v0.99.11

Security

• Grade a release receipt by verification rather than by the mere presence of
  evidence. A hub-broadcast receipt built from a release frame's caller-supplied
  evidence is now unverified, never supported, so a forged release can no
  longer launder fabricated evidence — a fake digest, a "ci: green" line, an
  invented approver — into a supported verdict the hub relays as trust.
  supported is reserved for the signed verify-release path whose declared
  checks actually ran, and the capability routing-trust filter now excludes
  unverified and disputed receipts so a forgery is never read as positive
  routing evidence.
• Bound every task-lease TTL with a MAXIMUM_TTL_SECONDS ceiling (30 days) as
  well as the existing minimum floor. A requested or default ttl_seconds is
  clamped into [MINIMUM_TTL_SECONDS, MAXIMUM_TTL_SECONDS], so a runaway or
  hostile ttl_seconds=1e15 can no longer pin a task for longer than the
  process will ever run. Non-finite requests continue to fall back to the
  default TTL.
• Refuse an inbound frame whose routing or identity field (sender, target,
  type, channel) is present but not a string, instead of str()-coercing
  it. A list, object, bool, or number would otherwise become a plausible
  identity or route — sender: ["a", "b"] coerced to "['a', 'b']" — letting a
  client bind a type-confused name or address a target it never spelled out. A
  structured payload is still accepted, since an A2A task frame legitimately
  carries one.

Fixed

• Keep synapse who usable when its requested subject is pinned to a retired
  machine key: the read-only query retries under a bounded identity derived
  from the current Ed25519 public key without removing or replacing the stale
  pin. A permanent synapse arm now returns a distinct identity-recovery
  verdict, and generated/checked-in systemd arm units use Restart=on-failure
  so a fail-closed 4013 stop cannot become a restart storm.
• Block publication unless the exact built wheel is installed in a clean
  environment and every declared console-script wrapper loads its callable from
  that environment's site-packages tree. The gate also refuses missing, extra,
  duplicated, or target-drifted entry-point metadata.
• Report a non-UTF-8 binary frame as a clean "Malformed JSON." error instead of
  killing the hub connection with an unhandled 1011. loads_bounded decodes
  bytes through json.loads, which raises UnicodeDecodeError (not
  JSONDecodeError) on an undecodable frame; it now honours its documented
  contract and re-raises that as JSONDecodeError, so every caller's decode
  guard — the hub included — covers a binary frame and the socket stays open.
• Preserve structured JSON payloads and auxiliary protocol fields in version-2
  relay-log rows instead of stringifying payloads and dropping grant metadata.
  Existing version-1 rows remain readable, and the relay benchmark now compares
  the same full envelope field set rather than counting discarded fields as a
  compression saving.
• Recover startup around malformed SQLite event rows using non-secret typed
  markers, degrade health/metrics, and fail closed on every mutation while the
  replayed state is incomplete. synapse compact --drop-corrupt now provides an
  explicit floor-bounded repair path and requires an owner-only archive report
  that preserves the row digest and validation reasons before deletion; a failed
  pre-delete archive write leaves the journal unchanged.
• Roll back a failed event-store append and restore SQLite
  synchronous=NORMAL after a rejected durable write, so an INSERT or commit
  error cannot leave later hub traffic running at the FULL durability mode.
• Catch a peer's malformed opening handshake in the multi-hub fetch so a failed
  federation poll surfaces as MultiHubFetchError and the standing
  partition-detection watch keeps polling every peer instead of the watch task
  dying silently and freezing its observations. The watch now also logs at
  WARNING if its loop exits on any unexpected error, and importing the agent
  client no longer calls logging.basicConfig, which had clamped the whole
  process's root logger to ERROR and swallowed those federation watch
  warnings.