ai-security-scanner 0.2.0

ai-security-scanner 0.2.0

Source: d18e920fd495bbaa465cff54e63e93b2d13fbb83

More honest reports, controlled refreshes, and broader evidence.

ai-security-scanner 0.2.0 rewrites the report layer for honesty and readability. Every
severity stays visible, including zeros, while zero and unmeasured values remain distinct.
A check without a verdict is no longer called untested, and a connection test is named as
not a scan in both languages.

Tables are captioned and each header says what it heads. Evidence records carry what the
scanner actually reported, and the Chinese report uses complete Chinese sentences rather
than translated fragments.

The product can now propose upstream adapter refreshes. The client decides whether a
refresh becomes a pull request back to main, and a refresh never claims more than was
actually checked. Every engine build input is gated on a recorded hash.

New coverage includes MCP Armor static configuration results, agentic radar workflow
inventory, and garak probe results read without inventing a severity.

Artifacts offered by this finalized set:

• linux-x86_64 / deb: ai-security-scanner_0.2.0_amd64.deb; technical qualification passed; beginner human path not-observed.

Not offered in this finalized set:

• linux-x86_64 / appimage: not offered (technical-qualification-not-observed).
• linux-x86_64 / rpm: not offered (technical-qualification-not-observed).
• macos-universal / dmg: not offered (technical-qualification-not-observed).
• windows-x86_64 / msi: not offered (authenticode-not-verified;beginner-human-path-not-observed;equivalent-msi-lifecycle-not-observed).
• windows-x86_64 / nsis: not offered (authenticode-not-verified;beginner-human-path-not-observed;real-installed-app-localhost-lifecycle-not-observed).

Verify the selected file against SHA256SUMS.txt and its artifact-specific public provenance before installing.
Qualification, human-path observation, OS signing, notarization, updater availability,
provenance requirements, and known limitations are recorded independently for every offered artifact
in release-metadata.json. An absent platform never implies that it passed.