PIDL v0.6.0 Release Notes¶

Release Date: 2026-09-13

This release adds flow verification provenance for incident attack-flows — a way to record how well-substantiated each step is and where it is sourced from — along with renderer badges and an analyzer rule, plus a comprehensive AIDLC workflow process-specification example.

Highlights¶

Flow.Verification records evidentiary provenance: a verification tier, source, and citation
Verification tiers — reported, corroborated, reproduced, partially_reproduced — matching the aisecurity-incidents deepdive.json vocabulary
d2 and mermaid sequence renderers emit a per-flow provenance badge
A security-analysis rule flags flows below the corroborated tier
New comprehensive AIDLC workflow process-specification example

What's New¶

Flow Verification Provenance¶

Record where an attack-flow step comes from and how well-substantiated it is:

{
  "from": "agent-collective",
  "to": "hugging-face",
  "action": "exploit_worker",
  "verification": {
    "tier": "corroborated",
    "source": "METR",
    "citation": "https://metr.org/..."
  }
}

VerificationTier — reported | corroborated | reproduced | partially_reproduced
FlowVerification { tier, source, citation } on Flow, with a Flow.HasVerification() helper
The schema addition is additive and backward-compatible

See the Flows guide and Specification.

Renderer Provenance Badges¶

d2 and mermaid sequence renderers emit a compact provenance badge per flow (e.g. 🔎 corroborated — METR), gated by SequenceRenderOptions.ShowVerification (on by default).

Analyzer Rule¶

A new security-analysis rule flags flows in agent/attack protocols that lack verification provenance at or above the corroborated tier — surfacing inferred or under-sourced steps in a published attack-flow.

AIDLC Workflow Example¶

A comprehensive AI Development Lifecycle (AIDLC) workflow process specification was added to the examples.

Installation¶

go get github.com/grokify/pidl@v0.6.0