AI SAFE² CLI 0.8.0: Evidence-Bound AISM Remediation Decisions

Assessment without remediation is trivia. You ran the AISM scoring, you found the gaps. And then what? A spreadsheet of findings with no owners, no sequence, no exit criteria, slowly going stale until the next assessment finds the same gaps.

CLI 0.8.0 closes the loop. It turns AISM assessment gaps into an accountable implementation plan, without ever letting the tool approve its own recommendations.

What’s new

safe2 aism remediation-init: binds every proposed action to the exact assessment, system identity, and scope it came from. No orphan actions, no mystery origins.

safe2 aism plan: validates the plan and emits two things: canonical JSON for machines, and a human-readable decision card for the person who has to sign off. Each action carries its owner, dependencies, assumptions, alternatives, exit criteria, and residual risks. That’s a real plan, not a findings dump.

--previous: detects completed actions that regress or disappear on reassessment. Fixed it once and it broke again? Now you know, with evidence.

--strict: for when “close enough” isn’t.

The part I’m proudest of is hard-coded into every plan: human_owned: true, remediation_authorized: false, conformance_claim: false. The tool proposes; the human disposes. The plan cannot authorize itself, and it cannot claim conformance. Those are human decisions, and the machine is structurally prevented from making them.

Every 0.8.0 remediation plan hard-codes three facts: a human owns it, the tool did not authorize it, and it claims no conformance. Accountability isn’t a policy here. It’s a data structure.

Why upgrade

1. Findings become plans. Owners, dependencies, exit criteria, residual risks. The gap between “we know” and “we did” gets a bridge.
2. Regressions get caught. --previous means fixed-and-rebroken stops being invisible.
3. The tool can’t grade its own homework. Self-authorization and self-conformance are structurally impossible, not just discouraged.
4. It’s validated. 817 tests passing, 7 skipped, Python 3.11 to 3.14, Greptile 5/5.

Takeaways

• 0.8.0 connects AISM scoring gaps to accountable, sequenced remediation plans.
• Human decision gate is hard-coded into every plan’s data structure.
• Regression detection across reassessments via --previous.

Bottom line: An assessment that doesn’t produce an accountable plan is just an expensive opinion. 0.8.0 makes the plan, and keeps the human in charge of it.

Release notes: AI SAFE² CLI 0.8.0 on GitHub, tag 2026-09-24_CLI_0.8.0.