v0.6.1

完整變更 / Full changes: CHANGELOG.md

What's Changed

• Release CLI 0.6.1 by @zhixuli0406 in #40

Full Changelog: v0.6.0...v0.6.1

v0.6.0

升級須知 / Upgrade notes

• Rust API 有不相容的 struct literal 變更。 hunt::run::DependencyHunt 新增 facade_of: Vec<String> 與 promoted_from: Option<String>，hunt::graph::DepGraph 新增 resolved。自己用 struct literal 建 DependencyHunt 的程式要補上 facade_of: vec![]、promoted_from: None；DepGraph 可改用 ..Default::default()。JSON 報告相容：兩個欄位空值時不輸出，舊報告照常讀取。
  Rust struct literals must add facade_of and promoted_from to hunt::run::DependencyHunt; hunt::graph::DepGraph gains resolved (use ..Default::default()). JSON reports stay compatible: both fields are omitted when empty and older reports still deserialize.

• 報告 schema 升到 3。 新版仍可讀 v2 報告：匯出、報告庫、比較和前次結果承接都照常運作。比較 v2 與 v3 報告時會附 schema_difference 說明，因為 v2 沒有嚴重度拆解與檢查紀錄。舊版 CLI／Pro 讀不了 v3 報告。
  Report schema is now 3. v2 reports still export, open in the workspace, compare (with a schema_difference note) and feed prior-run carry-over; older binaries cannot read v3 reports.

• 嚴重度可能被調降，--fail-on、--gate 用調降後的值。 finder 評的整體嚴重度高於影響時，只有另一家族的 verifier 也評了影響，才會截到兩者中較高的影響等級（severity_capped）；沒有獨立評等就維持原值；finder 的影響本來會調降時記 severity_cap_unconfirmed，不會調降就不記。原值保留在 severity_claimed。同一份程式碼可能比以前少觸發 CI 失敗。
  Severity above the impact rating is lowered only when a verifier from another family also rated impact (severity_capped); otherwise the claimed value stands and severity_cap_unconfirmed is noted only when the finder's impact would have lowered it. --fail-on and --gate use the result, so the same code may fail CI less often.

• 「covered」的意思變了。 模型只回空結果、沒列出檢查過什麼的模組，現在記為 reviewed_no_checks，不再算 covered。這不影響 run_status、結束碼和 gate，只是報告與完整性診斷會列出來。
  A module whose finder returned no candidates and listed no checks is now reviewed_no_checks, not covered. Run status, exit codes and gates are unchanged.

• finder 回覆格式改為物件（{"candidates", "checks", "hardening", "leads"}）。舊的 JSON 陣列仍接受，但這類模組會記為 reviewed_no_checks。refuter 判 plausible 時另外回 impact，缺了不影響判決。
  The finder reply is now an object; a legacy bare array is still accepted (its modules become reviewed_no_checks).

• Rust API 的 struct literal 又多了欄位。 audit::schema::Finding 新增 severity_claimed、likelihood、impact；ModuleCoverage 新增 prior_status、checks、hardening、leads；CoverageSummary 新增 shallow；PriorRunInfo 新增 carried_not_rediscovered、carried_not_rediscovered_overflow、hash_budget_exhausted、changed_unrediscovered、prior_gap_modules。
  Rust struct literals must add the new fields on Finding, ModuleCoverage, CoverageSummary and PriorRunInfo.

完整變更 / Full changes: CHANGELOG.md

What's Changed

• docs: reposition README as a second opinion on security findings by @zhixuli0406 in #34
• Release CLI 0.6.0 by @zhixuli0406 in #37

Full Changelog: v0.5.0...v0.6.0

v0.5.0

完整變更 / Full changes: CHANGELOG.md

What's Changed

• Release CLI 0.5.0 by @zhixuli0406 in #33

Full Changelog: v0.4.0...v0.5.0

v0.4.0

升級須知 / Upgrade notes

• Rust API 有不相容的 struct literal 變更。 audit::ScanOptions 與 hunt::run::EngineAuditor 新增必填 poc_image: String；可傳 sandbox::DEFAULT_POC_IMAGE.into()。FixCheckRun 新增 binding 並序列化 binding-aware outcome，FixCheckSummary 新增 scope 與選填 binding。舊報告仍可讀，但沒有完整相鄰 execution binding 的歷史正向 fix receipt 會降為 fix_unverified；負向結果保留。

完整變更 / Full changes: CHANGELOG.md

What's Changed

• fix: include npm README and verify publish tarball by @zhixuli0406 in #31
• release: CLI 0.4.0 by @zhixuli0406 in #32

Full Changelog: v0.3.2...v0.4.0

v0.3.2

升級須知 / Upgrade notes

• codex 與 grok 的認證 CLI 後端改為 fail-closed。 容器內的工具型模型可讀取可重用的 auth 檔，並可經允許的廠商網域將它送出，因此未設 allow_agent_tools = true 時現在會拒絕這類設定。請改用能完全關閉工具的 CLI、HTTP/OpenAI-compatible API 或 Ollama；只有在程式碼可信且明確接受 host 檔案與憑證可被讀取的風險時，才設 allow_agent_tools = true。
  Authenticated codex and grok CLI backends now fail closed. A tool-capable model in the container can read reusable auth and send it to an allowlisted vendor domain, so such configurations are rejected unless allow_agent_tools = true explicitly accepts host file and credential access. Prefer a fully tool-disabled CLI, an HTTP/OpenAI-compatible API, or Ollama.
• CI：deep 掃描沒有任何 AI 引擎能執行時，結束碼從 0 改成 4。 報告照樣寫出；要維持舊行為加 --allow-incomplete。quick 掃描、或只有部分 AI 引擎無法使用時，結束碼不變。細節見 CHANGELOG 的 Changed。
  CI: a deep scan in which no AI engine could run now exits 4 instead of 0 (the report is still written); --allow-incomplete keeps the old exit code.

完整變更 / Full changes: CHANGELOG.md

What's Changed

• feat(release): cosign v2.6.5, npm registry alert, release.yml hardening by @zhixuli0406 in #25
• feat(container): publish the grok-free agents base and egress images to GHCR by @zhixuli0406 in #26
• fix(images): fetch aports by git; accept cosign v3 docker-reference by @zhixuli0406 in #27
• fix(agents): quiet BuildKit's empty FROM default; document cosign lookup paths by @zhixuli0406 in #28
• Security release candidate: CLI 0.3.2 by @zhixuli0406 in #29
• docs: sync 0.3.2 public evidence boundary by @zhixuli0406 in #30

Full Changelog: v0.3.1...v0.3.2

v0.3.1

What's Changed

• chore(release): 0.3.1 by @zhixuli0406 in #24

Full Changelog: v0.3.0...v0.3.1

v0.3.0

What's Changed

• feat: publish evidence and trust contracts in 0.2.0 by @zhixuli0406 in #4
• fix: preserve exact release identity with compatible gh flags by @zhixuli0406 in #5
• Add public CLI trust readback and audited OSS methods by @zhixuli0406 in #6
• feat: Claude Code plugin marketplace, Scorecard workflow, contributor test policy by @zhixuli0406 in #7
• chore: plugin icon, Best Practices answers, rustls 0.23.46 on main by @zhixuli0406 in #8
• feat(plugin): listing links in plugin.json by @zhixuli0406 in #9
• docs: OpenSSF Best Practices passing badge by @zhixuli0406 in #10
• ci: Scorecard hardening - pinned actions, hash-locked pip, CodeQL, Dependabot by @zhixuli0406 in #11
• fix(deps): zip 9.0.5 and yaml-rust2 (RUSTSEC-2026-0367..0369, RUSTSEC-2024-0449) by @zhixuli0406 in #19
• ci(release): npm trusted publishing (stage-only); deps: alpine 3.24, cargo patch updates, packaging 26.3 by @zhixuli0406 in #21
• feat: evidence levels, PoC oracles, disclosure drafts, CVSS v4/CWE/CycloneDX, report-ready review pipeline (O1–O20 sync) by @zhixuli0406 in #22
• chore(release): 0.3.0 (dependency majors, CHANGELOG cut) by @zhixuli0406 in #23

New Contributors

• @zhixuli0406 made their first contribution in #4

Full Changelog: v0.2.0...v0.3.0

v0.2.1

Full Changelog: v0.2.0...v0.2.1

v0.2.0

Full Changelog: v0.1.1...v0.2.0

v0.1.1

Full Changelog: v0.1.0...v0.1.1