v0.1.6

The security lens grows a memory: it can now compare two snapshots and gate a pull request on the execution sinks it introduces.

Added

• Attack-surface gate GitHub Action (Rinkia/modscan/attack-surface) — on a pull request it audits the PR and the base branch, diffs them, sticky-comments the result, and fails the check when the PR introduces new execution sinks. It gates the delta, never the standing surface: sinks already on base never fail it. fail-on defaults to high (eval/exec/pickle.loads/yaml.load/os.system) — measured across real packages, the medium tier is dominated by routine __reduce__, dynamic-import and subprocess code, so gating on it is noisy for exactly the plugin hosts MODScan serves. No LLM, no API key, no committed snapshot. MODScan runs it on itself.
• modscan-audit --diff BASE PR — compare two --json attack-surface snapshots and report the sinks the second introduces. Identity is (id, module, call) compared as a counted multiset, so moved code never registers as a change while a third eval added to a module that already had two still shows up.
• modscan-audit --fail-on {high,medium,low,none} — defaults to none: the CLI stays a report, and the policy lives in the gate.

Still enumeration, not taint: an introduced sink is new attack surface to review, and a passing check is not a clean bill of health.

Full diff: v0.1.5...v0.1.6