9 is a semantics-preserving large-repository performance release.

Highlights

• Replaces repeated whole-program graph searches with deterministic indexes by file, function, and output.
• Preserves the complete 0.1.8 analysis semantics, rules, limits, evidence, ordering, and public contracts.
• Adds deterministic reference-equivalence tests for the optimized lookup paths.
• Refreshes the project README with current installation, evaluation, architecture, and contribution information.

Measured performance

On a controlled OpenStatus scan using release binaries, --no-cache, and default limits:

• graph analysis: 110.033 s → 6.089 s median;
• internal scan: 115.061 s → 11.403 s median;
• end-to-end scan including full JSON: 118.77 s → 14.20 s;
• peak resident memory: +1.36%.

The before/after reports retained exactly 81,306 facts, 250,000 graph nodes, 368,983 edges, ten findings, and the same report fingerprint. Results depend on repository and hardware; this is a bounded performance measurement, not a security-coverage claim.

Compatibility and verification

Taxonomy 1.0.0, Evidence Contract v2, secure-json-v1, SARIF 2.1.0, rule IDs, fingerprints, CLI/desktop behavior, baselines, history, suppressions, private cache v16, and optional AI behavior remain compatible. No dependencies or rules changed.

The Fedora 44 x86_64 RPM was built twice from independent clean targets with network isolation. Both RPMs and all staged/extracted CLI and desktop binaries were byte-identical. Formatting, strict Clippy, 195 active offline tests, RustSec, cargo-deny, RPM metadata/extraction, AppStream validation, and graphical desktop smoke tests passed.

The full evidence JSON remains intentionally complete and can be large; compact export is not part of this release.