v0.18.0 — security-audit wave

The security-audit wave. Three fixes held privately until every one was ready ship together, so no fix disclosed a live bypass ahead of its own remediation. This release also carries the RAND-aligned guardrail rehaul and the UX/contributor work merged since 0.17.1.

Security fixes

• Proxy output-secret gate now covers error results and structured/embedded channels (#378, ADR 0062). An isError=True result skipped the output scan at both call sites, and the scan folded only TextContent — so a credential in structuredContent or an EmbeddedResource, or in any errored result, could reach the model. All three channels are now scanned; taint-recording and single-use consumption are hoisted above the error guard too (raise-only).
• Per-user auth state is now control plane (#379, ADR 0065). The TOTP seed, its lockout counter, and the password hash live outside any repo and so sat outside the control-plane path globs — a mediated command deleting or overwriting them was not recognised as tamper. They are now matched explicitly.
• Control-plane paths are recognised regardless of separator style (#380, ADR 0066). POSIX tokenization treats \ as an escape, so a control-plane path spelled with Windows separators slipped past the command rule. The rule now also scans a separator-normalized view (scan-only, raise-only).

Related: GHSA-4vvj-9m89-648r (trailing space/dot path bypass on Windows, CVSS 7.1) was fixed in 0.17.0 and is now published with a full vector and all-platforms scope note.

Also in this release

The RAND-aligned guardrail rehaul (session correlator, opt-in least-privilege default role, subjective-memory governance, egress task-match leg, the labeled detection corpus with per-category FPR/TPR), a gated doberman uninstall, doberman 2fa reset-lockout, doberman taint clear, the WebhookAuditSink, and the UX/contributor work since 0.17.1. Full detail in the changelog.

Install: pip install --upgrade doberman-core