Skip to content

docs(readme): correct scope facts stale since the agent-configuration family - #34

Merged
trionnemesis merged 1 commit into
mainfrom
claude/agentsec-pr-33-checkin-wdm4qh
Aug 6, 2026
Merged

docs(readme): correct scope facts stale since the agent-configuration family#34
trionnemesis merged 1 commit into
mainfrom
claude/agentsec-pr-33-checkin-wdm4qh

Conversation

@trionnemesis

@trionnemesis trionnemesis commented Aug 6, 2026

Copy link
Copy Markdown
Owner

What changed

A reader of the README now sees the catalogue that actually ships. The scope block still described the original four scenarios and 4/10 OWASP coverage, both of which stopped being true when the agent-configuration family landed in #28; the architecture tree omitted inspect/ and posture/, both shipped.

An undercounted coverage claim is the failure mode this project argues against everywhere else — it reads as "untested" for four categories that are in fact covered.

Claim Was Now
OWASP Agentic coverage 4/10 (AAI001, AAI003, AAI004, AAI009) 8/10 (AAI001–AAI004, AAI006–AAI009)
Bundled scenarios four, unnamed beyond the original set eight, with the four AGT-CONFIG-* titles named
scenarios/ "four worked examples" "eight worked examples"
Source tree no inspect/, no posture/ both listed
Detection rule ids for contributors 100501, 100610, 100720, 100810 plus 100901–100904
CLI table missing get-run, mcp-contract both present

Every number is read off the repository rather than the previous prose: coverage from agentsec coverage, rule ids and scenario titles from scenarios/*.yaml, commands from agentsec --help.

Type

  • New scenario (Attack–Detection Contract)
  • Evidence collector
  • Executor
  • Evaluator / verdict logic
  • MCP gateway surface
  • Docs / ADR
  • Fix

Purple coverage

Question Answer
Which scenario(s) cover this change? None — no executable surface changes. The scenarios named are the ones already in scenarios/.
Does it change how a verdict is produced? No. No file outside README.md is touched.
Does it widen what the MCP gateway can reach? No. No tool, resource or publication policy is added or altered.

Checks

  • make check passes (ruff clean, mypy clean on 63 source files, 379 tests pass)
  • agentsec validate --strict passes on all 8 scenarios
  • agentsec run --target demo-agent-fixture --profile nightly still exits 1 —
    not run here; the guard hook correctly refuses agentsec run inside a Claude
    Code session, and this diff cannot affect it (README-only, one file). CI's
    "harness runs against its own fixtures" job covers it.

Notes for the reviewer

Two judgement calls worth checking:

  1. The bundled-scenarios line is now long. I named all four AGT-CONFIG-* scenarios by their attack shape rather than writing "and four agent-configuration scenarios", because the family name alone does not tell a reader whether their repository is exposed to any of it. If that reads as bloat in a scope bullet, collapsing it to the family name loses little.
  2. posture/ is described as "static posture ingestion, and which findings a scenario covers". That is adapter.py plus coverage.py, which is all the package currently exports. skill_assurance lives in project/discovery.py, not here — worth confirming I put the boundary in the right place.

README.zh-TW.md carries the same stale facts and is not updated here. It is a full translation, so bringing it into sync is a larger and more careful change than this one, and shipping a half-translated file seemed worse than shipping a known-stale one. Happy to follow up.

Generated by Claude Code

@claude
docs(readme): correct scope facts stale since the agent-configuration…
343af3b 
… family

The catalogue grew from four scenarios to eight in #28 and gained the
repository risk plane in #33, but README's scope block still described the
original four. A coverage claim that undercounts is the same failure mode
the project argues against everywhere else: it reads as "untested" for
categories that are, in fact, covered.

- OWASP Agentic coverage 4/10 → 8/10, verified against `agentsec coverage`
- Name the four AGT-CONFIG-* scenarios in the bundled list; scenarios/ is
  eight worked examples, not four
- Architecture tree gains `inspect/` and `posture/`, both shipped and both
  absent from it
- Detection-rule ids for contributors gain 100901–100904
- CLI table gains `get-run` and `mcp-contract`

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MhAYvfhZE3xs6KX5vWyukX
@trionnemesis
trionnemesis marked this pull request as ready for review August 6, 2026 02:35
@trionnemesis
trionnemesis merged commit 5b65b2c into main Aug 6, 2026
5 checks passed
@trionnemesis trionnemesis mentioned this pull request Aug 6, 2026
Merged
10 tasks
trionnemesis pushed a commit that referenced this pull request Aug 6, 2026
@claude
docs(zh-TW): bring the Traditional Chinese README up to date
d01d985 
The English README was corrected in #34; this closes the same gaps on the
zh-TW side, and folds in the posture/provenance rows drafted in the still-open
PR #29 (whose README.md half is now redundant).

- OWASP Agentic coverage 4/10 -> 8/10, verified against `agentsec coverage`
- Bundled scenarios: four -> eight, naming the AGT-CONFIG-* attack shapes;
  scenarios/ is eight worked examples
- Two capability rows that had no zh-TW equivalent: static posture ingestion
  and run provenance
- Two trust-posture bullets: a scanner's score is never a verdict, and a
  verdict states how it was proven
- Architecture tree gains `inspect/` and `posture/`
- Detection rule ids gain 100901-100904; CLI table gains `get-run` and
  `mcp-contract`

The resource counts and the scan section were already current from #33, so
they are untouched. Both READMEs now state the same facts.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MhAYvfhZE3xs6KX5vWyukX
@trionnemesis trionnemesis mentioned this pull request Aug 6, 2026
Merged
10 tasks
trionnemesis added a commit that referenced this pull request Aug 6, 2026
@trionnemesis @claude
docs(zh-TW): bring the Traditional Chinese README up to date (#36)
b3ca0c8 
The English README was corrected in #34; this closes the same gaps on the
zh-TW side, and folds in the posture/provenance rows drafted in the still-open
PR #29 (whose README.md half is now redundant).

- OWASP Agentic coverage 4/10 -> 8/10, verified against `agentsec coverage`
- Bundled scenarios: four -> eight, naming the AGT-CONFIG-* attack shapes;
  scenarios/ is eight worked examples
- Two capability rows that had no zh-TW equivalent: static posture ingestion
  and run provenance
- Two trust-posture bullets: a scanner's score is never a verdict, and a
  verdict states how it was proven
- Architecture tree gains `inspect/` and `posture/`
- Detection rule ids gain 100901-100904; CLI table gains `get-run` and
  `mcp-contract`

The resource counts and the scan section were already current from #33, so
they are untouched. Both READMEs now state the same facts.


Claude-Session: https://claude.ai/code/session_01MhAYvfhZE3xs6KX5vWyukX

Co-authored-by: Claude <noreply@anthropic.com>
This was referenced Aug 10, 2026
Closed
Draft
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@trionnemesis @claude