v0.35.1

What's Changed

🔧 Other Changes

• perf: consolidate six performance scan reports by Daniel Meppiel (@danielmeppiel) in #3370
• docs: consolidate maintainer roster and contributor credit by Daniel Meppiel (@danielmeppiel) in #3489
• chore(license): scope Apache-2.0 software and CC-BY-4.0 docs by Daniel Meppiel (@danielmeppiel) in #3487
• docs(concepts): Fix what-is-apm file extension by Ty Mick (@TyMick) in #3461
• Fix YAML syntax error in docs-grounding-verifier frontmatter by Ty Mick (@TyMick) in #3285
• fix(triage): drop inaccessible grok-4.7 pin from scheduled Triage Panel by Daniel Meppiel (@danielmeppiel) in #3515
• fix(perf-scan): emit noop instead of opening an issue on clean scans by Daniel Meppiel (@danielmeppiel) in #3516
• docs(pr): require closing keyword for delivered issues, Refs for partial by Daniel Meppiel (@danielmeppiel) in #3518
• docs(lockfile-spec): show sha256: hash form APM writes by Daniel Meppiel (@danielmeppiel) in #3519
• docs(devcontainer): stop advertising the unpublished GHCR feature by Daniel Meppiel (@danielmeppiel) in #3526
• fix(install): keep the locked commit as the cached source pin by Abhishek Acharya (@abhishekacharya200) in #3407
• fix(receipts): preserve macOS identity across remounts with downgrade-safe migration by Tyce Herrman (@TyceHerrman) in #3439
• fix(codex): admit Codex CLI 0.163.0 or later for native registration by Daniel Meppiel (@danielmeppiel) in #3529
• fix(install): retry transient Windows denials at staged activation (#3386) by Daniel Meppiel (@danielmeppiel) in #3530
• fix(install): keep files deployed to other Claude/Hermes profiles by Sergei Malykh (@xronos-i-am) in #3424
• fix(install): replay locked Git-semver tag for cached subdirectory deps by Daniel Meppiel (@danielmeppiel) in #3527
• fix(install): refuse unmatched skills: selection before any primitive writes by Daniel Meppiel (@danielmeppiel) in #3538
• fix(install): reconcile a targeted package's dropped transitive dependencies by Daniel Meppiel (@danielmeppiel) in #3528
• fix(git): pin autocrlf=false on the uncached fallback clone and checkout by Abhishek Acharya (@abhishekacharya200) in #3409
• fix(compile): ignore generated context outputs in placement counting by Daniel Meppiel (@danielmeppiel) in #3539
• fix(mcp): deploy MCP servers from local-path Claude plugin dependencies by Daniel Meppiel (@danielmeppiel) in #3540
• fix(mcp): keep v0.1 registry server version in search and show by Daniel Meppiel (@danielmeppiel) in #3549
• fix(lifecycle): close HTTP response published during deadline grace join by Daniel Meppiel (@danielmeppiel) in #3548
• fix(install.ps1): report the full staged-binary failure output by Daniel Meppiel (@danielmeppiel) in #3533
• docs(prompts): note Copilot harness and CLI do not load prompt files by Daniel Meppiel (@danielmeppiel) in #3550
• fix(audit): recognize Copilot sessionStart prompt hooks by Daniel Meppiel (@danielmeppiel) in #3542
• fix(lifecycle): treat non-positive script timeouts as invalid by Daniel Meppiel (@danielmeppiel) in #3544
• fix(plugins): read flat-shape Claude plugin .mcp.json files by Daniel Meppiel (@danielmeppiel) in #3541
• fix(marketplace): verify commit-SHA refs in marketplace check by Daniel Meppiel (@danielmeppiel) in #3543
• fix(audit): replay git deps over their declared transport by Daniel Meppiel (@danielmeppiel) in #3531
• fix(install): do not treat an empty skill directory as an unmanaged collision by Mohammed Alkindi (@MohammedAlkindi) in #3449
• fix(install): keep lockfile_version in sync after carrying resolved_tag by Daniel Meppiel (@danielmeppiel) in #3536
• fix(lockfile,compile): create apm.lock.yaml and compiled outputs with umask-derived mode by Daniel Meppiel (@danielmeppiel) in #3547
• fix(deps): honor PROXY_REGISTRY_ONLY in ref and semver enumeration by Pearl Nguyen (@pearlatvg) in #3471
• fix(lockfile): fail closed when apm.lock.yaml is a symlink by Daniel Meppiel (@danielmeppiel) in #3532
• fix(adapters): prepend docker run for options-only OCI packages (#3404) by Abhishek Acharya (@abhishekacharya200) in #3405
• fix(mcp): preserve declared self-defined server names containing slashes by bodapatisaikrishna in #3493
• fix(codex): forward ${VAR} stdio env values with env_vars instead of writing them by Abhishek Acharya (@abhishekacharya200) in #3406
• docs: install APM from Scoop's default main bucket (dead scoop-apm link) by Daniel Meppiel (@danielmeppiel) in #3517
• fix(install): preserve skills during cold replay without deployment receipts by Sergio Sisternes (@sergio-sisternes-epam) in #3490
• fix(uninstall): remove packages only from the selected Claude profile by Daniel Meppiel (@danielmeppiel) in #3555
• fix(tests): pin LF line endings in cached Codex source-pin fixture by Daniel Meppiel (@danielmeppiel) in #3561
• fix(tests): allow retained lifecycle lock in generated state-machine write set by Daniel Meppiel (@danielmeppiel) in #3566
• fix(arch): scope lockfile-read guard to the read-only resolver by Daniel Meppiel (@danielmeppiel) in #3568
• fix(ci): bypass unresolvable Azure apt mirror when installing fish and zsh by Daniel Meppiel (@danielmeppiel) in #3570
• fix(deps): lock transitive setuptools 84.1.0 (GHSA-xmj3-9gf7-h52w) by Daniel Meppiel (@danielmeppiel) in #3563
• fix(antigravity): emit native rule frontmatter (string globs, always_on trigger) by Daniel Meppiel (@danielmeppiel) in #3546
• chore: release v0.35.1 by Daniel Meppiel (@danielmeppiel) in #3558

New Contributors

• Ty Mick (@TyMick) made their first contribution in #3461
• Tyce Herrman (@TyceHerrman) made their first contribution in #3439
• Sergei Malykh (@xronos-i-am) made their first contribution in #3424
• Pearl Nguyen (@pearlatvg) made their first contribution in #3471

Full Changelog: v0.35.0...v0.35.1