Skip to content

v0.3.1 - CTI Fidelity and Integration Reliability

Release date: 2026-08-02

Corrobore v0.3.1 consolidates the compatible work delivered after v0.3.0. It hardens bounded Cypher execution, adds the open-source MEDICAL and RESEARCH domain packs, strengthens evidence-aware CTI import and deterministic STIX export, and makes the report-to-STIX journey a reproducible release gate. It also restores the published interactive API reference and prevents duplicate OpenAPI path keys from breaking Swagger UI again.

Highlights

Safer, more expressive Cypher execution

  • Cypher values now preserve native metadata and typed lists across the HTTP, shared-runtime, parser, planner, executor, and graph boundaries.
  • Parameter binding is structural rather than text substitution, preventing query-shape injection through parameter values.
  • Parser and executor work is bounded by explicit runtime budgets, including expression depth, list size, traversal work, and result shaping.
  • HTTP and embedded behavior share regression contracts for parameter safety, typed values, mutations, and lifecycle behavior.

Delivered by PR #85 and PR #124.

Open-source MEDICAL and RESEARCH domain packs

  • Adds MIT-licensed domain-medical and domain-research crates with explicit node and relationship vocabularies, fail-closed validation, deterministic built-ins, and byte-stable exporters.
  • Adds separately loadable provider libraries for the ABI v1 host so both packs can be deployed together without duplicate exported symbols.
  • MEDICAL preserves the distinction between evidence level and confidence and excludes identifiable participant records and treatment recommendations.
  • RESEARCH models citations, replication, retraction, supersession, and reproducibility signals without producing prestige, authority, or quality scores.
  • Both packs are reachable through POST /v1/domains/{domain}/validate without an enterprise license gate; provider readiness and capability checks still apply.

Delivered by PR #95, PR #96, PR #97, and PR #99.

Evidence-aware CTI import and deterministic export

  • STIX import retains typed candidate metadata, evidence references, source digests, and page, paragraph, or table-cell locators through persistence and restart.
  • Relationship mutations now participate in the same applied, duplicate, rejected, and quarantined accounting as node mutations.
  • CTI export preserves canonical STIX identity and scope, rejects dangling or out-of-scope references in strict mode, and remains deterministic across replay and restart.
  • A sanitized, MIT-licensed report-to-STIX corpus exercises import, native CTI validation, named corrections, relationship promotion, strict export, duplicate replay, and byte-identical persistent restart.

Delivered by PR #122, PR #123, PR #127, and PR #128.

Operator documentation and demonstration data

  • Adds a lifecycle guide for agent memory covering record, validation, challenge, consolidation, trace, and forgetting without silently replacing contradictory claims.
  • Adds the opt-in corrobore-demo loader for disposable Elastic-free OpenCTI evaluation environments. Normal stack startup never imports the dataset.
  • Keeps expensive Elastic-free compatibility gates available through explicit workflow dispatch while normal pull requests retain bounded contract checks.

Delivered by PR #113, PR #121, and PR #126.

Restored API reference

  • Consolidates the duplicated /v1/opencti/files OpenAPI entry into one schema matching the tagged operation: enqueue|delete request accepted by the server.
  • Removes the corresponding duplicated HTTP-guide section.
  • Adds a documentation contract that reports every duplicate OpenAPI path with its source lines before MkDocs can deploy a broken Swagger UI.
  • Publishes the release-note consistency contract as part of the docs workflow.

Delivered by issue #129.

Contracts

API and compatibility

  • Workspace-owned packages and /version report 0.3.1.
  • The high-level memory API remains contract_version: "v1"; the v0.3.1 release does not require memory-operation clients to change their payloads.
  • The OpenAPI document remains 3.1 and now reports info.version: 0.3.1.
  • POST /v1/opencti/files accepts exactly one tagged command shape: {"operation":"enqueue","descriptor":{...}} or {"operation":"delete","file_ids":[...]}.
  • The storage compatibility boundary remains manifest version V1 and record format JsonLinesV1; no data-format migration is introduced.

Security and evidence

  • Cypher parameters cannot add syntax or alter the parsed query structure.
  • Runtime limits apply before untrusted requests can create unbounded parse, traversal, mutation, or response work.
  • Evidence locators and source digests are provenance metadata. They do not by themselves prove that a candidate is correct or eligible for CTI export.
  • Strict STIX export fails closed on unresolved validation, identity, scope, or reference errors instead of silently dropping them.

Release automation

  • A v0.3.1 tag on the merged release commit is configured to build and test native archives for Linux, macOS, and Windows, then attach checksums and the Elastic-free OpenCTI distribution to the GitHub release.
  • Container publication is handled by its separate Docker workflow and must be verified independently; this note does not claim an image exists before the tagged workflow succeeds.

Upgrade notes

From v0.3.0

  1. Take and validate a coherent snapshot before replacing a persistent deployment. Keep the previous binary or image until application acceptance completes.
  2. Stop v0.3.0 cleanly and verify that it released exclusive ownership of the persistent directory. Never run two versions against the same directory.
  3. Start v0.3.1 with the same storage compatibility settings; no record-format migration is required. Verify /health/live, /health/ready, /version, /metrics, and a read-only application probe before restoring traffic.
  4. Rebuild optional MEDICAL or RESEARCH provider libraries and update their manifest version and digest together. The provider host rejects a stale or mismatched digest before accepting traffic.
  5. If clients use /v1/opencti/files, confirm they send the tagged operation field. The restored OpenAPI page now documents the runtime request shape.
  6. Re-run CTI import/export acceptance for deployments that depend on custom providers or correction rules; retain the source evidence and exported checksums with the rollout record.

Dependency updates in this release are locked in Cargo.lock. Downstream Rust embedders should rebuild from the tag rather than combining a v0.3.1 manifest with an older lockfile.

Known boundaries

  • Corrobore does not parse PDF files and does not run OCR or LLM extraction. The report-to-STIX gate begins with already-extracted structured candidates; document extraction remains an upstream responsibility.
  • The MEDICAL pack is not a medical device or clinical decision-support system and does not return treatment recommendations.
  • The RESEARCH pack does not perform misconduct detection, statistical meta-analysis, bibliometric ranking, or full-text redistribution.
  • The corrobore-demo OpenCTI dataset is opt-in and non-production. Replaying it can overwrite analyst changes to the same demonstration identifiers.
  • The Elastic-free OpenCTI medium profile remains conditional on its declared performance evidence; the supported small single-node profile is the default.
  • Corrobore remains a single-node structured graph-memory runtime, not a distributed graph database and not a full openCypher implementation.

Validation and provenance

Release preparation is accepted only after the merged release commit passes:

  • OpenAPI duplicate-path, runtime/docs alignment, release-note, and strict MkDocs contracts;
  • Rust formatting, workspace check, Clippy with warnings denied, and complete workspace tests;
  • the report-to-STIX acceptance gate and the repository's bounded standalone and Elastic-free contract workflows;
  • release asset builds on every declared platform with version/revision checks.

The v0.3.1 tag must identify that exact merged commit. GitHub archives, checksums, the Elastic-free distribution, and any separately published container image are release evidence only after their workflows finish successfully.

Full comparison

See every merged change in v0.3.0...v0.3.1.