v0.3.1

🐛 Fixes

• fix(guard): a2a r07 — half-window overlap, pinned gitleaks checksum, every page must be stamped (ccd24fc)
• fix(guard): a2a r07 — constant-time token, only /validate and /profiles, shape before logging, anchored verdict, no foreign default host (da29932)
• fix(webhook): a2a r07 — release stranded claims, publish paid verdicts, pin or stop, one job clock, one run per issue (cf8f438)
• fix(gate): a2a r07 — the script gate is an allowlist of the template, not a denylist (cfd31ce)

🧪 Tests

• test: complete comment and reproduction branch coverage (c43cddf)
• test: exercise API routes and webhook failure paths (23f39d9)
• test: pin GitHub and Otari client edge cases (2530aac)

📝 Docs

• docs: 147 tests at 100% line, branch and function coverage (1475c74)

🔧 CI and chores

• refactor: a2a r07 — one definition of the REPRODUCED marker (glm); counts → 166 tests (a28b8e1)
• ci: a2a r07 — smoke requires the exact commit, the repo stays unversioned, docs match the allowlist gate (b3be315)
• ci: require complete line branch and function coverage (3db7192)

Full diff: v0.3.0...HEAD

---

Deployed to https://allowance.edycu.dev at a28b8e1 after all 6 CI stages passed.