ai-security-scanner 0.1.5

ai-security-scanner 0.1.5

Source: 3e073900ade1b1b863d4f0a3576c0a19d1461ee6

Public testing pre-release. This build makes Windows startup and live scan progress
easier to understand. It has not completed the planned formal QC/code review.

On first launch, the app checks installed Windows prerequisites before showing the normal
workspace. It recognizes components that are already available and automatically prepares
the private local scan tools when needed. A standard Windows approval dialog appears only
when Windows itself needs a change; an explicit restart remains under the user's control.

The Ready/Repair loop is removed. A temporary local-tool connection issue can still be
retried, but a missing or invalid component from the installed package is no longer
presented as something the same broken installation can repair. The app explains the
problem and links to the latest installer while preserving existing local cases.

Before a scan starts, the activity view records when readiness was checked and explains any
blocker in plain language. During a scan, the same timeline shows the active and next scanner,
the current wait reason, the last durable progress, and a delayed-update notice without
mistaking a paused scan for a stalled one. This behavior is shared by every supported scan route.

When technical detail is useful, the app can download a redacted diagnostic containing safe
timestamps, statuses, phases, blocker codes, versions, and counts. It excludes target names,
local paths, raw evidence, credentials, and raw scanner output.

Preparation never starts a scan or widens its scope. The app still waits for the user's
explicit Start action before contacting an approved target.

Existing local cases, cleanup obligations, evidence snapshots, and provenance remain intact.

These desktop installers are built for Linux x86-64, universal macOS (Intel + Apple silicon),
and Windows x86-64. Verify the selected file against SHA256SUMS.txt and the public GitHub
artifact attestation before installing.

Fresh GitHub-hosted qualification jobs independently installed the Debian package, macOS DMG,
and Windows MSI. Linux and Windows completed managed-runtime install, start, status, fixed
network-disabled Gitleaks container execution, stop, uninstall with image-cache purge, and
private-state cleanup. The universal macOS artifact's DMG installation, bundled layout, exact
runtime manifest, CLI, desktop startup, and cleanup passed on GitHub's Intel macos-15-intel
runner. Its managed-runtime and container lifecycle is explicitly recorded as not observed
because GitHub-hosted macOS does not support the nested virtualization required by AppleHV.
This limited macOS evidence is accepted only for a pre-release. Exact evidence is published
per platform.

The current installers are not signed with Apple Developer ID or Windows Authenticode and
are not Apple-notarized. Application update payloads are separately signed with the updater
key, but the operating system may still show an unidentified-developer warning. No scanner
engine image is bundled.

The first-party ai-security-scanner-egress-gateway, isolated
ai-security-scanner-bootstrap-broker, and local ai-security-scanner-cli companion
executables are installed beside the desktop executable.
Platform copies and hashes are included as release evidence and SBOM entries.

CycloneDX and SPDX JSON SBOMs, generated third-party notices, engine reference notices, and
machine-readable release metadata accompany the installers.