InterLock 1.0.0-rc.13

Security

• A disabled source kept serving cached answers. Disabling or deleting a
  source removed it from the gateway's registry, but the MCP query handler
  consulted the cache before the registry, so any statement cached while the
  source was enabled was still answered afterwards; only new statements were
  refused. The handler now refuses an unknown source before the cache, an open
  PostgreSQL-wire session ends with 3D000 on its next message, and a registry
  reload clears the cache and connection pools of every source it stops
  loading. The admin console also clears a source's cache when it is edited,
  disabled or deleted, using the gateway's generation prefix: it had been
  advancing a counter under a default prefix no gateway read.

• The HTTP proxy ignored a source's cache strategy. It always used the
  gateway-wide strategy, so a source set to bypass was still cached over
  HTTP. It now resolves the source's own strategy, and a miss no longer falls
  through to the shared L2 cache.

Added

• A fresh install can be signed in to. With no admin yet, the console
  creates admin with the default password admin. That account reaches only
  the new change-password page until it sets a password of at least 12
  characters that is neither the default, its username nor the current one;
  HTML is redirected there, htmx gets HX-Redirect, and API calls answer 403
  password_change_required. INTERLOCK_ADMIN__BOOTSTRAP_PASSWORD still
  chooses the first password, and is not forced to change. Previously the
  quick start produced no login at all unless that variable was set.

• Admins can change their own password at /auth/change-password, linked
  from the sidebar. The change is throttled, audited as password.change
  (fail-closed), and revokes every other session of that admin: migration 019
  makes a password change bump authorization_version.

Fixed

• The quick start works as written: docker compose up needs no
  config.yaml, the admin console keeps a stable signing key across restarts,
  and every published port binds to 127.0.0.1. The unused 8080 mapping is
  gone.

• The Helm chart's default image is the chart's own appVersion instead of a
  hardcoded 1.0.0-rc.1, and the chart names its home, sources and
  maintainers.

• The Salesforce and Google Workspace client libraries (Apache-2.0) are in the
  published image, so those connectors no longer fail on a missing import.

• Install hints name the real package (interlock-runtime[pii],
  interlock-runtime[otel]), OpenTelemetry reports the running version, and
  CI measures coverage of interlock rather than the pre-rename namespace.

Documentation

• The documentation is a developer guide. It is now a Starlight site in
  docs-site/, organised as Get started, Concepts, Guides, Reference,
  Operations and Project. The quick start runs a sample database with
  docker compose --profile quickstart up and reaches a governed, redacted,
  audited query in a few steps, all verified against a fresh install. The
  reference for configuration, the admin API and its roles, MCP tools,
  connectors, role conditions, feature status and make targets is generated
  from the code and checked for staleness in CI. Contracts and runbooks moved
  into the site unchanged in substance and remain normative; the old docs/
  paths are mapped in docs/README.md. The README is a short introduction.

• Corrected while rewriting: a Vault reference is vault://path/key (the
  setup guide showed a #key form the resolver never read); the policy
  classifications condition is documented as matching no agent traffic today;
  adding admin accounts beyond the first needs SQL, now documented.

• Corrected claims the code does not back: policy redact_columns is applied
  to MCP and HTTP responses but not on the PostgreSQL wire, where only the PII
  scanner redacts; S3 and Spaces have no reachable governed write in V1; GitHub
  is active by default but its governance is not exercised by any test stack.
  The README's ports, admin roles, psql usage, extras and layout match the
  code.

• NOTICE describes the published image as it is: permissive licenses plus
  LGPL-3.0 (PyGithub, python-gitlab) and MPL-2.0 (certifi, tqdm, orjson), and
  the vendored htmx (BSD-2-Clause) and fonts (OFL). make license-report
  installs exactly what the image installs, writes a per-package inventory,
  and fails on any license outside that position.

• This changelog is split into one section per release candidate.

• SECURITY.md names a private contact, security@contextdata.ai, alongside
  GitHub private vulnerability reporting, with response times and supported
  versions. Issue creation links to it.