v2.1.0

Changelog

• b6883b0: feat(approval): config block with grant TTL defaulting (@kabirnarang-ux)
• fe674b0: feat(approval): domain entities, store interface, tenant-safe grant key (@kabirnarang-ux)
• 572d6a9: feat(approval): in-memory store with atomic single-use grants (@kabirnarang-ux)
• e3ed5c9: feat(approval): loopback-guarded operator endpoints (pending/approve/deny) (@kabirnarang-ux)
• 06441e8: feat(approval): manager — enqueue on no grant, single-use grant on approve (@kabirnarang-ux)
• dc0fb90: feat(approval): wire approval_workflow + session header plumb, e2e approve-and-retry (@kabirnarang-ux)
• fd8d626: feat(audit): record claimed post-condition effect on write-shaped calls (@kabirnarang-ux)
• d634db6: feat(dashboard): approvals queue view + API (approve/deny), 404 when off (@kabirnarang-ux)
• 5942c9c: feat(dashboard): read-only job-budget view + API, 404 when off (@kabirnarang-ux)
• 3cdaba2: feat(jobbudget): Postgres-backed Meter, atomic increment, cross-replica sharing (@kabirnarang-ux)
• 5b4c87e: feat(jobbudget): config block, mirrors Taint/ApprovalConfig split (@kabirnarang-ux)
• a7d8e5a: feat(jobbudget): domain Meter/Verdict/Config (@kabirnarang-ux)
• 2d6e615: feat(jobbudget): flag-gated Checker, tenant-safe job key, fail-open on meter error (@kabirnarang-ux)
• dec2e17: feat(jobbudget): in-memory Meter (@kabirnarang-ux)
• 92cec9c: feat(jobbudget): wire job_budget behind flag — read (IsOverBudget) feeds policy, write (Check) feeds the hard gate (@kabirnarang-ux)
• 4920d8e: feat(policy): add needs_approval effect, map Rego approval result (deny>approval>allow) (@kabirnarang-ux)
• 1a89223: feat(policy): expose job_over_budget state as input.job_over_budget in the decision context (@kabirnarang-ux)
• ea3a204: feat(policy): expose taint state as input.tainted in the decision context (@kabirnarang-ux)
• b22f1fc: feat(proxy): Decider gains optional JobBudgetLookup, mirrors TaintLookup (@kabirnarang-ux)
• 98665ff: feat(proxy): job-budget hard gate — 429 + distinct job_budget_exceeded audit decision (@kabirnarang-ux)
• d3399ab: feat(proxy): needs_approval outcome — enqueue+202, grant retry forwards, fail closed (@kabirnarang-ux)
• 2e81b82: feat(taint): config parsing tests, example block, and honest boundary docs (@kabirnarang-ux)
• d2b14f2: feat(taint): plumb Entry.SessionID so header sessions set taint end-to-end (@kabirnarang-ux)
• 2d79447: feat(taint): taint-tracking slice foundation (domain, key, engine, store) (@kabirnarang-ux)
• 296a935: feat(taint): wire taint_tracking behind the flag into the proxy decision path (@kabirnarang-ux)
• 930fe21: feat: honest security posture — startup warnings, evasion tests, hardening docs (@kabirnarang-ux)
• 7c55c90: fix(approval): populate session id before block gate so every audit path carries it (@kabirnarang-ux)
• ff93cd0: fix(approval): remove incorrect %w wrapping of nil in error messages (@kabirnarang-ux)
• a4659cb: fix(proxy): honor a consumed approval grant against the job-budget hard gate (@kabirnarang-ux)
• 3a8c551: fix(taint): honor session header in decision-time taint lookup; fix(proxy): mark grant-consumed audit entries (@kabirnarang-ux)
• ea1a2d0: refactor(platform): promote SessionID from taint/usecase to platform/session (pure move, 3rd caller incoming) (@kabirnarang-ux)
• 99847b0: test(e2e): exercise taint_tracking + approval_workflow + job_budget together (@kabirnarang-ux)