v0.11.0

Added

• Memory plugins. Loop memory is selected by memory.kind (default
  jsonl, same .autoloop/memory.jsonl store). A second plugin can be
  registered without changing harness internals. Set memory.module to a
  package or path to replace jsonl with Honcho, SuperMemory, Mnemosyne, or
  any other adapter that implements add/list/find/render. The Claude
  marketplace lists autoloop-memory; canonical skills live in
  .agents/skills.
• Durable waits (wait.request). An agent can park a named run without a
  live backend: emit wait.request, the harness journals wait.open, registry
  status becomes waiting, and the process exits 0. autoloop resume <run-id>
  journals wait.close and continues on the same run_id. Duration on the
  request is advisory — nothing sleeps in-process or burns backend.timeout_ms.
• Backend environment hardening is available as an opt-in policy. Existing
  presets continue to inherit their process environment unchanged. Setting
  backend.environment_policy = "hardened" (or the review-specific override)
  removes process-injection and Git-authority variables, repository-owned or
  relative PATH entries, and rejects credential-bearing proxy URLs.
• Frozen-paths guard. Opt-in event_loop.frozen_paths lists workdir-relative
  globs that loop roles must not modify. In-iteration writes are reverted and
  journaled as policy.frozen_path_violation. event_loop.frozen_paths_block
  also denies the acting role's completion claim and injects operator guidance.

Fixed

• Parked waiting runs appear in run health. categorizeRecords now
  buckets status=waiting (no PID required) instead of dropping them, so
  autoloop loops health and GET /api/runs list a waiting bucket
  alongside active, watching, stuck, failed, and completed.
• Configured prompt files cannot escape their declared roots. Objective,
  review, harness-instruction, and topology role paths now reject parent
  traversal and symlink escapes while preserving optional and explicitly empty
  file semantics.
• --events creates missing parent directories instead of failing when the
  events path's parent does not exist.
• Dashboard POST /runs spawn no longer crashes when the CLI self-command
  contains quoted arguments.