From de63f79f91ad8db2222f80259e33691ece3be958 Mon Sep 17 00:00:00 2001 From: niceclat Date: Fri, 29 May 2026 21:00:35 -0400 Subject: [PATCH] chore(release): bump to v0.1.4 --- CHANGELOG.md | 45 ++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index fbad99c..4b9e1e4 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,9 +6,48 @@ scheme follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] -### Added -- Dedicated `veldt-kya` repo separated from the upstream `veldt-decisions` - monorepo (open-core split). +## [0.1.4] — 2026-05-29 + +### Added — attack chains +- **ValkeyStateStore** — cross-process, cross-worker multi-step attack-chain + detection. Drops in as a `state_store=` to `AttackChainEngine` so multiple + KYA workers share partial-match state without coordination. JSON + serialization; ZSET-backed TTL expiry; fail-soft contract; full backward + compatibility with `InMemoryStateStore`. +- **Cross-agent delegation-graph-aware correlation** — `correlate_by` now + supports `correlation_id`; `correlation_id_for_invocation` walks the + `parent_invocation_id` chain (configurable max-hop) so an attack chain + can span multiple cooperating agents on the same delegated task. New + example rule: `cross_agent_data_exfiltration.yml`. +- **DAG step grammar** — rules can declare `mode: "dag"` with multi-parent + `after: [step_a, step_b]` to express AND-joins (diamond patterns, fan-in). + `within_seconds` measures from the latest predecessor. Linear rules remain + the default and behave identically to v0.1.3. New example rule: + `delegated_credential_exfil_diamond.yml`. +- **Sigma → KYA rule adapter** — `load_sigma_rule`, `load_sigma_rules_from_dir`, + `translate_sigma_to_kya_dict` translate SigmaHQ-format rules + (single-selection + AND-chain conditions, `|contains`, `|startswith`, + `|endswith`, `|re`/`|regex`, list values) into KYA `AttackChainRule`s. + MITRE technique IDs + tactic names preserved as metadata. Unsupported + constructs (OR, NOT, quantifiers, parens, keyword-only) raise + `SigmaTranslateError` with named offender so operators can split rules. + Configurable `field_prefix` (defaults to `"payload."` matching KYA's + evidence convention). + +### Added — assessment +- **Autonomous Systems Trust Assessment orchestrator** — `run_assessment` + computes a 5-pillar `AssessmentReport` (RiskScore, Provenance, Lineage, + TrustScoring, RBAC) returning structured `Finding` rows with severity, + evidence, and remediation hints. Designed for periodic governance + reporting against any agent or service-account principal. + +### Notes +- **Zero new database surface across all five features.** All new state + lives in the existing tables (kya_attack_partial_matches via the state + store, kya_evidence via the chain attach, kya_principal_trust via the + scoring update); no migrations required. +- All five features are independently optional; nothing in this release + introduces a hard runtime dependency. ## [0.1.0] — 2026-05-21