v0.9.0

doit v0.9.0

Postmortem-tooling release. The audit log now captures every signal an
operator (or agent) needs to reconstruct why doit made a decision — not
just what decision it made — and the new doit_audit_query MCP tool
makes those signals reachable by filter rather than tail-by-count.

Added

• 🎯T37 — L3 chain-of-evidence in the audit log. Every L3 invocation now
  records a structured l3_fast block (and l3_deep when the cascade
  fires both tiers) containing the model name, rendered prompt, model
  response, latency, decision, and reason. Configurable size cap via
  audit.l3_max_chars (default 16384 per block) with explicit truncation
  marker. The single biggest postmortem black hole — "why did L3 allow
  that?" — is now answerable.

• 🎯T36 — Elicitation outcomes and L2 promotions in the audit chain.
  Phase 1 elicitation (Allow once / Allow always / Deny once / Deny always)
  and Phase 2 promotion (rule proposed, accepted, or declined) each
  produce their own audit-chain entry, linked to the originating command
  via the new parent_seq field. New fields: parent_seq,
  elicitation_prompt, elicitation_choice, elicitation_latency_ms,
  proposed_rule_source, proposed_rule_generality, proposed_rule_id.
  Reflexive-vs-deliberated approvals are now visible as latency
  outliers; rule provenance is no longer lost.

• 🎯T39 — stdout/stderr excerpts for failure-mode commands. When a
  command's audit entry would record exit_code != 0, policy_result == deny, or timed_out == true, doit now captures up to 4096 bytes of
  stdout and stderr into new stdout_excerpt / stderr_excerpt fields.
  Configurable via audit.capture_output (always / on_failure /
  never, default on_failure) and audit.output_excerpt_bytes. UTF-8-
  safe truncation with […truncated, total N bytes] marker. New
  RedactOutput() bool method on cap.Capability is forward-compatible
  scaffolding for sensitive-command exclusion (no capability sets it
  today).

• 🎯T38 — doit_audit_query MCP tool. Filter-based postmortem lookup
  replaces tail-by-count as the primary primitive. Filters: policy_result,
  policy_level, rule_id, cwd_substring, project_root, since
  (RFC3339 or relative duration like 1h), until, exit_code (number
  or "nonzero"), cap, command_substring, parent_seq, limit
  (default 20, max 200). latest=true returns the single most-recent
  match — the primary postmortem path. include (l3 / excerpts /
  elicitation) opts into the heavy fields; default response strips
  them to keep result size sane.

Documentation

• agents-guide.md and README.md describe the new doit_audit_query
  workflow with concrete usage examples ("the last thing doit refused",
  "all L3 escalations in the last hour with prompt + response", "the
  elicitation chain that created rule X").
• STABILITY.md snapshot bumped to v0.9.0; the postmortem-tooling batch
  is recorded as a closed pre-1.0 gap. Field-level annotations on the
  new audit fields and config knobs remain Needs review until the
  schema settles through real-world use.