v5.2.0

5.2.0 (2026-09-03)

Features

• add host-side appliance seat launcher for kiosk lifecycle (#860) (c0854bf)
• add in-appliance participant workbench (#835) (4a188b9)
• add pack backend interaction seam (#927) (ebb4db2)
• add safe experimental parameter binding (#857) (2726603)
• add versioned disposable lab appliance (#840) (f71a72e)
• define bounded participant lab profile (#836) (621b4cb)
• enforce appliance network boundary (#838) (f7d343f)
• evidence: add portable research evidence bundle export (EXP-008) (#873) (a6322b3)
• honest per-dimension runtime readback for dynamic composition (#876) (#893) (3db5171)
• qualify bounded RAES participant agency (#855) (19014ac)
• raes: declare Cortex index as ADR-088 initial service state, native materializer + readback (#889) (#911) (aaf9235)
• record run-scoped apparatus and detection-content provenance (#871) (ca648f1)
• rename ACES to RAES and migrate to the raes 1.1.0 distribution (#846) (ced66dc)
• scenario: declare TechVault content in the SDL via the env-pack (#875) (#908) (4dcf07b)
• scenario: realization contract for TechVault, scenario-verification plugin seam, and standup fixes (#866) (#890) (7b21cdb)
• seal ACES run and evidence records for terminal execution attempts (#872) (1f6d17e)

Bug Fixes

• adopt OpenSSF Scorecard and remediate the supply-chain findings it reported (#850) (20ed98f)
• bind explicit models to installed participants (#865) (e2b8241)
• ci: allow exact dev promotion titles (#941) (95b16d5)
• clear appliance boundary quality gate (#839) (5a6c113)
• complete participant workbench integration (#837) (583e100)
• harden lab lifecycle recovery (#933) (fece8b2)
• make participant credential sourcing explicit (#928) (96302e4)
• preserve bounded participant execution semantics (#861) (0f0d8ee)
• quality: resolve SonarCloud new-code findings blocking the dev gate (#938) (8689d02)

Documentation

• add Ground Control requirement specs as repo-local files (#904) (9320c7a)
• cross-reference the OpenRAE env-pack companion repo (#926) (15dead9)
• name the scenario language in full in the readme (#844) (0b3c61c)
• sync branch-protection baseline with live required checks (#854) (8280f20)