v2.19.8

Correct SPF provider observations and bounded redirect handling without adding
collection or changing the compact default view.

Fixed

• SPF detection requires the complete v=spf1 version token. Lookalike
  prefixes such as v=spf10 no longer produce provider or SPF policy claims.
• Provider matching excludes includes after all and redirects ignored
  because all is present.
  Original TXT records remain available as retained observations.
• Qualified includes remain observable policy references. Detailed service
  roles say "SPF policy reference" rather than claiming sender authorization;
  the default panel continues to show the compact service name.
• Redirect collection requires one exact redirect= modifier and applies the
  all rule at every hop. Embedded modifier text and repeated redirects no
  longer schedule unrelated DNS requests or inherit a downstream policy.
• SPF specificity is applied to each target independently. A narrow match no
  longer hides a separately listed provider with an overlapping catalog rule.
  Repeated targets still produce one occurrence per matching rule. Live
  collection and cache-only fingerprint replay share the same matching path.

Tool Surface Changes

Tool surface changes: no CLI command, flag or JSON schema changes.
Detailed service labels and connection_map entry roles use "SPF policy
reference" for SPF observations.

Security

• Raise the development-only urllib3 floor to 2.8.0 and refresh its locked
  artifacts, addressing CVE-2026-97687 and CVE-2026-97689 in the dependency
  audit toolchain. Apply the same floor to the isolated release SBOM tool.
  urllib3 remains outside the published runtime graph.
• Audit the complete frozen exports without launching pip's resolver, avoiding
  its separate vendored transport. CI, release audits and SBOM generation keep
  their existing coverage and fail-closed vulnerability checks.