v1.6.0

Changelog

• 4460648: feat(AG-CI-04): implement the secret-exposure checker (unblocks Silver/Gold) (#53) (@fabriziosalmi)
• 8d9eb4b: feat(site): governed waivers for the 5 process SHOULDs + favicon/proof placeholders (#54) (@fabriziosalmi)
• d743cf1: feat(site): publish the standard at agssh.dev, Gold-clean, wearing its own badge (#50) (@fabriziosalmi)
• 204526e: fix(AG-SUP-04): allowlist the tracker host catalog for gitleaks (#52) (@fabriziosalmi)
• 86635eb: fix(publish): single deploy — kill the 409 artifact-name conflict (#56) (@fabriziosalmi)
• a26a5fc: fix(site): deploy the honest badge regardless of the gate verdict (#55) (@fabriziosalmi)
• 4035cf6: fix(site): publish via the GitHub-Actions Pages source, not a gh-pages branch (#51) (@fabriziosalmi)
• afa1d04: release: v1.6.0 — AG-CI-04 secret-exposure checker (unblocks Silver/Gold), agssh.dev dogfood site, README/RULES.md (#57) (@fabriziosalmi)

v1

Deterministic, fail-closed conformance gate for air-gapped static surfaces (AGSSH-STD-001 v1.0.0).

v1.5.1

Changelog

• 920c662: release: v1.5.1 — headless-run cap 30s->45s, CI actions on Node24 (#48) (@fabriziosalmi)
• b873574: test(dynamic): raise the headless-run cap 30s->45s to de-flake CI (#47) (@fabriziosalmi)

v1.5.0

Changelog

• 389d7da: feat(AG-PRV): detect the Meta Pixel by path, keep the FB SDK clean (#42) (@fabriziosalmi)
• ecf8ac4: fix(AG-NET-05): retitle to "No third-party egress during load" to match the checker (#44) (@fabriziosalmi)
• 55f0c5e: fix(rules): honest evidence for 5 rules + AG-DNS-01 requires issue-restricting CAA (#43) (@fabriziosalmi)
• ecd0277: release: v1.5.0 — Meta Pixel by path, title-drift audit fixes, AG-NET-05 retitle (#45) (@fabriziosalmi)

v1.4.0

Changelog

• 2f4f538: fix(AG-PRV): detect the real tracker landscape by host, not Google-only substrings (#39) (@fabriziosalmi)
• f51a96e: fix(score): monotonic scoring — exceeding a level's demand never lowers the score (#40) (@fabriziosalmi)
• fa57d81: release: v1.4.0 — privacy tracker detection + monotonic scoring (conformance-affecting) (#41) (@fabriziosalmi)

v1.3.3

Changelog

• 9a694af: feat(report): disclose a degraded environment (Chrome/scanner gaps) (#37) (@fabriziosalmi)
• 9ce9f75: fix(AG-NET-01): make CSP evidence say "permits", not imply asset relocation (#33) (@fabriziosalmi)
• 70d349e: fix(AG-SUP): empty/config-only scan input is N/A, not a vacuous PASS (#35) (@fabriziosalmi)
• 6cfdd40: fix(chrome): discover the browser on macOS/Windows, not just Linux PATH (#30) (@fabriziosalmi)
• 9a0e81e: fix(engine): unreachable surface is UNSCANNABLE, not a low score (exit 3) (#31) (@fabriziosalmi)
• 08c7d47: fix(report): split the fix queue — FAIL only vs "could not assess" (#34) (@fabriziosalmi)
• 5ce4bff: fix(score): label the score level-relative; expose scored-rule count (#36) (@fabriziosalmi)
• 2886c0b: fix(supply): sanitize scanner diagnostics, don't leak --help chatter as evidence (#32) (@fabriziosalmi)
• b1eb523: release: v1.3.3 — dogfood fixes (reachability gate, degraded-env disclosure, honest fix queue) (#38) (@fabriziosalmi)

v1.3.2

Changelog

• 36d45d5: fix(AG-PRV-03): catch protocol-relative third-party font sources (#27) (@fabriziosalmi)
• cfe7646: fix(engine): wire pipeline.enforce_ci_rules to gate the AG-CI family (#28) (@fabriziosalmi)
• dbddd9a: release: v1.3.2 — dogfood fixes (enforce_ci_rules wiring, AG-PRV-03 protocol-relative) (#29) (@fabriziosalmi)

v1.3.1

Changelog

• 3eb36ce: release: v1.3.1 — dogfood fixes (AG-PRV-03 false-positive, action SHA-pins, x/mod CVE) (#26) (@fabriziosalmi)

v1.3.0

Changelog

• 52743e8: feat(badge): self-hosted SVG conformance badge (-badge) (#24) (@fabriziosalmi)
• f8290fb: feat(mcp): agssh-mcp — the runner as an MCP server (#23) (@fabriziosalmi)
• 5612aaa: release: v1.3.0 — agssh-mcp MCP server + self-hosted badge + AG-SUP hardening (#25) (@fabriziosalmi)

v1.2.2

What's Changed

• release: v1.2.2 — derive every hand-duplicated number/version from the generator by @fabriziosalmi in #21

Full Changelog: v1.2.1...v1.2.2