Aegis 0.2.0 — Trusted Analysis Preview

Aegis 0.2.0

This is the first release that connects the complete Aegis trust workflow.

What changed

Trusted Analysis now runs one production task graph from deterministic evidence to a final policy decision. The report keeps scanner coverage, model provenance, verifier independence, consensus, threat context, project memory, audit events, and integrity hashes together.

Secure fixes now have an explicit transaction boundary. Aegis binds a patch to the reviewed source, applies it atomically, runs project checks, rescans the target, and replays the authorized baseline. It reports PARTIAL when complete proof is unavailable instead of upgrading an incomplete run to VERIFIED.

Dynamic validation remains opt-in. It runs locally with read-only mounts, networking disabled by default, dropped capabilities, an unprivileged user, and bounded resources.

The GitHub Action and CLI expose the deterministic policy path without executing repository code. They produce ALLOW, REVIEW, or BLOCK together with JSON and SARIF evidence.

Release artifacts

• aegis-security-0.2.0.vsix
• aegis_security_backend-0.2.0-py3-none-any.whl
• RELEASE-MANIFEST.json
• SHA256SUMS

The manifest records the release commit, artifact sizes, and SHA-256 digests.

Install

Start the local backend:

python -m venv .venv
source .venv/bin/activate
pip install aegis_security_backend-0.2.0-py3-none-any.whl

export AEGIS_FINGERPRINT_KEY="$(
  python -c 'import secrets; print(secrets.token_urlsafe(48))'
)"

uvicorn aegis.main:app --host 127.0.0.1 --port 8000

Install the VSIX from the Extensions view with Install from VSIX…, or run:

code --install-extension aegis-security-0.2.0.vsix

For pull requests:

- uses: lemkyz/Aegis@v0.2.0
  with:
    base: ${{ github.event.pull_request.base.sha }}
    head: ${{ github.event.pull_request.head.sha }}

Known limits

• The VS Code extension requires the local backend; it is not a standalone scanner.
• Dynamic proof depends on an explicitly authorized validation plan and a locally available container image.
• Model-backed review depends on configured providers. Deterministic workflows remain available without them.
• 0.2.0 is a preview release. Public schemas may change before 1.0.