v0.37.0

Security

• HTTP ledger transport now redacts. KorgLedgerClient.record_tool_call previously enqueued the event body without redact() — a tool call's args/result with a secret could reach the blob store + remote ledger unredacted. Centralized in a shared _build_body(); gap closed. (Local-journal + bridge already redacted.)
• CodeAct python actions enforce egress redaction (was recorded but the unredacted args were dispatched).

Added

• InMemoryLedgerClient — chain-faithful, file-free ledger client: record → verify_chain/verify_dag with no I/O. Byte-identical to LocalJournalClient (conformance-tested).

Changed

• One tool_gate pipeline. The gate sequence (workspace → guardrail → command-guard → egress → plan-mode → edit-policy → PreToolUse hook) — copy-pasted across three call sites — is now a single pipeline behind one evaluate(call, ctx) -> GateOutcome interface; ~430 lines and six methods out of agent.py.
• Centralized event-body construction in _build_body() across HTTP/local/in-memory clients.

Verifiable core proven byte-identical against the frozen korg-ledger@v1 conformance vectors.