Where Goshawk opened the doors (MCP, A2A, /v1, cross-language crypto), Sentinel stands guard over what comes through them.
- TypeDID envelope auth on
/v1(serve --require-auth):x-qg-envelopebound to the request path and body hash, Ed25519-verified against the envelope's did:key; failures are 401 receipts carrying the contract. POST /v1/answerand the semantic-model registry (models/import/{osi,croissant},models,search).- MCP stdio server (
mcp-serve): dependency-free JSON-RPC 2.0, same governed surface as/v1. - Reverse crypto direction closed:
PyTypeDidEnvelope::signedmints qg-python-compatible envelopes (same seed → same did:key). - Stack realigned to the 0.12 substrate wave: Grust 0.12.0 "Lobster", TypeSec 0.12.0 "Torcello", LakeCat 0.3.0 "Ocelot" — 40/40 green.
- A second book: The QueryGraph Stack guide (
docs/guide), plus the review deck and tri-format one-pager; the dedicated book gains the Goshawk/Sentinel chapter.
See CHANGELOG.md.