PTxray v1.8.4

Release notes

v1.8.4

A primary Shared Ethernet Adapter with Bridge Mode None warns, and a real-adapter Link Status other than Up warns. An idle backup with Bridge Mode None stays a pass. A missing entstat label stays unread.

The VIOS edition remains catalog-ready. A bare VIOS still reports absence-only. This is not a live configured VIOS and not a CIS VIOS certification.

v1.8.3

The VIOS edition is catalog-ready. Every in-scope appliance control has a door, a configured-branch fixture, an absence fixture, and a deviation-research note. A bare VIOS still reports absence-only.

That is not a live test of SEA failover, logged-in NPIV, virtual SCSI, or a Shared Storage Pool, and it is not a CIS VIOS certification. There is no CIS VIOS benchmark.

v1.8.2

VIOS is now a role of the AIX scanner. ptxray-vios.sh in the AIX report bundle checks for root and /usr/ios/cli/ioscli, then runs dist/tools/aixray-scan.ksh. From the padmin shell, run oem_setup_env first.

A bare VIOS report is banner absence-only. That means the install was assessed, including the absence of a Shared Ethernet Adapter, NPIV, virtual SCSI, and a Shared Storage Pool. It is not a finished redundant-VIOS assessment. Configured SEA failover, logged-in NPIV, and a Shared Storage Pool are not claimed by this release. There is no CIS VIOS benchmark. Ordinary AIX, STIG, CIS, and vulnerability findings stay findings.

v1.8.1

This release closes three IBM i evidence gaps while preserving local, read-only assessment.

• SMB protocol policy: reads current and pending NetServer flags on IBM i 7.4 and 7.5 using IBM's documented local query. Reports SMB1 permitted by configuration as a finding. Its temporary report is held locally and removed using its exact spool identity; cleanup failures are disclosed.
• SMTP relay policy: reads current relay and authentication settings through IBM's prompt-override retrieval API. Recognizes authentication overrides without opening an SMTP connection or executing a configuration change.
• CVE applicability: uses explicit product-to-PTF mappings from IBM bulletins and a complete local software-product inventory. A vulnerability tied to an absent product is counted as not applicable, separately from installed fixes. Missing, damaged, or incomplete inventory cannot establish absence.

The complete report bundles retain HTML, JSON, structured assessment output, and IBM i Blueprint output. Missing or ambiguous evidence still produces an explicit refusal; manual benchmark coverage remains disclosed. AIX retains offline IBM FLRTVC assessment and complete exposure reporting.

v1.8.0

• AIX report runs now acquire the pinned IBM FLRTVC engine separately, capture local fileset/interim-fix inventory, execute FLRTVC offline, and include validated exposure findings in HTML and JSON. The complete compact engine report is retained. Failed or incomplete engine execution cannot produce a completed assessment.
• IBM i defaults to the complete 134-check selection, including both CIS levels and operational checks. Explicit narrower selections remain available. A missing Level 2 QRETSVRSEC check has been added with its distinct IBM i 7.4 requirement.
• IBM i assessment no longer opens SMTP/SMB loopback sockets or queries the network-backed SYSTOOLS.GROUP_PTF_DETAILS view. Local evidence remains assessable; unavailable evidence is disclosed as NOT_ASSESSED. Partial and manual benchmark coverage remains explicit.
• The review-copy helper has a verified packaged validator binding but refuses the current composed report format. Manually review and remove sensitive details before sharing a full report.
• Fixed native AIX temporary-directory portability and IBM i trusted-path handling; packaged shared libraries and validator bindings are verified together with their callers.
• Refreshed verified lifecycle/advisory sources and added support for CISA's optional forensic-triage field without accepting unknown schema fields. Upgrade to 1.8.0 before refreshing definitions that contain this newer CISA field; older helpers can reject the newer catalog. Unknown hardware models no longer produce a clean lifecycle verdict.
• Updated public release verification for the composed report bundles, including signed payload identity and unsafe archive rejection. IBM FLRTVC and the APAR feed remain separately acquired and are not redistributed in these bundles.

v1.7.0

PTxray 1.7.0 is the current published release for IBM AIX and IBM i. The
product entry points are the composed report runners. The retired one-file
scanner names are no longer in the release set.

What is new

• Composed runners are the release payloads. GitHub Release assets are
  aixray-scan.ksh and ibmi-scan.ksh, plus aixray-aix.sh as a
  byte-identical alias of the AIX runner. ptxray-aix.sh and ptxray-ibmi.sh
  are retired. A scan that produces report.html still comes from the versioned
  report bundles (ptxray-report-aix-1.7.0.tar, ptxray-report-ibmi-1.7.0.tar):
  extract the matching bundle and run dist/tools/aixray-scan.ksh or
  dist/tools/ibmi-scan.ksh as README-REPORT.md names.
• Report hero lock. The film hero ships a 52px centre score and IBM's AIX
  square / IBM i circle marks, centred over the host plate.
• IBM i five pillars. The IBM i emitter scores os, firmware, security, CVE
  and resilience on the same report design as AIX. Firmware / PTF-group /
  Security-HIPER currency remain typed NOT_ASSESSED (the SYSTOOLS views they
  need are outbound IBM FLRT/PSP calls the assessment boundary bans). The
  --allow-ibm-lookup opt-in promised in 1.6 did not land in 1.7.

Unchanged from 1.6.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). Definitions
download by default; --offline / --definitions-bundle FILE opt out. The
release set is offline-signed: eleven assets — aixray-aix.sh,
aixray-scan.ksh, ibmi-scan.ksh, ptxray-defs.sh, ptxray-review-pack.sh,
ptxray-review-validate.awk, the two report bundles, SHA256SUMS, its
detached signature, and the release public key. The authoritative release-key
fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.6.0

PTxray 1.6.0 is the current published release for IBM AIX and IBM i. It is the
first release that ships the report: two report runners and the tool tree they
call, so a scan produces the PTxray report page (report.html), its print form,
and the Blueprint feed — not only verdict tables.

What is new

• Report runners. ptxray-report-aix-1.6.0.tar and
  ptxray-report-ibmi-1.6.0.tar each carry a runner (dist/tools/aixray-scan.ksh,
  dist/tools/ibmi-scan.ksh), the tool tree and data it calls, and a
  README-REPORT.md naming the exact command. The runner writes report.html,
  report.json, scan.ptx (the Blueprint input on AIX) and, on IBM i,
  ptxray-ibmi.json (the Blueprint input on IBM i). The one-file scripts alone
  do not produce the report.
• Definitions by default. The runners download the latest signed definitions
  by default. Opt out with --offline (cache only) or --definitions-bundle FILE
  to point at definitions you copied in for air-gapped machines.
• DISA STIG for AIX 7.x. The AIX report runner assesses 91 of the 283 STIG
  requirements (the one-file script carries a smaller subset) alongside CIS Level 1,
  CIS Level 2 and FFIEC; each standard is selectable at scan time and the report
  carries an overall grade per selected standard.
• IBM i edition. 122 controls against the CIS IBM i 7.5 Benchmark v2.1.0
  (Level 1 and Level 2), the IBM i security bulletins/CVE currency, release
  support and PTF group status, rendered on the same report design as AIX.
• Every check has a Blueprint entry. The Blueprint (the sequenced treatment
  plan) covers every control in this release, AIX and IBM i, 1:1.

Not assessed in this release (typed refusals, never silent)

• IBM i firmware currency, PTF group currency and Security/HIPER group currency:
  the IBM SYSTOOLS currency views they need are outbound calls to IBM FLRT/PSP,
  which the assessment boundary bans. An explicit --allow-ibm-lookup opt-in
  arrives in 1.7. The IBM i overall grade is computed from the Security pillar;
  the Currency pillar is shown as not scored.
• IBM i SMTP relay (ALWRLY): its on-disk store could not be verified.
• AIX SMS multi-boot state and residual human/application accounts require an
  administrator / ISSO review by design.

Unchanged from 1.5.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). The release set
is offline-signed: eleven assets — the six 1.5 artifacts (ptxray-aix.sh, the
byte-identical aixray-aix.sh alias, ptxray-defs.sh, ptxray-ibmi.sh,
ptxray-review-pack.sh, ptxray-review-validate.awk), the two report bundles,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The one-file scripts remain in the release set for compatibility; they are
scheduled to retire in 1.7 in favour of the report runners.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.5.0

PTxra...

PTxray v1.8.3

Release notes

v1.8.3

The VIOS edition is catalog-ready. Every in-scope appliance control has a door, a configured-branch fixture, an absence fixture, and a deviation-research note. A bare VIOS still reports absence-only.

That is not a live test of SEA failover, logged-in NPIV, virtual SCSI, or a Shared Storage Pool, and it is not a CIS VIOS certification. There is no CIS VIOS benchmark.

v1.8.2

VIOS is now a role of the AIX scanner. ptxray-vios.sh in the AIX report bundle checks for root and /usr/ios/cli/ioscli, then runs dist/tools/aixray-scan.ksh. From the padmin shell, run oem_setup_env first.

A bare VIOS report is banner absence-only. That means the install was assessed, including the absence of a Shared Ethernet Adapter, NPIV, virtual SCSI, and a Shared Storage Pool. It is not a finished redundant-VIOS assessment. Configured SEA failover, logged-in NPIV, and a Shared Storage Pool are not claimed by this release. There is no CIS VIOS benchmark. Ordinary AIX, STIG, CIS, and vulnerability findings stay findings.

v1.8.1

This release closes three IBM i evidence gaps while preserving local, read-only assessment.

• SMB protocol policy: reads current and pending NetServer flags on IBM i 7.4 and 7.5 using IBM's documented local query. Reports SMB1 permitted by configuration as a finding. Its temporary report is held locally and removed using its exact spool identity; cleanup failures are disclosed.
• SMTP relay policy: reads current relay and authentication settings through IBM's prompt-override retrieval API. Recognizes authentication overrides without opening an SMTP connection or executing a configuration change.
• CVE applicability: uses explicit product-to-PTF mappings from IBM bulletins and a complete local software-product inventory. A vulnerability tied to an absent product is counted as not applicable, separately from installed fixes. Missing, damaged, or incomplete inventory cannot establish absence.

The complete report bundles retain HTML, JSON, structured assessment output, and IBM i Blueprint output. Missing or ambiguous evidence still produces an explicit refusal; manual benchmark coverage remains disclosed. AIX retains offline IBM FLRTVC assessment and complete exposure reporting.

v1.8.0

• AIX report runs now acquire the pinned IBM FLRTVC engine separately, capture local fileset/interim-fix inventory, execute FLRTVC offline, and include validated exposure findings in HTML and JSON. The complete compact engine report is retained. Failed or incomplete engine execution cannot produce a completed assessment.
• IBM i defaults to the complete 134-check selection, including both CIS levels and operational checks. Explicit narrower selections remain available. A missing Level 2 QRETSVRSEC check has been added with its distinct IBM i 7.4 requirement.
• IBM i assessment no longer opens SMTP/SMB loopback sockets or queries the network-backed SYSTOOLS.GROUP_PTF_DETAILS view. Local evidence remains assessable; unavailable evidence is disclosed as NOT_ASSESSED. Partial and manual benchmark coverage remains explicit.
• The review-copy helper has a verified packaged validator binding but refuses the current composed report format. Manually review and remove sensitive details before sharing a full report.
• Fixed native AIX temporary-directory portability and IBM i trusted-path handling; packaged shared libraries and validator bindings are verified together with their callers.
• Refreshed verified lifecycle/advisory sources and added support for CISA's optional forensic-triage field without accepting unknown schema fields. Upgrade to 1.8.0 before refreshing definitions that contain this newer CISA field; older helpers can reject the newer catalog. Unknown hardware models no longer produce a clean lifecycle verdict.
• Updated public release verification for the composed report bundles, including signed payload identity and unsafe archive rejection. IBM FLRTVC and the APAR feed remain separately acquired and are not redistributed in these bundles.

v1.7.0

PTxray 1.7.0 is the current published release for IBM AIX and IBM i. The
product entry points are the composed report runners. The retired one-file
scanner names are no longer in the release set.

What is new

• Composed runners are the release payloads. GitHub Release assets are
  aixray-scan.ksh and ibmi-scan.ksh, plus aixray-aix.sh as a
  byte-identical alias of the AIX runner. ptxray-aix.sh and ptxray-ibmi.sh
  are retired. A scan that produces report.html still comes from the versioned
  report bundles (ptxray-report-aix-1.7.0.tar, ptxray-report-ibmi-1.7.0.tar):
  extract the matching bundle and run dist/tools/aixray-scan.ksh or
  dist/tools/ibmi-scan.ksh as README-REPORT.md names.
• Report hero lock. The film hero ships a 52px centre score and IBM's AIX
  square / IBM i circle marks, centred over the host plate.
• IBM i five pillars. The IBM i emitter scores os, firmware, security, CVE
  and resilience on the same report design as AIX. Firmware / PTF-group /
  Security-HIPER currency remain typed NOT_ASSESSED (the SYSTOOLS views they
  need are outbound IBM FLRT/PSP calls the assessment boundary bans). The
  --allow-ibm-lookup opt-in promised in 1.6 did not land in 1.7.

Unchanged from 1.6.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). Definitions
download by default; --offline / --definitions-bundle FILE opt out. The
release set is offline-signed: eleven assets — aixray-aix.sh,
aixray-scan.ksh, ibmi-scan.ksh, ptxray-defs.sh, ptxray-review-pack.sh,
ptxray-review-validate.awk, the two report bundles, SHA256SUMS, its
detached signature, and the release public key. The authoritative release-key
fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.6.0

PTxray 1.6.0 is the current published release for IBM AIX and IBM i. It is the
first release that ships the report: two report runners and the tool tree they
call, so a scan produces the PTxray report page (report.html), its print form,
and the Blueprint feed — not only verdict tables.

What is new

• Report runners. ptxray-report-aix-1.6.0.tar and
  ptxray-report-ibmi-1.6.0.tar each carry a runner (dist/tools/aixray-scan.ksh,
  dist/tools/ibmi-scan.ksh), the tool tree and data it calls, and a
  README-REPORT.md naming the exact command. The runner writes report.html,
  report.json, scan.ptx (the Blueprint input on AIX) and, on IBM i,
  ptxray-ibmi.json (the Blueprint input on IBM i). The one-file scripts alone
  do not produce the report.
• Definitions by default. The runners download the latest signed definitions
  by default. Opt out with --offline (cache only) or --definitions-bundle FILE
  to point at definitions you copied in for air-gapped machines.
• DISA STIG for AIX 7.x. The AIX report runner assesses 91 of the 283 STIG
  requirements (the one-file script carries a smaller subset) alongside CIS Level 1,
  CIS Level 2 and FFIEC; each standard is selectable at scan time and the report
  carries an overall grade per selected standard.
• IBM i edition. 122 controls against the CIS IBM i 7.5 Benchmark v2.1.0
  (Level 1 and Level 2), the IBM i security bulletins/CVE currency, release
  support and PTF group status, rendered on the same report design as AIX.
• Every check has a Blueprint entry. The Blueprint (the sequenced treatment
  plan) covers every control in this release, AIX and IBM i, 1:1.

Not assessed in this release (typed refusals, never silent)

• IBM i firmware currency, PTF group currency and Security/HIPER group currency:
  the IBM SYSTOOLS currency views they need are outbound calls to IBM FLRT/PSP,
  which the assessment boundary bans. An explicit --allow-ibm-lookup opt-in
  arrives in 1.7. The IBM i overall grade is computed from the Security pillar;
  the Currency pillar is shown as not scored.
• IBM i SMTP relay (ALWRLY): its on-disk store could not be verified.
• AIX SMS multi-boot state and residual human/application accounts require an
  administrator / ISSO review by design.

Unchanged from 1.5.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). The release set
is offline-signed: eleven assets — the six 1.5 artifacts (ptxray-aix.sh, the
byte-identical aixray-aix.sh alias, ptxray-defs.sh, ptxray-ibmi.sh,
ptxray-review-pack.sh, ptxray-review-validate.awk), the two report bundles,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The one-file scripts remain in the release set for compatibility; they are
scheduled to retire in 1.7 in favour of the report runners.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.5.0

PTxray 1.5.0 is the current published release for IBM AIX and IBM i. It
completes the AIXray-to-PTxray rename, separates signed-definition acquisition
from assessment, and publishes an offline-signed nine-asset release set.

The AIX runner requires root; the IBM i runner requires
QSECOFR. Each runner authenticates and invokes the separate adjacent
ptxray-defs.sh before assessment. Connected mode attempts a signe...

PTxray v1.8.2

Release notes

v1.8.2

VIOS is now a role of the AIX scanner. ptxray-vios.sh in the AIX report bundle checks for root and /usr/ios/cli/ioscli, then runs dist/tools/aixray-scan.ksh. From the padmin shell, run oem_setup_env first.

A bare VIOS report is banner absence-only. That means the install was assessed, including the absence of a Shared Ethernet Adapter, NPIV, virtual SCSI, and a Shared Storage Pool. It is not a finished redundant-VIOS assessment. Configured SEA failover, logged-in NPIV, and a Shared Storage Pool are not claimed by this release. There is no CIS VIOS benchmark. Ordinary AIX, STIG, CIS, and vulnerability findings stay findings.

v1.8.1

This release closes three IBM i evidence gaps while preserving local, read-only assessment.

• SMB protocol policy: reads current and pending NetServer flags on IBM i 7.4 and 7.5 using IBM's documented local query. Reports SMB1 permitted by configuration as a finding. Its temporary report is held locally and removed using its exact spool identity; cleanup failures are disclosed.
• SMTP relay policy: reads current relay and authentication settings through IBM's prompt-override retrieval API. Recognizes authentication overrides without opening an SMTP connection or executing a configuration change.
• CVE applicability: uses explicit product-to-PTF mappings from IBM bulletins and a complete local software-product inventory. A vulnerability tied to an absent product is counted as not applicable, separately from installed fixes. Missing, damaged, or incomplete inventory cannot establish absence.

The complete report bundles retain HTML, JSON, structured assessment output, and IBM i Blueprint output. Missing or ambiguous evidence still produces an explicit refusal; manual benchmark coverage remains disclosed. AIX retains offline IBM FLRTVC assessment and complete exposure reporting.

v1.8.0

• AIX report runs now acquire the pinned IBM FLRTVC engine separately, capture local fileset/interim-fix inventory, execute FLRTVC offline, and include validated exposure findings in HTML and JSON. The complete compact engine report is retained. Failed or incomplete engine execution cannot produce a completed assessment.
• IBM i defaults to the complete 134-check selection, including both CIS levels and operational checks. Explicit narrower selections remain available. A missing Level 2 QRETSVRSEC check has been added with its distinct IBM i 7.4 requirement.
• IBM i assessment no longer opens SMTP/SMB loopback sockets or queries the network-backed SYSTOOLS.GROUP_PTF_DETAILS view. Local evidence remains assessable; unavailable evidence is disclosed as NOT_ASSESSED. Partial and manual benchmark coverage remains explicit.
• The review-copy helper has a verified packaged validator binding but refuses the current composed report format. Manually review and remove sensitive details before sharing a full report.
• Fixed native AIX temporary-directory portability and IBM i trusted-path handling; packaged shared libraries and validator bindings are verified together with their callers.
• Refreshed verified lifecycle/advisory sources and added support for CISA's optional forensic-triage field without accepting unknown schema fields. Upgrade to 1.8.0 before refreshing definitions that contain this newer CISA field; older helpers can reject the newer catalog. Unknown hardware models no longer produce a clean lifecycle verdict.
• Updated public release verification for the composed report bundles, including signed payload identity and unsafe archive rejection. IBM FLRTVC and the APAR feed remain separately acquired and are not redistributed in these bundles.

v1.7.0

PTxray 1.7.0 is the current published release for IBM AIX and IBM i. The
product entry points are the composed report runners. The retired one-file
scanner names are no longer in the release set.

What is new

• Composed runners are the release payloads. GitHub Release assets are
  aixray-scan.ksh and ibmi-scan.ksh, plus aixray-aix.sh as a
  byte-identical alias of the AIX runner. ptxray-aix.sh and ptxray-ibmi.sh
  are retired. A scan that produces report.html still comes from the versioned
  report bundles (ptxray-report-aix-1.7.0.tar, ptxray-report-ibmi-1.7.0.tar):
  extract the matching bundle and run dist/tools/aixray-scan.ksh or
  dist/tools/ibmi-scan.ksh as README-REPORT.md names.
• Report hero lock. The film hero ships a 52px centre score and IBM's AIX
  square / IBM i circle marks, centred over the host plate.
• IBM i five pillars. The IBM i emitter scores os, firmware, security, CVE
  and resilience on the same report design as AIX. Firmware / PTF-group /
  Security-HIPER currency remain typed NOT_ASSESSED (the SYSTOOLS views they
  need are outbound IBM FLRT/PSP calls the assessment boundary bans). The
  --allow-ibm-lookup opt-in promised in 1.6 did not land in 1.7.

Unchanged from 1.6.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). Definitions
download by default; --offline / --definitions-bundle FILE opt out. The
release set is offline-signed: eleven assets — aixray-aix.sh,
aixray-scan.ksh, ibmi-scan.ksh, ptxray-defs.sh, ptxray-review-pack.sh,
ptxray-review-validate.awk, the two report bundles, SHA256SUMS, its
detached signature, and the release public key. The authoritative release-key
fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.6.0

PTxray 1.6.0 is the current published release for IBM AIX and IBM i. It is the
first release that ships the report: two report runners and the tool tree they
call, so a scan produces the PTxray report page (report.html), its print form,
and the Blueprint feed — not only verdict tables.

What is new

• Report runners. ptxray-report-aix-1.6.0.tar and
  ptxray-report-ibmi-1.6.0.tar each carry a runner (dist/tools/aixray-scan.ksh,
  dist/tools/ibmi-scan.ksh), the tool tree and data it calls, and a
  README-REPORT.md naming the exact command. The runner writes report.html,
  report.json, scan.ptx (the Blueprint input on AIX) and, on IBM i,
  ptxray-ibmi.json (the Blueprint input on IBM i). The one-file scripts alone
  do not produce the report.
• Definitions by default. The runners download the latest signed definitions
  by default. Opt out with --offline (cache only) or --definitions-bundle FILE
  to point at definitions you copied in for air-gapped machines.
• DISA STIG for AIX 7.x. The AIX report runner assesses 91 of the 283 STIG
  requirements (the one-file script carries a smaller subset) alongside CIS Level 1,
  CIS Level 2 and FFIEC; each standard is selectable at scan time and the report
  carries an overall grade per selected standard.
• IBM i edition. 122 controls against the CIS IBM i 7.5 Benchmark v2.1.0
  (Level 1 and Level 2), the IBM i security bulletins/CVE currency, release
  support and PTF group status, rendered on the same report design as AIX.
• Every check has a Blueprint entry. The Blueprint (the sequenced treatment
  plan) covers every control in this release, AIX and IBM i, 1:1.

Not assessed in this release (typed refusals, never silent)

• IBM i firmware currency, PTF group currency and Security/HIPER group currency:
  the IBM SYSTOOLS currency views they need are outbound calls to IBM FLRT/PSP,
  which the assessment boundary bans. An explicit --allow-ibm-lookup opt-in
  arrives in 1.7. The IBM i overall grade is computed from the Security pillar;
  the Currency pillar is shown as not scored.
• IBM i SMTP relay (ALWRLY): its on-disk store could not be verified.
• AIX SMS multi-boot state and residual human/application accounts require an
  administrator / ISSO review by design.

Unchanged from 1.5.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). The release set
is offline-signed: eleven assets — the six 1.5 artifacts (ptxray-aix.sh, the
byte-identical aixray-aix.sh alias, ptxray-defs.sh, ptxray-ibmi.sh,
ptxray-review-pack.sh, ptxray-review-validate.awk), the two report bundles,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The one-file scripts remain in the release set for compatibility; they are
scheduled to retire in 1.7 in favour of the report runners.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.5.0

PTxray 1.5.0 is the current published release for IBM AIX and IBM i. It
completes the AIXray-to-PTxray rename, separates signed-definition acquisition
from assessment, and publishes an offline-signed nine-asset release set.

The AIX runner requires root; the IBM i runner requires
QSECOFR. Each runner authenticates and invokes the separate adjacent
ptxray-defs.sh before assessment. Connected mode attempts a signed-definitions
update by default, while --offline uses a signed cache and
--definitions-bundle accepts a local signed bundle. Assessment probes remain
no-egress, read-only on system configuration, and non-remediating.

The release includes the AIX and IBM i runners, definitions downloader, review
helper and validator, the byte-identical aixray-aix.sh compatibility alias,
SHA256SUMS, its detached signature, and the rel...

PTxray v1.8.1

Release notes

v1.8.1

This release closes three IBM i evidence gaps while preserving local, read-only assessment.

• SMB protocol policy: reads current and pending NetServer flags on IBM i 7.4 and 7.5 using IBM's documented local query. Reports SMB1 permitted by configuration as a finding. Its temporary report is held locally and removed using its exact spool identity; cleanup failures are disclosed.
• SMTP relay policy: reads current relay and authentication settings through IBM's prompt-override retrieval API. Recognizes authentication overrides without opening an SMTP connection or executing a configuration change.
• CVE applicability: uses explicit product-to-PTF mappings from IBM bulletins and a complete local software-product inventory. A vulnerability tied to an absent product is counted as not applicable, separately from installed fixes. Missing, damaged, or incomplete inventory cannot establish absence.

The complete report bundles retain HTML, JSON, structured assessment output, and IBM i Blueprint output. Missing or ambiguous evidence still produces an explicit refusal; manual benchmark coverage remains disclosed. AIX retains offline IBM FLRTVC assessment and complete exposure reporting.

v1.8.0

• AIX report runs now acquire the pinned IBM FLRTVC engine separately, capture local fileset/interim-fix inventory, execute FLRTVC offline, and include validated exposure findings in HTML and JSON. The complete compact engine report is retained. Failed or incomplete engine execution cannot produce a completed assessment.
• IBM i defaults to the complete 134-check selection, including both CIS levels and operational checks. Explicit narrower selections remain available. A missing Level 2 QRETSVRSEC check has been added with its distinct IBM i 7.4 requirement.
• IBM i assessment no longer opens SMTP/SMB loopback sockets or queries the network-backed SYSTOOLS.GROUP_PTF_DETAILS view. Local evidence remains assessable; unavailable evidence is disclosed as NOT_ASSESSED. Partial and manual benchmark coverage remains explicit.
• The review-copy helper has a verified packaged validator binding but refuses the current composed report format. Manually review and remove sensitive details before sharing a full report.
• Fixed native AIX temporary-directory portability and IBM i trusted-path handling; packaged shared libraries and validator bindings are verified together with their callers.
• Refreshed verified lifecycle/advisory sources and added support for CISA's optional forensic-triage field without accepting unknown schema fields. Upgrade to 1.8.0 before refreshing definitions that contain this newer CISA field; older helpers can reject the newer catalog. Unknown hardware models no longer produce a clean lifecycle verdict.
• Updated public release verification for the composed report bundles, including signed payload identity and unsafe archive rejection. IBM FLRTVC and the APAR feed remain separately acquired and are not redistributed in these bundles.

v1.7.0

PTxray 1.7.0 is the current published release for IBM AIX and IBM i. The
product entry points are the composed report runners. The retired one-file
scanner names are no longer in the release set.

What is new

• Composed runners are the release payloads. GitHub Release assets are
  aixray-scan.ksh and ibmi-scan.ksh, plus aixray-aix.sh as a
  byte-identical alias of the AIX runner. ptxray-aix.sh and ptxray-ibmi.sh
  are retired. A scan that produces report.html still comes from the versioned
  report bundles (ptxray-report-aix-1.7.0.tar, ptxray-report-ibmi-1.7.0.tar):
  extract the matching bundle and run dist/tools/aixray-scan.ksh or
  dist/tools/ibmi-scan.ksh as README-REPORT.md names.
• Report hero lock. The film hero ships a 52px centre score and IBM's AIX
  square / IBM i circle marks, centred over the host plate.
• IBM i five pillars. The IBM i emitter scores os, firmware, security, CVE
  and resilience on the same report design as AIX. Firmware / PTF-group /
  Security-HIPER currency remain typed NOT_ASSESSED (the SYSTOOLS views they
  need are outbound IBM FLRT/PSP calls the assessment boundary bans). The
  --allow-ibm-lookup opt-in promised in 1.6 did not land in 1.7.

Unchanged from 1.6.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). Definitions
download by default; --offline / --definitions-bundle FILE opt out. The
release set is offline-signed: eleven assets — aixray-aix.sh,
aixray-scan.ksh, ibmi-scan.ksh, ptxray-defs.sh, ptxray-review-pack.sh,
ptxray-review-validate.awk, the two report bundles, SHA256SUMS, its
detached signature, and the release public key. The authoritative release-key
fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.6.0

PTxray 1.6.0 is the current published release for IBM AIX and IBM i. It is the
first release that ships the report: two report runners and the tool tree they
call, so a scan produces the PTxray report page (report.html), its print form,
and the Blueprint feed — not only verdict tables.

What is new

• Report runners. ptxray-report-aix-1.6.0.tar and
  ptxray-report-ibmi-1.6.0.tar each carry a runner (dist/tools/aixray-scan.ksh,
  dist/tools/ibmi-scan.ksh), the tool tree and data it calls, and a
  README-REPORT.md naming the exact command. The runner writes report.html,
  report.json, scan.ptx (the Blueprint input on AIX) and, on IBM i,
  ptxray-ibmi.json (the Blueprint input on IBM i). The one-file scripts alone
  do not produce the report.
• Definitions by default. The runners download the latest signed definitions
  by default. Opt out with --offline (cache only) or --definitions-bundle FILE
  to point at definitions you copied in for air-gapped machines.
• DISA STIG for AIX 7.x. The AIX report runner assesses 91 of the 283 STIG
  requirements (the one-file script carries a smaller subset) alongside CIS Level 1,
  CIS Level 2 and FFIEC; each standard is selectable at scan time and the report
  carries an overall grade per selected standard.
• IBM i edition. 122 controls against the CIS IBM i 7.5 Benchmark v2.1.0
  (Level 1 and Level 2), the IBM i security bulletins/CVE currency, release
  support and PTF group status, rendered on the same report design as AIX.
• Every check has a Blueprint entry. The Blueprint (the sequenced treatment
  plan) covers every control in this release, AIX and IBM i, 1:1.

Not assessed in this release (typed refusals, never silent)

• IBM i firmware currency, PTF group currency and Security/HIPER group currency:
  the IBM SYSTOOLS currency views they need are outbound calls to IBM FLRT/PSP,
  which the assessment boundary bans. An explicit --allow-ibm-lookup opt-in
  arrives in 1.7. The IBM i overall grade is computed from the Security pillar;
  the Currency pillar is shown as not scored.
• IBM i SMTP relay (ALWRLY): its on-disk store could not be verified.
• AIX SMS multi-boot state and residual human/application accounts require an
  administrator / ISSO review by design.

Unchanged from 1.5.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). The release set
is offline-signed: eleven assets — the six 1.5 artifacts (ptxray-aix.sh, the
byte-identical aixray-aix.sh alias, ptxray-defs.sh, ptxray-ibmi.sh,
ptxray-review-pack.sh, ptxray-review-validate.awk), the two report bundles,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The one-file scripts remain in the release set for compatibility; they are
scheduled to retire in 1.7 in favour of the report runners.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.5.0

PTxray 1.5.0 is the current published release for IBM AIX and IBM i. It
completes the AIXray-to-PTxray rename, separates signed-definition acquisition
from assessment, and publishes an offline-signed nine-asset release set.

The AIX runner requires root; the IBM i runner requires
QSECOFR. Each runner authenticates and invokes the separate adjacent
ptxray-defs.sh before assessment. Connected mode attempts a signed-definitions
update by default, while --offline uses a signed cache and
--definitions-bundle accepts a local signed bundle. Assessment probes remain
no-egress, read-only on system configuration, and non-remediating.

The release includes the AIX and IBM i runners, definitions downloader, review
helper and validator, the byte-identical aixray-aix.sh compatibility alias,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The canonical site is https://powertruesystems.com/ptxray/ and the canonical
repository is https://github.com/PowerTrueSYS/ptxray-public. The legacy site
URL https://powertruesystems.com/aixray/ has an active HTTP 308 redirect to
the canonical site, which returns HTTP 200. The legacy GitHub repository URL
https://github.com/PowerTrueSYS/aixray-public has an active HTTP 301 redirect
to the canonical repository, which returns HTTP 200. These redirect facts
preserve old links while all current documentation and release assets use the
PTx...

PTxray v1.8.0

Release notes

v1.8.0

• AIX report runs now acquire the pinned IBM FLRTVC engine separately, capture local fileset/interim-fix inventory, execute FLRTVC offline, and include validated exposure findings in HTML and JSON. The complete compact engine report is retained. Failed or incomplete engine execution cannot produce a completed assessment.
• IBM i defaults to the complete 134-check selection, including both CIS levels and operational checks. Explicit narrower selections remain available. A missing Level 2 QRETSVRSEC check has been added with its distinct IBM i 7.4 requirement.
• IBM i assessment no longer opens SMTP/SMB loopback sockets or queries the network-backed SYSTOOLS.GROUP_PTF_DETAILS view. Local evidence remains assessable; unavailable evidence is disclosed as NOT_ASSESSED. Partial and manual benchmark coverage remains explicit.
• The review-copy helper has a verified packaged validator binding but refuses the current composed report format. Manually review and remove sensitive details before sharing a full report.
• Fixed native AIX temporary-directory portability and IBM i trusted-path handling; packaged shared libraries and validator bindings are verified together with their callers.
• Refreshed verified lifecycle/advisory sources and added support for CISA's optional forensic-triage field without accepting unknown schema fields. Upgrade to 1.8.0 before refreshing definitions that contain this newer CISA field; older helpers can reject the newer catalog. Unknown hardware models no longer produce a clean lifecycle verdict.
• Updated public release verification for the composed report bundles, including signed payload identity and unsafe archive rejection. IBM FLRTVC and the APAR feed remain separately acquired and are not redistributed in these bundles.

v1.7.0

PTxray 1.7.0 is the current published release for IBM AIX and IBM i. The
product entry points are the composed report runners. The retired one-file
scanner names are no longer in the release set.

What is new

• Composed runners are the release payloads. GitHub Release assets are
  aixray-scan.ksh and ibmi-scan.ksh, plus aixray-aix.sh as a
  byte-identical alias of the AIX runner. ptxray-aix.sh and ptxray-ibmi.sh
  are retired. A scan that produces report.html still comes from the versioned
  report bundles (ptxray-report-aix-1.7.0.tar, ptxray-report-ibmi-1.7.0.tar):
  extract the matching bundle and run dist/tools/aixray-scan.ksh or
  dist/tools/ibmi-scan.ksh as README-REPORT.md names.
• Report hero lock. The film hero ships a 52px centre score and IBM's AIX
  square / IBM i circle marks, centred over the host plate.
• IBM i five pillars. The IBM i emitter scores os, firmware, security, CVE
  and resilience on the same report design as AIX. Firmware / PTF-group /
  Security-HIPER currency remain typed NOT_ASSESSED (the SYSTOOLS views they
  need are outbound IBM FLRT/PSP calls the assessment boundary bans). The
  --allow-ibm-lookup opt-in promised in 1.6 did not land in 1.7.

Unchanged from 1.6.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). Definitions
download by default; --offline / --definitions-bundle FILE opt out. The
release set is offline-signed: eleven assets — aixray-aix.sh,
aixray-scan.ksh, ibmi-scan.ksh, ptxray-defs.sh, ptxray-review-pack.sh,
ptxray-review-validate.awk, the two report bundles, SHA256SUMS, its
detached signature, and the release public key. The authoritative release-key
fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.6.0

PTxray 1.6.0 is the current published release for IBM AIX and IBM i. It is the
first release that ships the report: two report runners and the tool tree they
call, so a scan produces the PTxray report page (report.html), its print form,
and the Blueprint feed — not only verdict tables.

What is new

• Report runners. ptxray-report-aix-1.6.0.tar and
  ptxray-report-ibmi-1.6.0.tar each carry a runner (dist/tools/aixray-scan.ksh,
  dist/tools/ibmi-scan.ksh), the tool tree and data it calls, and a
  README-REPORT.md naming the exact command. The runner writes report.html,
  report.json, scan.ptx (the Blueprint input on AIX) and, on IBM i,
  ptxray-ibmi.json (the Blueprint input on IBM i). The one-file scripts alone
  do not produce the report.
• Definitions by default. The runners download the latest signed definitions
  by default. Opt out with --offline (cache only) or --definitions-bundle FILE
  to point at definitions you copied in for air-gapped machines.
• DISA STIG for AIX 7.x. The AIX report runner assesses 91 of the 283 STIG
  requirements (the one-file script carries a smaller subset) alongside CIS Level 1,
  CIS Level 2 and FFIEC; each standard is selectable at scan time and the report
  carries an overall grade per selected standard.
• IBM i edition. 122 controls against the CIS IBM i 7.5 Benchmark v2.1.0
  (Level 1 and Level 2), the IBM i security bulletins/CVE currency, release
  support and PTF group status, rendered on the same report design as AIX.
• Every check has a Blueprint entry. The Blueprint (the sequenced treatment
  plan) covers every control in this release, AIX and IBM i, 1:1.

Not assessed in this release (typed refusals, never silent)

• IBM i firmware currency, PTF group currency and Security/HIPER group currency:
  the IBM SYSTOOLS currency views they need are outbound calls to IBM FLRT/PSP,
  which the assessment boundary bans. An explicit --allow-ibm-lookup opt-in
  arrives in 1.7. The IBM i overall grade is computed from the Security pillar;
  the Currency pillar is shown as not scored.
• IBM i SMTP relay (ALWRLY): its on-disk store could not be verified.
• AIX SMS multi-boot state and residual human/application accounts require an
  administrator / ISSO review by design.

Unchanged from 1.5.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). The release set
is offline-signed: eleven assets — the six 1.5 artifacts (ptxray-aix.sh, the
byte-identical aixray-aix.sh alias, ptxray-defs.sh, ptxray-ibmi.sh,
ptxray-review-pack.sh, ptxray-review-validate.awk), the two report bundles,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The one-file scripts remain in the release set for compatibility; they are
scheduled to retire in 1.7 in favour of the report runners.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.5.0

PTxray 1.5.0 is the current published release for IBM AIX and IBM i. It
completes the AIXray-to-PTxray rename, separates signed-definition acquisition
from assessment, and publishes an offline-signed nine-asset release set.

The AIX runner requires root; the IBM i runner requires
QSECOFR. Each runner authenticates and invokes the separate adjacent
ptxray-defs.sh before assessment. Connected mode attempts a signed-definitions
update by default, while --offline uses a signed cache and
--definitions-bundle accepts a local signed bundle. Assessment probes remain
no-egress, read-only on system configuration, and non-remediating.

The release includes the AIX and IBM i runners, definitions downloader, review
helper and validator, the byte-identical aixray-aix.sh compatibility alias,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The canonical site is https://powertruesystems.com/ptxray/ and the canonical
repository is https://github.com/PowerTrueSYS/ptxray-public. The legacy site
URL https://powertruesystems.com/aixray/ has an active HTTP 308 redirect to
the canonical site, which returns HTTP 200. The legacy GitHub repository URL
https://github.com/PowerTrueSYS/aixray-public has an active HTTP 301 redirect
to the canonical repository, which returns HTTP 200. These redirect facts
preserve old links while all current documentation and release assets use the
PTxray name.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.4.0

If you downloaded v1.3.0, download v1.4.0 and run it again. This release
rewrites what a scan hands you. The checks still read the same box the same
read-only way; the report they produce is new, and 25 checks that could only
ever report an inventory or a refusal have been taken out of the compliance
groups rather than left padding the count.

Two things this release does not do, stated up front so you can plan around
them: the currency producer lane is not in this release, and the currency
section of a scan says so in as many words instead of implying a clean result.

IBM i edition

ptxray-ibmi.sh ships unchanged from v1.3.0 apart from its declared version: same
CIS IBM i V7R4M0 / V7R5M0 Benchmark v2.1.0 grading on IBM i 7.4 and 7.5, same read-only
PASE run. The report rewrite above is the AIX edition's; the IBM i report is the v1.3.0 form.

What changed for you

The report is new. A scan now produces one structured document and renders
every view from it — the HTML report, the print form and the terminal
snapshot are three views of one document, never three separate cal...

PTxray v1.7.0

Release notes

v1.7.0

PTxray 1.7.0 is the current published release for IBM AIX and IBM i. The
product entry points are the composed report runners. The retired one-file
scanner names are no longer in the release set.

What is new

• Composed runners are the release payloads. GitHub Release assets are
  aixray-scan.ksh and ibmi-scan.ksh, plus aixray-aix.sh as a
  byte-identical alias of the AIX runner. ptxray-aix.sh and ptxray-ibmi.sh
  are retired. A scan that produces report.html still comes from the versioned
  report bundles (ptxray-report-aix-1.7.0.tar, ptxray-report-ibmi-1.7.0.tar):
  extract the matching bundle and run dist/tools/aixray-scan.ksh or
  dist/tools/ibmi-scan.ksh as README-REPORT.md names.
• Report hero lock. The film hero ships a 52px centre score and IBM's AIX
  square / IBM i circle marks, centred over the host plate.
• IBM i five pillars. The IBM i emitter scores os, firmware, security, CVE
  and resilience on the same report design as AIX. Firmware / PTF-group /
  Security-HIPER currency remain typed NOT_ASSESSED (the SYSTOOLS views they
  need are outbound IBM FLRT/PSP calls the assessment boundary bans). The
  --allow-ibm-lookup opt-in promised in 1.6 did not land in 1.7.

Unchanged from 1.6.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). Definitions
download by default; --offline / --definitions-bundle FILE opt out. The
release set is offline-signed: eleven assets — aixray-aix.sh,
aixray-scan.ksh, ibmi-scan.ksh, ptxray-defs.sh, ptxray-review-pack.sh,
ptxray-review-validate.awk, the two report bundles, SHA256SUMS, its
detached signature, and the release public key. The authoritative release-key
fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.6.0

PTxray 1.6.0 is the current published release for IBM AIX and IBM i. It is the
first release that ships the report: two report runners and the tool tree they
call, so a scan produces the PTxray report page (report.html), its print form,
and the Blueprint feed — not only verdict tables.

What is new

• Report runners. ptxray-report-aix-1.6.0.tar and
  ptxray-report-ibmi-1.6.0.tar each carry a runner (dist/tools/aixray-scan.ksh,
  dist/tools/ibmi-scan.ksh), the tool tree and data it calls, and a
  README-REPORT.md naming the exact command. The runner writes report.html,
  report.json, scan.ptx (the Blueprint input on AIX) and, on IBM i,
  ptxray-ibmi.json (the Blueprint input on IBM i). The one-file scripts alone
  do not produce the report.
• Definitions by default. The runners download the latest signed definitions
  by default. Opt out with --offline (cache only) or --definitions-bundle FILE
  to point at definitions you copied in for air-gapped machines.
• DISA STIG for AIX 7.x. The AIX report runner assesses 91 of the 283 STIG
  requirements (the one-file script carries a smaller subset) alongside CIS Level 1,
  CIS Level 2 and FFIEC; each standard is selectable at scan time and the report
  carries an overall grade per selected standard.
• IBM i edition. 122 controls against the CIS IBM i 7.5 Benchmark v2.1.0
  (Level 1 and Level 2), the IBM i security bulletins/CVE currency, release
  support and PTF group status, rendered on the same report design as AIX.
• Every check has a Blueprint entry. The Blueprint (the sequenced treatment
  plan) covers every control in this release, AIX and IBM i, 1:1.

Not assessed in this release (typed refusals, never silent)

• IBM i firmware currency, PTF group currency and Security/HIPER group currency:
  the IBM SYSTOOLS currency views they need are outbound calls to IBM FLRT/PSP,
  which the assessment boundary bans. An explicit --allow-ibm-lookup opt-in
  arrives in 1.7. The IBM i overall grade is computed from the Security pillar;
  the Currency pillar is shown as not scored.
• IBM i SMTP relay (ALWRLY): its on-disk store could not be verified.
• AIX SMS multi-boot state and residual human/application accounts require an
  administrator / ISSO review by design.

Unchanged from 1.5.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). The release set
is offline-signed: eleven assets — the six 1.5 artifacts (ptxray-aix.sh, the
byte-identical aixray-aix.sh alias, ptxray-defs.sh, ptxray-ibmi.sh,
ptxray-review-pack.sh, ptxray-review-validate.awk), the two report bundles,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The one-file scripts remain in the release set for compatibility; they are
scheduled to retire in 1.7 in favour of the report runners.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.5.0

PTxray 1.5.0 is the current published release for IBM AIX and IBM i. It
completes the AIXray-to-PTxray rename, separates signed-definition acquisition
from assessment, and publishes an offline-signed nine-asset release set.

The AIX runner requires root; the IBM i runner requires
QSECOFR. Each runner authenticates and invokes the separate adjacent
ptxray-defs.sh before assessment. Connected mode attempts a signed-definitions
update by default, while --offline uses a signed cache and
--definitions-bundle accepts a local signed bundle. Assessment probes remain
no-egress, read-only on system configuration, and non-remediating.

The release includes the AIX and IBM i runners, definitions downloader, review
helper and validator, the byte-identical aixray-aix.sh compatibility alias,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The canonical site is https://powertruesystems.com/ptxray/ and the canonical
repository is https://github.com/PowerTrueSYS/ptxray-public. The legacy site
URL https://powertruesystems.com/aixray/ has an active HTTP 308 redirect to
the canonical site, which returns HTTP 200. The legacy GitHub repository URL
https://github.com/PowerTrueSYS/aixray-public has an active HTTP 301 redirect
to the canonical repository, which returns HTTP 200. These redirect facts
preserve old links while all current documentation and release assets use the
PTxray name.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.4.0

If you downloaded v1.3.0, download v1.4.0 and run it again. This release
rewrites what a scan hands you. The checks still read the same box the same
read-only way; the report they produce is new, and 25 checks that could only
ever report an inventory or a refusal have been taken out of the compliance
groups rather than left padding the count.

Two things this release does not do, stated up front so you can plan around
them: the currency producer lane is not in this release, and the currency
section of a scan says so in as many words instead of implying a clean result.

IBM i edition

ptxray-ibmi.sh ships unchanged from v1.3.0 apart from its declared version: same
CIS IBM i V7R4M0 / V7R5M0 Benchmark v2.1.0 grading on IBM i 7.4 and 7.5, same read-only
PASE run. The report rewrite above is the AIX edition's; the IBM i report is the v1.3.0 form.

What changed for you

The report is new. A scan now produces one structured document and renders
every view from it — the HTML report, the print form and the terminal
snapshot are three views of one document, never three separate calculations.
That is the whole point of the rewrite: a number in the printed page and the
same number on your terminal cannot disagree, because neither one computed it.

The page is three things, top to bottom, and nothing else:

• The hero. A five-ring aperture, one ring per pillar, each ring labelled
  with its score and its name and each label a link into that pillar's
  section. The middle carries the overall score, the hostname and the scan
  date — or NOT SCORED and an n OF m ASSESSED line when coverage is too
  thin to grade honestly.
• The pillar sections. One collapsed section per pillar. The summary row
  carries a gauge, the pillar name, the context that pillar is judged in
  (the AIX level, the firmware level, the standards you selected), a
  one-line statement of how the score was derived, and a proportional
  FAIL/WARN/PASS bar. Opening a section lists its controls, worst first, each
  with its verdict, what was found, and the command and captured output the
  verdict came from.
• The Blueprint box. The last element on the page.

The report carries findings and evidence. It does not carry remediation.
No fix text, no cost estimate, no outage window appears on any row. That is a
deliberate line: the report is the X-ray, and a remediation plan for your box
is a separate piece of work that starts from it.

A refusal reads as a refusal. A control PTxray could not assess renders
the word NOT ASSESSED, a box saying why it could not be assessed, and the
severity that control would have carried — as ck-sec-apars does on our lab
box, rendering NOT ASSESSED, The probe ran but produced no output to assess. and a high exposure — so an unassessed critical control
cannot sit on the page wearing the same shape as a passing one. It groups
with the warnings and it counts...

PTxray v1.6.0

Release notes

v1.6.0

PTxray 1.6.0 is the current published release for IBM AIX and IBM i. It is the
first release that ships the report: two report runners and the tool tree they
call, so a scan produces the PTxray report page (report.html), its print form,
and the Blueprint feed — not only verdict tables.

What is new

• Report runners. ptxray-report-aix-1.6.0.tar and
  ptxray-report-ibmi-1.6.0.tar each carry a runner (dist/tools/aixray-scan.ksh,
  dist/tools/ibmi-scan.ksh), the tool tree and data it calls, and a
  README-REPORT.md naming the exact command. The runner writes report.html,
  report.json, scan.ptx (the Blueprint input on AIX) and, on IBM i,
  ptxray-ibmi.json (the Blueprint input on IBM i). The one-file scripts alone
  do not produce the report.
• Definitions by default. The runners download the latest signed definitions
  by default. Opt out with --offline (cache only) or --definitions-bundle FILE
  to point at definitions you copied in for air-gapped machines.
• DISA STIG for AIX 7.x. The AIX report runner assesses 91 of the 283 STIG
  requirements (the one-file script carries a smaller subset) alongside CIS Level 1,
  CIS Level 2 and FFIEC; each standard is selectable at scan time and the report
  carries an overall grade per selected standard.
• IBM i edition. 122 controls against the CIS IBM i 7.5 Benchmark v2.1.0
  (Level 1 and Level 2), the IBM i security bulletins/CVE currency, release
  support and PTF group status, rendered on the same report design as AIX.
• Every check has a Blueprint entry. The Blueprint (the sequenced treatment
  plan) covers every control in this release, AIX and IBM i, 1:1.

Not assessed in this release (typed refusals, never silent)

• IBM i firmware currency, PTF group currency and Security/HIPER group currency:
  the IBM SYSTOOLS currency views they need are outbound calls to IBM FLRT/PSP,
  which the assessment boundary bans. An explicit --allow-ibm-lookup opt-in
  arrives in 1.7. The IBM i overall grade is computed from the Security pillar;
  the Currency pillar is shown as not scored.
• IBM i SMTP relay (ALWRLY): its on-disk store could not be verified.
• AIX SMS multi-boot state and residual human/application accounts require an
  administrator / ISSO review by design.

Unchanged from 1.5.0

The AIX runner requires root; the IBM i runner requires QSECOFR. Assessment
probes remain no-egress, read-only on system configuration, and non-remediating
(the only network component is the separate ptxray-defs.sh). The release set
is offline-signed: eleven assets — the six 1.5 artifacts (ptxray-aix.sh, the
byte-identical aixray-aix.sh alias, ptxray-defs.sh, ptxray-ibmi.sh,
ptxray-review-pack.sh, ptxray-review-validate.awk), the two report bundles,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is unchanged:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The one-file scripts remain in the release set for compatibility; they are
scheduled to retire in 1.7 in favour of the report runners.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.5.0

PTxray 1.5.0 is the current published release for IBM AIX and IBM i. It
completes the AIXray-to-PTxray rename, separates signed-definition acquisition
from assessment, and publishes an offline-signed nine-asset release set.

The AIX runner requires root; the IBM i runner requires
QSECOFR. Each runner authenticates and invokes the separate adjacent
ptxray-defs.sh before assessment. Connected mode attempts a signed-definitions
update by default, while --offline uses a signed cache and
--definitions-bundle accepts a local signed bundle. Assessment probes remain
no-egress, read-only on system configuration, and non-remediating.

The release includes the AIX and IBM i runners, definitions downloader, review
helper and validator, the byte-identical aixray-aix.sh compatibility alias,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The canonical site is https://powertruesystems.com/ptxray/ and the canonical
repository is https://github.com/PowerTrueSYS/ptxray-public. The legacy site
URL https://powertruesystems.com/aixray/ has an active HTTP 308 redirect to
the canonical site, which returns HTTP 200. The legacy GitHub repository URL
https://github.com/PowerTrueSYS/aixray-public has an active HTTP 301 redirect
to the canonical repository, which returns HTTP 200. These redirect facts
preserve old links while all current documentation and release assets use the
PTxray name.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.4.0

If you downloaded v1.3.0, download v1.4.0 and run it again. This release
rewrites what a scan hands you. The checks still read the same box the same
read-only way; the report they produce is new, and 25 checks that could only
ever report an inventory or a refusal have been taken out of the compliance
groups rather than left padding the count.

Two things this release does not do, stated up front so you can plan around
them: the currency producer lane is not in this release, and the currency
section of a scan says so in as many words instead of implying a clean result.

IBM i edition

ptxray-ibmi.sh ships unchanged from v1.3.0 apart from its declared version: same
CIS IBM i V7R4M0 / V7R5M0 Benchmark v2.1.0 grading on IBM i 7.4 and 7.5, same read-only
PASE run. The report rewrite above is the AIX edition's; the IBM i report is the v1.3.0 form.

What changed for you

The report is new. A scan now produces one structured document and renders
every view from it — the HTML report, the print form and the terminal
snapshot are three views of one document, never three separate calculations.
That is the whole point of the rewrite: a number in the printed page and the
same number on your terminal cannot disagree, because neither one computed it.

The page is three things, top to bottom, and nothing else:

• The hero. A five-ring aperture, one ring per pillar, each ring labelled
  with its score and its name and each label a link into that pillar's
  section. The middle carries the overall score, the hostname and the scan
  date — or NOT SCORED and an n OF m ASSESSED line when coverage is too
  thin to grade honestly.
• The pillar sections. One collapsed section per pillar. The summary row
  carries a gauge, the pillar name, the context that pillar is judged in
  (the AIX level, the firmware level, the standards you selected), a
  one-line statement of how the score was derived, and a proportional
  FAIL/WARN/PASS bar. Opening a section lists its controls, worst first, each
  with its verdict, what was found, and the command and captured output the
  verdict came from.
• The Blueprint box. The last element on the page.

The report carries findings and evidence. It does not carry remediation.
No fix text, no cost estimate, no outage window appears on any row. That is a
deliberate line: the report is the X-ray, and a remediation plan for your box
is a separate piece of work that starts from it.

A refusal reads as a refusal. A control PTxray could not assess renders
the word NOT ASSESSED, a box saying why it could not be assessed, and the
severity that control would have carried — as ck-sec-apars does on our lab
box, rendering NOT ASSESSED, The probe ran but produced no output to assess. and a high exposure — so an unassessed critical control
cannot sit on the page wearing the same shape as a passing one. It groups
with the warnings and it counts as a warning in the pillar score. It is never
folded into the passes.

A print form. The report converts to a page-broken print layout you send
to Print → Save as PDF in any browser. Page one is the hero plus a one-line
index of every pillar; each pillar then expands onto its own page, opened, so
a printed copy carries the same evidence a clicked-open browser copy does.
There is no PDF binary, no font download and no network call anywhere in that
path.

A terminal snapshot. Add --tty alongside --out and the same document
also renders as a compact ASCII headline on stderr — host, platform, OS level,
scan date and the overall score — so a scripted run can log the verdict without
parsing HTML. It is a modifier on the report, not a mode of its own: the report
is still written to --out, and the snapshot goes to stderr so it never mixes
into piped output.

A provenance stamp on every report, not only when something is wrong.
Each definitions source renders its id, whether it was bundled or fetched,
its as_of date, its origin, and its age in whole days — with STALE when
that age exceeds 30 days. You can tell at a glance how old the data behind a
verdict is, on a clean report as much as on a bad one.

The pare: 25 checks out of the groups

Twenty-five checks are flagged pared and no longer appear in any compliance
group. Eight were refusal-only or inventory-only — they reported what is
installed, or reported that they could not judge, without ever rendering a
verdict. Seventeen were performance and housekeeping tuning checks that do
not belong in a security-and-currency posture scan.

The check directories stay: several remain useful as fact emitters and the
history is preserved. What changes is that they stop inflating a compliance
denominator they were never going to answer.

One customer-visible coverage change: the FFIEC group drops from 34 to 31
controls. ck-fs-lv-slack, ck-jfs-legacy (II.C.11) and ck-savevg
(II.C.21) were the only pared checks carrying compliance tags. CIS Level 1
and Level 2 and STIG coverage...

PTxray v1.5.0

Release notes

v1.5.0

PTxray 1.5.0 is the current published release for IBM AIX and IBM i. It
completes the AIXray-to-PTxray rename, separates signed-definition acquisition
from assessment, and publishes an offline-signed nine-asset release set.

The AIX runner requires root; the IBM i runner requires
QSECOFR. Each runner authenticates and invokes the separate adjacent
ptxray-defs.sh before assessment. Connected mode attempts a signed-definitions
update by default, while --offline uses a signed cache and
--definitions-bundle accepts a local signed bundle. Assessment probes remain
no-egress, read-only on system configuration, and non-remediating.

The release includes the AIX and IBM i runners, definitions downloader, review
helper and validator, the byte-identical aixray-aix.sh compatibility alias,
SHA256SUMS, its detached signature, and the release public key. The
authoritative release-key fingerprint is:

sha256:c2fa7dc69be3dead5e196eca6a9c48ece42a7105eb9f56ab9f620bd0c6c617bd

The canonical site is https://powertruesystems.com/ptxray/ and the canonical
repository is https://github.com/PowerTrueSYS/ptxray-public. The legacy site
URL https://powertruesystems.com/aixray/ has an active HTTP 308 redirect to
the canonical site, which returns HTTP 200. The legacy GitHub repository URL
https://github.com/PowerTrueSYS/aixray-public has an active HTTP 301 redirect
to the canonical repository, which returns HTTP 200. These redirect facts
preserve old links while all current documentation and release assets use the
PTxray name.

The VIOS lane remains disabled pending live VIOS acceptance and is not claimed
by this release.

v1.4.0

If you downloaded v1.3.0, download v1.4.0 and run it again. This release
rewrites what a scan hands you. The checks still read the same box the same
read-only way; the report they produce is new, and 25 checks that could only
ever report an inventory or a refusal have been taken out of the compliance
groups rather than left padding the count.

Two things this release does not do, stated up front so you can plan around
them: the currency producer lane is not in this release, and the currency
section of a scan says so in as many words instead of implying a clean result.

IBM i edition

ptxray-ibmi.sh ships unchanged from v1.3.0 apart from its declared version: same
CIS IBM i V7R4M0 / V7R5M0 Benchmark v2.1.0 grading on IBM i 7.4 and 7.5, same read-only
PASE run. The report rewrite above is the AIX edition's; the IBM i report is the v1.3.0 form.

What changed for you

The report is new. A scan now produces one structured document and renders
every view from it — the HTML report, the print form and the terminal
snapshot are three views of one document, never three separate calculations.
That is the whole point of the rewrite: a number in the printed page and the
same number on your terminal cannot disagree, because neither one computed it.

The page is three things, top to bottom, and nothing else:

• The hero. A five-ring aperture, one ring per pillar, each ring labelled
  with its score and its name and each label a link into that pillar's
  section. The middle carries the overall score, the hostname and the scan
  date — or NOT SCORED and an n OF m ASSESSED line when coverage is too
  thin to grade honestly.
• The pillar sections. One collapsed section per pillar. The summary row
  carries a gauge, the pillar name, the context that pillar is judged in
  (the AIX level, the firmware level, the standards you selected), a
  one-line statement of how the score was derived, and a proportional
  FAIL/WARN/PASS bar. Opening a section lists its controls, worst first, each
  with its verdict, what was found, and the command and captured output the
  verdict came from.
• The Blueprint box. The last element on the page.

The report carries findings and evidence. It does not carry remediation.
No fix text, no cost estimate, no outage window appears on any row. That is a
deliberate line: the report is the X-ray, and a remediation plan for your box
is a separate piece of work that starts from it.

A refusal reads as a refusal. A control PTxray could not assess renders
the word NOT ASSESSED, a box saying why it could not be assessed, and the
severity that control would have carried — as ck-sec-apars does on our lab
box, rendering NOT ASSESSED, The probe ran but produced no output to assess. and a high exposure — so an unassessed critical control
cannot sit on the page wearing the same shape as a passing one. It groups
with the warnings and it counts as a warning in the pillar score. It is never
folded into the passes.

A print form. The report converts to a page-broken print layout you send
to Print → Save as PDF in any browser. Page one is the hero plus a one-line
index of every pillar; each pillar then expands onto its own page, opened, so
a printed copy carries the same evidence a clicked-open browser copy does.
There is no PDF binary, no font download and no network call anywhere in that
path.

A terminal snapshot. Add --tty alongside --out and the same document
also renders as a compact ASCII headline on stderr — host, platform, OS level,
scan date and the overall score — so a scripted run can log the verdict without
parsing HTML. It is a modifier on the report, not a mode of its own: the report
is still written to --out, and the snapshot goes to stderr so it never mixes
into piped output.

A provenance stamp on every report, not only when something is wrong.
Each definitions source renders its id, whether it was bundled or fetched,
its as_of date, its origin, and its age in whole days — with STALE when
that age exceeds 30 days. You can tell at a glance how old the data behind a
verdict is, on a clean report as much as on a bad one.

The pare: 25 checks out of the groups

Twenty-five checks are flagged pared and no longer appear in any compliance
group. Eight were refusal-only or inventory-only — they reported what is
installed, or reported that they could not judge, without ever rendering a
verdict. Seventeen were performance and housekeeping tuning checks that do
not belong in a security-and-currency posture scan.

The check directories stay: several remain useful as fact emitters and the
history is preserved. What changes is that they stop inflating a compliance
denominator they were never going to answer.

One customer-visible coverage change: the FFIEC group drops from 34 to 31
controls. ck-fs-lv-slack, ck-jfs-legacy (II.C.11) and ck-savevg
(II.C.21) were the only pared checks carrying compliance tags. CIS Level 1
and Level 2 and STIG coverage are unchanged.

The backup checks in the pared set are not lost work — the questions they
tried to answer from inside an LPAR are better answered by asking you during
onboarding, which is where they are going.

Under the hood: one control, one tool

The scanner is built from per-tool modules rather than one script with
everything inlined. The runner's job is to run doors and pass their output
along; it does not contain a check body, a probe or an HTML row. Every
hardware and OS fact on the report — the machine, the AIX level, the firmware
level, CPU, memory, paging, filesystems, storage and recovery posture — now
comes from a probe captured on your box and handed to a pure transformer that
parses it and invents nothing.

Currency: an honest refusal, not a clean result

The currency producer lane is not in this release. It lands after 1.4.

PTxray's currency evaluation needs producer records describing which
definition sources are loaded. Those producers are not built yet. Rather than
render a currency section that looks fine because it had nothing to judge,
the currency lane refuses and says so. On a completely healthy box, on a
completely broken box, the answer today is the same refusal — that is the
correct behaviour for a component that cannot see its inputs, and it is
called out here so nobody reads a quiet currency panel as a pass.

The definitions lane is a different mechanism and its evaluator does work.
Supply a .aixray-defs bundle and PTxray reads every source in it offline,
with no network call: on our lab box a current bundle evaluated to
UNVERIFIED because one source was 42 days old against a 30-day threshold — a
real verdict on real data, which is exactly what the currency lane cannot yet
give you.

How to supply the bundle. --html requires --definitions-bundle, and
that is the path we test and ship: the bundle's sources are evaluated offline
and stamped into the report's provenance block. Passing
--definitions-bundle without --html, to get the standalone acquisition
block on its own, does not complete in this build — the tool that produces
that block's input does not exist in the tree yet. Use the bundle through the
report.

What did not change

PTxray is still a read-only assessment. It does not remediate findings,
install or remove software, change configuration, restart services, alter
accounts, or reboot the system.

The on-box scanner is still honest about air-gapped operation: it does not
phone home, fetch reference data, upload a report, perform a live DNS lookup,
or open an outbound network connection. The new report is a single
self-contained HTML file — no external stylesheet, no external script, no
remote font, no remote image. Reports stay local unless you choose to
transfer them.

Already fixed for 1.4.1

Four things are known and scheduled rather than silently carried:

• The print form drops the provenance stamp. report.html carries the
  definition-source block; report-print.html does not.
• Checks describe their reasons in prose. When a control is NOT ASSESSED
  or N/A, PTxray infers a typed reason by pattern-matching the sentence the
  check wrote. Unrecognised wording now degrades to "Reason not typed b...

PTxray v1.4.0

Release notes

v1.4.0

If you downloaded v1.3.0, download v1.4.0 and run it again. This release
rewrites what a scan hands you. The checks still read the same box the same
read-only way; the report they produce is new, and 25 checks that could only
ever report an inventory or a refusal have been taken out of the compliance
groups rather than left padding the count.

Two things this release does not do, stated up front so you can plan around
them: the currency producer lane is not in this release, and the currency
section of a scan says so in as many words instead of implying a clean result.

IBM i edition

ptxray-ibmi.sh ships unchanged from v1.3.0 apart from its declared version: same
CIS IBM i V7R4M0 / V7R5M0 Benchmark v2.1.0 grading on IBM i 7.4 and 7.5, same read-only
PASE run. The report rewrite above is the AIX edition's; the IBM i report is the v1.3.0 form.

What changed for you

The report is new. A scan now produces one structured document and renders
every view from it — the HTML report, the print form and the terminal
snapshot are three views of one document, never three separate calculations.
That is the whole point of the rewrite: a number in the printed page and the
same number on your terminal cannot disagree, because neither one computed it.

The page is three things, top to bottom, and nothing else:

• The hero. A five-ring aperture, one ring per pillar, each ring labelled
  with its score and its name and each label a link into that pillar's
  section. The middle carries the overall score, the hostname and the scan
  date — or NOT SCORED and an n OF m ASSESSED line when coverage is too
  thin to grade honestly.
• The pillar sections. One collapsed section per pillar. The summary row
  carries a gauge, the pillar name, the context that pillar is judged in
  (the AIX level, the firmware level, the standards you selected), a
  one-line statement of how the score was derived, and a proportional
  FAIL/WARN/PASS bar. Opening a section lists its controls, worst first, each
  with its verdict, what was found, and the command and captured output the
  verdict came from.
• The Blueprint box. The last element on the page.

The report carries findings and evidence. It does not carry remediation.
No fix text, no cost estimate, no outage window appears on any row. That is a
deliberate line: the report is the X-ray, and a remediation plan for your box
is a separate piece of work that starts from it.

A refusal reads as a refusal. A control PTxray could not assess renders
the word NOT ASSESSED, a box saying why it could not be assessed, and the
severity that control would have carried — as ck-sec-apars does on our lab
box, rendering NOT ASSESSED, The probe ran but produced no output to assess. and a high exposure — so an unassessed critical control
cannot sit on the page wearing the same shape as a passing one. It groups
with the warnings and it counts as a warning in the pillar score. It is never
folded into the passes.

A print form. The report converts to a page-broken print layout you send
to Print → Save as PDF in any browser. Page one is the hero plus a one-line
index of every pillar; each pillar then expands onto its own page, opened, so
a printed copy carries the same evidence a clicked-open browser copy does.
There is no PDF binary, no font download and no network call anywhere in that
path.

A terminal snapshot. Add --tty alongside --out and the same document
also renders as a compact ASCII headline on stderr — host, platform, OS level,
scan date and the overall score — so a scripted run can log the verdict without
parsing HTML. It is a modifier on the report, not a mode of its own: the report
is still written to --out, and the snapshot goes to stderr so it never mixes
into piped output.

A provenance stamp on every report, not only when something is wrong.
Each definitions source renders its id, whether it was bundled or fetched,
its as_of date, its origin, and its age in whole days — with STALE when
that age exceeds 30 days. You can tell at a glance how old the data behind a
verdict is, on a clean report as much as on a bad one.

The pare: 25 checks out of the groups

Twenty-five checks are flagged pared and no longer appear in any compliance
group. Eight were refusal-only or inventory-only — they reported what is
installed, or reported that they could not judge, without ever rendering a
verdict. Seventeen were performance and housekeeping tuning checks that do
not belong in a security-and-currency posture scan.

The check directories stay: several remain useful as fact emitters and the
history is preserved. What changes is that they stop inflating a compliance
denominator they were never going to answer.

One customer-visible coverage change: the FFIEC group drops from 34 to 31
controls. ck-fs-lv-slack, ck-jfs-legacy (II.C.11) and ck-savevg
(II.C.21) were the only pared checks carrying compliance tags. CIS Level 1
and Level 2 and STIG coverage are unchanged.

The backup checks in the pared set are not lost work — the questions they
tried to answer from inside an LPAR are better answered by asking you during
onboarding, which is where they are going.

Under the hood: one control, one tool

The scanner is built from per-tool modules rather than one script with
everything inlined. The runner's job is to run doors and pass their output
along; it does not contain a check body, a probe or an HTML row. Every
hardware and OS fact on the report — the machine, the AIX level, the firmware
level, CPU, memory, paging, filesystems, storage and recovery posture — now
comes from a probe captured on your box and handed to a pure transformer that
parses it and invents nothing.

Currency: an honest refusal, not a clean result

The currency producer lane is not in this release. It lands after 1.4.

PTxray's currency evaluation needs producer records describing which
definition sources are loaded. Those producers are not built yet. Rather than
render a currency section that looks fine because it had nothing to judge,
the currency lane refuses and says so. On a completely healthy box, on a
completely broken box, the answer today is the same refusal — that is the
correct behaviour for a component that cannot see its inputs, and it is
called out here so nobody reads a quiet currency panel as a pass.

The definitions lane is a different mechanism and its evaluator does work.
Supply a .aixray-defs bundle and PTxray reads every source in it offline,
with no network call: on our lab box a current bundle evaluated to
UNVERIFIED because one source was 42 days old against a 30-day threshold — a
real verdict on real data, which is exactly what the currency lane cannot yet
give you.

How to supply the bundle. --html requires --definitions-bundle, and
that is the path we test and ship: the bundle's sources are evaluated offline
and stamped into the report's provenance block. Passing
--definitions-bundle without --html, to get the standalone acquisition
block on its own, does not complete in this build — the tool that produces
that block's input does not exist in the tree yet. Use the bundle through the
report.

What did not change

PTxray is still a read-only assessment. It does not remediate findings,
install or remove software, change configuration, restart services, alter
accounts, or reboot the system.

The on-box scanner is still honest about air-gapped operation: it does not
phone home, fetch reference data, upload a report, perform a live DNS lookup,
or open an outbound network connection. The new report is a single
self-contained HTML file — no external stylesheet, no external script, no
remote font, no remote image. Reports stay local unless you choose to
transfer them.

Release process note

The sec-14-review gate was skipped for this release by operator ruling on
2026-08-23. It is recorded here rather than left out of the record.

Already fixed for 1.4.1

Four things are known and scheduled rather than silently carried:

• The print form drops the provenance stamp. report.html carries the
  definition-source block; report-print.html does not.
• Checks describe their reasons in prose. When a control is NOT ASSESSED
  or N/A, PTxray infers a typed reason by pattern-matching the sentence the
  check wrote. Unrecognised wording now degrades to "Reason not typed by the
  check." rather than failing the report, but the durable fix is for checks to
  emit a typed reason field alongside the prose.
• A single non-conforming row can still cost the whole report. The
  renderer validates the document before it renders and refuses outright on a
  uniqueness violation. It should degrade the offending row instead: a report
  with one under-typed row is worth more than no report.
• The currency producer lane. See above.

Known limitations

The v1.2.0 known limitations all still apply:

• Run as root for the intended coverage. A non-root run is supported but
  incomplete because several patch, dump, boot, account, audit, SSH, and
  service-policy reads require privilege.
• The public scanner neither fetches nor bundles IBM's flrtvc.ksh or full
  apar.csv. A complete current CVE sweep requires an authorized, locally
  supplied FLRTVC report or inputs. Without them, source-dependent clean
  results remain incomplete.
• This is a point-in-time, bounded posture scan, not continuous monitoring or
  an exhaustive filesystem/application audit. Workload-specific tuning and
  controls outside a read-only in-LPAR view still require administrator
  review.
• A review-pack file is pseudonymized, not anonymized. It can retain
  operational detail and must be inspected locally before sharing; never send
  its separate decoding key with it.
• Producing a report writes the operator-selected output. Locally supplied
  FLRTVC inputs also use a private temporary directory; an abru...

PTxray v1.3.0

Release notes

v1.3.0

PTxray joins the IBM i platform and takes its production name. This release
renames the project from AIXray to PTxray and adds a dedicated IBM i
edition alongside the existing AIX assessment.

IBM i edition

ptxray-ibmi.sh is a new read-only IBM i assessment that runs from PASE
(/QOpenSys/usr/bin/ksh). On IBM i 7.4 and 7.5 it is graded against the CIS
IBM i V7R4M0 / V7R5M0 Benchmark v2.1.0: 76 of 89 CIS Level 1 controls receive
an automated verdict on 7.5, and 73 of 88 on 7.4. Uncovered Level 1 controls
are CIS-manual or not-yet-implemented and are disclosed by the scanner rather
than dropped (registry as_of 2026-08-19); on other releases it reports the
release-independent evidence it can assess and omits borrowed control numbers.
Like the AIX edition it
changes nothing, installs nothing, and makes no network calls during
assessment, and it reports NOT_ASSESSED when evidence is unavailable rather
than inventing a result. There is no DISA STIG for IBM i, so none is claimed.

PTxray rename

The AIX assessment is now ptxray-aix.sh, and the review helpers are
ptxray-review-pack.sh and ptxray-review-validate.awk. For continuity, each
release also publishes aixray-aix.sh as a byte-identical alias so download
links and report footers minted before the rename keep resolving; the alias
will be retired at a future major release.

Download

The release assets are ptxray-aix.sh, ptxray-ibmi.sh,
ptxray-review-pack.sh, ptxray-review-validate.awk, the aixray-aix.sh
alias, and SHA256SUMS. Download the assets, verify them against
SHA256SUMS, and run the edition for your platform.

v1.2.0

A reference-data and inventory release. The standalone check-module count grows
from 324 to 387; the public package is the assembled monolith, the two
review-pack helpers, and those 387 modules — 390 build outputs in all. If you
downloaded v1.1.0, download v1.2.0, verify it against SHA256SUMS, and run it
again.

Security APAR seed

A current AIX 7.3 TL4 (7300-04) system can now be judged against bundled
security APAR rows. v1.1.0 carried no 7300-04 seed row, so ck-sec-apars
refused with "no bundled security APAR rows apply". v1.2.0 adds IJ59563
(7300-04) and the sibling TL rows IJ59564 (7300-03), IJ59565 (7300-02) and
IJ59566 (7200-05), all carrying CVE-2026-16923 (bos.mp64 local privilege
escalation). The check still refuses when instfix cannot read the fix
database; that is evidence handling, not a missing table row.

Three HIPER rows for IBM node 7278066
(devices.pciex.7710612214105006.com) are now in the same seed: IJ57378
(7300-04), IJ57303 (7300-03), IJ57855 (7200-05). IBM publishes no CVE for
that node, so the display field carries the non-CVE token HIPER-7278066.

Firmware floor table

The firmware floor table is now keyed on the full machine-type-model, so current
Power10 E1050 (9043-*) and E1080 (9080-HEX) systems resolve to a bundled
family instead of falling out of the type-only lookup. Power9 E980 (9080-M9S)
is listed. Scale-out 9105 and 9009 rows are globbed (9105-*, 9009-*).

Check inventory

Standalone check modules grow from 324 to 387. Each new module is a
self-contained ck-* tool; the public tag carries all 387 plus the assembled
monolith and the two review-pack helpers, which is the 390 build outputs above.
This is an inventory change, not a change of shape — AIXray is still one
inspectable script you read before it runs, with the standalone tools published
alongside it.

CIS Level 1 demonstrated coverage is unchanged from v1.1.0 at 208 of 212
controls (209 mapped); 4.1.1.19 remains mapped but has
never rendered a determinate verdict on a committed fixture. The CIS Level 2
surface and the published count basis are otherwise unchanged.

Reference data

Reference-data as_of dates advance to 2026-08-18 for the IBM AIX lifecycle,
IBM security advisory, and CIS IBM AIX reference sources. The DISA STIG for IBM
AIX source stays at 2026-06-15 — that is DISA's publisher benchmark date, not a
curator stamp.

The 30-day lifecycle and security-advisory freshness thresholds start from
2026-08-18. A default installation renders those sources STALE after 2026-09-17
unless a later refresh ships.

Two post-vintage IBM advisories remain documented gaps, the same class as in
v1.1.0: IBM publishes no AIX Level→APAR table for them, so both stay on the
operator-supplied FLRTVC path.

What did not change

No remediation of findings, no configuration change. AIXray reads and
reports. It does not remediate a host, install or remove software, change
configuration, restart services, alter accounts, or reboot the system.

Zero network calls during assessment execution. The scanner does not phone
home, fetch reference data, upload a report, perform a live DNS lookup, or open
an outbound network connection. Reports stay local unless an operator chooses to
transfer them. Obtaining the script is, as always, a separate download.

The download is still the monolith plus the standalone ck-* tools.

Known limitations

AIXray v1's known limitations, unchanged since v1.0.0:

• Run as root for the intended coverage. A non-root run is supported but
  incomplete, because several patch, dump, boot, account, audit, SSH and
  service-policy reads require privilege.
• The public scanner neither fetches nor bundles IBM's flrtvc.ksh or full
  apar.csv. A complete current CVE sweep requires an authorized, locally
  supplied FLRTVC report or inputs. Without them, source-dependent clean results
  remain incomplete.
• This is a point-in-time, bounded posture scan, not continuous monitoring or an
  exhaustive filesystem or application audit. Workload-specific tuning and
  controls outside a read-only in-LPAR view still require administrator review.
• A review-pack file is pseudonymized, not anonymized. It can retain operational
  detail and must be inspected locally before sharing; never send its separate
  decoding key with it.
• Producing a report writes the operator-selected output. Locally supplied
  FLRTVC inputs also use a private temporary directory; an abrupt termination
  can leave that directory for manual removal. Neither operation changes
  assessed AIX/VIOS configuration or state.

v1.1.0

A defect-fix release. Zero new checks: the check-module count stays 324,
unchanged from v1.0.0. If you downloaded v1.0.0, download v1.1.0, verify it
against SHA256SUMS, and run it again.

SRC parser fixes

The parser fixes are all in the shared SRC (lssrc -a) capture fragment consumed
by the 16 SRC/rctcpip service checks — writesrv, dt, piobe, qdaemon, and the 12
rc.tcpip subserver checks. Two parser defects are closed:

Right-anchored SRC status parse. The v1.0.0 parser accepted only two exact
lssrc -a row shapes: a four-field row ending in active and a three-field row
ending in inoperative. Subsystem rows without a group column — present in real
inventories, proven by live captures from two AIX boxes — fit neither shape, and
the parser fails closed: a single rejected row discarded the entire SRC
inventory, so the affected checks refused with NOT_ASSESSED rather than assess.
No wrong verdict was emitted. The status field is now right-anchored against the
known status vocabulary, and groupless rows are retained.

Open SRC status vocabulary. Transitional states stopping and starting now
classify as running; previously an unrecognized state — stopping was captured
live — discarded the whole inventory the same way, withholding SRC evidence from
all 16 checks.

In practical terms for a v1.0.0 operator: on systems whose lssrc -a inventory
contains a groupless or transitional-state row, the affected service checks
reported NOT_ASSESSED; v1.1.0 assesses them.

Review-copy pseudonymizer fix

The discover_after extractor could not match identity labels ending in =;
the fail-closed layers held — no observed leak in eight probes, not an
exhaustive proof — and the fix restores the intended coverage.

Reference data

The reference-data as_of advances to 2026-08-11 after a live-feed curation
review. Table content (lifecycle rows, security-advisory rows, the embedded
strict-seed APAR catalogue) is unchanged. Two post-vintage IBM security
advisories — for curl (maximum CVSS 9.8, eight CVEs) and for BIND (CVSS 7.5) —
remain documented gaps: IBM publishes no AIX Level→APAR table for either, so
both stay on the operator-supplied FLRTVC path, same as in v1.0.0.

What did not change

No remediation of findings, no configuration change. AIXray reads and
reports; it does not remediate a host or alter its configuration.

Zero network calls during assessment execution. The assessment logic and
reference data are local to the script. Reports stay local unless the operator
transfers them. Obtaining the script is, as always, a separate download.

v1.0.0

The first stable release. catalog.json declares tool_version 1.0.0 and
the assembled scanner reports VERSION="1.0.0".

What ships

Four release assets, up from two at v0.1.0:

aixray-aix.sh              the assembled scanner
aixray-review-pack.sh      the review-copy helper
aixray-review-validate.awk the independent validator the helper runs
SHA256SUMS                 digests for every payload catalog.json declares

SHA256SUMS now covers the three top-level payloads and every standalone
check tool, not just the top-level files. docs/VERIFY.md derives the payload
set from catalog.json, so the documented verification recipe stays correct as
the catalog grows.

The repository ships 324 standalone check tools under checks/<id>/, each with
its own manifest, alongside the assembled single-file scanner. Every catalog
entry declares read_only: true; 88 of the 324 declare requires_root.

Standards

Checks carry the standard tags they are written against. At this release the
catalog tag census...