Saltar al contenido
English — Cambiar idioma a inglés

Novedades

Registro de cambios del proyecto, directamente desde CHANGELOG.md.

  1. Sin publicar

    Added

    • Enterprise console workflow — persistent campaign creation with idempotent retries, server-paginated findings and scoped views, evidence-aware plan review and execution results, tenant-scoped access/session administration and audit exploration. Public demo requests use a protected server intake with expiring private records; local tests only accept example contacts. Webhook attempt metadata persists across restarts and distinguishes HTTP responses from human receipt. Hosted operational and human acceptance remain pending.
    • Public site refresh — wider responsive layouts, editorial headlines, language flags, a guided synthetic preview and verifiable security controls. Public source-access pages explain private repository permissions; the new demo guide is available in Spanish and English. Fixed mobile navigation, exposure-graph styling and scrolling of documentation tables. Human validation and hosted-demo limitations remain explicit.
    • Phase 0 — repository foundations: monorepo layout, toolchains (uv / pnpm / Go), Makefile, CI workflows, local docker compose stack, threat model, ADRs 0000–0016, packages/core domain contract.
    • Phase 1 — packages/connectors feeds: CVE List V5, NVD 2.0, CISA KEV, EPSS (history), OSV, GHSA, Ubuntu/Debian/Red Hat/Alpine/Amazon distro feeds, AWS/GCP bulletins, CSAF 2.0, OpenVEX, pluggable commercial; alias resolution, PURL/CPE, per-ecosystem ranges, vuln store.
    • Phase 2 — inventory collectors (AWS per §6.2.1, GCP, Kubernetes, registries SBOM, GitHub Reader App, scan sandbox), IAM read-only policies with explicit data denies + offline simulator, packages/graph Postgres store with history, reconciliation (managed/shadow/ghost), ownership, coverage, exports, synthetic demo tenant.
    • Phase 3 — packages/matcher (deterministic direct/inverse matching, per-ecosystem versions, VEX, dedup, golden set) and packages/risk (explainable policy-versioned scoring, toxic combinations, compensating controls, proactive queries, runtime context hook).
    • Phase 4 — packages/actions (closed catalog, templates, root-cause consolidation, ranking) and packages/agent (LLMProvider for Bedrock/Anthropic/Fake, untrusted-content delimiting, injection detection, redaction, read-only tools, Triage/Hunter/Planner/Explainer, deterministic validator, signed plan pipeline, zero-day mode).
    • Phase 5 — policies/ OPA/Rego (RBAC, approval SoD/two-person, execution gate, freeze, risk acceptance) with 93 tests; packages/policy engines; apps/api FastAPI approval-service with OIDC, WebAuthn step-up, signed attestations, notifier (links only), webhooks, kill switch, REST /api/v1, read-only MCP.
    • Phase 6 — apps/executor (Go): signature/hash/attestation/policy/freshness gate, GitHub App scoped tokens, idempotent PR handlers for 8 actions, ticket/runbook actions, tracker, distroless image.
    • Phase 7 — packages/signing (ECDSA P-256 local/KMS), packages/audit (hash chain, Object Lock segments, centinela-audit verify, OCSF export), packages/query (CQL + NL→CQL), Datadog dashboards/monitors module.
    • Phase 7 (cont.) — apps/workers Temporal workflows per plane with plane-isolation assertions, reports workflow and artefact store; evals/ golden set + runner; Python→Go E2E contract fixture; apps/api console read models, War Room SSE, trust statement publication (human-approved VEX), executive reports, ISO 27001 / SOC 2 evidence packs, noise budget, suppressions with mandatory reason/expiry, feedback loop, analyst triage with verified-closure guard, what-if simulation endpoints.
    • Frontend — Faro design system packages/ui (tokens, themes, motion, 40+ components, Storybook, axe/contrast/reduced-motion tests, tree-shakeable RSC-safe packaging), apps/web console (Hoy, ¿Me afecta?, vulnerabilities, assets, plans approval flow with WebAuthn, War Room, campaigns, reports/CQL builder, connectors, settings, onboarding, ⌘K), apps/site (landing, demo, transparent pricing, security, docs, status, changelog), apps/trust-portal (OpenVEX/CSAF exports, RSS).
    • Self-service onboarding — registration at first OIDC login (JIT tenant), /api/v1/connections with per-connection least-privilege templates (AWS CloudFormation single-account and Organizations StackSet, GCP gcloud/WIF, Azure ARM/Bicep; Terraform for all three), SNS/OIDC-verified callbacks plus 15 s polling, permission checklist with remediations, automatic first sweep; console wizard /onboarding/connect with live detection and resource counters; docs/onboarding/PROCESS.md.
    • Phase 10 — differentiator matrix (docs/differentiators.md), DoD evidence (docs/dod-checklist.md), demo guide, 26 feature pages, Datadog metrics catalogue and monitors for every differentiator.
    • Phase 8/9 — Terraform modules and stacks, Helm charts, ArgoCD, onboarding templates (CFN/Terraform/WIF/GitHub App manifests, permission verifier), CI/security/release/lighthouse workflows, threat model, compliance (GDPR, Ley 21.719, ISO 27001, SOC 2), runbooks, user/operator guides.