blitzstrike 1.0.55 → 1.0.58

package/CHANGELOG.md

@@ -5,6 +5,46 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.58] — 2026-09-13
+
+### Fixed — total-verification pass
+
+- **Backward-compat mission load** — `loadMission` now normalizes old persisted
+  missions (missing the P14 budget fields: `max_tokens`, `max_cost_usd`,
+  `per_task_budget`, `started_at`, `used_tokens`/`used_cost_usd`, and P9
+  `failed_approaches`) so `blitzstrike mission resume <old-id>` no longer crashes.
+- **Scope gate** — now rejects ANY non-local target without an authorized scope
+  (previously the `https://` regex let a bare host like `example.com` slip past
+  the upfront gate). Non-local + no scope → `scope_required`.
+- README CLI section now lists the `mission` and `benchmark` commands.
+
+## [1.0.57] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 18: documentation & examples)
+
+- `docs/AUTONOMY.md` — full reference for the autonomous engine (components,
+  mission lifecycle, safety invariants, CLI, MCP mission mode, no-babysitting).
+- `examples/` — runnable scripts: `mission-source.sh`, `mission-web.sh`,
+  `benchmark.sh`.
+- README — new "Autonomous engine" section + further-reading link.
+
+## [1.0.56] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 16: autonomous benchmark)
+
+- **Autonomous Benchmark** (`src/mission/benchmark.ts`, §26):
+  - `runAutonomousBenchmark()` — runs the FULL autonomous engine (Mission
+    Control) against each labelled corpus fixture and reports tp/tn/fp/fn,
+    precision, recall, F1, false-positive rate, time-to-completion, and budget.
+  - New CLI command: `blitzstrike benchmark` (`--full` for the whole corpus).
+
+### Fixed — multi-language source discovery
+
+- `iterSourceFiles` (`TARGET_EXTS`) only indexed PHP extensions, so the
+  autonomous engine silently skipped `.py`/`.java`/`.js`/`.ts` sources. Added
+  the missing extensions — the autonomous benchmark now scores
+  **precision 1.0 / recall 1.0 / F1 1.0** over the full 101-fixture corpus.
+
 ## [1.0.55] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 15: termination engine)

package/README.md

@@ -54,6 +54,25 @@ confirms it.
 
 ---
 
+## Autonomous engine
+
+Beyond single-tool calls, Blitz Strike ships a **self-driving security research
+engine** (Mission Control). Give it a target and a scope — it plans, executes,
+verifies, reviews against false positives, fills coverage gaps, and reports,
+all without babysitting:
+
+```bash
+npx blitzstrike mission ./path/to/source --mode source
+npx blitzstrike mission https://example.com --mode web --scope example.com
+npx blitzstrike benchmark --full
+```
+
+It is deterministic by default (no model calls unless configured), persists
+every mission (resumable), enforces scope + budget + termination policy, and
+keeps long-term memory of findings and failed approaches.
+
+→ [Autonomous engine](docs/AUTONOMY.md) — full architecture + reference.
+
 ## Why TypeScript / Bun
 
 - **Single static binary** via `bun build --compile` — ship one executable per platform.
@@ -117,6 +136,8 @@ blitzstrike serve --mcp       # start MCP server over stdio (default)
 blitzstrike doctor            # health check: runtime + 130-tool catalog + creds
 blitzstrike install           # write MCP config to detected clients (Claude/Cursor/OpenCode)
 blitzstrike install --dry-run # preview the config without writing
+blitzstrike mission <target>  # run an autonomous mission (source or web)
+blitzstrike benchmark         # run the autonomous benchmark (--full for whole corpus)
 blitzstrike sync-data         # fetch heavy datasets (payloads + templates) on-demand
 blitzstrike update            # check for a newer version + refresh the data cache
 blitzstrike version           # print version
@@ -384,6 +405,7 @@ Do not use against systems without explicit permission from the owner.
 
 - [Installation](docs/installation.md) — prerequisites, install, client registration.
 - [Usage](docs/usage.md) — one-call engagement, granular path, modes, memory.
+- [Autonomous engine](docs/AUTONOMY.md) — Mission Control, agents, security graph, benchmark.
 - [Manifesto](docs/manifesto.md) — the invariants that drive the methodology.
 - [Contributing](CONTRIBUTING.md) — how to add chains, tools, and data.
 - [Changelog](CHANGELOG.md) — version history.