v0.9.1

A full-repository review, and the corrections it earned. The course now says what the code does, the learner gate installs what it needs, and eight checks that could not fail can fail again.

🐛 Bug Fixes

• (tooling) Install ripgrep in the learner tier, which check:core required and no install step supplied
• (agent) Mask the uncovered tail of a staggered PII span instead of forwarding it to the model
• (agent) Honor the per-tool deadline in the filesystem-backed reads, and say what it cannot preempt
• (evals) Score a declined confirmation as a failed case instead of aborting the run and discarding its evidence
• (evals) Keep the stochastic judge out of the verdict a field named deterministic_pass reports
• (observability) Plot the error ratio the alert actually tests, instead of one floored at a rate no lab reaches
• (docs) Credit the course rather than the theme in the footer of every published page
• (ci) Stop Dependabot opening pull requests the compatibility holds are designed to reject
• (ci) Build the loopback relay the host gateway needs, so the evidence run reaches its first model call
• (ci) Capture the Ollama version as one line, which $GITHUB_ENV rejected as two and which killed the evidence run
• (gateway) Admit the judge's chat-completions shape on the governed model route, which .env.example already told readers to use

🔒 Gates

• (tools) Close the fence-length hole that disabled a page's remaining prose checks after a nested block
• (tools) Compare the doctor tiers against the arrays the script declares, and report a name it no longer has
• (tools) Read both workflow extensions, walk the corpus that exists, and grade retention per upload step
• (tools) Validate the routes the site serves today, not only the addresses it retired
• (evals) Refuse to let a truncated run report itself as a passing one

📚 Documentation

• Replace the coverage-floor rationale with the true one in all six places that stated it
• Record that the site is published from this repository, and that its slugs are now frozen
• Correct the surfaces that cannot complete a guarded write, and name the one that can
• State the platform support tiers and the unverified Kubernetes path where the path is chosen
• Give every Agent Skill a source and an install command

---

Evidence boundary for this release

README.md states the release story as "a workflow-dispatch run uploads results.json, and a human reads it before tagging." That run did not produce evidence for this tag, and this release does not carry a results.json.

Three hosted dispatches at this candidate were attempted. Each hit a different pre-existing defect in the evidence path, three of which are fixed above:

1. tools/bin/loopback-relay was never built — eval.yml installs only evals/, and the guard's remedy only reaches the tools build from the repository root. Fixed.
2. ollama --version wrote a multi-line value into $GITHUB_ENV. Fixed.
3. The judge speaks /v1/chat/completions while the governed model route declared only /v1/responses. Fixed.
4. The PII guard's detector needs 26–44 seconds warm on a CPU host against a 9-second ceiling, so it fails closed and redacts every model response. Open — #154.

The fourth is still open because closing it is a design decision about detector quality, latency, and what 5.5. Gateway Security promises, not a repair. The measurements are in that issue.

So the deterministic gates behind this tag are complete — format, check, all three test suites with both 80% coverage floors, the docs build, eval:validate, the red-team suite, browser accessibility, gitleaks and Trivy — and the model-backed judgment is outstanding. #148 tracks it and records why it was never obtainable on the Go stack before now.

Stating the gap rather than leaving it silent is the standard 0.2. Evidence sets for the course; it applies to the course's own releases too.