feat(update): working on next release

♬ Dana Jean Phoenix & Powernerd - Figure Me Out (New Arcades Remix)

Author: Mte90

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 - VulnInstruct specification-guided vulnerability detection (`src/vuln_spec` module: schema, extractor, BM25+vector retriever) behind `[vuln_spec] enabled = false` default
+- `baco report --config <PATH>` to load evidence-gate config for standalone reports
 
 ### Changed
 - Threat-modeling phase disabled by default (`enable_threat_modeling = false`) — it generated a static STRIDE template rather than code-derived analysis

Cargo.toml

@@ -12,6 +12,14 @@ keywords = ["security", "vulnerability", "scanner", "sast", "llm"]
 categories = ["command-line-utilities", "development-tools"]
 rust-version = "1.85"
 
+
+exclude = [
+  "baco-output/**",
+  "core*",
+  "*.profraw",
+  "lcov.info",
+]
+
 [dependencies]
 # Async trait support
 async-trait = "0.1"
@@ -71,6 +79,7 @@ dirs = "5"
 thiserror = "1.0"
 tempfile = "3"
 regex = "1"
+libc = "0.2"
 
 # Tree-sitter for AST parsing
 tree-sitter = "0.26"

README.md

@@ -8,15 +8,15 @@ Grounded in 36 surveyed papers (16 integrated) from [Awesome-LLMs-for-Vulnerabil
 [![CI](https://github.com/CodeAtCode/baco-scanner/actions/workflows/ci.yml/badge.svg)](https://github.com/CodeAtCode/baco-scanner/actions/workflows/ci.yml)
 [![Coverage](https://codecov.io/gh/CodeAtCode/baco-scanner/branch/master/graph/badge.svg)](https://app.codecov.io/gh/CodeAtCode/baco-scanner)
 [![License: GPL v3](https://img.shields.io/badge/License-GPLv3-blue.svg)](https://www.gnu.org/licenses/gpl-3.0)
-[![Rust](https://img.shields.io/badge/rust-1.74+-orange.svg)](https://www.rust-lang.org)
+[![Rust](https://img.shields.io/badge/rust-1.85+-orange.svg)](https://www.rust-lang.org)
 
 [![Example Report](docs/example-report-screenshot.png)](example-report.html)
 
 ---
 
 ## Prerequisites
 
-- **Rust** 1.74+ (`rustup`)
+- **Rust** 1.85+ (`rustup`)
 - **An LLM API key** (Mistral, OpenAI, or any OpenAI-compatible endpoint)
 - **Semgrep** installed on PATH (`pip install semgrep` or [see install options](https://semgrep.dev/docs/getting-started/))
 
@@ -41,7 +41,7 @@ export LLM_DISCOVERY_KEY="your-key-here"  # or LLM_API_KEY for generic fallback
 ./target/release/baco doctor
 
 # 5. Scan
-./target/release/baco scan --config config.toml
+./target/release/baco scan --config /path/to/project/baco.toml
 ```
 
 ### Additional subcommands
@@ -54,7 +54,8 @@ export LLM_DISCOVERY_KEY="your-key-here"  # or LLM_API_KEY for generic fallback
 ./target/release/baco eval --target /path/to/fixtures --ground-truth eval/oracles/target.json
 
 # Generate report
-./target/release/baco report --input findings.json --format html
+# Use --config only when the evidence gate must apply to a standalone report
+./target/release/baco report --input findings.json --format html --config config.toml
 
 # Verify findings
 ./target/release/baco verify --input findings.json
@@ -72,6 +73,8 @@ export LLM_DISCOVERY_KEY="your-key-here"  # or LLM_API_KEY for generic fallback
 ./target/release/baco scan --config my.toml --dry-run   # Print estimate and exit
 ./target/release/baco scan --config my.toml --target /path  # Override target path
 ./target/release/baco scan --config my.toml --force     # Force full rescan
+./target/release/baco scan --config my.toml --diff main...HEAD  # Limit report to files changed in git revspec
+./target/release/baco scan --config my.toml -q          # Suppress non-essential output (global flag)
 ```
 
 - **Phases**: 4 parallel (Indexing, Semgrep, CpgSlice, LlmStaticAnalysis) + 19 sequential phases — some disabled by default (see [Configuration](docs/configuration.md))
@@ -81,13 +84,13 @@ export LLM_DISCOVERY_KEY="your-key-here"  # or LLM_API_KEY for generic fallback
 ## Features
 
 - **Pipeline profiles**: `core` (default) runs essential phases; `all` enables experimental phases (still individually flag-gated) — set with `scanner.profile = "core" | "all"`
-- **Pipeline phases**: Indexing → Semgrep → CpgSlice (`[cpg]` section, requires Joern) → LlmStaticAnalysis → CweRouting (`router.enabled`) → RuleSynthesis (experimental) → LlmDiscovery → LlmVerification → Validate (opt-in) → SecurityAgentVerification (opt-in) → TicketCrossRef → GitAnalysis → CrossFileAnalysis → ConfidenceScoring → AiAggregation → ThreatModeling (`enable_threat_modeling`) → RootCauseDedup → MultiVerifier (`enable_multi_verifier`, experimental) → AutoPatching (`enable_auto_patching`, opt-in) → CveBootstrap → PocCompiler (`enable_poc_compilation`, opt-in) → ExploitSynth (`[exploit]` section, experimental) → VariantSearch → Reporting
+- **Pipeline phases**: Indexing → Semgrep → CpgSlice (`[cpg]` section, requires Joern) → LlmStaticAnalysis → CweRouting (`router.enabled`) → RuleSynthesis (experimental) → LlmDiscovery → LlmVerification → Validate (opt-in) → SecurityAgentVerification (opt-in) → TicketCrossRef → GitAnalysis → CrossFileAnalysis → ConfidenceScoring → AiAggregation → ThreatModeling (`enable_threat_modeling`) → RootCauseDedup → AutoPatching (`enable_auto_patching`, opt-in) → CveBootstrap → PocCompiler (`enable_poc_compilation`, opt-in) → ExploitSynth (`[exploit]` section, experimental) → VariantSearch → Reporting
 - **Parallel execution**: Indexing, Semgrep, CpgSlice, and LlmStaticAnalysis run concurrently; 19 sequential phases follow
 - **CWE-aware MoE (opt-in)**: BM25 RAG retrieval from CWE knowledge base, routes to specialized analysis paths — enable with `router.enabled = true`
 - **Research-backed**: 16 academic papers integrated (VulTriage, VulIn, MoCQ, MoEVD, AgentFlow) — see [Research Integration](docs/research-integration.md)
 - **Checkpoint/resume**: Crash recovery after each phase
 - **Pre-flight checks**: `baco doctor` validates config, presets, LLM phases, semgrep, python3, Joern (if CPG enabled), output dir, and disk space
-- **Multiple outputs**: JSON, HTML, SARIF
+- **Multiple outputs**: JSON, HTML, SARIF, Markdown
 - **Config-driven**: TOML config with env var overrides
 - **Ticket systems**: Configurable via `[[tickets.systems]]` TOML blocks (supports any system type via `system_type` field) — see [Configuration](docs/configuration.md) for setup
 
@@ -149,6 +152,7 @@ export LLM_DISCOVERY_KEY="your-key-here"  # or LLM_API_KEY for generic fallback
 - `findings.json` — complete vulnerability data (all fields, machine-readable)
 - `report.html` — interactive report with severity filtering, code highlighting, confidence/CWE badges
 - `report.sarif` — SARIF 2.1 for CI/CD integration (GitHub Code Scanning, Azure DevOps)
+- `findings.md` — Markdown summary of findings (written alongside JSON)
 
 ## Architecture
 
@@ -169,6 +173,9 @@ See [Research Integration](docs/research-integration.md) for per-paper details (
 - [Operator Tuning](docs/operator-tuning.md) — Performance flags and scenario-based tuning
 - [Output Interpretation](docs/output-interpretation.md) — Reading findings, confidence, triage verdicts
 - [Troubleshooting](docs/troubleshooting.md) — Common errors and fixes
+- [Argus Analysis](docs/argus-analysis.md) — Evidence verification techniques
+- [CI Integration](docs/ci-integration.md) — Continuous integration setup
+- [Cloudflare Security Audit Skill Analysis](docs/cloudflare-security-audit-skill-analysis.md) — Domain-routed hunt prompts
 
 
 ### Reading Order

docs/README.md

@@ -10,7 +10,7 @@ Documentation for baco — a 23-phase LLM-assisted code scanner.
 |------|-------------|
 | [architecture.md](architecture.md) | The 23-phase pipeline, PhaseGraph, data flow |
 | [configuration.md](configuration.md) | All config options, LLM setup, phase flags |
-| [research-integration.md](research-integration.md) | The 31 papers integrated into baco |
+| [research-integration.md](research-integration.md) | Research-backed design and paper integrations |
 | [ci-integration.md](ci-integration.md) | CI/CD setup with SARIF output |
 | [llm-vuln-detection-papers-survey.md](llm-vuln-detection-papers-survey.md) | Full survey of 36 papers |
 | [example-report-screenshot.png](example-report-screenshot.png) | Sample HTML report preview |

docs/architecture.md

@@ -30,7 +30,7 @@ BACO uses a **data-driven PhaseGraph** (`src/scanner/pipeline/orchestrator.rs`)
 | 11 | Ticket Cross-Reference | `tickets.systems` non-empty |
 | 12 | Git Analysis | Target is a git repository |
 | 13 | Cross-File Analysis | Always-on |
-| 14 | Confidence Scoring | `normalization.enabled=false` |
+| 14 | Confidence Scoring | `scanner.performance.enable_confidence_refinement=false` |
 | 15 | AI Aggregation | `llm.phases.aggregation` (API key present) |
 | 16 | Threat Modeling | `scanner.performance.enable_threat_modeling=false` |
 | 17 | Root Cause Deduplication | `scanner.performance.enable_root_cause_dedup=true` |
@@ -67,7 +67,7 @@ flowchart LR
 
     subgraph PostProcessing["Post-Processing"]
         direction TB
-        E1[Root Cause Dedup] --> E2[Multi-Verifier] --> E3[Auto-Patch] --> E4[CVE Bootstrap] --> E5[PoC Compiler] --> E6[Variant Search]
+        E1[Root Cause Dedup] --> E2[Auto-Patch] --> E3[CVE Bootstrap] --> E4[PoC Compiler] --> E5[Variant Search]
     end
 
     subgraph Output["Output"]
@@ -79,7 +79,7 @@ flowchart LR
     B3 --> C1
     C5 --> D1
     D2 --> E1
-    E6 --> F1
+    E5 --> F1
 
     classDef parallel fill:#e1f5fe
     classDef discovery fill:#fff3e0
@@ -100,7 +100,7 @@ The pipeline includes several verification gates and calibration layers that aug
 
 Before rendering the final report, deterministic checks verify that all citations (file paths + line ranges) match the scanned source tree. Findings failing this check have their confidence score halved and a note added explaining the discrepancy.
 
-Configured via `[citation_verification] enabled = true`.
+Configured via `[citation_verification] enabled = false` (disabled by default).
 
 ### Prior-Runs Store (Discovery Phase)
 
@@ -132,5 +132,5 @@ When the Docker sandbox is unavailable, unverifiable findings are marked with `r
 
 ### Eval Harness (External)
 
-Known-answer oracle scoring under `eval/` with labeled vulnerable/secure fixture pairs and oracle files. Recall/precision scoring via `src/eval.rs`; end-to-end runs require `BACO_EVAL=1` + LLM key. See [`eval/README.md`](../eval/README.md).
+Known-answer oracle scoring under `eval/` with labeled vulnerable/secure fixture pairs and oracle files. Recall/precision scoring via `src/eval.rs`; end-to-end runs use `BACO_EVAL_FLOOR` env var. See [`eval/README.md`](../eval/README.md).
 

docs/argus-analysis.md

@@ -1,9 +1,7 @@
 # Research: argusappsec/argus → baco adoption analysis
 
 Source: https://github.com/argusappsec/argus (Go daemon, Apache-2.0, pre-1.0,
-24 ADRs + design docs). Analyzed 2026-09-01. Companion analysis:
-docs/cloudflare-security-audit-skill-analysis.md (5 items from that report
-already implemented in commit 61e2c80 — not repeated here).
+24 ADRs + design docs). Analyzed 2026-09-01.
 
 ## Summary
 

docs/ci-integration.md

@@ -1,6 +1,6 @@
 # CI Integration Guide
 
-BACO outputs SARIF 2.1 format (`report.sarif`), which GitHub Code Scanning, Azure DevOps, and other CI tools can ingest to display findings as PR annotations and security alerts.
+A scan writes `findings.json`, `findings.md` and `report.html` to the output directory. SARIF 2.1 is produced separately, with `baco report --format sarif`, and that file (`report.sarif`) is what GitHub Code Scanning, Azure DevOps and other CI tools ingest to display findings as PR annotations and security alerts.
 
 ## GitHub Actions Setup
 
@@ -32,16 +32,21 @@ jobs:
 
       - name: Run BACO Scan
         env:
-          MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}
+          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
         run: ./target/release/baco scan --config baco.toml
 
+      - name: Generate SARIF
+        run: ./target/release/baco report --input baco-output/findings.json --format sarif --config baco.toml
+
       - name: Upload SARIF to GitHub Code Scanning
         uses: github/codeql-action/upload-sarif@v3
         with:
           sarif_file: baco-output/report.sarif
 ```
 
-**Required:** Set `MISTRAL_API_KEY` (or your LLM provider key) as a GitHub repository secret.
+**Required:** Set `LLM_API_KEY` as a GitHub repository secret. Without it the LLM phases are skipped and the scan falls back to the non-LLM phases only.
+
+**Note on `baco report --config`:** The `baco report` command accepts a `--config` flag to apply the evidence gate to report output. Without `--config`, the evidence gate is not applied to `baco report` output.
 
 ## Configuration