v0.5.0

Changelog

• fa08fad chore(lint): enable unused and wire the remaining pinned seams
• 3854188 ci(release): restore the tag-triggered goreleaser pipeline
• 8bfccd3 ci: add build, test, guard and cross-build pipeline
• e20a188 docs(readme): rewrite for the v0.5 core with install, tool and provider guides
• a772f8a feat(audit): add the metadata-only write seam
• 82b170f feat(cli): add status, env and version
• 33790f7 feat(cli): add the egress disclosure and privacy command
• 01a66ee feat(cli): add the rules and update commands
• 74a1a2b feat(cli): add the run command with startup recovery
• 2c14800 feat(cli): exclude the control token and allowlist literals from backfill
• f154431 feat(config): add the strict configuration schema
• ecf69ea feat(filter): accept schema v1 and signal command rules
• 275ce43 feat(filter): add builtin rules and the allowlist-neutral floor
• ae56ee0 feat(filter): add the action policy with fail-safe failures
• 807ae88 feat(filter): add the public rule registry
• a1c6fef feat(filter): add the rule and bundle document schema
• 31d7f55 feat(filter): add the six detector algorithms as rule types
• ec92bc5 feat(filter): compile rule documents
• b46ff5d feat(filter): evaluate rules over leaves
• e9ba0ac feat(install): add checksum-verified Linux and Windows installers
• e88f0bc feat(platform): add path resolution
• 6f2e938 feat(protocol): add the JSON leaf walk
• 6388bb7 feat(protocol): add the bounded streaming backfill writer
• af03254 feat(protocol): add the incremental SSE decoder
• d199196 feat(proxy): add host, origin and control-token guards
• d947aaf feat(proxy): add the loopback-only listener
• 4e43129 feat(proxy): add the metadata-only control API
• 948db60 feat(proxy): add the never-misroute resolver
• b7075e7 feat(proxy): decode or fail closed on response encodings
• 3f00364 feat(proxy): fail closed on compressed request bodies
• 8b8e82f feat(proxy): fail closed on unwalkable declared-JSON requests
• 5e5ec2b feat(proxy): stream SSE backfill incrementally
• 6c2138d feat(redact): add backfill with the exclusion set
• b2e899a feat(redact): add the HMAC placeholder engine
• 800da4e feat(redact): backfill placeholders across SSE deltas
• 8de55cc feat(redact): make the outbound writer forward-only
• 88064cb feat(supply): add atomic serial high-water stores
• ef5ba4b feat(supply): add key-list rotation and revocation
• cc50ba3 feat(supply): add signed rule sync with the OD gate
• 18d7dc1 feat(supply): add the Ed25519 signing substrate
• 1e13371 feat(supply): add the crash-safe signed self-update
• 3654bb0 feat(supply): freeze the payloads and projections
• 7986a77 fix(audit): add the named invariant-2 test at its table path
• 84dc485 fix(cli): count requests and redactions on the live path
• c633daf fix(filter): align the detector budget with the scan budget and harden PEM end-matching
• f84b092 fix(guards): count pure LOC strictly and split the oversized layering file
• e362bfe fix(redact): map decoded spans back to raw bytes for request substitution
• 59d404a fix(redact): restore secrets with JSON-escape-depth awareness on the client-bound path
• 9f44f04 refactor(redact): own the canonical SSE reassembler and internalize test-only exports
• 1ffe152 refactor(supply): internalize the keylist installer and drop the dead revocation decoder
• c0f88b9 test(cli): add an agent-workload scenario matrix
• 2e290cd test(cli): add end-to-end acceptance and the full-graph CI step
• 60f3b9e test(guards): allow the new reference docs under docs/
• 485e20c test(supply): exercise the update apply path end to end
• f76435d test(supply): pin the wire format with the golden vectors

---

Install: brew install --cask fregie/tap/tokenhush (macOS),
irm https://raw.githubusercontent.com/fregie/tokenhush/main/install.ps1 | iex
(Windows, or scoop install tokenhush), or the install.sh script (Linux).