Hashimori 0.2.0

Hashimori 0.2.0

The first tagged release since 0.1.0's initial commit — twelve PRs, two rule packs, one silent-bypass bug fixed, and the CI/publishing groundwork to make future releases routine.

New rule packs

• Healthcare (#3) — FDA SaMD clearance for clinical decision support, HIPAA BAAs before PHI reaches a model vendor, 42 CFR Part 2 consent, clinician attestation on AI-drafted documentation.
• Finance (#7, thanks @tkbad) — credit/underwriting explainability, AML/sanctions alert disposition, algorithmic trading kill switches, robo-advice suitability disclosure, cardholder data agreements, model-risk validation. Mapped to DORA, APRA CPS230/234, PCI DSS, ECOA/Reg B, FCRA, SR-11-7, SEC, and FINRA.

Fixed

• Silent rule-bypass in in/not_in (#5) — a bare string instead of a list (in: credit instead of in: [credit]) used to be silently checked character-by-character, turning a rule meant to fire into one that never did, with no error anywhere. Now raises a clear error instead of misevaluating.
• CLI crashes on malformed input (#6) — a broken or wrong-shaped rule pack used to crash evaluate/test with a raw Python traceback. Now a clean one-line error, same exit code.

Hardened

• StepSecurity Harden Runner added to CI for supply-chain monitoring (#4).
• CODEOWNERS added so review auto-assignment matches what the README already claimed (#8).
• PyPI publishing via Trusted Publishing (OIDC) — no stored token, ever (#11).

Test coverage: 56% → 96%

hashimori/cli.py — the actual user-facing entrypoint — had 0% coverage before this release. Now 94%, alongside new edge-case coverage for previously-untested condition/loader branches (#6).

Docs / discoverability

• A comparison table against OPA/Rego and generic GRC platforms, so evaluators can tell in 30 seconds whether this is the right tool for them (#9).
• A true zero-install quickstart — uvx/pipx run straight from the repo, no clone, no venv (#10).

Contributors

@bansalfx, @tkbad

Full list of merged PRs: #1–#12