AgentConfigScore v0.24.0

AgentConfigScore v0.24.0

This maintainer-focused Beta release connects concrete lint findings to
reviewable next steps and opt-in PR results. It also hardens path, input and
initialization handling. It is still a local, dependency-free deterministic
linter and baseline-aware regression gate, not a semantic judge or runtime guard.

Install or upgrade

python -m pip install --upgrade "agent-config-score==0.24.0"
agent-config-score --version
agent-config-score . --explain

Expected version: AgentConfigScore 0.24.0. Python 3.10+ is required; Git is
needed for diff. Both console aliases (agent-config-score, acs) and
python -m agent_config_score remain available. There are no runtime dependencies.

What is included

• --explain adds static next steps to active scan/new regression findings in
  text and Markdown. Rule help and an unscored maintainer checklist connect
  findings to a fix/recheck workflow without executing commands or repairing files.
• init --pr-comment generates the tested, opt-in, single bot-comment workflow.
  It discloses pull-requests: write; default initialization keeps read-only
  GitHub permissions. Fork PRs retain job summaries without comments. Setup
  itself makes no GitHub API calls.
• init --workflow-only leaves custom policy and suppression bytes entirely out
  of scope, including under --force. Selected-file and parent checks, exclusive
  creation and opened-file identity checks reduce accidental overwrites.
• guardrails previews narrowly recognized deletion safeguards in one existing
  instruction file. A reviewed addition requires explicit content-bound
  confirmation to append. English, Simplified and Traditional templates are
  available; example sections, ambiguous markup and narrow approval-bypass
  signals can require manual merging. This is unscored, opt-in advice.
• New reports capture the declared version and a best-effort tool-source
  fingerprint. JSON, HTML, SARIF, new history snapshots and feedback retain it;
  comparisons retain both scan identities. Missing source is explicitly unknown.
• Path checks avoid narrowly defined repository-slug/conditional-reference false
  positives, retain package paths under build directories and no longer let
  explicit relative paths pass via unrelated suffix matches.
• Unsafe/unreadable selected sources and path-index traversal failures stop the
  operation instead of silently scoring incomplete input. Comparisons reuse
  scan-captured instruction text. File-removal move exemptions are restricted
  to one-to-one, nonempty exact decoded-text moves within the same directory.
• Optional Simplified
  and Traditional
  repository overviews, core guides and limitations. Advanced references and CLI
  output remain English. The wheel links to, but does not bundle, offline docs.

Upgrade existing integrations deliberately

Pin reproducible CI to LE0-Lin/AgentConfigScore@v0.24.0 or its verified commit.
Rolling @v0 follows releases and can change. Upgrading the local package does
not update an existing workflow's pinned Action revision. Newly generated
workflows use rolling @v0; inspect/pin it before committing.

To adopt PR comments without resetting custom policy, compare the recipe with
your existing workflow, then preview before replacing it:

agent-config-score init --workflow-only --pr-comment --force --dry-run
agent-config-score init --workflow-only --pr-comment --force
agent-config-score doctor

--force replaces the selected workflow, not a YAML merge; do not run it
without reviewing local customizations. Policy is not read or validated in this
mode. Ordinary unscoped init --force still replaces both generated targets.
Keep only one scanning/comment workflow. Initialization and guardrail appends
are not atomic transactions: an I/O failure may leave partial changes. Inspect
before retrying; linked/shared targets can require manual integration.

Existing commands, configuration version 1, stable rule IDs and policy defaults
are unchanged. Report identity is additive; strict JSON consumers must allow
the new metadata. There are no new scored rules in this release, but corrected
path interpretation can change findings/scores. Tighter removal exemptions can
produce new regression-only errors even at 100 on both sides; enable baseline
fail_on_new_errors or --fail-on-new-errors to gate them. A bare CLI comparison
without policy retains its score-only default. Operational failures return exit
2, not a clean result; doctor error checks return 1.

Verification and evidence limits

The release workflow requires the source regression suite, a wheel/source
distribution build and installed-wheel acceptance on Linux, Windows and macOS
before publication. The installed journey covers the new opt-in commands and
exact policy preservation as well as the existing regression/permission cases.

Maintained fixtures, synthetic workflows and package acceptance verify specified
engineering behavior, not independent accuracy or real-user adoption. The
unresolved AI pilot and deferred human annotation remain unscored. Development
reuse of public samples is disclosed; frozen research records and older release
artifacts are unchanged.

An A 100 is not proof of useful or safe instructions. Missing recognized
safeguard text means review needed, not proven danger; adding text does not
increase the score or enforce agent behavior. A source fingerprint is not
execution attestation or a reproducibility guarantee. Read the
limitations,
maintainer guide
and changelog.