agent-bom v0.95.0

What's Changed

• fix(ci): isolate dashboard no-ui route tests by @msaad00 in #3764
• fix(ui): sources overflow and demo watermark on mobile by @msaad00 in #3766
• fix(cli): cloud scan alias crashes with TypeError (aws_include_lambda) by @msaad00 in #3767
• fix(gateway): detect modern secret formats in DLP; correct fail_mode doc by @msaad00 in #3768
• fix(cli): harden focused-command formats, unscanned-check gate, friendly findings error, --aws-deep by @msaad00 in #3769
• fix(api): dedupe in-memory findings view, calm graph backpressure, validate findings sort/severity + results push by @msaad00 in #3770
• fix(output): surface reachability in JSON findings, warn on malformed manifests, tighten typosquat + git-SHA confidence by @msaad00 in #3771
• fix(graph): stop walking inbound trust edges as outbound assume (complete #3761) by @msaad00 in #3772
• fix(ui): product taxonomy, density pass, and demo clarity by @msaad00 in #3773
• fix(ui): un-crash Runtime + Lineage pages, unique findings keys, light-mode + version fixes by @msaad00 in #3774
• fix(ui): align Snowflake and cloud vendor logos in workflow diagram by @msaad00 in #3776
• feat(ui): add top product bar with canonical agent-bom branding by @msaad00 in #3777
• feat(ui): tenant service registry for lock/connect/live states by @msaad00 in #3775
• fix(deploy): pilot quickstart db path, SPCS tag sync, dependency CVE floors by @msaad00 in #3778
• fix(data): store correctness + output fidelity (tenant audit chain, snowflake fleet, clickhouse ts, sqlite busy_timeout, SBOM/CSV/parquet/prometheus) by @msaad00 in #3779
• test(ci): de-flake 1M SQLite perf guard + exclude slow tests from required CI by @msaad00 in #3780
• fix(security): VCS token off argv, header download token, redact webhook URLs, tenant-scope stores, HEAD gate, MCP write labels, NL skill-exfil, report suggestion by @msaad00 in #3781
• docs(diagram): make cloud vendor logos legible on white chips by @msaad00 in #3782
• feat(demo): seed showcase catalog, workflow v2, and operator UI polish by @msaad00 in #3783
• fix(ui): posture nav, scan targets, and security-graph polish by @msaad00 in #3784
• feat(ui): embed live graph investigation on security graph by @msaad00 in #3785
• fix(ui): align AI BOM manifest with platform theme and evidence model by @msaad00 in #3786
• fix(ui): consolidated operator experience — connectors, jobs DAG, graph readability by @msaad00 in #3787
• feat(ui): clarify New Scan scope and connected account picker by @msaad00 in #3788
• fix(ui): unblock main E2E graph selector drift by @msaad00 in #3791
• chore(deps): bump lucide-react from 1.23.0 to 1.24.0 in /ui by @dependabot[bot] in #3790
• feat(brand): BOM manifest mark + agent bill of materials tagline by @msaad00 in #3792
• fix(tests): restore release lint hygiene by @msaad00 in #3793
• docs(deploy): rollout verification + brand/docs polish by @msaad00 in #3794
• chore(typing): bring findings pipeline + store accessors under strict mypy (#1969) by @andres-linero in #3796
• fix(ui): agent+BOM brand mark and NIST text tiles by @msaad00 in #3797
• feat(graph): first-class AI framework BOM entities by @msaad00 in #3798
• fix(platform): harden self-hosted release validation by @msaad00 in #3795
• fix(deploy): secrets via files across Postgres and control plane by @msaad00 in #3801
• feat(ui): Overview exec briefing; mesh off-home by @msaad00 in #3812
• feat(brand): agent HUD in the O, not emoji smile by @msaad00 in #3813
• fix(deploy): reset Postgres app-password GUC so it doesn't persist in cleartext by @msaad00 in #3817
• fix(ui): topology contrast + drop orphan DashboardAnalytics by @msaad00 in #3818
• fix(compliance): never score unevaluated controls as pass by @msaad00 in #3819
• fix(secrets): resolve signing PEMs file-first + keyless-lead cloud creds (#3807) by @msaad00 in #3820
• feat(security): keep DB-tier secrets out of the DSN and rotate audit HMAC keys by @msaad00 in #3821
• feat(identity): harden OAuth-AS issuer, JWT aud/iss binding, deprovision by owner by @msaad00 in #3822
• fix(findings): match severity filter on string column for backend parity by @msaad00 in #3824
• fix(api): offload findings read-path and graph reads off the event loop by @msaad00 in #3823
• feat(output): interop schema conformance gate + strict-validity and determinism fixes by @msaad00 in #3826
• fix(cli): scan explicit --project under --no-discover; guard zero-artifact scans by @msaad00 in #3825
• refactor(ast): dedupe shared scanner primitives into ast_signal_utils by @msaad00 in #3828
• docs: reconcile drifted capability counts and enforce check-counts in CI by @msaad00 in #3827
• chore: remove orphaned back-compat shim and duplicate scripts by @msaad00 in #3830
• fix(graph): canonical model node id + emit observes edges by @msaad00 in #3829
• fix(auth): count SAML SSO in CLI boot gate and auth-configured checks by @andres-linero in #3831
• fix(image): include aws/azure/gcp SDKs so self-hosted BYOC works (#3832) by @msaad00 in #3836
• fix(correctness): close post-merge audit gaps by @msaad00 in #3837
• feat(cli): install-aware upgrade guidance, update/upgrade disambiguation, DB freshness signals by @msaad00 in #3838
• ci(demo): automate hosted demo redeploy on release via SSM (#3833) by @msaad00 in #3839
• fix(secrets): make proxy signing keys file-first by @msaad00 in #3840
• docs(deploy): add a verifiable self-hosted BYOC path by @msaad00 in #3841
• feat(cli): connect can establish and verify a read-only cloud connection (#3832) by @msaad00 in #3842
• fix(cli): correct Snowflake connect scan command (points at a removed surface) by @msaad00 in #3846
• feat(ui): post-scan repo overview with surface chips by @msaad00 in #3848
• fix(polish): refresh cloud scans and HUD favicon by @msaad00 in #3844
• feat(auth): OIDC auth-code + PKCE browser login foundation by @msaad00 in #3849
• docs(readme): Scan → Graph → Serve lanes, brand mark, fresh demo media by @msaad00 in #3850
• chore(release): 0.95.0 — enterprise auth, cloud-connect, interop, security hardening by @msaad00 in #3851
• docs(release): combine demo, provider onboarding, and SDK maintenance by @msaad00 in #3855
• fix(ui): dedupe live-investigation panel, graph readability, HUD mark polish, overview consolidation by @msaad00 in #3857
• chore(maintenance): combine UI cleanup and dependency updates by @msaad00 in #3862
• fix(ui): leadership-first overview, correlated top risks, drawers, findings drill-down by @msaad00 in #3863
• fix(security): confine POST /v1/scan local paths to the same jail as secondary scan endpoints by @msaad00 in #3864
• fix(ui): consolidate scan entry points + vocabulary (Connect→Scan→Assess) by @msaad00 in #3865
• fix(demo): complete + reliable correlated demo-estate seed (agents, exposure paths, identity) by @msaad00 in #3866
• ci(azure-ingestion): skip scheduled run when Azure OIDC is not configured by @msaad00 in #3868
• docs(readme): top-load What-is/Personas/How-It-Works + Connect-first visuals & logo lockup by @msaad00 in #3867
• feat(inventory): unified asset-inventory endpoint + Snowflake connection sweep parity by @msaad00 in #3869
• fix(ui): pre-release polish — full-width sources/registry + connection drawer CTA dedupe by @msaad00 in #3870
• feat(cloud): non-blocking cloud SDK freshness signal by @andres-linero in #3872
• feat(mcp): agent-native unified asset-inventory tools by @msaad00 in #3871
• feat(platform): combine API route deprecation and dashboard SSO CTA by @msaad00 in #3875
• docs: reconcile API-op / route-module / MCP-tool counts for 0.95.0 by @msaad00 in #3876
• fix(inventory): facet-filtered list drops rows past the page limit (P1, pre-tag) by @msaad00 in #3877
• fix(ui): lift dark theme contrast for readable hierarchy by @msaad00 in #3878
• fix(compliance): per-framework endpoint reports no_data on zero scans, not score 100 (pre-tag) by @msaad00 in #3879
• fix(overview): count bulk-ingested findings in posture grade + headline by @msaad00 in #3890
• fix(compliance): wire MITRE ATT&CK to its real bundled catalog (#3882) by @msaad00 in #3891
• fix(api): dedupe /v1/findings to one row per canonical id + normalize identifiers by @msaad00 in #3893
• perf(findings): shed heavy /v1/findings reads with 429 under saturation (#3884) by @msaad00 in #3894
• perf(inventory): serve inventory/summary breakdown from cached snapshot counts (#3885) by @msaad00 in #3895
• fix(dx): 0.95.0 DX/UX polish bundle (serve --demo-estate, offline+repo_url guard, per-control no_data, blocklist seed) by @msaad00 in #3896
• feat(ui): scalable connector gallery on /connections by @msaad00 in #3901
• perf(intel): fix full-scan hangs in KEV/advisory lookups (#3912) by @msaad00 in #3914
• fix(ui): distinguish AI clients from background agents in agent inventory by @msaad00 in #3918
• chore(maintenance): combine registry and dependency refreshes by @msaad00 in #3919
• perf+fix: sargable hot-table filters + retain alert-webhook tasks (#3911, #3913) by @msaad00 in #3920
• polish: MCP-catalog freshness line + client/background agent copy by @msaad00 in #3921
• fix(ui): light-theme coherence — tokenize agents/registry/overview by @msaad00 in #3922
• perf(intel): offload intel routes off the event loop (P1 availability) by @msaad00 in #3924
• fix(compliance): /v1/compliance scores over evaluated controls, not silent passes by @msaad00 in #3925
• docs+ui: release-align nav label, stale counts, CHANGELOG date by @msaad00 in #3923
• perf(findings): materialize scan_id + severity index on hub_findings_current by @andres-linero in #3928
• perf(intel): make build_daily_brief KEV alias correlation sargable by @andres-linero in #3929
• chore(docs): recapture 0.95.0 product screenshots by @msaad00 in #3930

Full Changelog: v0.94.2...v0.95.0