agent-bom v0.103.2

Highlights

• The committed reference evidence lab now executes the real repository, CycloneDX, Kubernetes IaC, MCP configuration, advisory, correlation, and authenticated gateway paths. Its generated proof binds every input artifact, exact-identity join, signed runtime-facts bundle, live allow receipt, and strict pre-upstream block receipt.
• The evidence journey is labeled Connect, Discover, Scan, Correlate, Investigate, and Enforce (opt-in); fresh snapshots are selected by default, stale or future-dated inputs remain explicit, and completed scans always offer truthful Findings, Investigation, and Remediation handoffs.
• Investigation selects the newest completed correlation when no explicit snapshot is deep-linked, keeps correlation setup secondary to the resulting graph, and presents the evidence journey clearly across desktop, mobile, light, and dark views.

What's Changed

• fix(graph): simplify correlated evidence journey by @msaad00 in #5026
• chore(deps): consolidate CodeQL 4.37.9 actions by @msaad00 in #5039
• chore(deps): consolidate JavaScript updates by @msaad00 in #5038
• chore: consolidate weekly lock and registry refresh by @msaad00 in #5042
• fix(graph): clarify automated evidence journey by @msaad00 in #5043
• chore(release): prepare 0.103.2 by @msaad00 in #5044
• fix(graph): stabilize workspace scale proof by @msaad00 in #5045
• fix(graph): keep mobile attack paths readable by @msaad00 in #5046
• fix(mcp): gate runtime introspection execution by @msaad00 in #5047
• chore(deps): consolidate UI dependency updates by @msaad00 in #5052
• fix(postgres): provision retained observation partitions by @msaad00 in #5054
• fix(graph): preserve correlation evidence truth by @msaad00 in #5053
• fix(product): make correlation journey and proof truthful by @msaad00 in #5055

Full Changelog: v0.103.1...v0.103.2