v32.0.2

What's Changed

• build(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #2
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #4
• build(deps-dev): bump electron-builder from 25.1.8 to 26.15.3 by @dependabot[bot] in #5
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #19
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #20
• build(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #22
• build(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #23
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #25
• build(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #26
• build(deps): bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #28
• build(deps): bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in #24
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #27
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #21
• feat: implement governed ZASI architecture and release gates by @cvsz in #29
• fix: close release and backup safety gates by @cvsz in #31
• docs: refresh architecture validation evidence by @cvsz in #32
• docs: record merged release evidence by @cvsz in #33
• fix(desktop): fail closed without bundled Python runtime by @cvsz in #34
• fix(desktop): harden packaged state and runtime relocatability by @cvsz in #35
• docs: record merged Electron hardening by @cvsz in #36
• fix(egress): enforce DNS resolution deadlines by @cvsz in #37
• docs: refresh current validation evidence by @cvsz in #38
• docs: reconcile current release evidence by @cvsz in #39
• fix: make legacy capability paths permanently retired by @cvsz in #40
• fix: reject malformed session scopes by @cvsz in #41
• fix: enforce control-plane scope boundaries by @cvsz in #42
• docs: record merged scope enforcement evidence by @cvsz in #43
• docs: reconcile current test count by @cvsz in #44
• docs: reconcile current test count by @cvsz in #45
• ci: set CodeQL read-only baseline by @cvsz in #46
• docs: record current validation evidence by @cvsz in #47
• feat: add source-backed multimodal artifact slice by @cvsz in #48
• docs: reconcile merged multimodal evidence by @cvsz in #49
• feat: add bounded glTF artifact evidence by @cvsz in #50
• docs: record hosted glTF verification by @cvsz in #51
• docs: record current runtime and release evidence by @cvsz in #52
• Harden runtime secrets, staging boundaries, and local speech evidence by @cvsz in #53
• fix: harden CI runtime and audit availability handling by @cvsz in #54
• Feature/ai futures superintelligence by @cvsz in #55
• Harden World Room CI and local security boundary by @cvsz in #74
• chore(deps): update psycopg requirement from <4.0.0,>=3.2.0 to >=3.3.5,<4.0.0 by @dependabot[bot] in #68
• chore(deps): update cryptography requirement from <51.0.0,>=46.0.7 to >=50.0.1,<51.0.0 by @dependabot[bot] in #61
• chore(deps-dev): bump electron from 44.1.0 to 44.3.0 by @dependabot[bot] in #57
• chore(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #70
• ci(supply-chain): attest published container provenance by @cvsz in #75
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #71
• chore(deps): update uvicorn requirement from <1.0.0,>=0.34.0 to >=0.52.4,<1.0.0 by @dependabot[bot] in #69
• chore(deps-dev): update pytest requirement from >=7.0.0 to >=9.1.1 by @dependabot[bot] in #67
• chore(deps-dev): update z3-solver requirement from >=4.12.0 to >=5.1.0.0 by @dependabot[bot] in #66
• chore(deps-dev): update setuptools requirement from >=61.0 to >=84.0.0 by @dependabot[bot] in #62
• chore(deps): update redis requirement from <7.0.0,>=5.0.0 to >=8.1.0,<9.0.0 by @dependabot[bot] in #60
• chore(deps): bump three from 0.179.1 to 0.186.0 by @dependabot[bot] in #59
• chore(deps-dev): update black requirement from >=23.0.0 to >=26.5.1 by @dependabot[bot] in #65
• chore(deps): update pydantic requirement from <3.0.0,>=2.8.0 to >=2.13.5,<3.0.0 by @dependabot[bot] in #64
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #56
• chore(deps): update fastapi requirement from <1.0.0,>=0.115.0 to >=0.141.1,<1.0.0 by @dependabot[bot] in #63
• chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #72
• ci(security): gate container publish on vulnerability and secret scans by @cvsz in #76
• test(prod-readiness): add reference corpora and security evidence pack by @cvsz in #77
• feat: add zasi ECC bundle by @ECC-Tools[bot] in #30
• ci(release): fail closed on missing production GO evidence by @cvsz in #79
• fix(release): reject stale staging production evidence by @cvsz in #80
• security(legacy): require bearer auth for compatibility HUD by @cvsz in #81
• ci(supply-chain): pin release actions to immutable commits by @cvsz in #82
• ci(security): pin CodeQL actions to immutable commits by @cvsz in #83
• ci(supply-chain): pin primary CI actions to immutable commits by @cvsz in #84
• ci(supply-chain): enforce immutable actions repository-wide by @cvsz in #85
• fix(runtime): enforce single authoritative port ownership by @cvsz in #86
• test(identity): prove durable restart state by @cvsz in #87
• security(events): keep outbox claim credentials internal by @cvsz in #88
• security(world-room): sanitize upstream failure surfaces by @cvsz in #89
• security(world-room): enforce trusted browser origin by @cvsz in #90
• security(persistence): redact worker credentials before durable storage by @cvsz in #91
• security(events): redact durable audit and event payloads by @cvsz in #92
• security(api): redact public HTTP error payloads by @cvsz in #93
• security(electron): close backend log credential leak by @cvsz in #94
• test(identity): consolidate P1 foundation acceptance evidence by @cvsz in #95
• security(governance): require live main ruleset for production GO by @cvsz in #96
• security(governance): require complete production check set by @cvsz in #97
• security(governance): add reproducible main ruleset bootstrap by @cvsz in #98
• security(release): bind staging evidence to deployed origin by @cvsz in #99
• security(release): bind candidate evidence to deployed digest by @cvsz in #100
• security(release): require observed staging release identity by @cvsz in #101
• security(release): verify rollback runtime digest by @cvsz in #102
• security(release): bind staging evidence to one timeline by @cvsz in #103
• security(release): verify post-rollback health identity by @cvsz in #104
• security(release): bind World Room evidence to canonical endpoint by @cvsz in #105
• security(release): add external canary measurement provenance by @cvsz in #106
• docs(arin): establish Project Center and master architecture by @cvsz in #107
• test(arin): gate reference cor...

v32.0.0

Changelog

All notable changes to the ZASI (Zero-Entropy Autonomous Superintelligence Infrastructure) project are documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

---

[32.0.0] - 2026-09-01

Added

• Subsystems #169–#176 (Hyper-Cosmology & Singularity Milestone):
  • #169: Tachyon-Mediated Retrocausal Error Mitigation Matrix
  • #170: Stellar-Mass Gravitational Wave Interferometer Array
  • #171: Ultra-Relativistic Plasma Wakefield Positron Accelerator
  • #172: Quantum Vacuum Casimir Force Actuator Core
  • #173: Trans-Galactic Dark Matter Axion Haloscope Detector
  • #174: Non-Hermitian Exceptional Point Sensor Lattice
  • #175: Hyperbolic Spacetime Geodesic Wormhole Router
  • #176: Infinite-Dimensional Hilbert Space Singularity Sovereign Supreme
• Automated Package Ecosystem Deployment:
  • Live PyPI publishing workflow via OIDC Trusted Publishing and pypa/gh-action-pypi-publish.
  • npm automated distribution workflow (zasi-cockpit on npm Registry).
  • GitHub Pages Command Cockpit live hosting (cvsz.github.io/zasi).
  • GitHub Container Registry (GHCR) Docker multi-platform builds.
• Full Community & Agent Framework:
  • 9 specialized domain skills in .agents/skills/ (Quantum QEC, Formal SMT, RSI, Real Hardware, Security, MCP, etc.).
  • 7 specialized multi-agent personas in .agents/agents/.
  • GitHub Discussion templates for RFC subsystem proposals, Q&A, and community onboarding.

Security

• Resolved all CodeQL static analysis alerts: DOM XSS (textContent), Subresource Integrity (SRI) hashes on CDN scripts, sensitive log filtering in main.py, and workflow least-privilege permissions.

---

[31.0.0] - 2026-09-01

Added

• React 18 + React Router v6 SPA: Complete browser-based command cockpit with 5 distinct routes (/, /jarvis, /subsystems, /cockpit, /mcp).
• Command Palette (Ctrl+K / Cmd+K): Modal overlay for keyboard-driven navigation, state mutations, and daemon triggers.
• Dark/Light Theme System: CSS variable-driven theming engine with local storage persistence.
• Toast Notification Engine: Non-blocking asynchronous notifications for system actions and WebSocket state changes.
• Web Speech Synthesis & Voice Recognition: Two-way neural voice interface with pitch/rate modulation across J.A.R.V.I.S., F.R.I.D.A.Y., and E.D.I.T.H. personas.
• WebSocket Server (RFC 6455): Real-time 2-second streaming telemetry and log broadcasts over /ws.
• API Key & Rate Limiting Middleware: Secure access control via X-API-Key headers and sliding-window 60 req/min throttles.
• SQLite Persistence: Local state synchronization to data/zasi_state.db.
• OpenAPI 3.0 Auto-Documentation: Live interactive endpoint specification served at /api/openapi.json.
• Server-Sent Events (SSE): Word-by-word streaming chat completions on /api/jarvis/stream.
• Google Gemini API Native Bridge: Multi-turn conversation context grounding with Gemini 2.0 Flash fallback.
• Docker & Docker Compose: Automated containerized deployment stack.
• Electron Desktop Application: Cross-platform desktop shell wrapping the full Python/React stack.
• Vite & npm Build Configuration: Production bundler setup and structural testing suite.

---

[30.0.0] - 2026-09-01

Added

• Subsystems #161–#168 (Omniversal Apex Prime Milestone)
• Three.js 3D hypergraph visualization engine.
• 172-test comprehensive suite.