docs: sync project documentation with today's v8.0 wave-1 push

[beenuar]

Summary

Brings every cross-cutting doc surface in line with the 21 PRs that landed on main on 2026-05-14, anchored by the v8.0 architectural foundation (PR #125) and the security + correctness wave that followed it. No code changes — pure documentation sync.

What changed

• CHANGELOG.md — new [Unreleased] block covering:
  • v8.0 architectural foundation (graph at ingest, four-agent rebrand, /hunt, sixteen connectors, automation maturity, public scoreboard) — PR feat(v8.0): graph at ingest, four-agent rebrand, /hunt, 16 connectors, public benchmark #125
  • Security hardening wave — PRs fix(rule-engine): eliminate eval() RCE in Sigma condition parser (C-1) #116, fix(api): scope /hunts queries by tenant_id (C-2) #117, fix(api): tenant-isolate every /cases query and case_number resolver (P2-W1) #118, fix(cors): lock down CORS across all services with AISOC_CORS_ORIGINS allow-list (P2-A1) #119, fix(agents): SSRF guard for playbook http_request and notify (P2-W7) #120, fix(api): harden plugin manager OCI install path (H-3) #121, fix(dev-mode): unify is_dev_env() helper + startup invariant (H-8 + P2-A3) #127, fix(agents): sanitize untrusted enrichment + alert text before LLM (M-9) #128
  • Python CodeQL alerts driven to zero on main — PRs chore(security): resolve all open CodeQL python alerts #133, fix(security): resolve final 2 CodeQL alerts (#440, #441) #136, fix(security): resolve CodeQL alert #442 (waitlist log injection) #137
  • UEBA env-var alignment (first community contribution, closes [Bug]: UEBA service ignores docker-compose environment variables due to env_prefix mismatch #134) — PR fix(ueba): pick up docker-compose env vars instead of falling back to defaults #135
  • Issues [Bug]: aisoc serve fails on fresh clone - ghcr.io/beenuar/aisoc-{honeytokens,purple-team}:latest deny pull, no fallback to local build #131 + [Bug]: 13 security & UI issues found via code review + live site inspection #130 — security smoke + UX cleanup — PR fix(security+ux): resolve #131 + 13 issues from #130 review #132
  • Playbook engine correctness pass — PR fix(agents/playbook): correctness pass on engine evaluation + flattening #129
• README.md — new v8.0 wave-1 (on main, not yet tagged) entry in the version-history section; Next block rewritten as v8.0 wave-2. Version badge intentionally not bumped (still 7.3.1) because wave-1 is on main but not tagged.
• AGENTS.md — new v8.0 wave-1 block under "Learned Workspace Facts": four-agent topology, /hunt surface, connector inventory, L0–L4 maturity ladder, security-wave outcomes, CodeQL hygiene patterns, UEBA dual-alias env-var convention.
• AISOC_V8_PROGRESS.md — Status block refreshed to record that PR feat(v8.0): graph at ingest, four-agent rebrand, /hunt, 16 connectors, public benchmark #125 shipped at b854010e on 2026-05-14, list the 12 post-merge PRs that landed on main after it, and clarify that wave-2 is the still-tracked [~] work.
• apps/docs/docs/deployment/env-vars.md — UEBA section rewritten around the dual-alias rule (unprefixed wins over UEBA_-prefixed, matches every other Python service and the docker-compose.yml exports). Table now lists canonical + legacy names side by side.
• apps/docs/docs/operations/security.md — new Static analysis (CodeQL) section documenting the zero-alert CI gate and the two reusable patterns from the sweep (inline-at-call-site sanitisation for py/log-injection, single import style for py/import-and-import-from).

Verification

• git diff --stat shows 141 insertions / 28 deletions across 6 files
• Every doc link inside the new content was verified against the filesystem (apps/docs/docs/architecture/graph-schema.md, apps/docs/docs/console/funnel-kpis.md, apps/docs/docs/concepts/automation-maturity.md, apps/docs/docs/benchmark-scoreboard.mdx, apps/docs/static/data/scoreboard.json, apps/web/content/blog/graph-at-ingest.mdx, apps/web/content/blog/automation-maturity.mdx, apps/web/content/papers/l0-l4-automation-maturity.md — all present on main)
• Code-fence parity checked across all 6 changed files — balanced

Test plan

• Docusaurus build (apps/docs) renders the new env-vars table and new Static analysis (CodeQL) security section without warnings
• No broken internal links to the new sections (anchors: #ueba-service-servicesueba, #static-analysis-codeql)
• Spot-check that the README's v8.0 wave-1 block renders correctly on GitHub

Made with Cursor