What's Changed
🔧 Other Changes
- feat(tls): verify against the OS trust store by default (closes #2004) by @fangkangmi in #2005
- fix(update): re-check transitive dependencies' own semver ranges during apm update by @nadav-y in #2053
- feat(shepherd): enforce canonical owner gate by @danielmeppiel in #2180
- fix(deps): git-semver update idempotency in build_update_plan by @srobroek in #2165
- fix(audit): preserve dependency link paths during replay by @danielmeppiel in #2179
- docs: add deny and doctor CLI references by @danielmeppiel in #2178
- fix(installer): expose stable Windows executable by @danielmeppiel in #2094
- fix(audit): honor locked skill subsets during replay by @danielmeppiel in #2177
- fix(docs): correct relative link depths across docs site by @JasonTame in #2170
- fix(pack): pack subdirectory-prefixed skills by @danielmeppiel in #2176
- fix(policy): preserve strict policy across warm cache reads by @danielmeppiel in #2193
- test(foundation): add hermetic lifecycle integration utilities by @danielmeppiel in #2209
- harden(contracts): add platform and rendered documentation evidence by @danielmeppiel in #2199
- test: add finite taxonomy and quality ratchets by @danielmeppiel in #2198
- test(consume): add real lifecycle contracts by @danielmeppiel in #2212
- test(produce): prove real pack-to-install artifact parity by @danielmeppiel in #2215
- test(consume): expand source/ref/cache matrix by @danielmeppiel in #2219
- test(produce): expand genuine materialization matrix by @danielmeppiel in #2218
- fix(deps): canonicalize virtual package manifest bytes by @danielmeppiel in #2223
- test(govern): prove strict policy lifecycle parity by @danielmeppiel in #2221
- fix(lockfile): converge claude_skill virtual dep name/version across resolution paths (closes #2206) by @danielmeppiel in #2217
- test(quality): synchronize the finite critical-suite count by @danielmeppiel in #2230
- fix(deps): preserve custom port in HTTP git URL persisted to apm.yml by @atulya-singh in #2210
- fix(audit): exempt is_virtual packages from config-consistency manifest check by @hugoguitton-lucca in #2214
- fix(marketplace): close packed source contracts by @danielmeppiel in #2228
- fix(pack): emit category in Claude marketplace output by @mbeacom in #2189
- fix(cache): preserve nested GitLab repository identity by @lidorcg in #2192
- fix(cli): warn when Codex agent tool scope is dropped by @jstar0 in #2186
- fix(deps): accept custom port in shorthand so apm.yml entries re-parse by @atulya-singh in #2211
- harden(shepherd): require exact-head functional owner evidence by @danielmeppiel in #2234
- fix(policy): honor Govern cache TTL with bounded property coverage by @danielmeppiel in #2235
- fix(deps): honor SSH for semver ref resolution by @danielmeppiel in #2229
- fix(ado): preserve lock coordinates for outdated and update by @danielmeppiel in #2226
- fix(deps): bound best-effort ref lookup retries by @danielmeppiel in #2238
- fix(virtual-packages): restore hermetic lifecycle convergence by @danielmeppiel in #2240
- test(architecture): add bounded mutation pilot by @danielmeppiel in #2241
- test(deps): add field-complete lockfile round-trip and reconstruction properties by @danielmeppiel in #2246
- fix: Windows CI CRLF baseline and WebSocket shutdown thread-join (closes #2233) by @danielmeppiel in #2237
- fix(prune): reconcile merged hook ownership after package removal by @danielmeppiel in #2249
- fix(hooks): scope merged-hook wipe to resolved targets, not all KNOWN_TARGETS by @danielmeppiel in #2252
- harden(ci): require hermetic lifecycle smoke subset on pull-request CI by @danielmeppiel in #2247
- feat(mutation): add lockfile-normalization owner to bounded mutmut pilot by @danielmeppiel in #2251
- fix(ci): restore Windows unit reliability by @danielmeppiel in #2262
- fix(deps): add SSH key-auth clone failure guidance by @danielmeppiel in #2244
- test(hooks): promote target-scope uninstall smoke by @danielmeppiel in #2257
- fix(release): package Rich Unicode tables in frozen binaries by @danielmeppiel in #2264
- test(lifecycle): add shared state substrate by @danielmeppiel in #2265
- test: remove duplicate validation suite by @danielmeppiel in #2263
- fix(quality): correct duplicate group count by @danielmeppiel in #2274
- test(fixtures): auth-hardened url_rewrite_subprocess_env for real CLI installs by @danielmeppiel in #2267
- test(lifecycle): cover package shape transitions by @danielmeppiel in #2273
- fix(deps): preserve shared transitive deps still reachable from survivors by @danielmeppiel in #2269
- fix(ci): raise packaged Unix integration timeout by @danielmeppiel in #2276
- test(config): cover configuration and shared-graph lifecycle contracts by @danielmeppiel in #2277
- test: retire six exact duplicate modules by @danielmeppiel in #2278
- fix(install): reconcile dropped-target merge-hook state on target contraction by @danielmeppiel in #2275
- fix(manifest): fold legacy 'all' in targets to auto-detect with a deprecation warning by @kotalab in #2272
- fix: absolutize Copilot user-scope hook commands (closes #2232) by @danielmeppiel in #2236
- fix(hooks): compose per-file routing with dependency targets by @srobroek in #2259
- fix(hooks): rebuild merged hooks from transitive lockfile survivors by @Shaurya2k06 in #2256
- test: retire six header-only twin modules by @danielmeppiel in #2280
- test(integration): add primitive target lifecycle covering array by @danielmeppiel in #2266
- test(ci): isolate the live guardrailing hero by @danielmeppiel in #2281
- fix(deps): recover virtual files from GitHub throttles by @danielmeppiel in #2284
- fix(install): contract generic shared target rows by @danielmeppiel in #2283
- test(integration): retire final header-only test twins by @danielmeppiel in #2285
- feat(agentics): add daily performance-scan agentic workflow by @sergio-sisternes-epam in #2125
- fix(deps): align integration throttle contracts by @danielmeppiel in #2287
- test(outdated): isolate parallel fixtures by @danielmeppiel in #2288
- test(integration): hermeticize packaged lifecycle E2E by @danielmeppiel in #2289
- fix(prune): reconcile deployment ledger ownership by @danielmeppiel in #2292
- fix(install): reconcile dropped target instructions by @danielmeppiel in #2295
- fix: guide compile-only project installs (supersedes #2115, closes #2057) by @danielmeppiel in #2293
- fix(audit): surface ref-consistency before deployment-ledger-owners by @danielmeppiel in #2300
- fix(install): remove shared-root skill orphan on target narrowing by @danielmeppiel in #2299
- fix(skills): report zero-match filters (supersedes #2117, closes #2116) by @danielmeppiel in #2294
- fix: selective update plan must not mark unselected deps removed (closes #2291) by @danielmeppiel in #2305
- test(lifecycle): require real state machine gate by @danielmeppiel in #2309
- fix(lifecycle): repair packaged G0 contracts by @danielmeppiel in #2310
- test(tls): make override oracle state-independent by @danielmeppiel in #2311
- fix(install): defer transient GitHub validation failures by @danielmeppiel in #2313
- fix(integration): hermeticize stale packaged G0 release-blocker tests by @danielmeppiel in #2314
- chore: release v0.26.0 by @danielmeppiel in #2316
New Contributors
- @fangkangmi made their first contribution in #2005
- @JasonTame made their first contribution in #2170
- @atulya-singh made their first contribution in #2210
- @hugoguitton-lucca made their first contribution in #2214
- @mbeacom made their first contribution in #2189
- @lidorcg made their first contribution in #2192
- @jstar0 made their first contribution in #2186
- @kotalab made their first contribution in #2272
- @Shaurya2k06 made their first contribution in #2256
Full Changelog: v0.25.0...v0.26.0