0.1.10

• Updated the immutable tool-cache action to signed v1.0.1, retaining each
  verified fetch event in the ephemeral runner diagnostic bundle for durable
  OpenObserve evidence after teardown.

0.1.8

• Added a trusted default-branch Dependabot catalog synchronizer. Failed
  same-repository Dependabot action bumps are updated in place from a
  workflow_run job that never executes candidate code; hardening and
  Scorecard validators now derive action identities from the catalog instead
  of carrying additional hardcoded SHA copies.
• Made the synchronizer update the exact bound pull request through GitHub's
  native branch API, approve only action_required runs for its exact derived
  SHA, and keep candidate trees data-only. Transitive Docker-action image
  declarations now converge with action pin updates as well.
• Added the machine-enforced cache trust contract v2: provider ref scopes,
  exact-first key dimensions, persistent-runner residue rules, retention and
  rate limits, hosted/fleet equivalence, and real cold/warm telemetry.
• Added successful runtime harnesses for the real cargo-fuzz and
  ClusterFuzzLite reusable workflows, including a complete C++ libFuzzer
  builder integration and fail-closed evidence aggregation.
• Isolated owner-only side-effect runtime fixtures from Dependabot pull
  requests so real bot commits and repository labels are never mistaken for
  disposable commitlint or label-mutation evidence.
• Made release-ledger date reconciliation timezone-independent by deriving the
  tagged commit's UTC author date. The signed 0.1.7 tag remains immutable
  rejected evidence and has no release.

0.1.6

• Added explicit Dependabot-safe advanced CodeQL routing. Ordinary private
  analysis and Dependabot pull requests can use separate reviewed runner
  classes while preserving stable language check identities and a secretless
  pull_request trust boundary.
• Added validated opt-in dependency cache inputs to python-ci.yml pip callers
  and node-ci.yml npm/pnpm/Yarn callers. Cache backends must match the package
  manager and dependency paths cannot be supplied without enabling a cache.
• Treat OSV Scanner's exact No package sources found result as a successful
  empty inventory while preserving failure for vulnerabilities and all other
  errors. The first MyAttention consolidation ring exposed this in an
  observability-schema repository with no package manager files.
• Fixed nddev-security-bundle.yml to supply all four evidence paths required
  by the shared scanner and upload the redacted one-day evidence bundle. The
  first public-product consumer ring exposed the missing OSV, Gitleaks and
  actionlint paths in real private PR jobs.

Changed

• Routed the consolidated private security bundle's pinned uv, actionlint,
  OSV-Scanner and gitleaks artifacts through the public immutable tool-cache
  action. Baked uv is reused without setup; GitHub-hosted and cache-miss jobs
  retain the same checksum-verified upstream fallback.
• Strengthened the consolidated private-free security bundle without adding a
  placement: actionlint logs plus Zizmor, OSV and fully redacted Gitleaks SARIF
  are always retained as a one-day artifact, including on aggregate failure.
• Completed the no-cancel invariant for queued work: every self-workflow and
  example now uses a run-id-unique concurrency group, because GitHub retains
  only one pending run in a shared group even when cancellation is false.
• Made preservation of started jobs a library invariant. All self-workflows and
  consumer examples now use cancel-in-progress: false; the executable
  workflow contract rejects future cancellation expressions, and the
  performance skills optimize duplicate work before execution instead of
  erasing in-flight evidence.
• Added opt-in preinstalled-toolchain paths to Go and Java CI. Immutable
  ephemeral runners verify exact baked Go/gofmt and Java/Maven commands and
  skip redundant setup-action downloads; hosted callers keep existing setup.
• Expanded python-ci.yml to an explicit uv-or-pip contract. Hosted callers
  receive the appropriate pinned setup action; immutable ephemeral callers may
  verify baked commands. pip fails closed without a project-owned install
  command instead of guessing dependency or lockfile policy.
• Expanded node-ci.yml from a Bun-only lane to a fail-closed npm, pnpm, Yarn
  and Bun contract. Hosted callers receive exact setup; immutable ephemeral
  callers can verify and reuse baked toolchains, avoiding repeated downloads.
  Empty install commands select each manager's frozen-lockfile default.

0.1.3

Fixed

• Granted the release caller the same read-only Actions scope required by its
  reusable promotion gate, and added a static transitive-permission check so a
  tag cannot fail during workflow startup before evidence verification.