LaneKeep v1.0.5

What's Changed

Budget & Governance

• Per-task budget scope (#50) — third scope alongside per-session and cumulative; opt-in via LANEKEEP_TASK_ID, resets per claude -p invocation. Backs cron preflight daily-allowance gating for autonomous loop runners.
• MCP inventory policy (#49) — declared-set + count ceiling for MCP tools.
• Halt signal + cumulative_halted trace field (#34, #35, #36) — when a cumulative cap trips, a sibling halted.json lets loop runners decide whether to spawn the next iteration.
• lanekeep clear-halt CLI (#44) — drop halt marker and reset counters (TD-017).
• Pricing: added claude-opus-4-7, corrected sonnet-4-5 snapshot; opus-4-7 mapped to 1M context window (#8, #10).

Trace, Correlation, Privacy

• Trace correlation fields (#46) — agent_team_id, story_id, epic_id (AG-007) for multi-agent fleet observability.
• Trace privacy redaction (#40) — <private> envelopes; *_KEY, *_TOKEN, *_SECRET, *_PASSWORD values redacted.

Agent Output & Config

• agent_hint field on deny/ask responses (#43, #48) — actionable hints in evaluator responses + authoring guidance.
• Canonical overrides{} block + extra_rules prepend (#41) — explicit precedence with loud warnings on shadowing.

New Evaluators (disabled by default)

• context-budget, session-patterns, multi-session (c1adc89) — with default config, module docs, settings panel controls, and bats coverage.
• Tier 2.1 write-then-execute hardening — exclude docs/data extensions; surface as INFO by default.

Default Rules — False-Positive Reduction

• Tightened 6 noisy rules to cut FP rate ~88% (#15, #6).
• governance_paths consolidated and extended to cover Read tool; substring-match issue fixed (#28).
• git branch -d allowed; -D still gated (git-009, #31).
• sys-088 env-var bypass pattern broadened to any LANEKEEP_* suffix (#33).
• rm -rf hard-block anchors fixed for remaining variants (#42, TD-016).

Signing & Plugins

• openssl missing warns instead of silently skipping (#45, TD-002).
• Plugin timeout default lowered (TD-014); plugins.* docs (#36).

UI & Dashboard

• Insights: evasion filter card + sidebar badge; tool-scope badge on policy cards (#20, #21, edbaee5, 713b050).
• Home Budget widget: input/output token rows.
• Save button enabled while typing numeric budget inputs (#7); thousands separators; unsaved-settings warning before navigation.
• Settings panel: controls for context-budget, session-patterns, multi-session evaluators.
• Fixes: notification controls greying (#11), recent-activity flicker (DOM diffing), home-page search includes rule.id (#24).

Translations (i18n)

• Added Hindi, Italian, Turkish, Arabic, Vietnamese READMEs.
• Translated READMEs relocated to translations/ folder.

Docs

• README hero sharpened; capabilities list always visible; Algorismo links above headline and in footer.
• agent_hint authoring guidance (#48); extra_rules prepend precedence (#47); halt signal documented (#35); REFERENCE.md Per-task limits table.

Tech Debt & CI

• Closed TD-002, TD-014, TD-015, TD-016, TD-017, TD-018.
• CI: skip on docs/specs/strategy-only changes; smoke job dropped; meta-repo dispatch gated on release tags (#38); Playwright browser cache; watchdog flake fix (#39).
• Co-located rule-behavior bats from meta-repo (#30).
• Dependabot bumps: actions/checkout → 7.0.0, create-github-app-token → 3.2.0.

Fixes

• Handler: JSON-encode redact response with control bytes (#17); SIGPIPE trap + listener resilience (#12).
• Pattern validator: don't flag bounded outer ? as ReDoS (#19, #29).
• Audit: register session_write_exec, harden net-000 regex (#26).
• Session-patterns refactor: removed Tier 2.6 (consolidated into action-chain governance).

Full Changelog: v1.0.4...v1.0.5