v0.2.0

Fan-out and fan-in, a policy diff, a browser playground, and a security pass. The core module still has zero third-party dependencies.

Try it without installing anything

Playground — edit a policy in the browser and watch which past decisions your edit would flip. The Go engine is compiled to WebAssembly and runs client-side; a JavaScript re-implementation would be a second engine that drifts from the first, which for a project about determinism would defeat the point.

Engine

• Parallel steps. Branches run concurrently, but join and concatenate their traces in declaration order, so the result never depends on which finishes first. Two branches writing one field with different values is refused, not arbitrated — nothing in the workflow says which should win. A panicking branch becomes an error naming the branch rather than taking the process down.
• Concurrency-safe registration. The workflow and policy registries are behind an RWMutex; no lock is held while domain code runs. The test fails with a real DATA RACE when the lock is removed.

Replay, as a tool

cee diff <before> <after> <events> replays historical inputs against a changed manifest and reports which decisions would come out differently — counting a changed outcome separately from a changed explanation, because folding them together overstates the blast radius of a change.

### 1 of 4 past decisions would change
| # | input | change |
|---|---|---|
| 1 | amount=80 | `disposition`: auto_approved → manager_review |

Packaged as a reusable GitHub Action (action.yml) that maintains a single pull-request comment. Verified end to end.

Diagnostics

A new package measuring the error side — intent miss rate, probe refusal rate, escalation rate — rather than only the flattering counts. Rates are zero over no data rather than NaN: a rate with no denominator is missing data, not a good score.

Security

Five findings from an audit, each fixed with a test that fails without the fix:

Severity	Issue
high	Path traversal in the catalog — an untrusted index.json could read outside the root or write outside the install directory
medium	/v1/pending handed out the resume pointer, which is the capability to approve
medium	Unbounded outbound response reads in llmhttp, embedhttp, httpsandbox
low	Internal error text returned to clients
low	wasmhooks.Hook ran untrusted WASM with no deadline

Also

• code_audit example: an AI PR-review agent re-cast so the model only extracts and a deterministic gate decides — a model-derived severity cannot auto-block a merge.
• Catalog grew from 2 to 6 plugins, all pure JSON.
• Every document is English-only; the README covers architecture and operation.

Full log: v0.1.0...v0.2.0