Aelira v0.9.6

Security

Image-equation remediation is bound to a purpose-authorized vision provider, validates the exact source occurrence, rejects unrestricted recognition output, verifies rendered MathML deterministically, caps confidence at 0.55, and always requires human acceptance.
PDF table remediation binds visible cells to real marked content and verifies the saved Table/TR/TH/TD hierarchy, ParentTree, MCID/MCR, and object identity before publication. Ambiguous or excessive structures fail closed before mutation.
Remediation artifacts remain tenant-fenced, descriptor and checksum-bound, approval-gated under the final lock, and unavailable until validation succeeds. Canvas and Brightspace enqueue failures expose stable bounded codes rather than provider or filesystem detail.

Printed standalone equation images addressable by page, xref, image index, bounding box, and occurrence identity can be recognized as LaTeX, converted through latex2mathml, round-trip verified, and associated with /Formula content and embedded MathML.
Verified tables remediate automatically when their real cell structure is provable. Inclusive limits are 64 columns, 10,000 cells, and 200 tables; ragged, merged, unbound, or oversized cases remain explicit manual-review outcomes.
Canvas stored-content remediation now persists durable jobs, immutable bounded source snapshots, complete target fingerprints, source-current approvals, bounded diagnostic evidence, restart discovery, and fenced writeback intents.

OCR-generated searchable text survives into the delivered PDF, while suitability, signatures, XFA, partial-text, and indeterminate cases remain fail closed.
PDF-derived HTML is reconstructed through a passive allowlist and rejects active content, event handlers, unsafe URLs, malformed image payloads, decompression risks, and trailing-data polyglots.
Direct, queued, and Brightspace publication consumes the exact descriptor-bound output claim rather than reopening a mutable pathname.
OneDrive receives tenant scope through department_id. Invalid constructor wiring, reserved scan metadata, remediation CORS preflight, and LMS enqueue-error sanitization are covered by regression tests.

Document remediation runs through the durable queue with active-job deduplication, bounded legacy waiting, tenant-fenced job status and latest-job endpoints, artifact-gated downloads, and a killable subprocess with bounded termination and no retry after a hard timeout.
Equation approval is revalidated after subprocess completion and again under the final artifact lock. Missing purpose-bound vision configuration degrades to detection plus manual remediation without fabricated MathML.
Release reruns isolate publication receipts by workflow attempt while retaining the exact seven-file SBOM, signed-tag, dependency-audit, reproducibility, and coordinated image/package/release gates.

Drain active work and pause remediation intake. Back up PostgreSQL and verify the restore path before changing images or schema.
Run alembic upgrade head explicitly and confirm the repository has one head: 20260825_canvas_queue.
Set REMEDIATION_EXECUTION_TIMEOUT_SECONDS and REMEDIATION_TERMINATION_GRACE_SECONDS for the deployment. Defaults are 1,800 seconds and 10 seconds. A hard timeout is terminal and is not retried automatically.
Deploy API and worker from the same 0.9.6 release. Confirm API health, a fresh worker heartbeat, queue age, and failed/quarantined rows before resuming intake.
Image-derived equations remain ai_vision, confidence 0.55, and needs_review=true. Recognition alone never approves or publishes an artifact; persist human acceptance and allow the worker to revalidate it at consumption time.
Preserve every v0.9.5 operator action in CHANGELOG.md, including review and deliberate resubmission of any pre-v0.9.5 quarantined work.

Each included feature PR passed the backend, lint, dependency-security, CLI, dashboard, deterministic Chromium, linux/amd64 Docker, and linux/arm64 Docker checks at its reviewed head.
Publication remains blocked until the exact merged release commit passes the same CI gates and the signed tag satisfies every protected release workflow receipt, signature, SBOM, audit, and reproducibility check.
This checked-in body is consumed verbatim by .github/workflows/release.yml.