Release v2.0.0 — hardened ASGI deployment, transport cleanup, credential redaction, ai-skills compliance · paulomac1000/ha-mcp-readonly

v2.0.0 — 2026-08-12

Removed the legacy two-endpoint HTTP+SSE transport. Supported MCP transports are now stdio and Streamable HTTP only.
The network deployment uses an explicit hardened ASGI application with bounded request/header sizes, trusted Host policy, exact-origin CORS, connection limits, and explicit stateless/stateful mode.
Public capability discovery separates supported and active transports/components and reports server, SDK, protocol, and deployment-profile identity.

Final tool responses are recursively redacted at the application-owned operation boundary (key-aware credential filtering plus token/JWT/IP pattern sanitization).
Blocking coroutine adapters run through the bounded invocation executor instead of blocking the MCP event loop.
REST and MCP HTTP request bodies and aggregate headers are bounded before application parsing.

diagnose_automation_aliases cut from >120s to ~4.5s on a live 131-automation instance.
Backend health probe retries at startup with background reconciliation; transient failures no longer permanently disable read capabilities.

1,251 unit/protocol, 87 smoke, 278 integration, 174 e2e checks green on HA 2026.5.1 (operator validation, PR #22).
Full evidence in docs/evidence-live-27d32c9b.md.