-
coreci-bot released this
2026-09-27 14:29:32 +00:00 | 8 commits to main since this releaseMilestone v0.2 phase 4: the trust thesis is attack-proven.
Adversarial suite (REQ-32) — 11 attacks, all caught: hallucinated citations to never-stored passages flag as unanchored claims and FAIL the export gate (the gate now requires zero unanchored claims, not just ≥99% liveness — the verify pass caught a fabricated report passing vacuously); fabricated quotes never match; the weak band (0.80–0.85) is pinned with a real 0.82 input; private-IP redirect attacks die at the SSRF guard; redirect chains to gone pages classify dead; 5MB responses are capped; deep-report runs pause/resume and cancel mid-depth-loop over the real HTTP API.
E2E (REQ-17) — the ≤3-click happy path (submit question, pick methodology, approve plan) validated against the real stack: live ApiClient binding → loopback FastAPI bridge → asyncio engine with trust loop — not the mock.
Round-trip (REQ-34) — markdown export carries citation URLs as links; JSON export uses the backend ledger schema and validates back into the CitationLedger pydantic model.
Live tier (G-004) — opt-in keyed tests (uv run pytest -m live) skip cleanly without secrets; the zero-key suite never asserts the 99% bar vacuously.
Gates: 126 backend (mypy strict, ruff) + 97 frontend (typecheck, lint, vitest, build).
Next: P5 final review + audit + milestone ship → v0.2.5 (the MVP release), presented at the owner gate.
Downloads