forkwright · forkwright · Jul 6, 2026 · Jul 6, 2026
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.1.11"
+  ".": "0.1.12"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,49 @@
 # Changelog
 
+## [0.1.12](https://github.com/forkwright/harmonia/compare/v0.1.11...v0.1.12) (2026-07-06)
+
+
+### Features
+
+* **horismos:** reactive config core — leaf diff, held-back merge, Section, ReloadOutcome ([#529](https://github.com/forkwright/harmonia/issues/529) step 1) ([#563](https://github.com/forkwright/harmonia/issues/563)) ([6f72e5f](https://github.com/forkwright/harmonia/commit/6f72e5f4e2733f6998d1fb5b0cf6aeaad60961f9))
+* **zetesis:** wire Cardigann definition-driven indexer client ([#512](https://github.com/forkwright/harmonia/issues/512)) ([b53885a](https://github.com/forkwright/harmonia/commit/b53885ad690c3e9207cde0df3fcc1a7626c8fa34))
+
+
+### Bug Fixes
+
+* **acquisition:** low-severity audit batch findings (zetesis/ergasia/syntaxis/aitesis/syndesmos) ([#503](https://github.com/forkwright/harmonia/issues/503)) ([2a112c1](https://github.com/forkwright/harmonia/commit/2a112c1608b396434ad6017d34c0f7ebe1533725)), closes [#447](https://github.com/forkwright/harmonia/issues/447) [#381](https://github.com/forkwright/harmonia/issues/381) [#461](https://github.com/forkwright/harmonia/issues/461) [#446](https://github.com/forkwright/harmonia/issues/446) [#435](https://github.com/forkwright/harmonia/issues/435) [#445](https://github.com/forkwright/harmonia/issues/445)
+* **aitesis:** atomic approval workflow and request authorization ([#487](https://github.com/forkwright/harmonia/issues/487)) ([a27fd12](https://github.com/forkwright/harmonia/commit/a27fd12d498c181e47573657131a1d840445f43a)), closes [#395](https://github.com/forkwright/harmonia/issues/395) [#396](https://github.com/forkwright/harmonia/issues/396) [#397](https://github.com/forkwright/harmonia/issues/397)
+* **aitesis:** compare-and-swap request status to close approval lost-update race ([#560](https://github.com/forkwright/harmonia/issues/560)) ([77a3a5e](https://github.com/forkwright/harmonia/commit/77a3a5ea5515156d23f1b42d7288ffc433f286f7))
+* **akouo:** playback-engine correctness (real seek, decode-failure signaling) ([#485](https://github.com/forkwright/harmonia/issues/485)) ([8c027af](https://github.com/forkwright/harmonia/commit/8c027af3508b115d786bbe6d84948ea39c701bd0)), closes [#386](https://github.com/forkwright/harmonia/issues/386) [#387](https://github.com/forkwright/harmonia/issues/387) [#398](https://github.com/forkwright/harmonia/issues/398) [#399](https://github.com/forkwright/harmonia/issues/399) [#400](https://github.com/forkwright/harmonia/issues/400) [#401](https://github.com/forkwright/harmonia/issues/401) [#402](https://github.com/forkwright/harmonia/issues/402) [#403](https://github.com/forkwright/harmonia/issues/403) [#404](https://github.com/forkwright/harmonia/issues/404)
+* **akouo:** propagate real underruns, stop audio on pause, honor buffer_size ([#562](https://github.com/forkwright/harmonia/issues/562)) ([ddd5097](https://github.com/forkwright/harmonia/commit/ddd509763debea89903b97c2f4d41a583b8f4c93))
+* **apotheke:** guard single-row writes against zero-row match ([#507](https://github.com/forkwright/harmonia/issues/507)) ([29a97cc](https://github.com/forkwright/harmonia/commit/29a97cce8cca38e81c0053773b2dd1782d3933fd)), closes [#492](https://github.com/forkwright/harmonia/issues/492)
+* **apotheke:** guard want.rs and play_history single-row writes against zero-row match ([#561](https://github.com/forkwright/harmonia/issues/561)) ([3277278](https://github.com/forkwright/harmonia/commit/32772784302d66a3ded24cad75a834f9defdea6a)), closes [#538](https://github.com/forkwright/harmonia/issues/538) [#552](https://github.com/forkwright/harmonia/issues/552)
+* **apotheke:** period-scoped stats, checked writes, transactional streaks ([#496](https://github.com/forkwright/harmonia/issues/496)) ([9673863](https://github.com/forkwright/harmonia/commit/96738635818182f0c55974c2e1922dcb6422f571)), closes [#405](https://github.com/forkwright/harmonia/issues/405) [#406](https://github.com/forkwright/harmonia/issues/406) [#407](https://github.com/forkwright/harmonia/issues/407) [#450](https://github.com/forkwright/harmonia/issues/450) [#451](https://github.com/forkwright/harmonia/issues/451)
+* **archon:** render reliability and wire metadata/queue/curation traits ([#497](https://github.com/forkwright/harmonia/issues/497)) ([9a57b03](https://github.com/forkwright/harmonia/commit/9a57b0366d7dcda369c15db864e161272cdbe807)), closes [#388](https://github.com/forkwright/harmonia/issues/388) [#408](https://github.com/forkwright/harmonia/issues/408) [#409](https://github.com/forkwright/harmonia/issues/409) [#410](https://github.com/forkwright/harmonia/issues/410) [#411](https://github.com/forkwright/harmonia/issues/411) [#412](https://github.com/forkwright/harmonia/issues/412) [#468](https://github.com/forkwright/harmonia/issues/468) [#469](https://github.com/forkwright/harmonia/issues/469) [#470](https://github.com/forkwright/harmonia/issues/470)
+* **archon:** secure renderer TLS/QUIC transport (cert pinning, peer auth) ([#486](https://github.com/forkwright/harmonia/issues/486)) ([cf1fb43](https://github.com/forkwright/harmonia/commit/cf1fb43b4c26c358152152e1b58fcf2579a0b9e2)), closes [#389](https://github.com/forkwright/harmonia/issues/389) [#413](https://github.com/forkwright/harmonia/issues/413) [#414](https://github.com/forkwright/harmonia/issues/414) [#415](https://github.com/forkwright/harmonia/issues/415)
+* **core:** low-severity audit batch findings (exousia/horismos/apotheke/kritike) ([#502](https://github.com/forkwright/harmonia/issues/502)) ([790617a](https://github.com/forkwright/harmonia/commit/790617aedb09a3e5b0c56853295105899456114d))
+* **epignosis:** metadata provider correctness (TVDB cache, TMDB cross-ref, AcoustID) ([#494](https://github.com/forkwright/harmonia/issues/494)) ([58efa38](https://github.com/forkwright/harmonia/commit/58efa38aec3d671b455a42eedd5a1cc014f61249)), closes [#416](https://github.com/forkwright/harmonia/issues/416) [#417](https://github.com/forkwright/harmonia/issues/417) [#471](https://github.com/forkwright/harmonia/issues/471) [#458](https://github.com/forkwright/harmonia/issues/458)
+* **epignosis:** reject non-success HTTP responses and deflake rate-limit test ([#506](https://github.com/forkwright/harmonia/issues/506)) ([995208b](https://github.com/forkwright/harmonia/commit/995208b1bebc539a5f136b93de50192643cb41d4)), closes [#498](https://github.com/forkwright/harmonia/issues/498) [#482](https://github.com/forkwright/harmonia/issues/482)
+* **ergasia:** download filesystem safety (reconciliation, disk guard, zip-slip) ([#491](https://github.com/forkwright/harmonia/issues/491)) ([f8ec16e](https://github.com/forkwright/harmonia/commit/f8ec16eaae1ad38b444a43163c92ac80830a5193)), closes [#360](https://github.com/forkwright/harmonia/issues/360) [#365](https://github.com/forkwright/harmonia/issues/365) [#366](https://github.com/forkwright/harmonia/issues/366) [#367](https://github.com/forkwright/harmonia/issues/367) [#452](https://github.com/forkwright/harmonia/issues/452) [#453](https://github.com/forkwright/harmonia/issues/453) [#454](https://github.com/forkwright/harmonia/issues/454)
+* **ergasia:** validate archive entries and enforce extraction byte caps ([#555](https://github.com/forkwright/harmonia/issues/555)) ([3353751](https://github.com/forkwright/harmonia/commit/33537511e412ae90faecaa7f4b2d5fefa0579ef5))
+* **exousia:** harden auth paths (constant-time keys, DB-authoritative bearer, refresh TOCTOU) ([#476](https://github.com/forkwright/harmonia/issues/476)) ([fae78ab](https://github.com/forkwright/harmonia/commit/fae78abb8d93bb3e6e0f9e2f680610edd38d8015)), closes [#473](https://github.com/forkwright/harmonia/issues/473) [#418](https://github.com/forkwright/harmonia/issues/418) [#419](https://github.com/forkwright/harmonia/issues/419) [#420](https://github.com/forkwright/harmonia/issues/420)
+* **komide:** bound feed/episode fetch, fix backoff overflow, add coverage ([#495](https://github.com/forkwright/harmonia/issues/495)) ([bb59ff4](https://github.com/forkwright/harmonia/commit/bb59ff40e44e64fe2622c1f8b3ab0a985f64b1bd)), closes [#368](https://github.com/forkwright/harmonia/issues/368) [#369](https://github.com/forkwright/harmonia/issues/369) [#370](https://github.com/forkwright/harmonia/issues/370) [#371](https://github.com/forkwright/harmonia/issues/371) [#455](https://github.com/forkwright/harmonia/issues/455) [#456](https://github.com/forkwright/harmonia/issues/456)
+* **media:** low-severity audit batch findings (komide/epignosis/prostheke) ([#504](https://github.com/forkwright/harmonia/issues/504)) ([9405fb6](https://github.com/forkwright/harmonia/commit/9405fb62fe45ff5954f286df71733056510d82af)), closes [#382](https://github.com/forkwright/harmonia/issues/382) [#464](https://github.com/forkwright/harmonia/issues/464) [#440](https://github.com/forkwright/harmonia/issues/440) [#444](https://github.com/forkwright/harmonia/issues/444) [#466](https://github.com/forkwright/harmonia/issues/466)
+* **paroche:** accept repeated Subsonic playlist song params ([#509](https://github.com/forkwright/harmonia/issues/509)) ([86e421e](https://github.com/forkwright/harmonia/commit/86e421e37662a6e5f08f221d88ee1d9b11b3baa7)), closes [#477](https://github.com/forkwright/harmonia/issues/477)
+* **paroche:** authenticate endpoints, SSRF guard, real pagination, transactional writes ([#483](https://github.com/forkwright/harmonia/issues/483)) ([7faa6ca](https://github.com/forkwright/harmonia/commit/7faa6ca4181ea1fa5f72c754f24936130f021af1)), closes [#361](https://github.com/forkwright/harmonia/issues/361) [#372](https://github.com/forkwright/harmonia/issues/372) [#373](https://github.com/forkwright/harmonia/issues/373) [#374](https://github.com/forkwright/harmonia/issues/374) [#375](https://github.com/forkwright/harmonia/issues/375) [#457](https://github.com/forkwright/harmonia/issues/457)
+* **paroche:** close IPv4-compatible-IPv6 SSRF bypass and resolve magnet trackers ([#511](https://github.com/forkwright/harmonia/issues/511)) ([9ea2ec2](https://github.com/forkwright/harmonia/commit/9ea2ec2e602d4d1c59a152bba23b8b0308aeb51b)), closes [#479](https://github.com/forkwright/harmonia/issues/479)
+* **paroche:** report real list totals instead of page-slice length ([#508](https://github.com/forkwright/harmonia/issues/508)) ([2056a1c](https://github.com/forkwright/harmonia/commit/2056a1ce0ba97c1bac0216c7c9d3b0fdaede621d)), closes [#478](https://github.com/forkwright/harmonia/issues/478)
+* **paroche:** route enqueue_download through the live download queue ([#510](https://github.com/forkwright/harmonia/issues/510)) ([5356330](https://github.com/forkwright/harmonia/commit/5356330cd0a01c23983ceea91794542268ecec47)), closes [#499](https://github.com/forkwright/harmonia/issues/499)
+* **paroche:** scope get_request to caller and redact indexer creds in download_url ([#558](https://github.com/forkwright/harmonia/issues/558)) ([eb906b2](https://github.com/forkwright/harmonia/commit/eb906b2d09fffb3658345029fe937e042e8193b1))
+* **serving:** low-severity audit batch findings (paroche/syndesis/archon/akouo) ([#505](https://github.com/forkwright/harmonia/issues/505)) ([8b6c86f](https://github.com/forkwright/harmonia/commit/8b6c86f85194b78dc5a26929406c52e574ccfa4c)), closes [#383](https://github.com/forkwright/harmonia/issues/383) [#465](https://github.com/forkwright/harmonia/issues/465) [#384](https://github.com/forkwright/harmonia/issues/384) [#439](https://github.com/forkwright/harmonia/issues/439) [#437](https://github.com/forkwright/harmonia/issues/437) [#436](https://github.com/forkwright/harmonia/issues/436)
+* **syndesis:** secure renderer client (pinned TLS, reassembly, bounded buffers) ([#484](https://github.com/forkwright/harmonia/issues/484)) ([e71cd8d](https://github.com/forkwright/harmonia/commit/e71cd8d6384eb97a77b4903658a2e52395e644ba)), closes [#362](https://github.com/forkwright/harmonia/issues/362) [#363](https://github.com/forkwright/harmonia/issues/363) [#364](https://github.com/forkwright/harmonia/issues/364) [#376](https://github.com/forkwright/harmonia/issues/376) [#377](https://github.com/forkwright/harmonia/issues/377) [#378](https://github.com/forkwright/harmonia/issues/378) [#379](https://github.com/forkwright/harmonia/issues/379) [#380](https://github.com/forkwright/harmonia/issues/380)
+* **syndesmos:** correct Last.fm and Tidal integrations ([#481](https://github.com/forkwright/harmonia/issues/481)) ([da2afc3](https://github.com/forkwright/harmonia/commit/da2afc3c612efc6fcf259e246aab08357c5b0b7e)), closes [#390](https://github.com/forkwright/harmonia/issues/390) [#391](https://github.com/forkwright/harmonia/issues/391) [#392](https://github.com/forkwright/harmonia/issues/392) [#421](https://github.com/forkwright/harmonia/issues/421) [#422](https://github.com/forkwright/harmonia/issues/422) [#423](https://github.com/forkwright/harmonia/issues/423)
+* **syntaxis:** async mock extract to match ergasia DownloadEngine trait ([#493](https://github.com/forkwright/harmonia/issues/493)) ([593758e](https://github.com/forkwright/harmonia/commit/593758e97c28b6960ff28edbd7d281c155365e8f))
+* **syntaxis:** correct download dispatch (slot leaks, retry wakeup, protocol guard) ([#489](https://github.com/forkwright/harmonia/issues/489)) ([e11fd19](https://github.com/forkwright/harmonia/commit/e11fd19f1811ac45e71fd47e67b6d99d7b64efbe)), closes [#393](https://github.com/forkwright/harmonia/issues/393) [#394](https://github.com/forkwright/harmonia/issues/394) [#424](https://github.com/forkwright/harmonia/issues/424) [#425](https://github.com/forkwright/harmonia/issues/425) [#426](https://github.com/forkwright/harmonia/issues/426) [#427](https://github.com/forkwright/harmonia/issues/427) [#428](https://github.com/forkwright/harmonia/issues/428)
+* **syntaxis:** dispatch recovered items and close retry/cancel races ([#559](https://github.com/forkwright/harmonia/issues/559)) ([e017616](https://github.com/forkwright/harmonia/commit/e01761613bc338ce504359d2fbebcb449704d05a))
+* **zetesis:** close indexer-fetch SSRF, injection, XML-DoS, and key-leak defects ([#556](https://github.com/forkwright/harmonia/issues/556)) ([f3bafb2](https://github.com/forkwright/harmonia/commit/f3bafb22f03aaa6388b93d78a5ff6b4f83bddb54))
+* **zetesis:** harden indexer search (SSRF guard, key redaction, body cap, tx) ([#488](https://github.com/forkwright/harmonia/issues/488)) ([9b9ae1b](https://github.com/forkwright/harmonia/commit/9b9ae1b55cf817745a0cd20c6a8e550869fdd7b3)), closes [#429](https://github.com/forkwright/harmonia/issues/429) [#430](https://github.com/forkwright/harmonia/issues/430) [#431](https://github.com/forkwright/harmonia/issues/431) [#432](https://github.com/forkwright/harmonia/issues/432) [#433](https://github.com/forkwright/harmonia/issues/433) [#434](https://github.com/forkwright/harmonia/issues/434) [#459](https://github.com/forkwright/harmonia/issues/459) [#460](https://github.com/forkwright/harmonia/issues/460) [#467](https://github.com/forkwright/harmonia/issues/467)
+
 ## [0.1.11](https://github.com/forkwright/harmonia/compare/v0.1.10...v0.1.11) (2026-05-29)
 
 

diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -30,7 +30,7 @@ exclude = [
 ]
 
 [workspace.package]
-version = "0.1.11"
+version = "0.1.12"
 edition = "2024"
 rust-version = "1.89"
 license = "AGPL-3.0-or-later"