AuraScan v0.6.0

AuraScan v0.6.0

AuraScan v0.6.0 introduces an AI-Assisted Recovery Environment for diagnosing
and repairing an Arch-family installation that cannot boot normally.

Highlights

• Added aurascan recovery management, status, local UKI build, atomic refresh,
  removal, verified ISO download, and guarded removable-disk writing.
• Added a guided recovery runtime for Arch Linux, EndeavourOS, Manjaro, and
  CachyOS across Btrfs, ext4, XFS, LUKS2, LVM2, and mdraid discovery paths.
• Added NetworkManager Ethernet/tethering detection, volatile validated saved
  Wi-Fi profile use, and manual open/WPA2/WPA3/hidden Wi-Fi connection.
• Added deterministic offline boot/package diagnostics and two-pass recovery AI
  that can select only opaque local probes and prioritize verified actions.
• Added confirmed recovery recipes for package state, repositories, kernel and
  module support, DKMS, initramfs, config drift, cache pressure, noncritical
  boot services, snapshots, and positively detected bootloaders.
• Added mkosi's built-in mkosi-initrd profile and ukify, a systemd recovery
  runtime, Limine/systemd-boot/GRUB adapters, a recovery refresh hook, private
  state, and Archiso release profiles.
• Incident AI now allows 60 seconds per request and distinguishes provider
  timeouts, transport failures, and invalid guarded JSON responses while
  retaining deterministic diagnostics.
• Unprivileged incident scans now treat root-only pstore access as optional;
  root collector permission failures remain visible for diagnosis.

Safety Boundaries

• Installation remains explicit; the Arch package never writes the ESP or
  enables a recovery entry.
• Secure Boot installation requires an already enrolled sbctl-compatible owner
  key. AuraScan does not enroll keys.
• AI never creates commands or executable targets. Provider failure falls back
  to deterministic recovery.
• Snapshot restore and bootloader reinstall require exact typed confirmations.
• Bootloader reinstall recipes preserve firmware variables and restore backed-up
  loader files when command or post-validation checks fail.
• Filesystem repair, partition changes, firmware, authentication policy,
  user-data deletion, arbitrary AI commands, and automatic reboot remain out of
  scope.

Release Artifacts

• aurascan-recovery-0.6.0-x86_64.iso
• aurascan-recovery-0.6.0-x86_64.iso.sha256
• aurascan-recovery-0.6.0-x86_64.iso.packages.txt
• ISO SHA-256:
  e476da5bb3f0aeaf84787d5f623eb5964d0fa9e00903769c561df203ee6821c6

The 1.5 GiB hybrid BIOS/UEFI image contains 464 packages. It uses the LTS
kernel while retaining the complete networking, storage, and repair tool set.
The package manifest is sorted so it can be reviewed and compared
mechanically.

Release Validation

• All 813 tests passed, including recovery networking, storage, transaction,
  snapshot-confirmation, bootloader-refusal, initramfs rollback, privacy, and
  packaging coverage.
• Presenter audits passed in normal, strict, and strict-MEDIUM modes. Python
  compilation, shell syntax, wheel contents, package metadata, and Git diff
  checks also passed.
• Every packaged systemd unit passed systemd-analyze verify. The privileged
  monitor, maintenance, and Safe Autopilot services each received a 0.8 SAFE
  offline security exposure score.
• The Arch package built and tested in a clean chroot. Its 232 installed files
  passed pacman -Qkk with no alterations.
• The ISO booted under SeaBIOS and OVMF. QEMU exercised LUKS2+Btrfs and
  ext4+LVM targets, DHCP and offline operation, interrupted package state,
  snapshot confirmation, and unknown-bootloader refusal.
• The locally built UKI booted under OVMF. Secure Boot OVMF rejected the
  unsigned test copy and booted a copy signed with disposable test keys.
• The exact ISO, expanded root image, initramfs images, EFI image, UKI, wheel,
  source archive, and Arch package passed scans for the configured API key,
  host identity, home paths, Wi-Fi material, and incident evidence.
• The clean release-candidate package is installed on the CachyOS Limine host.
  Recovery image refresh, boot-entry visibility, target discovery, provider
  readiness, offline fallback, Wi-Fi profile validation, and live network scan
  passed without changing the existing CachyOS boot entry.