v4.5.2

Legal Notice Packaging, SecretGate Cache Pruning & 42-Gate CI Release Pre-Flight (Apache 2.0)

Changelog

Intent & Specifications

• 5118e3d [INT-917] docs(spec): align Cell 2.3 with deterministic mathematical gate proof
• 2f5fed0 [INT-920] docs(intent): harden open-core legal notices, DCO provenance, and...
• 4667e50 [INT-922] docs(specs): purge sovereign UI spec bleed and link arXiv:2610.32285

Verification & Quality Gates

• 8ca8395 [SUB-1728] refactor(verify): align cell_2_3 and REVIEW directives with...
• a23f783 [SUB-1735] fix(verify): skip gitignored build dirs and bound secret regexes

Release & Packaging

• 23ce0b1 [SUB-1741] feat(legal,cli): harden open-core legal notices, DCO, and clean...
• 0fbf732 [SUB-1744] fix(ci,cli): resolve release, uninstall, module, and boundary...
• b22cc32 [SUB-1753] chore(release): v4.5.2 - Legal Notices, SecretGate & Release...

Full Changelog: v4.5.1...v4.5.2

Release Notes & Architecture Details

Verification & Quality Gates (nomos verify)

• SecretGate Cache Pruning & Credential Bounds: Prunes gitignored framework build caches during secret scans, enforces word-bounded credential regexes, and aligns Cell 2.3 deterministic gate proofs.

Release & Packaging (.goreleaser.yaml, uninstall.sh, ci.yaml)

• Statutory Apache-2.0 Packaging & Uninstall Hygiene: Bundles NOTICE, THIRD_PARTY_NOTICES.md, and the verbatim SPDX Apache-2.0 appendix across GoReleaser archives, updates uninstall.sh for clean NOMOS_HOME removal, and runs full 42-gate CI pre-flight verification prior to release cuts.

Included v4.5.0 Milestone Features

Container Sandbox Anti-Reward-Hacking Hooks, Configurable Intent Twin Mode & Zero-Footprint Telemetry (Apache 2.0)

Ambient Hooks & Pacing (nomos hook --container-sandbox)

• Runtime Anti-Reward-Hacking Guard: Physically blocks reads, writes, and shell commands targeting protected benchmark verifier and oracle paths (/logs/verifier, /solution, /tests) while permitting full-container OS sysadmin operations (/etc, /tmp, /var, sqlite3).
• Zero-Footprint Container Execution: Skips global SQLite telemetry initialization during nomos hook and nomos version invocations so disposable evaluation containers remain 100% free of global state.

Configuration & Workspace (nomos.yaml, nomos.schema.json)

• Configurable Bilateral Intent Twin Policy (intent_twin_mode): Adds intent_twin_mode (off, feat, strict) to nomos.yaml and nomos.schema.json, defaulting to off for friction-free solo adoption while enabling feat or strict bilateral INT-*/SUB-* pairing on team and regulated repositories.