squash

Changelog

All notable changes to squash-ai are documented here. Format: Conventional Commits ยท Keep a Changelog


[Unreleased] โ€” 2026-05-19 โ€” EU AI Act deadline update (Omnibus)

Documentation


[3.8.0] โ€” 2026-05-12 โ€” P1 sprint: redline + audit trail + financial exposure

The demo earns the next user: every failing clause is actionable, every scan is auditable, every gap is a number a CFO will read.

Added โ€” P1 (Critical / Low complexity)

Roadmap


The demo is the compliance scanner โ€” visuals communicate everything.

Added โ€” Sprint 30 W249โ€“W251

Changed

Why this matters โ€” every share is a billboard

A share permalink is now an instantly-renderable, framework-aware billboard. A founder pastes their privacy policy, gets a /r/{hash}/card.svg, drops the URL into Slack, and the unfurl preview is a Squash-branded compliance score. /trending turns aggregate behaviour into social proof: โ€œwhat policies are people checking right now.โ€ The visual UI rebuild collapses the cognitive distance between โ€œI have a documentโ€ and โ€œI have a verdictโ€ to a single keystroke on a breathing purple orb.


[3.6.0] โ€” 2026-05-09 โ€” Demo polish (Sprint 29)

Added โ€” Sprint 29 W258โ€“W260

Changed


[3.5.0] โ€” 2026-05-09 โ€” Demo polish + viral features (Sprint 28)

Added โ€” Sprint 28 W246โ€“W248

Changed

Why this matters โ€” viral on-ramp to the squash CLI

The single biggest barrier to first-time-user adoption is the gap between โ€œI have a privacy policyโ€ and โ€œI have a model artefact ready for squash attest.โ€ /quick-check collapses that gap to a single curl. Anyone can paste their privacy policy into the demo, get a verdict in two seconds, and share the result with a single anonymous URL. The output explicitly points the visitor at pip install squash-ai && squash attest for the real run.


[3.2.0] โ€” 2026-05-05 โ€” AI Insurance Risk Package (Track C / C6)

Added โ€” Sprint 24 W235โ€“W237

Opens a new buyer motion

Chief Risk Officer + insurance procurement. AI cyber-insurance underwriters (Munich Re, Coalition, AIG, Beazley) are publicly demanding standardised evidence packages before quoting a policy. squash insurance-package generates the package automatically from existing squash artefacts โ€” no new data collection required.


[3.0.2] โ€” 2026-05-04 โ€” Konjo Edition Demo v2: Real Models, Side-by-Side, Animated

Added


[3.0.1] โ€” 2026-05-04 โ€” Konjo Edition Demo + CI fixes

Fixed

Added


[3.0.0] โ€” 2026-05-03 โ€” Bulletproof Edition (Phase G)

โ€œCorrectness is the floor, not the ceiling.โ€

Major version bump for the cryptographic-chain hardening lane: every Tier-0/1 attestation is now byte-identical on rerun, every signed payload flows through RFC 8785 canonical JSON, every cert ID is keyed on the input (uuid5, never uuid4), every clock is injectable, every release wheel + Docker image carries SLSA Build Level 3 provenance, and the entire chain โ€” input manifest โ†’ canonical body โ†’ Ed25519 โ†’ RFC 3161 TSA โ†’ SLSA โ€” is verifiable end-to-end via squash self-verify.

Added โ€” Cryptographic primitives (Phase G.2)

Added โ€” Cryptographic chain (Phase G.3)

Changed โ€” Tier-0/1 sites swept (AUDIT_BASELINE.md ยง7, 22 line-items)

Added โ€” Tests (Phase G.4)

134 new Phase-G tests across 10 new files + 2 atheris fuzz harnesses: test_canon_compat.py (26), test_clock.py (10), test_ids.py (9), test_reproducibility.py (10), test_phase_g_property.py (11), test_phase_g_negative.py (27), test_phase_g_edge.py (19), test_phase_g_concurrency.py (5), test_phase_g_security.py (10), test_phase_g_snapshot.py (9), plus tests/fuzz/fuzz_canon.py and tests/fuzz/fuzz_input_manifest.py for the nightly 100K-iter run.

Test count: 5,226 โ†’ 5,362 passing.

Added โ€” Static analysis (Phase G.5)

Added โ€” CI gates (Phase G.7)

Added โ€” Demo Day package

Added โ€” Planning + audit docs

Changed โ€” Misc

Deferred


[2.7.0] โ€” 2026-05-01 โ€” D5: Industry Compliance Benchmarking (W249-W250)

โ€œHow do we compare?โ€ โ€” Every enterprise QBR starts here. 8 sector baselines ยท percentile placement ยท k-anonymity ยท DP noise.

Added (W249-W250 / Track D / D5)


[2.6.0] โ€” 2026-05-01 โ€” D4: Multi-Jurisdiction Compliance Matrix (W240-W242)

A multinational LLM deployment touches 6+ jurisdictions on average. Today the legal compliance mapping is a one-week consulting engagement per deployment. This compresses it into a single command.

Added (Track D / D4)

Regulatory basis

EU AI Act Art. 9 + Art. 13 ยท NIST AI RMF ยท ISO 42001 ยง6 ยท GDPR Art. 30 ยท Colorado AI Act ยท NYC LL144 ยง1894 ยท SEC AI Operation Comply ยท FedRAMP AC-2 ยท FDA AI/ML Action Plan ยท UK ICO AI guidance ยท Singapore Model AI Governance Framework v2


[2.5.0] โ€” 2026-04-30 โ€” D1: GitHub App โ€” Auto-Attest Check Runs

1 user โ†’ 50-user network effect. The GitHub App is the wedge that turns squash from a tool into infrastructure.

Added (Track D / D1)

Regulatory basis

EU AI Act Art. 9 (post-market monitoring) ยท NIST AI RMF MEASURE 2 ยท ISO 42001 ยง9.1 (CI gating as preventive control)


[2.4.0] โ€” 2026-04-30 โ€” C1 โ˜…: squash freeze โ€” Emergency Response (W221-W222)

โ˜… The Red Button. Highest drama-per-hour ratio in the entire roadmap. 20% of organisations have a tested AI incident-response plan. This is one of them.

Added (W221-W222 / Track C / C1 โ˜…)

Regulatory basis

EU AI Act Article 73 (serious incident reporting) ยท NIST AI RMF MANAGE 4.1 (incident response) ยท ISO 42001 ยง9.1 (corrective action)


[2.3.0] โ€” 2026-04-30 โ€” D2: AI Identity Attestation (W226-W228)

92% of organisations lack full visibility into their AI identities. 73% of CISOs would invest immediately โ€” if the product existed. Now it does.

Added (W226-W228 / Track D / D2)

Regulatory basis

NIST AI RMF GOVERN 1.1 ยท EU AI Act Art. 9 ยท SOC 2 CC6.1 ยท FedRAMP AC-2 ยท CIS Controls v8 Control 5 ยท OWASP Agentic AI AA3


[2.2.0] โ€” 2026-04-30 โ€” C10: Runtime Hallucination Monitor (W267-W269)

EU AI Act Article 9(1)(f) requires post-market monitoring throughout the AI system lifecycle. 18% production hallucination rate ยท 39% of chatbots reworked in 2024.

Added (W267-W269 / Track C / C10)

Distinct from C7

C7 attests a model pre-deploy on a fixed probe set. C10 monitors live traffic continuously โ€” EU AI Act Art. 9 post-market monitoring obligation.


[2.1.0] โ€” 2026-04-30 โ€” C7 โ˜…: Hallucination Rate Attestation (W251-W252)

$67.4B in 2024 AI hallucination losses ยท 47% of executives made decisions on hallucinated content. squash hallucination-attest converts this into a signed domain-calibrated certificate.

Added (W251-W252 / Track C / C7 โ˜…)


[2.0.0] โ€” 2026-04-30 โ€” C2: AI Washing Detection (W223-W225)


[1.17.0] โ€” 2026-05-01 โ€” Sprint 18 W218โ€“W220 / Track D-6: SOC 2 Type II Readiness

Added (W218โ€“W220 โ€” Track D / D6 โ€” SOC 2 Type II Readiness โ€” Enterprise Procurement Unblocker)

SOC 2 Type II is the most-requested item in enterprise procurement (MEDDPICC). Without it, most $50K+ ACVs cannot proceed to contract. Sprint 18 wraps squashโ€™s existing building blocks โ€” signed attestations, hash-chained audit log, policy engine, RBAC, uptime monitoring โ€” in the AICPA Trust Services Criteria and produces an auditor-ready evidence bundle on demand.

# Coverage report across all 65 TSC controls
squash soc2 readiness

# Filter to specific category or status
squash soc2 readiness --category CC --status PARTIAL --json

# Build auditor-ready ZIP evidence bundle
squash soc2 evidence --output ./evidence/ --window 365

Key squash โ†’ TSC mappings:

TSC Control Squash Component Status
CC6.1 Logical Access auth.py + oms_signer.py + Sigstore COVERED
CC6.8 Malicious Software scanner.py + adapter_scanner.py COVERED
CC7.2 Monitoring governor.py hash-chained audit log COVERED
CC7.4 Incident Response incident.py + squash freeze COVERED
CC8.1 Change Management slsa.py + approval_workflow.py COVERED
CC9.2 Vendor Risk vendor_registry.py + procurement_scoring.py COVERED
PI1.1โ€“PI1.4 Processing attest.py + attestation_registry.py 4/4 COVERED

Module count: 99 โ†’ 100 (soc2.py).


New buyer: General Counsel. The GC approving an AI model for content generation, legal drafting, or code assistance needs a signed certificate answering three questions: What is the derivation chain? What copyright-heavy training sources exist? Has the model memorised copyrighted text?

squash genealogy --model ./model --deployment-domain legal-drafting
squash genealogy --model ./model --endpoint http://localhost:8080/v1/complete
squash genealogy --model ./model --block-on-contamination
squash copyright-check --model ./model --deployment-use commercial
squash copyright-check --model ./model --json --fail-on-incompatible

Stats: 60 new tests ยท 0 regressions ยท 4416 passing ยท 78 โ†’ 80 modules


[1.16.0] โ€” 2026-05-01 โ€” Sprint 28 W246โ€“W248 / Track D-3: Procurement Scoring API

Added (W246โ€“W248 โ€” Track D / D3 โ€” AI Procurement Scoring API โ€” The Credit-Score Play)

Every Fortune 500 procurement team is writing AI vendor questionnaires. They take 4 weeks each. Sprint 28 turns the Trust Package into a queryable API โ€” the credit-score equivalent for AI compliance. Whoeverโ€™s score the buyer asks for becomes the de facto standard.

# Query the score for any vendor (public, no auth required)
curl https://squash.works/v1/score/acme-corp
# โ†’ {"score": 87.4, "tier": "VERIFIED", "frameworks": ["eu-ai-act","iso-42001"], ...}

# Get score breakdown (Pro plan)
curl -H "Authorization: Bearer sq_live_..." https://squash.works/v1/score/acme-corp
# โ†’ {..., "breakdown": {"compliance_score": 92.0, "freshness": 85.0, ...}}

# Score history time-series (Enterprise)
curl -H "Authorization: Bearer sq_live_..." https://squash.works/v1/score/acme-corp/history

# Embeddable badge SVG for vendor README
<img src="https://squash.works/v1/score/acme-corp/badge" />

# CLI โ€” local registry scoring
squash score acme-corp --local --breakdown
squash score acme-corp --local --history --json

Freemium model:

Field Unauthenticated Pro Team Enterprise
score + tier โœ“ โœ“ โœ“ โœ“
breakdown โ€” โœ“ โœ“ โœ“
history โ€” (402) 3 months 3 months 12 months

Module count: 96 โ†’ 99 (procurement_scoring.py + concurrent sprints).


[1.15.0] โ€” 2026-04-30 โ€” Sprint 24 W235โ€“W237 / Track C-6: AI Insurance Risk Package

Added (W235โ€“W237 โ€” Track C / C6 โ€” AI Insurance Risk Package)

New buyer motion: Chief Risk Officer + insurance procurement. AI cyber-insurance is crystallising in 2026. Underwriters demand standardised evidence packages before quoting. Squash generates the whole submission in one command.

squash insurance-package --models-dir ./models --org "Acme Corp"
squash insurance-package --models-dir ./models --zip ./insurance-bundle.zip
squash insurance-package --models-dir ./models --json --underwriter munich-re

Stats


[1.15.0] โ€” 2026-05-01 โ€” Sprint 36 W259โ€“W261 / Track C-9: Carbon / Energy Attestation

Added (W259โ€“W261 โ€” Track C / C9 โ€” Carbon / Energy Attestation โ€” CSRD buyer)

The ESG / sustainability office is a new buyer motion. CSRD applies to all large EU companies from 2025. Squash carbon attestation is the machine-readable, cryptographically signed proof these frameworks demand.

# BERT-base in Ireland, 100K inferences/day
squash attest-carbon \
  --model-id bert-base \
  --params 110M \
  --region eu-west-1 \
  --hardware a100 \
  --inferences-per-day 100000 \
  --csrd --sign

# 7B model in Stockholm (green grid) vs Sydney (coal)
squash attest-carbon --model-id llama-7b --params 7B --region eu-north-1 --json
squash attest-carbon --model-id llama-7b --params 7B --region ap-southeast-2 --json

# Enrich existing ML-BOM with energy fields
squash attest-carbon --model-id bert-base --params 110M --region us-east-1 --bom ./mlbom.json

Grid intensity table covers 90+ regions:

Module count: 86 โ†’ 88 (carbon_attest.py; 2 additional modules added by concurrent sprints).


[1.14.0] โ€” 2026-04-30 โ€” Sprint 22 W229โ€“W231 / Track C-5: Regulatory Examination Simulation

Added (W229โ€“W231 โ€” Track C / C5 โ€” Regulatory Examination Simulation)

78% of executives canโ€™t pass an AI governance audit in 90 days. squash simulate-audit closes that gap in 60 seconds. Mock regulatory examination from the examinerโ€™s perspective โ€” answers pulled from squash attestation data, gaps flagged, prioritised remediation roadmap included.

squash simulate-audit --regulator EU-AI-Act --models-dir ./model
squash simulate-audit --regulator NIST-RMF --json
squash simulate-audit --regulator SEC --output-dir ./compliance/
squash simulate-audit --regulator FDA --fail-below 60

Changed

Stats


[1.14.0] โ€” 2026-05-01 โ€” Sprint 35 W265โ€“W266 / Track C-8: Model Deprecation Watch

Added (W265โ€“W266 โ€” Track C / C8 โ€” Model Deprecation Watch)

OpenAI / Anthropic / Google / Meta / Mistral sunset models quarterly. Every sunset breaks a version-tied Annex IV record. Most teams discover deprecations the day inference returns a 404. Squash deprecation-watch fires alerts before that day arrives.

# Scan asset registry against all 5 provider feeds
squash deprecation-watch --lead-time 30

# Check a specific model
squash deprecation-watch --check gpt-4-0613

# List all known deprecations as JSON
squash deprecation-watch --list --json

# Alert on Slack, fail CI if any alerts
squash deprecation-watch --alert-channel slack --fail-on-alert

Module count: 85 โ†’ 86 (deprecation_watch.py). All count guards updated.


[1.13.0] โ€” 2026-04-30 โ€” Sprint 27 W243โ€“W245 / Track C-4: Continuous Regulatory Watch Daemon

Added (W243โ€“W245 โ€” Track C / C4 โ€” Continuous Regulatory Watch Daemon)

Turns squash from a quarterly compliance tool into a daily intelligence service. Poll SEC.gov, NIST.gov, EUR-Lex, and any custom RSS feed for new AI governance requirements, map them to squash policy controls, and surface gap analysis against the local model portfolio โ€” all from a single cron-friendly command.

# One-shot poll (add to cron)
squash watch-regulatory --once --models-dir ./models --alert-channel slack

# 6-hour daemon
squash watch-regulatory --interval 6h --alert-channel slack

# Custom state legislature feed
squash watch-regulatory --once --extra-feed name=legiscan,url=https://...,keywords=artificial+intelligence

# Dry run โ€” see what would surface without persisting
squash watch-regulatory --once --dry-run --json

Changed

Stats


[1.12.0] โ€” 2026-04-30 โ€” Sprint 15 W208 / Track B-2: Branded PDF Compliance Report

Added (W208 โ€” Track B / B2 โ€” Branded PDF Compliance Report)

The CISO leave-behind that closes deals. A fully branded executive PDF from squash annex-iv generate --branded with cover page, KPI scorecard, exec summary, full Annex IV body, and signature block. WeasyPrint-based; degrades to an HTML preview when WeasyPrint is absent.

squash annex-iv generate --root ./model \
  --system-name "BERT Sentiment Classifier" \
  --format pdf \
  --branded \
  --org "Acme Corp" \
  --author "ML Platform Team" \
  --output-dir ./compliance/

Module count: 74 โ†’ 75 (pdf_report.py + templates/ directory with 3 SVGs + 1 CSS โ€” only pdf_report.py counts as a Python module)


[1.11.0] โ€” 2026-04-30 โ€” Sprint 32 W257โ€“W258 / Track B-8: LoRA / Adapter Poisoning Detection

Added (W257โ€“W258 โ€” Track B / B8 โ€” LoRA / Adapter Poisoning Detection)

LoRA adapters are perceived as โ€œsmall therefore low-risk.โ€ They are not. A LoRA adapter is a complete behavioural rewrite in megabytes. JFrog Security (2024) found ~100 malicious models on HuggingFace, several establishing reverse-shell on load. This sprint ships the first dedicated adapter security gate in the compliance-as-code ecosystem.

# Block any non-safetensors adapter outright (policy gate)
squash scan-adapter --lora ./adapter.pt --require-safetensors
# โ†’ rc=2, CRITICAL: --require-safetensors violated

# Scan a safetensors adapter with signed certificate
squash scan-adapter --lora ./adapter.safetensors --sign
# โ†’ CLEAN ยท 2 tensors ยท 0 findings ยท Certificate: adapter-squash-adapter-scan.json

# Full JSON report for CI integration
squash scan-adapter --lora ./adapter.safetensors --json
# โ†’ {"risk_level": "CLEAN", "findings": [], "adapter_hash": "...", ...}

Threat model covered (W257):

Threat Detection Severity
Pickle / PyTorch format PK-001 GLOBAL/REDUCE/STACK_GLOBAL opcodes CRITICAL
Pickle without explicit opcodes PK-002 inherent execution risk HIGH
--require-safetensors policy violation PK-003 format gate CRITICAL
Shell injection strings in any format SH-001 pattern sweep CRITICAL
safetensors OOB read vector ST-006 offset > file size CRITICAL
Malformed safetensors header ST-001โ€“ST-004 integrity checks CRITICAL
NaN / Inf weights WD-001/WD-002 float sentinel check HIGH
Kurtosis anomaly (spike weights) WD-003 excess kurtosis > 8 HIGH/MEDIUM
High-value target (embed_tokens/lm_head) large magnitude WD-004 HIGH
Layer concentration (backdoor in one layer) WD-005 > 85% L2 in single tensor MEDIUM

Statistical thresholds tuned against (W258):

Module count: 73 โ†’ 74 (adapter_scanner.py)


[1.10.0] โ€” 2026-04-30 โ€” Sprint 15 W209/W210 / Track B-3: Compliance Digest

Added (W209/W210 โ€” Track B / B3 โ€” Weekly / Monthly Email Digest)

The passive-retention surface. Squash stays in front of the CISOโ€™s eyes between active sessions. A weekly or monthly portfolio email lands in the inbox with five-metric posture, top-5 risk movers, and the August 2 countdown โ€” no dashboard login required.

# Cron-friendly stdout dump (no SMTP needed)
squash digest send --period weekly --dry-run --models-dir ./models

# Render-only preview (text / HTML / JSON)
squash digest preview --models-dir ./models --format html --output ./digest.html

# Send via any SMTP (Resend / Mailgun / SES / direct)
SQUASH_SMTP_HOST=smtp.resend.com SQUASH_SMTP_FROM=ciso-digest@acme.com \
  squash digest send --period weekly --org "Acme ML" \
    --recipients ciso@acme.com --recipients vp-eng@acme.com \
    --dashboard-url https://app.getsquash.dev/acme

Changed

Stats

Konjo notes

The Konjo discipline this sprint: 0 new modules. The dashboard already had every metric needed; B3 is purely a render layer + a delivery layer over the existing telemetry. No graveyards, no parallel data path, no provider-specific code (Resend / Mailgun / SES are all SMTP relays โ€” no need to write a Resend adapter when stdlib smtplib already works against any of them). The --dry-run flag exposes the exact same render the live send produces โ€” โ€œpreviewโ€ and โ€œsendโ€ are the same code path branching on whether to hit the network. ๊ฑด์กฐ applied to the surface area: one builder, two delivery paths, one CLI.


[1.9.0] โ€” 2026-04-30 โ€” Sprint 14 W205 / Track B-1: Public HF Scanner

Added (W205 โ€” Track B / B1 โ€” Public HuggingFace Model Scanner)

The first Track B parallel item. The free top-of-funnel growth tool any ML engineer can run against any public HuggingFace model in one command โ€” no login, no enterprise SaaS, no sales call. Squashโ€™s brand-builder on the platform with the largest concentration of ML engineers in the world.

squash scan hf://meta-llama/Llama-3.1-8B-Instruct
squash scan hf://microsoft/phi-3@v2.0 --policy enterprise-strict --output-dir ./out
squash scan hf://acme/private --hf-token $HF_TOKEN --download-weights

Changed

Stats

Konjo notes

The Konjo discipline this sprint: B1 is the highest-leverage parallel item that depends only on the existing scanner + policy modules. Same calendar week ships A1/A2 (Track A) + C1 (Track C) too โ€” exactly the parallelisation insight the master plan codifies. The hf:// path extends squash scan rather than introducing a new top-level subcommand: one user-facing entry point, two backends, zero learning overhead. Light-mode default (no weight download) keeps the public scanner fast & cheap; --download-weights is opt-in for users who want the full security audit. ๊ฑด์กฐ applied to the surface area.


[1.8.0] โ€” 2026-04-30 โ€” Sprint 13: Startup Pricing Tier ($499/mo)

Added

Context

SEC โ€œOperation AI Complyโ€ (2024) produced enforcement actions. The SECโ€™s 2026 examination priorities list AI-related disclosures as a top-tier focus. squash detect-washing is the first ML compliance tool that compares prose capability claims against signed attestation evidence automatically.


[1.9.0] โ€” 2026-04-30 โ€” B10: License Conflict Detection (W196)

Added

Konjo notes


[1.8.0] โ€” 2026-04-30 โ€” B9: Training Data Poisoning Detection (W195)

Added

Literature basis

Konjo notes


[1.7.0] โ€” 2026-04-30 โ€” B7: Drift SLA Certificate (W194)

Added

Konjo notes


[1.6.0] โ€” 2026-04-30 โ€” B6: Audit-Trail Blockchain Anchoring (W193)

Added

Konjo notes


[1.5.0] โ€” 2026-04-30 โ€” B4: Terraform / Pulumi Provider

Added โ€” Tier 3 #26 (B4) Terraform/Pulumi provider

Konjo notes


[1.3.0] โ€” 2026-04-29 โ€” Sprint 8: Moat Deepening

Added (W182โ€“W187 โ€” Sprint 8: Moat Deepening)

Changed

Stats


[1.2.0] โ€” 2026-04-29 โ€” Sprint 7: Enterprise Moat

Added (W178โ€“W181 โ€” Sprint 7: Enterprise Moat)

Changed

Stats


[1.1.0] โ€” 2026-04-29 โ€” Sprint 5: Market Expansion

Added (W170โ€“W174 โ€” Sprint 5: Market Expansion)

Changed

Stats


[1.0.0] โ€” 2026-04-28 โ€” Sprint 4A: Critical Path to Launch

Changed

Added


[0.9.14] โ€” 2026-04-28 โ€” Sprint 4B: High-Leverage Engineering

Added (W160โ€“W168)


[0.9.13] โ€” 2026-04-28 โ€” Sprint 3: CI/CD & Integrations

Added (W145โ€“W152 โ€” Sprint 3: CI/CD & Integrations)

Added (W137โ€“W144 โ€” Sprint 2: Cloud API & Auth)

Added (W135 / W136 โ€” Sprint S1 Exit Gate)

Added (Wave 133 + Wave 134)

Added (Wave 132)

Added (Wave 131)

Added (Wave 130)

Added (Wave 129)

Added (Wave 128)

[0.9.14] โ€” 2026-04-28

Changed

Added (Wave 83 โ€” from squish extraction)

Added (Wave 82 โ€” from squish extraction)

Previous waves (W57โ€“W81)

Extracted with full git history. See git log --oneline for complete wave history.


For full history prior to repo separation, see konjoai/squish git history.