v0.3.0

Added

• Added comprehensive PPE documentation and tested examples. (#82)
• Documented the CMF extension bag contract and expanded cross-PDP conformance tests. (#59)
• Added a catalog of fail-closed safety invariants with fault-injection tests. (#71)
• Added Criterion benchmarks for hook dispatch, full decisions, throughput, PDP evaluation, and session memory. (#35)

Changed

• Updated base64, CEL, Redis, deadpool-redis, UUID, and related dependencies.(#111)

Removed

• Removed the unused public BAG_WORKLOAD_PREFIX constant. (#59)

Fixed

• Contained serial, transform, audit, and PDP panics through on_error; cancelled requests now abort spawned work and preserve prior plugin state. (#71)
• Made the ppe-core self-test dependency path-only so release packaging can resolve it. (#71)
• Corrected read_labels and read_workload capability namespaces to match the keys emitted by the CMF bridge. (#59)

Security

• Redacted inline PEM keys and HMAC secrets from identity configuration debug output. (#86)
• Updated rustls to 0.23.45 for RUSTSEC-2026-0285. (#86)

Internal

• Raised line coverage above 96% and made the LCOV artifact match the gated run. (#86)
• Added multithreaded engine stress tests, a Loom memory-ordering model, and a nightly ThreadSanitizer job. (#60)

New Contributors

• @aviavissar made their first contribution in #86

Contributors

• @abdallahsamabd
• @araujof
• @aviavissar
• @mkoushni

Full Changelog: v0.2.0...v0.3.0