sounding 0.9.4

First public release.

sounding audits the text that configures an agent — MCP tool contracts, Agent Skills, and prompts — for structural problems, scores them with a formula it prints, writes the corrections, and pins them so drift is caught. One engine, three adapters. Deterministic: no model in the loop, same input same output.

Fixed

• profiles: hyphenated vocabulary (close-up, top-down, off-centre, dall-e) could never match, because normalization turns hyphens into spaces while the patterns still expected the hyphen. A prompt that stated its framing as "extreme close-up, top-down view" was reported as missing composition — the linter flagging a careful author. Every profile pattern now matches the normalized form, with a structural guard so the class can't return. (#1)
• ci: install the package before running the suite, so the tests that shell out to python -m sounding.cli can import it. The first CI run this repo ever had exposed the ordering.
• playground: the embedded wheel is rebuilt from source and verified byte-identical to src/, so the browser and the CLI run the same rules.

Changed

• A clean report now states plainly that no findings means well-formed, not safe — static checks on a declared contract, not a judgement of intent or runtime behaviour. (part of #3)

Known gaps, tracked in the open

• #2 image:subject false positives on plainly stated subjects
• #3 a paraphrased malicious skill can still reach a low finding count
• #4 agent-profile dimensions satisfied by incidental trigger words
• #5 MCP008 penalizes a free-text search query with no honest resolution

Scope, stated plainly: this is static analysis of a declared contract. Nothing is executed, connected to, or scanned. A contract that passes cleanly can still be malicious at runtime.