docs(readme): the agent fingerprint, the v0.2.0 release, and a gap worth stating

[trionnemesis]

What changed

Both READMEs described agentsec scan as if it only ranked attack surface. It answers what the repository is first now, and the Traditional Chinese edition did not mention that classification at all.

The two files had drifted in both directions, so this closes the gap each way:

	was missing	now has
README.md	static posture ingestion, run provenance (capability table)	both rows, matching zh-TW
README.zh-TW.md	the fingerprint entirely — capability row, quick-start section, sample output	all three, matching en

Type

• New scenario (Attack–Detection Contract)
• Evidence collector
• Executor
• Evaluator / verdict logic
• MCP gateway surface
• Docs / ADR
• Fix

Purple coverage

Question	Answer
Which scenario(s) cover this change?	None — documentation only, no code touched.
Does it change how a verdict is produced?	No.
Does it widen what the MCP gateway can reach?	No.

Three things a first-time reader can now act on

Install from the release. v0.2.0 ships a wheel and an sdist, so "install from source" is no longer the only option. Both READMEs now lead with the pinned wheel and say why: anything whose pass/fail you care about should pin a release rather than main, the CI gate especially, since a change here would otherwise move another repository's merge decisions. The URL is the browser_download_url from the release itself.

configuration_only is spelled out in prose. A repository holding only a CLAUDE.md and a .mcp.json is not a runtime agent, and not_detected is an absence of evidence rather than a pass. The code refuses to conflate those; the README should not let a reader do it on the code's behalf.

The catalogue does not travel with the CLI. Outside a checkout of AgentSec, <workspace>/scenarios is empty and every risk resolves to not_verifiable. That was already true and already recorded in docs/feature-matrix.md, but it is newly easy to misread now that the line above it can say confirmed langgraph — so it is stated in Status, where someone hits it before their first run rather than after.

Checks

• pytest — 397 passed, 2 skipped (docs-only change; no test reads the root READMEs)
• Traditional Chinese punctuation normalised to the file's full-width convention in every added line
• Release URL taken from the v0.2.0 release payload rather than constructed by hand

Notes for the reviewer

• The Status caveat is the one paragraph here that is not purely descriptive — it documents a limitation rather than a feature. It belongs in the README rather than only in the feature matrix because it changes what the first run looks like, but it is fair to argue it reads as an apology in a section people skim.
• I did not touch the ## Why or scope sections; scenario counts, OWASP coverage and resource counts were already correct as of docs(readme): correct scope facts stale since the agent-configuration family #34.

---

Generated by Claude Code