Added
- The chat agent can now run the Home Assistant security audit on demand. Asking "is my home secure?" (or about network security, privacy, access tokens, or unknown devices) calls the new
audit_home_securitytool, which builds a fresh snapshot, evaluates the thirteen Home Assistant & network security rules with the usual capability gating and entity exclusions, and returns the findings by severity, each with its deterministic summary and suggested actions, plus the checks that could not run and why (which integration or install type would provide the missing fact). The system prompt tells the model to report by severity, name the checks that did not run, and never claim a check passed when it is listed as not run. Until now the audit's results existed only as notifications, audit rows, and health-sensor attributes, so the agent had nothing to say when asked. The on-demand run is read-only: no notification, audit row, cooldown charge, explainer call, or auth-inventory commit, and it bypasses the 24-hour posture cooldown so a standing finding is still listed. This is step 9 of the network security plan in its HA-only form; the privacy digest and thenetwork_auditprovider override wait for router adapters, since no MAC, IP, or hostname exists in the HA-only data. - The
sentinel_healthsensor gains afailed_rulesattribute listing rules whose evaluation raised in the last cycle; such rules were counted as active before. The on-demand audit reports the same rules underchecks_not_run. - New
home_generative_agent.run_network_auditservice returns the same report (status,findings,checks_run,checks_not_run,capabilities,missing_capabilities,notes,privacy_notes) for dashboards and automations.