Release Changelog

New: V4 NEXUS Modules (28 total)

• 313 Temporal Binding Protocol — Nanosecond-precise SLH-DSA (FIPS 205) receipts anchored to IPFS
• Ghost-Watch CADL — 5-tier cognitive-adaptive deception layer (Monitor → Neutralize)
• WE-FORGE — NLP linguistic watermarking for lure documents
• AETHER — Synthetic traffic generator (50,000+ decoy endpoints)
• CHRONOS — Temporal snapshot reversion engine
• VALKYRIE — BGP null-route strike capability
• TARTARUS — Exfiltration trap with PQC-encrypted noise injection
• HEPHAESTUS — Supply chain binary auditor (XZ-style injection detection)
• AEGIS-LLM — Prompt sentinel for AI jailbreak prevention
• VSAT Suite — Satellite ground segment security (9-element ethical hacking)
• CEQS Engine — Quantum error correction simulator
• QE-BIM — Quantum entanglement-based integrity monitor
• AEON — Unified quantum framework
• NVL72 Telemetry — 30TB VRAM monitoring for GB200 architectures
• C-SBOM Auditor — CycloneDX 1.5 cryptographic SBOM
• Identity Controls — IDENTITY-1 through IDENTITY-8 (zero-trust, MFA, biometric)

Security Fixes

• CRQC-001 through CRQC-013: Post-quantum migration patches (12/14 complete)
• Session path traversal fix — safe_filename passed to encrypted storage
• Crypto fail-closed — no plaintext downgrade on import failure
• Plugin HMAC-SHA256 signing with cosign verification

Test Suite

2,4,107 tests passing · 0 failed · 36 skipped · POSTURE GREEN

New: V3 Modules (10 modules)

• Browser Recon — Playwright SPA fingerprinting, CSP analysis, API discovery
• Container Scanning — Dockerfile linting (12 rules), Trivy/Grype CVE scanning
• Active Directory Auditor — Kerberoasting, AS-REP roasting, delegation analysis
• SIEM Integration — Splunk HEC, Elasticsearch, Wazuh REST API
• Collaborative Sessions — Multi-user session sharing and event timeline
• Malware Sandbox — YARA pattern matching, static binary analysis
• LSTM Trainer — Behavioral sequence modeling for APT detection
• Threat Predictor — Markov-chain lateral movement prediction
• eBPF Self-Protection — Kernel-level syscall interception
• Bridge V3 — Beacon detector, C2 attribution, event rate tracking

Detection Improvements

WebShell Detector: 45 signatures, F1=1.000, 0% false positive rate across 39-sample corpus

LOLBin Detector: 15 Windows LOLBins (mshta, regsvr32, certutil, rundll32, wmic...)

ATT&CK Coverage: 51.4% (136/265 techniques)

New: V2 Modules (13 modules)

• RAG Knowledge Base — ChromaDB vector store, 5 namespaces
• Agentic Auto-Chain — 4 built-in plans with approval gates
• EPSS + KEV Scoring — FIRST.org EPSS v3, CISA KEV catalog
• ATT&CK Mapping — 70+ technique mappings, Navigator v4 JSON export
• ML Anomaly Detection — IsolationForest → ONNX → z-score fallback
• JA3/JA3S Fingerprinting — Pure-Python TLS fingerprinting
• DNS Covert Channel Detection — 6 heuristic rules, DoH detection
• Campaign Manager — Asyncio-parallel multi-target scanning
• Intelligence Graph — NetworkX MultiDiGraph, 9 node types
• Plugin Code Signing — HMAC-SHA256 + cosign/sigstore
• Threat Intelligence — FeodoTracker, URLhaus, MalwareBazaar, OTX
• Crypto Agility — 7 PQC migration snippets, 11 NIST algorithms
• Docker CVE Sandbox — 8 pre-mapped CVEs, 6 security constraints

Initial Release: 9 Core Modules

• Recon — DNS enum (7 record types), subdomain discovery, port scan, WHOIS, GeoIP, AI profiling
• Vuln — CVE/NVD, CVSS v3.1, OSV audit, AI triage
• Exploit — Advisory-only, scope-guarded, lab-mode required
• Network — Scapy PCAP, ONNX anomaly, JA3/JARM, topology mapping
• Defense — 24 CIS checks, iptables analysis, SSH hardening
• Quantum — TLS scan, NIST FIPS 203/204/205, SLH-DSA, 313-BIND
• Plugins — Sandboxed IPC, 6 hook points, HMAC-SHA256 signing
• CI/CD — 18 secret patterns, SARIF 2.1.0, GitHub Actions integration
• Docs — AI help, interactive tutorials, man page generation

Initial test suite: 404 tests passing · POSTURE GREEN