@clear-capabilities/agentic-security-scanner 0.177.0 → 0.178.0

package/CHANGELOG.md

@@ -9,6 +9,22 @@
 > make the history less accurate, not more.
 
 
+## 0.178.0 - Autonomous Security Assurance: documentation repositioning
+
+Documentation and documentation tooling only. No scanner behavior changed, no benchmark claim was added, and no capability was promoted to GA.
+
+- **Repositioned** from "agentic security harness / scanner" to an **Autonomous Security Assurance Platform for the AI Software Era**, organised around one canonical ten-stage lifecycle (`Discover → Corroborate → Prove → Learn → Scale → Observe → Trace → Fix → Verify → Detect`). The operational finding workflow is documented as a subset of it. "Agentic security harness" stays in SEO metadata and comparison material.
+- **`docs/capabilities.yaml`** is the single source of truth for GA, Preview, Labs and Roadmap: 37 capabilities (12 GA, 15 Preview, 7 Labs, 3 Roadmap), assigned conservatively from the code, tests and status pages as of 0.177.0. Detect and respond (`dnr`), the Eval Lab and release assurance are Labs; connected production detection, live runtime observation and the security learning rate metric are Roadmap. A GA, Preview or Labs capability must name implementation evidence that exists; a Roadmap capability must name none.
+- **README rewritten**: the hero, the trust statement (including the measured, low independent accuracy), the traditional-versus-agentic view, a generated lifecycle table and a generated capability snapshot, Code Boundaries promoted as the security graph underneath, the eight role lanes, and the command inventory regrouped by lifecycle goal. The detailed material that left the README is preserved in `docs/reference/capability-reference.md`.
+- **New documentation tree**: `quickstart/`, `how-it-works/`, ten lifecycle stage pages, `security-graph/`, a Trust area (trust and limitations, scan health, assurance modes, verified remediation, agent threat model, model egress, benchmarking methodology), eight role pages including new CISO and Detection Engineering lanes, `workflows/` including **One Finding's Journey** (a real demo-app finding through all ten stages with captured output, including the stages that honestly did not run), integrations, labs and roadmap areas, and a website content package under `docs/website/` (no website source exists in the repository).
+- **No page moved or deleted.** `docs/DOCS-MIGRATION.md` maps every existing path and README section to where it lives now. Existing guides that back a capability gained a `**Maturity:**` line.
+- **Six reusable SVGs** in `docs/assets/positioning/`, with alt text and maturity written out in text rather than color alone, and no quantitative claims.
+- **`docs/STYLE-AND-TERMINOLOGY.md`**: the vocabulary, the one lifecycle ordering, the "verified" and "proven" rules, and the avoid-list.
+- **`scripts/check-positioning-docs.mjs`** (npm: `docs:check-positioning`, `docs:positioning` to regenerate tables), run by `check-doc-drift.mjs --gate`, which the release gate's `doc-links` check runs. It fails closed on: an invalid maturity or stage, missing evidence, a stale generated table, a page whose maturity contradicts the registry, a Roadmap capability described as shipped, a documented command or subcommand that does not exist, a non-canonical lifecycle ordering, avoid-list words and em-dashes in owned pages, broken links and heading anchors, role pages more than two clicks from docs home, and SVGs without alt text, spelled-out maturity or with percentages. A check that cannot run is a finding, not a skip. Tests prove each rule in both directions.
+- `.gitignore` now also ignores a root `*.PRD` or `*.prd` working document, the same convention as the existing `-PRD.md` patterns.
+
+Not changed here: the plugin and marketplace manifest descriptions and the session banner still carry the older wording. They are shipped metadata, outside this change's scope.
+
 ## 0.177.0 - Moat PRDs, second pass: what a re-read of the PRD still required
 
 - **Rule compiler: the IR is enforced, and promotion is honest.** Source, propagator, sink, sanitizer, dominating guard, framework constraint and exclusions are regular expressions the matcher enforces (they were free-text hints it ignored). A sanitizer is local to the hit it guards, not file-wide. Scoring goes through the scanner's own rule loader, so a rule the loader would refuse is rejected at compile time. A shared false-positive corpus is part of the promotion gate and `rules regress` re-scores every promoted rule. Found by trying the flow without test-only overrides: `rules promote` published an unsigned pack that the scanner refuses, so a "promoted" rule found nothing; promote now signs with `--sign-key`, says whether the scanner will load the rule, and `rules status` shows `live`. Underneath it, rule-pack signing was broken on current Node ("Invalid JWK OKP key") and is fixed.

package/README.md

@@ -1,6 +1,6 @@
 # @clear-capabilities/agentic-security-scanner
 
-The scan engine behind the [agentic-security](https://github.com/Clear-Capabilities/agentic-security) Claude Code plugin: SAST, SCA with function-level reachability and CISA KEV, secrets, IaC, prompt-injection and MCP/agent-tool audit, auth/authZ analysis, SBOM/AI-BOM, and compliance evidence.
+The scan engine behind [Agentic Security](https://github.com/Clear-Capabilities/agentic-security), an autonomous security assurance platform (a Claude Code plugin and CLI) that pairs deterministic analysis with security agents and never treats an incomplete scan as a clean one. See [how it works](https://github.com/Clear-Capabilities/agentic-security/blob/main/docs/how-it-works/assurance-lifecycle.md) and [trust and limitations](https://github.com/Clear-Capabilities/agentic-security/blob/main/docs/trust/trust-and-limitations.md). The engine provides: SAST, SCA with function-level reachability and CISA KEV, secrets, IaC, prompt-injection and MCP/agent-tool audit, auth/authZ analysis, SBOM/AI-BOM, and compliance evidence.
 
 ```bash
 npx @clear-capabilities/agentic-security-scanner scan .