Changelog
- 6ea1823 Add per-server MCP response trust classes (#820)
- d3edac5 Add provider-key DLP coverage (#821)
- fbe631b Make contain install portable across Linux distros (#817)
- cd399d6 conductor: clearer follower operator UX (check advisories, error remediation, recovery docs) (#828)
- 091d66d feat(playground): add brokered Fly deployment (#826)
- b444ccd feat(playground): harden live playground core (#825)
- a0d859f fix(conductor): prevent follower restart-wedge and add replay-state recovery command (#823)
- 9f52193 fix(proxy): measure idle across both tunnel directions (CONNECT + WebSocket) (#816)
- 25283bd fix(security): receipt trust anchor, fail-closed reload/state, scan masking, sandbox TOCTOU (#819)
- c5668e1 fix(selfupdate): require signed release manifest, never exec the download (#818)
- 778f391 playground: pin Fly Dockerfile base images by digest (#829)
- cc0757e v3.0.0: conductor fleet day-2 ops (follower un-enroll, DR backup/restore) + fail-closed hardening defaults (breaking) (#827)