blitzstrike 1.0.43 → 1.0.46

package/CHANGELOG.md

@@ -5,6 +5,67 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.46] — 2026-09-13
+
+### Fixed (autonomous-engine milestone review)
+
+- **Scope gate** — a URL mission without an authorized scope now terminates
+  immediately with `scope_required` (no agent runs); `@recon` also refuses
+  unscoped URL targets instead of falling through to a source scan.
+- **Retry scheduling** — `retry` tasks are re-runnable again (treated as
+  `pending`), so failed tasks retry then resolve to `failed` instead of sticking.
+- **Security Graph now populated** — `@source` links sink nodes to the target;
+  `@commander`/`@reviewer` read the graph (exposure + reachability) for strategy
+  and adversarial review.
+- **Hypothesis lifecycle wired** — `@validator` promotes/rejects hypotheses
+  (validated/rejected) from STRIKE verdicts; `@reviewer` rejects low-confidence
+  or unreachable findings.
+- **Observability** — every agent decision is recorded in `decision_log`;
+  the `@reporter` output is captured as the mission `report`.
+
+## [1.0.45] — 2026-09-13
+
+### Added — Autonomous Security Engine (foundation, phases 1–6 of 18)
+
+The first milestone of the "Autonomous Security Research & Verification Engine"
+upgrade — a Mission Control layer that wraps the existing BLITZ / EAGLE-EYE /
+STRIKE core without replacing it.
+
+- **Mission State** (`src/mission/state.ts`) — persistent, resumable missions
+  (`~/.blitzstrike/missions/<id>.json`).
+- **Task Graph** (`src/mission/taskgraph.ts`) — dependency-aware, parallel
+  scheduling (pending/running/blocked/success/failed/retry/skipped/cancelled).
+- **Security Graph** (`src/mission/graph.ts`) — shared world model (nodes +
+  typed edges).
+- **Hypothesis Engine** (`src/mission/hypothesis.ts`) — observation/hypothesis/
+  validated/rejected with §14 confidence bands; never auto-confirms a hit.
+- **Specialized Agents** (`src/agents.ts`) — 12 modular agents (@commander,
+  @recon, @web, @api, @source, @auth, @mobile, @cloud, @analysis, @validator,
+  @reviewer, @reporter), each wrapping an existing primitive.
+- **Mission Control** (`src/mission/control.ts`) — the autonomous loop
+  (observe → plan → act → collect → replan → terminate), stateful + resumable,
+  mode profiles (web/api/source/mobile/cloud/bugbounty/redteam/audit).
+- **CLI** — `blitzstrike mission <target> [--mode] [--scope]`, plus
+  list/status/report/resume/stop subcommands.
+- **MCP Autonomous Mission API** — `mission_start` / `mission_status` /
+  `mission_resume` / `mission_stop` / `mission_list`.
+
+## [1.0.44] — 2026-09-13
+
+### Added
+
+- **Autonomous no-babysitting orchestration** (the missing piece vs.
+  oh-my-open-pentest's plugin loop):
+  - `runEngagement` now returns the full deliverable **inline** — summary,
+    markdown, JSON, and SARIF — so a single call completes a source audit
+    (no separate `report` call needed).
+  - `runLiveEngagement` — a fully autonomous live engagement for URL targets:
+    scope gate → marker-reflection sweep (`strike_verify` per common parameter)
+    → canonical findings via `resolveFinding` → inline report.
+  - `run_engagement` MCP tool auto-branches: URL target → autonomous live
+    sweep; source path → full static pipeline. Scope-gated and non-destructive
+    (marker + negative control only).
+
 ## [1.0.43] — 2026-09-13
 
 ### Added