v0.8.0

TL;DR

Twenty-three commits since v0.7.2: a full-AUR baseline corpus builder (baseline build, baseline import), property stability tracking for longitudinal rules, a unified TemporalContext across both analysis paths, and reproducible artifact serialisation with optional ed25519 signing. Also includes an interactive config setup wizard, a --simple flag to skip LLM verdicts, a first-run welcome banner, and database schema migrations for the corpus tables.

Added

• Full-AUR corpus builder. trustsight baseline build fetches the AUR metadata archive (117K+ packages), downloads PKGBUILDs via cgit with snapshot tarball fallback, runs the full analysis pipeline on each one, and persists results. Progress is saved every 1000 packages so --resume can continue after an interrupt. trustsight baseline import merges a signed corpus artifact into the local database. baseline build doubles as a cron target: the first run processes all packages, subsequent runs only process changed ones.
• Property stability tracking. Eleven per-package, per-key property dimensions (depends, source_hosts, build_system_markers, configure_flags, version_scheme, pkgdesc_tokens, build_line_count, install_hook_present, license, source_orgs, vendored_libs) are recorded on every analysis and persisted with a SHA-256 value hash and a stable_for_n counter that accumulates on identical observations and resets on change.
• Canonical reproducible serialisation. canonical_artifact_bytes() produces byte-identical output from the same corpus inputs regardless of build time or platform. The signed payload records the ruleset version, scorer version, and corpus cutoff in a deterministic manifest.
• ed25519 artifact signing. build_artifact accepts --sign KEY to attach a detached ed25519 signature. import_baseline() verifies the signature against the shipped public key and refuses unsigned artifacts by default (--allow-unsigned exists for local builds).
• config setup interactive wizard. Walks through provider choice (openai, ollama), endpoint, API key (masked), model name, and an optional connection test.
• --simple flag on review and inspect. Skips the LLM verdict and uses the deterministic fallback directly.
• First-run welcome banner. Shown when the novelty seed is imported on a first review run, printing config path, database path, and next-step suggestions. Help epilog shows "New? Start with 'trustsight config setup', then 'trustsight review'."
• Connection-test error messages. APITimeoutError, APIConnectionError, and APIStatusError are caught during the setup test and in generate_verdict_stream() with user-friendly explanations.
• Loading indicator. A "Querying LLM..." spinner (rich) or "... " text (plain) appears during LLM verdict generation.
• config set extended. model, timeout, and provider keys are now accepted alongside the existing api_key and base_url.

Changed

• TemporalContext unifies both analysis paths. The git-based and corpus-based analysis paths now share a single TemporalContext parameter that declares the clock source (git_commit, aur_metadata, or observation_history) rather than deriving timestamps internally. Both paths produce identical temporal verdicts (R065-R067) for the same package. The clock source is recorded on every PackageFact as temporal_source.
• _build_prompt() refactored. The max_diff_chars_for_llm parameter now truncates only the diff portion of the prompt, not the entire prompt including system instructions.
• history commands that reference an unanalysed package. Instead of "not found in history", the message now suggests "Run 'trustsight inspect X' first."
• Seed-import message simplified. From "Imported novelty seed: N source URLs, M maintainers (O observations)." to "Imported N known source URLs and M maintainers for novelty detection."

Fixed

• LLM verdict always used in inspect. The inspect command previously called fallback_verdict() unconditionally instead of generate_verdict(). It now calls the LLM for scoring packages.
• API exceptions and suppressed verdicts now logged at warning level. Previously debug made them invisible in normal operation.

Internal

• Four new database tables: package_profiles, package_properties, pkgbuild_snapshots, alert_state.
• Database helper functions: get_pkgbuild_snapshot(), save_pkgbuild_snapshot(), get_package_profile(), save_package_profile().
• update_properties() runs on every analyze_package_text() call before rule evaluation. Property breaks are returned but not yet consumed by longitudinal rules (R094-R102).
• Database schema migration support via _migrate and _ADDED_COLUMNS.

Stats

• 23 commits since v0.7.2
• 739 tests (25 files), all passing
• Package version 0.8.0