fix(release,ci,docs): release provenance gate, action validation, test hermeticity & 0.2.0 alignment

.github/workflows/platforms.yml

@@ -5,6 +5,8 @@ name: Platform smoke
 on:
   push:
     branches: [main]
+  pull_request:
+    branches: [main]
   schedule:
     - cron: "29 3 * * 4"
   workflow_dispatch:
@@ -33,5 +35,10 @@ jobs:
           tests/test_action_signature_policy.py
           tests/test_discovery_signature_gate.py
           tests/test_confined_integrity.py
+          tests/test_confined_links_and_variants.py
+          tests/test_confined_bounds.py
           tests/test_output_confinement.py
           tests/test_prompt_confined_reads.py
+          tests/test_prompt_surfaces.py
+          tests/test_ide_settings_binding.py
+          tests/test_a2a_collection.py

.github/workflows/release.yml

@@ -258,14 +258,14 @@ jobs:
           set -euo pipefail
           shopt -s nullglob dotglob
           bundles=(attestation/*)
-          (( ${#bundles[@]} == 1 ))
-          test -s "${bundles[0]}"
+          (( ${#bundles[@]} == 1 )) || exit 1
+          test -s "${bundles[0]}" || exit 1
           wheels=(dist/*.whl)
           sdists=(dist/*.tar.gz)
           everything=(dist/*)
-          (( ${#wheels[@]} == 1 && ${#sdists[@]} == 1 && ${#everything[@]} == 2 ))
+          (( ${#wheels[@]} == 1 && ${#sdists[@]} == 1 && ${#everything[@]} == 2 )) || exit 1
           for artifact in "${everything[@]}"; do
-            [[ -f "$artifact" && ! -L "$artifact" ]]
+            [[ -f "$artifact" && ! -L "$artifact" ]] || exit 1
           done
           for artifact in "${wheels[@]}" "${sdists[@]}"; do
             gh attestation verify "$artifact" \

CHANGELOG.md

@@ -4,6 +4,8 @@ Notable changes to Nexus SymBiote, newest release first. Within a release, secur
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-11-12
+
 Closes detection gaps listed under 0.1.0's known limitations and others found in review, makes inventories comparable across checkouts and reproducible, and makes every gate say why it failed. New commands sign and verify inventories, compare them with the use an agent's own traces report, report their G7 AI SBOM minimum-element coverage, map their findings to security frameworks, draw them as a graph and export the reviewed agent to Nexus-ShadowScan. Record baselines again after upgrading, as *Upgrading* below describes: the native format, paths, the inferred agent reference and many records change. [Known limitations](docs/known-limitations.md) lists what is still not collected, compared or verified.
 
 ### Security
@@ -40,12 +42,16 @@ Closes detection gaps listed under 0.1.0's known limitations and others found in
 - Read brace, bracket, pattern and parameter expansions in MCP launch arguments in linear time and bounded memory: a few kilobytes of unclosed braces stalled a scan, a 128 KB brace list took 3.9 GB, and a long `*` pattern took 30 s to compile. Default operands nested more than eight deep and braces open more than 256 deep are a gap, and inline JSON arguments no longer exhaust the scan budget. Pattern readings are matched against the program names that their literal text allows, and each compile is charged.
 - Follow the `@path` imports of nested `CLAUDE.md` files, and treat an A2A card module that is too large to parse or spelled with compatibility characters as a coverage gap.
 - Find MCP package-source origins and analyse Python MCP servers in time linear in the file size: a long `.npmrc` value held the `mcp` collector for 25 s at 160 KB, and a server passed to a large helper from many calls took quadratic time.
-- In the runtime gateway with `canonical_arguments=True`, validate and resolve the scope of the arguments the executor receives, and deny schemas that use keywords only drafts before draft-04 define.
+- **Breaking:** the runtime gateway passes canonical arguments by default (`canonical_arguments=True`), so `resolve_scope` and `execute` receive the RFC 8785 value the approval binds, and it validates and resolves the scope of those arguments; an integral float outside the I-JSON range is refused in every mode, and schemas that use keywords only drafts before draft-04 define are denied. Pass `canonical_arguments=False` only for an executor that needs the caller's own encoding.
 - Measure the PyPI soak only from a commit's push run, so a commit without one, such as a `[skip ci]` push, needs a stated override; require the publishing environment to admit only `main` rather than every protected branch; treat an unreported ruleset bypass as unknown; and reject workflow gate steps that never run, and gate commands that are quoted, conditional, negated, chained, backgrounded, preceded by `set +e`, `set -n`, `cd`, `trap`, `exit` or `hash` (also through `builtin`, `command`, `shopt -o` or an expanded command name), run through a `$VAR` that `export`, `declare`, `read` or a loop rebinds, passed as an option's value such as `python -X`, or run under another shell or working directory. Scripts the checker reads differently from `bash` (`$'...'` escapes, partly quoted here-document delimiters, here-documents and comments inside `$(...)`) no longer yield a gate.
 - **Breaking:** record the ShadowScan discovery verification outcome in the BOM, and fail unverified discovery evidence in CI. Importing a report writes `metadata.completeness.discovery_verification` (`verified` with the signer identity and issuer, otherwise `unverified`) with the report digest and the report's own run time; the repository and commit are recorded as `unknown` because the ShadowScan report format carries neither. The record is unsigned, so it is reported but never trusted: only a producer check in the same run counts as verification (`import-shadowscan --bundle`, or `validate`/`risk --project --signature-policy`). Otherwise `import-shadowscan` (with or without `--report-only`), `validate` and `risk` warn loudly, and fail the run when a CI variable (`CI`, `GITHUB_ACTIONS` and the like) is set unless `--allow-unsigned-discovery` is passed; `--fail-on-unsigned-discovery` forces failure anywhere, and passing both is a usage error. `risk --json-output` reports such a failure with the same keys as a scored report, and `validate` records it as `unsigned_discovery`. The Action takes an `allow-unsigned-discovery` input.
 - **Breaking:** verify the Sigstore trust root before trusting it. Offline verification now fails closed when the sigstore-python cache directory or `trusted_root.json` is group/world-writable, a symlink, or owned by someone else; a missing cache is created mode 0700. Pass an explicit trust root with `--trust-root` on `verify-artifact`/`verify-discovery` (optionally pinned with `--trust-root-sha256`), or `NEXUS_SYMBIOTE_SIGSTORE_TRUST_ROOT` for any verification path, and the verification output prints the trust-root path used. A verify that passed on a shared or group-writable cache now exits 1 until the cache is made private or a trust root is supplied.
 - Verify against the cached Sigstore trust root from the bytes that were checked. The cached `trusted_root.json` is now opened once without following symlinks, checked on that descriptor and read, and the verifier is built from those bytes; before, sigstore-python read the file again by path after the check, so a process running as the same user could replace it in between. A missing cached root is created mode 0600 from the root embedded in sigstore-python, as sigstore-python did.
 - **Breaking:** bind each `risk.suppressions` entry to the finding it accepted. An entry now requires the finding's `fingerprint`, which `risk --json-output` and human-readable `risk` print for each finding: a digest of its component, category, severity and detail, and of the component's content digest (`content_hash`, `definition_hash`, `schema_hash` or the `sha256` file hash) when the inventory records one. A finding whose detail, severity or reviewed bytes changed, such as a prompt whose one bidirectional override grew to 31 or now reverses a different instruction, is no longer suppressed and counts again, and the entry is listed under `suppressions_stale`; before, an entry covered the component and category whatever the finding became. A policy with an entry that has no fingerprint is refused ([suppressions](docs/policy-reference.md#suppressions)).
+- Count runtime quorums over unrevoked signers: a signature from a revoked or unbound key appended to a valid envelope no longer makes it fail, and never counts towards a threshold. Collection limits are kept per context, the offline guard stays in force until its last overlapping user leaves, a state store whose identity changed in place is refused, and `runtime keygen` creates key files without following links.
+- Require the exact spelling of every path component in confined reads on case-folding file systems, and refuse a policy file under another case. A signer policy entry that names its artifact or bundle in another case is refused there as it is on a case-sensitive file system. A runner started with a path or an interpreter instead of a package entry point, and `npm exec` options after the package, are unknown launchers; `deno.json` and bunfig preload, shell and CA settings are read as resolver configuration; SSE lines may end in a bare carriage return within the response bound; and `hf_` tokens and raw `Authorization` and cookie header values are redacted.
+- Refuse a byte-order mark in strict JSON, read `image:sha256:` and tag-plus-digest references as digest pins and a tag without a dot as unpinned, apply a model's intrinsic risks in `diff`, SARIF and VEX, and export a package URL only when the component's registry agrees with it.
+- Stop the release provenance step explicitly when an expected distribution or attestation is missing or is a symbolic link, run the platform smoke workflow on pull requests with the confinement suites, and refuse a `scanners` subset in the Action while `validate` is on.
 
 ### Changed
 

CITATION.cff

@@ -11,11 +11,11 @@ repository-code: https://github.com/Hunzee-VC/Nexus-Symbiote
 repository-artifact: https://pypi.org/project/nexus-symbiote/
 url: https://github.com/Hunzee-VC/Nexus-Symbiote
 # The code's licence. The distributions also bundle CycloneDX schemas (Apache-2.0) and
-# SPDX schemas (Community-Spec-1.0); see src/nexus_symbiote/generators/schemas/vendor/NOTICE.txt.
+# SPDX schemas (Community-Spec-1.0 AND CC-BY-3.0); see src/nexus_symbiote/generators/schemas/vendor/NOTICE.txt.
 license: MIT
 # scripts/check_repository_hygiene.py requires this version to match pyproject.toml.
-version: 0.1.0
-date-released: "2026-11-08"
+version: 0.2.0
+date-released: "2026-11-12"
 keywords:
   - aibom
   - agent-bill-of-materials

CLAUDE.md

@@ -6,16 +6,17 @@ Agent Bill of Materials (AgentBOM) generator and validator for AI agent supply c
 
 ```
 src/nexus_symbiote/
-  core/        — Domain models (Pydantic v2), enums, AIBOM container, RFC 8785 JCS hashing, inventory content digest
-  scanners/    — Component discovery (MCP, model weights, prompts, RAG, registry, A2A, IDE agents, ShadowScan reports)
-  generators/  — Exports: native JSON, CycloneDX 1.7, SPDX 3.0, SARIF, VEX
+  core/        — Domain models (Pydantic v2), evidence/authority records, enums, AIBOM container, RFC 8785 JCS hashing, inventory content digest
+  scanners/    — Component discovery (MCP, MCP launch/live wire, model weights, prompts, RAG, registry, A2A, IDE agents, ShadowScan reports)
+  generators/  — Exports & PURL projection: native JSON, CycloneDX 1.7, SPDX 3.0.1, SARIF 2.1.0, VEX
   validators/  — Completeness, integrity, and risk scoring
   diff/        — AIBOM version comparison and the snapshot alert gate
-  live/        — Opt-in observations through independently pinned local MCP launchers
-  utils/       — Confined bounded reads, Sigstore/artifact verification, file hash utilities, terminal-output neutralization
-  runtime.py   — Signed, operation-bound authorization for integrations that mediate tool calls
-  runtime_validation.py, runtime_cli.py — Offline schema validation worker; `runtime` commands
+  live/        — Opt-in observations and pinned stdio execution (`inventory.py`, `session.py`, `stdio.py`, `verify.py`)
+  utils/       — Confined `openat` reads (`confined.py`), Sigstore/Ed25519 verification (`crypto.py`), safe output writes (`files.py`), JSONC/model-header parsers, secret redaction, terminal neutralization
+  runtime.py   — Signed, operation-bound authorization gateway (`canonical_arguments=True` by default)
+  runtime_validation.py, runtime_cli.py — Isolated offline schema validation worker; `runtime` commands
   policy.py, signature_policy.py       — Caller-selected policy and operator signer policy
+  limits.py                            — Operator-controlled collection bounds (`--limit`, `NEXUS_SYMBIOTE_LIMITS`)
   graph.py, lineage.py                 — Repository association graph, blast radius, lineage
   risk_classes.py, graph_view.py, graph_cli.py — Risk classes, exposure paths; the `graph` HTML/JSON view
   digest_cli.py                        — `digest`: file, canonical and content digests of an inventory
@@ -26,8 +27,9 @@ src/nexus_symbiote/
   inventory_export.py, inventory_export_cli.py — ShadowScan simple-list export; `export-inventory`
   advisories.py                        — Explicit, bounded OSV queries for exact package identities
   modes.py                             — Offline by default; live mode is opt-in
+  reporting.py                         — Neutralized text and JSON gate reporting
   scanner_catalog.py                   — Built-in collector universe for coverage checks
-  cli.py, live_cli.py, supply_chain_cli.py — Click CLI entrypoints
+  cli.py, analysis_cli.py, live_cli.py, supply_chain_cli.py — Click CLI entrypoints
 ```
 
 ## Build and test
@@ -55,6 +57,6 @@ make check            # offline subset of the required CI checks
 - Every scanner extends `scanners/base.py:Scanner` and returns `ScanResult`
 - Risk assessments use `RiskSeverity` enum: critical > high > medium > low > info
 - Trust tiers: internal-verified > internal-unverified > third-party-signed > third-party-unsigned > untrusted-public > unknown
-- Tests live in `tests/` and use pytest
-- Ruff for linting (line-length 100), mypy strict mode
+- Tests live in `tests/` and use pytest (`conftest.py` isolates environment/HOME, blocks outbound non-loopback sockets, and enforces `--strict-skips` in CI)
+- Ruff for linting (line-length 100), mypy strict mode (`mypy src/nexus_symbiote scripts`)
 - No comments unless the why is non-obvious