v0.4.0

What's Changed

• [log] Add debug logging to difc/path_labels.go by @github-actions[bot] in #8538
• docs: fix unsupported headers in JSON stdin OpenTelemetry example, clarify MCP_GATEWAY_PORT behavior by @lpcox with @Copilot in #8564
• Deduplicate jq filter compile/cache pipeline in jqschema without changing public behavior by @lpcox with @Copilot in #8565
• rust-guard: extract apply_issue_read_enrichment helper + add limit_items_with_log tests by @lpcox with @Copilot in #8566
• Fix ToolAnnotations drop in routed mode; document SDK upgrade gate by @lpcox with @Copilot in #8567
• [test-improver] Improve tests for middleware jqschema by @github-actions[bot] in #8540
• [Repo Assist] test(config): add JSON schema validation tests for opentelemetry config by @github-actions[bot] in #8588
• [Repo Assist] fix(config): add headers field to JSON stdin opentelemetry config by @github-actions[bot] in #8587
• [test] Add tests for httputil.ReadResponseBody and ReadResponseBodyStrict by @github-actions[bot] in #8601
• [log] Add debug logging to difc path_labels resolve paths by @lpcox in #8608
• Use newValidationError() consistently in string validation rules by @lpcox with @Copilot in #8646
• Add coverage for serveAndWait shutdown-timeout fallback by @lpcox with @Copilot in #8650
• refactor: scatter reduction across server, config, and cmd packages by @lpcox with @Copilot in #8649
• [log] Add debug logging to BaseResponseWriter by @github-actions[bot] in #8616
• Fix stale common.go reference in Log-Level Quad-Function Pattern comments by @lpcox with @Copilot in #8647
• Refactor shared HTTP response body read path in httputil by @lpcox with @Copilot in #8648
• [Repo Assist] refactor(config): route all ValidationError constructors through newValidationError by @github-actions[bot] in #8651
• [log] Add debug logging to guard_policy_validation.go by @github-actions[bot] in #8675
• refactor: implement 7 semantic function clustering improvements by @lpcox with @Copilot in #8689
• [test] Add tests for logger.atomicWriteFile and logger.syncFileWithWarning by @github-actions[bot] in #8673
• [test-improver] Improve tests for proxy response transform by @github-actions[bot] in #8676
• refactor: eliminate duplicate empty-string validator by delegating NonEmptyString to RequiredStringField by @lpcox with @Copilot in #8705
• refactor: have TimeoutPositive delegate to PositiveInteger by @lpcox with @Copilot in #8706
• [Repo Assist] perf(logger): sanitize RPC payload once for text+markdown previews by @github-actions[bot] in #8722
• [test] Add tests for logger.SlogHandler.Handle via attrKeyString helper by @github-actions[bot] in #8730
• refactor(config): eliminate duplicate validation rules in internal/config by @lpcox with @Copilot in #8731
• [test-improver] Improve tests for cmd/output.go by @github-actions[bot] in #8746
• refactor(config): eliminate duplicate validation rules in internal/config by @lpcox in #8741
• [log] Add debug logging to difc/capabilities.go by @github-actions[bot] in #8744
• Refactor duplicated helper logic for session logging, rate-limit parsing, and routed server setup by @lpcox with @Copilot in #8762
• Model gh codespace stop as a guarded write operation by @lpcox with @Copilot in #8764
• Update nightly docs reconciler prompt for split config package layout by @lpcox with @Copilot in #8763
• Upgrade gh-aw to v0.82.2 pre-release and recompile workflows by @lpcox in #8786
• rust-guard: dedupe PR/issue response-path setup and add gist/notification path-label tests by @lpcox with @Copilot in #8778
• Add load-time WASM guard ABI checks and align guard unit runtime config by @lpcox with @Copilot in #8779
• refactor(difc): extract tagSet to deduplicate concurrent map logic from Label and Capabilities by @lpcox with @Copilot in #8780
• [test-improver] Improve tests for server SystemTools handlers by @github-actions[bot] in #8815
• [test] Add tests for githubhttp.ParseRateLimitResetFromText by @github-actions[bot] in #8811
• [log] Add debug logging to middleware/content_rewrite.go by @github-actions[bot] in #8813
• rust-guard: flatten commit integrity branch logic and expand trusted bot variant coverage by @lpcox with @Copilot in #8842
• refactor: semantic function clustering – remove wrapper, relocate helpers by @lpcox with @Copilot in #8840
• feat(tracing): OTel improvements from go-fan review by @lpcox with @Copilot in #8841
• [Repo Assist] refactor: centralise SecureCompileOpts into internal/jqutil by @github-actions[bot] in #8867
• [test-improver] Improve tests for tracing/span_helpers by @github-actions[bot] in #8876
• refactor: rename newHTTPConnection→assembleHTTPConnection, getItems→extractRawItems; extract writeJSONToFile helper by @lpcox with @Copilot in #8873
• [log] Add debug logging to resolveGuardPolicyOverride in flags_difc.go by @github-actions[bot] in #8875
• Add sink-visibility to write-sink guard policy to prevent GitLost exfiltration by @lpcox in #8895
• Add sink-visibility runtime verification and integration tests by @lpcox in #8903
• Address sink-visibility runtime check review feedback by @lpcox in #8907

Full Changelog: v0.3.33...v0.4.0