* feat(worker): record token, cache, and turn usage per agent
* feat: replace model tiers with a single SHANNON_AI_MODEL across five providers
* feat(cli): rebuild the setup wizard for provider and model selection
* docs: document single-model selection and supported providers
* feat(worker): use chat completions for OpenAI behind a custom base URL
* feat: add SHANNON_AI_OPENAI_FORMAT to pick the wire API for OpenAI gateways
* refactor(cli): drop endpoint path hints from the gateway format picker
* feat(worker): enable pi in-session provider retry with retry-after backoff
* refactor(worker): hand provider error classification to pi and drop the Anthropic ladders
* refactor: remove the subscription retry preset and pipeline config section
* fix(worker): validate Bedrock credentials with the same live probe as other providers
* feat(worker): render the report from structured findings instead of agent-written markdown
* fix(worker): dispose the credential probe session on every path
* fix(worker): refuse to replace the assembled report with an empty one
* refactor(worker): catch post-processing throws across the whole finalization block
* revert(worker): drop the report zero-findings guard
* docs(worker): correct the retry split and Bedrock credential claims
* docs: regenerate llms-full.txt from current sources
* feat(cli): build and run the npx flow from a clone
* refactor(cli): flatten the setup summary output
* feat(cli): reject runs with more than one provider configured
* fix(worker): say a rejected bash call never ran
* chore(cli): drop grok-4.3 and gpt-5.6-luna from the setup suggestions
* feat(worker): capture structured finding locations for SARIF output
* fix(worker): enumerate queue confidence so the report inherits it verbatim
* feat(worker): give the reporting phase a mode-specific output schema
* feat(worker): emit a SARIF 2.1.0 log for exploitative runs
* fix(worker): correct SARIF locations and defer fingerprinting to the upload action
* fix(worker): drop the confidence suffix from the analysis-mode summary list
* feat(worker): give exploit findings a dedicated code location field
* feat(worker): carry structured code locations from the vuln queue to the report
* fix(worker): join code locations from the vuln queue instead of re-asking agents
* fix(worker): spell out the finding_id to category mapping in the tool schema
* feat: drop Google/Gemini as a supported AI provider
* fix(worker): stop asking the report agent for code locations
* docs: correct the provider list and drop the removed rate-limit settings
* docs: add provider cyber safeguards and suggested models per provider
* docs: document the SARIF output and the report rating thresholds
Apply the same convention from the README pass across the rest of the
repo content so the company and the product are never conflated:
company -> "Keygraph", commercial product -> "the Keygraph platform".
- docs/keygraph-platform.md: retitle "# Keygraph" -> "# Keygraph Platform"
and refer to the product as "the Keygraph platform" throughout (the
page is the platform overview, not a company page).
- docs/coverage-roadmap.md, docs/safety.md: product references updated;
the "Keygraph is not responsible for misuse" line stays as the company.
- llms.txt / llms-full.txt: kept in sync with the README and docs they
mirror, so the combined-context files don't reintroduce the conflation.
No filenames changed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Replace the README with the marketing-reviewed version and bring the
project onto one consistent naming scheme:
- "Shannon Lite" -> "Shannon" (the open-source CLI is just Shannon)
- "Shannon Pro" -> "Keygraph" (the commercial platform)
- Rename docs/shannon-pro.md -> docs/keygraph-platform.md and fix the
internal link, matching the README's link target.
- Regenerate llms.txt and llms-full.txt from the updated README and docs.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
