0.3.0

Stateful offline contracts now verify JSON fields, captured IDs, synthetic fixtures and file checksums against pinned previous CLI builds. New no-leak checks scan process/MCP diagnostics and selected text artifacts without exposing matching values. Installed cli-testing bin symlinks and malformed-input diagnostics are fixed. Release run 38097062035 passed all validation and published the exact checked artifact to npm; the attached tarball matches npm integrity. CLI adoption remains full-validation-only. See docs/ci/UPGRADES.md and docs/ci/TIMINGS.md for coverage, compatibility boundaries and approximate costs.

0.1.0

Fixed

• Agent fixtures support private dialogs with different addresses and message IDs per account.
  Set the sender's dialog and enable per-account IDs in the private cast; each case needs a unique
  synthetic label to prove receipt and cleanup on the owner's side.

Added

• Security and agent commands create private run folders. security scan, security socket and
  agent wrap the existing scripts, record pins and exit codes, and leave crashes incomplete. Agent
  runs require an explicit live flag, caller-owned configuration, and a passing blocked-write canary.

• Run comparison distinguishes new, fixed and returning scanner observations. Carry history with
  --previous; legacy scanner runs are read without edits. Transcript redactions support file snapshots.

• The suite groups — SUITE_GROUPS: security, contract, performance, ux, analyzers, live, seed.

• The security audit, written down to repeat — docs/security/ (method, runbook, agent test,
  reviewer prompts, lessons) and the scripts it uses: scripts/security/scan,
  scripts/security/socket, scripts/agent/run-agent, scripts/agent/run-payload.

Changed — may break callers

• The project is now licensed under Apache License 2.0. See LICENSE for the terms.

CLI contract toolkit 0.2.0 (preview)

Validated offline contract toolkit for repository CI. This is the exact package artifact checked by release run 38092344081; SHA256: 996d49ca2d7336ea82dbdb2862d257fd5cafe73aa53da6e497834aeef35f14e5. npm publication remains pending trusted-publisher configuration. Consumers pin this release asset and its lockfile integrity.