chore: bump to v0.5.3, update roadmap, fix PSSA path injection, harden learning memory save

- Version bump: pyproject.toml + __init__.py → 0.5.3
- CHANGELOG: mark cost tracking (#16), audit reports (#17), crash resilience as shipped
- README: move cost tracking to shipped, add dynamic pricing to roadmap
- prescreen.py: escape single quotes in PSScriptAnalyzer path (command injection fix)
- learning.py: wrap save() in try/except for resilience
- test_e2e_smoke.py: update version assertion to 0.5.3

Author: Akkari

README.md

@@ -206,9 +206,12 @@ I'm working. I'm real. I'm also still growing.
 - Available on PyPI: `pip install quorum-validator` | ClawHub: `openclaw skills add dacervera/quorum`
 
 **What's coming:**
+- Dynamic model pricing updates (`quorum costs update`)
 - More critics (Architecture, Delegation, Style, Tester)
 - Domain-specific rubric packs (compliance, security, infrastructure)
 - Confidence calibration against golden sets
+- Self-validation CI gate (GRAD)
+- **Hardware-backed result protection** — YubiKey KEK/DEK encryption for sensitive validation results, tamper-evident run manifests (SP 800-130/152 aligned)
 - Community rubric contributions
 
 ---

docs/CHANGELOG.md

@@ -42,12 +42,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - [x] Learning memory (Milestone #7)
 - [x] Pre-screen expansion — Ruff, Bandit, PSScriptAnalyzer (Milestone #15)
 - [x] PyPI publish (Milestone #14) — `pip install quorum-validator`
+- [x] **Cost tracking and estimation** (Milestone #16) — per-call token counts via LiteLLM, cumulative run cost in manifest, pre-run estimate, `--max-cost` budget cap, cost report in CLI output
+- [x] **CSV audit reports** (Milestone #17) — per-file SHA-256, timing, token counts, cost breakdown; aggregate summary with median tokens/sec and cost-by-model
+- [x] **Crash-resilient batch validation** — progressive manifest saves, `--resume`, graceful SIGTERM/SIGINT shutdown
 - [ ] Architecture critic (Milestone #9)
 - [ ] Tester critic (Milestone #10)
 - [ ] Confidence calibration (Milestone #6b)
 - [ ] Delegation critic (Milestone #11)
 - [ ] Style critic (Milestone #12)
 - [ ] Self-validation graduation (GRAD)
+- [ ] **Hardware-backed result protection** (Milestone #18) — YubiKey KEK wrapping per-run DEKs, encrypted-at-rest validation results, HMAC tamper evidence over run manifests. For sensitive security assessments where findings themselves are high-value targets. CKMS-aligned (SP 800-130/152 principles applied to the validation pipeline)
 
 ---
 

reference-implementation/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "quorum-validator"
-version = "0.5.2"
+version = "0.5.3"
 description = "Multi-critic quality validation for agents, research, and configurations"
 authors = [
     {name = "Daniel Cervera", email = "daniel@sharedintellect.com"},

reference-implementation/quorum/__init__.py

@@ -9,5 +9,5 @@
 specialized critics, each required to provide grounded evidence.
 """
 
-__version__ = "0.5.2"
+__version__ = "0.5.3"
 __all__ = ["__version__"]

reference-implementation/quorum/learning.py

@@ -64,12 +64,15 @@ def load(self) -> list[Issue]:
 
     def save(self, issues: list[Issue]) -> None:
         """Write issues to JSON using atomic tmp+rename to prevent corruption."""
-        self._path.parent.mkdir(parents=True, exist_ok=True)
-        data = [issue.to_dict() for issue in issues]
-        tmp = self._path.with_suffix(".tmp")
-        tmp.write_text(json.dumps(data, indent=2, default=str), encoding="utf-8")
-        tmp.replace(self._path)
-        logger.debug("Saved %d known issues to %s", len(issues), self._path)
+        try:
+            self._path.parent.mkdir(parents=True, exist_ok=True)
+            data = [issue.to_dict() for issue in issues]
+            tmp = self._path.with_suffix(".tmp")
+            tmp.write_text(json.dumps(data, indent=2, default=str), encoding="utf-8")
+            tmp.replace(self._path)
+            logger.debug("Saved %d known issues to %s", len(issues), self._path)
+        except Exception as e:
+            logger.warning("Failed to save learning memory to %s: %s", self._path, e)
 
     def update_from_findings(
         self,

reference-implementation/quorum/prescreen.py

@@ -834,8 +834,10 @@ def _run_pssa(self, artifact_path: Path, artifact_text: str) -> list[Finding]:
         }
 
         try:
+            # Escape single quotes in path to prevent PowerShell command injection
+            escaped_path = str(artifact_path).replace("'", "''")
             ps_command = (
-                f"Invoke-ScriptAnalyzer -Path '{artifact_path}' "
+                f"Invoke-ScriptAnalyzer -Path '{escaped_path}' "
                 "-Severity Warning,Error | ConvertTo-Json"
             )
             result = subprocess.run(

reference-implementation/tests/test_e2e_smoke.py

@@ -44,7 +44,7 @@ def test_quorum_cli_version(self):
         runner = CliRunner()
         result = runner.invoke(cli, ["--version"])
         assert result.exit_code == 0
-        assert "0.5.1" in result.output
+        assert "0.5.3" in result.output
 
     @pytest.mark.smoke
     def test_validate_example_research(self, tmp_path):