v0.7.2 — COSE_Sign1 receipts, MCP Gateway shim, Scalar API Explorer

What's Changed

• fix(demo): add API health check and online/offline status badge by @aevum-labs in #157
• feat(demo): consolidate frontend + API into single Fly.io app by @aevum-labs in #158
• fix(demo): WCAG AA color-contrast violations in Stepper nav by @aevum-labs in #159
• fix(demo): ScalarExplorer "Document could not be loaded" — same-origin URL fallback by @aevum-labs in #160
• feat(demo): match Scalar API explorer to Aevum visual theme by @aevum-labs in #161
• docs: quality pass — changelog v0.7.1, CLI reference, glossary, demo health URL by @aevum-labs in #162
• fix: update version labels, adapter table, and demo API version to v0.7.1 by @aevum-labs in #163
• docs(aevum-core): annotation pass — Tier 1 black-box core by @aevum-labs in #164
• fix(aevum-mcp): fastmcp>=3.2.0,<4 + suppress false-positive major-bump alerts by @aevum-labs in #169
• feat: serve React app from Fly.io; mobile API Explorer; payload scrub; warm machine by @aevum-labs in #170
• fix: add persistent volume mount for sigchain SQLite by @aevum-labs in #171
• fix: add Dockerfile and demo/** to deploy-api.yml trigger paths by @aevum-labs in #172
• fix: force clean Docker rebuild; ensure React SPA served by @aevum-labs in #173
• fix: force no-cache Docker build to ensure React app is built by @aevum-labs in #174
• fix: tab bar visible on Firefox Android by @aevum-labs in #175
• fix: restore Sigchain, Compliance, OWASP, Docs tabs + Android nav fix by @aevum-labs in #176
• fix(a11y): WCAG AA contrast on active tab; intro-strip as landmark by @aevum-labs in #177
• feat(demo): implement SignchainExplorer, ComplianceReport, OWASPCrosswalk by @aevum-labs in #178
• fix: add Production/Isolated Session badges to sigchain and sandbox views by @aevum-labs in #179
• fix(a11y): WCAG AA contrast for Isolated Session badge by @aevum-labs in #180
• feat: maintenance ingest endpoint + workflow hook by @aevum-labs in #181
• fix: sigchain/recent reads from engine ledger (same store as ingest) by @aevum-labs in #182
• feat(demo): chain verification visual + Sigchain→Compliance deep-link by @aevum-labs in #183
• fix(ci): harden smoke-test against transient errors and step hard-failures by @aevum-labs in #184
• fix(ci): create demo-outage label before gh issue create by @aevum-labs in #185
• fix(ci): smoke-test full hardening — retries, response logging, cold-start handling by @aevum-labs in #187
• fix(demo): use Fly-Client-IP for rate limiting behind Fly.io proxy by @aevum-labs in #188
• fix(ci): point smoke test at aevum-demo.fly.dev (stale HF Space was returning 405) by @aevum-labs in #189
• fix: restore ingest URL to demo.aevum.build; remove HF Space frontmatter by @aevum-labs in #190
• feat: session labels + payload summary in public sigchain entries by @aevum-labs in #191
• fix: session label date format compatible with macOS by @aevum-labs in #192
• fix: chain verification field compatibility (entry_hash vs audit_id) by @aevum-labs in #193
• fix: port sandbox routes from demo/main.py to aevum-maintainer by @aevum-labs in #194
• fix: resolve TS2345 in ComplianceReport (SignedEntry → Record<string, unknown>) by @aevum-labs in #195
• fix: compliance report TS2345 + chain verification hash mismatch by @aevum-labs in #196
• fix: monthly-maintenance DEP_COUNT bash arithmetic error by @aevum-labs in #198
• fix: resolve TS2345 in ComplianceReport — use SignedEntry intersectio… by @aevum-labs in #199
• fix: sigchain entry 404 + persist maintenance entries across deploys by @aevum-labs in #200
• feat(demo): surface replay endpoint in Compliance tab by @aevum-labs in #201
• fix: collapse chain views, add payload summary to replay, fix sandbox reset by @aevum-labs in #202
• fix: upgrade pip to 26.1.2 to resolve PYSEC-2026-196 by @aevum-labs in #203
• feat(adk): AevumADKPlugin — governance adapter for Google ADK by @aevum-labs in #204
• feat(maf): pin [maf] extra to agent-framework-core and drop prerelease flag by @aevum-labs in #205
• feat: diverse sigchain event types across 4 workflows by @aevum-labs in #206
• feat(cli): add aevum receipt command and file-based verify mode by @aevum-labs in #207
• fix(otel): dual-emit gen_ai.provider.name + gen_ai.system; update ingest allowlist by @aevum-labs in #208
• docs: update EU AI Act deadline and Colorado AI Act bill reference by @aevum-labs in #209
• fix: bump PyJWT to >=2.13.0; pip-audit clean by @aevum-labs in #210
• docs: OpenAI Agents and MCP integration guides with tested examples by @aevum-labs in #211
• fix: pin cedarpy~=4.8.0; record conformance 11/11 by @aevum-labs in #212
• feat(publish): COSE_Sign1 receipt format with Ed25519 + RFC 3161 TST (Session 1A) by @aevum-labs in #213
• fix(demo): API Explorer button opens Scalar in new tab at correct URL by @aevum-labs in #214
• feat(mcp): Docker MCP Gateway interceptor shim + deployment docs by @aevum-labs in #215
• fix(demo): mount Scalar UI in FastAPI before SPA catch-all by @aevum-labs in #216
• release: v0.7.2 by @aevum-labs in #217
• fix: Beta classifier + README maintainer line before v0.7.2 tag by @aevum-labs in #218

Full Changelog: v0.7.1...v0.7.2