v32.0.2

What's Changed

• build(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #2
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #4
• build(deps-dev): bump electron-builder from 25.1.8 to 26.15.3 by @dependabot[bot] in #5
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #19
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #20
• build(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #22
• build(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #23
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #25
• build(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #26
• build(deps): bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #28
• build(deps): bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in #24
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #27
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #21
• feat: implement governed ZASI architecture and release gates by @cvsz in #29
• fix: close release and backup safety gates by @cvsz in #31
• docs: refresh architecture validation evidence by @cvsz in #32
• docs: record merged release evidence by @cvsz in #33
• fix(desktop): fail closed without bundled Python runtime by @cvsz in #34
• fix(desktop): harden packaged state and runtime relocatability by @cvsz in #35
• docs: record merged Electron hardening by @cvsz in #36
• fix(egress): enforce DNS resolution deadlines by @cvsz in #37
• docs: refresh current validation evidence by @cvsz in #38
• docs: reconcile current release evidence by @cvsz in #39
• fix: make legacy capability paths permanently retired by @cvsz in #40
• fix: reject malformed session scopes by @cvsz in #41
• fix: enforce control-plane scope boundaries by @cvsz in #42
• docs: record merged scope enforcement evidence by @cvsz in #43
• docs: reconcile current test count by @cvsz in #44
• docs: reconcile current test count by @cvsz in #45
• ci: set CodeQL read-only baseline by @cvsz in #46
• docs: record current validation evidence by @cvsz in #47
• feat: add source-backed multimodal artifact slice by @cvsz in #48
• docs: reconcile merged multimodal evidence by @cvsz in #49
• feat: add bounded glTF artifact evidence by @cvsz in #50
• docs: record hosted glTF verification by @cvsz in #51
• docs: record current runtime and release evidence by @cvsz in #52
• Harden runtime secrets, staging boundaries, and local speech evidence by @cvsz in #53
• fix: harden CI runtime and audit availability handling by @cvsz in #54
• Feature/ai futures superintelligence by @cvsz in #55
• Harden World Room CI and local security boundary by @cvsz in #74
• chore(deps): update psycopg requirement from <4.0.0,>=3.2.0 to >=3.3.5,<4.0.0 by @dependabot[bot] in #68
• chore(deps): update cryptography requirement from <51.0.0,>=46.0.7 to >=50.0.1,<51.0.0 by @dependabot[bot] in #61
• chore(deps-dev): bump electron from 44.1.0 to 44.3.0 by @dependabot[bot] in #57
• chore(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #70
• ci(supply-chain): attest published container provenance by @cvsz in #75
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #71
• chore(deps): update uvicorn requirement from <1.0.0,>=0.34.0 to >=0.52.4,<1.0.0 by @dependabot[bot] in #69
• chore(deps-dev): update pytest requirement from >=7.0.0 to >=9.1.1 by @dependabot[bot] in #67
• chore(deps-dev): update z3-solver requirement from >=4.12.0 to >=5.1.0.0 by @dependabot[bot] in #66
• chore(deps-dev): update setuptools requirement from >=61.0 to >=84.0.0 by @dependabot[bot] in #62
• chore(deps): update redis requirement from <7.0.0,>=5.0.0 to >=8.1.0,<9.0.0 by @dependabot[bot] in #60
• chore(deps): bump three from 0.179.1 to 0.186.0 by @dependabot[bot] in #59
• chore(deps-dev): update black requirement from >=23.0.0 to >=26.5.1 by @dependabot[bot] in #65
• chore(deps): update pydantic requirement from <3.0.0,>=2.8.0 to >=2.13.5,<3.0.0 by @dependabot[bot] in #64
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #56
• chore(deps): update fastapi requirement from <1.0.0,>=0.115.0 to >=0.141.1,<1.0.0 by @dependabot[bot] in #63
• chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #72
• ci(security): gate container publish on vulnerability and secret scans by @cvsz in #76
• test(prod-readiness): add reference corpora and security evidence pack by @cvsz in #77
• feat: add zasi ECC bundle by @ECC-Tools[bot] in #30
• ci(release): fail closed on missing production GO evidence by @cvsz in #79
• fix(release): reject stale staging production evidence by @cvsz in #80
• security(legacy): require bearer auth for compatibility HUD by @cvsz in #81
• ci(supply-chain): pin release actions to immutable commits by @cvsz in #82
• ci(security): pin CodeQL actions to immutable commits by @cvsz in #83
• ci(supply-chain): pin primary CI actions to immutable commits by @cvsz in #84
• ci(supply-chain): enforce immutable actions repository-wide by @cvsz in #85
• fix(runtime): enforce single authoritative port ownership by @cvsz in #86
• test(identity): prove durable restart state by @cvsz in #87
• security(events): keep outbox claim credentials internal by @cvsz in #88
• security(world-room): sanitize upstream failure surfaces by @cvsz in #89
• security(world-room): enforce trusted browser origin by @cvsz in #90
• security(persistence): redact worker credentials before durable storage by @cvsz in #91
• security(events): redact durable audit and event payloads by @cvsz in #92
• security(api): redact public HTTP error payloads by @cvsz in #93
• security(electron): close backend log credential leak by @cvsz in #94
• test(identity): consolidate P1 foundation acceptance evidence by @cvsz in #95
• security(governance): require live main ruleset for production GO by @cvsz in #96
• security(governance): require complete production check set by @cvsz in #97
• security(governance): add reproducible main ruleset bootstrap by @cvsz in #98
• security(release): bind staging evidence to deployed origin by @cvsz in #99
• security(release): bind candidate evidence to deployed digest by @cvsz in #100
• security(release): require observed staging release identity by @cvsz in #101
• security(release): verify rollback runtime digest by @cvsz in #102
• security(release): bind staging evidence to one timeline by @cvsz in #103
• security(release): verify post-rollback health identity by @cvsz in #104
• security(release): bind World Room evidence to canonical endpoint by @cvsz in #105
• security(release): add external canary measurement provenance by @cvsz in #106
• docs(arin): establish Project Center and master architecture by @cvsz in #107
• test(arin): gate reference corpus with deterministic evidence contracts by @cvsz in #108
• docs(arin): begin exact capability matrix with zknowbase by @cvsz in #109
• docs(arin): record exact-head ZARVIS source assessment by @cvsz in #110
• docs(arin): record bounded ZCoder source assessment by @cvsz in #111
• docs(arin): record bounded zDash source assessment by @cvsz in #112
• security(canary): integrity-bind external measurement artifacts by @cvsz in #113
• docs(arin): record bounded zAnything source assessment by @cvsz in #114
• feat(arin): establish bounded zknowbase read contract by @cvsz in #115
• feat(arin): add bounded zknowbase read transport by @cvsz in #122
• feat(arin): map zknowbase citations into evidence by @cvsz in #123
• feat(arin): gate zknowbase writes behind scope and policy by @cvsz in #124
• feat(arin): define safe degraded zknowbase reads by @cvsz in #125
• docs(arin): extract bounded ZCoder security requirements by @cvsz in #126
• feat(arin): define fail-closed tool capability descriptors by @cvsz in #127
• test(arin): prove denied tool authorities stay denied by @cvsz in #128
• docs(arin): propose bounded ZCoder tool adapter ADR by @cvsz in #129
• test(arin): define bounded ZCoder adapter contract by @cvsz in #130
• docs(arin): reconcile verified Task 6 adapter evidence by @cvsz in #131
• test(arin): define fail-closed local tool transport by @cvsz in #132
• docs(arin): record verified local tool transport by @cvsz in #133
• docs(arin): reconcile Project Center evidence truth by @cvsz in #134
• docs(arin): reconcile verified Project Center plan state by @cvsz in #135
• docs(arin): inventory legacy identity compatibility by @cvsz in #136
• chore(deps-dev): update httpx requirement from <1.0.0,>=0.28.0 to >=0.28.1,<1.0.0 by @dependabot[bot] in #116
• chore(deps): bump react and @types/react by @dependabot[bot] in #117
• chore(deps-dev): bump vite from 8.2.2 to 8.3.0 by @dependabot[bot] in #118
• chore(deps): bump react-dom and @types/react-dom by @dependabot[bot] in #119
• chore(deps-dev): bump @types/three from 0.179.0 to 0.186.0 by @dependabot[bot] in #120
• chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #121
• test(arin): lock legacy JARVIS compatibility routes by @cvsz in #137
• docs(arin): verify legacy route regression evidence by @cvsz in #138
• feat(arin): establish v1 canonical contract envelope by @cvsz in #139
• feat(arin): generate canonical v1 contract artifacts by @cvsz in #141
• docs(arin): reconcile Task 4 artifact evidence by @cvsz in #142
• test(arin): close Task 4 v1 compatibility gap by @cvsz in #143
• test(arin): reapply Task 4 contract compatibility closure by @cvsz in #145
• fix(release): build cockpit before wheel install in release job by @cvsz in #146
• evidence(staging): v32.0.2 production GO exercise by @cvsz in #147
• fix(release): allow loopback pinentry for CI signing by @cvsz in #148
• evidence(staging): v32.0.2 GO exercise round 2 (candidate 38e7f65) by @cvsz in #149

New Contributors

• @dependabot[bot] made their first contribution in #1
• @cvsz made their first contribution in #29
• @ECC-Tools[bot] made their first contribution in #30

Full Changelog: v32.0.0...v32.0.2

What's Changed

• build(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #2
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #4
• build(deps-dev): bump electron-builder from 25.1.8 to 26.15.3 by @dependabot[bot] in #5
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #19
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #20
• build(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #22
• build(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #23
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #25
• build(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #26
• build(deps): bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #28
• build(deps): bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in #24
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #27
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #21
• feat: implement governed ZASI architecture and release gates by @cvsz in #29
• fix: close release and backup safety gates by @cvsz in #31
• docs: refresh architecture validation evidence by @cvsz in #32
• docs: record merged release evidence by @cvsz in #33
• fix(desktop): fail closed without bundled Python runtime by @cvsz in #34
• fix(desktop): harden packaged state and runtime relocatability by @cvsz in #35
• docs: record merged Electron hardening by @cvsz in #36
• fix(egress): enforce DNS resolution deadlines by @cvsz in #37
• docs: refresh current validation evidence by @cvsz in #38
• docs: reconcile current release evidence by @cvsz in #39
• fix: make legacy capability paths permanently retired by @cvsz in #40
• fix: reject malformed session scopes by @cvsz in #41
• fix: enforce control-plane scope boundaries by @cvsz in #42
• docs: record merged scope enforcement evidence by @cvsz in #43
• docs: reconcile current test count by @cvsz in #44
• docs: reconcile current test count by @cvsz in #45
• ci: set CodeQL read-only baseline by @cvsz in #46
• docs: record current validation evidence by @cvsz in #47
• feat: add source-backed multimodal artifact slice by @cvsz in #48
• docs: reconcile merged multimodal evidence by @cvsz in #49
• feat: add bounded glTF artifact evidence by @cvsz in #50
• docs: record hosted glTF verification by @cvsz in #51
• docs: record current runtime and release evidence by @cvsz in #52
• Harden runtime secrets, staging boundaries, and local speech evidence by @cvsz in #53
• fix: harden CI runtime and audit availability handling by @cvsz in #54
• Feature/ai futures superintelligence by @cvsz in #55
• Harden World Room CI and local security boundary by @cvsz in #74
• chore(deps): update psycopg requirement from <4.0.0,>=3.2.0 to >=3.3.5,<4.0.0 by @dependabot[bot] in #68
• chore(deps): update cryptography requirement from <51.0.0,>=46.0.7 to >=50.0.1,<51.0.0 by @dependabot[bot] in #61
• chore(deps-dev): bump electron from 44.1.0 to 44.3.0 by @dependabot[bot] in #57
• chore(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #70
• ci(supply-chain): attest published container provenance by @cvsz in #75
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #71
• chore(deps): update uvicorn requirement from <1.0.0,>=0.34.0 to >=0.52.4,<1.0.0 by @dependabot[bot] in #69
• chore(deps-dev): update pytest requirement from >=7.0.0 to >=9.1.1 by @dependabot[bot] in #67
• chore(deps-dev): update z3-solver requirement from >=4.12.0 to >=5.1.0.0 by @dependabot[bot] in #66
• chore(deps-dev): update setuptools requirement from >=61.0 to >=84.0.0 by @dependabot[bot] in #62
• chore(deps): update redis requirement from <7.0.0,>=5.0.0 to >=8.1.0,<9.0.0 by @dependabot[bot] in #60
• chore(deps): bump three from 0.179.1 to 0.186.0 by @dependabot[bot] in #59
• chore(deps-dev): update black requirement from >=23.0.0 to >=26.5.1 by @dependabot[bot] in #65
• chore(deps): update pydantic requirement from <3.0.0,>=2.8.0 to >=2.13.5,<3.0.0 by @dependabot[bot] in #64
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #56
• chore(deps): update fastapi requirement from <1.0.0,>=0.115.0 to >=0.141.1,<1.0.0 by @dependabot[bot] in #63
• chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #72
• ci(security): gate container publish on vulnerability and secret scans by @cvsz in #76
• test(prod-readiness): add reference corpora and security evidence pack by @cvsz in #77
• feat: add zasi ECC bundle by @ECC-Tools[bot] in #30
• ci(release): fail closed on missing production GO evidence by @cvsz in #79
• fix(release): reject stale staging production evidence by @cvsz in #80
• security(legacy): require bearer auth for compatibility HUD by @cvsz in #81
• ci(supply-chain): pin release actions to immutable commits by @cvsz in #82
• ci(security): pin CodeQL actions to immutable commits by @cvsz in #83
• ci(supply-chain): pin primary CI actions to immutable commits by @cvsz in #84
• ci(supply-chain): enforce immutable actions repository-wide by @cvsz in #85
• fix(runtime): enforce single authoritative port ownership by @cvsz in #86
• test(identity): prove durable restart state by @cvsz in #87
• security(events): keep outbox claim credentials internal by @cvsz in #88
• security(world-room): sanitize upstream failure surfaces by @cvsz in #89
• security(world-room): enforce trusted browser origin by @cvsz in #90
• security(persistence): redact worker credentials before durable storage by @cvsz in #91
• security(events): redact durable audit and event payloads by @cvsz in #92
• security(api): redact public HTTP error payloads by @cvsz in #93
• security(electron): close backend log credential leak by @cvsz in #94
• test(identity): consolidate P1 foundation acceptance evidence by @cvsz in #95
• security(governance): require live main ruleset for production GO by @cvsz in #96
• security(governance): require complete production check set by @cvsz in #97
• security(governance): add reproducible main ruleset bootstrap by @cvsz in #98
• security(release): bind staging evidence to deployed origin by @cvsz in #99
• security(release): bind candidate evidence to deployed digest by @cvsz in #100
• security(release): require observed staging release identity by @cvsz in #101
• security(release): verify rollback runtime digest by @cvsz in #102
• security(release): bind staging evidence to one timeline by @cvsz in #103
• security(release): verify post-rollback health identity by @cvsz in #104
• security(release): bind World Room evidence to canonical endpoint by @cvsz in #105
• security(release): add external canary measurement provenance by @cvsz in #106
• docs(arin): establish Project Center and master architecture by @cvsz in #107
• test(arin): gate reference corpus with deterministic evidence contracts by @cvsz in #108
• docs(arin): begin exact capability matrix with zknowbase by @cvsz in #109
• docs(arin): record exact-head ZARVIS source assessment by @cvsz in #110
• docs(arin): record bounded ZCoder source assessment by @cvsz in #111
• docs(arin): record bounded zDash source assessment by @cvsz in #112
• security(canary): integrity-bind external measurement artifacts by @cvsz in #113
• docs(arin): record bounded zAnything source assessment by @cvsz in #114
• feat(arin): establish bounded zknowbase read contract by @cvsz in #115
• feat(arin): add bounded zknowbase read transport by @cvsz in #122
• feat(arin): map zknowbase citations into evidence by @cvsz in #123
• feat(arin): gate zknowbase writes behind scope and policy by @cvsz in #124
• feat(arin): define safe degraded zknowbase reads by @cvsz in #125
• docs(arin): extract bounded ZCoder security requirements by @cvsz in #126
• feat(arin): define fail-closed tool capability descriptors by @cvsz in #127
• test(arin): prove denied tool authorities stay denied by @cvsz in #128
• docs(arin): propose bounded ZCoder tool adapter ADR by @cvsz in #129
• test(arin): define bounded ZCoder adapter contract by @cvsz in #130
• docs(arin): reconcile verified Task 6 adapter evidence by @cvsz in #131
• test(arin): define fail-closed local tool transport by @cvsz in #132
• docs(arin): record verified local tool transport by @cvsz in #133
• docs(arin): reconcile Project Center evidence truth by @cvsz in #134
• docs(arin): reconcile verified Project Center plan state by @cvsz in #135
• docs(arin): inventory legacy identity compatibility by @cvsz in #136
• chore(deps-dev): update httpx requirement from <1.0.0,>=0.28.0 to >=0.28.1,<1.0.0 by @dependabot[bot] in #116
• chore(deps): bump react and @types/react by @dependabot[bot] in #117
• chore(deps-dev): bump vite from 8.2.2 to 8.3.0 by @dependabot[bot] in #118
• chore(deps): bump react-dom and @types/react-dom by @dependabot[bot] in #119
• chore(deps-dev): bump @types/three from 0.179.0 to 0.186.0 by @dependabot[bot] in #120
• chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #121
• test(arin): lock legacy JARVIS compatibility routes by @cvsz in #137
• docs(arin): verify legacy route regression evidence by @cvsz in #138
• feat(arin): establish v1 canonical contract envelope by @cvsz in #139
• feat(arin): generate canonical v1 contract artifacts by @cvsz in #141
• docs(arin): reconcile Task 4 artifact evidence by @cvsz in #142
• test(arin): close Task 4 v1 compatibility gap by @cvsz in #143
• test(arin): reapply Task 4 contract compatibility closure by @cvsz in #145
• fix(release): build cockpit before wheel install in release job by @cvsz in #146
• evidence(staging): v32.0.2 production GO exercise by @cvsz in #147
• fix(release): allow loopback pinentry for CI signing by @cvsz in #148
• evidence(staging): v32.0.2 GO exercise round 2 (candidate 38e7f65) by @cvsz in #149

New Contributors

• @dependabot[bot] made their first contribution in #1
• @cvsz made their first contribution in #29
• @ECC-Tools[bot] made their first contribution in #30

Full Changelog: v32.0.0...v32.0.2

What's Changed

• build(deps-dev): bump the npm_and_yarn group across 1 directory with 2 updates by @dependabot[bot] in #1
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #2
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #4
• build(deps-dev): bump electron-builder from 25.1.8 to 26.15.3 by @dependabot[bot] in #5
• build(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #19
• build(deps): bump docker/login-action from 3 to 4 by @dependabot[bot] in #20
• build(deps): bump docker/build-push-action from 6 to 7 by @dependabot[bot] in #22
• build(deps): bump actions/setup-node from 4 to 7 by @dependabot[bot] in #23
• build(deps): bump docker/setup-buildx-action from 3 to 4 by @dependabot[bot] in #25
• build(deps): bump docker/metadata-action from 5 to 6 by @dependabot[bot] in #26
• build(deps): bump actions/configure-pages from 5 to 6 by @dependabot[bot] in #28
• build(deps): bump actions/upload-pages-artifact from 3 to 5 by @dependabot[bot] in #24
• build(deps): bump actions/deploy-pages from 4 to 5 by @dependabot[bot] in #27
• build(deps): bump actions/setup-python from 5 to 7 by @dependabot[bot] in #21
• feat: implement governed ZASI architecture and release gates by @cvsz in #29
• fix: close release and backup safety gates by @cvsz in #31
• docs: refresh architecture validation evidence by @cvsz in #32
• docs: record merged release evidence by @cvsz in #33
• fix(desktop): fail closed without bundled Python runtime by @cvsz in #34
• fix(desktop): harden packaged state and runtime relocatability by @cvsz in #35
• docs: record merged Electron hardening by @cvsz in #36
• fix(egress): enforce DNS resolution deadlines by @cvsz in #37
• docs: refresh current validation evidence by @cvsz in #38
• docs: reconcile current release evidence by @cvsz in #39
• fix: make legacy capability paths permanently retired by @cvsz in #40
• fix: reject malformed session scopes by @cvsz in #41
• fix: enforce control-plane scope boundaries by @cvsz in #42
• docs: record merged scope enforcement evidence by @cvsz in #43
• docs: reconcile current test count by @cvsz in #44
• docs: reconcile current test count by @cvsz in #45
• ci: set CodeQL read-only baseline by @cvsz in #46
• docs: record current validation evidence by @cvsz in #47
• feat: add source-backed multimodal artifact slice by @cvsz in #48
• docs: reconcile merged multimodal evidence by @cvsz in #49
• feat: add bounded glTF artifact evidence by @cvsz in #50
• docs: record hosted glTF verification by @cvsz in #51
• docs: record current runtime and release evidence by @cvsz in #52
• Harden runtime secrets, staging boundaries, and local speech evidence by @cvsz in #53
• fix: harden CI runtime and audit availability handling by @cvsz in #54
• Feature/ai futures superintelligence by @cvsz in #55
• Harden World Room CI and local security boundary by @cvsz in #74
• chore(deps): update psycopg requirement from <4.0.0,>=3.2.0 to >=3.3.5,<4.0.0 by @dependabot[bot] in #68
• chore(deps): update cryptography requirement from <51.0.0,>=46.0.7 to >=50.0.1,<51.0.0 by @dependabot[bot] in #61
• chore(deps-dev): bump electron from 44.1.0 to 44.3.0 by @dependabot[bot] in #57
• chore(deps): bump github/codeql-action from 3 to 4 by @dependabot[bot] in #70
• ci(supply-chain): attest published container provenance by @cvsz in #75
• chore(deps): bump softprops/action-gh-release from 2 to 3 by @dependabot[bot] in #71
• chore(deps): update uvicorn requirement from <1.0.0,>=0.34.0 to >=0.52.4,<1.0.0 by @dependabot[bot] in #69
• chore(deps-dev): update pytest requirement from >=7.0.0 to >=9.1.1 by @dependabot[bot] in #67
• chore(deps-dev): update z3-solver requirement from >=4.12.0 to >=5.1.0.0 by @dependabot[bot] in #66
• chore(deps-dev): update setuptools requirement from >=61.0 to >=84.0.0 by @dependabot[bot] in #62
• chore(deps): update redis requirement from <7.0.0,>=5.0.0 to >=8.1.0,<9.0.0 by @dependabot[bot] in #60
• chore(deps): bump three from 0.179.1 to 0.186.0 by @dependabot[bot] in #59
• chore(deps-dev): update black requirement from >=23.0.0 to >=26.5.1 by @dependabot[bot] in #65
• chore(deps): update pydantic requirement from <3.0.0,>=2.8.0 to >=2.13.5,<3.0.0 by @dependabot[bot] in #64
• chore(deps): bump actions/dependency-review-action from 4 to 5 by @dependabot[bot] in #56
• chore(deps): update fastapi requirement from <1.0.0,>=0.115.0 to >=0.141.1,<1.0.0 by @dependabot[bot] in #63
• chore(deps): bump actions/download-artifact from 4 to 8 by @dependabot[bot] in #72
• ci(security): gate container publish on vulnerability and secret scans by @cvsz in #76
• test(prod-readiness): add reference corpora and security evidence pack by @cvsz in #77
• feat: add zasi ECC bundle by @ECC-Tools[bot] in #30
• ci(release): fail closed on missing production GO evidence by @cvsz in #79
• fix(release): reject stale staging production evidence by @cvsz in #80
• security(legacy): require bearer auth for compatibility HUD by @cvsz in #81
• ci(supply-chain): pin release actions to immutable commits by @cvsz in #82
• ci(security): pin CodeQL actions to immutable commits by @cvsz in #83
• ci(supply-chain): pin primary CI actions to immutable commits by @cvsz in #84
• ci(supply-chain): enforce immutable actions repository-wide by @cvsz in #85
• fix(runtime): enforce single authoritative port ownership by @cvsz in #86
• test(identity): prove durable restart state by @cvsz in #87
• security(events): keep outbox claim credentials internal by @cvsz in #88
• security(world-room): sanitize upstream failure surfaces by @cvsz in #89
• security(world-room): enforce trusted browser origin by @cvsz in #90
• security(persistence): redact worker credentials before durable storage by @cvsz in #91
• security(events): redact durable audit and event payloads by @cvsz in #92
• security(api): redact public HTTP error payloads by @cvsz in #93
• security(electron): close backend log credential leak by @cvsz in #94
• test(identity): consolidate P1 foundation acceptance evidence by @cvsz in #95
• security(governance): require live main ruleset for production GO by @cvsz in #96
• security(governance): require complete production check set by @cvsz in #97
• security(governance): add reproducible main ruleset bootstrap by @cvsz in #98
• security(release): bind staging evidence to deployed origin by @cvsz in #99
• security(release): bind candidate evidence to deployed digest by @cvsz in #100
• security(release): require observed staging release identity by @cvsz in #101
• security(release): verify rollback runtime digest by @cvsz in #102
• security(release): bind staging evidence to one timeline by @cvsz in #103
• security(release): verify post-rollback health identity by @cvsz in #104
• security(release): bind World Room evidence to canonical endpoint by @cvsz in #105
• security(release): add external canary measurement provenance by @cvsz in #106
• docs(arin): establish Project Center and master architecture by @cvsz in #107
• test(arin): gate reference corpus with deterministic evidence contracts by @cvsz in #108
• docs(arin): begin exact capability matrix with zknowbase by @cvsz in #109
• docs(arin): record exact-head ZARVIS source assessment by @cvsz in #110
• docs(arin): record bounded ZCoder source assessment by @cvsz in #111
• docs(arin): record bounded zDash source assessment by @cvsz in #112
• security(canary): integrity-bind external measurement artifacts by @cvsz in #113
• docs(arin): record bounded zAnything source assessment by @cvsz in #114
• feat(arin): establish bounded zknowbase read contract by @cvsz in #115
• feat(arin): add bounded zknowbase read transport by @cvsz in #122
• feat(arin): map zknowbase citations into evidence by @cvsz in #123
• feat(arin): gate zknowbase writes behind scope and policy by @cvsz in #124
• feat(arin): define safe degraded zknowbase reads by @cvsz in #125
• docs(arin): extract bounded ZCoder security requirements by @cvsz in #126
• feat(arin): define fail-closed tool capability descriptors by @cvsz in #127
• test(arin): prove denied tool authorities stay denied by @cvsz in #128
• docs(arin): propose bounded ZCoder tool adapter ADR by @cvsz in #129
• test(arin): define bounded ZCoder adapter contract by @cvsz in #130
• docs(arin): reconcile verified Task 6 adapter evidence by @cvsz in #131
• test(arin): define fail-closed local tool transport by @cvsz in #132
• docs(arin): record verified local tool transport by @cvsz in #133
• docs(arin): reconcile Project Center evidence truth by @cvsz in #134
• docs(arin): reconcile verified Project Center plan state by @cvsz in #135
• docs(arin): inventory legacy identity compatibility by @cvsz in #136
• chore(deps-dev): update httpx requirement from <1.0.0,>=0.28.0 to >=0.28.1,<1.0.0 by @dependabot[bot] in #116
• chore(deps): bump react and @types/react by @dependabot[bot] in #117
• chore(deps-dev): bump vite from 8.2.2 to 8.3.0 by @dependabot[bot] in #118
• chore(deps): bump react-dom and @types/react-dom by @dependabot[bot] in #119
• chore(deps-dev): bump @types/three from 0.179.0 to 0.186.0 by @dependabot[bot] in #120
• chore(deps): bump actions/upload-artifact from 4.6.2 to 7.0.1 by @dependabot[bot] in #121
• test(arin): lock legacy JARVIS compatibility routes by @cvsz in #137
• docs(arin): verify legacy route regression evidence by @cvsz in #138
• feat(arin): establish v1 canonical contract envelope by @cvsz in #139
• feat(arin): generate canonical v1 contract artifacts by @cvsz in #141
• docs(arin): reconcile Task 4 artifact evidence by @cvsz in #142
• test(arin): close Task 4 v1 compatibility gap by @cvsz in #143
• test(arin): reapply Task 4 contract compatibility closure by @cvsz in #145
• fix(release): build cockpit before wheel install in release job by @cvsz in #146
• evidence(staging): v32.0.2 production GO exercise by @cvsz in #147
• fix(release): allow loopback pinentry for CI signing by @cvsz in #148
• evidence(staging): v32.0.2 GO exercise round 2 (candidate 38e7f65) by @cvsz in #149

New Contributors

• @dependabot[bot] made their first contribution in #1
• @ECC-Tools[bot] made their first contribution in #30

Full Changelog: v32.0.0...v32.0.2