v2.4.0

v2.4.0 (2026-09-17)

This release is published under the Apache-2.0 License.

Bug Fixes

• Address inference review findings (efb69ac)

• Address review findings on permissions, resolution, and docs (396434a)

• Answer a deleted import profile at every policy write (388ef6c)

• Drop the redundant lock and nested error paths in Ignore position (f09d5b0)

• Drop the search in flight when a picker search changes (e62491c)

• Keep a saved root primary key knowable when a relation is planned (7215ce9)

• Require a source position on every Source Trace (f4168c6)

• Validate independent Device fields when a relation is unresolved (82eaaaa)

• adapters: Name the excluded row and keep its source location (f9ea2e5)

• adapters: Reject a row the declared output kinds cannot carry (f341328)

• inference: Keep the status classification of an oversized response (46eba07)

• inference: Refuse a saturated deadline pool instead of starving the caller (091b942)

• migrations: Refuse to reverse the superseded-proposal retirement (abe7f0f)

• opengrep: Catch getattr on a bound coordinator (f307853)

• opengrep: Match the effective response body limit (6037da5)

• proposals: Retire requests queued under a superseded contract (339d14f)

Chores

• opengrep: Replace the private-coordinator AST scanner with a taint rule (c2e4642)

Documentation

• Require a protected NetBox-to-Proxy hop in the Vault research note (640382d)

Features

• Settle a rack position collision and sync an update row (c818d75)

Refactoring

• Keep one opengrep ruleset and one proposal-contract test module (bd570f0)

• Share one debounced search between the trace pickers (e4a4590)

Testing

• Assert the exact read-failure message (6a32c48)

• Exempt only the owning module in both tree guards (0d46852)

• Fake migration 0035 on the walk back (353e2e4)

• Give the redaction header list its own module (12ba5d3)

• Prove each deleted-profile refusal with a real request (494fdbd)

• Reject a negative candidate limit on the device endpoint (3565897)

• opengrep: Cover the alias import forms in the boundary fixture (25bd06d)

---

Detailed Changes: v2.3.0...v2.4.0