feat(update): working on next release

♬ Vectorwolf - Street Justice-V

Author: Mte90

docs/configuration.md

@@ -16,17 +16,14 @@ api_key = "${MISTRAL_API_KEY}"
 model = "mistral-small"
 
 [scanner.performance]
-enable_incremental_scan = false
 max_parallel_tasks = 4
-enable_file_filtering = true
 ```
 
 **Experimental sections** (disabled by default):
 - `[cpg]` — CPG-guided slicing (requires Joern binary)
 - `[validate]` — LLM-as-judge rationale validation
 - `[vuln_spec]` — VulTriage triple-path, policy sampling, agent scaffold
 - `[agent_scaffold]` — Agent-assisted analysis
-- `[agent_flow]` — Multi-agent harness synthesis
 - `[threat_modeling]` — STRIDE threat modeling (now under `[scanner.performance]`)
 
 Enable only after reviewing the detailed sections below.
@@ -65,11 +62,9 @@ profile = "all"
 ```toml
 [scanner.performance]
 # Skip unchanged files based on SHA256 hash comparison (hashes persisted to output dir)
-enable_incremental_scan = false
 # Maximum number of parallel tasks for scanning operations
 max_parallel_tasks = 4
 # Enable file filtering to reduce false positives
-enable_file_filtering = true
 
 # --- Semgrep configuration ---
 [scanner.semgrep]
@@ -154,25 +149,17 @@ The `[router]` section configures the Mixture-of-Experts routing for per-CWE and
 ```toml
 [router]
 enabled = false
-default_prompt = "llm_static_analysis"
 
-# CWE-specific prompt/model overrides
+# CWE-specific model overrides
 [router.cwe_overrides]
-"CWE-79" = { prompt_template = "xss_analysis", model_override = "mistral-small" }
-"CWE-89" = { prompt_template = "sqli_analysis", model_override = "qwen35" }
-
-# Language-specific prompt/model overrides
-[router.language_overrides]
-"php" = { prompt_template = "php_security", model_override = null }
-"python" = { prompt_template = "python_security", model_override = null }
+"CWE-79" = { model_override = "mistral-small" }
+"CWE-89" = { model_override = "qwen35" }
 ```
 
 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
 | `enabled` | bool | `false` | Enable MoE routing |
-| `default_prompt` | str | `"llm_static_analysis"` | Default prompt template name |
-| `cwe_overrides` | map | `{}` | CWE ID → PromptSpec overrides |
-| `language_overrides` | map | `{}` | Language → PromptSpec overrides |
+| `cwe_overrides` | map | `{}` | CWE ID → model override for that CWE's domain |
 
 ## LLM Configuration
 
@@ -356,7 +343,7 @@ Prompts are validated (max 10,000 characters, no null bytes) before use.
 [[tickets.systems]]
 system_type = "github"
 url = "https://api.github.com"
-credentials.token = "${GITHUB_TOKEN}"
+api_key = "${GITHUB_TOKEN}"
 ```
 
 ## Output Configuration
@@ -493,15 +480,11 @@ before the vulnerability judgement.
 | Field          | Type | Default | Description                          |
 |----------------|------|---------|--------------------------------------|
 | `enabled`      | bool | false   | Enable triple-path augmentation      |
-| `control_path` | bool | true    | Include AST/CFG/DFG verbalisation    |
-| `knowledge_path`| bool | true    | Include CWE pattern RAG              |
 | `semantic_path`| bool | true    | Include function summary             |
 
 ```toml
 [vultriage]
 enabled = false
-control_path = true
-knowledge_path = true
 semantic_path = true
 ```
 
@@ -678,24 +661,6 @@ enable_hunt_prompts = false
 
 Available modules: `injection.md`, `auth.md`, `authz_absence.md`, `xss.md`, `path_traversal.md`, `crypto.md`, `resource.md`, `deserialization.md`, `memory_safety.md`.
 
-### AgentFlow Multi-Agent Harness Synthesis (P5) — arXiv:2605.11835
-
-Represents the harness as a typed graph DSL with a search loop. Most invasive
-integration — static harness only until P5.5.
-
-| Field                      | Type | Default | Description                    |
-|----------------------------|------|---------|--------------------------------|
-| `enabled`                  | bool | false   | Enable AgentFlow harness       |
-| `max_iterations`           | int  | 10      | Max synthesis iterations       |
-| `requires_instrumented_target`| bool | false | Require instrumented target   |
-
-```toml
-[agent_flow]
-enabled = false
-max_iterations = 10
-requires_instrumented_target = false
-```
-
 ### Exploit Synthesis (T3.2)
 
 Automated exploit generation to verify findings. Runs in sandboxed Docker containers.
@@ -705,14 +670,12 @@ Automated exploit generation to verify findings. Runs in sandboxed Docker contai
 | `enabled`                    | bool | false   | Enable exploit synthesis       |
 | `sandbox_image`              | str  | "python:3.11-slim" | Docker image for sandbox |
 | `timeout_secs`               | int  | 30      | Timeout for exploit execution  |
-| `max_exploits_per_finding`   | int  | 1       | Max attempts per finding       |
 
 ```toml
 [exploit]
 enabled = false
 sandbox_image = "python:3.11-slim"
 timeout_secs = 30
-max_exploits_per_finding = 1
 ```
 
 ### Confidence Normalization
@@ -788,7 +751,6 @@ rules:
 ''']
 
 [scanner.performance]
-enable_incremental_scan = true
 enable_root_cause_dedup = true
 enable_variant_search = true
 
@@ -834,9 +796,6 @@ registrations = [
     '''(?si)register_rest_route\s*\([^;]*?[\x27\x22]callback[\x27\x22]\s*=>\s*''',
 ]
 
-[agent_flow]
-enabled = false
-
 [agent]
 enabled = false
 max_turns = 10
@@ -865,7 +824,7 @@ baco scan --config my.toml --preset my-project
 | `triage`     | `enabled`, `model`, `batch_size`, `suspicion_threshold`                   |
 | `priority`   | `enabled`, `git_recent_boost`, `entry_point_boost`, `small_file_boost`    |
 | `budget`     | `enabled`, `max_llm_calls`, `reserve_percent_for_high_risk`               |
-| `agent_flow` | `enabled`, `max_iterations`, `requires_instrumented_target`                |
+| `agent_flow` | `enabled`, `max_iterations`                                                |
 | `agent`      | `enabled`, `max_turns`, `tool_timeout_secs`               |
 | `knowledge`  | `fp_patterns` (map of CWE → list of false-positive indicator strings), `required_security_primitives` (map of language → list of required primitives), `hook_registry` (map of language → HookRegistryLanguageConfig with `hook_label`, `registrations` regexes with optional `(?P<hook>)` capture, `handler_patterns` override) |
 

docs/operator-tuning.md

@@ -8,7 +8,6 @@ Performance tuning for the Baco SAST scanner. Adjust settings based on scan spee
 
 ```toml
 [scanner.performance]
-enable_incremental_scan = true
 max_parallel_tasks = 2
 enable_threat_modeling = false
 enable_confidence_refinement = false
@@ -28,7 +27,6 @@ exclude_paths = ["tests/", "docs/", "target/", "vendor/"]
 
 ```toml
 [scanner.performance]
-enable_incremental_scan = false
 max_parallel_tasks = 8
 enable_threat_modeling = true
 enable_root_cause_dedup = true
@@ -48,7 +46,6 @@ timeout_secs = 120
 
 ```toml
 [scanner.performance]
-enable_incremental_scan = true
 max_parallel_tasks = 2
 enable_confidence_refinement = false
 enable_variant_search = false
@@ -64,9 +61,7 @@ max_concurrent = 2
 
 | Flag | Type | Default | Effect |
 |------|------|---------|--------|
-| `enable_incremental_scan` | bool | false | Skips unchanged files via SHA256 hash comparison |
 | `max_parallel_tasks` | int | 4 | Max concurrent scan tasks |
-| `enable_file_filtering` | bool | true | Filters low-value files (minified, vendor) |
 | `enable_threat_modeling` | bool | false | STRIDE-based threat analysis |
 | `enable_root_cause_dedup` | bool | true | Collapses findings with same root cause |
 | `enable_auto_patching` | bool | false | Generates fix patches — opt-in |
@@ -120,13 +115,3 @@ early_termination_threshold = 500.0
 
 Scan stops after N medium+ findings. Useful for very large codebases. When triggered, an `early_termination` section is recorded in the JSON report.
 
-### Agent Flow Gate
-
-Multi-agent harness synthesis (opt-in, default OFF). Enable only after understanding the requirements:
-
-```toml
-[agent_flow]
-enabled = false
-max_iterations = 10
-requires_instrumented_target = false
-```

docs/troubleshooting.md

@@ -19,14 +19,6 @@ Common issues and solutions for the Baco SAST scanner.
 | CPG slicing phase shows "skipped" | Joern dependency missing | Install Joern binary (see above) or skip CPG analysis |
 | Scan takes unusually long | Large codebase, no caching | Enable `enable_llm_cache = true` to avoid duplicate API calls |
 
-## Incremental Scan Surprises
-
-| Symptom | Cause | Fix |
-|---------|-------|-----|
-| Files skipped during incremental scan | Stale hash store | Delete output directory to force full rescan: `rm -rf <output-dir>/` |
-| Changed files not re-analyzed | Hash mismatch in checkpoint.json | Remove checkpoint.json and file_hashes.json, then rescan |
-| Incremental scan slower than full scan | Hash validation overhead | Accept overhead or force full scan by clearing output dir |
-
 ## Report/Output Issues
 
 | Symptom | Cause | Fix |

presets/cpp.toml

@@ -106,14 +106,7 @@ reserve_percent_for_high_risk = 20
 
 [knowledge.required_security_primitives]
 "cpp" = ["bounds check", "size validation", "std::string", "at()", "length()"]
-
-[agent_flow]
-enabled = false
-max_iterations = 10
-requires_instrumented_target = false
-
 [agent]
 enabled = false
 max_turns = 15
 tool_timeout_secs = 300
-trusted_paths = []

presets/django.toml

@@ -86,7 +86,6 @@ rules:
 ''']
 
 [scanner.performance]
-enable_incremental_scan = true
 enable_variant_search = true
 enable_cve_bootstrap = true
 
@@ -191,11 +190,5 @@ registrations = [
 handler_patterns = [
   '''^[ \t]*([a-zA-Z_][a-zA-Z0-9_.]*)''',
 ]
-
-[agent_flow]
-enabled = false
-requires_instrumented_target = false
-
 [agent]
 enabled = false
-trusted_paths = []

presets/laravel.toml

@@ -97,7 +97,6 @@ rules:
 ''']
 
 [scanner.performance]
-enable_incremental_scan = true
 enable_variant_search = true
 enable_cve_bootstrap = true
 
@@ -206,11 +205,5 @@ handler_patterns = [
   '''^[ \t]*\[\s*[a-zA-Z_\x5c][a-zA-Z0-9_\x5c]*::class\s*,\s*[\x27\x22]([a-zA-Z_][a-zA-Z0-9_]*)[\x27\x22]\s*\]''',
   '''^[ \t]*[\x27\x22]([a-zA-Z_\x5c][a-zA-Z0-9_\x5c]*@[a-zA-Z_][a-zA-Z0-9_]*)[\x27\x22]''',
 ]
-
-[agent_flow]
-enabled = false
-requires_instrumented_target = false
-
 [agent]
 enabled = false
-trusted_paths = []

presets/litellm.toml

@@ -24,7 +24,6 @@ exclude_paths = [
 rulesets = ["p/python", "p/bandit", "p/flask", "p/security"]
 
 [scanner.performance]
-enable_incremental_scan = true
 enable_root_cause_dedup = true
 enable_variant_search = true
 enable_cve_bootstrap = true
@@ -103,11 +102,5 @@ max_llm_calls = 800
 ]
 "CWE-79" = ["JSONResponse", "orjson.dumps", "HTTPException"]
 "CWE-611" = ["defusedxml", "xml.etree.ElementTree.fromstring"]
-
-[agent_flow]
-enabled = false
-requires_instrumented_target = false
-
 [agent]
 enabled = false
-trusted_paths = []

presets/oss-monorepo.toml

@@ -39,7 +39,6 @@ exclude_paths = [
 ]
 
 [scanner.performance]
-enable_incremental_scan = true
 
 [llm]
 enable_llm_cache = true
@@ -101,11 +100,5 @@ sink_patterns = [
 [budget]
 enabled = true
 max_llm_calls = 1000
-
-[agent_flow]
-enabled = false
-requires_instrumented_target = false
-
 [agent]
 enabled = false
-trusted_paths = []

presets/oss-python.toml

@@ -42,7 +42,6 @@ exclude_paths = [
 rulesets = ["p/python", "p/bandit", "p/security"]
 
 [scanner.performance]
-enable_incremental_scan = true
 
 [llm]
 enable_llm_cache = true
@@ -94,11 +93,5 @@ sink_patterns = [
 [budget]
 enabled = true
 max_llm_calls = 1000
-
-[agent_flow]
-enabled = false
-requires_instrumented_target = false
-
 [agent]
 enabled = false
-trusted_paths = []

presets/wordpress-core.toml

@@ -104,7 +104,6 @@ rules:
 ''']
 
 [scanner.performance]
-enable_incremental_scan = true
 enable_root_cause_dedup = true
 enable_variant_search = true
 enable_cve_bootstrap = true
@@ -216,11 +215,5 @@ registrations = [
     '''(?si)add_action\s*\(\s*[\x27\x22](?P<hook>(?:wp_ajax|wp_ajax_nopriv|admin_post|admin_post_nopriv)[^\x27\x22]*)[\x27\x22]\s*,\s*''',
     '''(?si)register_rest_route\s*\([^;]*?[\x27\x22]callback[\x27\x22]\s*=>\s*''',
 ]
-
-[agent_flow]
-enabled = false
-requires_instrumented_target = false
-
 [agent]
 enabled = false
-trusted_paths = []