Commit Graph

Select branches

Hide Pull Requests

chore/bump-norma-v0.4.7

chore/docker-verified-tools

chore/dockerignore-and-readme

chore/norma-v0.4.4

chore/norma-v0.4.5

chore/norma-v0.4.6

chore/release-0.6.0

chore/server-tests-skip-without-dsn

chore/use-norma-usage-fix

docs/anthropic-base-url

docs/openai-responses-base-url

feat/adversarial-verification-gate

feat/agentic-guards

feat/agentic-prompt-hardening

feat/ask-operator

feat/ask-operator-env-handoff

feat/ask-operator-target-tag

feat/backup-script

feat/bbot-orchestrator

feat/bbot-typed-ingest

feat/claim-heartbeat-fencing

feat/closed-question-judge

feat/codeaudit-skill

feat/cost-ledger

feat/coverage-ledger

feat/deadline-contract

feat/derived-field-envelope

feat/drostbench-flag-corpus

feat/egress-governor

feat/fact-provenance

feat/finding-dedup-discipline

feat/finding-evidence-schema

feat/finding-proof-and-measured-impact

feat/hierarchical-budgets

feat/ingest-bbot

feat/intercept-decided-by

feat/l3-benchmark

feat/llm-test-stored-key

feat/llm-user-agent

feat/mcp-health

feat/notify-configurable-limits

feat/notify-limits-ui

feat/ouroboros-takes

feat/per-intent-llm-rotation

feat/php2shell-skill

feat/planner-quiet-mode

feat/planner-quiet-mode-toggle

feat/profile-posture-check

feat/prompt-injection-hardening

feat/rea-mcp-integration

feat/recon-toolbox

feat/release-body-from-changelog

feat/retest-verification

feat/skill-frontmatter-safety

feat/skills-reverse-skill-ports

feat/submission-review

feat/target-gate-custom-tools

feat/target-gate-extract-resolve-gate

feat/target-gate-hooks-scope

feat/target-gate-inherit-spawn

feat/target-gate-pinned-dialer

feat/target-gate-redirect-hops

feat/target-gate-schema-request

feat/test-db-per-package

feat/tool-rag-lexical

feat/untrusted-boundary-default-on

feat/untrusted-boundary-toggle

feat/update-banner-opt-in

feat/verification-ui

feat/verified-findings

fix/apply-new-options

fix/auth-init-setup-token

fix/auto-scope-hygiene

fix/backup-keep-zero

fix/block-reason-bound

fix/ci-race-shellcheck

fix/clean-clone-build

fix/companies-overflow-count

fix/config-load-errors

fix/cost-ledger-fresh-input

fix/customtool-proxy-scheme

fix/drost-dynamic-port

fix/drost-finding-detail-resilience

fix/drostbench-goal-target

fix/enrich-http-gate

fix/escalation-test-signature

fix/feishu-digest-overflow

fix/gitignore-backups

fix/go-1.26.10-xnet

fix/inheritance-test-teardown-order

fix/intercept-decision-source-prefix

fix/jwt-key-volume

fix/llm-provider-env-case

fix/llm-stored-key-endpoint

fix/llm-test-stored-profile-endpoint

fix/login-rate-limit-hardening

fix/login-terms-authorized-use

fix/node-22

fix/notify-overflow-count

fix/paused-duration-freeze

fix/shell-env-secrets

fix/target-gate-declared-first

fix/task-detail-metrics

fix/toolbox-tar-paths

fix/verification-gzip-body

main

release/v0.5.0

release/v0.5.1

rsi/loop-c-contract

rsi/shadow-lessons

rsi/skill-gaps

rsi/task-outcome-card

#102

#104

#106

#108

#11

#110

#111

#112

#113

#114

#115

#116

#118

#12

#121

#122

#123

#125

#126

#127

#128

#130

#132

#133

#134

#135

#136

#137

#138

#139

#14

#140

#141

#142

#143

#144

#145

#146

#147

#148

#149

#150

#151

#152

#152

#153

#155

#157

#158

#159

#16

#160

#161

#162

#163

#164

#165

#166

#167

#169

#170

#171

#172

#173

#174

#175

#176

#177

#178

#179

#18

#180

#182

#183

#184

#185

#186

#187

#188

#189

#190

#191

#192

#193

#194

#195

#196

#197

#198

#199

#2

#20

#200

#201

#202

#203

#204

#205

#206

#207

#208

#208

#22

#24

#26

#28

#30

#34

#35

#36

#37

#4

#42

#43

#44

#45

#46

#47

#49

#51

#53

#55

#57

#59

#6

#61

#63

#65

#67

#69

#7

#71

#74

#75

#77

#81

#82

#83

#88

#92

#95

#96

#97

#98

v0.4.0

v0.5.0

v0.5.1

v0.6.0

Mono Color

• 2fd6ed08fc feat(image): web-recon toolbox - nuclei, httpx, subfinder, katana, ffuf, dalfox, sqlmap feat/recon-toolbox BaaRai 2026-10-21 14:50:21 +02:00
• b237fbaa32 feat(engine): ouroboros takes - goal ambiguity gate, failover escalation, stagnation surfacing BaaRai 2026-10-21 14:46:56 +02:00
• d24e734f19 fix(web): freeze session run duration while the task is paused fix/paused-duration-freeze BaaRai 2026-10-21 14:34:31 +02:00
• 43a072861d Merge pull request #104 from BaaRai/rsi/shadow-lessons BaaRai 2026-10-21 14:27:40 +02:00
• a8f3c2c328 feat(rsi): evidence-gated lesson library in shadow mode rsi/shadow-lessons BaaRai 2026-10-19 00:32:09 +02:00
• 61abd4522f Merge pull request #108 from BaaRai/rsi/loop-c-contract BaaRai 2026-10-21 14:24:18 +02:00
• b95ece6418 Merge pull request #106 from BaaRai/rsi/skill-gaps BaaRai 2026-10-21 14:24:15 +02:00
• a98d9a1ec6 Merge pull request #102 from BaaRai/rsi/task-outcome-card BaaRai 2026-10-21 14:24:10 +02:00
• 8fd83ef070 docs(rsi): Loop C adoption contract and credits rsi/loop-c-contract BaaRai 2026-10-19 00:33:34 +02:00
• cbb6f66c4b feat(server): capability-gap report from skill misses rsi/skill-gaps BaaRai 2026-10-19 00:33:08 +02:00
• cf369dec4f feat(server): per-task outcome card for RSI baselines rsi/task-outcome-card BaaRai 2026-10-19 00:28:27 +02:00
• bba7989903 Merge pull request #98 from BaaRai/fix/drost-dynamic-port BaaRai 2026-10-16 14:31:42 +02:00
• 89ece8eb8d fix(bench): discover the challenge port dynamically and tear down on deploy failure fix/drost-dynamic-port BaaRai 2026-10-16 14:29:00 +02:00
• 623e5e58a7 Merge pull request #92 from BaaRai/fix/task-detail-metrics BaaRai 2026-10-16 13:38:10 +02:00
• 0777edfb8f Merge pull request #97 from BaaRai/fix/drost-finding-detail-resilience BaaRai 2026-10-16 12:17:54 +02:00
• 67971ef7da fix(bench): survive finding-detail 404s and always tear the corpus down fix/drost-finding-detail-resilience BaaRai 2026-10-16 12:15:02 +02:00
• 57cac93d49 Merge pull request #96 from BaaRai/fix/drostbench-goal-target BaaRai 2026-10-16 12:04:46 +02:00
• 58b221bfe1 fix(bench): name the target URL in the DrostBench task goal fix/drostbench-goal-target BaaRai 2026-10-16 12:02:01 +02:00
• 5d72de4ef7 Merge pull request #95 from BaaRai/feat/drostbench-flag-corpus BaaRai 2026-10-16 11:47:45 +02:00
• 19e929c224 feat(bench): let runs pick the task llm chain and host-reachable target feat/drostbench-flag-corpus BaaRai 2026-10-16 11:44:54 +02:00
• d2f4697b2b feat(bench): add the DrostBench corpus with a flag oracle BaaRai 2026-10-16 11:27:47 +02:00
• b269d3e590 fix(server): fill task metrics on the detail endpoint fix/task-detail-metrics BaaRai 2026-10-13 14:49:47 +02:00
• 908832ae1b Merge pull request #88 from BaaRai/feat/planner-quiet-mode-toggle BaaRai 2026-10-12 21:13:40 +02:00
• 9f03b8c16a feat: per-task planner quiet-mode switch, editable mid-run feat/planner-quiet-mode-toggle BaaRai 2026-10-12 21:13:28 +02:00
• 8d841a6011 Merge pull request #83 from BaaRai/fix/inheritance-test-teardown-order BaaRai 2026-10-12 18:46:55 +02:00
• 35bd98561c Merge pull request #82 from BaaRai/feat/test-db-per-package BaaRai 2026-10-12 18:46:51 +02:00
• d0ffd96960 Merge pull request #81 from BaaRai/feat/planner-quiet-mode BaaRai 2026-10-12 18:46:48 +02:00
• ac8491d666 fix: inheritance test teardown closes the manager after the DeleteTask cleanups fix/inheritance-test-teardown-order BaaRai 2026-10-12 18:43:41 +02:00
• aaf966872a feat: each test package runs on its own database feat/test-db-per-package BaaRai 2026-10-12 18:43:29 +02:00
• f57cf659b5 feat: planner quiet-mode skips edge rounds while work runs and goals hold feat/planner-quiet-mode BaaRai 2026-10-12 18:36:44 +02:00
• ff2e0bf338 Merge pull request #77 from BaaRai/feat/skills-reverse-skill-ports BaaRai 2026-10-12 16:34:48 +02:00
• 53bda9fe37 feat(skills): port edr-bypass-re playbook from reverse-skill (MIT) feat/skills-reverse-skill-ports BaaRai 2026-10-12 13:15:05 +02:00
• a11c2ed10c feat(skills): port api-security playbook from reverse-skill (MIT) BaaRai 2026-10-12 13:15:05 +02:00
• 04e8b37368 feat(skills): port patch-diff playbook from reverse-skill (MIT) BaaRai 2026-10-12 13:15:05 +02:00
• 2cdedd8eee Merge pull request #75 from BaaRai/fix/llm-test-stored-profile-endpoint BaaRai 2026-10-12 08:55:32 +02:00
• 2f80ffd979 Merge pull request #74 from BaaRai/fix/cost-ledger-fresh-input BaaRai 2026-10-12 08:55:29 +02:00
• 6b1f04b1ba fix: llm/test stored profile fills endpoint fields from the row fix/llm-test-stored-profile-endpoint BaaRai 2026-10-12 08:54:29 +02:00
• c96c3ea3a9 fix: cost ledger charges fresh input only (cache read is part of input tokens) fix/cost-ledger-fresh-input BaaRai 2026-10-12 08:53:20 +02:00
• e36d0730da Merge pull request #71 from BaaRai/feat/cost-ledger BaaRai 2026-10-12 08:25:41 +02:00
• a183c4aad5 Merge pull request #69 from BaaRai/feat/submission-review BaaRai 2026-10-12 08:25:38 +02:00
• 67ff6ffffa feat: cost ledger (per-profile EUR pricing on token usage) feat/cost-ledger BaaRai 2026-10-12 08:20:37 +02:00
• 7644ae2a2f feat: pre-submission report review (validate against program rules) feat/submission-review BaaRai 2026-10-12 08:09:57 +02:00
• 3231211fca Merge pull request #61 from BaaRai/feat/profile-posture-check BaaRai 2026-10-12 08:04:35 +02:00
• 724967b4b5 merge main (resolve .gitignore: keep both entries) feat/profile-posture-check BaaRai 2026-10-12 08:03:35 +02:00
• 3f1c409558 Merge pull request #67 from BaaRai/feat/llm-test-stored-key BaaRai 2026-10-12 08:02:10 +02:00
• 93300a6097 Merge pull request #65 from BaaRai/feat/deadline-contract BaaRai 2026-10-12 08:02:08 +02:00
• 6b2f682ebe Merge pull request #63 from BaaRai/feat/finding-dedup-discipline BaaRai 2026-10-12 08:02:05 +02:00
• ba5c31fd01 Merge pull request #59 from BaaRai/feat/l3-benchmark BaaRai 2026-10-12 08:02:00 +02:00
• 2853f085e5 fix: llm/test stored-key fallback skips the runtime's key normalization feat/llm-test-stored-key BaaRai 2026-10-12 07:37:32 +02:00
• 2629140b93 feat: deadline contract in the executor seeds feat/deadline-contract BaaRai 2026-10-12 07:30:27 +02:00
• 02265524f2 feat: duplicate discipline before report_finding and in the reporter feat/finding-dedup-discipline BaaRai 2026-10-12 07:29:59 +02:00
• 54b32714bb feat: refusal-posture probe for LLM profiles BaaRai 2026-10-12 07:01:40 +02:00
• 86a4efc85e feat: L3 benchmark harness (whole-app corpus, independent judge) feat/l3-benchmark BaaRai 2026-10-12 07:01:36 +02:00
• 0e53de78c2 Merge pull request #57 from BaaRai/feat/ask-operator-env-handoff BaaRai 2026-10-12 06:46:25 +02:00
• ce8efa5139 Merge pull request #55 from BaaRai/feat/codeaudit-skill BaaRai 2026-10-12 06:46:23 +02:00
• 4b815d5ee0 feat: ask_operator environmental handoff discipline feat/ask-operator-env-handoff BaaRai 2026-10-12 06:45:21 +02:00
• b81c6238a7 feat: codeaudit skill (white-box source audit pipeline) feat/codeaudit-skill BaaRai 2026-10-12 06:41:22 +02:00
• b17f885935 Merge pull request #53 from BaaRai/feat/adversarial-verification-gate BaaRai 2026-10-12 06:31:28 +02:00
• b4430a3ef2 Merge pull request #51 from BaaRai/feat/finding-proof-and-measured-impact BaaRai 2026-10-12 06:31:25 +02:00
• bb81979bf6 feat: adversarial verification gate before confirmed findings feat/adversarial-verification-gate BaaRai 2026-10-12 06:26:51 +02:00
• 2d8e357961 feat: measured impact and attacker-goal proof standard for findings feat/finding-proof-and-measured-impact BaaRai 2026-10-12 06:25:35 +02:00
• bc178443a2 Merge pull request #49 from BaaRai/feat/prompt-injection-hardening BaaRai 2026-10-12 00:59:03 +02:00
• c1bebabafa feat: first-layer prompt-injection hardening for agents feat/prompt-injection-hardening BaaRai 2026-10-12 00:58:53 +02:00
• c60988d934 Merge pull request #47 from BaaRai/chore/use-norma-usage-fix BaaRai 2026-10-12 00:54:15 +02:00
• 9ef99cfa27 chore: use the norma fork until the usage fix lands upstream chore/use-norma-usage-fix BaaRai 2026-10-12 00:54:03 +02:00
• a26ba1ebab Merge pull request #46 from BaaRai/fix/login-terms-authorized-use BaaRai 2026-10-11 23:23:31 +02:00
• cc7a42f705 fix: login terms of use now permit authorized testing fix/login-terms-authorized-use BaaRai 2026-10-11 23:22:35 +02:00
• 3a8a4f8366 Merge pull request #45 from BaaRai/feat/ask-operator BaaRai 2026-10-11 23:06:51 +02:00
• d54e468763 feat: ask_operator tool - workers can request operator input (captcha/OTP) with a screenshot and pause feat/ask-operator BaaRai 2026-10-11 23:06:39 +02:00
• 553a9ac638 Merge pull request #44 from BaaRai/feat/mcp-health BaaRai 2026-10-11 23:05:38 +02:00
• 7a98373cfd Merge pull request #43 from BaaRai/feat/backup-script BaaRai 2026-10-11 23:05:35 +02:00
• acce5cea2b Merge pull request #42 from BaaRai/feat/skill-frontmatter-safety BaaRai 2026-10-11 23:05:32 +02:00
• 28e6618c71 feat: surface MCP server connect health to operators and agents feat/mcp-health BaaRai 2026-10-11 22:50:00 +02:00
• 2c8359fdb1 feat: built-in backup script (pg_dump with rotation, optional data archive) feat/backup-script BaaRai 2026-10-11 22:46:47 +02:00
• 07d272727d fix: emit safe skill frontmatter YAML and verify it round-trips feat/skill-frontmatter-safety BaaRai 2026-10-11 22:26:22 +02:00
• e2d7eecb61 feat: rea reverse-engineering skill + per-server MCP HTTP request timeout (#37) BaaRai 2026-10-11 19:55:54 +02:00
• 799defadd1 fix: quote the rea skill description so the YAML frontmatter parses feat/rea-mcp-integration BaaRai 2026-10-11 19:09:08 +02:00
• 24c8ea13c0 feat: rea reverse-engineering skill + per-server MCP HTTP request timeout BaaRai 2026-10-11 19:02:23 +02:00
• b17fa7fe3a Merge pull request #36 from BaaRai/docs/prune-upstream BaaRai 2026-10-11 17:23:53 +02:00
• e771e4f165 README: prune dead upstream links and fork-irrelevant sections BaaRai 2026-10-11 17:23:46 +02:00
• 4ce99fb8bd Merge pull request #35 from BaaRai/docs/readme-coherence BaaRai 2026-10-11 16:38:57 +02:00
• 4a901cb417 README: make the license terms match reality, drop em dashes BaaRai 2026-10-11 16:38:50 +02:00
• e827c62933 Merge pull request #34 from BaaRai/feat/traffic-ingest BaaRai 2026-10-11 15:03:08 +02:00
• d8f47d4359 Traffic ingest: capture operator browsing via a browser extension BaaRai 2026-10-11 14:53:08 +02:00
• 95a8206cb6 Merge pull request #30 from BaaRai/bot/fix-argjson BaaRai 2026-10-10 19:19:39 +02:00
• 0e82253686 Bot: quote the response_format JSON for --argjson BaaRai 2026-10-10 19:19:34 +02:00
• 905e401676 Merge pull request #28 from BaaRai/bot/json-mode BaaRai 2026-10-10 19:16:42 +02:00
• 42f3bd98ea Bot: JSON mode for triage, temperature 0, flash model BaaRai 2026-10-10 19:16:37 +02:00
• cf68aece0a Merge pull request #26 from BaaRai/bot/restore-prompt BaaRai 2026-10-10 19:08:06 +02:00
• f420277729 Bot: restore the original LABELS instruction wording BaaRai 2026-10-10 19:08:00 +02:00
• e39734539d Merge pull request #24 from BaaRai/bot/debug-tail BaaRai 2026-10-10 19:06:04 +02:00
• d1d28cb333 Bot: log the raw reply tail for triage debugging BaaRai 2026-10-10 19:05:59 +02:00
• 631859657a Merge pull request #22 from BaaRai/bot/revert-flash BaaRai 2026-10-10 19:02:19 +02:00
• 698ec389e0 Bot: back to deepseek-chat BaaRai 2026-10-10 19:02:13 +02:00
• 919755dc2a Merge pull request #20 from BaaRai/bot/robust-labels BaaRai 2026-10-10 19:00:09 +02:00
• c08a229a57 Bot: tolerate decorated LABELS lines from smaller models BaaRai 2026-10-10 19:00:04 +02:00
• 0213310e38 Merge pull request #18 from BaaRai/bot/deepseek-flash BaaRai 2026-10-10 18:56:23 +02:00
• f95e975e31 Bot: switch the model to deepseek-flash BaaRai 2026-10-10 18:56:18 +02:00
• 765308712e Merge pull request #16 from BaaRai/bot/maintainer-labels BaaRai 2026-10-10 18:46:37 +02:00
• 7511937e82 Bot: label maintainer-opened issues, silently BaaRai 2026-10-10 18:46:31 +02:00