v0.9.0

Adds a second, structurally distinct MCP guidance tool covering the community-maintained pfREST package -- public MCP contract: 95 pfSense READ tools + 2 documentation guidance tools (was 1), 0 default-reachable WRITE = 97 total (was 96).

Added

• pfsense_get_api_guidance -- a new guidance tool covering pfSense-pkg-RESTAPI (documented at pfrest.org), never Netgate product documentation, never blended with the existing pfsense_get_official_guidance. Four bounded query modes -- tool, endpoint, model, topic -- returning cross-source evidence explicitly labeled by provenance: PROJECT_AUTHORED (this project's own tool interpretation), PFREST_UPSTREAM (pfrest.org's live documentation, fetched through a narrow, allowlisted, HTTPS-only, GET-only fetcher with a hard response-size cap and a bounded cache), and LIVE_APPLIANCE_SCHEMA (your connected appliance's own /api/v2/schema/openapi, fetched through the same authenticated transport every READ tool already uses). When sources disagree, the disagreement is stated explicitly -- never silently merged, never silently dropped.
• Project-authored tool guidance (pfsense_mcp.guidance.tool_guidance) is now wired into pfsense_get_api_guidance's tool query mode.
• make pfrest-privilege-crosscheck -- an offline, advisory, maintainer-facing script comparing what pfrest.org and (if configured) your connected appliance each declare as a READ tool's required pfSense privilege. Not part of the MCP surface; never grants a privilege or modifies configuration.
• make pfrest-schema-diff -- an offline, advisory, maintainer-facing semantic (not byte-level) OpenAPI comparison across twelve dimensions (paths/methods, operationIds, parameters, schemas, fields, enums, default values, required packages, auth metadata, allowed privileges, applies-immediately metadata, extensions, version metadata), classifying differences without assuming a cause. Not part of the MCP surface.

Safety

Documentation and guidance content -- from any of the four provenance sources -- is evidence, never authorization. It cannot select, influence, or execute any action this server takes; it cannot reach a WRITE capability; and no source can masquerade as another. This is enforced structurally (isolation tests, no authorization-shaped output fields) and verified adversarially, including live against a real appliance, before this release.

Not included in this release: a persistent pfREST documentation cache, conditional-GET revalidation, a model-name discovery tool, or a production CE-vs-Plus schema comparison (the tooling to run one exists offline, but no comparison was performed against production).

Full detail: CHANGELOG.md, docs/adr/ADR-035-pfrest-live-guidance-layer.md, and docs/ACCEPTANCE_v0.9.0.md.