v1.12.0

1.12.0 (2026-10-19)

Features

• 25-01: add pure L7 path collapse engine (classifier, template synthesis, gate, length cap) (bdd6b41)
• 25-01: add replace-mode L7 merge reconciliation (PolicyEvent.ReplaceL7HTTP, MergePolicyWithOptions) (04be558)
• 25-01: observe collapse paths in raw wire form (percent-encoding never decoded) (96f8e16)
• 25-01: reject --min-flows-per-l7-rule values below 1 (fail-closed gate validation) (0a4057f)
• 25-01: wire L7 path collapse end-to-end (aggregator whole-run state, pipeline, CLI flags) (8fb61c8)
• 25-02: commit pre-phase-25 byte-identity goldens (l7_http 1 policy, mixed_tcp_icmp server+client) (40cfe09)
• 25-02: wire collapse_l7_paths/min_flows_per_l7_rule through MCP session args (fail-closed gate validation, default resolution) (3eb7229)
• 26-01: implement NSAW-02 new-namespace replay report (5899380)
• 26-02: implement NSAW-01 namespace watcher (GREEN) (e852c5e)
• 26-02: implement watcher-precedence branch and NSAW-01 generate wiring (GREEN) (f5ff192)

Bug Fixes

• 26: mark research open questions resolved with pinned plan decisions (b410fbc)