v0.9.0

What's Changed

• chore(deps): Bump the minor-and-patch group with 3 updates by @dependabot[bot] in #59
• chore(deps): Bump the minor-and-patch group with 2 updates by @dependabot[bot] in #60
• chore(ci): Bump the actions group with 9 updates by @dependabot[bot] in #61
• feat(template): public-parity — versions contract, demo ops, showcase fixes by @chrispezza in #76
• fix(security): trusted-proxy client IP on Fly — right-most XFF + CIDRs (#72) by @chrispezza in #77
• fix(security): opt-in CLIENT_IP_HEADER for authoritative edge headers (#72) by @chrispezza in #78
• fix(profile): persist name updates to the users row (#70) by @chrispezza in #79
• feat(auth): guest → registered upgrade flow (#68) by @chrispezza in #80
• fix(auth): unique placeholder email for anonymous provisioning (hotfix) by @chrispezza in #81
• test: coverage hardening, mutation testing (ADR-032), SetLastLogin fix by @chrispezza in #86
• chore(ci): cap every job with timeout-minutes; cancel superseded PR runs by @chrispezza in #102
• chore(ci): use the runner's preinstalled psql; apt only as a retried, capped fallback by @chrispezza in #111
• ci(demo-reset): add least-privilege permissions block by @chrispezza in #103
• refactor(health): ping the DB through a consumer-side Pinger seam by @chrispezza in #104
• chore(versions): add -write sync mode so a pin bump is a one-file edit by @chrispezza in #105
• fix(view): widen the ADR-029 token scan to every palette family; fix four leftovers by @chrispezza in #106
• test(scripts): cover agentsmd spine check and checkversions contract by @chrispezza in #107
• feat(checks): sqlc/templ regeneration-drift check in task ci by @chrispezza in #108
• test(server): wiring contracts — middleware order, static cache headers, route table by @chrispezza in #109
• feat(checks): adr015-no-hardcoded-secrets — high-signal secret scanner by @chrispezza in #110
• feat(reaper): sweep orphaned anonymous auth users that have no public row by @chrispezza in #112
• feat(dashboard): progress widgets — quiz score history and cards to review by @chrispezza in #113
• feat(profile): show account email, change password, sign out on the page by @chrispezza in #114
• feat(home): landing architecture explainer with live perf stats by @chrispezza in #115
• chore(ci): Bump the actions group across 1 directory with 3 updates by @dependabot[bot] in #94
• chore(deps): Bump the minor-and-patch group across 1 directory with 2 updates by @dependabot[bot] in #95
• chore(cache): delete dead internal/cache package by @chrispezza in #119
• chore(lint): pin golangci-lint to v2.13.1 and track it in versions.json (ADR-030) by @chrispezza in #120
• chore(deps): bump chi, pgx, x/time and raise Go floor to 1.26 by @chrispezza in #123
• chore(ci): Bump softprops/action-gh-release from 3.0.2 to 3.0.3 in the actions group by @dependabot[bot] in #122
• fix(middleware): stop RateLimiter eviction goroutine with the server by @chrispezza in #124
• feat(quiz): per-topic entry so explainer hand-offs land on their topic by @chrispezza in #125
• fix(agentsmd): normalize layer endings and detect ATX headings per CommonMark by @chrispezza in #126
• docs: update rate limiter snippets for the context signature; drop stale main.go placeholders by @chrispezza in #127
• feat(seo): share/crawl surface and live-demo links by @chrispezza in #128
• feat(perf): observed-vs-budget grid and Server-Timing (ADR-034) by @chrispezza in #129
• feat(flashcards): RLS isolation check (ADR-034) by @chrispezza in #130
• feat(patterns): rate-limit demo with Retry-After (ADR-034) by @chrispezza in #131
• feat(quiz): questions on the proof surfaces (ADR-034) by @chrispezza in #133
• chore: release 0.9.0 by @chrispezza in #139

New Contributors

• @dependabot[bot] made their first contribution in #59

Full Changelog: v0.8.0...v0.9.0