AgentConfigScore v0.24.0

AgentConfigScore v0.24.0

This maintainer-focused Beta release connects concrete lint findings to
reviewable next steps and opt-in PR results. It also hardens path, input and
initialization handling. It is still a local, dependency-free deterministic
linter and baseline-aware regression gate, not a semantic judge or runtime guard.

Install or upgrade

python -m pip install --upgrade "agent-config-score==0.24.0"
agent-config-score --version
agent-config-score . --explain

Expected version: AgentConfigScore 0.24.0. Python 3.10+ is required; Git is
needed for diff. Both console aliases (agent-config-score, acs) and
python -m agent_config_score remain available. There are no runtime dependencies.

What is included

• --explain adds static next steps to active scan/new regression findings in
  text and Markdown. Rule help and an unscored maintainer checklist connect
  findings to a fix/recheck workflow without executing commands or repairing files.
• init --pr-comment generates the tested, opt-in, single bot-comment workflow.
  It discloses pull-requests: write; default initialization keeps read-only
  GitHub permissions. Fork PRs retain job summaries without comments. Setup
  itself makes no GitHub API calls.
• init --workflow-only leaves custom policy and suppression bytes entirely out
  of scope, including under --force. Selected-file and parent checks, exclusive
  creation and opened-file identity checks reduce accidental overwrites.
• guardrails previews narrowly recognized deletion safeguards in one existing
  instruction file. A reviewed addition requires explicit content-bound
  confirmation to append. English, Simplified and Traditional templates are
  available; example sections, ambiguous markup and narrow approval-bypass
  signals can require manual merging. This is unscored, opt-in advice.
• New reports capture the declared version and a best-effort tool-source
  fingerprint. JSON, HTML, SARIF, new history snapshots and feedback retain it;
  comparisons retain both scan identities. Missing source is explicitly unknown.
• Path checks avoid narrowly defined repository-slug/conditional-reference false
  positives, retain package paths under build directories and no longer let
  explicit relative paths pass via unrelated suffix matches.
• Unsafe/unreadable selected sources and path-index traversal failures stop the
  operation instead of silently scoring incomplete input. Comparisons reuse
  scan-captured instruction text. File-removal move exemptions are restricted
  to one-to-one, nonempty exact decoded-text moves within the same directory.
• Optional Simplified
  and Traditional
  repository overviews, core guides and limitations. Advanced references and CLI
  output remain English. The wheel links to, but does not bundle, offline docs.

Upgrade existing integrations deliberately

Pin reproducible CI to LE0-Lin/AgentConfigScore@v0.24.0 or its verified commit.
Rolling @v0 follows releases and can change. Upgrading the local package does
not update an existing workflow's pinned Action revision. Newly generated
workflows use rolling @v0; inspect/pin it before committing.

To adopt PR comments without resetting custom policy, compare the recipe with
your existing workflow, then preview before replacing it:

agent-config-score init --workflow-only --pr-comment --force --dry-run
agent-config-score init --workflow-only --pr-comment --force
agent-config-score doctor

--force replaces the selected workflow, not a YAML merge; do not run it
without reviewing local customizations. Policy is not read or validated in this
mode. Ordinary unscoped init --force still replaces both generated targets.
Keep only one scanning/comment workflow. Initialization and guardrail appends
are not atomic transactions: an I/O failure may leave partial changes. Inspect
before retrying; linked/shared targets can require manual integration.

Existing commands, configuration version 1, stable rule IDs and policy defaults
are unchanged. Report identity is additive; strict JSON consumers must allow
the new metadata. There are no new scored rules in this release, but corrected
path interpretation can change findings/scores. Tighter removal exemptions can
produce new regression-only errors even at 100 on both sides; enable baseline
fail_on_new_errors or --fail-on-new-errors to gate them. A bare CLI comparison
without policy retains its score-only default. Operational failures return exit
2, not a clean result; doctor error checks return 1.

Verification and evidence limits

The release workflow requires the source regression suite, a wheel/source
distribution build and installed-wheel acceptance on Linux, Windows and macOS
before publication. The installed journey covers the new opt-in commands and
exact policy preservation as well as the existing regression/permission cases.

Maintained fixtures, synthetic workflows and package acceptance verify specified
engineering behavior, not independent accuracy or real-user adoption. The
unresolved AI pilot and deferred human annotation remain unscored. Development
reuse of public samples is disclosed; frozen research records and older release
artifacts are unchanged.

An A 100 is not proof of useful or safe instructions. Missing recognized
safeguard text means review needed, not proven danger; adding text does not
increase the score or enforce agent behavior. A source fingerprint is not
execution attestation or a reproducibility guarantee. Read the
limitations,
maintainer guide
and changelog.

AgentConfigScore v0.23.0

AgentConfigScore v0.23.0

This release packages the English core workflow: a dependency-free, local
instruction linter and baseline-aware CI regression gate. It remains Beta.
No accuracy comparison with AI review or independent user validation is claimed.

Install or upgrade

python -m pip install --upgrade "agent-config-score==0.23.0"
agent-config-score --version

Expected version: AgentConfigScore 0.23.0. Python 3.10+ is required; Git is
needed for diff. Both console aliases (agent-config-score, acs) and the
PATH-independent python -m agent_config_score entrypoint are available.

What is included

• Shared Markdown context for more conservative handling of explicit prohibited
  command blocks/lists, matching code fences and command-option parsing.
• Local Markdown-link checks relative to the instruction file.
• Narrow English rules for explicitly false success reports and bulk environment
  transfers. These are evidence-based lint signals, not general intent detection.
• Baseline-owned regression policy and expiring suppressions, local diff and
  compare, initialization, integration doctor, rule inspection and reports.
• An optional copy-ready PR-comment workflow; posting is opt-in, not an automatic
  action of the scanner.
• Windows Unicode Git-path fixes and concise diagnostics for invalid UTF-8
  integration files or unwritable reports.
• A user guide
  covering setup, exit codes and troubleshooting, plus a
  documentation index.
• Installed-wheel acceptance on Linux, Windows and macOS, required before
  publication alongside the full source regression suite.

Compatibility and adoption

Existing command names, configuration version 1 and JSON field names remain
unchanged. Rule additions and interpretation fixes can change scores and findings
on the same input compared with v0.22.0. Review new signals when upgrading; a
score change is not a new real-world accuracy measurement.

The new stable rule IDs are false-success-report and broad-environment-upload.
They are included in rule inspection, suppression schema and SARIF metadata.
Operational filesystem/encoding failures return exit 2; doctor error checks
return 1. These failures are not clean scan results.

For reproducible CI, pin the Action to LE0-Lin/AgentConfigScore@v0.23.0 (or its
verified commit). @v0 remains a rolling pre-1.0 reference and can change on a
later release. The tool applies the baseline policy to both trees so a PR cannot
use its own weaker policy or new suppression to approve itself.

Existing generated workflows do not need to be reinitialized merely to upgrade
the installed package. Review whether they use a fixed Action version or rolling
v0, since those determine the CI tool separately from your local installation.

Evidence and known limits

Maintained deterministic contracts and synthetic installed-package journeys
verify expected engineering behavior; they do not establish real-world precision,
recall or usefulness. The unresolved AI pilot and failed source acquisitions
remain explicitly unscored; research preparation is separate from the runtime.

An A 100 means no active deterministic rule matched, not semantic perfection
or a security approval. Arbitrary paraphrases, contradictions and other-language
instruction semantics still need review. Read the
limitations
and full changelog.

Simplified and Traditional Chinese documentation/language links are the next
optional milestone; they are not included in v0.23.0. Translating documentation
will not by itself add Chinese semantic detection or change machine-readable
interfaces.

AgentConfigScore v0.22.0

What's Changed

• Fix prohibited command table false positive by @LE0-Lin in #43
• Detect case-variant instruction filenames by @LE0-Lin in #44
• Release AgentConfigScore 0.22.0 by @LE0-Lin in #45

Full Changelog: v0.21.0...v0.22.0

AgentConfigScore v0.21.0

What's Changed

• Add privacy-safe feedback case export by @LE0-Lin in #41
• Release AgentConfigScore 0.21.0 by @LE0-Lin in #42

Full Changelog: v0.20.0...v0.21.0

AgentConfigScore v0.20.0

What's Changed

• Add transparent adversarial Benchmark v1 by @LE0-Lin in #38
• Expand deterministic danger coverage by @LE0-Lin in #39
• Release AgentConfigScore 0.20.0 by @LE0-Lin in #40

Full Changelog: v0.19.0...v0.20.0

AgentConfigScore v0.19.0

What's Changed

• Add a visual demo gallery by @LE0-Lin in #34
• Add branded GitHub social preview by @LE0-Lin in #35
• Harden score credibility and add copy-ready agent templates by @LE0-Lin in #36
• Release AgentConfigScore 0.19.0 by @LE0-Lin in #37

Full Changelog: v0.18.0...v0.19.0

AgentConfigScore v0.18.0

What's Changed

• Add product demo and trusted PyPI publishing by @LE0-Lin in #33

Full Changelog: v0.17.0...v0.18.0

AgentConfigScore v0.17.0

What's Changed

• docs: document real-world regression fixtures by @LE0-Lin in #13
• feat: add Git-aware local regression diff by @LE0-Lin in #14
• feat: add baseline-governed repository policy by @LE0-Lin in #15
• chore: polish CLI help and surface policy source by @LE0-Lin in #16
• feat: add safe one-command repository setup by @LE0-Lin in #17
• feat: add stable rule catalog and rules CLI by @LE0-Lin in #18
• feat: add reasoned expiring rule suppressions by @LE0-Lin in #19
• feat: add JSON Schema editor validation by @LE0-Lin in #20
• test: add end-to-end behavior contract fixtures by @LE0-Lin in #21
• feat: add repository doctor command by @LE0-Lin in #22
• feat: auto-detect local Git baseline for diff by @LE0-Lin in #23
• chore: teach doctor about automatic diff baseline by @LE0-Lin in #24
• ci: add Windows and macOS product validation by @LE0-Lin in #25
• feat: add immutable score history snapshots by @LE0-Lin in #26
• ci: lock down score history workflow outputs by @LE0-Lin in #27
• ci: build and verify release distributions by @LE0-Lin in #28
• ci: verify Python 3.10 through 3.14 support by @LE0-Lin in #29
• feat: make nested AGENTS.md analysis scope-aware by @LE0-Lin in #30
• feat: support AGENTS.override.md by @LE0-Lin in #31
• Release v0.17.0: harden scanner and add real-world benchmark by @LE0-Lin in #32

Full Changelog: v0.5.2...v0.17.0

AgentConfigScore v0.5.1

AgentConfigScore v0.5.1

AgentConfigScore is a regression gate for AI coding-agent instructions — think Codecov for AGENTS.md and CLAUDE.md.

Highlights

• Block pull requests that make agent instructions worse
• Compare baseline → candidate scores
• Detect newly introduced errors and regressions
• Support AGENTS.md, CLAUDE.md, Cursor, Copilot, Gemini and more
• Reusable GitHub Action via LE0-Lin/AgentConfigScore@v0
• Structured Action outputs for downstream workflows
• SARIF 2.1.0 output for GitHub Code Scanning
• Zero runtime dependencies
• No API key or LLM required
• Tested on Python 3.10, 3.12 and 3.13

Quick start

- uses: LE0-Lin/AgentConfigScore@v0
  with:
    max-drop: "0"
    fail-on-new-errors: "true"

Live demo

See a real intentionally failing pull request where AgentConfigScore detected an unsafe curl | bash instruction and blocked the regression:

#6

Feedback

Real-world agent configuration regressions and false-positive reports are welcome:

#8

If AgentConfigScore is useful in your repository, a ⭐ helps other maintainers discover it.

AgentConfigScore v0.5.1

What's Changed

• chore: upgrade official GitHub Actions to v7 by @LE0-Lin in #11

Full Changelog: v0.5.0...v0.5.1