v0.6.0

What's Changed

• chore: lower the code-scan ratchet to 107 open issues by @ffroliva in #76
• docs: actions follow BootUI, MCP lists action tools gated per panel by @ffroliva in #85
• docs: every review includes a maintainability pass by @ffroliva in #86
• fix: the fleet names why a box could not be created by @ffroliva in #87
• chore(deps): Dependabot batch 2026-11-09 by @ffroliva in #88
• chore(deps): bump softprops/action-gh-release from 3.0.3 to 3.0.4 by @dependabot[bot] in #77
• chore(deps): bump SonarSource/sonarqube-scan-action from 8.4.0 to 8.4.1 by @dependabot[bot] in #78
• chore(deps): bump astral-sh/setup-uv from 5.4.2 to 10.3.3 by @dependabot[bot] in #79
• chore(deps): bump the ui-dependencies group in /ui with 5 updates by @dependabot[bot] in #81
• docs: retrospective for the source-over-docs skill rules by @ffroliva in #74
• chore: repo hardening (Scorecard, zizmor and actionlint, CODEOWNERS) by @ffroliva in #71
• test: harness self-tests never write the real overhead log by @ffroliva in #89
• fix: MCP negotiates only the protocol revision it serves by @ffroliva in #90
• fix: the pytest cache never writes into the cwd mid-test by @ffroliva in #91
• ci: JUnit and overhead uploads, live split per server, docs-only skip, order-safe layout test by @ffroliva in #92
• fix: nested-run tests carry a 300 s timeout (Windows 'worker crashed' was the 60 s default) by @ffroliva in #93
• refactor: split the FastAPI introspector before it grows by @ffroliva in #94
• test: golden fixtures by version; 2.3.0 shape rules for 2.3.0 evidence by @ffroliva in #95
• refactor: split settings by family; classify every field for warnings by @ffroliva in #96
• test: BootUI 2.3.0 enumerations captured from the pinned tag by @ffroliva in #97
• docs: document every tool, setting and extra, checked by tests by @ffroliva in #98
• fix: two tests that broke parallel runs by @ffroliva in #99
• ci: dispatchable CI and a live-check aggregator by @ffroliva in #100
• test: the BootUI test catalog covers classes outside src/test by @ffroliva in #101
• ci: the full-extras leg installs every optional integration by @ffroliva in #102
• ci: uploads are scanned for planted values first by @ffroliva in #103
• test: a patched golden root still selects the fixture version by @ffroliva in #104
• perf: the linearity gate measures each size once per attempt (W0b T7) by @ffroliva in #105
• fix: the golden sanitiser is ready for BootUI 2.3.0 captures (W2a T1) by @ffroliva in #106
• perf: the mutant harness computes each unmutated base once per worker (W0b T8) by @ffroliva in #108
• feat: a guarded live BootUI capture and a machine-values leak gate (W2a T2-T3) by @ffroliva in #107
• test: BootUI 2.3.0 live goldens with a completeness test (W2a T4) by @ffroliva in #111
• test: settings and tool catalogue parity with BootUI 2.3.0 (W3 wave A) by @ffroliva in #110
• feat: a capture-hook registry with suspend and resume (W4 Wave 0) by @ffroliva in #112
• test: parity tests carry their tracker row keys (W3) by @ffroliva in #113
• refactor: rest-api advisor rules split by family (W3 B0) by @ffroliva in #114
• test: panel route parity with BootUI 2.3.0 goldens (W3 C1) by @ffroliva in #116
• chore: ci_walls, the attempt-1 CI critical-path table (W0b T1) by @ffroliva in #115
• test: REST API rule parity with BootUI 2.3.0 (W3 B) by @ffroliva in #118
• docs: the safety gate, with its exit behaviour pinned (W9 T1) by @ffroliva in #117
• feat: runtime journal (W5a core) by @ffroliva in #119
• test: architecture rule parity with BootUI 2.3.0 (W3 B) by @ffroliva in #121
• chore: register W5b wave-1 panel slots (W5b lane 0) by @ffroliva in #122
• test: security rule parity with BootUI 2.3.0 (W3 B) by @ffroliva in #120
• test: security test citations name catalogued BootUI tests or say derived by @ffroliva in #123
• feat: low-footprint mode and Live Memory controls (W4 L) by @ffroliva in #125
• test: interpreter-state gate and side-effect guard for sensors (W6 S0) by @ffroliva in #124
• perf: lane-gate tests on an in-memory fake git (W0b T6) by @ffroliva in #126
• feat: startup timeline panel (W5b lane S) by @ffroliva in #127
• chore: W7 wave 0 panel slots for copilot, claude-code, github and ai by @ffroliva in #129
• feat: W6 S1 sys.monitoring tool-id allocator; swallowed.py goes through it by @ffroliva in #128
• feat: W7 A AI panel over GenAI spans and AI journal events by @ffroliva in #134
• feat: W7 S agent sessions: Copilot and Claude Code panels and session streams by @ffroliva in #136
• feat: W5b P profile diff over the app's .env. files by @ffroliva in #133
• ci: record pytest-speed fixture times and rebuild counts on every CI pytest run by @ffroliva in #135
• chore: W8 A0 action-capable panels and the W8 action settings by @ffroliva in #140
• feat: W5b E1 REST API error contract by @ffroliva in #130
• feat: W9 safety-gate docs, SARIF 2.1.0 writer, STARTUP/SHUTDOWN SQL phases by @ffroliva in #138
• chore: W5c I0 runtime-insights panel slot, 28 kind stubs, kind import rule, settings by @ffroliva in #141
• feat: W5b C scheduled tasks panel from in-process schedulers by @ffroliva in #139
• feat: W5b M metrics panel over the host Prometheus registry by @ffroliva in #131
• feat: W7 G1 GitHub dashboard from local repository state by @ffroliva in #132
• feat: runtime insights snapshot, checks and coverage (W5c I1) by @ffroliva in #143
• feat: W7 G2 GitHub refresh action (REST only) by @ffroliva in #142
• feat: W6 S2 agent-sensor floor: panels, routes, actions and tools answer BootUI's unavailable shapes by @ffroliva in #137
• fix: the insights read budget runs alone with the timing files by @ffroliva in #148
• feat: RAPI-ERR rules read the error contract (W5b E2) by @ffroliva in #146
• feat: config override layer and overrides file (W8 O1) by @ffroliva in #144
• feat: runtime insights routes, tools and the resource-profile floor (W5c I2) by @ffroliva in #147
• feat: cache clear action for in-process caches (W8 K1) by @ffroliva in #145
• feat: config override routes (W8 O2) by @ffroliva in #149
• feat: runtime insight ai-usage-by-route (W5c K9) by @ffroliva in #152
• feat: Alembic migrate action (W8 M1) by @ffroliva in #150
• feat: http journal producer (W5a P-http) by @ffroliva in #153
• fix: no_side_effects ignores pytest's cache staging dir by @ffroliva in #154
• feat: resident audit hook with processes and files sensors (W6 S3) by @ffroliva in #151
• feat: sql journal producer (W5a P-sql) by @ffroliva in #155
• chore(ci): PR CI 10.8 -> 6.7 min (sqlite heap-walk fix, shard weights); 3-5 min needs owner layout calls by @ffroliva in #156
• feat(w8): Alembic clean (downgrade base), off by default, one flight with migrate by @ffroliva in #157
• feat(w7): shared class-method wrap helper for capture integrations (E0) by @ffroliva in #159
• feat(w5c): runtime insight errors-behind-2xx; exception-hotspots and framework-warnings-by-route not applicable (K2) by @ffroliva in #160
• feat(w5c): runtime insight route-time-breakdown on the monotonic clocks, shared request join (K1) by @ffroliva in #161
• chore(ci): locked Ubuntu 3.12/3.14 legs run on push only; release/** pushes run the full matrix by @ffroliva in #163
• feat(w5a): exception journal producer, metadata-only, never raises into the host (P-exception) by @ffroliva in #162
• fix(ci): a release/** push is not held to main's code-scan baseline by @ffroliva in #165
• feat(w7): email panel: capture at smtplib/aiosmtplib, dev trap that never connects, masked .eml (E) by @ffroliva in #164
• feat(w5a): log journal producer, runs whenever the journal records log (P-log) by @ffroliva in #168
• feat(w5c): safe-method-dml evaluates; lazy-sql-after-handler answers not applicable honestly (K4a) by @ffroliva in #170
• fix(w5c): a journal source is insights evidence only while its panel is enabled (I-visible) by @ffroliva in #171
• feat(w5c): exception-hotspots and framework-warnings-by-route evaluate over the exception and log sources (K2b) by @ffroliva in #169
• chore(ci): refresh shard weights from release run 43307896140 by @ffroliva in #174
• chore(ci): refresh shard weights for both platforms from release run 43368074431 by @ffroliva in #180
• docs: AGENTS.md workflow rule: port BootUI, do not reinvent by @ffroliva in #173
• fix: an offer made by a thread that holds the journal lock is refused and counted reentrant by @ffroliva in #178
• fix: Runtime Insights report SQL capture as DISABLED when the SQL trace flag or panel is off (BootUI SqlCapture) by @ffroliva in #172
• fix: the log handler holds no lock across the journal offer (deadlock with a finalizer that logs) by @ffroliva in #177
• fix: Runtime Insights leave out requests that started before evicted events (BootUI LEFT_OUT_BEFORE_LOSS) by @ffroliva in #181
• fix: the dev email trap wraps an aiosmtplib imported after install; non-ASCII addresses are captured by @ffroliva in #182
• feat: the connection journal source and the connections-per-request insight (BootUI ConnectionPayload, ConnectionsPerRequest) by @ffroliva in #184
• fix: a SQL check is not recorded where this app's SQL is not recorded (BootUI SqlCapture NOT_RECORDED) by @ffroliva in #185
• docs + chore: 0.6.0 doc audit, README voice and release prep by @ffroliva in #186
• chore: release 0.6.0 by @ffroliva in #187

Full Changelog: v0.5.0...v0.6.0