v0.5.57 — Post-Release Truth and Reliability Repair

Bounded repair of six defects found in the v0.5.56 post-deploy audit.

Deployed: merge commit 6faadef55fefe0a2347d54450f3cf29e7c56b85a (PR #322) · Cloud Build ca5742a7-9d55-43a7-9f8d-b7e8b19502c7 · live 2026-08-06T11:27:35Z

What changed

• Deletion requests no longer fail silently. Firestore read/write failures and unexpected handler exceptions now return a structured, non-enumerating, retryable HTTP 503 with processed=false. A failed persistence operation is never reported as successful, and no backend detail or UUID is echoed back.
• Opt-in shared history is bounded. At most the 20 newest results are retained, oldest evicted on every read and write, written atomically, and the reported success reflects what actually persisted.
• MCP Registry description shortened to 88 characters, with the ≤100 limit now enforced by a regression contract.
• Discovery truth: the stale Genesis Master Prompt v4.2 server-card identity replaced with the live production methodology identity.
• One source for legal text: duplicate Terms/Privacy HTML bodies removed, so /terms and /privacy render only from the canonical policy modules.
• Terms v2.4 and Privacy Policy v2.5, in English and Bahasa Malaysia, describing the bounded-history retention contract in the same terms the code enforces.

Verification

• 1,176 tests passed / 14 skipped; Bandit 0 findings; all 9 remote checks green
• Independent security review at the exact head, with 16 of the new regression contracts failing against the parent commit — confirming they detect the repaired behaviour rather than passing vacuously
• Post-deploy smoke: 25 passed / 0 stop / 0 instrument, including a full real-inference validation across all three Trinity stages

Not claimed

This release makes no legal-compliance certification. Review of statutory notice sufficiency remains a separate, parallel track. The coordination tools remain disabled following the earlier security incident, which is contained but not closed.