0.2.0

A reliability round. No new gates, no new adapters. The probe claims less than it did, and what it claims holds up better.

Your score may drop after upgrading. That is the point of this release: checks that used to pass on weak evidence no longer do.

Behaviour changes

• The probe no longer runs code from the repository it reads. Before this release, pip-audit -r requirements.txt could run a package's build backend. Python audits now accept exact pins only, with resolution and builds off. An unpinned requirements.txt gives gate 2 UNKNOWN, with the reason, instead of being resolved.
• The stage grows with the app. fix used to write stage: 1 into HUMAN-GATES.md, which froze the requirements. New registers leave detection on. If an older fix wrote that line for you, remove it: a declared stage below the detected one is kept, and the report now flags the conflict.
• --url measures more strictly. Health needs JSON with a real version. Strict-Transport-Security: max-age=0 and frame-ancestors * count as missing. Security headers need HTTPS.
• --csrf-post no longer gives a PASS. A POST to the health route says nothing about the routes that write, so gate 10 reads it as inconclusive. Your Origin check still counts as static evidence. Test the routes that write yourself.
• What was not checked is said. Monorepo apps, skipped packages, nested manifests and source the probe cannot read (Vue, Svelte, Go and others) are listed, in the Markdown and in --json. They give UNKNOWN, not PASS.
• Fewer false passes: impossible and future dates, a CI job or step with if: false, retention-days on a workflow artifact read as log cleanup, a helper imported only by a file nothing loads, Django settings that switch a header off, and comments as evidence.

Generated files

• Next.js src/app layouts are handled, and a Pages Router project gets a manual step. The CI workflow is written only when it can work.
• The backup workflow commits nothing unless you opt in, and refuses to run in a public repository.
• The rollback and restore guides were followed step by step and corrected: supabase migration repair before db push on a restored database, a compensating migration instead of a down file, and rows copied between databases by \copy into a staging table.

Checked, and not checked

• 205 tests on Ubuntu and Windows with Node 20, 22 and 24.
• fix --write, then a production build, on fresh Next.js apps.
• Both guides on a throwaway Postgres 17 with Supabase CLI 3.0.0 and 2.122.1. auth was a stub table.
• Not checked: the generated workflows on GitHub Actions, either guide on a real Supabase project, macOS.

Static checks are pattern matching, not proof a control works: read the evidence column. --no-audit still passes gate 2 on config alone, and the probe still exits 0 on a failing scorecard.

Full list: CHANGELOG.md