@clear-capabilities/agentic-security-scanner 0.177.0 → 0.179.0

package/CHANGELOG.md

@@ -9,6 +9,33 @@
 > make the history less accurate, not more.
 
 
+## 0.179.0 - Faster releases: checks run at commit time, and the release gate stops repeating itself
+
+Release tooling only. No scanner behavior changed. The last full release took 68 minutes: push 15.5, hosted CI wait 14.5, local release gate 25, hosted release workflow 8, npm 4.5. Two changes cut the local share, and nothing the hosted gate proves was removed.
+
+- **Background gate warm-up.** `.githooks/post-commit` starts `scripts/gate-warm.mjs --start`: a detached, low-priority run of the same pre-push gate (`pre-push-gate.mjs --force`) for the commit just made, recording passes in the same signed verdict cache, so `git push` reuses them. `npm run gate:status` (exit 0 passed, 1 failed, 2 running, 3 nothing usable for HEAD) and `npm run gate:wait` show or await it. It is not a second gate: an amend, rebase, edit or different Node changes the cache key and the push runs the gate in full. It does not start in CI, during a rebase, merge, cherry-pick or bisect, or with `AGENTIC_SECURITY_NO_GATE_WARM=1`.
+- **Commit-time preparation.** `.githooks/pre-commit` runs `scripts/pre-commit-prepare.mjs`: it rebuilds `scanner/dist` and stages it when a build input is staged (the bundle embeds `package.json`), and regenerates the generated docs tables when a docs page is staged. A partial commit of build inputs is refused. `--no-verify` and `AGENTIC_SECURITY_NO_PRECOMMIT=1` skip it.
+- **`ship` uses both.** Before pushing it asks for the background verdict: a recorded failure stops it at once with the check names, a running warm-up is awaited, a pass lets the push reuse it.
+- **The local release gate no longer repeats what the pre-push gate proved.** When the released commit has the PR head's identical tree and the push output recorded `pre-push gate PASSED` for exactly that head, `verify` runs every check except the ten the pre-push gate already ran (`PROVEN_BY_PRE_PUSH` in `scripts/ship/lib.mjs`). The publish blockers (changelog entry, dependency currency, remote CI, version, scorecard), the full release closure and the time and memory gates still run locally. Otherwise the whole gate runs. The hosted release workflow still runs every check with the cache off and its publish job needs all of them.
+
+Measured effect is not yet known: this release is the first to use them. The expected saving is about 20 of the 25 local-gate minutes, plus the push wait when the warm-up has finished.
+
+## 0.178.0 - Autonomous Security Assurance: documentation repositioning
+
+Documentation and documentation tooling only. No scanner behavior changed, no benchmark claim was added, and no capability was promoted to GA.
+
+- **Repositioned** from "agentic security harness / scanner" to an **Autonomous Security Assurance Platform for the AI Software Era**, organised around one canonical ten-stage lifecycle (`Discover → Corroborate → Prove → Learn → Scale → Observe → Trace → Fix → Verify → Detect`). The operational finding workflow is documented as a subset of it. "Agentic security harness" stays in SEO metadata and comparison material.
+- **`docs/capabilities.yaml`** is the single source of truth for GA, Preview, Labs and Roadmap: 37 capabilities (12 GA, 15 Preview, 7 Labs, 3 Roadmap), assigned conservatively from the code, tests and status pages as of 0.177.0. Detect and respond (`dnr`), the Eval Lab and release assurance are Labs; connected production detection, live runtime observation and the security learning rate metric are Roadmap. A GA, Preview or Labs capability must name implementation evidence that exists; a Roadmap capability must name none.
+- **README rewritten**: the hero, the trust statement (including the measured, low independent accuracy), the traditional-versus-agentic view, a generated lifecycle table and a generated capability snapshot, Code Boundaries promoted as the security graph underneath, the eight role lanes, and the command inventory regrouped by lifecycle goal. The detailed material that left the README is preserved in `docs/reference/capability-reference.md`.
+- **New documentation tree**: `quickstart/`, `how-it-works/`, ten lifecycle stage pages, `security-graph/`, a Trust area (trust and limitations, scan health, assurance modes, verified remediation, agent threat model, model egress, benchmarking methodology), eight role pages including new CISO and Detection Engineering lanes, `workflows/` including **One Finding's Journey** (a real demo-app finding through all ten stages with captured output, including the stages that honestly did not run), integrations, labs and roadmap areas, and a website content package under `docs/website/` (no website source exists in the repository).
+- **No page moved or deleted.** `docs/DOCS-MIGRATION.md` maps every existing path and README section to where it lives now. Existing guides that back a capability gained a `**Maturity:**` line.
+- **Six reusable SVGs** in `docs/assets/positioning/`, with alt text and maturity written out in text rather than color alone, and no quantitative claims.
+- **`docs/STYLE-AND-TERMINOLOGY.md`**: the vocabulary, the one lifecycle ordering, the "verified" and "proven" rules, and the avoid-list.
+- **`scripts/check-positioning-docs.mjs`** (npm: `docs:check-positioning`, `docs:positioning` to regenerate tables), run by `check-doc-drift.mjs --gate`, which the release gate's `doc-links` check runs. It fails closed on: an invalid maturity or stage, missing evidence, a stale generated table, a page whose maturity contradicts the registry, a Roadmap capability described as shipped, a documented command or subcommand that does not exist, a non-canonical lifecycle ordering, avoid-list words and em-dashes in owned pages, broken links and heading anchors, role pages more than two clicks from docs home, and SVGs without alt text, spelled-out maturity or with percentages. A check that cannot run is a finding, not a skip. Tests prove each rule in both directions.
+- `.gitignore` now also ignores a root `*.PRD` or `*.prd` working document, the same convention as the existing `-PRD.md` patterns.
+
+Not changed here: the plugin and marketplace manifest descriptions and the session banner still carry the older wording. They are shipped metadata, outside this change's scope.
+
 ## 0.177.0 - Moat PRDs, second pass: what a re-read of the PRD still required
 
 - **Rule compiler: the IR is enforced, and promotion is honest.** Source, propagator, sink, sanitizer, dominating guard, framework constraint and exclusions are regular expressions the matcher enforces (they were free-text hints it ignored). A sanitizer is local to the hit it guards, not file-wide. Scoring goes through the scanner's own rule loader, so a rule the loader would refuse is rejected at compile time. A shared false-positive corpus is part of the promotion gate and `rules regress` re-scores every promoted rule. Found by trying the flow without test-only overrides: `rules promote` published an unsigned pack that the scanner refuses, so a "promoted" rule found nothing; promote now signs with `--sign-key`, says whether the scanner will load the rule, and `rules status` shows `live`. Underneath it, rule-pack signing was broken on current Node ("Invalid JWK OKP key") and is fixed.

package/README.md

@@ -1,6 +1,6 @@
 # @clear-capabilities/agentic-security-scanner
 
-The scan engine behind the [agentic-security](https://github.com/Clear-Capabilities/agentic-security) Claude Code plugin: SAST, SCA with function-level reachability and CISA KEV, secrets, IaC, prompt-injection and MCP/agent-tool audit, auth/authZ analysis, SBOM/AI-BOM, and compliance evidence.
+The scan engine behind [Agentic Security](https://github.com/Clear-Capabilities/agentic-security), an autonomous security assurance platform (a Claude Code plugin and CLI) that pairs deterministic analysis with security agents and never treats an incomplete scan as a clean one. See [how it works](https://github.com/Clear-Capabilities/agentic-security/blob/main/docs/how-it-works/assurance-lifecycle.md) and [trust and limitations](https://github.com/Clear-Capabilities/agentic-security/blob/main/docs/trust/trust-and-limitations.md). The engine provides: SAST, SCA with function-level reachability and CISA KEV, secrets, IaC, prompt-injection and MCP/agent-tool audit, auth/authZ analysis, SBOM/AI-BOM, and compliance evidence.
 
 ```bash
 npx @clear-capabilities/agentic-security-scanner scan .

package/dist/{37d64df006576248d0d8.json → 711e5445a9cfc412086b.json}

@@ -1,6 +1,6 @@
 {
   "name": "@clear-capabilities/agentic-security-scanner",
-  "version": "0.177.0",
+  "version": "0.179.0",
   "description": "Scanner engine for the agentic-security Claude Code plugin: SAST, SCA with reachability and CISA KEV, secrets, IaC, Haskell and Nix/NixOS, prompt-injection, MCP/agent-tool audit, authZ analysis, SBOM, compliance attestation, and more.",
   "type": "module",
   "main": "src/index.js",
@@ -130,7 +130,7 @@
     "verification:conformance:check": "node ../scripts/verification-conformance-check.mjs",
     "verification:conformance:static": "node ../scripts/verification-conformance-check.mjs --static",
     "verification:replay-example": "node ../scripts/verification-replay-example.mjs",
-    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
+    "test:lifecycle": "node --test test/ci-hang-protection.test.js test/ci-test-shards.test.js test/pre-bash-guard.test.js test/lsp-protocol-smoke.test.js test/ide-surfaces.test.js test/detector-liveness.test.js test/bench-watchdog.test.js test/ci-parity.test.js test/dead-code.test.js test/no-dead-modules.test.js test/no-orphan-scripts.test.js test/no-stray-state.test.js test/tree-integrity.test.js test/stop-hook.test.js test/plugin-self-check.test.js test/skills-registry.test.js test/bodyguard.test.js test/cache-invalidator-guard.test.js test/dispatch-pre-tool.test.js test/dispatch-user-prompt.test.js test/session-start-model-capture.test.js test/sandbox.test.js test/sandbox-escape.test.js test/trust-boundary.test.js test/ci-templates.test.js test/agent-mcp-tools.test.js test/triage-command.test.js test/no-orphan-tests.test.js test/supply-command.test.js test/posture-command.test.js test/labs-command.test.js test/compliance-command.test.js test/check-doc-drift.test.js test/gate-warm.test.js test/docs-positioning.test.js test/dist-chunks-tracked.test.js && node ../scripts/lint-command-descriptions.mjs test/workflow-confinement.test.js test/check-bundle-source.test.js test/ship.test.js test/release-prepare.test.js",
     "test:eval": "node --test test/independent-eval.test.js test/realworld-recall.test.js",
     "test:discovery": "node --test test/discovery-partition.test.js test/discovery-lenses.test.js test/discovery-hunter.test.js test/discovery-confirm.test.js test/discovery-disprove.test.js test/discovery-judge.test.js test/discovery-run.test.js test/discovery-wiring.test.js test/discovery-llm-invoke.test.js test/local-only-mode.test.js test/context-intelligence/build-js.test.js test/context-intelligence/build-python-haskell.test.js test/context-intelligence/hie-adapter.test.js test/context-intelligence/store.test.js test/context-intelligence/review-queue.test.js test/context-intelligence/packer-egress.test.js test/context-intelligence/evaluation.test.js test/context-intelligence/queue-diff.test.js test/context-intelligence/cli.test.js test/context-intelligence/resilience.test.js test/context-intelligence/frameworks.test.js test/context-intelligence/skew-git-rls.test.js test/context-intelligence/premortem.test.js test/context-intelligence/git-diff-candidates.test.js",
     "eval:independent": "node ../bench/independent-eval/runner.mjs",
@@ -242,6 +242,10 @@
     "scorecard:check": "node ../scripts/scorecard-check.mjs",
     "release:check": "node ../scripts/release-check.mjs",
     "release:check:fast": "node ../scripts/release-check.mjs --fast",
+    "gate:warm": "node ../scripts/gate-warm.mjs --start",
+    "gate:status": "node ../scripts/gate-warm.mjs --status",
+    "gate:wait": "node ../scripts/gate-warm.mjs --wait",
+    "precommit:prepare": "node ../scripts/pre-commit-prepare.mjs",
     "gate:prepush": "node ../scripts/pre-push-gate.mjs",
     "gate:trace": "node ../scripts/gate-trace-reads.mjs",
     "gate:prepush:install": "node ../scripts/pre-push-gate.mjs --install-hook",
@@ -258,6 +262,8 @@
     "docs:render-language": "node ../scripts/render-language-docs.mjs",
     "docs:capture-language": "node ../scripts/capture-language-examples.mjs",
     "completion-status": "node ../scripts/write-completion-status.mjs",
+    "docs:check-positioning": "node ../scripts/check-positioning-docs.mjs",
+    "docs:positioning": "node ../scripts/check-positioning-docs.mjs --write",
     "docs:check-language": "node ../scripts/render-language-docs.mjs --check && node ../scripts/capture-language-examples.mjs --check",
     "test:nixos-host": "node --test test/nix/nixos-host-runtime.test.js",
     "test:language-gates": "node --test --test-concurrency=1 test/language/language-benchmark-gates.test.js",