v0.3.0

[0.3.0] - 2026-07-25
Medium-findings audit backlog worked through — 0 failing checks; the three remaining findings are accepted-risk ADR-documented deferrals (SCALE-002, SCALE-003, SEC-005). See the audit runs under audits/.

Added
ARCH-012: the MCP protocol baseline (2025-11-25) is pinned as MCP_PROTOCOL_VERSION in server.py, with a regression test that fails CI if a SDK bump changes the negotiated version.
SEC-022: dump_status renamed to fiscal_status so every tool shares the fiscal_ server-identity namespace; dump_status is kept as a documented deprecated alias (removed in a future minor). Tool-hash pinning is documented as a gateway responsibility in SECURITY.md.
SCALE-003: ADR 0002 gains a concrete Mcp-Session-Id sticky-session example (nginx / Ingress / Traefik) for the multi-replica case.
SEC-005: docs/network-egress.md prescribes the network-layer egress mitigation (default-deny NetworkPolicy / egress-proxy allow-list) that supersedes application-level DNS pinning.
SDK-002: tools now return typed Pydantic models, so FastMCP exposes an output schema and structured content for every tool.
SDK-003: Context injection — tools emit debug logs and fiscal_list_dimensions reports progress while loading the dumps.
ARCH-002: tool descriptions carry explicit use-case context.
ARCH-003: empty results return a guidance note (pointing at fiscal_list_dimensions or a different level) instead of a silent empty.
OBS-006: optional OpenTelemetry tracing via the otel extra, gated by EFV_MCP_OTEL_ENABLED (off by default; src/swiss_efv_mcp/_otel.py).
SCALE-006 / SEC-007: compose.yaml with CPU/memory limits, read-only root filesystem, dropped capabilities and no-new-privileges.
OPS-001: per-tool live tests (fiscal_by_institution, dump_status) and a scheduled/manual live-test workflow (.github/workflows/live.yml).
OPS-003: docs/roadmap.md documenting the phase architecture and the audit backlog.
Security
SEC-004: the egress guard now rejects IP-literal hosts and re-asserts the allow-list on the final URL after redirects.