v0.6.0

[0.6.0] - 2026-07-02

Bug Fixes

• Resolve registered scaffold/governance bugs + release v0.5.3 (#552–556)
• Resolve review findings across engine, guard, templates, and CI (#590)

Documentation

• Prep v0.6.0 release (migration note + README release line) (#591)

Features

• Backlog quality/security toolchain hardening + Rust support [PI-558, 559, 561-565]
• (PI-576) Add OpenSSF Scorecard as a scheduled CI job (#581)
• (PI-577) Scan built container images with Trivy (delivery=service) (#582)
• (PI-578) Lint the Dockerfile with hadolint (delivery=service) (#583)
• (PI-575) Add SLSA build provenance attestation to release artifacts (#584)
• (PI-574) Generate a CycloneDX SBOM in release, attach to Releases (#585)
• (PI-579) Add dependency license compliance scanning (#586)
• (PI-580) Wire up property-based testing / fuzzing per language (#587)
• Self-populating board metadata + upstream bug-routing skill (#588)

Miscellaneous Tasks

• Bump version to 0.6.0
• (PI-570) Raise per-language quality gates to their strictest practical ceiling (#571)
• (PI-569) Enforce a blocking test coverage threshold in CI (#572)
• (PI-568) Add dependency vulnerability (CVE/advisory) scanning to CI (#573)