trionnemesis · trionnemesis · Aug 6, 2026 · Aug 6, 2026
diff --git a/.github/workflows/agentsec-gate.yml b/.github/workflows/agentsec-gate.yml
@@ -10,7 +10,7 @@
 #
 #   jobs:
 #     purple:
-#       uses: trionnemesis/AgentSec/.github/workflows/agentsec-gate.yml@v0.1.0
+#       uses: trionnemesis/AgentSec/.github/workflows/agentsec-gate.yml@v0.2.0
 #       with:
 #         target: order-agent-staging
 #         profile: pr

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -1,6 +1,6 @@
 # Cut a release from a version tag.
 #
-#   git tag v0.1.0 && git push origin v0.1.0
+#   git tag v0.2.0 && git push origin v0.2.0
 #
 # Builds the sdist and wheel, refuses a tag that disagrees with
 # pyproject.toml, and publishes a GitHub Release with the artifacts

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,6 +6,98 @@ Notable changes, newest first. The format follows
 [`docs/roadmap.md`](docs/roadmap.md): integrations marked 🟡 there are first
 drafts even when they appear in a release.
 
+## [0.2.0] — 2026-08-06
+
+The release that gives AgentSec a first step. In 0.1.0 the entry point was
+`agentsec run`, which could not be reached without a configured target — an
+allowlist entry, a staging agent, usually a SIEM. An engineer who wanted to know
+whether their repository was exposed had to finish someone else's sprint first.
+
+`agentsec scan` needs a checkout and nothing else.
+
+```
+agentsec init → agentsec scan → agentsec scan --verify --target … → dashboard
+```
+
+### Added
+
+- **Repository risk plane** (`agentsec init` / `agentsec scan`). Twelve
+  deterministic rules read what a repository gives an AI agent — project
+  instructions, subagent definitions, skills, hooks, pre-approved tool grants,
+  MCP servers and memory stores — and rank what they find. Each risk resolves to
+  `verified`, `verifiable` or `not_verifiable`; `scan --verify` hands the
+  provable high-severity subset to the harness and returns real verdicts.
+- **A risk is a reason to test, not a result.** `scan` exits `0` even with
+  critical risks outstanding: nothing has executed and no detection control has
+  been given the chance to fire. `not_verifiable` is the honest third state —
+  neither a pass nor a failure, but AgentSec naming something it cannot settle.
+- **The agent-configuration attack family** — four scenarios covering the
+  surface the risk plane inventories: poisoned project instructions that
+  exfiltrate a secret (`AGT-CONFIG-001`), a zero-width Unicode directive hidden
+  in an agent definition (`AGT-CONFIG-002`), a hook interpolating untrusted
+  content into a shell command (`AGT-CONFIG-003`), and an MCP server added
+  mid-session with a credential-shaped env block (`AGT-CONFIG-004`). OWASP
+  Agentic coverage goes 4/10 → 8/10.
+- **Project resolution and surface discovery** — `.agentsec/project.yaml` gives
+  a repository a stable id and reviewed relative locations, so which repository
+  is a process-boundary decision rather than a tool argument.
+- **Composed project dashboard**, served as one read-only resource
+  (`agentsec://dashboard/latest`) and described by
+  `schemas/project-dashboard.schema.json`: project identity, the risk plane, the
+  four-axis purple rollup, Skill Assurance and static posture, each in its own
+  property. Computed in memory — reading it starts no run and writes no file.
+- **`agentsec://project/risks`** — the risk plane alone, for a client that wants
+  the repository view without the run history. Takes no arguments at all.
+- **Static posture ingestion** and finding-coverage correlation, plus run
+  provenance recorded on every result.
+- **Claude Desktop packaging** for the read-only report gateway.
+- **Publication boundary**: published output is projected rather than filtered —
+  each publisher names the fields it keeps, transcript turns become digests,
+  principals and tenants become stable pseudonyms, and every projection carries a
+  manifest of what it dropped. The report gateway declines to serve per-run
+  evidence and the audit log at all, and refuses to start if a resource has no
+  publication policy.
+- **Project page** at <https://trionnemesis.github.io/AgentSec/>, and a
+  Traditional Chinese edition of the README and the dashboard docs.
+- `docs/feature-matrix.md` classifying every capability Core / Supporting /
+  Experimental / Parked against the one path, and two ADRs: 0008 (Skill
+  Assurance as a separate bounded context) and 0009 (the repository-first
+  golden path, with four rejected alternatives and five accepted costs).
+
+### Changed
+
+- MCP resources 8 → 10 (7 published under `AGENTSEC_MCP_READ_ONLY=1`). The tool
+  surface stays at 11: every capability added this cycle landed on
+  `HarnessService` and reached the gateway as a resource, not a new verb.
+- `PUBLISH_SCHEMA_VERSION` did not exist in 0.1.0 and ships here at 1.3.0,
+  having moved three times within this cycle as the published surface grew.
+  `repo_risk` is a required property on the composed dashboard, so a consumer
+  validating strictly against an in-cycle version sees a new key; every shape
+  already being read is untouched.
+- `docs/roadmap.md` is sorted by layer rather than by completion status.
+- The scenario validator warns on unspecific and empty detection assertions, and
+  pre-flights span-only detection backends.
+
+### Fixed
+
+- `AGT-CONFIG-003` was tagged to a single hook path, so it correlated with this
+  repository and with nothing in anyone else's. Retagged to the hook directory,
+  which makes hook-injection risk `verifiable` in an arbitrary repository.
+- Hook rules strip comments before matching. A comment *explaining* a proxied
+  `curl` was being reported as network egress — a rule that reports the
+  documentation of a risk as the risk teaches its reader to skip the plane.
+- The guard hook's MCP argument check is scoped to AgentSec's own gateway rather
+  than to every MCP call in the session.
+- Twelve findings from the local deployment review, closed.
+
+### Notes
+
+Still alpha, and `docs/roadmap.md` still marks every row honestly: the Promptfoo
+executor, the Wazuh/OTel HTTP collectors and the MCP server binding are written
+but not yet proven against a live system. Two gaps this cycle's own risk plane
+found in the catalogue are recorded rather than hidden — no scenario covers the
+tool-grant/settings surface, and none covers the memory surface.
+
 ## [0.1.0] — 2026-07-29
 
 Initial release.
@@ -31,4 +123,5 @@ Initial release.
 - CLI with meaningful exit codes (`0` clean, `1` blocking, `2` could not tell)
   and a reusable CI gate workflow (`agentsec-gate.yml`).
 
+[0.2.0]: https://github.com/trionnemesis/AgentSec/releases/tag/v0.2.0
 [0.1.0]: https://github.com/trionnemesis/AgentSec/releases/tag/v0.1.0
diff --git a/README.md b/README.md
@@ -214,7 +214,7 @@ Call the reusable workflow from the repository that owns the agent, pinned to a
 ```yaml
 jobs:
   purple:
-    uses: trionnemesis/AgentSec/.github/workflows/agentsec-gate.yml@v0.1.0
+    uses: trionnemesis/AgentSec/.github/workflows/agentsec-gate.yml@v0.2.0
     with:
       target: order-agent-staging
       profile: pr

diff --git a/README.zh-TW.md b/README.zh-TW.md
@@ -208,7 +208,7 @@ claude mcp add agentsec -- agentsec-mcp
 ```yaml
 jobs:
   purple:
-    uses: trionnemesis/AgentSec/.github/workflows/agentsec-gate.yml@v0.1.0
+    uses: trionnemesis/AgentSec/.github/workflows/agentsec-gate.yml@v0.2.0
     with:
       target: order-agent-staging
       profile: pr

diff --git a/packaging/claude-desktop/manifest.json b/packaging/claude-desktop/manifest.json
@@ -2,7 +2,7 @@
   "manifest_version": "0.1",
   "name": "agentsec-report",
   "display_name": "AgentSec (report)",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Read-only AgentSec report gateway: purple-team verdicts, four-axis coverage and findings for the selected repository. Cannot start a run.",
   "long_description": "Registers the AgentSec MCP server in read-only mode, so a local Cowork session or a Live Artifact can read results without being able to execute anything. Execution tools are not registered in this mode — not refused at dispatch, absent from the listing — and the resource set is the published allowlist. To run scenarios, use the Claude Code project registration in .mcp.json or the CLI on the execution host.",
   "author": { "name": "trionnemesis" },

diff --git a/pyproject.toml b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentsec"
-version = "0.1.0"
+version = "0.2.0"
 description = "Purple-team harness for AI agents: Attack-Detection Contracts, deterministic verdicts, MCP gateway."
 readme = "README.md"
 requires-python = ">=3.11"

diff --git a/site/index.html b/site/index.html
@@ -273,7 +273,7 @@ <h3>Add to Claude Code</h3>
         <h3>Gate a real agent in CI</h3>
         <pre><code>jobs:
   purple:
-    uses: trionnemesis/AgentSec/.github/workflows/agentsec-gate.yml@v0.1.0
+    uses: trionnemesis/AgentSec/.github/workflows/agentsec-gate.yml@v0.2.0
     with:
       target: order-agent-staging
       profile: pr</code></pre>

diff --git a/src/agentsec/__init__.py b/src/agentsec/__init__.py
@@ -12,5 +12,5 @@
 Nothing above the service boundary may reach below it.
 """
 
-__version__ = "0.1.0"
+__version__ = "0.2.0"
 __all__ = ["__version__"]