v0.15.0

0.15.0 (2026-10-06)

Features

• agents: require human approval to accept licenses; prefer unencumbered tools (#163) (a4179ca)
• data: canonical security scanner registry + NIST mapping (#155) [MERGE FIRST] (#157) (058ad89)
• docs: frontmatter crosswalk to Dublin Core / schema.org + guard (#209) (#213) (8685971)
• generate: add generated repo-root llms.txt for agent navigation (#212) (#218) (f717345)
• generate: landscape summary/phase + ROADMAP metrics from source (#142) (#196) (aa9aa0c)
• generate: neutral document inventory from INDEX.yaml (#199) (#206) (c0d6ab4)
• generate: re-land framework registry + NCCoE casing fix (#198) (#223) (1ba74f8)
• generate: re-land TRACEABILITY control matrix from frontmatter + NIST OSCAL (#197) (#221) (60313c0)
• meta: add CITATION.cff; stop calling the repo's own content 'guidance' (#214) (#219) (46ac233)
• validator: enforce doc freshness — optional stale_after + staleness check (#210) (#216) (042ad32)
• validator: guard prose count-drift + generate landscape/control counts (#184) (#188) (010c41f)
• validator: guard SECURITY-CONTROLS.md control-count integrity (#121) (#170) (44e0001)

Bug Fixes

• ci: bump js-yaml override to 4.3.1 in linters (CVE-2026-59870) (#194) (2e77ad8)
• ci: bump js-yaml to 4.3.2 to clear a high-severity CPU-DoS advisory (#290) (e6d2968)
• ci: bump smol-toml to 1.7.1 to clear an infinite-loop DoS advisory (#291) (e557daf)
• ci: pin markdownlint-cli2 once, clear GHSA-253c, align the ruff rev (#296) (bf88af6)
• ci: promote pre-deploy to gating via per-line self-scan marker (#263) (#272) (cdf4653)
• ci: repair Link Check — OWASP agentic URL + relative-path/403 config (#220) (6fd93d7)
• ci: replace markdownlint-cli2 with markdownlint-cli (#304) (7d0f4b3)
• config: enforce mandated size/complexity limits; drop vestigial FRAMEWORK_VERSIONS (#261) (#274) (d5ba978)
• contract: copied probe recognizes inline flow-mapping frontmatter (#154) (#190) (f162a9d)
• contract: fail closed when the provisioned contract isn't the universal one (#262) (a726bdb)
• contract: reconcile contract version to 1.0.0 + guard against drift (#191) (#192) (bd940a3)
• deps: commit uv.lock + require lock files to be git-tracked, not just present (#271) (0daa0da)
• deps: resolve npm audit highs in CI linter deps (#164) (1be25ec)
• docs: correct automation self-docs + guard contract-probe drift (#250, #251) (#275) (45f3a80)
• generate: generate AGENTS.md nist_controls from body citations (#238) (#277) (d6d1045)
• generate: generate PLAYBOOK skill table + fill em-dash word-counts (#254, #256) (#276) (9bca89a)
• landscape: make FEDERAL-AI-LANDSCAPE.md freshness date evergreen from the registry (#142) (#229) (cd75062)
• landscape: scope Federal Register query + source-aware relevance gate (#182) (#195) (cae911f)
• new-project: catch backtick dangling refs + exclude playbook-doc navigators (#189) (#201) (89b9f4a)
• skills: add symlink fallback resolution for playbook-source refs (#287) (94be9b9)
• validators: correct validate-adrs dir + dependency-pin regex; wire validators into CI (#264) (1e18d2d)
• validators: enforce frontmatter enums, single-source exclusions, close staleness gap (#270) (b7de498)

Documentation

• a11y: add Section 508 accessibility statement + document md-hygiene (#211) (#224) (a250360)
• add SUPPORT.md and emphasize federal community (#178) (#187) (e43f8ef)
• agents: add Durable-References guidance (ephemeral refs vs NIST tags) (#280) (7f3bece)
• backend: make sandbox references backend-agnostic (acq wrapper, not sbx-only) (#217) (380cad3)
• codeowners: make the security-sensitive review claim honest (#269) (1f0b8a5)
• de-drift stale version/count stamps + restore orphaned §14.2 heading (#265) (2788e37)
• frontmatter is a convention (not a standard) + MCP crosswalk column (#215) (#225) (fe33e5a)
• public-readiness governance files + scope reframe (#185) (78cb5ba)
• remove internal Slack references for public readiness (#176) (#186) (94fdf42)

Maintenance

• ci: automate pre-commit rev updates, guard the ruff dual-pin (#297) (0c88615)
• deps: bump actions/checkout from 7.0.0 to 7.0.1 (#166) (b16b104)
• deps: bump actions/setup-python from 6.3.0 to 7.0.0 (#167) (cf65a76)
• deps: bump feedparser from 6.0.12 to 6.0.14 (#205) (023586a)
• deps: bump https://github.com/astral-sh/ruff-pre-commit from v0.16.8 to 0.16.9 (#301) (17b60c0)
• deps: bump pre-commit from 4.6.0 to 4.6.1 (#172) (8e22797)
• deps: bump pre-commit from 4.6.1 to 4.6.2 (#279) (89891bd)
• deps: bump ruff from 0.15.21 to 0.15.22 (#169) (0b9142a)
• deps: bump ruff from 0.15.22 to 0.16.0 (#173) (69d3bc2)
• deps: bump ruff from 0.16.0 to 0.16.1 (#204) (2512c33)
• deps: bump ruff from 0.16.1 to 0.16.2 (#230) (dbc6ca9)
• deps: bump ruff from 0.16.2 to 0.16.3 (#278) (4095253)
• deps: bump ruff from 0.16.3 to 0.16.7 (#294) (d05c036)
• deps: bump ruff from 0.16.7 to 0.16.8 (#295) (1e44d51)
• deps: bump ruff from 0.16.8 to 0.16.9 (#300) (b07a4fd)
• deps: bump tcort/github-action-markdown-link-check (#203) (3267760)
• deps: bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#168) (e73018d)
• deps: bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#171) (07ce3ce)
• deps: bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#202) (1147e4a)
• deps: bump zizmorcore/zizmor-action from 0.6.2 to 0.6.4 (#293) (b47f40b)
• landscape: review federal AI registry — no new governance docs (2026-08-04) (#181) (b5e95cc)

CI/CD

• check only changed markdown links on PRs (#283) (9ea8add)