RELEASE.2026-09-01T00-00-00Z

Changelog

• f5c5dc9 build: import the SILO package under its own module path
• 2d5abc2 chore: complete the AGPL notice on fork-authored files
• c05da7b chore: drop configuration for bots that are not installed
• 2c33a4e chore: ignore the local consumer-module review scratch directory
• f484d0d ci: make a release prove its commit, and pin what it builds from
• 9a3805d ci: make release retries tag-idempotent
• 3674933 ci: make the release gate provable and its claims true
• 1445e88 ci: release only from a signed tag at the tip of main, verify exact provenance
• a8e7eb4 ci: test main on push and stop dispatch runs cancelling each other
• a6c14da ci: verify build provenance before repackaging archives into images
• aa07b1c feat: add read-only object checksum verification
• 4abbb3a feat: expose how much checksum verify actually verified
• 7057705 fix: avoid double-closing S3 Select responses
• d38412a fix: classify an SSE-C refusal with a key as a read error, keep policy and size messages clear
• f188939 fix: close final credential and release verification gaps
• bdc742a fix: close the remaining --debug credential leaks
• 45e5144 fix: fail --fail-on no-checksum when nothing was verified
• c1358c4 fix: force 0600 on rotated support artifacts too
• 76b2e89 fix: keep an unquoted DSN password whole and match auth schemes case-insensitively
• 625713c fix: keep only the scheme of a signed header and scrub JSON structurally
• 08244df fix: keep secrets out of error messages and traces
• 59989f8 fix: let svcacct set clear a policy again, report bad global flags once
• 4b36b0a fix: make credential redaction fail-closed and scrub final output
• 1b39423 fix: preserve checksum output in pipelines
• 81e2767 fix: rebuild SigV4 traces from known fields and widen secret scrubbing
• ec12b64 fix: redact admin trace output and register every credential ingress
• f5b88dd fix: redact the default admin trace and stop the shape sweep mangling prose
• b291b53 fix: register a URL password as written, keep listing parameters visible in traces
• 328efee fix: register the password before the first separator of an unquoted DSN payload too
• 915cfd9 fix: reject a malformed app-level global flag instead of ignoring it
• a29b455 fix: stop --debug from printing credentials
• b75d28b fix: stop checksum verify help from advertising the play alias
• 30a7ea0 fix: stop writing support artifacts world-readable
• 712bf3a fix: use regular PUT for empty pipe input
• 2121081 fix: validate policy writes strictly
• 3998392 fix: withhold SSE-C keys and credential URLs the parser rejects