v0.42.0

0.42.0 (2026-09-12)

Features

• devflow: persist effective finder set as run evidence (#906) (98cf6c4)

Bug Fixes

• devflow: align monitor trust checks with registry contract (#896) (54a9f86)
• devflow: correct three wrong-verdict bugs in consumer-pin-audit (#897) (51f4666)
• devflow: harden consumer-pin-audit against seven open defects (#905) (de7c0d4)
• devflow: harden consumer-pin-audit input validation (#889) (ecc24d9)
• devflow: stop counting confidence finders against breadth envelope (#900) (3d5060c), closes #807
• hooks: replace SIGPIPE-vulnerable pipelines with herestrings (#895) (f159c6b), closes #822 #689
• make agent isolation optional (#886) (9d5948e)
• registry: reject shadowed severity rules and invalid regex signals (#891) (ac260f7)
• restrict Codex judgment-role capabilities (#884) (1d2123d)
• review: harden finder-normalization decoder evidence binding (#894) (b32b733)
• review: harden sandbox scope binding and submodule checks (#890) (9edad16)
• tasks: de-duplicate test suites that task verify runs twice (#903) (19c0966), closes #823