diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 6a9b15a7..89fe832e 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -27,7 +27,7 @@ jobs:
git config user.email 41898282+github-actions[bot]@users.noreply.github.com
- name: Set up Python
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+ uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #
with:
python-version: "3.x"
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index d7d8ab5a..e80e1e55 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -26,7 +26,7 @@ jobs:
persist-credentials: false
- name: Set up Python ${{ matrix.python-version }}
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+ uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #
with:
python-version: ${{ matrix.python-version }}
diff --git a/README.md b/README.md
index 7a101c83..1333528d 100644
--- a/README.md
+++ b/README.md
@@ -1,131 +1,173 @@
-# GitGalaxy
+
+
+# GitGalaxy
+
+[Docs](https://squid-protocol.github.io/gitgalaxy/) · [Visualizer](https://gitgalaxy.io/)
[](https://badge.fury.io/py/gitgalaxy)
-[](https://www.python.org/downloads/)
+[](https://www.python.org/downloads/)
[](https://polyformproject.org/licenses/noncommercial/1.0.0/)
-
-[](#)
-[](#)
+[](#)
[](#)
-[](#)
[](#)
-[](#)
[](https://pypi.org/project/gitgalaxy/)
[](#)
-[](https://pepy.tech/project/gitgalaxy)
-### **Whole-Repository Understanding & DevSecOps Topology**
+
+
+
+
+**1 scan** · **97 structural signals** · **50+ languages** · **0 need for compilation**
+**19 risk exposure scores** · **6 final reports** · **0 dependencies** · `pip install gitgalaxy`
+
+
+
+
+
+Gitgalaxy can assess full repos, comprised of mixes of 50+ different languages and map out the architecture, provide risk exposures and actionable fixes to lower those exposures. The graph below is a workflow from one gitgalaxy scan from on our golden test repo, which contains sample code files from the Apollo-11 1969 flight software through the modern tech stacks. [Benchmark](https://github.com/squid-protocol/language-crucible)
+
+
+
+
+### **Whole-Repository Intelligence with a Unique Security Layer **
+
+Gitgalaxy is a tool to determistically audit code, fast enough for the CI pipeline. Most code intelligence engines use an AST, like tree-sitter, which is offers an overly granular view of a repos (like asking to understand a house and getting a list of every brick and glass pane) and it limits the languages and files that can be scanned. Modern repos are poly-lingual. Many repos have old code without a good AST. To bypass this, Gitgalaxy uses a custom regex/lexical structural-analysis engine with a statistics layer on top — it builds a feature vector per file (from ~97 regex "signal" categories - that mark the boundaries of functions, control flow, I/O, state mutation, and dozens of other structural and security-relevant behaviors) and per repo (dependency graph via import resolution + PageRank/centrality), then transforms those raw counts into normalized 0–100 risk scores via sigmoid functions, and exports the result to six formats.
+
+Gitgalaxy trades AST-level precision for orders-of-magnitude speed and universal language coverage, in the same spirit that [BLAST traded Smith-Waterman's](https://squid-protocol.github.io/gitgalaxy/03-01-claim-1-search-strategies/) exhaustive alignment for heuristic speed in genomics. Output includes SARIF, CycloneDX SBOM, a queryable SQLite knowledge graph, an LLM-optimized architecture brief, and 3D visualization data from a single scan pass that takes seconds.
+
+The result is a deterministic knowledge graph of the repository, built without ever requiring the code to compile. It calculates the ratio of test code to core logic, maps each file's downstream "blast radius" through the dependency graph, and surfaces project-structure signal that line-by-line linters miss entirely. Per-file signal extraction runs in time linear to codebase size; repository-level graph metrics (centrality, community detection) use standard network-analysis algorithms with explicit sampling bounds on very large graphs.
+
+Our unique engine allows for the unique ways to scan for several CWEs families without the need for CVE lists, which is a unique edge for our code intelligence engine.
+
+
-Most tools analyze code line-by-line. GitGalaxy maps the entire architectural ecosystem. By tracking the exact flow of information across network dependencies, identifying local folder constraints, and natively recognizing 50+ languages—even mid-file—GitGalaxy provides a deterministic, macro-level view of your software's structural architecture.
+
### Scanning Apollo-11 with the blAST Engine
-**Why we built a custom parsing engine:**
-Standard Abstract Syntax Trees (ASTs) are excellent for finding syntax errors, but they require fully compilable code and struggle to map massive-scale information flow efficiently. LLMs suffer from context window saturation and yield probabilistic, fluctuating answers.
+
-The **blAST (Bypassing LLMs and ASTs) engine** solves this by adopting the search philosophy of computational biology. Just as genomic BLAST sequencing scans billions of DNA base pairs to identify protein domains without "executing" the organism, GitGalaxy blAST sequences raw source code to identify **Structural Signatures**.
+
-Instead of mapping gene starts and genetic mutations, the engine deterministically sequences coding intent, execution boundaries, and architectural risk exposures. This enables the engine to build a deterministic 3D knowledge graph of your entire repository in linear O(N) time without ever requiring the code to compile. It instantly calculates the ratio of test boundaries to core logic, maps network blast radiuses, and extracts the vital project structure data that rigid linters ignore.
+## What GitGalaxy Finds — and What It Doesn't Claim
-*(Note: Raw structural signatures are simply data points. True risk exposures in GitGalaxy are calculated metrics derived from these structural alignments combined with topological network gravity).*
+GitGalaxy produces two different kinds of output, and they should be read differently.
-Think of GitGalaxy as a highly calibrated macro-analyzer for codebase risk. Every assumption the system makes is abstracted into over 300 tunable variables. You can query active API nodes, isolate supply chain threats, or highlight functions exhibiting extreme cognitive load—all adjusted via custom thresholds to eliminate false-positive fatigue. Field-tested on over 1,000 repositories, the engine comes equipped with enterprise-grade defaults ready for immediate CI/CD deployment.
+**Risk Exposure scores** are a 0–100, density-normalized signal across 19 categories
+(secrets, injection surface, memory corruption, and more), rolled up from function to
+file to folder to repository. A high score means *this deserves attention first* — it
+is a prioritization signal, not a verdict. Two files can carry the same score for
+completely different reasons: a real problem, or a legitimate pattern that looks
+identical on the surface. Encrypted malware and a well-tested cryptography routine
+both produce high entropy. GitGalaxy can't tell you which one it found — only that
+something worth a second look is there.
-**Core Repository Mapping Technology**
-* **Heuristic Structural Alignment:** Bypasses LLMs and rigid ASTs. Sequences code in raw text without requiring it to compile.
-* **Deterministic Sequencing:** Maps code using 60+ bounded structural signatures (I/O intents, state mutations, execution wrappers) exactly like sequencing genetic markers.
-* **Taxonomical Classification:** These structural profiles allow us to classify functions, files, classes, and entire repositories into distinct architectural archetypes.
-* **Topological Cartography:** Produces full network mapping via imports and dynamic execution markers.
-* **Zero-Hallucination:** Eliminates LLM architectural hallucinations and context window limits by relying strictly on mathematical constraints.
-* **Polyglot Sequencing:** Scans 50+ languages, 250+ extensions, fully folder-aware. **([How to add a language in 1 minute and 1 prompt](https://github.com/squid-protocol/gitgalaxy/blob/main/gitgalaxy/standards/how_to_add_a_language.md))**
+**Findings** are individual, line-level flags: a specific Structural Signature that
+crossed a risk threshold. These are evidence to review, not confirmed vulnerabilities.
+GitGalaxy never executes code, traces runtime dataflow, or verifies exploitability —
+it tells you a pattern exists in the text, at this exact line, and hands you the
+context to judge it yourself.
-**Enterprise Scale & Performance Metrics**
-* **Active Pipeline Integration:** Over 11,000 PyPI downloads, driven heavily by automated CI/CD security sweeps and zero-trust DevSecOps workflows.
-* **Production Tested:** Backed by an active early-adopter community on GitHub driving real-world issue resolution, architectural forks, and continuous engine hardening.
-* 100,000 LOC/sec code analysis.
-* 0.07 GB/sec raw log ingestion.
-* Full-system scans in minutes without data sampling.
-* 100% daily system coverage.
+**This is intentional, not a limitation we're hiding.** GitGalaxy is built to err
+toward recall over precision: flag more, and let a human or a deeper tool narrow the
+list, rather than risk staying silent on something real. False positives are the
+expected cost of that trade-off, the same way they are for every static analyzer that
+doesn't execute the code it reads.
-**Methodology & Comparative Benchmarks**
-GitGalaxy is backed by an academic-grade thesis detailing the equations powering the blAST engine.
+That also means GitGalaxy is strongest against a specific class of problem —
+**negligence, not adversarial evasion.** A hardcoded key someone forgot to remove, an
+insecure registry, an obviously dangerous `eval()` call — nobody on the other end of
+those is trying to hide from a scanner. A specifically motivated attacker who knows
+how static, signature-based detection works can evade individual signals like entropy
+thresholds without much effort. Treat GitGalaxy as the fast first pass across a
+codebase too large to read by hand — not the last word on whether something is safe.
-* **[Optimum Search Strategies Evolve](https://squid-protocol.github.io/gitgalaxy/03-01-claim-1-search-strategies/):** AST-free mapping. Outperforms rigid parsers and LLM context windows.
-* **[Languages are getting easier to regex for meaning and intent](https://squid-protocol.github.io/gitgalaxy/03-02-claim-2-explicitness/):** Quantifies linguistic opacity. Assigns mathematical "trust dampeners" to implicit languages.
-* **[All languages have keywords that roughly do the same thing, these can be grouped to make cross-language keyword maps](https://squid-protocol.github.io/gitgalaxy/03-03-claim-3-taxonomy-map/):** Standardizes 50+ languages into a single universal physical framework.
-* **[Cross-Language Comparisons of over 1000 repos](https://squid-protocol.github.io/gitgalaxy/03-04-claim-4-comparing-languages/):** Deterministic 1:1 benchmarking of distinct syntax architectures.
-* **[Universal File Archetypes by k-means clustering](https://squid-protocol.github.io/gitgalaxy/03-05-claim-5-file-archetypes/):** ML isolation of files into K-means clusters.
-* **[Mainframe Proven: 100% CI/CD Translation Success Rate](https://github.com/squid-protocol/gitgalaxy/tree/main/examples/ibm_cics_translation):** Flawless architectural translation of 27 distinct legacy COBOL repositories (including IBM CICS benchmark apps) into compiling Java Spring Boot environments.
+
-**Data Privacy & On-Premise Deployment**
-* 100% air-gapped execution.
-* On-premise deployment with zero IP exfiltration risk.
-* Zero-trust processing model.
+### Weakness Classes, Not Just Known CVEs
-**Installation & Usage**
-* Python-based: `pip install gitgalaxy`
-* CLI execution
-* CI/CD Integration: Native **[GitHub Action](https://github.com/squid-protocol/gitgalaxy/blob/main/github-action-readme.md)** available for zero-trust DevSecOps pipelines.
-* Outputs forensic JSONs (optimized for AI-agent summary reports) and a native SQLite3 database for robust querying and storage.
+Most dependency scanners work from a lookup table: they know a vulnerability exists
+because someone found it, filed it, and it now has a CVE number in a feed. That's
+useful, but it's necessarily reactive — a scanner built this way is blind to anything
+that hasn't been discovered and disclosed yet, including straightforward variants of
+known-bad patterns that just look slightly different from the filed instance.
-> **📖 Official Documentation:** Read the full technical specifications, architecture blueprints, and the Taxonomical Equivalence Map at **[squid-protocol.github.io/gitgalaxy](https://squid-protocol.github.io/gitgalaxy/)**.
+GitGalaxy takes a different approach: instead of matching known instances, it matches
+weakness *classes*. Its findings are tagged by CWE (Common Weakness Enumeration) —
+hardcoded credentials, dynamic code execution, unsafe deserialization — not by CVE ID.
+A structural signature for "dynamic execution of tainted input" catches that pattern
+wherever it appears, with whatever variable names, in whatever specific arrangement —
+not just the one instance someone already filed a report about.
----
+The same philosophy extends to the SBOM layer. Rather than asking "does this package
+version appear in a vulnerability database," GitGalaxy's zero-trust physical audit
+asks "does this package's actual content on disk structurally match what a legitimate
+version should look like" — entropy, structural fingerprint, behavioral anomaly flags.
+That's how a tampered dependency gets caught on day one, before anyone has discovered
+or disclosed anything, because there's no CVE to wait for.
-## Quickstart Guide
+This is a complement to CVE-feed tools (Snyk, Dependabot, OSV-Scanner), not a
+replacement for them — those tools are the right answer for "is this exact known bug
+present." GitGalaxy is the right answer for the wider net: weakness classes and
+physical anomalies that don't require anyone to have found and filed the specific
+instance first.
-### 1. Install
+### Real-World Adoption
-```bash
-pip install gitgalaxy
-```
+
+Tracking the total, deduplicated volume of fetches across PyPI, GitHub, and GitLab against our baseline control repositories.
-### 2. Scan a Repository
+
-Point the GalaxyScope at any local repository or ZIP archive. The engine runs entirely on your local machine—zero data is transmitted.
+Measured without mirrors. The GitHub/PyPI breakdown lines begin partway through the window because per-source tracking was added after total-fetch tracking; the total line before that point is aggregate across all sources.
+
-### 3. GitHub Actions CI/CD Integration
+## Benchmarks
+* **[50+ Language Test Repo](https://github.com/squid-protocol/language-crucible)** and [artifacts](https://github.com/squid-protocol/language-crucible/tree/main/raw_output)
+* **[Speed Results from 104 Repos](https://squid-protocol.github.io/gitgalaxy/03-01-claim-1-search-strategies/)**
+* **[Cross-Language Comparisons of over 1000 repos](https://squid-protocol.github.io/gitgalaxy/03-04-claim-4-comparing-languages/):** Deterministic 1:1 benchmarking of distinct syntax architectures.
+* **[Universal File Archetypes by k-means clustering](https://squid-protocol.github.io/gitgalaxy/03-05-claim-5-file-archetypes/):** ML isolation of files into K-means clusters.
+* **[Mainframe Proven: 100% CI/CD Translation Success Rate](https://github.com/squid-protocol/gitgalaxy/tree/main/examples/ibm_cics_translation):** 27 out of 27 successful architectural translation of 27 distinct legacy COBOL repositories (including IBM CICS benchmark apps) into compiling Java Spring Boot environments.
-GitGalaxy can be integrated directly into your GitHub Actions pipeline for automated DevSecOps auditing, Zero-Trust SBOM generation, or Pre-Commit firewalls.
+
-**🚀 [View the Full GitHub Action Integration Guide](https://github.com/squid-protocol/gitgalaxy/blob/main/github-action-readme.md)**
+
-Check out our comprehensive guide to set up the **Pipeline Architecture** (Parallel Enforcement & Autonomous Reporting). It covers all available inspection tools, AI guardrails, and advanced configuration options like our hyper-sensitive `--paranoid` threat-hunting mode.
+## Data Privacy & On-Premise Deployment
+* 100% air-gapped execution
+* On-premise deployment
+* Zero-trust processing model
+
-*Minimal Example (Running a single inspection tool):*
-```yaml
-name: GitGalaxy Security Audit
+
-on:
- pull_request:
- branches: [ "main" ]
+## Installation & Usage
+* Python-based: `pip install gitgalaxy`
+* CLI execution
+* **[How to add a new programming language in 1 prompt](https://github.com/squid-protocol/gitgalaxy/blob/main/gitgalaxy/standards/how_to_add_a_language.md)**
+* Outputs forensic JSONs (optimized for AI-agent summary reports) and a native SQLite3 database for robust querying and storage.
-jobs:
- gitgalaxy-scan:
- runs-on: ubuntu-latest
- steps:
- - name: Checkout Repository
- uses: actions/checkout@v4
+### CI/CD Integration
- - name: Run GitGalaxy Supply Chain Firewall
- uses: squid-protocol/gitgalaxy@main
- with:
- tool: 'supply-chain-firewall' # View the Integration Guide for the full tool directory
- target: '.'
-```
+Drop the template for your platform straight into your pipeline — each one runs a GitGalaxy scan and can fail the build on risk-threshold or malware-signature breaches.
----
+| Platform | Template |
+|---|---|
+| **GitHub Actions** | [`gitgalaxy-pipeline.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/github/gitgalaxy-pipeline.yml) — see the [full integration guide](https://github.com/squid-protocol/gitgalaxy/blob/main/github-action-readme.md) |
+| **GitLab CI** | [`scan.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/gitlab/scan.yml) |
+| **Bitbucket Pipelines** | [`bitbucket-pipelines.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/bitbucket/bitbucket-pipelines.yml) + [`bitbucket_insights.py`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/bitbucket/bitbucket_insights.py) (posts findings as Bitbucket Code Insights annotations) |
+| **Azure Pipelines** | [`azure-pipelines.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/azure/azure-pipelines.yml) |
+| **Anything else** (Jenkins, CircleCI, etc.) | [`scan.yml`](https://github.com/squid-protocol/gitgalaxy/blob/main/templates/scan.yml) — generic, shell-invocable template |
-### [GitGalaxy Core Analysis Engine](https://github.com/squid-protocol/gitgalaxy/blob/main/docs/wiki/01-project-overview.md)
-The central blAST engine. It bypasses rigid ASTs using mathematical heuristics to map O(N) multi-dimensional relationships across 50+ languages, managing signal processing, spatial layout, and high-speed SQLite telemetry recording.
+
@@ -138,8 +180,6 @@ A deterministic, high-fidelity translation pipeline. It converts legacy COBOL in
* **Proven Metric:** Achieved a perfect 27/27 Maven compile success rate across a batch test of distinct legacy repos.
* **Verify for Yourself:** [Inspect the raw outputs of the IBM CICS Application Translation here.](https://github.com/squid-protocol/gitgalaxy/tree/main/examples/ibm_cics_translation/)
-
-
### [Mainframe Refactoring: COBOL & JCL Optimization](https://github.com/squid-protocol/gitgalaxy/tree/main/gitgalaxy/tools/cobol_to_cobol/)
An analytical suite for sanitizing mainframe monoliths. It safely neutralizes legacy lexical traps, extracts dead execution memory, maps topological DAG execution orders, and generates Zero-Trust JCL configurations for modern cloud deployments.
* **Proven Metric:** The dead-code extraction engine removed over 6,700 lines of dead execution blocks and orphaned variables from the standard IBM CICS benchmark app in seconds.
diff --git a/action.yml b/action.yml
index 1fa1706c..7b9dd67a 100644
--- a/action.yml
+++ b/action.yml
@@ -32,7 +32,7 @@ runs:
using: "composite"
steps:
- name: Set up Python
- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+ uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #
with:
python-version: '3.10'
diff --git a/docs/gitgalaxy_architecture_brief.md b/docs/gitgalaxy_architecture_brief.md
index 01ff0482..70c1d42f 100644
--- a/docs/gitgalaxy_architecture_brief.md
+++ b/docs/gitgalaxy_architecture_brief.md
@@ -4,7 +4,7 @@
## 0. FORENSIC TRACEABILITY
| Metadata | Value |
|---|---|
-| **Engine** | `GitGalaxy Scope v6.2.0 (Delta Mode)` |
+| **Engine** | `GitGalaxy Scope (Delta Mode)` |
| **Target Path** | `/home/runner/work/gitgalaxy/gitgalaxy` |
| **Timestamp** | `2026-07-17T22:27:12.798136+00:00` |
| **Scan Duration** | `6.34s` |
diff --git a/docs/wiki/02-08-the-detector.md b/docs/wiki/02-08-the-detector.md
index 0c387404..2110d797 100644
--- a/docs/wiki/02-08-the-detector.md
+++ b/docs/wiki/02-08-the-detector.md
@@ -4,7 +4,7 @@
>
> Before the Splicer spends computational energy carving a logic stream, it performs a strict physical viability check. If a file enters the Splicer with a structural confidence score below `0.42`, it triggers the **Singularity Bypass**, safely relegating the file to "Dark Matter" (unparsed mass). Similarly, files explicitly verified as `markdown` or `plaintext` trigger a Prose Deflection, routing them entirely to "Ghost Mass."
>
-> **The Ecosystem Gravity Override:** In the v6.3.0 Protocol, a critical exception was introduced for highly contested, declarative files—most notably C/C++ header files (`.h`). Pure-macro headers often lack the standard functional logic (braces, loops, branches) required to pass the 0.42 confidence floor naturally, causing vital architectural maps to vanish into Dark Matter.
+> **The Ecosystem Gravity Override:** In the Protocol, a critical exception was introduced for highly contested, declarative files—most notably C/C++ header files (`.h`). Pure-macro headers often lack the standard functional logic (braces, loops, branches) required to pass the 0.42 confidence floor naturally, causing vital architectural maps to vanish into Dark Matter.
>
> To solve this, the Splicer now implements an **Ecosystem Gravity Override**. If the upstream Language Lens previously utilized ecosystem mass to safely lock a file into a C-family orbit (`c`, `cpp`, or `objective-c`), the Splicer trusts that macro-level gravity. It artificially boosts the file's parsing confidence to `1.0`, ensuring these critical structural components are fully mapped and integrated into the final spatial cartography.
@@ -14,7 +14,7 @@ Strings and text literals are the natural enemies of structural parsers. A stray
To prevent this "Quote Desynchronization," the Splicer utilizes the **Atomic Literal Shield**, an advanced pre-processing engine that securely masks disruptive text *without* altering the physical line counts or character indexing of the original file. This ensures the parsed logic perfectly maps 1:1 with the original source code.
-The v6.3.0 Protocol introduces heavily upgraded, language-aware shielding:
+The Protocol introduces heavily upgraded, language-aware shielding:
* **Advanced Atomic Quotes:** The shield processes multi-character sequence markers strictly *before* single quotes. This surgical ordering correctly masks C++ Raw String Literals (e.g., `R"EOF(...)EOF"`) and Python Triple Quotes (`"""` / `'''`) without prematurely triggering on standard double quotes contained within them.
* **Heredoc Isolation:** For scripting languages (Shell, Bash, Ruby, Perl, Elixir), standard regex is insufficient. The Splicer deploys a line-by-line state machine to isolate complex Heredoc logic (e.g., `<<-EOF`), safely blanking out massive text blocks that frequently contain rogue bash characters or unescaped quotes.
@@ -28,7 +28,7 @@ To maintain absolute mathematical integrity, the GitGalaxy Splicer strictly enfo
By routing the pre-split streams into distinct analysis engines, GitGalaxy guarantees that structural metrics and human intent are measured independently.
### 1. Coding Analysis (The 51-Element Schema Guarantee)
-The `coding_analysis` engine is responsible for measuring the raw physical properties of the Active Matter (branches, IO operations, memory manipulations). In the v6.3.0 Protocol, this engine was upgraded to enforce absolute schema rigidity:
+The `coding_analysis` engine is responsible for measuring the raw physical properties of the Active Matter (branches, IO operations, memory manipulations). In the Protocol, this engine was upgraded to enforce absolute schema rigidity:
* **Anti-Hallucination Binding:** The engine initializes its counting dictionary directly from the `UNIVERSAL_METRICS_SCHEMA`. If a custom language definition attempts to inject an unregistered rule, the Splicer actively ignores it.
* **Deterministic Output:** This strict bounding guarantees that the resulting metrics dictionary is *exactly* 51 elements long, in the exact same order, every single time. This absolute consistency is vital for preventing schema drift and ensuring downstream risk algorithms (which rely on fixed-length arrays) never crash or misalign.
* **Indentation Signatures:** Alongside regex matching, the coding analyzer also calculates the physical indentation density (Tabs vs. Spaces) to help downstream models identify the formatting culture of the logic block.
@@ -47,11 +47,11 @@ Even if a file is relegated to Dark Matter (failing the 0.42 structural confiden
Because programming languages adhere to vastly different structural physics, a one-size-fits-all regex approach is mathematically impossible. To solve this, the `_function_slice` Master Dispatcher analyzes the language's lexical family and dynamically routes the Active Matter into one of five highly specialized extraction algorithms (Integration Modes).
* **Mode A: Label-Based Scan (Legacy Species)** Used for legacy procedural languages like Assembly, AGC, and COBOL, which lack traditional scoping mechanisms. The Splicer uses a greedy, label-based scan (`_slice_by_labels`). It searches for functional start tags or labels and captures the entire block of logic until it encounters the next start tag or a definitive return instruction (e.g., `RET`, `GOBACK`, `END-PERFORM`), successfully isolating the structural satellite.
-* **Mode B: Recursive Scope Analysis (C-Family & Lisp)** The standard algorithm for languages relying on braces `{}` or parentheses `()`. The v6.3.0 Protocol heavily fortifies this brace-tracking engine against syntax desynchronization:
+* **Mode B: Recursive Scope Analysis (C-Family & Lisp)** The standard algorithm for languages relying on braces `{}` or parentheses `()`. The Protocol heavily fortifies this brace-tracking engine against syntax desynchronization:
* **The Atomic Alternation Shield:** Evaluates double quotes, single quotes, and backticks simultaneously. This prevents complex string manipulation from confusing the scanner and falsely collapsing the closing braces.
* **The C++ Preprocessor Brace Shield:** C/C++ macros frequently contain raw floating braces (e.g., `#else {`), which historically shattered scope stacks. The Splicer now implements a preprocessor shield that safely blinds the parser to duplicate or floating braces trapped inside dead structural branches (`#elif`, `#else`) and multi-line `#define` macros.
* **Mode C: Density Stratification (Python & YAML)** Languages that rely on whitespace require a topographical approach. Using `_slice_by_indentation`, the engine identifies a structural igniter (like `def` or `class`) and calculates its base indentation level. It then scans forward, line-by-line, through the code's density. The scope block is naturally terminated the moment the engine encounters a line of active code that drops back to or below the base indentation level.
-* **Mode D: Semantic Handshake Stack (Keyword Scoping)** A major addition in the v6.3.0 Protocol, Mode D (`_slice_by_keywords`) is explicitly designed for non-brace scripting languages like Shell, Ruby, Lua, and Elixir.
+* **Mode D: Semantic Handshake Stack (Keyword Scoping)** A major addition in the Protocol, Mode D (`_slice_by_keywords`) is explicitly designed for non-brace scripting languages like Shell, Ruby, Lua, and Elixir.
* Powered by the new `SemanticScopeRegistry`, this engine tracks structural depth via text keywords rather than symbols. It identifies specific *openers* (`if`, `def`, `case`) and *closers* (`fi`, `end`, `esac`) to manage the scope stack.
* It includes specialized heuristics, such as the **Ruby Inline Modifier Guard**, which prevents single-line modifiers (e.g., `return true if x`) from falsely incrementing the depth stack.
* **Mode E: Terminator Cleaving (Declarative Architectures)** Designed for declarative and query languages like SQL, Erlang, and Prolog (`_slice_by_terminator`). Rather than tracking nested scope, this mode monitors the stream for an **Igniter** keyword (e.g., `SELECT`, `CREATE`, or an Erlang function head) to start orbiting a new logic block. The block remains open until the engine detects the language's specific **Terminator** token (like a semicolon `;` or a period `.`), at which point the "guillotine drops," cleaving the statement into a measurable satellite.
@@ -68,7 +68,7 @@ The `_process_satellite_physics` method analyzes the raw string of the isolated
(Highly linear functions branch at steep 90° angles; highly complex functions branch at wide 22.5° angles).
* **Magnitude (`mag`):** The final physical mass of the block, calculated as:
$$\text{Magnitude} = (\text{branches} + 1) \times (\text{args} + 1) + (0.05 \times \text{loc})$$
-* *Note on Arguments:* The v6.3.0 Protocol upgraded the argument counter to recognize space-separated arguments, ensuring languages like Lisp, Scheme, and Shell calculate accurate magnitudes alongside comma-separated C-family languages.
+* *Note on Arguments:* The Protocol upgraded the argument counter to recognize space-separated arguments, ensuring languages like Lisp, Scheme, and Shell calculate accurate magnitudes alongside comma-separated C-family languages.
### 2. The Naming Shields
Extracting a function name from raw text is notoriously difficult; naive regex frequently destroys complex C++ signatures or Objective-C methods. To guarantee pristine architectural labeling, GitGalaxy utilizes a gauntlet of **Naming Shields**:
@@ -83,7 +83,7 @@ Finally, the satellite is assigned a *texture* (its functional classification: `
## 2.3.5.E. The Cartographer: Fractal Fibonacci Positioning
-The Cartographer transforms flat file lists into a deterministic 3D star map. By applying procedurally generated patterns to digital architecture, it ensures the visual layout reflects the structural hierarchy and "gravitational" importance of the repository's components. Under the v6.3.0 Protocol, the engine utilizes a collision-aware packing algorithm to create organic, repeatable, and dense volumetric galaxies.
+The Cartographer transforms flat file lists into a deterministic 3D star map. By applying procedurally generated patterns to digital architecture, it ensures the visual layout reflects the structural hierarchy and "gravitational" importance of the repository's components. Under the Protocol, the engine utilizes a collision-aware packing algorithm to create organic, repeatable, and dense volumetric galaxies.
### 1. Sectorization & Hull Calculation (The Bounding Boxes)
Before spatial coordinates are assigned, the engine must calculate the physical footprint of every folder (Constellation).
diff --git a/docs/wiki/02-12-audit-recorder.md b/docs/wiki/02-12-audit-recorder.md
index c433bed2..4bc5309c 100644
--- a/docs/wiki/02-12-audit-recorder.md
+++ b/docs/wiki/02-12-audit-recorder.md
@@ -21,7 +21,7 @@ Here is the structural blueprint of the final output. This template exactly matc
```json
{
- "Audit Protocol": "GitGalaxy v6.3.2-Audit",
+ "Audit Protocol": "GitGalaxy",
"1. Forensic Trail (Traceability)": {
"Analysis Context": {
"Engine Identity": "",
diff --git a/docs/wiki/assets/sankey_v4.3.1.png b/docs/wiki/assets/sankey_v4.3.1.png
new file mode 100644
index 00000000..af8bbfcb
Binary files /dev/null and b/docs/wiki/assets/sankey_v4.3.1.png differ
diff --git a/docs/wiki/cookbook/generate-llm-architecture-briefs.md b/docs/wiki/cookbook/generate-llm-architecture-briefs.md
index c22c4d1c..5560b998 100644
--- a/docs/wiki/cookbook/generate-llm-architecture-briefs.md
+++ b/docs/wiki/cookbook/generate-llm-architecture-briefs.md
@@ -82,7 +82,7 @@ If you paste this exact text into an LLM like Claude 3.5 Sonnet or GPT-4o, it wi
## 0. FORENSIC TRACEABILITY
| Metadata | Value |
|---|---|
-| **Engine** | `GitGalaxy Scope v6.2.0 (Delta Mode)` |
+| **Engine** | `GitGalaxy Scope (Delta Mode)` |
| **Target Path** | `/srv/storage_16tb/projects/gitgalaxy/data/abap-cleaner` |
| **Scan Duration** | `2.38s` |
| **Git Branch** | `main` |
diff --git a/gitgalaxy/README.md b/gitgalaxy/README.md
index c643888d..1cb3477d 100755
--- a/gitgalaxy/README.md
+++ b/gitgalaxy/README.md
@@ -8,6 +8,23 @@ Welcome to the internal source code for the **GitGalaxy Core Engine**.
This directory contains the central orchestrator—**GalaxyScope**—alongside the core structural mechanics, lexical routing, and mathematical heuristics that power the entire DevSecOps ecosystem. If you are a developer looking to contribute, understand the data pipeline, or run the primary CLI, here is your architectural map.
+**Why we built a custom parsing engine:**
+Abstract Syntax Trees (ASTs) are excellent for catching syntax errors, but they require fully compilable code and a dedicated parser per language — both of which break down at the scale and polyglot mess of a real enterprise monolith. LLMs solve the language-coverage problem but introduce their own limits: context windows too small for million-line codebases, and probabilistic output that isn't the same twice.
+
+The **blAST (Bypassing LLMs and ASTs) engine** takes a third path, borrowed from a specific insight in computational biology: BLAST proved that a fast heuristic search — willing to accept a small, bounded margin of error — beats an exhaustive, mathematically perfect one once a database gets large enough. GitGalaxy applies that same tradeoff to source code. Instead of compiling a full parse tree, it scans raw text for **Structural Signatures**: bounded, ReDoS-safe regex patterns that mark the boundaries of functions, control flow, I/O, state mutation, and dozens of other structural and security-relevant behaviors — the same way a conserved sequence motif can imply a protein's function without anyone solving its 3D structure.
+
+The result is a deterministic knowledge graph of the repository, built without ever requiring the code to compile. It calculates the ratio of test code to core logic, maps each file's downstream "blast radius" through the dependency graph, and surfaces project-structure signal that line-by-line linters miss entirely. Per-file signal extraction runs in time linear to codebase size; repository-level graph metrics (centrality, community detection) use standard network-analysis algorithms with explicit sampling bounds on very large graphs.
+
+*(Note: raw structural signatures are just counts. The risk scores GitGalaxy reports are derived metrics — density-normalized against file size and weighted by network centrality — not raw hit counts.)*
+
+Think of GitGalaxy as a highly configurable macro-analyzer for codebase risk. Every assumption the system makes is exposed as one of 300+ tunable variables. You can query active API nodes, isolate supply chain threats, or highlight functions exhibiting extreme cognitive load — all adjusted via custom thresholds to reduce false-positive fatigue. Field-tested on over 1,000 repositories, the engine ships with enterprise-oriented defaults ready for CI/CD integration.
+
+* **Heuristic Structural Scanning:** Bypasses LLMs and rigid ASTs. Reads code as raw text without requiring it to compile.
+* **Deterministic Signal Extraction:** Maps code using a 97-point structural signal schema (I/O intent, state mutation, execution wrappers, security-relevant patterns, and more), rolled up into 19 aggregate risk categories.
+* **Taxonomical Classification:** These structural profiles let us cluster functions, files, and entire repositories into distinct architectural archetypes.
+* **Topological Cartography:** Builds a full dependency graph from imports and dynamic execution markers, with PageRank-style centrality and blast-radius scoring.
+* **No LLM in the Analysis Loop:** The core mapping and risk-scoring engine makes no calls to any language model — output is fully deterministic and reproducible run over run. (Some optional legacy-migration tools, like COBOL-to-Java translation, do use AI to translate isolated business logic; the analysis engine itself does not.)
+
### 🗺️ The Developer Map (How the Pipeline Flows)
When you trigger the `galaxyscope` command, the data flows through these physical directories:
diff --git a/gitgalaxy/core/aperture.py b/gitgalaxy/core/aperture.py
index 0ba21ac2..6a2811be 100644
--- a/gitgalaxy/core/aperture.py
+++ b/gitgalaxy/core/aperture.py
@@ -16,7 +16,7 @@
# ==============================================================================
# GitGalaxy Phase 0.1: Ingestion & Filtering (The Aperture Filter)
-# Strategy: v6.3.1 (Monolith Ceilings, Array Shields & Intent Overrides)
+# Strategy: (Monolith Ceilings, Array Shields & Intent Overrides)
# Architecture: Path Evaluation -> Intent Resolution -> Content Validation
# ==============================================================================
diff --git a/gitgalaxy/core/detector.py b/gitgalaxy/core/detector.py
index 2f5d4a13..a849e96b 100644
--- a/gitgalaxy/core/detector.py
+++ b/gitgalaxy/core/detector.py
@@ -46,7 +46,7 @@ def get_token_mass(text: str, deep_scan: bool = False) -> Optional[int]:
# galaxyscope:ignore sec_high_risk_execution
# GitGalaxy Phase 2.5 & 7.5: Logic Splicer & Topological Mapper
-# Strategy v6.3.0 Protocol: Fluid-State Counters, Language Sliding & Semantic Modes
+# Strategy Protocol: Fluid-State Counters, Language Sliding & Semantic Modes
# ==============================================================================
# galaxyscope:ignore sec_high_risk_execution
@@ -94,7 +94,7 @@ class FunctionNode(TypedDict, total=False):
class LogicData(TypedDict, total=False):
- """The standardized output schema for Strategy v6.2.0+ compliance."""
+ """The standardized output schema for Strategy compliance."""
equations: Dict[str, int]
functions: List[FunctionNode]
diff --git a/gitgalaxy/core/guidestar_lens.py b/gitgalaxy/core/guidestar_lens.py
index 03751f41..0b7e6c77 100644
--- a/gitgalaxy/core/guidestar_lens.py
+++ b/gitgalaxy/core/guidestar_lens.py
@@ -27,7 +27,7 @@
# galaxyscope:ignore sec_io, llm_hooks
# GitGalaxy Phase 0.5: Sector Intelligence (The GuideStar Lens)
-# Strategy: v6.3.0 (Deep Manifest Inspection & Evidence Hierarchy)
+# Strategy: (Deep Manifest Inspection & Evidence Hierarchy)
# ==============================================================================
# galaxyscope:ignore sec_io, llm_hooks
diff --git a/gitgalaxy/core/prism.py b/gitgalaxy/core/prism.py
index 866b4f82..fb193b4c 100644
--- a/gitgalaxy/core/prism.py
+++ b/gitgalaxy/core/prism.py
@@ -14,7 +14,7 @@
# ==============================================================================
# GitGalaxy Phase 2: Payload & Surface Splitter (The Prism)
-# Strategy v6.2.0 Protocol: Safe Delimiter Extraction & Format Bypasses
+# Strategy Protocol: Safe Delimiter Extraction & Format Bypasses
# ==============================================================================
@@ -56,7 +56,7 @@ class Prism:
compilable code. To achieve polyglot velocity and prioritize functional intent across
50+ languages, the Prism utilizes highly bounded, ReDoS-proof regular expressions.
- PIPELINE RULES (v6.2.0):
+ PIPELINE RULES:
1. Format Bypass: Respects 'undeterminable' files by passing them untouched to prevent pipeline stalls.
2. Dynamic Regex Matrix: Pre-compiles standard comment rules at runtime based on the JSON configuration.
3. O(1) String Literal Masking: Temporarily masks string literals to prevent the scanner from
diff --git a/gitgalaxy/galaxyscope.py b/gitgalaxy/galaxyscope.py
index 83af55e5..fb381747 100644
--- a/gitgalaxy/galaxyscope.py
+++ b/gitgalaxy/galaxyscope.py
@@ -588,7 +588,7 @@ def __init__(
self,
target_input: Union[str, Path],
config: Dict[str, Any],
- version: str = "6.2.0",
+ version: str = "latest",
):
self.config = config
self.version = version
diff --git a/gitgalaxy/metrics/chronometer.py b/gitgalaxy/metrics/chronometer.py
index 438ab2da..fdf2f1ce 100644
--- a/gitgalaxy/metrics/chronometer.py
+++ b/gitgalaxy/metrics/chronometer.py
@@ -26,7 +26,7 @@
# galaxyscope:ignore sec_high_risk_execution, sec_io, llm_hooks
# GitGalaxy Phase 3: Chronometer (Time-Series Analyzer)
-# Strategy v6.3.0 Protocol: Bulk Survey, Dynamic Windowing & Thread-Safety
+# Strategy Protocol: Bulk Survey, Dynamic Windowing & Thread-Safety
# ==============================================================================
# galaxyscope:ignore sec_high_risk_execution, sec_io, llm_hooks
@@ -40,7 +40,7 @@ class Chronometer:
and physical file-system stability, providing raw telemetry to the
Signal Processor for exposure calculations.
- ARCHITECTURE (v6.3.0):
+ ARCHITECTURE:
1. Survey-First Logic: Performs a bulk metadata sweep during initialization
to ensure Pass 2 threading is a zero-I/O memory lookup.
2. Dynamic Windowing: Calculates a rolling window based on 10% of the project's
diff --git a/gitgalaxy/metrics/signal_processor.py b/gitgalaxy/metrics/signal_processor.py
index 677989b4..8ebc0885 100644
--- a/gitgalaxy/metrics/signal_processor.py
+++ b/gitgalaxy/metrics/signal_processor.py
@@ -21,7 +21,7 @@
# ==============================================================================
# GitGalaxy Phase 4: Signal Processor (The Structural Signature Analysis Engine)
-# Strategy v6.2.0 Protocol: Temporal Normalization & Universal Exposure
+# Strategy Protocol: Temporal Normalization & Universal Exposure
# ==============================================================================
@@ -32,7 +32,7 @@ class SignalProcessor:
PURPOSE: Converts raw logic counts and temporal telemetry into "Exposure Vectors"
and generates high-fidelity forensic reports identifying structural risks.
- ARCHITECTURE (v6.2.0):
+ ARCHITECTURE:
1. Temporal Consolidation: Math formulas for Churn and Stability now live here.
2. Two-Pass Normalization: Auto-scales Churn based on the galaxy's global maximum.
3. Sigmoid Armor: `try/except OverflowError` guarantees survival on extreme file densities.
diff --git a/gitgalaxy/metrics/statistical_auditor.py b/gitgalaxy/metrics/statistical_auditor.py
index b3c7259b..7cfb01c7 100644
--- a/gitgalaxy/metrics/statistical_auditor.py
+++ b/gitgalaxy/metrics/statistical_auditor.py
@@ -23,7 +23,7 @@
# galaxyscope:ignore sec_high_risk_execution, sec_hardcoded_secrets, sec_io
# GitGalaxy Phase 7: Spectral Auditor (Quality Control)
-# Strategy v6.2.0 Protocol: Bayesian Accountability & Unparsable Artifacts
+# Strategy Protocol: Bayesian Accountability & Unparsable Artifacts
# ==============================================================================
# galaxyscope:ignore sec_high_risk_execution, sec_hardcoded_secrets, sec_io
diff --git a/gitgalaxy/recorders/audit_recorder.py b/gitgalaxy/recorders/audit_recorder.py
index fa5fcaf6..ec3cdcfe 100644
--- a/gitgalaxy/recorders/audit_recorder.py
+++ b/gitgalaxy/recorders/audit_recorder.py
@@ -26,7 +26,7 @@
# galaxyscope:ignore sec_high_risk_execution, sec_io, sec_state_mutation
# GitGalaxy Phase 8 & 9: Forensic Audit Recorder
-# Strategy v6.2.0 Protocol: Data Provenance & State Decoding
+# Strategy Protocol: Data Provenance & State Decoding
# Stage 2.5: Total Feature Parity (Descriptive Descriptors + Performance)
# ==============================================================================
@@ -103,7 +103,7 @@ def generate_report(
git_audit = session_meta.get("git_audit", {})
forensic_trail = {
"Analysis Context": {
- "Engine Identity": session_meta.get("engine", "GitGalaxy Scope v6.2.0"),
+ "Engine Identity": session_meta.get("engine", "GitGalaxy Scope"),
"Zero-Dependency Mode Active": session_meta.get("zero_dependency_mode", False),
"Missing Dependencies": session_meta.get("missing_dependencies", {}),
"Target Root Name": session_meta.get("target", "Unknown"),
@@ -562,7 +562,7 @@ def generate_report(
}
mission_audit = {
- "Audit Protocol": "GitGalaxy v6.3.2-Audit",
+ "Audit Protocol": "GitGalaxy-Audit",
"1. Forensic Trail (Traceability)": forensic_trail,
"2. Global Ecosystem Summary": summary,
"3. Forensic Security & Vulnerability Audit": security_audit,
@@ -587,7 +587,7 @@ def decode_galaxy(input_path, output_path=None):
if __name__ == "__main__":
- parser = argparse.ArgumentParser(description="GitGalaxy v6.2.0 Forensic Audit Recorder CLI")
+ parser = argparse.ArgumentParser(description="GitGalaxy Forensic Audit Recorder CLI")
parser.add_argument("input", help="Path to columnar galaxy.json")
parser.add_argument("--out", help="Optional output path")
args = parser.parse_args()
diff --git a/gitgalaxy/recorders/gpu_recorder.py b/gitgalaxy/recorders/gpu_recorder.py
index ab65f068..0a7d5e78 100644
--- a/gitgalaxy/recorders/gpu_recorder.py
+++ b/gitgalaxy/recorders/gpu_recorder.py
@@ -26,7 +26,7 @@
# galaxyscope:ignore sec_high_risk_execution
# GitGalaxy Phase 9: GPU Recorder
-# Strategy v6.2.0 Protocol: Destructive Columnar Pivot & Text Interning
+# Strategy Protocol: Destructive Columnar Pivot & Text Interning
# Stage 3.3: Destructive RAM Eviction (Final Pipeline Phase)
# ==============================================================================
diff --git a/gitgalaxy/recorders/llm_recorder.py b/gitgalaxy/recorders/llm_recorder.py
index 3a4ec4e1..6fc035d4 100644
--- a/gitgalaxy/recorders/llm_recorder.py
+++ b/gitgalaxy/recorders/llm_recorder.py
@@ -25,7 +25,7 @@
# galaxyscope:ignore sec_high_risk_execution, sec_db_hooks
# GitGalaxy Phase 10: LLM Recorder (The AI Translation Layer)
-# Strategy v6.3.0 Protocol: Token Density, Distribution Topology & Context Graphs
+# Strategy Protocol: Token Density, Distribution Topology & Context Graphs
# ==============================================================================
# galaxyscope:ignore sec_high_risk_execution, sec_db_hooks
diff --git a/gitgalaxy/standards/language_lens.py b/gitgalaxy/standards/language_lens.py
index 22ea3222..73fcb7e9 100644
--- a/gitgalaxy/standards/language_lens.py
+++ b/gitgalaxy/standards/language_lens.py
@@ -19,7 +19,7 @@
# ==============================================================================
# GitGalaxy Phase 1: The Entity Census (Linguistic Classification Engine)
-# Strategy v6.2.0 Protocol: Bayesian Inference & Confidence Hierarchy
+# Strategy Protocol: Bayesian Inference & Confidence Hierarchy
# ==============================================================================
diff --git a/gitgalaxy/standards/language_standards.py b/gitgalaxy/standards/language_standards.py
index 726a2c9a..6a13400a 100644
--- a/gitgalaxy/standards/language_standards.py
+++ b/gitgalaxy/standards/language_standards.py
@@ -759,7 +759,7 @@
"_meta": {
"target_version": "TypeScript 6.0 / ES2026",
"last_updated": "2026-03-12",
- "blueprint_version": "v6.3.1",
+ "blueprint_version": "",
"status": "production",
},
# COMPREHENSIVE SURFACE AREA: Standard modern suffixes, JSX variants, and ambient declaration boundaries.
@@ -3853,7 +3853,7 @@
"_meta": {
"target_version": "Kotlin 2.3.10 (K2 Compiler / Wasm / Java 25 Support)",
"last_updated": "2026-03-12",
- "blueprint_version": "v6.3.1",
+ "blueprint_version": "",
"status": "production",
},
# COMPREHENSIVE SURFACE AREA: Standard sources, Kotlin script files (heavily used in modern Gradle), and module declarations.
@@ -7554,7 +7554,7 @@
"_meta": {
"target_version": "Dockerfile (BuildKit)",
"last_updated": "2026-02-27",
- "blueprint_version": "v6.2.2",
+ "blueprint_version": "",
"status": "production",
},
# COMPREHENSIVE SURFACE AREA: Standard extensions for container definitions across Docker and Podman ecosystems.
@@ -7797,7 +7797,7 @@
"_meta": {
"target_version": "MATLAB R2024b",
"last_updated": "2026-02-27",
- "blueprint_version": "v6.2.2",
+ "blueprint_version": "",
"status": "production",
},
# COMPREHENSIVE SURFACE AREA: Standard scripts, functions, and modern Live Scripts (.mlx).
@@ -8217,7 +8217,7 @@
"_meta": {
"target_version": "Solidity 0.8.20+ (Smart Contracts / Foundry / Hardhat)",
"last_updated": "2026-04-01",
- "blueprint_version": "v6.3.2",
+ "blueprint_version": "",
"status": "production",
},
# COMPREHENSIVE SURFACE AREA: Standard Solidity contracts and library files.
@@ -8591,7 +8591,7 @@
"_meta": {
"target_version": "GNU Make 4.4+",
"last_updated": "2026-02-28",
- "blueprint_version": "v6.2.2",
+ "blueprint_version": "",
"status": "production",
},
# COMPREHENSIVE SURFACE AREA: Standard make extensions, definitions, and includes.
@@ -9484,7 +9484,7 @@
"_meta": {
"target_version": "R5RS / R6RS / Guile (GnuPG gpgscm)",
"last_updated": "2026-03-11",
- "blueprint_version": "v6.2.2",
+ "blueprint_version": "",
"status": "production",
},
# COMPREHENSIVE SURFACE AREA: Standard Scheme, legacy PLT/Chez suffixes, and Racket sources.
@@ -9889,7 +9889,7 @@
"_meta": {
"target_version": "Tcl 8.6 / SQLite Test Suite",
"last_updated": "2026-03-11",
- "blueprint_version": "v6.3.0",
+ "blueprint_version": "",
"status": "production",
},
# COMPREHENSIVE SURFACE AREA: Standard scripts and Tcl modules.
diff --git a/github-action-readme.md b/github-action-readme.md
index 346ca0bd..badef0ac 100755
--- a/github-action-readme.md
+++ b/github-action-readme.md
@@ -4,9 +4,9 @@
[](#)
[](#)
-GitGalaxy is an AST-free, high-velocity heuristic physics engine for codebase architecture and DevSecOps.
+Gitgalaxy is a static analysis tool that can assess full repos, comprised of mixes of 50+ different languages and map out the architecture, provide risk exposures and actionable fixes to lower those exposures. The result is a deterministic knowledge graph of the repository, built without ever requiring the code to compile.
-Instead of relying on slow static parsers, GitGalaxy translates structural codebase DNA into N-dimensional risk physics. This GitHub Action allows you to drop our entire suite of security sentinels, autonomous AI guardrails, and architectural cartography tools directly into your CI/CD pipeline. It physically blocks threats and automatically generates living architectural documentation.
+This GitHub Action drops our security sentinels, AI-agent guardrails, and architectural cartography tools directly into your CI/CD pipeline, and can automatically generate living architectural documentation.
For a deep dive into the methodology, see [The blAST Paradigm](docs/wiki/01-03-the-blast-paradigm.md) and our [Security Landscape Overview](docs/wiki/04-00-security_landscape.md).
@@ -14,64 +14,32 @@ For a deep dive into the methodology, see [The blAST Paradigm](docs/wiki/01-03-t
## 🚀 The "Golden Path" (Recommended Pipeline)
-For the highest level of automated enterprise security and documentation, we recommend the **Parallel Enforcement & Autonomous Reporting** pipeline.
+For standard PR gating, use the **3-job Zero-Trust Sentinel pipeline**: `vault-sentinel`, `xray-inspector`, and `supply-chain-firewall` run in parallel, and any one of them can fail the build.
-This workflow runs our core Zero-Trust Sentinels simultaneously for lightning-fast pipeline execution. If (and only if) the code passes all security gates, the Orchestrator (`galaxyscope`) generates an updated LLM Architectural Brief and automatically commits it back to your `main` branch under the `docs/` folder.
+Rather than pasting the workflow here (which is exactly how our version pins drifted out of sync last time), use the maintained template directly:
-Create a file at `.github/workflows/gitgalaxy-pipeline.yml`:
+**➡️ [`templates/github/gitgalaxy-pipeline.yml`](templates/github/gitgalaxy-pipeline.yml)** — copy this file to `.github/workflows/gitgalaxy-pipeline.yml` in your repo.
-```yaml
-name: GitGalaxy Zero-Trust Pipeline
+> **Note on trigger:** the shipped template runs `on: push: branches: [main]` — it reports on code *after* it lands on `main`, not before. If you want these gates to actually block a merge rather than report after the fact, change the trigger to `on: pull_request` before adopting it. We kept `push` as the default because it's the lower-friction starting point, but it's worth a deliberate decision, not an assumption.
-on:
- push:
- branches:
- - main
+### Advanced: Autonomous Architecture Docs
-jobs:
- vault-sentinel:
- name: Vault Sentinel
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v4
- - uses: squid-protocol/gitgalaxy@v2.2.1
- with:
- tool: 'vault-sentinel'
- target: '.'
-
- xray-inspector:
- name: X-Ray Inspector
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v4
- - uses: squid-protocol/gitgalaxy@v2.2.1
- with:
- tool: 'xray-inspector'
- target: '.'
-
- supply-chain-firewall:
- name: Supply Chain Firewall
- runs-on: ubuntu-latest
- steps:
- - uses: actions/checkout@v4
- - uses: squid-protocol/gitgalaxy@v2.2.1
- with:
- tool: 'supply-chain-firewall'
- target: '.'
+If you also want GitGalaxy to keep an LLM-readable architecture brief up to date automatically, add a 4th job that runs *after* all three gates pass, and commits the brief back to `docs/` on `main`:
+```yaml
architectural-report:
name: Autonomous LLM Brief
needs: [vault-sentinel, xray-inspector, supply-chain-firewall]
runs-on: ubuntu-latest
permissions:
- contents: write # Grants the Action permission to push the report to main
+ contents: write # This job pushes to main — grant this scope deliberately
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0 # Required to calculate historical Volatility/Churn
- name: Generate GalaxyScope LLM Brief
- uses: squid-protocol/gitgalaxy@v2.2.1
+ uses: squid-protocol/gitgalaxy@v2.4.0
with:
tool: 'galaxyscope'
target: '.'
@@ -82,15 +50,17 @@ jobs:
run: |
mkdir -p docs
mv *_galaxy_llm.md docs/gitgalaxy_architecture_brief.md || true
-
+
git config --global user.name "github-actions[bot]"
git config --global user.email "github-actions[bot]@users.noreply.github.com"
git add docs/gitgalaxy_architecture_brief.md
-
+
# Only commit and push if the architecture actually changed
git diff --quiet && git diff --staged --quiet || (git commit -m "docs: auto-update LLM architectural brief" && git push)
```
+This is genuinely optional, and separate for a reason: it's the only job in this file with write access to your repo, running unattended. Add it once you're comfortable with the base 3-job pipeline, not as your first step.
+
---
## 🧰 The Arsenal: Tool Directory
@@ -98,7 +68,7 @@ jobs:
The `tool` input determines which GitGalaxy program executes. Choose the right tool for your specific pipeline stage:
### 1. The Orchestrator (Reporting & Observability)
-* **[`galaxyscope`](docs/wiki/01-02-galaxyscope-cli-reference.md)**: The core mapping engine. It calculates 18-point risk physics (Cognitive Load, State Flux, Instructional Density), runs ML threat inference, and generates outputs (LLM Markdown Briefs, GPU Payloads, SQLite DBs). *Does not fail the pipeline; strictly for reporting and cartography.*
+* **[`galaxyscope`](docs/wiki/01-02-galaxyscope-cli-reference.md)**: The core mapping engine. It calculates 19-point risk physics (Cognitive Load, State Flux, Instructional Density, and more), runs ML threat inference, and generates outputs (LLM Markdown Briefs, GPU Payloads, SQLite DBs, SARIF, and CycloneDX SBOM via `--sarif-only`/`--sbom-only`). *Does not fail the pipeline; strictly for reporting and cartography.*
### 2. The Sentinels (Zero-Trust Enforcement)
*These tools are designed to `sys.exit(1)` and break the build instantly if a threat is detected.*
@@ -112,7 +82,6 @@ The `tool` input determines which GitGalaxy program executes. Choose the right t
* **[`dev-agent-firewall`](docs/wiki/02-18-dev-agent-firewall.md)**: Evaluates algorithmic complexity and blast radius to determine if an AI has the context to safely modify the code. Flags "Context Window Black Holes" and enforces Human-in-the-Loop (HITL) mandates for highly volatile infrastructure.
### 4. Specialized Hunters & Artifacts (Targeted Audits)
-* **[`zero-trust-sbom`](docs/wiki/04-02-sbom-generator.md)**: Generates a universally compliant CycloneDX 1.4 JSON SBOM. Unlike standard tools that blindly trust manifests, this engine physically verifies packages on disk, flagging high-entropy code and spoofed files.
* **[`api-network-map`](docs/wiki/04-01-full-api-network-map.md)**: Compares physical source-code routing against official OpenAPI/Swagger specs to hunt down undocumented **Shadow APIs** (Security Risks) and **Ghost APIs** (Audit Bloat).
* **[`pii-leak-hunter`](docs/wiki/04-06-pii-leak-hunter.md)**: A high-velocity streaming binary scanner for massive, single files. Scrubs database dumps or raw production logs for exposed VISA, Mastercard, SSN, and AWS keys, generating a safely masked evidence log.
@@ -127,7 +96,7 @@ Configure the GitGalaxy action via the `with` block in your workflow step.
| `tool` | Yes | `galaxyscope` | The specific executable to run (see Tool Directory above). |
| `target` | Yes | `.` | The directory or specific file path to scan. |
| `args` | No | `""` | Additional CLI arguments passed directly to the tool. |
-| `version` | No | `latest` | Target a specific PyPI version of GitGalaxy (e.g., `2.2.1`). |
+| `version` | No | `latest` | Pin to a specific version of GitGalaxy (see [GitHub Releases](https://github.com/squid-protocol/gitgalaxy/releases) for available versions). |
| `full_precision` | No | `false` | Set to `'true'` to install heavy physics engines (`networkx`, `tiktoken`, `xgboost`) for Blast Radius math and ML Threat Inference. |
### 🛡️ Understanding the `--paranoid` Flag
@@ -142,15 +111,16 @@ When passing arguments via `args`, the `--paranoid` flag allows you to control t
## 🛠️ Advanced Integration Examples
### Universal Zero-Trust SBOM Generation
-Generate a physical-verified CycloneDX SBOM to attach to a release.
+Generate a physical-verified CycloneDX SBOM to attach to a release. SBOM generation is native to `galaxyscope` — see the [SBOM generator reference](docs/wiki/04-02-sbom-generator.md).
```yaml
- name: Generate Physical SBOM
- uses: squid-protocol/gitgalaxy@v2.2.1
+ uses: squid-protocol/gitgalaxy@v2.4.0
with:
- tool: 'zero-trust-sbom'
+ tool: 'galaxyscope'
target: '.'
-
+ args: '--sbom-only'
+
- name: Upload SBOM Artifact
uses: actions/upload-artifact@v4
with:
@@ -163,13 +133,13 @@ Automatically halt the CI/CD pipeline if an AI agent commits code that exposes a
```yaml
- name: AI AppSec Validation
- uses: squid-protocol/gitgalaxy@v2.2.1
+ uses: squid-protocol/gitgalaxy@v2.4.0
with:
tool: 'ai-appsec-sensor'
target: '.'
- name: Agent Context Firewall
- uses: squid-protocol/gitgalaxy@v2.2.1
+ uses: squid-protocol/gitgalaxy@v2.4.0
with:
tool: 'dev-agent-firewall'
target: '.'
@@ -180,10 +150,10 @@ Automatically audit Pull Requests to ensure developers aren't silently exposing
```yaml
- name: Shadow API Audit
- uses: squid-protocol/gitgalaxy@v2.2.1
+ uses: squid-protocol/gitgalaxy@v2.4.0
with:
tool: 'api-network-map'
target: '.'
# Optional: Point directly to a swagger file, or use --merge-all for monorepos
args: '--swagger ./docs/openapi.yaml'
-```
\ No newline at end of file
+```
diff --git a/site/js/core/data-parser.js b/site/js/core/data-parser.js
index d1cda79c..274378f1 100644
--- a/site/js/core/data-parser.js
+++ b/site/js/core/data-parser.js
@@ -10,7 +10,7 @@
/**
* FILENAME: data-parser.js
* GitGalaxy Data Ingestion & Transformation Layer
- * v6.5.0: Deep Refraction Update (Fibonacci Physics + Complexity Depth)
+ *: Deep Refraction Update (Fibonacci Physics + Complexity Depth)
* Handles Satellite Impact Scoring, 3D Phyllotaxis, and DNA Inheritance.
*/
diff --git a/site/js/core/metavisualizer.html b/site/js/core/metavisualizer.html
index 4f0592f4..0ef201d6 100644
--- a/site/js/core/metavisualizer.html
+++ b/site/js/core/metavisualizer.html
@@ -6,7 +6,7 @@
MetaVisualizer | Forensic Galaxy Shell