msaad00/agent-bom

What's Changed

• chore(deps-dev): bump vite from 8.1.4 to 8.1.5 in /ui by @dependabot[bot] in https://github.com/msaad00/agent-bom/pull/4057
• fix(overview): make connector/bulk-ingested estates first-class in the exec pane by @msaad00 in https://github.com/msaad00/agent-bom/pull/4059
• fix: three scanner/CLI correctness bugs (malicious remediation, AST skip-dir scope, --agent-mode coverage) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4060
• feat(connect): emit ready-to-run read-only onboarding artifacts by @msaad00 in https://github.com/msaad00/agent-bom/pull/4058
• feat(auth): first-class SSO provider presets at /login by @msaad00 in https://github.com/msaad00/agent-bom/pull/4062
• Harden the bulk/connector ingest write path for scale and availability by @msaad00 in https://github.com/msaad00/agent-bom/pull/4061
• fix(overview): keep executive top risks honest across API and UI by @msaad00 in https://github.com/msaad00/agent-bom/pull/4064
• Virtual, scoped, revocable model-provider key broker by @msaad00 in https://github.com/msaad00/agent-bom/pull/4065
• feat(connections): guided Verify step in the connect wizard by @msaad00 in https://github.com/msaad00/agent-bom/pull/4067
• governance[8/8]: audit-event OTLP-log export + EDR/MDM device-posture ABAC by @msaad00 in https://github.com/msaad00/agent-bom/pull/4066
• feat(auth): Snowflake OAuth dashboard sign-in by @msaad00 in https://github.com/msaad00/agent-bom/pull/4069
• feat(scan): scanner coverage — Go reachability, OS/distro breadth, live-K8s by @msaad00 in https://github.com/msaad00/agent-bom/pull/4073
• docs: full-stack "Architecture & how it works" in README + tighten ARCHITECTURE by @msaad00 in https://github.com/msaad00/agent-bom/pull/4076
• fix(gateway): fail closed on conditional-access evaluation error by @msaad00 in https://github.com/msaad00/agent-bom/pull/4080
• perf(graph): streamed-persist + bounded reconciliation-set for graph writes by @msaad00 in https://github.com/msaad00/agent-bom/pull/4074
• fix(scan): scanner-coverage accuracy + security hardening by @msaad00 in https://github.com/msaad00/agent-bom/pull/4077
• fix(ci): bootstrap Git before Alpine checkout by @msaad00 in https://github.com/msaad00/agent-bom/pull/4081
• perf(hub): atomic + batched ingest write path and sub-linear overview snapshot by @msaad00 in https://github.com/msaad00/agent-bom/pull/4078
• feat(export): scheduled findings export to object stores + warehouses (S3 + ClickHouse + Snowflake) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4082
• feat(integrations): MCP-first ITSM/ticketing connector [WIP] by @msaad00 in https://github.com/msaad00/agent-bom/pull/4084
• fix(ci): restore root-logger handlers between tests (xdist stdout pollution → 3.13 failure) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4085
• feat(connect-wizard): AWS Organization StackSet onboarding path by @msaad00 in https://github.com/msaad00/agent-bom/pull/4088
• feat(self-posture): operator self-audit of agent-bom's own deployment by @msaad00 in https://github.com/msaad00/agent-bom/pull/4089
• perf(graph): bounded prior-snapshot digest + single-pass streaming persist by @msaad00 in https://github.com/msaad00/agent-bom/pull/4091
• feat(integrations): connect-once ticketing UI + Azure/GCS/BigQuery/Databricks export sinks by @msaad00 in https://github.com/msaad00/agent-bom/pull/4090
• fix(audit): make posture and evidence outputs honest by @msaad00 in https://github.com/msaad00/agent-bom/pull/4096
• fix(graph): make streamed snapshot retries atomic by @msaad00 in https://github.com/msaad00/agent-bom/pull/4097
• fix(deploy): make release proof and health contracts honest by @msaad00 in https://github.com/msaad00/agent-bom/pull/4098
• feat(onboarding): connect-depth (deep-scan + DSPM opt-in), all-regions, Snowflake SPCS from wizard by @msaad00 in https://github.com/msaad00/agent-bom/pull/4099
• feat(remediation): prioritize campaigns and unify investigations by @msaad00 in https://github.com/msaad00/agent-bom/pull/4100
• fix(mitre): bound evidence mappings to observed context by @msaad00 in https://github.com/msaad00/agent-bom/pull/4102
• fix(formats): enforce CycloneDX reference uniqueness by @msaad00 in https://github.com/msaad00/agent-bom/pull/4109
• fix(postgres): restore store parity by @msaad00 in https://github.com/msaad00/agent-bom/pull/4110
• chore(deps): consolidate routine dependency updates by @msaad00 in https://github.com/msaad00/agent-bom/pull/4121
• fix(exports): publish warehouse runs atomically by @msaad00 in https://github.com/msaad00/agent-bom/pull/4122
• fix(cspm): fail closed on unevaluable benchmark evidence by @msaad00 in https://github.com/msaad00/agent-bom/pull/4124
• feat(self-posture): operator self-audit UI panel by @msaad00 in https://github.com/msaad00/agent-bom/pull/4123
• fix(graph): persist attack-path analysis status by @msaad00 in https://github.com/msaad00/agent-bom/pull/4132
• perf(compliance): bound and reconcile hub reads by @msaad00 in https://github.com/msaad00/agent-bom/pull/4133
• fix(dspm): retain complete vector scan evidence by @msaad00 in https://github.com/msaad00/agent-bom/pull/4128
• feat(ciem): activate bounded AWS IAM usage evidence by @msaad00 in https://github.com/msaad00/agent-bom/pull/4129
• feat(kspm): add native evidence-aware transport by @msaad00 in https://github.com/msaad00/agent-bom/pull/4135
• feat(ciem): add fail-closed authorization evidence contract by @msaad00 in https://github.com/msaad00/agent-bom/pull/4139
• fix(postgres): restore bootstrap, snapshot, and edge parity by @msaad00 in https://github.com/msaad00/agent-bom/pull/4140
• fix(compliance): reconcile executive finding counts by @msaad00 in https://github.com/msaad00/agent-bom/pull/4143
• feat(sast): add canonical SARIF integrity boundary by @msaad00 in https://github.com/msaad00/agent-bom/pull/4144
• feat(ciem): collect fail-closed Azure and GCP authorization evidence by @msaad00 in https://github.com/msaad00/agent-bom/pull/4145
• perf(compliance): offload and keyset hub reads by @msaad00 in https://github.com/msaad00/agent-bom/pull/4146
• feat(compliance): align executive and findings scopes by @msaad00 in https://github.com/msaad00/agent-bom/pull/4147
• feat(sast): align execution integrity and product surfaces by @msaad00 in https://github.com/msaad00/agent-bom/pull/4148
• docs(readme): lead with scan-first run and sync product proof by @msaad00 in https://github.com/msaad00/agent-bom/pull/4149
• refactor(runtime): public gateway policy eval and freeze package layout by @msaad00 in https://github.com/msaad00/agent-bom/pull/4150
• feat(snowflake): complete SPCS Native App distribution by @msaad00 in https://github.com/msaad00/agent-bom/pull/4160
• fix(gateway): restore identity-bound drift enforcement and event fidelity by @msaad00 in https://github.com/msaad00/agent-bom/pull/4161
• fix(attestation): require external DSSE signer trust by @msaad00 in https://github.com/msaad00/agent-bom/pull/4163
• fix(graph): render bounded rollup cards eagerly by @msaad00 in https://github.com/msaad00/agent-bom/pull/4164
• refactor(ast): consolidate the JS and TS analysis package by @msaad00 in https://github.com/msaad00/agent-bom/pull/4167
• security(runtime): publish fail-mode matrix and retire command allowlist theater by @msaad00 in https://github.com/msaad00/agent-bom/pull/4168
• feat(ciem): project proved authorization evidence into graph by @msaad00 in https://github.com/msaad00/agent-bom/pull/4171
• fix(cloud): surface Snowflake inventory evaluation gaps by @msaad00 in https://github.com/msaad00/agent-bom/pull/4173
• feat: advisory AI triage checkpoint, CLI init evacuation, bounded discovery walks by @msaad00 in https://github.com/msaad00/agent-bom/pull/4174
• docs(readme): lead with what/who/how, dedupe sections, compact diagrams by @msaad00 in https://github.com/msaad00/agent-bom/pull/4176
• feat(ciem): surface authorization evidence health by @msaad00 in https://github.com/msaad00/agent-bom/pull/4178
• fix(security): close IAM condition-drop and gateway conditional-access/identity-scope fail-opens by @msaad00 in https://github.com/msaad00/agent-bom/pull/4179
• fix: audit P0/P1 — event-loop offload, SCA matching + Go reachability honesty by @msaad00 in https://github.com/msaad00/agent-bom/pull/4180
• fix(identity): fail closed on partial IAM evidence and unpinned JWT audience by @msaad00 in https://github.com/msaad00/agent-bom/pull/4182
• fix(graph): keep distinct credential nodes instead of collapsing to one phantom node by @msaad00 in https://github.com/msaad00/agent-bom/pull/4183
• fix(audit): serialize the tamper-evident hash chain to prevent forks under concurrent writes by @msaad00 in https://github.com/msaad00/agent-bom/pull/4185
• fix(gateway,dspm,sast): honest KPIs, drift-cap signal, coverage warnings, aggregated SAST status by @msaad00 in https://github.com/msaad00/agent-bom/pull/4186
• fix(exec): reconcile none-band + KEV counts, correct narrative command, label demo totals by @msaad00 in https://github.com/msaad00/agent-bom/pull/4189
• fix(postgres): shared idempotency store and RLS backstop parity by @msaad00 in https://github.com/msaad00/agent-bom/pull/4192
• feat(cspm): provenanced benchmark control inventory and coverage drift gate by @msaad00 in https://github.com/msaad00/agent-bom/pull/4196
• feat(mitre): refresh bundled ATT&CK catalog to v18.1 with pinned provenance by @msaad00 in https://github.com/msaad00/agent-bom/pull/4197
• fix(hub): combined read-path scope filtering + atomic ingest, validation, honest truncation by @msaad00 in https://github.com/msaad00/agent-bom/pull/4198
• feat(ciem): AWS Access-Advisor over-privilege findings + AWS/GCP identity governance from usage telemetry by @msaad00 in https://github.com/msaad00/agent-bom/pull/4199
• feat(graph): typed ATT&CK/ATLAS technique mappings + consume dropped posture signals (combines #4201 + #4210) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4213
• fix(findings): surface computed-but-dropped signals + strict-generics typing + screenshot refresh (combines #4212 + #4211 + #4209 + #4208) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4215
• feat(compliance): vendor NIST 800-53 catalog + NIST↔ISO crosswalk into the framework library by @msaad00 in https://github.com/msaad00/agent-bom/pull/4217
• feat(hosted): self-serve invite/signup endpoint for the invite-only MVP by @msaad00 in https://github.com/msaad00/agent-bom/pull/4218
• chore(ci): PR fast path — single-interpreter matrix on PRs + npm cache by @msaad00 in https://github.com/msaad00/agent-bom/pull/4222
• fix(pipeline): release the surfacing graph before persist rebuild (one current graph, not two) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4220
• feat(mcp): signed MCP scan attestation foundation (PR-1 of #4151) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4221
• feat(graph): bounded partitioned attack-path campaign engine (core of #4156) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4223
• chore(ci): path-conditional Python suite + fuzzing, 3 pytest workers on PRs by @msaad00 in https://github.com/msaad00/agent-bom/pull/4225
• feat(compliance): NIST 800-53 check→control mapping + independent per-framework scoring by @msaad00 in https://github.com/msaad00/agent-bom/pull/4226
• fix(ci): gate test steps, not the matrix job, so the required check always reports by @msaad00 in https://github.com/msaad00/agent-bom/pull/4227
• feat(ui): attack-path kill-chain technique render (closes MITRE typed enrichment) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4224
• feat(compliance): framework library surface lock-in — CLI/API/exports/UI/MCP (closes #4214) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4228
• feat(cwpp): lifecycle foundation + cross-cloud disk adapters + runtime workload evidence (stages 1-3) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4230
• feat(graph): storage-backed graph-build workspace — producer-streaming foundation (PR-1 of #4075) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4231
• fix(postgres): make migrations authoritative at runtime by @msaad00 in https://github.com/msaad00/agent-bom/pull/4232
• feat(self-posture): tenant-scoped audit-chain integrity in the operator self-posture surface by @msaad00 in https://github.com/msaad00/agent-bom/pull/4234
• feat(deps): cloud-SDK pin-drift signal + CI freshness gate against a dated reference by @msaad00 in https://github.com/msaad00/agent-bom/pull/4235
• feat(kspm): versioned benchmark provenance + evidence-aware live-cluster posture (proven on kind) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4236
• perf(graph): stream the SQLite search-index refresh + map the producer-streaming wall (PR-2 of #4075) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4237
• feat(dspm): production-database content classification via read-only connect-once (live-PG proven) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4238
• fix(gateway): enforce bounded relay buffering by @msaad00 in https://github.com/msaad00/agent-bom/pull/4240
• fix(postgres): restore audit hash-chain fork-guard index in the migration-owned schema by @msaad00 in https://github.com/msaad00/agent-bom/pull/4243
• fix(clickhouse): bound buffered analytics queue by @msaad00 in https://github.com/msaad00/agent-bom/pull/4244
• docs(readme): make public proof concise and architecture-accurate by @msaad00 in https://github.com/msaad00/agent-bom/pull/4248
• fix: post-audit hardening — CIEM double-count, honesty/UI, PCI descriptors + graph edge reconcile (combines #4246 + #4247) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4249
• fix(security): egress + delivery boundary hardening (combines #4241 + #4242) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4245
• fix(ci): hermetic test isolation + worksteal distribution (closes the ~576s→~210s CI lever) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4251
• feat(kspm): surface live cluster posture as first-class API/MCP/CLI + least-privilege in-cluster deploy by @msaad00 in https://github.com/msaad00/agent-bom/pull/4250
• fix(ui): harden product proof capture and graph readability by @msaad00 in https://github.com/msaad00/agent-bom/pull/4252
• fix(scanner): reset enrichment circuit state between tests to stop empty OSV queries by @msaad00 in https://github.com/msaad00/agent-bom/pull/4254
• fix(api): scope hosted-scan discovery to the request, not the server host by @msaad00 in https://github.com/msaad00/agent-bom/pull/4255
• feat(deps): agent-bom-collector sidecar image shipping cloud SDKs independently by @msaad00 in https://github.com/msaad00/agent-bom/pull/4256
• fix(postgres): decode psycopg-native graph JSONB reads by @msaad00 in https://github.com/msaad00/agent-bom/pull/4257
• refactor(typing): bring remaining api/ modules under strict mypy by @msaad00 in https://github.com/msaad00/agent-bom/pull/4259
• fix(identity): prevent canonical agent collisions by @msaad00 in https://github.com/msaad00/agent-bom/pull/4258
• fix(api): isolate scan state and restore validation gates by @msaad00 in https://github.com/msaad00/agent-bom/pull/4261
• feat(dspm): Azure Blob + database content classification by @msaad00 in https://github.com/msaad00/agent-bom/pull/4260
• feat(cspm): deepen provider benchmark coverage + reconcile catalog proofs by @msaad00 in https://github.com/msaad00/agent-bom/pull/4262
• feat(cspm): automate manual Azure identity + Databricks controls (own-worded, CIS-ID-mapped) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4263
• fix(deps): repair extra-gated SDK imports that break on latest pinned versions by @msaad00 in https://github.com/msaad00/agent-bom/pull/4264
• fix(findings): complete the scan-finding read path (keyset + export) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4267
• fix(cloud): wire two plumbed-but-unfed cloud last-mile legs by @msaad00 in https://github.com/msaad00/agent-bom/pull/4265
• fix(scan): surface graph-derived finding categories on every scan surface by @msaad00 in https://github.com/msaad00/agent-bom/pull/4266
• fix(compliance): honesty + licensing polish — own-worded CIS titles, no_data score, toxic-combo subsumption, unassessed exploit likelihood by @msaad00 in https://github.com/msaad00/agent-bom/pull/4268
• feat(ui): polish scan workspace and product proof by @msaad00 in https://github.com/msaad00/agent-bom/pull/4270
• fix(ci): make gitleaks independent of pull request API by @msaad00 in https://github.com/msaad00/agent-bom/pull/4272
• fix(deploy): align auth posture and lock container dependencies by @msaad00 in https://github.com/msaad00/agent-bom/pull/4271
• chore(release): prepare 0.96.4 by @msaad00 in https://github.com/msaad00/agent-bom/pull/4275
• fix(honesty): CIS docstring-title leak, SBOM purl synthesis, doc/compose/changelog hygiene by @msaad00 in https://github.com/msaad00/agent-bom/pull/4281
• fix(findings): severity-sort keyset completeness + CSV export of all finding types by @msaad00 in https://github.com/msaad00/agent-bom/pull/4279
• fix(postgres,api): ship attack_paths columns in migrations; take cloud connection I/O off the event loop by @msaad00 in https://github.com/msaad00/agent-bom/pull/4282
• fix(matching): fail closed on unparseable advisory bounds; merge fix versions across aliases by @msaad00 in https://github.com/msaad00/agent-bom/pull/4286
• fix(audit): persist proxy-auth events under Postgres RLS; warn on swallowed audit writes by @msaad00 in https://github.com/msaad00/agent-bom/pull/4283
• fix(api,postgres,output): off-loop route sweep + post-ingest ANALYZE; console/graph reconciliation and self-contained export by @msaad00 in https://github.com/msaad00/agent-bom/pull/4288
• fix(release): don't fail the release on a coverage-limited self-scan by @msaad00 in https://github.com/msaad00/agent-bom/pull/4289
• test(graph): pin the shipped persist path bounded on a large new snapshot (#4075) by @msaad00 in https://github.com/msaad00/agent-bom/pull/4291

Full Changelog: https://github.com/msaad00/agent-bom/compare/v0.96.3...v0.96.4