v0.0.24 — Operate-&-Maintain + autonomy-safety + 11 capability quick-wins

Ironclad becomes safe to run unattended: observable, recoverable, and with real autonomy-safety primitives. 22 capabilities across three areas — every new feature is default-off and byte-identical when off.

Operate & Maintain (run it unattended)

• Runtime telemetry — GET /metrics: rolling latency / error-rate / token-cost + SLO verdict + anomaly signal.
• Backup & restore for the memory tiers (Qdrant/Neo4j/Valkey) + engine state, with retention + a runbook.
• Operate scheduler — one cron entry fans out to periodic jobs (backup, prune, …).
• Behavioral post-deploy verify → auto-rollback to the last-good build on failure.
• Alerting pipeline — SLO/anomaly rules → outbound webhook page + inbound POST /alert receiver.

Autonomy-safety (safe without a human watching)

• Ambiguity auto-detector — no-guessing becomes a pre-flight gate.
• Learned-state safety — snapshot + eval-gated ACE promotion + auto-revert of a measured regression.
• Full tamper-evident audit log — who/what/when/why across the tool surface + audit-dir tamper-resistance.
• Ingestion prompt-injection defense (ADR-0012), OS exec sandbox (ADR-0013), RBAC + multi-tenant foundation (ADR-0014).

New tools & capabilities

create_issue · fetch_url (SSRF-guarded) · edit_file · remember · a feature-spec/PRD prompt · dependabot + a dependency-audit CI · log & run-artifact retention · /ace snapshot|rollback|unlearn.

Full detail in the CHANGELOG. Every security-sensitive feature ships an ADR with explicit remaining scope.