v3.9.0 — Session-scoped preflights, vault protection, broad-rule advisory

What's New

Vault passphrase protection (locked rule)

AI agents can no longer run signet-eval setup or signet-eval unlock. This prevents an agent from setting a vault passphrase and locking the human out — which happened in practice.

Overly broad preflight constraint advisory

Submitting a preflight constraint with tool_pattern: ".*" and no conditions is now rejected with an explanation. An agent previously locked itself out by filing a universal constraint that matched every tool call including its own MCP tools. Use force: true to bypass if genuinely needed.

Session-scoped preflights (SIGNET_SESSION)

When the SIGNET_SESSION env var is set, preflights are scoped to that session. Each Claude Code instance sees only its own preflights plus global (session_id=NULL) ones. Deactivation, lock checks, and overrides are all session-aware. Backward compatible — unset SIGNET_SESSION means identical behavior to v3.8.0.

Files changed

• src/policy.rs — new locked rule protect_vault_passphrase (8th self-protection rule)
• src/vault.rs — session_id field on Preflight, DB migration, session-filtered queries
• src/mcp_server.rs — broad-constraint advisory, session_id capture + display
• src/main.rs — CLI preflight status shows session scope

Tests

138 tests passing (107 unit + 7 integration CLI + 24 integration hook)