v0.25.0

Detection-gap release: findings that fired internally in 0.24.0 but never reached users now surface in output, score, and exit code.

Fixed detection gaps

• CRED-002 / PERM-001 now reach the user (#250). Both fired internally but never set a file, so the concrete-findings filter dropped them from output, score, and exit code — an un-ignored private key produced no visible >=HIGH signal on 0.24.0. CRED-002 now attributes the first key file with a runnable remediation and scans recursively (never a false clean bill); PERM-001 attributes the first offending file.
• GIT-001/002/003 severity is existence-aware, backed by git check-ignore (#250). A missing/incomplete .gitignore is a LOW advisory when nothing committable matches, and HIGH naming the actual files when a genuinely un-ignored secret exists — removing the inversion where a partial .gitignore scored worse than none. Committability honors negations, root-anchoring, dir-only rules, and nested ignores.
• CRED-001 now scans secrets.json / credentials.json (#250).
• scan-soul can no longer be satisfied by the vocabulary of an attack, and check no longer flags prose-hardened SOULs (#251). Direction-aware control matching + six first-class governance-violation classes (override-compliance mandate, deception mandate, oversight disclaimer, exfiltration channel, persistence installation, identity-by-claim) render as HIGH file:line blocks, clamp the score, and fail --ci. Corpus soul tiers now order correctly: benign 19 (0 violations) > buggy 7 > malicious 4 (9 violations).
• Security-taxonomy / coverage documents no longer false-positive as credential access (AST-CRED-002/003, #256).
• git check-ignore / git ls-files stdin EPIPE can no longer crash a scan (#264). An async pipe error when git exits early is now handled at both spawn sites; committability still resolves conservatively (fail-safe: over-report as committable, never mark a secret ignored).

Security

• Pinned @opena2a/aim-sdk to 1.0.2 (moves transitive @opena2a/atx-verify 0.2.0 -> 0.3.0), closing the post-signing declaredPurpose tamper gap that 0.24.0 shipped in its arp re-export path.

Supply chain

Published via npm Trusted Publishing (GitHub Actions OIDC, no long-lived token). SLSA v1 provenance attached.

Verify:

• npm view hackmyagent@0.25.0 dist.attestations --json (non-empty, predicateType slsa.dev/provenance/v1)
• npm audit signatures after npm install hackmyagent@0.25.0