v0.32.0

Breaking changes

• zotio-mcp --allow-unauthenticated refuses an address other hosts can reach. With --transport http, unauthenticated serving on 0.0.0.0, :PORT or any non-loopback address now exits 2 before it listens; before, it only printed a warning and served read and write tools to the network. Loopback binds (including localhost. and zoned IPv6 such as [::1%lo0]) are unchanged. To serve other hosts, keep the bearer token (ZOTIO_MCP_TOKEN or --mcp-auth-token-file); a reverse proxy can send it.
• tail --workflow advances its cursor when the workflow fails. Events are delivered once; the events the workflow still owes are recorded next to the local database (<db>.tail-trigger-*.json, one per API source and workflow spec), and only the workflow is retried on the next poll. A script that restarted tail to get a failed window delivered again no longer gets it, and the held-retry stderr line has new text.

Changelog

Fixes

• 5d06c33: fix(mcp): accept zoned IPv6 and rooted localhost as loopback binds (@enieuwy)
• 3c70519: fix(mcp): refuse --allow-unauthenticated on an off-host address (@enieuwy)
• 76ee71c: fix(tail): key owed workflow triggers by source and database identity (@enieuwy)
• 1e260e1: fix(tail): retry a failed workflow trigger alone and repair torn delivery lines (@enieuwy)

Documentation

• 8c0d4f7: docs(roadmap): align the remaining stored-upload lines with what shipped (@enieuwy)
• bf60891: docs(roadmap): mark stored upload and scope intersection as shipped (@enieuwy)

Build & CI

• 78bab98: chore(release): cut 0.32.0 (@enieuwy)
• e85d7e2: chore(rules): let a release tag be created after the gates, keep recovery guards (@enieuwy)
• 40079ef: ci(vuln): run govulncheck on the release toolchain (@enieuwy)

---

Curated history: CHANGELOG.md · Install: brew install orgmentem/tap/zotio