InterLock 1.0.0-rc.18

The first release built in the public repository. Its image and chart carry
GitHub build provenance attestations as well as cosign signatures; earlier
release candidates were built while the repository was private and are
cosign-signed only.

Security

• pymongo 4.18.2 (CVE-2026-88029, CVE-2026-96747, CVE-2026-96748,
  CVE-2026-96749) in the optional connectors-tier2 extra; the published
  image does not include it.
• fsspec 2026.9.0 (GHSA-27vj-qcqg-25rc: un-sandboxed Jinja rendering of
  Kerchunk reference documents) and multidict 6.9.1 (GHSA-54p9-h82j-f925:
  unbounded memory growth through the items-view operators), both transitive
  dependencies of the published image.

Fixed

• The console's "Identity created" page showed a PostgreSQL connection command
  that put the API key in the user name with no password, so psql prompted
  instead of connecting, and named localhost:5432, which is not where the
  Compose quick start publishes the gateway. It now passes the key as the
  password, with the gateway host and port left for you to fill in.

Documentation

• The README describes who InterLock is for, the problem it solves, how a
  request is decided, the tested agents, what InterLock stores, and its
  current operating boundaries.