AuraScan v0.7.0

AuraScan v0.7.0

Contextual Follow-Up Assistant

• Added aurascan ask, aurascan ask --latest, direct retained context and
  incident IDs, and --facts-only.
• Added interactive follow-up after foreground upgrade preflight/aftercare,
  Incident Recovery, Resolve System Findings, weekly maintenance, and Config
  Drift results.
• Existing confirmation prompts accept ? to open questions and then return to
  the unchanged decision.
• AI may select only AuraScan-owned fact, diagnostic-probe, and verified-action
  IDs. It cannot provide commands, package targets, paths, scripts, or edits.
• Requested actions are rebuilt from current local state, shown as one plan,
  and confirmed independently. Parent --yes never authorizes them.
• Sessions are bounded to eight questions, twelve provider requests, a
  60-second request timeout, and 12,000 characters per request.
• Redacted source contexts are fingerprinted and retained privately for 30 days
  or 50 records. Follow-up questions and answers are not persisted.
• Added Doctor checks and regression coverage for private storage, tampering,
  redaction, TTY/service gating, stale plans, provider failures, and workflow
  exit-code isolation.

Contextual follow-up is excluded from recovery mode, package scans, pacman
hooks, root collectors, background services, JSON output, --yes, and
--no-ai workflows in this release.

Hardware-Aware Incident Follow-Up

• Added automatic read-only hardware enrichment for questions about CPU, GPU,
  memory, OOM events, temperatures, fans, BIOS, firmware, microcode, and
  drivers.
• Added bounded CPU/RAM/mainboard/BIOS inventory, GPU and driver state, DIMM
  topology where SMBIOS permits it, hwmon and NVIDIA telemetry, memory
  pressure, and normalized current-boot hardware-error counts.
• Added installed-versus-repository checks for relevant microcode and graphics
  packages plus supported firmware-update discovery through fwupd.
• Added evidence-based Intel 13th/14th Gen desktop microcode guidance without
  treating runtime microcode as proof that motherboard firmware is current.
• Excluded serials, UUIDs, raw SPD/I2C data, raw firmware tables, and arbitrary
  files from retained and AI-visible hardware context.
• Stopped proposing persistent-service restarts for transient desktop
  application units such as app-chromium@....service.

Full-Control Repair Agent

• Added aurascan agent, retained context/incident selection, --access,
  --approval, --output-sharing, --session-timeout, and --facts-only.
• Kept guarded as the default. Optional user-shell and root-shell modes
  accept only strict, visibly previewed command objects from the foreground AI
  session.
• Added each-command, immutable whole-plan, and typed session approval
  modes, with 30-command, 40-provider-request, and session-expiry limits.
• Added a root-owned policy ceiling at /etc/aurascan/agent.conf. Root sessions
  also require the exact per-session phrase GRANT AI FULL ROOT CONTROL.
• Added a root broker with private 0600 requests, UID/process/start-time/TTY/
  context binding, short-lived capabilities, exact plan hashes, and no access
  to AI credentials.
• Added Btrfs/Snapper pre-session snapshots. Continuing without supported
  rollback requires the exact phrase CONTINUE WITHOUT ROLLBACK.
• Added redacted terminal-output sharing by default and a separate
  SHARE FULL TERMINAL OUTPUT grant for bounded raw output.
• Added private user and root audits, 30-day/50-session retention, Doctor
  checks, setup-wizard controls, /agent, /status, and /stop.
• Kept the agent foreground-only. It cannot start from JSON, noninteractive,
  --yes, hooks, root collectors, background services, or Recovery v1.

Unrestricted root mode is explicitly documented as user-authorized remote code
execution. Its commands can defeat AuraScan's own safeguards after execution
begins; snapshots and audit controls do not make that authority safe.

Recovery Image

The application and Arch package advance to v0.7.0. The separately downloadable
Recovery image remains the validated v0.6.0 hybrid BIOS/UEFI image referenced by
the packaged recovery manifest; this release does not claim that a replacement
ISO was built or revalidated.

Validation

• All 885 tests passed.
• Python compilation, strict MEDIUM+ presenter coverage, wheel-content checks,
  systemd unit verification, package metadata generation, and Git diff checks
  passed.
• A package-managed local build was installed and the KDE tray applet was
  restarted successfully.
• Live read-only hardware probing verified DIMM, GPU, sensor, driver,
  microcode, and fwupd categorization without persisting serials or UUIDs.

AuraScan v0.6.0

AuraScan v0.6.0

AuraScan v0.6.0 introduces an AI-Assisted Recovery Environment for diagnosing
and repairing an Arch-family installation that cannot boot normally.

Highlights

• Added aurascan recovery management, status, local UKI build, atomic refresh,
  removal, verified ISO download, and guarded removable-disk writing.
• Added a guided recovery runtime for Arch Linux, EndeavourOS, Manjaro, and
  CachyOS across Btrfs, ext4, XFS, LUKS2, LVM2, and mdraid discovery paths.
• Added NetworkManager Ethernet/tethering detection, volatile validated saved
  Wi-Fi profile use, and manual open/WPA2/WPA3/hidden Wi-Fi connection.
• Added deterministic offline boot/package diagnostics and two-pass recovery AI
  that can select only opaque local probes and prioritize verified actions.
• Added confirmed recovery recipes for package state, repositories, kernel and
  module support, DKMS, initramfs, config drift, cache pressure, noncritical
  boot services, snapshots, and positively detected bootloaders.
• Added mkosi's built-in mkosi-initrd profile and ukify, a systemd recovery
  runtime, Limine/systemd-boot/GRUB adapters, a recovery refresh hook, private
  state, and Archiso release profiles.
• Incident AI now allows 60 seconds per request and distinguishes provider
  timeouts, transport failures, and invalid guarded JSON responses while
  retaining deterministic diagnostics.
• Unprivileged incident scans now treat root-only pstore access as optional;
  root collector permission failures remain visible for diagnosis.

Safety Boundaries

• Installation remains explicit; the Arch package never writes the ESP or
  enables a recovery entry.
• Secure Boot installation requires an already enrolled sbctl-compatible owner
  key. AuraScan does not enroll keys.
• AI never creates commands or executable targets. Provider failure falls back
  to deterministic recovery.
• Snapshot restore and bootloader reinstall require exact typed confirmations.
• Bootloader reinstall recipes preserve firmware variables and restore backed-up
  loader files when command or post-validation checks fail.
• Filesystem repair, partition changes, firmware, authentication policy,
  user-data deletion, arbitrary AI commands, and automatic reboot remain out of
  scope.

Release Artifacts

• aurascan-recovery-0.6.0-x86_64.iso
• aurascan-recovery-0.6.0-x86_64.iso.sha256
• aurascan-recovery-0.6.0-x86_64.iso.packages.txt
• ISO SHA-256:
  e476da5bb3f0aeaf84787d5f623eb5964d0fa9e00903769c561df203ee6821c6

The 1.5 GiB hybrid BIOS/UEFI image contains 464 packages. It uses the LTS
kernel while retaining the complete networking, storage, and repair tool set.
The package manifest is sorted so it can be reviewed and compared
mechanically.

Release Validation

• All 813 tests passed, including recovery networking, storage, transaction,
  snapshot-confirmation, bootloader-refusal, initramfs rollback, privacy, and
  packaging coverage.
• Presenter audits passed in normal, strict, and strict-MEDIUM modes. Python
  compilation, shell syntax, wheel contents, package metadata, and Git diff
  checks also passed.
• Every packaged systemd unit passed systemd-analyze verify. The privileged
  monitor, maintenance, and Safe Autopilot services each received a 0.8 SAFE
  offline security exposure score.
• The Arch package built and tested in a clean chroot. Its 232 installed files
  passed pacman -Qkk with no alterations.
• The ISO booted under SeaBIOS and OVMF. QEMU exercised LUKS2+Btrfs and
  ext4+LVM targets, DHCP and offline operation, interrupted package state,
  snapshot confirmation, and unknown-bootloader refusal.
• The locally built UKI booted under OVMF. Secure Boot OVMF rejected the
  unsigned test copy and booted a copy signed with disposable test keys.
• The exact ISO, expanded root image, initramfs images, EFI image, UKI, wheel,
  source archive, and Arch package passed scans for the configured API key,
  host identity, home paths, Wi-Fi material, and incident evidence.
• The clean release-candidate package is installed on the CachyOS Limine host.
  Recovery image refresh, boot-entry visibility, target discovery, provider
  readiness, offline fallback, Wi-Fi profile validation, and live network scan
  passed without changing the existing CachyOS boot entry.

AuraScan v0.5.0

AuraScan v0.5.0

Assisted background recovery and AI-guided repair planning release. AuraScan's
AI can now choose useful local diagnostics and help prioritize a repair plan
without receiving command-generation or repair authority.

Highlights

• Added a two-pass incident AI workflow. The triage pass may select only
  AuraScan-owned opaque diagnostic probe IDs; the final pass explains and ranks
  only locally verified repair actions.
• Added bounded read-only probes for package integrity, kernel headers and
  DKMS, initramfs readiness, failed noncritical services, cache pressure,
  repository health, and stale package-manager locks.
• Added strict execution limits: at most 24 probe candidates, six AI-selected
  probes, 12 executed probes, 180 seconds of local probe work, and two bounded
  provider requests per incident.
• Added separately opted-in Assisted Background Recovery through a hardened
  systemd --user timer. It can prepare a private repair plan while the user is
  logged in, but cannot run sudo, invoke repairs, or write system paths.
• Added six-hour prepared-plan reuse with evidence fingerprint matching. The
  foreground resolution flow refreshes probes and privileged preconditions
  before presenting one combined repair confirmation.
• Added provider retry backoff, per-UID processing, private background state,
  and a concise tray notification when a verified plan is ready.
• Added an offline root Safe Autopilot service, disabled by default. Its
  unattended allowlist remains limited to reversible stale pacman-lock recovery
  and verified mirrorlist restoration, with manifests, rollback, and a 24-hour
  identical-action cooldown.
• Extended incident reports to schema 1.3 while retaining compatibility with
  1.0 through 1.2 reports.
• Extended the setup wizard and Doctor for background-AI readiness, user timer
  state, probe tools, retry state, root repair policy, and automatic-repair
  outcomes.
• Added a dedicated privacy document describing evidence bounds, redaction,
  storage, AI request limits, and the privilege boundary between collectors,
  the user assistant, and repair execution.

Enablement

Existing foreground incident diagnostics continue to work without background
processing. The new features are explicit opt-ins:

aurascan init --enable-incident-background-ai
aurascan incidents --background-ai-status
sudo aurascan incidents --auto-repair safe

Safe Autopilot may also be left at its default off setting while background
AI prepares broader repairs for foreground confirmation.

Safety Notes

Root boot and weekly collectors remain network-isolated and read-only. The
networked assistant runs unprivileged as the logged-in user. AI can select only
known probe and action IDs; it cannot provide executable targets, commands,
file edits, approval, or a successful repair result. AuraScan rebuilds every
privileged action from trusted current state and revalidates it as root.

Filesystem repair, partition and bootloader changes, authentication policy,
firmware operations, user-data deletion, AUR rebuilds, and automatic rebooting
remain prohibited.

AuraScan v0.4.0

AuraScan v0.4.0

Incident recovery and Arch-family compatibility release focused on making
system maintenance calmer, safer, and easier to act on.

Highlights

• Added aurascan incidents for bounded current-boot, previous-boot, history,
  coredump, and deterministic crash diagnostics.
• Added field-limited coredump collection that never reads core memory, process
  environments, or complete command lines.
• Added redacted, user-opened incident AI review with strict evidence/action ID
  validation and a total 12,000-character input bound.
• Added confirmed repair recipes with fresh root-side precondition checks,
  exact kernel/header version proof, manifests, bounded redacted output, and
  rollback where supported.
• Added an optional hardened previous-boot monitor and one grouped tray
  notification per boot. Package installation leaves the monitor disabled.
• Added coupled weekly incident maintenance with incremental journal/coredump
  checkpoints, a persistent randomized timer, silent clean scans, and no
  background AI or repairs.
• Added dynamic tray states for overdue maintenance, actionable findings, and
  critical incidents, refreshed without restarting the applet.
• Replaced overlapping incident tray entries with one Resolve System
  Findings workflow. It applies verified repairs when available or clearly
  acknowledges reviewed historical evidence so the tray returns to normal.
• Added live stage and elapsed-time feedback to interactive incident scans so
  journal collection, coredump analysis, repair verification, and AI correlation
  no longer leave the terminal looking idle.
• Added package-manager handoff boundaries, repository-transition explanations,
  and a post-upgrade mirror-fallback summary gated by deterministic installed
  version verification. AI is instructed not to mislabel repository metadata as
  an AuraScan error or require manual conflict resolution without concrete evidence.
• Removed the redundant Config Drift Assistant tray entry; upgrade runs still
  invoke config-drift handling automatically, and the standalone CLI remains.
• Removed AuraScan Doctor from the routine tray menu while retaining
  aurascan doctor as the installation and configuration troubleshooting CLI.
• Removed the redundant Dry-run Preflight tray action because the normal
  upgrade action always runs preflight; the report-only CLI remains available.
• Fixed installed-wizard hook discovery so it recognizes the release-safe
  /usr/share/libalpm/hooks/aurascan.hook and does not prompt for a redundant
  local override or resolve a template through Python's packaging module.
• Distinguished NVIDIA NV_ERR_NO_MEMORY allocation failures from confirmed
  kernel/systemd OOM-kill evidence and tightened AI package-causation guidance.
• Added wizard and Doctor coverage for monitoring, journal/coredump access,
  repair tools, private storage, and tray notification readiness.

Package Path

The tagged Arch package installs these additional assets:

• /usr/lib/systemd/system/aurascan-incident-monitor.service
• /usr/lib/systemd/system/aurascan-incident-maintenance.service
• /usr/lib/systemd/system/aurascan-incident-maintenance.timer
• /usr/lib/tmpfiles.d/aurascan-incidents.conf

The package must not enable or start either service or the timer. Users opt in through
aurascan init --enable-incident-monitor.

Safety Notes

The boot and weekly monitors have no network access, make no AI requests, and
never apply repairs. AI cannot generate executable actions. Privileged recipes are rebuilt
from trusted current state and revalidated as root. AuraScan does not automate
filesystem repair, partition or bootloader changes, authentication policy,
firmware operations, user-data deletion, AUR rebuilds, or rebooting.

AuraScan v0.3.0

AuraScan v0.3.0

Public package-path release focused on making AuraScan usable as a native
CachyOS/Arch desktop upgrade companion.

Highlights

• Added the optional aurascan updater tray applet for KDE-style desktops.
• Added per-user XDG autostart install/remove/status commands for the updater.
• Added desktop launcher and icon assets for package-managed installs.
• Added wizard and Doctor coverage for updater tray config, Qt bindings,
  terminal detection, and autostart state.
• Added package metadata for the tray applet optional dependency:
  python-pyqt6.
• Improved Doctor hook reporting so a release-safe packaged hook is accepted
  without requiring a local /etc hook override.
• Kept the tray applet as a launcher only; upgrade preflight, config drift, and
  package scanning remain in the existing CLI flows.

Package Path

The Arch/AUR recipe under packaging/arch/ is intended to install AuraScan as a
package-manager-owned tool:

• /usr/bin/aurascan
• /usr/bin/aurascan-makepkg
• /usr/share/libalpm/hooks/aurascan.hook
• /usr/share/applications/aurascan-updater.desktop
• /usr/share/icons/hicolor/scalable/apps/aurascan-updater.svg

After package installation, run:

aurascan init
aurascan doctor

Safety Notes

AuraScan remains a developer preview. Upgrade preflight, config drift handling,
package scanning, and AI review reduce blind spots but do not prove that a
package, AUR build, or upgrade is safe. The updater tray icon is optional and
does not replace Cachy-Update or Shelly.

AuraScan v0.2.0

AuraScan v0.2.0

Developer-preview release focused on making AuraScan easier to discover and on
turning upgrade safety into a first-class workflow.

Highlights

• Added aurascan upgrade as a native-feeling Arch/CachyOS upgrade preflight.
• Added pacman preview plus paru, yay, and Shelly helper support.
• Added deterministic checks for boot/root space, kernel/module mismatch risk,
  ignored packages, replacements/conflicts, foreign package rebuild risk, and
  .pacnew/.pacsave drift.
• Added raise-only AI review for upgrade risk summaries.
• Added aurascan config-drift for beginner-friendly .pacnew/.pacsave
  review, safe merge planning, backups, and optional redacted AI diff review.
• Added wizard configuration for upgrade preflight and config drift defaults.
• Improved AI configuration behavior for root/sudo hook contexts.

Safety Notes

AuraScan remains a developer preview. A clean report is not proof that a package
or upgrade is safe. AI review is advisory and cannot lower deterministic risk.
Config drift writes create backups, but users should still keep normal system
backups and review sensitive file changes carefully.

Try It

python -m pip install -e ".[test]"
python -m aurascan init
python -m aurascan upgrade --dry-run
python -m aurascan config-drift --dry-run

The Arch packaging skeleton is in packaging/arch/ for users who want to test
package-manager installation locally before a future AUR publication.

AuraScan v0.1.0 developer preview

Initial public developer preview of AuraScan.\n\nHighlights:\n- Conservative Arch/CachyOS package audit flow for pacman hooks and PKGBUILD review.\n- Structured terminal and JSON reporting.\n- Deep static analysis remains explicit and opt-in.\n- Smart update fast path remains gated by context proof, trusted baseline, and trust-boundary diff checks.\n\nThis release is source-only for early review and development.