v0.3.3

• Route evaluation and snapshot execution through shared assessment services. Persist versioned, tenant-scoped operation receipts so authorized callers can inspect a committed result after a lost worker response. Large responses preserve their execution status; generation conflicts and uncertain outcomes remain explicit.

• Bound operation pagination, queue admission, retained results and collector retries. Detect repeated provider cursors, honor Retry-After without retrying early, use Redis server time for shared rate limits, and return sanitized errors when admission or storage is unavailable.

• Add bounded, read-only distributed recovery inspection and cooperative write-lease checks. Qualify coordinated PostgreSQL/object backup restoration into fresh stores, including corruption rejection, snapshot chains, retained operation receipts and tenant isolation. This synthetic single-host drill does not establish production RPO/RTO, failover or capacity.

• Replace evidence-type graph fanout with exact, source-account-scoped record bindings. Add bounded CCF, environment, repository, finding, source and explicit vendor relationships, plus paginated roots and version-checked navigation. Evidence node IDs now identify records; old type-only links must be refreshed.

• Add an expanded icon-led graph workspace with continuous directional connections, drill-down, parent roll-up, and readable adjacent details. Redesign shared connector setup around configuration, access testing, first sync and results; clarify findings and pending access-review decisions.

• Show repository evidence outcomes and linked control impact, keep unobservable public settings distinct from failures, and show AI models, evidence gaps, linked controls and next steps alongside current framework coverage. Preserve the approved logo corners without CSS clipping.

• Store explicit vendor asset references with migration 0031. Refresh the investigation guide, product screenshots, coverage boundaries and contribution roadmap.

• Preserve evidence eligibility across freshness, control tests and workpapers: observed inventory cannot refresh a stale verdict, and unavailable evidence cannot supply design or sample credit. Correct order-dependent CCF ambiguity totals.

• Bind organization mapping approvals to safeguard semantics, mapping and requirement definitions; preserve stale review history and adverse decisions. Tighten catalog publication validation.

• Add versioned, tenant-scoped safeguard implementations and independently reviewed governance decisions, including expiring risk acceptance and extensions. These records never override assessment verdicts. Database migration 0030 adds their history tables; export them before a downgrade.

• Add source-account identity to normalization v5, compact CCF pages and separately paged references in projection v2, plus input and relation admission budgets. Document deployment limits and model relationships.

• Reuse shared framework marks in AI governance and mapping review, and shared control-family icons in the graph. Point console documentation links at the current repository.

• Pin the Compose quick start to published release templates. Refresh the candidate tour, AI-governance and mobile screenshots, navigation map, and coverage-depth boundaries.

• Gate container publication on dependency scans and authenticated runtime qualification for both AMD64 and ARM64, and make PyPI wait for the image job so a failed container check cannot leave an immutable Python release published first. Require the latest main-push CI run to pass; an older green run or a PR-only run no longer authorizes a tag.

• Replace the G-and-waves logo with a shared layered-evidence mark across the console, favicon, MCP icon, README and social preview. Enlarge the README banner and regenerate the synthetic console screenshots.

• Security: refresh the container's liblzma package for DSA-6549-1, remove pip and ensurepip from both runtime Python environments, remove the unused vulnerable infocmp executable, and remove setuid/setgid bits from system utilities. CI and release builds now reject fixable MEDIUM findings as well as HIGH and CRITICAL findings. Unfixed distribution findings remain tracked; this does not certify a vulnerability-free image.

• Security: reject incoming SAML signatures and digests that use deprecated algorithms, including SHA-1. Previously, selecting SHA-256 for outgoing signatures did not reject SHA-1 assertions from the IdP. Configure the IdP to use RSA-SHA256 and SHA-256 or stronger before upgrading.

• Security: sign browser-session, OIDC-state and SAML-correlation cookies with SHA-256 and require at least 32 bytes for signing secrets in authenticated deployments. Existing browser sessions must sign in again after upgrading; replace short secrets before starting the new server.

• Split GRC workflow routes out of the server application factory while preserving route behavior. Update LangGraph, web dependencies and the pinned cache action. Keep the Node build image on a current digest of supported Node 22 LTS, aligned with console CI; Node major upgrades require an explicit coordinated change.

• Refresh README setup instructions and synthetic console screenshots. Correct package visibility and release-status guidance; the published 0.3.2 image remains available while 0.3.3 is qualified.

What's Changed

• chore(docker)(deps): bump node from 22-slim to 25-slim by @dependabot[bot] in #883
• chore(deps)(deps): bump the web-weekly group in /app/web with 3 updates by @dependabot[bot] in #882
• chore(actions)(deps): bump actions/cache from 4.3.0 to 6.1.0 by @dependabot[bot] in #886
• chore(deps)(deps-dev): update langgraph requirement from >=0.2.0 to >=1.2.14 by @dependabot[bot] in #884
• refactor(server): split GRC workflow routes out of create_app by @msaad00 in #885
• fix(auth): pin SHA256 cookie signing and reject short secrets by @msaad00 in #887
• fix(auth): reject deprecated incoming SAML algorithms by @msaad00 in #888
• docs: refresh README setup and current console screenshots by @msaad00 in #889
• fix: harden container runtime dependencies and vulnerability gates by @msaad00 in #890
• chore: prepare 0.3.3 security release by @msaad00 in #891
• style: refresh shared logo, enlarge banner and clarify deployment by @msaad00 in #892
• docs: clarify lake compatibility, deployment tuning and queue fairness by @msaad00 in #893
• fix: qualify both release architectures before Python publication by @msaad00 in #894
• chore(deps)(deps): bump lucide-react from 1.52.0 to 1.53.0 in /app/web in the web-weekly group by @dependabot[bot] in #895
• chore(docker)(deps): bump oss-fuzz-base/base-builder-python from 88bcf57 to 756c719 in /.clusterfuzzlite by @dependabot[bot] in #896
• chore(actions)(deps): bump the actions-weekly group with 4 updates by @dependabot[bot] in #897
• fix: preserve evidence eligibility and version CCF governance by @msaad00 in #898
• feat: trace exact evidence lineage to frozen results by @msaad00 in #899
• feat: explain frozen CCF requirement coverage gaps by @msaad00 in #900
• ci: retain full vulnerability evidence for Scorecard remediation by @msaad00 in #902
• fix: preserve schema and evidence contracts across SQL marts by @msaad00 in #901
• feat: polish evidence journeys and contributor readiness by @msaad00 in #904
• feat: organize console workflows and evidence review by @msaad00 in #905
• feat: focus console review workflows and evidence paths by @msaad00 in #906
• Fix exact evidence graph paths and unify connector setup by @msaad00 in #907
• Make AI governance actionable and fix clipped branding by @msaad00 in #912
• fix(console): align visual identities and refresh the release tour by @msaad00 in #913
• Preserve assessment outcomes and bound API recovery by @msaad00 in #914

Full Changelog: v0.3.2...v0.3.3

v0.3.2

• Prepare package, console, chart, Compose and deployment examples for 0.3.2. New images target ghcr.io/koda-ai-studio/grc-lake; historical 0.3.1 images remain under ghcr.io/msaad00/grc-lake. Candidate references become usable only after publication.

• Preserve synthetic fixture origin through collection and invalidate stale or cyclic inherited CCF mapping reviews. Tighten Helm startup and distributed availability behavior and refresh pinned dependencies and security gates.

• Add bounded ClusterFuzzLite coverage for strict JSON, raw evidence, AI-BOM imports and webhook signatures. Reject malformed signature text without exceptions and tolerate malformed optional AI-BOM fields; replay minimized regressions in the unit suite.

• Correct personnel-screening, breach-notification, and broad PCI CCF mappings; use official ISO Annex A titles, label top-level coverage, and attribute proposed catalog rows to source reconciliation with legacy-field reads.

• Stream atomic gold JSON writes and bound dashboard detail with explicit totals. Cold posture uses a source-hash-bound asset projection, with a streaming fallback for legacy lakes.

• Use native NIST OSCAL catalog/profile references, return a JSON-RPC error for unknown MCP tools, and return 404 for unknown legacy evidence IDs. Clarify console mapping labels and guard batched Sidebar toggles.

• The Helm chart refuses to render without authentication. Set GRC_LAKE_COOKIE_SIGNING_KEY (and GRC_LAKE_SESSION_SECRET for OIDC) through env[], or acknowledge a local-only insecure install. The container is now named grc-lake, so update kubectl logs -c and similar selectors, and the writable home volume mounts at /home/grc-lake.

• The EKS reference keeps the cluster API endpoint private unless cluster_endpoint_public_access_cidrs names the networks allowed to reach it. Open-world CIDRs are rejected. Existing clusters become private on their next apply unless the variable is set.

• Connector plugins register under the grc_lake.connectors and grc_lake.connector_catalog entry-point groups. The trustops.* groups still load; when both define a name, the grc_lake entry wins.

• Webhook deliveries add X-GRC-Lake-Timestamp and X-GRC-Lake-Timestamp-Signature so receivers can reject replays. Existing signature headers are unchanged.

• SPDX 3.0.1 and CycloneDX AI-BOM exports validate against the official schemas. grc-lake query accepts WITH queries and opens both marts read-only.

• Add a disposable authenticated image probe for API-key authorization, tenant isolation, revocation, snapshot integrity, and persistence after container recreation. Document publisher and provenance verification across the repository ownership transfer while retaining working historical image references. Allow the exact repository-owner identifier in technical copy without allowing retired product names or visual wordmarks.

What's Changed

• fix(evidence): retain synthetic origin for fixture collections by @msaad00 in #867
• fix(brand): complete GRC Lake README and visual sweep by @msaad00 in #868
• fix(ci): scope CodeQL permissions and hash wheel smoke installs by @msaad00 in #869
• fix(deps): consolidate weekly updates and repair build/security gates by @msaad00 in #877
• fix(distributed): bound tenant caching and protect hosted availability by @msaad00 in #870
• fix(ccf): validate inherited reviews and cover NIST Rev. 3 gaps by @msaad00 in #872
• test(release): qualify authenticated images and retain Python provenance by @msaad00 in #878
• fix: close full-stack audit findings across auth, API, CCF, interop, deploy, console and perf by @msaad00 in #879
• fix(security): fuzz input boundaries and preserve API exports by @msaad00 in #880

Full Changelog: v0.3.1...v0.3.2

v0.3.1

• Bulk-load the DuckDB mart through typed Arrow tables when available, with a staged NDJSON fallback. Preserve table schemas, views, row contents, and order. Strict JSON decoding avoids unnecessary depth and Unicode scans while retaining duplicate-key, finite-number, Unicode, and nesting checks.

• Cache posture, violations, graph, coverage, and file-derived ingestion status per tenant lake and input version. Posture refreshes at evidence freshness boundaries. JSONL collection pages validate each file version and then seek directly to the requested rows. Callers receive independent results. Distributed request scratch directories remain isolated; reuse across those requests is limited.

• Refresh the README screenshots from the golden demo, correct the hero markup, and document local versus distributed deployment topology. Update the upgrade guide to reflect the published GRC Lake package and image.

What's Changed

• perf(pipeline): bulk-load DuckDB marts and streamline strict JSON by @msaad00 in #865
• perf(api): cache generation-aware lake reads and seek collection pages by @msaad00 in #864
• chore(release): prepare 0.3.1 and refresh product documentation by @msaad00 in #866

Full Changelog: v0.3.0...v0.3.1

v0.3.0

• Rebrand the product, CLI, SDK, console, logo, repository links and deployment examples to GRC Lake. Legacy CLI commands, Python imports and runtime environment variables remain supported. See upgrade instructions before changing package or deployment names. The release targets the new grc-lake distribution and image; existing TrustOps releases remain under their original registry names.

• Add opt-in distributed mode backed by PostgreSQL and S3-compatible object storage. API replicas use independent scratch storage, concurrent tenants publish through database-clock writer fences, and readers see only committed, hash-verified evidence. PostgreSQL holds operational state; the existing local deployment mode remains supported.

• Add stable virtual worker shards, tenant/source/UTC-date Parquet partitions, 32 physical PostgreSQL history partitions, bounded tenant job dispatch, and query indexes. Workers claim independently across tenants, respect cancellation races, and use database time for lease renewal and recovery. These partitions remain within one PostgreSQL cluster; storage replication and RAID are deployment-infrastructure responsibilities.

• Qualify concurrent replicas and worker recovery against a real S3-compatible service in CI, including conditional and multipart writes, replica scratch loss, PostgreSQL/S3 outages, and killed-writer fencing. This is a single-host synthetic qualification, not a production capacity or storage-replication certification.

• Preserve neighboring artifacts during failed downloads by using uniquely owned temporary files. Migration rollback refuses custom security policies on child partitions instead of silently discarding them.

• Let the distributed qualification wait up to 90 seconds for evidence reads after a storage restart. Bucket readiness can precede data availability; unavailable reads are retried within that bound, while changed publication versions or evidence hashes fail immediately.

• frameworks sync marks each fetch error transient when the upstream is temporarily unavailable (HTTP 403, 429, or 5xx, or a network failure). python -m security_lakehouse.framework_sync report emits a GitHub ::warning:: for those and exits 0, but emits ::error:: and exits 1 for any other fetch error, such as a 404, an invalid URL, or a registry entry with no source, so a broken source entry no longer passes silently.

• Shorten the PyPI package description to what the package does: read-only evidence collection, deterministic control tests, and reproducible assessment exports via API, CLI, and MCP. It no longer lists framework names or claims audit-ready proof.

• Audit readiness no longer counts a control with evidence but no verdict as assessed. Each framework's assessed_controls now excludes not-evaluated controls, so the coverage gate and the Overview agree (golden ISO 27001 reports 0 assessed, not 1). A new observed_controls field keeps the raw count.

• fixtures load --company golden now also seeds a small set of synthetic records for the local no-auth demo: four remediation tasks linked to findings the golden pipeline opened (one overdue), four risks, a published access-control policy, two vendor assessments, and a live metrics capture plus two earlier points so the Insights trends draw. Records are marked synthetic, re-running the load adds nothing, lake files and assessment hashes are untouched, and nothing is written when GRC_LAKE_DATABASE_URL points at an external database. --no-demo-records skips it. make demo-local and docker compose up pick this up through the same command.

• Console score and count labels now say what they measure. The Overview's assessment score is marked as the headline score with an info tooltip. Audit room shows the "Audit readiness index" and "Evaluated frameworks ready" (for example "0 of 3", naming the frameworks) as sub-indicators. AI governance shows the "AI governance indicator" with its formula in a tooltip, and each AI framework card is one line ("4 of 72 controls assessed · 3 failing") with the full breakdown in a tooltip. Frameworks counts requirements and Mapping review counts mappings, and each page now says so. An empty decision log reads "No org decisions logged yet" instead of "verified · 0". Insights says "findings", control results say "evidence confidence" and show its inputs on hover, and the local demo avatar is an icon. The onboarding card explains why a fixture-loaded demo shows 0% setup readiness.

• Console consistency pass. Below 640px, the Findings, Evidence, and Controls tables render each row as a card (title, severity or status chips, labelled metadata), and their filters fold behind one "Filters" toggle; desktop tables are unchanged. KPI tiles use one component everywhere (Insights and Graph included), empty lists share one empty state, Onboarding uses the standard page width, and the Frameworks safeguard section uses the collapsible card. The Graph opens on one fitted control path with "Show whole framework" one click away, labels counts as "in view" versus catalog totals, and shows a one-line summary on phones so the canvas is on the first screen. Workflows auto-arrange left to right with step edges between fixed left and right handles. The sidebar fits at 1440x900, keeps the current page scrolled into view, and fades the edge with hidden links. Logos at 40px and below draw the waves only. Charts, the graph, workflow nodes, tag chips, and the sign-in page use theme tokens in both themes, and chart tooltips no longer render as a white box in dark mode. Sign-in, invite, and shared trust pages have a <main> landmark and an <h1>, the Workflows sidebars have unique labels, and the axe end-to-end test now covers every route with the full WCAG 2.1 AA and best-practice rule set. Product copy no longer compares GRC Lake with other products.

• Add GET /api/v1/platform/features (read scope), which reports whether plan usage, billing, and SCIM are enabled. The console checks it once and skips routes that would return 501, so the Access & keys page no longer logs failed requests on a self-hosted server. Servers without this route fall back to the previous behavior of hiding panels on 501.

• Wrap MCP tool error text in the same untrusted-content envelope as results, since errors can echo API details or caller arguments. Errors still return isError: true.

• Validate an unchanged evidence file with one stat instead of re-reading and hashing it on every unfiltered /api/v1/evidence page. Files changed in the last two seconds are still hashed, so same-size rewrites are detected.

• Retry operation lease renewal on transient database errors such as SQLite database is locked, with short backoff, instead of stopping the job. A job is interrupted with lease_renewal_failed only when renewal can no longer succeed before its lease expires. Recording a job's result or interruption also retries such errors for up to 10 seconds before leaving the job to lease-expiry recovery.

• Bound unparameterized /api/v1/graph and /api/v1/repo-graph responses. Without limit, offset, or cursor they now serve the first page of 100 nodes and 100 edges, marked meta.default_page: true, with meta.next_cursor for the rest. The console graph page follows the cursor at 1000 rows per page, and the MCP get_repository_graph tool takes limit (1-100, default 100) and offset and reports pagination.next_offset.

• KnowBe4 (knowbe4-training, preview) now uses cursor pagination (cursor=0, per_page=500) because KnowBe4 deprecates the page parameter in November 2026. KnowBe4's spec does not yet say where the next cursor is returned. The client follows a cursor carried in a Link: rel="next" header and always sends requests to the configured regional host. If a full page arrives with no next cursor, it falls back to page paging from page 1. If KnowBe4 ignores page or repeats a cursor, the sync fails with a clear error and stores no duplicate rows. A 429 that outlasts the backoff budget now fails as "rate limit reached, retry the sync later" instead of a generic error.

• Security: the audit log no longer returns connector credential values to any role. Each credentials field keeps its name with a *** marker. apikey, authorization, and passphrase fields are now redacted at rest like token and password. Connector configuration rejects URLs that embed user:password@ with a 400.

• Security: escape snapshot reason, organization name, timestamps, bundle ID, and hash in the executive PDF. Markup in a snapshot reason could fail the export, make the renderer open a local file, or embed a javascript: link.

• Security: look up API keys and browser sessions by a keyed SHA-256 digest instead of 210,000 PBKDF2 iterations per request. Unknown or malformed tokens are rejected without the KDF, which removes an unauthenticated CPU exhaustion path. The tokens carry 192 or more random bits.

• Security: for state-changing /api requests authenticated by the session cookie, and for POST /api/v1/auth/session-from-key, require Content-Type: application/json. Refuse an Origin that matches neither the request host nor TRUSTOPS_PUBLIC_URL. Bearer-token requests and the SAML ACS post are unaffected.

• Security: OIDC auto-provisioning admits only verified emails whose domain is listed in the new TRUSTOPS_OIDC_ALLOWED_DOMAINS (comma-separated, exact match).

• Security: SSRF validation rejects percent-encoded hostnames. The tenant-facing Iceberg REST catalog connects only to an address validated as public for each connection, which closes a DNS-rebinding window. The operator CLI export is unchanged.

• Security: console and public trust pages send a Content-Security-Policy. Authenticated API JSON responses send Cache-Control: no-store.

• Helm pods no longer mount a Kubernetes API token. Set serviceAccount.automountToken: true only for CLI runs of the Kubernete...

v0.2.24

• Run retention automatically from the scheduler when TRUSTOPS_RETENTION_SCHEDULE is set. It is off by default, and only previews candidates until TRUSTOPS_RETENTION_ARCHIVE_DIR names an archive outside the lake root. Scheduled runs use the CLI's protections, record each run in gold/retention_runs.jsonl, and expose the settings under Helm scheduler.retention.

• Run background operations on a bounded worker pool (TRUSTOPS_OPERATION_WORKERS, default 2, range 1-16) with at most one in-flight job per tenant per replica, so one tenant's long job no longer blocks others.

• Cap every MCP tool output, including write tools, with an explicit mcp_truncation marker instead of an error. Tool annotations now report read-only, destructive, idempotent, and open-world behavior per tool. Text shown to the model wraps free-text values in an untrusted-content envelope; structuredContent keeps exact values.

• Page /api/v1/graph, /api/v1/repo-graph, /api/v1/graph/coverage, and /api/v1/frameworks/coverage with the standard limit/offset/cursor contract when paging parameters are sent. Evidence pages stream instead of loading every row, and graph ordering no longer depends on the Python hash seed.

• Keep a revoked trust share revoked when a copy of its record still sits in another lake the owner can reach, such as a flat root copied into a scoped tenant directory. List copied shares once.

• Report duplicate control IDs during catalog validation, and guard ISO 42001 Annex A controls against colliding with management clause IDs.

Upgrade notes

• Since 0.2.23, trust shares stored in a flat root lake resolve publicly only while no server tenant exists or after one tenant owns that lake. In a deployment with several tenants and no recorded flat-lake owner, CLI-issued links stored in the flat root return 404. Reissue them from the tenant that should own them.

• After scheduled retention runs, releases before 0.2.24 reject the new retention rows in gold/scheduler_state.jsonl and stop scheduling. Do not downgrade below 0.2.24 once retention is enabled.

• In-process callers of the MCP server's FastMCP.call_tool now receive a CallToolResult; read structuredContent for the previous dict. Remote MCP clients are unaffected.

What's Changed

• fix(security): keep copied trust shares revoked across owner lakes by @msaad00 in #841
• fix(catalog): reject control ID collisions across framework rows by @msaad00 in #842
• fix(mcp): cap every tool output, annotate tools accurately, envelope untrusted text by @msaad00 in #845
• fix(retention): run retention automatically from the scheduler by @msaad00 in #844
• fix(operations): run background jobs with bounded per-tenant fairness by @msaad00 in #843
• fix(api): page graph and coverage routes and stream evidence pages by @msaad00 in #846
• chore(release): prepare 0.2.24 by @msaad00 in #848

Full Changelog: v0.2.23...v0.2.24

v0.2.23

• Keep legacy flat-lake shares visible and revocable by their original tenant after a scoped tenant directory is created. Reject public access to ambiguous tenant-managed flat-root shares without an established owner, and add mutation-verified coverage for snapshot payload/ledger predecessor mismatches.

• Prevent braces stack exhaustion in console build tooling with an exact, provenance-verified depth-guard replacement. Check transitive parser behavior in CI and block high-severity development dependency advisories alongside production advisories.

What's Changed

• fix(deps): prevent braces stack exhaustion in console tooling by @msaad00 in #838
• fix(security): preserve legacy share revocation after tenant migration by @msaad00 in #839
• chore(release): prepare 0.2.23 by @msaad00 in #840

Full Changelog: v0.2.22...v0.2.23

v0.2.22

• Update the locked Mako dependency to 1.4.3, resolving its Windows template-lookup path traversal advisory.

• Align self-hosted deployment examples with runtime authentication, require cookie signing configuration in hosted Helm profiles, and launch scheduler CronJobs through the container's CLI executable. Refresh the EKS reference version, add staged infrastructure bootstrap and operator Helm values, and cover deployment plans and chart-to-server startup in CI.

What's Changed

• fix(deploy): align Helm runtime, EKS bootstrap and self-hosted guidance by @msaad00 in #836
• fix(release): ship deployment corrections and patched Mako in 0.2.22 by @msaad00 in #837

Full Changelog: v0.2.21...v0.2.22

v0.2.21

• Harden evidence verdicts, human approval authority, tenant isolation, recovery, background operations, and portable reports.

Added

• Supporting and inherited mapping relationships remain visible without coverage credit or OSCAL implementation claims.

• Evidence-bound N/A, inherited, and compensating assessment context in period workpapers, preserved through independent human review without changing machine verdicts.

• Durable tenant-scoped background operations for console and remote MCP evaluation, connector sync, scheduler ticks, and snapshots, with idempotent acceptance and explicit interrupted-work recovery.

Fixed

• Reject symlinked audit-source parents during retention, make cancellation atomic with claims, and enforce isolated native-code deadlines in the operating system.

• Revalidate current CMMC source evidence before SPRS credit or POA&M closure, and bind catalog discovery to the imported installation.

• Render portable dashboard reports directly from frozen data, with offline browser support, exact embedded JSON, safe evidence markup, and explicit coverage.

• Share current credential authority across HTTP, queued work, and live streams;
  reject inconsistent tenant or source-key bindings and reconnect streams when
  persistent authority changes.

• Share tenant-aware framework mapping coverage across CCF, Frameworks, and AI Governance, keeping contextual relationships separate from reviewed implementation mappings.

• Require sufficient current catalog coverage before reporting AI governance as governed; retain the composite score formula and reject non-catalog control IDs as passing coverage.

• Align catalog/program evidence requirements and current AI/CCF summaries, preserve observation-only uncertainty, and compare evidence timestamps as instants.

• Preserve explicit imported control mappings, require positive Jira resolutions, retain unresolved Azure role uncertainty, and detect unsafe added Kubernetes capabilities.

• Make assessment scores a versioned percentage of fresh passing controls, so new failures cannot improve them and passing severity cannot increase control risk.

• Preserve remediation authority across owner changes, serialize access-review decisions and terminal campaigns, and revalidate queued session authority.

• Reconcile interrupted workflow claims without replay, preserve review evidence during rollback, and repair SQLite acknowledgment defaults.

• Reject unlisted generation files, unsafe workpaper recovery, forged export metadata, and missing-lake verification; preserve recovery provenance and compare timestamp instants across read projections.

• Bound MCP assurance pages, advertise mode-appropriate tools, keep human attestations out of API-key MCP, and return bootstrap API credentials once.

• Share rule-aware verdict evaluation between controls and CCF safeguards, preserve source-tenant freshness boundaries, and reject bronze pointers as proof of available source evidence.

• Keep excluded or unknown MFA populations out of passing coverage, and classify GCP organization policies by their relevant constraint and explicit unconditional enforcement.

• Resolve catalogs from the active user-installed wheel and add explicit, resumable quarantine of interrupted snapshot files without rewriting committed history.

• Accept normalized passing evidence in workpapers, preserve open POA&M items when evidence is unknown, reopen completed items on regression, and suppress readiness scores when framework coverage is insufficient.

• Reject every unauthenticated production-server entry point, require authenticated sessions for human mapping review, and restore tenant-scoped snapshot integrity reads.

• Stream bronze and silver integrity verification instead of retaining full evidence payloads, preserving hash linkage, duplicate detection, counts, and evidence-set digests.

• Remove an unused framework-score assignment flagged by CodeQL; retain control-risk scoring for capped and uncapped assessments.

• Patch the console build selector parser through scoped overrides while preserving generated CSS; retain the separate unpatched braces advisory in dependency security documentation.

• Restore the README distinction between assessing an existing evidence lake and collecting new evidence through connectors.

• Preserve flat-lake ownership and share revocation as tenants are added, isolate request audits, and enforce server-side auditor view scopes.

• Bound graph detail, index connector history, coalesce stream computation, and cache unchanged catalogs. Add verified generation archival with snapshot and reader protection.

• Carry control input digests and event-level OSCAL lineage, validate query filters, harden MCP schemas and tool authority, and correct packaged skills and AWS permissions.

• Clarify console permissions and approval eligibility, improve responsive overview and freshness detail, respect system theme, and refresh the concise README and synthetic demo screens.

• Preserve historical snapshot and workpaper recovery without rewriting recorded hashes, support independently retained integrity checkpoints, and reject malformed generation and integrity manifests.

• Keep scores consistent when finding details are capped; distinguish missing provider evidence, avoid duplicate control counts, and report incomplete connector pagination and unavailable factor reads explicitly.

• Pin mapping approvals to reviewed control versions, support explicit safeguard bindings, label the NIST 800-53B Moderate pack accurately, and reopen remediation tasks when published evidence regresses.

• Carry normalized v4 evidence availability through Parquet and Iceberg exports while preserving source account identities and generation tenant isolation.

• Correct ten SOC 2 criterion topics from the AICPA source manifest and regenerate catalog metadata without changing mapping review decisions.

• Require human SSO for exception approvals, remediation retests, access decisions, policy acknowledgments, and workflow gates. Reject self-verification and linked-task dismissal without an evidence retest.

• Keep the scheduler daemon alive after tick errors, fsync connector history, bound CronJob retries, and provide explicit runtime-tail recovery with preserved originals and deferred scheduling. Reject evidence timestamps that overflow UTC or freshness arithmetic.

• Report incomplete SPRS assessments without a numeric score, count only explicit current passes in metrics, bind share issuers to authenticated identities, and enforce framework scope with observed-versus-catalog coverage counts.

• Avoid repeated snapshot decoding and canonical hashing on unchanged history, allow concurrent verified readers, and decode only requested trend payloads after verification while retaining whole-chain tamper detection.

• Record failed agent decisions without blocking other proposals, and let independent SSO reviewers close abandoned execution claims without replaying side effects or racing a live worker.

• Route remote MCP reads and writes through authenticated APIs, reject incomplete remote configuration and credential-bearing redirects, and support explicitly configured private API destinations.

• Preserve evaluated control verdicts when activity observations are also present, while retaining unknown, observation-only, failure, and stale states. Incremental evaluation refreshes existing verdicts without rewriting historical generations.

• Accept changed connector records at the same source timestamp when their collection is newer, preventing alert status updates from blocking later syncs. Older redelivery cannot overwrite the newer collection; conflicting ties on both timestamps still fail without changing the store.

• Keep inventory observations unevaluated, respect configured failure thresholds, and include declared eligible assets without period evidence in workpaper sampling gaps.

• Keep declared workpaper assets in sampling even when evidence is missing or unbound; exclude only a known incompatible asset type established by the cutoff, preserving account isolation and earlier exports.

• Retain failed login attempts as observations, preserve GCP IAM conditions, and identify broad/public access grants and open repository alert severity.

• Reconcile missing HIPAA workstation, media, authentication, policy and documentation identities against eCFR, preserving historical catalog scope and proposed mapping review.

• Persist scheduler attempts before execution so failed or interrupted workflows, connector syncs, and lake evaluations respect their configured interval; reject corrupt scheduler state without discarding retry history.

• Read and index connector history once per status request, retain successful runs beyond the recent-history window, and reject malformed history instead of silently discarding it.

• Schedule registered tenant lakes in hosted root ticks with isolated state, locks, execution identity, and webhook attribution; authenticated Helm deployments now use explicit all-tenant scheduling.

• Atomically claim agent decisions across SQLite/PostgreSQL before execution, require independent SSO review, and retain interrupted claims for reconciliation. The console now reflects review eligibility and in-progress decisions.

• Preserve connector-local event identities through upsert, normalization, incremental evaluation, and lineage; reject conflicting equal-time observations and retain newer evidence on stale redelivery.

• Preserve UTC instants in DuckDB marts and sinks independently of connection timezone.

• Verify live assessment generations and ledger-backed snapshot history before export; detect changed normalized evidence and require workpaper HTML to match its JSON. Reject unexpected export files and symlinks.

• Retain API-key provenance in exchanged sessions, revoke derived access with the key, and reserve independent workpaper and mapping review for eligible SSO identities. Key issuance canno...

v0.2.20

• Package every framework source manifest and reject wheels with missing pack data, fixing installed demo and evaluation failures.

• Add dependency-aware deployment readiness, refresh the README product tour and demo screenshots, and align release artifacts.

• Read CCF summaries and asset pages from indexed, generation-pinned SQLite projections; preserve query semantics and fail closed on broken indexes.

• Refresh DuckDB sink tables atomically, remove obsolete rows, and reject cross-lake destination reuse; existing unowned destinations require a new database.

• Bind hosted assessments to the authenticated platform tenant and block ambient warehouse exports from tenant requests.

• Update urllib3, PyJWT, oauthlib, virtualenv, and brace-expansion to address dependency advisories.

• Preserve unknown evidence outcomes, refresh incremental assessments at freshness boundaries, and pin historical OSCAL findings to verified snapshot inputs.

• Publish explicit safeguard-to-asset evaluation and reviewed requirement rollups through the API, CLI, MCP, and Frameworks page, with observed-population limits.

• Reuse connector discovery across control tests, consolidate framework scoring and evaluation result serialization, and distinguish local publication from warehouse export failures.

• Reject unsupported Helm read replicas and multiple writers regardless of volume access mode; document current deployment and evaluation limits.

• CI type-checks the package with mypy (make typecheck).

• Workflow action.connector_sync no longer fails with an AttributeError
  after a successful sync.

• Snowflake and Databricks asset-risk rows with no status and a missing or
  non-numeric risk score are recorded as observed instead of failing the sync.

• An OpenAI-compatible model response whose first choice has no message is
  reported as a model error instead of an AttributeError.

• Posture gate fails closed: when an allowlist of failing controls is set and
  the control-tests request fails, the gate now fails instead of reporting zero
  failing tests, and failing tests beyond the fetched page count as unexpected
  instead of being dropped. Empty lists no longer crash on macOS bash 3.2.

• Hosted cloud linking: the console's Azure and GCP link forms collect the
  tenant's own app registration (tenant ID, client ID, and one secret,
  certificate, or federated token file reference) or service account to
  impersonate, validated in the browser and on the server with the readers'
  rules. Reference fields take env-var names only and show the tenant's
  TRUSTOPS_TENANT_<ID>__ prefix, and connector form placeholders use it in
  hosted mode. GET /api/v1/auth/whoami reports hosted and
  secret_ref_prefix.

• The Azure admin-consent callback no longer copies the tenant it reports into
  connector options, and hosted mode offers no consent URL for an
  operator-owned multi-tenant app.

• Test reliability: the API rate-limit tests run on a frozen clock, and the
  connector registry tests restore process-global state and ignore connectors
  from installed packages.

• Framework packs: NIST SP 800-171 Rev 3 (all 97 requirements from NIST's
  OSCAL catalog, each with its Rev 2 predecessors from NIST's change
  analysis), EU NIS2 (Article 21(2)(a)-(j) measures and Article 23
  reporting) and EU DORA (99 financial-entity obligations across Articles
  5-30 and 45). Sources are pinned by sha256; every new CCF mapping is
  proposed, and requirements without an honest safeguard home are listed.
  CMMC 2.0 Level 2 stays on Rev 2.

• EU AI Act: EU-AI-ACT-Art.49 carried the fundamental rights impact
  assessment title, which is Article 27. It is now "Registration" (version
  1.1.0; the old version stays in history), its risk-assessment mapping moved
  to the AI governance safeguard, and Article 27 is added.

• AI governance: 16 new life-cycle safeguards (evaluation, drift monitoring,
  AI incidents, model and dataset provenance, human oversight, and more), all
  proposed. NIST AI RMF coverage rises from 28 to 69 of 72 requirements and
  ISO/IEC 42001 from 26 to 37 of 39; the requirements left unmapped on
  purpose are listed in docs/CCF_AI_CONTEXT.md.

• Control categories: the 21 control families are grouped into 10 categories.
  GET /api/v1/ccf/coverage returns a categories ledger,
  frameworks safeguards --format table prints families under their category,
  OSCAL components carry a trustops-category property, and the console
  Control families tab groups families by category and links to each family's
  review queue.

• Fixed: a control family or category reported state: reviewed as soon as
  one of its mappings was reviewed, so 15 families and all 10 categories read
  as reviewed while most of their mappings were proposed. The state is now
  reviewed only when no mapping is proposed, partially_reviewed when some
  are, and proposed_only when none is reviewed.

• Adoption kit: a root compose.yaml (a loopback-only sample-data demo, and
  a trustops-server profile with authentication on), a
  5-minute tutorial, CI gate
  docs with a sample-data workflow, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT,
  and issue forms.

• Security: mapping-review endpoints return fixed error messages instead of
  exception text; the server logs only the exception class.

• Fixed: a lake with no evaluated controls reported Assessment score 100 and
  "Ready for review" (and fed that 100 into audit readiness). It now scores 0
  with posture state not_evaluated, shown as "Not assessed".

• Fixed: the AI governance page used stale framework ids and counted only
  evaluated controls as "mapped", so ISO/IEC 42001 and the EU AI Act read
  "0/0 mapped". Each pack now shows the requirements and safeguard-mapped
  counts the Frameworks page shows, a pass rate only when this lake has
  evidence, and packs with nothing evaluated no longer pull the governance
  score down as 0%. An inventory inferred from lineage no longer triggers the
  "no model inventory" gap.

• Console: "mapped" means mapped to a safeguard everywhere. The framework
  drawer's mapped count now matches the roster; official-source links read
  "source-cited" and the readiness gate reads "reviewed article mappings".
  A /controls?id= link to a control this lake has not evaluated (or an
  unknown id) says so and links to the requirement in Frameworks, and the
  crosswalk chips carry the framework for that link. "AI controls" becomes
  "AI safeguard mappings" and opens the AI governance review queue.

• Console: trust-center share links resolve in no-auth mode before the lake
  holds any data; the Azure link badge reads "No secrets stored" (a client
  secret is supported, only its env-var name is kept); date helpers show "—"
  for unparseable dates; identity marks meet 4.5:1 contrast, and the
  accessibility suite now checks color contrast, including /auth.

• Fixed: GET /api/v1/policies?status=… and
  GET /api/v1/vendor-assessments?status=… returned 500 for any status, which
  also broke the MCP list_policies status filter.

• Security: webhook delivery records store a fixed reason (for example "SSRF
  blocked" or the error class) instead of resolver and socket text, which
  could reveal the private address an internal hostname resolved to. Hosted
  Azure cloud links require the subscription ID to be a GUID, and a completed
  cloud-link session can no longer be completed again to overwrite its staged
  credentials.

• CI builds with the same uv version as the container image, and a test fails
  when the pins drift apart. The container's uv moves from 0.10.9 to 0.12.19
  and the setup-uv action from 7.6.0 to 10.2.0.

• The published image is multi-arch (linux/amd64 and linux/arm64), so
  docker compose up runs natively on Apple silicon and Arm hosts.

• Console dependencies: Next.js 16.3.6, React Flow 12.12.0, framer-motion
  13.4.3, lucide-react 1.48, and TanStack Query 5.103.2.

• Console: GDPR, NIS2, and DORA use their own neutral marks instead of the EU
  AI Act badge; the crosswalk overlap matrices name each framework once, and
  the Control families tab states its category, family, and safeguard counts.
  README screenshots add the Control families tab and the crosswalk.

What's Changed

• chore(deps)(deps): bump the web-weekly group in /app/web with 7 updates by @dependabot[bot] in #757
• chore(docker)(deps): bump astral-sh/uv from 0.10.9 to 0.12.19 in the containers-weekly group by @dependabot[bot] in #759
• chore(actions)(deps): bump astral-sh/setup-uv from 7.6.0 to 10.2.0 by @dependabot[bot] in #758
• ci: keep setup-uv pins in step with the container's uv by @msaad00 in #763
• fix(ci-gate): fail closed when control tests can't be read by @msaad00 in #773
• fix(mapping-review): return fixed error messages instead of exception text by @msaad00 in #771
• feat(ccf): AI governance safeguards and a category layer over control families by @msaad00 in #774
• docs: compose quickstart, contributor guide, security policy, and CI gate example by @msaad00 in #772
• fix: deterministic rate-limit and registry tests; hosted cloud-link credential forms by @msaad00 in #775
• feat(frameworks): NIST SP 800-171 Rev 3, NIS2, and DORA packs by @msaad00 in #776
• docs: 0.2.20 README polish and pre-release audit fixes by @msaad00 in https://github.com/msaad00/trustops-security-dat...

v0.2.19

• Operator note (hosted / multi-tenant server mode only; self-hosted
  single-tenant and CLI installs are unaffected): connector and workflow
  secrets now resolve only from tenant-prefixed variables
  (TRUSTOPS_TENANT_<ID>__…) or names the operator allowlists in
  TRUSTOPS_CONNECTOR_SECRET_REFS / TRUSTOPS_WORKFLOW_SHARED_SECRETS; move
  shared secrets before upgrading. Hosted AWS connectors need role_arn and
  external_id, GCP and BigQuery need impersonate_service_account, and Azure
  and Intune need a tenant-owned app registration. After rotating
  TRUSTOPS_COOKIE_SIGNING_KEY, run frameworks review resign once per tenant
  lake.
• Live-cloud readiness, verified against real AWS, Azure, and GCP tenants:
  connectors probe accepts the same credentials as sync (including a local
  CLI profile for AWS) and makes a real read-only call for Azure and GCP; GCP
  keeps collecting when an API is disabled or a permission is missing and
  reports it as a named coverage gap; connector errors say what to fix instead
  of only an exception name; and long asset IDs no longer collide, so every
  synced GCP row is counted.
• Console consistency: framework counts include only seeded packs (planned or
  superseded packs are listed separately), the superseded ISO/IEC 27701:2019
  row says so, badges use one set of labels, Preview has a keyboard-reachable
  explanation, and the overview and audit room name their different scores.
  Server-mode requests now record the signed-in user as the actor even if the
  request body names someone else. README screenshots are cropped to their
  content and include Mapping review and a phone-width overview.
• Org mapping review: your reviewers can approve, reject, or request changes
  to safeguard mappings for your tenant (console Mapping review, API
  /api/v1/mapping-reviews/*, CLI frameworks review). Decisions go to an
  append-only, hash-chained log in the tenant lake with reviewer, rationale,
  and time; controls/safeguards.json is never modified. Coverage, OSCAL, and
  snapshots report maintainer-reviewed, org-reviewed, and rejected separately.
  New compliance_reviewer role and mapping_review scope; API keys, agents,
  and MCP tools can list the queue but never decide.
• Hosted tenant isolation: in server mode, connector secret references resolve
  only under the tenant's TRUSTOPS_TENANT_<TENANT_ID>__ prefix or the new
  operator allowlist TRUSTOPS_CONNECTOR_SECRET_REFS, and server secrets
  (TRUSTOPS_*, DATABASE_*, AWS_*, STRIPE_*, and similar) are always
  refused. Cloud readers need delegated access: AWS role_arn plus
  external_id, GCP and BigQuery impersonate_service_account, a tenant
  kubeconfig_ref for Kubernetes. Local Parquet paths are scoped to
  $TRUSTOPS_LAKE_LOCAL_ROOT/<tenant_id>. Iceberg REST and Glue readers keep
  only vended credentials from catalog metadata and accept only object-store
  locations (s3://, or the warehouse's gs://); local file: warehouses
  stay available in local and CLI mode only. Local and CLI runs are otherwise
  unchanged. Operator note: hosted
  tenants whose connectors name a shared or default secret must move it to a
  tenant-prefixed variable or add it to TRUSTOPS_CONNECTOR_SECRET_REFS; see
  docs/SERVER_AUTH.md#hosted-connector-credentials.
• Hosted Azure isolation: in server mode azure-posture and intune-devices
  authenticate only as the customer's own Entra app registration (tenant_id,
  client_id, and one of client_secret_ref, client_certificate_ref, or
  federated_token_file_ref). DefaultAzureCredential, the az CLI login,
  and the server-wide AZURE_SUBSCRIPTION_ID/AZURE_TENANT_ID overrides are
  refused for tenants. Local and CLI runs keep DefaultAzureCredential.
  Operator note: hosted Azure and Intune connectors that relied on the
  server's identity stop syncing until the tenant configures an app
  registration and the operator provisions its secret under the tenant prefix.
• Hosted workflow secrets: in server mode {{secret.NAME}} resolves from the
  calling tenant's TRUSTOPS_TENANT_<TENANT_ID>__SECRET_<NAME>, not the shared
  TRUSTOPS_SECRET_<NAME>. Operator note: before upgrading, copy each
  tenant's workflow secrets to its prefixed name (tenant acme:
  TRUSTOPS_SECRET_SLACK_WEBHOOK becomes
  TRUSTOPS_TENANT_ACME__SECRET_SLACK_WEBHOOK), or list a secret that is
  deliberately shared by every tenant in TRUSTOPS_WORKFLOW_SHARED_SECRETS.
  Unmigrated webhook, Slack, and Jira actions fail without sending. Local
  mode is unchanged.
• Mapping review: the new frameworks review resign command
  (--lake <dir> --previous-key-env <NAME>) re-signs the decision-log tip
  after TRUSTOPS_COOKIE_SIGNING_KEY is rotated. It verifies the hash chain and the old tip MAC with the
  previous key first, refuses and writes nothing if either fails, and records
  a tip_resigned entry in the workbench audit log. Operator note: after
  rotating the key, run it once per tenant lake. See
  docs/MAPPING_REVIEW.md#rotating-the-signing-key.
• SSRF guard: 6to4 (2002::/16) and Teredo (2001::/32) addresses are
  judged by the IPv4 addresses they embed, so one that tunnels to a private,
  loopback, or metadata IPv4 is refused on every supported Python version.

What's Changed

• fix(docs): crop console screenshots to their content by @msaad00 in #748
• fix(connectors): live-cloud probe parity, partial GCP collection, actionable errors by @msaad00 in #749
• feat: org mapping review workflow with attributable approvals by @msaad00 in #750
• fix(console): consistent counts, labels, and copy; mapping review screenshots by @msaad00 in #756
• fix(security): tenant-scoped secret refs, Iceberg storage isolation, delegated cloud credentials by @msaad00 in #755
• fix(security): tenant-scoped Azure identity and workflow secrets, 6to4/Teredo guard, review-log key rotation by @msaad00 in #761
• chore(release): prepare 0.2.19 by @msaad00 in #762

Full Changelog: v0.2.18...v0.2.19