1.4.0

File Gate 1.4.0

Security and product gap-closure for high-assurance gated downloads.

Security

• Step-up open redirect closed (#40) — field step_up_login_url only
• OTP HMAC uses authenticated secrets (#39) including dual-key previous
• Download denial flood limits
• Token revoke field-scope fail-closed; signed_url jti revoke
• Dual-key secret rotation (docs/SECRET_ROTATION.md)

Added

• Soft optional audit_chain integration (docs/AUDIT.md)
• Mint-time OIDC (A2) (#36)
• Forced identity mint (global + per-field)
• Multi-field mint pin + strictest-wins redeem
• WebAuthn enrollment UI (#38)
• Authenticated method role allowlist
• Docs: E2E (#37), PLAN, KEYCLOAK-UNIFIED-AUTH

See CHANGELOG.md for full notes.