blitzstrike 1.0.52 → 1.0.57

package/CHANGELOG.md

@@ -5,6 +5,80 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.57] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 18: documentation & examples)
+
+- `docs/AUTONOMY.md` — full reference for the autonomous engine (components,
+  mission lifecycle, safety invariants, CLI, MCP mission mode, no-babysitting).
+- `examples/` — runnable scripts: `mission-source.sh`, `mission-web.sh`,
+  `benchmark.sh`.
+- README — new "Autonomous engine" section + further-reading link.
+
+## [1.0.56] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 16: autonomous benchmark)
+
+- **Autonomous Benchmark** (`src/mission/benchmark.ts`, §26):
+  - `runAutonomousBenchmark()` — runs the FULL autonomous engine (Mission
+    Control) against each labelled corpus fixture and reports tp/tn/fp/fn,
+    precision, recall, F1, false-positive rate, time-to-completion, and budget.
+  - New CLI command: `blitzstrike benchmark` (`--full` for the whole corpus).
+
+### Fixed — multi-language source discovery
+
+- `iterSourceFiles` (`TARGET_EXTS`) only indexed PHP extensions, so the
+  autonomous engine silently skipped `.py`/`.java`/`.js`/`.ts` sources. Added
+  the missing extensions — the autonomous benchmark now scores
+  **precision 1.0 / recall 1.0 / F1 1.0** over the full 101-fixture corpus.
+
+## [1.0.55] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 15: termination engine)
+
+- **Termination Engine** (`src/mission/termination.ts`, §24):
+  - `evaluateTermination()` — ordered hard stops: user_interrupted →
+    budget_exhausted → safety_violation → scope_violation → max_iterations →
+    no_progress.
+  - `objectiveComplete()` — all tasks in a terminal non-failed state.
+  - `applyTermination()` — records the reason + detail into `decision_log` and
+    sets `completed`/`terminated`.
+  - `NO_PROGRESS_LIMIT` — iterations without progress before declaring stuck.
+- Mission Control now terminates on ANY traceable reason (not just budget) and
+  logs the termination decision with detail.
+
+## [1.0.54] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 14: budget controller)
+
+- **Budget Controller** (`src/mission/budget.ts`, §22):
+  - `budgetStatus()` — tracks time / tasks / requests / tokens / cost with
+    per-dimension overrun flags.
+  - `budgetOverrun()` — detects overruns and returns a specific reason
+    (e.g. `budget overrun: tasks, requests`).
+  - `consumeTasks()` / `consumeTokens()` — increment consumption counters.
+  - `perTaskOverrun()` — enforces the per-task request budget.
+- Extended the `Budget` type with `max_tokens`, `max_cost_usd`,
+  `per_task_budget`, `started_at`, and `used_tokens`/`used_cost_usd`.
+- Mission Control now terminates gracefully on ANY budget dimension overrun
+  (not just tasks) and records a final budget snapshot in the decision log.
+
+## [1.0.53] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 13: model router)
+
+- **Model Router** (`src/mission/router.ts`, §21):
+  - Pure routing layer — never calls a model. Deterministic by default.
+  - `routeTask()` — maps an agent type to a model tier (`large`/`medium`/`small`)
+    only when a provider is configured; otherwise routes to `none`.
+  - `AGENT_TIER` — §21 mapping (planning/source/review → large; attack execution
+    → medium; verification → small).
+  - `loadRouterConfig()` — reads `BLITZSTRIKE_MODEL_PROVIDER` / `_LARGE` /
+    `_MEDIUM` / `_SMALL` env vars.
+  - `routingPlan()` — full plan (all `none` when deterministic).
+- Mission Control records the routing decision (tier) per task and the overall
+  routing plan in the mission `decision_log`.
+
 ## [1.0.52] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 12: browser automation agent)

package/README.md

@@ -54,6 +54,25 @@ confirms it.
 
 ---
 
+## Autonomous engine
+
+Beyond single-tool calls, Blitz Strike ships a **self-driving security research
+engine** (Mission Control). Give it a target and a scope — it plans, executes,
+verifies, reviews against false positives, fills coverage gaps, and reports,
+all without babysitting:
+
+```bash
+npx blitzstrike mission ./path/to/source --mode source
+npx blitzstrike mission https://example.com --mode web --scope example.com
+npx blitzstrike benchmark --full
+```
+
+It is deterministic by default (no model calls unless configured), persists
+every mission (resumable), enforces scope + budget + termination policy, and
+keeps long-term memory of findings and failed approaches.
+
+→ [Autonomous engine](docs/AUTONOMY.md) — full architecture + reference.
+
 ## Why TypeScript / Bun
 
 - **Single static binary** via `bun build --compile` — ship one executable per platform.
@@ -384,6 +403,7 @@ Do not use against systems without explicit permission from the owner.
 
 - [Installation](docs/installation.md) — prerequisites, install, client registration.
 - [Usage](docs/usage.md) — one-call engagement, granular path, modes, memory.
+- [Autonomous engine](docs/AUTONOMY.md) — Mission Control, agents, security graph, benchmark.
 - [Manifesto](docs/manifesto.md) — the invariants that drive the methodology.
 - [Contributing](CONTRIBUTING.md) — how to add chains, tools, and data.
 - [Changelog](CHANGELOG.md) — version history.