v0.20.0
v0.20.0: 4 fixes, 6 features, 4 docs.
Fixes
- alias raw-hex UI values to smithy tokens (#368) (#370) (#368 #370)
- back off + retry on GitHub GraphQL rate limits (#360) (#366) (#360 #366)
- teach the license gate to see the Python dep tree (#349) (#357) (#349 #357)
- bump the README version badge in lockstep with the release (#341) (#341)
Features
- browser UI — split cockpit (#354) (#369) (#354 #369)
- PTY-over-websocket terminal bridge (#353) (#364) (#353 #364)
- harden the loopback backend (DNS-rebinding / CSRF / origin) (#352) (#363) (#352 #363)
- serve the Python cores over a 127.0.0.1 FastAPI backend (#351) (#362) (#351 #362)
- retire PySide6/PyInstaller — remove the LGPL artifact ahead of the web-app rebuild (#355) (#359) (#355 #359)
- add a license-compliance gate (SPDX allowlist) and register it (#345) (#345)
Docs
- cockpit UI split-cockpit visual spec (#354) (#367) (#354 #367)
- document the local-web-app model + reconcile ADR cross-refs (#356) (#365) (#356 #365)
- teach the denylist escalation path in role cards + delivery brief (#358) (#358)
- cockpit re-architecture findings + ADR-0008 (#344) (#348) (#344 #348)
Deploy notes
- Infra changed: no
- Migrations to run: no