v0.5.2

Plug: halt before sending the rejection; report test conns from before_send

The 0.5.2 CI run flaked once on the mid lane with new evidence: the 401
response reached the client while the handler's owner reports after the
send never ran — the transport can kill the handler process once the
response flushes and the client closes, before any post-send code executes.
The harness now sends its observed-connection report from a
register_before_send hook, which runs inside send_resp: the report strictly
precedes the response bytes, so it cannot be lost to the handler's death.

To keep the reported connection final, Verify's {:halt, status} rejection
sets the halted flag before send_resp instead of after — wire behavior is
identical (Plug reads the flag only after the pipeline returns), and
before_send callbacks now observe the final halted state. Gate exit 0.

v0.5.1: Release 0.5.1: skip unusable JWKS keys, stabilize transport tests

Release 0.5.1: skip unusable JWKS keys, stabilize transport tests

Two residuals the owner rejected in the 0.5.0 release, closed:

A JWKS key this verifier cannot use for signature work is skipped and the
rest of the set still fetches and resolves: an alg naming another algorithm
(encryption keys, names outside both registries) or a well-formed key of an
unsupported kty/curve (RFC 7517 Section 5). Leaked private members, a
malformed non-string alg, and other malformed entries still reject the whole
set loudly — the private-member precheck runs before any skip decision, so
skipping can never hide leaked material. The max_keys bound still counts
every listed key; an all-skipped set resolves empty and lookups fail closed.

The Plug target-fidelity suite no longer flakes on saturated CI runners:
each real-Bandit-transport assertion drains the helper's per-request report
messages so every assert scans a bounded mailbox, and the observed-result
window is 15 seconds (a starved handler process can trail the client's
received response past the old 5-second window). No library code changed.

Version 0.5.1 with corpus pin, conformance pin, install strings, runbook
asserts, and livebooks moved together. Gate exit 0 on this tree; one-family
review of the diff (private-member hole, kty skip, coverage, README drift,
comments, changelog hygiene) repaired before the gate.

v0.5.0

Release 0.5.0: quorum deadline, telemetry contract, total verify, discovery revalidation

Review-hardening remediation and the 0.5.0 release on top of b6bfd9e.

Capacity and contracts: verify_quorum/3 accepts an opt-in :deadline (absolute
monotonic ms) bounding the assignment search's wall-clock time; expiry keeps
best-so-far acceptance and otherwise returns the first retryable core error,
:deadline at :quorum. A versioned telemetry contract (ADR 0006) emits five
low-cardinality events (verify, verify_quorum, Web Bot Auth verify, replay
claim, custody sign); :telemetry becomes the single required dependency.
Verify and sign entry points are total: unexpected internal faults return
:internal at :internal with the exception class in detail; the crypto rescue
narrows to OTP argument/runtime classes.

Interop and discovery: Plug.Verify gains a stable :name for repeat identity;
DNS splits authoritative NXDOMAIN (:domain_not_found, nonretryable) from
retryable :resolution_failed; JWKS alg accepts either registry spelling,
normalized once to the JOSE name (PS256/PS384 included); caches revalidate
conditionally with stored ETags (validators never cross redirects, CIMD
revalidates unconditionally, a 304 keeps only all-live keys under its own
directives with the stored lifetime persisting when it omits them); Nested
admits non-JOSE inner cty and rejects only JOSE-typed values.

Hardening and performance: one inner/1 error shape; generated-spec signing
shares the custody path (event + 1..1,024-byte bound); binary-part OWS trim
and validate-once plumbing measure ~2.5x faster signature bases (p50).

Infrastructure: dialyxir in the declared gate with an exact-entry ignore
file (CI caches the PLT); ash-family lockfile refresh within pins; grouped
Dependabot for both Mix environments and GitHub Actions; notebook runner
sandboxing (own cwd and Mix.install cache); SSH-agent test temp dirs are
per-PID.

Docs: guides, architecture, threat model (refreshed measured ceilings),
ADR 0006 implemented boundary, six Livebooks at 0.5.0 with a telemetry
section. Gate exit 0 on this tree; decorrelated review (two families) and
repair passes recorded under .kimosabe.

v0.4.0

Release 0.4.0

v0.3.1

Release 0.3.1 with the stricter corpus metadata rule

The corpus index names v0.3.1 as its source release, so its digest and
the consumer pin change. Corpus validation tests start from the tracked
corpus only, since Finder can leave .DS_Store files in a macOS checkout
and each test plants its own. Installs move to ~> 0.3.1.

v0.3.0

Sign the refresh test's directory with the cache's clock

The real TLS refresh test froze the cache clock at one second while its
peer signed the directory proof with wall time, so a second boundary
between the capture and the fetch dated the proof in the cache's future
and the fetch failed as source_unavailable. The peer now signs with the
test's clock.