v0.8.0

doit v0.8.0

Threat-model-driven safety improvements — three pre-1.0 follow-ons to the
v0.7.0 threat model land in this release, plus per-project anomaly calibration
and a recoverability-aware rm tier.

Added

• 🎯T33 — doit_check_config reports the full safety contract. The tool
  now surfaces all seven load-bearing settings the threat model names, with
  stable §N markers tying each result back to
  docs/threat-model.md. [FAIL] for missing Bash
  deny-list / doit registration; [INFO] / [WARN] for sibling MCP servers,
  dangerous-tier state, policy-store permissions, L3 model overrides, and
  per-project config presence. Settings weakened from defaults are now
  visually distinct from informational items.

• 🎯T34 — Startup warning for sibling MCP servers with execution-adjacent
  primitives. doit emits a warning at MCP-server startup when other
  registered servers expose shell execution, file-write+chmod, language
  runtimes, or HTTP-to-localhost patterns that bypass doit's policy engine.
  Suppressible per-server via the new
  policy.acknowledged_sibling_servers: [...] config field. Backed by a
  classification heuristic in the new internal/mcpinventory package.

• 🎯T35 — L3 prompt-injection surface enumerated, hardened, and tested.
  New docs/l3-injection.md document enumerates
  every untrusted input flowing into the L3 prompt with per-input trust
  level, position, mitigation, and gap classification. The L3 prompt
  template now wraps every agent-supplied field (command, cwd,
  justification, safety argument, session scope, session description) in
  XML data tags with full XML character escaping, and instructs the model
  to treat tag contents as data only. A 10-payload prompt-injection
  regression corpus lives in internal/llm/testdata/injection_corpus.yaml
  and is exercised by the renderer test on every CI run.

Changed

• 🎯T29 — Learned duration statistics keyed per-project. Duration
  aggregation now keys on (cap, subcmd, project_id) rather than the
  global (cap, subcmd), so a small repo's make test percentiles no
  longer pool with a monorepo's. project_id derives from the project
  root path; commands without a project context fall back to a shared
  bucket. Eliminates a class of false-positive anomaly flags in both
  directions.

• 🎯T30 — rm tier reflects reversibility via git-tracked status. A
  non-recursive rm against a git-tracked file is now evaluated as
  write-tier (recoverable via git checkout HEAD -- <path>) rather than
  dangerous-tier. Untracked files, recursive removes, and paths outside any
  git repo remain dangerous. Hardcoded catastrophic rules
  (deny-rm-catastrophic) still fire regardless of tier.

Documentation

• docs/threat-model.md updated to reflect the runtime affordances landed
  in T33–T35; the §3 "user's responsibility" framing now points at the
  reporting/warning that doit_check_config and the startup warning
  provide.
• STABILITY.md snapshot bumped to v0.8.0 with the new
  acknowledged_sibling_servers config field, the per-target rm tier
  table, the project-keyed duration aggregator, and a new pre-1.0 gap
  noting the missing NOTICES / third-party attribution file.