v1.0.0

• Add: live MCP tool probing over HTTP transports (scan --probe-mcp --probe-timeout) — real initialize → notifications/initialized → tools/list handshake, opt-in, never fatal on failure, never follows a cross-host redirect, never sends a credential
• Add: definitionScope=probed tools get real descriptionSha256/schemaSha256/descriptionLength/hasImperativeLanguage, widening the same definitionSha256 recipe from v0.11.0 — the description-only rug-pull gap is now closed
• Add: mcp_tool_description_imperative risk rule (medium) — flags a live-probed tool description that reads as model-directed instructions, a real MCP prompt-injection shape
• Add: declaredInConfig on every probed tool, plus mcp_tool_undeclared risk rule (medium) — a server advertising a tool the operator never configured is now a named finding, not silently indistinguishable from an ordinary tool
• Add: scan --spec-version — CycloneDX specVersion is now a flag, default 1.6, 1.7 opt-in; changing the default is a policy-documented major version bump, never silent
• Add: harness-aibom:contractVersion root property — this project's own data-contract version, independent of CycloneDX's own specVersion (named to avoid colliding with it, caught and fixed during the rc period)
• Fix: validate now rejects a specVersion outside this project's supported set — a real CycloneDX schema validator puts no enum on that field, so this project's own check is the only thing that catches a declared/actual mismatch
• Add: SPEC.md contract/deprecation policy section — closes the native-slot question (property namespace stays the 1.x contract) and states the deprecation policy plainly for the first time
• Promoted from v1.0.0rc1, verified end-to-end from a real install off PyPI before this release

v1.0.0rc1

• Add: live MCP tool probing over HTTP transports (scan --probe-mcp --probe-timeout) — real initialize → notifications/initialized → tools/list handshake, opt-in, never fatal on failure, never follows a cross-host redirect, never sends a credential
• Add: definitionScope=probed tools get real descriptionSha256/schemaSha256/descriptionLength/hasImperativeLanguage, widening the same definitionSha256 recipe from v0.11.0
• Add: mcp_tool_description_imperative risk rule (medium) — flags a live-probed tool description that reads as model-directed instructions, a real MCP prompt-injection shape
• Add: scan --spec-version — CycloneDX specVersion is now a flag, default 1.6, 1.7 opt-in; changing the default is a policy-documented major version bump, never silent
• Add: harness-aibom:specVersion root property — this project's own data-contract version, independent of CycloneDX's own specVersion
• Add: SPEC.md contract/deprecation policy section — closes the native-slot question (property namespace stays the 1.x contract) and states the deprecation policy plainly for the first time
• This is a release candidate — pip install agent-harness-aibom (no --pre) ignores it entirely; verify with pip install --pre agent-harness-aibom==1.0.0rc1

v0.11.0

• Add: tool definition pinning, stage 1 of 3 — every MCP tool now gets a definitionSha256 (name-only today, no network/subprocess involved)
• Add: mcp_tool_not_pinned risk rule (low) — flags every tool until real description/schema probing exists (0.12.0/0.13.0)
• Add: compute_tool_pinning_coverage() — a real, separate coverage axis, surfaced in the report's MCP security section
• Add: report --diff now classifies a changed tool definition hash as high severity — the rug-pull signal, ready before probing lands
• Add: canonical JSON hashing recipe pinned in SPEC.md — stable across all three staged releases

v0.10.1

• Add: dead-code check — flags a public function defined but never referenced anywhere else
• Add: redaction test extended to every downstream command (report, report --diff, policy --format sarif, compliance --format json)
• Add: docstring-claims registry — every "never"/"always"/"fully" claim now points at a real, collected test
• Add: CycloneDX schema validation now also checks the real 1.7 schema, not just 1.6
• Add: two new CI jobs — schema-gate and build-and-test-from-artifact (installs the real wheel into a clean venv)

v0.10.0

• Add: report --diff before.json after.json — a dedicated, severity-sorted change report (not one section of the full explorer)
• Add: document identity header (hostnames, timestamps, tool versions) with partial-scan and hostname-mismatch warnings
• Add: diff.diff_documents_with_properties() — the same diff identity as diff, with full properties attached for severity classification
• Add: security findings (new/resolved/persisting) reusing policy --baseline's own diff logic

v0.9.1

• Fix: a wholesale OSV.dev outage now surfaces a root-level warning and fails scan-vulns when every query failed
• Fix: scan-vulns is now idempotent (no duplicate vulnCheck properties, stale vulnerabilities cleared on re-run)
• Fix: compliance --format json now includes a disclaimer field, not just the text-mode output
• Fix: a successful offline sign now explains the cosign TUF warning instead of leaving it unexplained

v0.9.0

• Add: scan-vulns command — real OSV.dev vulnerability lookups into CycloneDX's native vulnerabilities[]
• Add: CycloneDX declarations — narrow, self-assessed coverage claims backed by real computed ratios
• Add: compliance evidence mapping — NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS (real control IDs, evidence-only, never a certification claim)
• Add: confidence tags (observed/inferred) on skill content analysis, sha256, model digest, MCP transport
• Add: evidence chain rendering in the Component Inspector
• Add: optional Ollama /api/show enrichment — prompt-template/tokenizer metadata (doc-verified, not live-server-verified)
• Add: per-instance Dependency graph explorer in the HTML report, collapsed by default
• Add: Raw BOM to Component Inspector cross-navigation (clickable bom-ref links)

v0.8.2

• Fix: pyproject.toml author corrected to the actual author
• Add: SKILL.md YAML frontmatter parsing (real name/description/license/allowed-tools fields)
• Add: scan --verify-deterministic — runs a scan twice, confirms byte-identical output
• Add: diff --security — security-findings diff (new/persisting/resolved), shared with policy --baseline
• Add: policy --format sarif — SARIF 2.1.0 output for code-scanning UIs, schema-validated
• Add: policy --policy-file rules.yaml — policy-as-code with user-authored rules
• Add: sign / verify-signature commands — cosign-based AIBOM signing, key-based and offline
• Add: report --bundle/--key — Artifact integrity section with a real cosign verification
• Add: Trust zones and Capability matrix sections in the HTML report
• Add: Model digest drift callout in the Baseline diff section
• Add: Raw BOM search/highlight in the HTML report

v0.8.0

• Add: AIBOM self-integrity checks in validate — duplicate bom-ref, dangling dependency edges, malformed hashes
• Add: find_orphan_components — components/services unreachable from the harness root, reported as warnings
• Add: Component Inspector in the HTML report — click "Inspect" on any component/service for a focused detail modal
• Docs: SPEC.md §15 documenting the integrity checks and inspector design

v0.7.0

• Fix: risk observations now sorted by severity (high/medium/low), not rule-definition order
• Fix: prompt_surface and memory_store collectors now detect symlinks escaping --home, matching hook's existing behavior
• Add: report --baseline <before.json> renders a Baseline diff section and real added/removed/changed counts in the Security summary
• Add: policy <file> [--fail-on low|medium|high] [--baseline before.json] command for CI gating on named risk rules
• Add: SPEC.md §14 documenting the above; §2 taxonomy table updated with symlink/pathOutsideHome fields