v0.28.0

Changes

• fold the scanner fuzz crate into the workspace
• [breaking] mint wire compatibility 2 with one occurrence per row
• spell a sealed payload once
• give validated newtypes a const literal constructor
• read validated newtypes through serde try_from
• (wire) read the report and the last plain documents through the traits
• (wire) seal the open families with the envelope reader
• (wire) read every plain document through one Document trait
• (locale) show the two layouts a context can describe
• (cli) stage locale coverage evidence with amiss locale-inventory
• build fixture digests with the shared law
• (wire) seal every digest-bound document through one envelope
• (locale) judge coverage plans from the command line
• preserve domain types across configuration, storage, and providers
• replace custom Serde implementations with derives
• replace JSON and digest wrappers with native libraries
• (wire) keep public report ingress fully typed
• Skip unrelated CI work and shrink executable test fixtures
• (cli) retain typed reference occurrences
• (wire) share tagged resolution models
• (wire) close report row models
• (wire) separate semantic construction from output
• (wire) keep semantic observation ownership explicit
• (scan) consume typed controls without envelope round-trips
• (wire) close semantic template and envelope payloads
• (wire) close semantic producer kinds across the data flow
• (wire) carry concrete policy controls through sealed requests
• (spec) reject string-tag shape drift across public readers
• (wire) remove the handwritten canonical JSON writer
• Use library JSON writers in bootstrap and CLI fixtures
• Retain generated semantic envelopes beside their canonical bytes
• Send bounded external CLI inputs directly to artifact validators
• Read reference projections with Serde and preserve input extensions
• Pass bounded report bytes directly to CLI validators
• Read report envelopes directly through Serde
• Preserve resolved failure context and remove unreachable render path
• Produce and consume scanner reports through shared serde models
• Let report projections consume stored path types directly
• Keep portable write and flush failure checks with the emitter
• Emit typed report envelopes with serde and standard buffering
• Derive serialization for complete resolution outcomes
• Name resolved targets in resolver data
• Use shared report types for unavailable scanner inputs
• Serialize external plans and assessments directly to artifact bytes
• Preserve path-aware strict JSON refusals for evidence input
• Carry serialized external evidence through provider boundaries
• Use typed report fields for adoption and repair
• (cli) read typed human and JUnit reports
• Restrict machine-applicable fixes to text document paths
• (cli) read typed SARIF and Code Quality findings
• (wire) reuse canonical semantic output bytes
• (cli) require SARIF artifact for spanless locations
• (cli) serialize SARIF from borrowed structs
• (cli) clarify projection benchmark scope
• (cli) serialize Code Quality from borrowed structs
• (scan) share semantic evidence report provenance
• (scan) hash typed candidate identities
• (report) admit site-build defect evidence
• (wire) validate reports through typed model
• (external) derive assessment JSON
• (external) derive evidence JSON
• (wire) derive external plan JSON
• (wire) derive release manifest JSON
• (controls) derive organization floor JSON
• (controls) derive scanner policy JSON
• (controls) derive debt and waiver JSON
• (wire) derive execution constraint JSON
• (wire) derive trusted time JSON
• (wire) derive controls request JSON
• (wire) derive snapshot request JSON
• strip release symbols and skip the read on a scan memo hit
• (scan) read a locale page inventory out of the candidate tree
• give the domain-separated digest one home
• (scan) name the control admission law once
• compile the test suites once instead of many times
• reuse production wire models and control fixtures
• (scan) carry closed exception applications into reports
• Share closed finding evidence across report and adoption flows
• Use closed Serde tags for projection and exception details
• (wire) close finding key scopes
• (wire) borrow closed report identity
• (wire) type supplied semantic request envelopes
• (scan) consume closed semantic observations
• (wire) keep supplied trusted time typed end to end
• Use library JSON writers in scanner and Markdown fixtures
• Consume generated semantic envelopes directly in the scanner
• Hash site identities from existing evidence kinds with Serde
• Hash blob evidence from typed Serde inputs
• Use shared enum classifications in finding metadata
• Keep generated-report failures contextual and remove duplicate checks
• Check generated scanner reports in the contract drift gate
• Share projection difference data with the report model
• Use one projection reason vocabulary in producers and reports
• Produce shared evidence source counts directly
• Hash adoption facts from borrowed serde inputs
• Hash through the selected serde writer
• Stream produced finding keys and propagate evaluation errors
• Store finding key inputs as direct shared data
• Use shared finding scopes in the evaluator
• Stream candidate identities directly into their hasher
• Replace the observation identity encoder with shared serde models
• Stream typed index identities directly into SHA-256
• Isolate the process-wide fatal allocation measurement
• (scan) hash typed staged-index identities
• (scan) reuse report counter structs
• (report) share document classifications with the scanner
• (scan) share report decision types
• (wire) derive semantic evidence JSON
• (deps) bump the cargo group with 4 updates
• parse the Markdown profile with pulldown-cmark
• (locale) retain a validated coverage audit in the controller
• eliminate transient clones in domain flows
• infer Serde bounds and simplify optional fields
• Enforce report count bounds through Serde adapters
• (bootstrap) validate complete typed reports
• (wire) share projection source models
• (wire) close report engine and summary metadata
• (report) share typed result validation
• (wire) close report control provenance
• (wire) require strings for observation and resolution tags
• (wire) require strings for finding and evidence tags
• (wire) require strings for report context tags
• (wire) require strings for sidecar assessment tags
• (wire) require strings for external and semantic tags
• (wire) require strings for control and manifest tags
• (wire) require strings for request and Git tags
• (wire) serialize protocol fixtures with the canonical library
• Use library JSON writers in wire contract fixtures
• Derive serialization for strict JSON values
• Stream semantic payload digests through the canonical writer
• Bind relation sources directly through their Serde model
• Let Serde enforce policy assertion presence
• Remove the unused manual field decoding API
• Return external evidence with its complete-input digest
• Decode external envelopes with shared Serde input checks
• Validate decoded semantic evidence at bootstrap capture
• Read bootstrap reports through typed acceptance stages
• Share report identity projections between readers
• Read sealed report controls through existing Serde models
• Use string-only library derives for control tags
• Reject unbound report envelope fields with Serde
• Remove redundant semantic fixture digest assertion
• Keep semantic observations object-shaped under Serde
• Write typed semantic observations without JSON value adapters
• reuse existing report field types in canonical order
• stream binary repository paths through serde
• Use report payload types directly without aliases
• Let report rows carry their stored serde types
• Let fact inputs borrow their key and evidence
• Derive serialization for resolution details
• Stream accepted finding keys in canonical field order
• Let serde enforce structural fact optionality
• Let report models carry validated producer paths directly
• Use typed analysis routes and one error-row builder
• Reject invalid feedback byte paths and zero location counts
• Serialize locale artifacts from borrowed payloads to bytes
• Serialize publication artifacts from borrowed payloads to bytes
• Carry canonical relation artifact bytes through the controller
• (wire) derive repository path serialization
• (wire) share resolver reasons with report models
• (wire) share snapshot identity models
• (wire) stream report findings canonically
• (wire) stream report observations canonically
• (wire) type report finding rows
• (wire) type report analysis rows
• (wire) type report provenance blocks
• (wire) exercise manifest closure boundaries
• (controls) bound floor resource limits
• (wire) derive evaluation request JSON
• (wire) derive candidate identity JSON
• (wire) derive record-set input JSON
• (wire) derive locale assessment JSON
• (test) insert locale pages by order
• (wire) derive locale evidence JSON
• (wire) derive locale plan JSON
• (wire) derive publication assessment JSON
• (wire) derive publication evidence JSON
• (wire) preserve publication parse diagnostics
• (wire) derive publication plan JSON
• (wire) derive relation assessment JSON
• (wire) derive relation plan JSON
• (wire) derive relation evidence JSON
• Validate candidate snapshot shapes in index-mode reports
• Derive sealed report identities without rebuilding JSON
• Decode captured bootstrap controls directly with Serde