v3.20.0

Added

• Deployment latency SLO qualification. director-ai latency-slo now drives
  the live /v1/review endpoint at a declared request count and concurrency,
  records p95 latency and error rate in a secret-safe integrity packet, and
  exits non-zero when the deployment misses its declared operating point. The
  gate is explicitly deployment- and workload-specific; it does not turn one
  passing host into a universal latency claim.

• Fail-closed EU AI Act Annex IV template. The compliance surface can emit
  a structured technical-documentation template whose mandatory evidence
  fields block completion until populated, including system purpose, risk
  controls, evaluation, monitoring, cybersecurity, and change history.

• Reusable remote benchmark dependencies. The remote benchmark launcher
  accepts validated PEP 508 requirements through repeatable --remote-deps
  options and safely quotes them for installation. The implementation is now
  the neutral run_remote_benchmark_gpu.py; the historical audit-specific path
  remains only as a deprecated, provenance-preserving reproduction shim.

• RFC 3161 external timestamp anchoring for the compliance audit chain
  (KIMI3-anchoring). The tamper-evident audit hash chain
  (compliance/audit_log.py) proves nobody altered a row without the HMAC
  secret, but not existence-at-time — the keyholder could rebuild it with
  back-dated timestamps. The new compliance/timestamp_anchor.py closes that
  gap: it obtains an RFC 3161 timestamp token from a Timestamp Authority over the
  current chain head (which, through the prev_hash linkage, commits to the whole
  prior history), verifies the token (message-imprint binding, the content-type
  and message-digest signed attributes, and the CMS signature over the signed
  attributes against the embedded certificate — RSA or ECDSA), and stores it in an
  audit_anchor table. Verification has two tiers: by default internal-consistency
  only (TSA-token-anchored); when trusted TSA roots are configured
  (audit_anchor_tsa_roots, director-ai compliance verify-anchors --tsa-roots)
  the signing certificate must also chain to a pinned root — validated at
  genTime, with a sole critical time-stamping EKU on the leaf and RFC 5280 CA
  constraints (basicConstraints CA=True, keyCertSign, pathLen) enforced on every
  attacker-supplied intermediate — which is trusted-TSA-attested and completes
  back-dating resistance. AuditLog.current_head() exposes the head; the
  director-ai compliance anchor / verify-anchors commands drive it. Opt-in
  (audit_anchor_enabled, default off; audit_anchor_tsa_url,
  audit_anchor_timeout_s) and offline-graceful — a down or unreachable TSA
  yields a logged warning, never breaking the audit path. Needs the crypto
  extra (adds asn1crypto); the import is lazy so the free/core surface never
  pulls it. Publishing to a public transparency log (Rekor) is deliberately out
  of scope. BUSL-1.1 (paid compliance tier).

Changed

• Public pricing and package documentation now follows the canonical annual
  plans: Pro at CHF or USD 490/year, Full at CHF or USD 980/year, and
  Director-Class AI under a separately scoped commercial order. The two active
  Polar checkout links were verified live before being recorded.
• EU compliance references now cite the final Digital Omnibus instrument rather
  than proposal-stage material.
• Release dependency hygiene replaces yanked build 1.5.1 with stable 1.5.0
  and advances the independent hash-pinned SAST stack to Semgrep 1.171.0.

Fixed

• Tag-driven releases now dispatch the Core, Lite, and paid publish workflows
  when RELEASE_PAT is absent, preserving each workflow's own trusted-publisher
  identity and preventing duplicate dispatch when the PAT-driven event chain is
  available. Missing or mismatched release tags fail closed with a clear error.
• Trusted RFC 3161 verification now selects the CMS signer by signer identifier
  and enforces RFC 5280 CA constraints, key-cert-sign usage, path length, and a
  sole critical time-stamping EKU across the supplied chain.
• docs/internal/ is guarded as forever-private repository state so internal
  planning and review material cannot enter public release history.