v1.24.0

1.24.0 (2026-09-05)

Added

• cli: generated modules open reads only, nucleus add is tested end to end, ADR-032 draws the major line, contract inventory complete (#473) (a50dbec)
• router: rate limit after identity, CORS first, request_timeout with exemptions, http.route by template, lazy gzip and mounts that serve their root (#471) (53b30bd)

Fixed

• auth: flash data lives one request, JWT verifies issuer and audience, tasks honour their policy, migrations take a lock, models reject duplicate names (#472) (481d6ff)
• deps: raise the sibling module floors to nucleus v1.23.2 (#469) (d238caa)