Changelog
- 9001a16 Add mediation envelope federation verification (#465)
- 31403b8 Add redaction provider parser registry (#462)
- 8f4909f Guard ratify against low-confidence enforcement (#493)
- a502b71 chore(deps): pin python verifier fixture and add CI policy gate (#448)
- 5523c94 ci: bump github/codeql-action in the ci-actions group (#477)
- e8d146a ci: bump the ci-actions group across 1 directory with 2 updates (#446)
- cef4f47 ci: pin release build to Go 1.25.10 for stdlib security fixes (#496)
- 7541930 deps: bump cryptography (#450)
- fac893d deps: bump github.com/fsnotify/fsnotify in the go-deps group (#476)
- 66a53f4 deps: bump the pr-review-deps group in /.github with 4 updates (#451)
- 72f3717 feat(blockreason): X-Pipelock-Block-Reason header schema and emit package (#467)
- dd4fd4e feat(blockreason,runtime): contract reason codes + proxy_decision receipt builder (#484)
- 4b575b0 feat(capture): add contract-aware replay fidelity gates (#456)
- 39874e4 feat(cli/signing): operator commands to bootstrap live-lock trust (#494)
- 38bacb4 feat(contract): add activation lifecycle commands (#461)
- bfb6b18 feat(contract): add active manifest store (#459)
- 7a4091d feat(contract): add inference confidence and exposure gates (#452)
- d293305 feat(contract): add runtime contract evaluation (#460)
- 4d01e23 feat(contract): add shadow replay reports (#458)
- 42e99d6 feat(contract): emit signed shadow delta receipts (#457)
- f6602da feat(contract): live-lock foundation: validator, evaluator, loader (#482)
- 9bc5104 feat(contract): path normalization with cardinality cap and operator pin/split (#454)
- 6b2a3a1 feat(contract): v2.4 schema package + EvidenceReceipt v2 envelope (#442)
- 2adae9b feat(contract,runtime): mcp_tool_call rule kind + EvaluateMCP (#485)
- 3b55d33 feat(contract/runtime): fsnotify watcher for active manifest (#483)
- 23a947b feat(health): wedge-detection watchdog reports /health 503 on wedge (#473)
- 3e91534 feat(learn): add contract compile candidate pipeline (#455)
- 3d47d6b feat(learn): add ratify and forget commands (#463)
- 64b108d feat(learn-and-lock): observe phase wiring (config, privacy, recorder schema, metrics, CLI) (#447)
- 3c722e9 feat(mcp): live-lock enforcement on MCP transports (#490)
- abeba87 feat(metrics,capture): soak observability, transport parity, header hardening, reason matrix (#475)
- ebb94f6 feat(proxy): gate fetch, CONNECT, and WebSocket contracts (#489)
- d06b25c feat(proxy): live-lock enforcement on forward proxy (#486)
- a8e1247 feat(proxy): live-lock enforcement on intercept proxy (#487)
- 1d6364a feat(proxy): live-lock enforcement on reverse and redirect paths (#488)
- 9ace0e6 feat(proxy/blockheaders): emit X-Pipelock-Block-Reason on every block path (#469)
- 4086512 feat(signing): deployment-level key roster, recovery authorization, and root transition primitive (#444)
- db1ea3b fix(capture): classify learn observations for debt metrics (#480)
- f8b64dc fix(capture,config): SessionID empty + caller-side metadata + race + e2e regression test (#474)
- aa33b39 fix(envelope): verify origin-form target URIs (#481)
- 10826e8 fix(learn): require nested live-lock environment (#495)
- 066aa93 fix(mcp): drain adopted-descendant zombies during long-lived wraps (#449)
- a84f28e fix(mcp): listener routes SSE upstream responses through SSEReader (#472)
- 84d544b fix(proxy/reload): scanner drain, detect_drift rebuild, reverse-proxy receipt parity (#443)
- 456c010 fix(runtime/loader): atomic writes in watcher tests to match production (#492)
- 0d6789a fix(sentry): adapt scrubber to sentry-go 0.46 (#453)
- 918bcca refactor(metrics): split internal/metrics into per-feature bundles (TD-6) (#441)
- 9ca43dc test(capture): add live-lock decision matrix harness (#491)
- 64d194b test(capture): add synthetic replay regression harness (#468)