v2.5.0

# SkillSpector v2.5.0

Released: 2026-07-24

## Summary

SkillSpector 2.5.0 adds canonical inspection-ledger reporting so every scan can show what was inspected, skipped, failed, or excluded. JSON-consuming security automation can now distinguish normal policy findings from scans that did not execute reliably.

## Highlights

- JSON and SARIF reports now include execution-completeness information, analyzer status, and safe explanations for skipped or failed work.
- JSON consumers can block incomplete or failed scans instead of treating a zero-finding report as a successful validation.

## Added

- Canonical inspection-ledger accounting across static and LLM analysis stages, including per-component coverage and explicit out-of-scope records.
- Execution-completeness fields in JSON and SARIF output so automation can distinguish a complete scan from a partial or failed one.
- The top-level `execution_successful` status and `analysis_completeness.ledger_exceptions` diagnostics in JSON output.

## Changed

- Recursive scans now return a failure when any child scan fails, and include the child status in the combined report.
- The CLI exits with code 2 for a fatal execution or accounting failure, even when a JSON report was produced.
- Baseline fingerprints use the version 2 format, binding accepted findings to the scanner version, source content, and full finding evidence.

## Fixed

- Tightened static-analysis filtering so documentation or code-example context cannot broadly suppress credential-access findings.
- Improved binary and large-file handling during analysis.
- CI validators can report the public completeness exceptions that explain a blocked execution failure.

## Security

- Version 1 baselines containing fingerprints are rejected instead of allowing stale or insufficiently specific suppressions. Regenerate and review a version 2 baseline after upgrading.
- Hardened analyzer and build-context processing against unsafe input handling while preserving auditable suppression records in SARIF output.

## Breaking Changes and Migration

- Baseline files with version 1 fingerprints are no longer accepted. Run `skillspector baseline <path>`, review the generated version 2 entries, and commit the replacement baseline; rules-only version 1 baselines remain supported with a warning.
- JSON integrations must treat invalid or missing output, a nonzero process failure, or `execution_successful: false` as a blocking validation error and surface `analysis_completeness.ledger_exceptions` for diagnosis. Continue to use HIGH or CRITICAL findings for ordinary security-policy failures.

## Deprecations

- None.

## Validation

- Required CI jobs: lint, test-unit, test-integration, docker-smoke, and sonar-scan — passed.

## Known Limitations

- None.

## References

- `CHANGELOG.md`
- `docs/SUPPRESSION.md`