PermitProbe v0.3.0

PermitProbe v0.3.0 release notes

PermitProbe v0.3.0 adds deterministic replay for completed exploration work and checks alternate
API, edge and storage read paths against the same private-object boundary as their source route.

Sanitized deterministic replay

permitprobe replay-create converts a completed exploration report into a private manifest that
contains only the target-bound policy digest, source-report digest and normalized case IDs. It
stores no URLs, credentials, headers, response bodies or provider prose.

permitprobe replay reruns the exact deterministic baseline and completed exploration cases. It
does not invoke an exploration provider, revalidates every ID against the current policy catalogue,
keeps the GET-only zero-write boundary and fails closed when the policy, target, source report or
case catalogue differs.

Linked read boundaries

A linked_resources contract binds an alternate object path to a protected source resource.
Anonymous mode probes the pinned route without credentials after the source API establishes each
seeded object. Any forbidden 2xx becomes linked.public_access; a denial passes only with a valid
source-object control.

For a second route on the exact normalized primary origin, authentication: "source_subjects"
mirrors the source resource's complete anonymous and authenticated caller/owner matrix. PermitProbe
forwards each subject's bearer token or Cookie header only after same-origin validation at policy
load and again immediately before delivery. Cross-origin linked reads never receive credentials.

Every linked request uses a new proxy-free client, follows no redirects, reuses no response cookie
and closes after response headers without consuming the body. Linked findings participate in
one-shot scans, baselines and deterministic finding retests.

Fail-closed retests and compatibility

An authenticated linked finding retest reruns the relevant source controls and linked allow
controls before it can declare a violation fixed. A route that starts denying every request remains
inconclusive, and the complete retest plan is checked against max_cases before any request.

The policy format remains version 1 and the report schema remains version 2. Existing v0.2.1
policies remain valid because replay and linked reads are opt-in. Anonymous linked cases use stable
policy digests, evidence IDs, targets and report metadata for deterministic baselines and retests.
Scan reports expose both aggregate credential forwarding and explicit same-origin/cross-origin
scope fields.

Linked checks make status-level access decisions. They do not inspect the linked response body,
prove the returned object's identity, validate signed-token cryptography, enumerate storage, use a
storage service credential or show that two same-origin routes share one deployment revision.