Docs-only patch. No code changed since v0.8.0 — lib/, hooks/, bin/ and scripts/ are identical.
- README rewritten: 234 → 108 lines. One agents table with a tier column, the exit-code contract in five lines, and the long-form material — the 0/1/2 contract, what changed for
scanin v0.7, zero-default-root behaviour,audit --jsongating — moved to the new docs/exit-codes.md. - CI gating correction: the old README told JSON consumers to gate on
overallLevel >= 2. An incomplete scan is capped at 2 — the same value as the pass threshold — so that gate would pass an unfinished scan. Gate on the exit status (2= incomplete, never clean). The product-side fix is tracked as G-1679. - Why republish for a README? npm renders the README inside the published tarball, so this is the only way to keep the npm page and GitHub in sync.
Also on the honest-limits list from v0.8.0: the scorecard's Claude Code "Sandbox" line is still an assumption, not a check (G-1677, next).
Published from main with npm provenance (OIDC trusted publishing, SLSA attestation).