v0.3.0

0.3.0 (2026-09-03)

Features

• phase-a: derive public gate authority (#123) (9aa9a56)

Bug Fixes

• ci: attest release provenance only on public repos (#134) (9a2b090)
• ci: make the dependabot auto-merge guard refuse instead of merging (#90) (37d3f1b), closes #89
• ci: name the sha's real version on every action pin (#119) (254f210)
• ci: run CI on a pull request whose base is not main (#92) (4358b47)
• control: validate registration responses into an exhaustive state machine (#95) (35f1b1f)
• deps: pin koinon to v0.1.0 and clear the mechanical lint-baseline entries (#73) (8850220), closes #57 #61
• deps: regenerate Cargo.lock so koinon matches the v0.2.0 the manifest already declares (#124) (6622e4c)
• dictyon: bound control-connection establishment with a deadline (#76) (62596f7), closes #52
• dictyon: index peer removals and refuse to frame an unframable payload (#78) (3f6011b), closes #55
• dictyon: reject an over-limit key response before buffering it (#79) (3ecf9ce), closes #55
• dictyon: validate server-supplied key-hex and routing-data fields at netmap ingestion (#97) (2f0bd71)
• gate-attestation: pin hybrid-gate.yml call to a SHA, closing the lint-debt gap (#91) (32d4488)
• hamma-core: decode a Node with no Addresses instead of failing the map update (#72) (f8ef9b2)
• hamma-core: drop a dead allow suppressing a lint that never fires (#80) (fa1ddfb), closes #57
• hamma-core: enforce the documented config ranges at the deserialize boundary (#77) (f3b2335)
• hamma-core: redact the pre-auth key from AuthInfo debug output (#74) (9b0b747), closes #57
• handshake: chunked AsyncRead header reader (#81) (00c38b9), closes #55
• lint: burn down the kanon-lint debt baseline and delete it (#86) (8c420f3), closes #57
• llms: classify dictyon as a library, not a CLI, in the discovery corpus (#87) (c1f7815), closes #85
• mitos: zeroize AuthInfo::auth_key on drop (#93) (a39bca4)
• noise: add FrameTooLarge error taxonomy (#83) (e023a1a), closes #55
• noise: validate hex length before allocation (#82) (8b8bad6), closes #55
• release: derive the path-dep version pin release-please patches (#75) (043cb5a)
• release: drop the component/package-name fields that wedge release-please (#121) (6b7380f)

Documentation

• refresh the _llm state corpus and README status against the tree (#120) (20a7195)