Axern v0.3.1

Axern v0.3.1 establishes an explicit identity and authorization boundary for
the control plane while keeping the sandbox data plane independently
verifiable.

Highlights

• Principal identities are derived from authenticated mTLS certificates and
  can be inspected with axern identity whoami.
• Platform administrators can grant, list, inspect, and revoke namespace role
  bindings through the Axern CLI. Revocation history remains auditable, and a
  namespace with active bindings cannot be deleted.
• Gateway, tunnel, rollout-worker, and public API calls enforce their intended
  platform or namespace scope instead of relying on network reachability as
  authorization.
• axern doctor provides a single diagnostic path for context, TLS, control
  plane, gateway, and tunnel readiness.
• Candidate and published Python, Go, and TypeScript SDK artifacts are verified
  against a fresh live Axern data plane before and after publication.

Upgrade Boundary

This release intentionally replaces the pre-1.0 control-plane schema and PKI
baseline. In-place upgrades from v0.2.x PostgreSQL databases or retained Axern
PKI Secrets are not supported. Deploy v0.3.1 with a fresh control-plane
database and freshly generated Axern PKI material. New installations require
no additional migration step.

See the authorization guide
for the principal and namespace role model.

What's Changed

• build(deps): bump @grpc/grpc-js from 1.14.3 to 1.14.4 by @dependabot[bot] in #5
• build(deps): update Go security dependencies by @rcyw in #9
• build: align Dependabot with workspace locks by @rcyw in #18
• build(deps): bump the go-security-updates group across 10 directories with 4 updates by @dependabot[bot] in #19
• build(deps): complete security dependency updates by @rcyw in #21
• build(deps): resolve security alerts by @rcyw in #22

New Contributors

• @dependabot[bot] made their first contribution in #5
• @rcyw made their first contribution in #9

Full Changelog: v0.1.0...v0.3.1