Ait

v0.55.48 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 25d AI Agents & Assistants

✓ No known CVEs patched

This release patches 3 known CVEs

Topics

agent-harness agent-isolation agentic ai-agents ai-coding ai-tools

+14 more

aider claude-code code-provenance codex coding-assistant cursor developer-tools gemini-cli git git-worktree llm-agents python vcs worktree

Affected surfaces

auth rbac

Summary

AI summary

Added AIT Risk-Based Pre-Apply Review Orchestration with new commands, fields, and hardened safety gates.

Full changelog

Add AIT Risk-Based Pre-Apply Review Orchestration design and
implementation docs covering Phase 0 through Phase 6.
Add ait review attempt, review queue worker, deterministic risk
scoring, trusted baseline snapshots, structured reviewer findings,
finding lifecycle commands, and local review benchmark support.
Add ait query fields for review and finding state, including review
status, profile, override, freshness, and finding severity/lifecycle
filters.

Harden pre-apply review gates so required missing, queued, running,
failed, blocked, stale, or malformed reviews fail closed for auto
apply.
Keep review status separate from verifier verified_status; review
failures remain quality/safety gate evidence and do not mutate
Git/provenance integrity status.
Extend reports, status, and release checklist coverage for review
status, baseline refs, freshness, overrides, and benchmark checks.

Reviewer adapters run through configured local commands with bounded
cwd/env/timeout controls; AIT core does not add direct network access.
Human override remains auditable and is recorded as override state
rather than rewriting blocked/failed reviews as passed.
Trusted baseline retrieval excludes candidate, stale, and
policy-blocked memory from trusted reviewer context.

Reviewer adapters execute with bounded cwd/env/timeout controls; AIT core provides no direct network access.
Human overrides are audited as override state without altering blocked/failed review outcomes.
Trusted baseline retrieval excludes candidate, stale, and policy‑blocked memory from reviewer context.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Ait

Get notified when new releases ship.

About Ait

v0.55.52 Keep the built-in claude-code reviewer pinned to the local claude -p CLI even when repository policy defines a conflicting command override.