v1.65.0

1.65.0 (2026-07-24)

Bug Fixes

• audit: classify from the row, not a field pair (389816a)
• audit: converge the last two daemon readers; fix row detection (4bae6e2)
• audit: one decision mapper — a denial can never render as an allow (162cb7d)
• auth,config: close the last two non-human channels + un-break the daemon memo (round-3) (0a74e29), closes 5/#6 #2 #2
• auth,sync: address pre-push review — dedupe hard-block path + last-good cache backup (47e9bcb)
• auth: a pre-strict "Always Allow" must not pre-satisfy a tier-7 review (B1 #6) (fe679b1)
• auth: a shield hard-block downgrades to review only when a human is reachable (998bfaf)
• auth: cloud no-match allow must not resolve a tier-7 strict review (B1 #6) (2600809)
• config: a cloud-managed strict floor can't be disabled by repo config (task #16) (deed707), closes #2
• config: reset the rules-cache memo via _resetConfigCache (round-2 F4 gap-1) (170ab10)
• daemon: explain WHY the daemon is down, via a startup-state file (62b1ac7)
• mcp: don't mass-remove pins on an empty inventory; batch forget --stale (A1+B1) (246aca3), closes #251
• posture: disambiguate colliding Secrets rows + honest headroom copy (P3) (355e1c5)
• posture: egress + gate headline actions derive from the finding (P2) (f64b9c3)
• posture: headline CTA derives from the finding, not a canned path list (35192b2)
• report: shadow-mode rows and findings are not blocks (ff36447)
• restore library-call coverage, converge a 4th reader, keep \s+ (92a88ce)
• shields: a cloud-mandated shield cannot be weakened locally (B1) (ad51b47)
• shields: a config rule cannot suppress a cloud shield rule (B1 part 2) (48d7203)
• shields: a shield mandate floors local mode; non-builtin fails closed (B1) (025641a), closes #1 #2 #3 #251
• shields: close the remaining local bypasses of a cloud-mandated shield (B1) (c186cc0), closes #1 #2 #2b 5/#6 #3 #251 #1
• shields: redis rules require Redis, not just the word (db79fcd)
• sync: write rules-cache atomically + read it resiliently (shield fail-open) (2ef873a)

Features

• daemon: build identity — /health + versioned pidfile + doctor/status drift (task #18 commit a) (4aa2d4a)
• daemon: cooperative takeover + autostart gate — a newer build replaces a stale daemon (task #18 commit b) (f77964b)
• mcp: pin lifecycle — orphan detection, stale auto-removal, forget command (8fe30e0)