moov-io/watchman v1.0.2

Release v1.0.2

on GitHub

Watchman 1.0.2 is the first 1.0 cut with working GitHub release artifacts. v1.0.0 and v1.0.1 did not finish Create Release (no binaries or images).

Watchman 1.0 is the v2 sanctions screening engine. Screening is GET /v2/search. Each result is the list record with match (0 to 1) on the same object.

What 1.0 freezes

• API: GET /v2/search with type, name, IDs (gov_passport=COUNTRY:NUMBER), dates, and addresses. There is no JSON POST body on that path.
• Identity vs evidence: a matching passport, national ID, IMO/MMSI, aircraft serial, or crypto address (with country) can score 1.0. A matching tax number, company registration, email, or phone raises the score; it does not force 1.0. Two IDs of the same type that disagree lower the blended score (ID_CONFLICT_PENALTY_MULTIPLIER, default 0.70).
• Cutoff: minMatch is policy. 0.80 is the usual production queue (precision ~0.99 on OpenSanctions subject pairs). Default minMatch remains 0 so 0.x callers keep the same page of results unless they pass a cutoff.
• Ingest: every uploaded row is loaded into the in-memory search index. A per-source checksum avoids scanning the table on every query.
• Ops: authentication belongs at a reverse proxy. Embeddings stay off until you configure a provider (qwen3-embedding:0.6b via Ollama is the measured pick). MCP is experimental.

Using Watchman: https://moov-io.github.io/watchman/using-watchman/
For compliance and risk: https://moov-io.github.io/watchman/methodology/for-compliance/

Search

• search: stop forcing 1.0 on tax IDs and contact matches
• search: penalize conflicting government IDs
• search: recast person/business/organization type mismatches (vessel/aircraft stay a hard zero)
• ingest: index all ingested rows with a checksum cache by @adamdecaf in #912
• pkg/recordlink: public Keys and Prefixes for hashed blocking by @adamdecaf in #909

Docs and evaluation

• docs: Using Watchman guide, first-search at minMatch=0.80 (OFAC SDN 48603 + passport → 1.0)
• docs: compliance briefing, OpenSanctions Pairs tables (precision/recall; drop F1 from public pages)
• research: OpenSanctions Pairs evaluator and results by @adamdecaf in #903
• build: ship Linux and macOS GitHub releases with libpostal

Fixes

• makefile: DIST_GOTAGS is a make variable, not a clean recipe (Docker Hub / OpenShift make clean on Create Release)
• makefile: sudo make for libpostal so data can be written under /usr/local/share on Ubuntu
• ci: install autoconf/automake on macOS before libpostal (autoreconf)
• ci: Create Release matrices use fail-fast: false
• webui: omit request path from wasm compression log (CWE-117)
• deps: rubyzip 3.7.0 (GHSA-47m2-wp7j-p9vc)
• test: split geocoding Success tests into mock and live; keep OFAC methodology page nav
• ci: GitHub releases are latest, not prerelease

Full Changelog: v0.69.0...v1.0.2