v1.4.4

What's Changed

• fix(graft): keep receiver endpoint record private by @randlee in #928
• Recover 3 orphaned AI36 finding records for re-verification by @randlee in #925
• sync: back-propagate main into develop (PR #914 hotfix) by @randlee in #915
• feat(cli): agent@host cross-host shorthand + trusted-peer host resolver (#901/#902) by @randlee in #933
• fix: drop .atm.toml activation gate, fail loud on real errors (GH #900) by @randlee in #934
• plan: Phase AS shared publish-kit migration by @randlee in #939
• docs: GH #864 canonical naming SSOT link + ingestion diagnostics by @randlee in #937
• docs+feat: permissive sender-identity ADR + non-blocking roster warning by @randlee in #938
• chore(tracking): remove worktree-tracking.md from repo by @randlee in #936
• Plan: Phase AO (opt-in mTLS) + Phase AP (outbound connectivity) by @randlee in #829
• AS.2: Justify ATM consumer-manifest activation by @randlee in #944
• AS.1: Freeze canonical publish-kit overlay by @randlee in #940
• docs(as4): record blocked PyPI publication receipt by @randlee in #947
• chore: prove publish-kit branch overlay by @randlee in #946
• fix(ci): centralize sc-compose revision pins by @randlee in #951
• Phase AS: shared publish-kit migration engineering (AS.1-AS.4) by @randlee in #954
• refactor(as5): retire bespoke Hermes PyPI pipeline by @randlee in #955
• Phase AS: merge AS.5 legacy-retirement delta by @randlee in #956
• Revert: pull Phase AS engineering back out of develop by @randlee in #957
• DRAFT: Phase AS engineering (AS.1-AS.5) -- for review, not merge by @randlee in #958
• plan: TLS transport isolation replan (freezes Phase AO) by @randlee in #959
• Revert unauthorized Phase AS redraft from develop by @randlee in #960
• AO2.1: Peer-wire policy and plain-pipeline baseline by @randlee in #961
• fix(sprint-report): don't gate in-progress sprints as data gaps by @randlee in #964
• AO2.2: isolated mTLS peer-wire byte-stream adapter by @randlee in #965
• docs(ao2): mark AO.1 complete, register sprint line by @randlee in #962
• AO2.3: runtime peer-wire mode seam by @randlee in #967
• AO2.4: Operational performance proof (shipped daemon, mode-aware benchmarking) by @randlee in #968
• fix(ao2): harden cleanup guards and version sync by @randlee in #970
• fix(daemon-switch): gate signed cli and daemon pairs by @randlee in #974
• fix(daemon-switch): gate signed cli and daemon pairs (cherry-pick to develop) by @randlee in #975
• fix(signing): migrate ATM binaries to Apple Development identity by @randlee in #976
• fix(smoke): AO2 benchmark harness peer-wire-mode isolation and daemon-switch hardening by @randlee in #977
• docs(ao2): AO2.5 benchmark-db-safety and daemon-switch launch-overlay plans by @randlee in #979
• Add canonical SC website (site/ + announcements/) by @randlee in #953
• docs(ao2): plan AO2.5.4/AO2.6/AO2.7/AO2.8 benchmark safety and parity sequence by @randlee in #980
• propagate documents by @rand-lee in #981
• fix(AO2.5): benchmark primary-db safety + daemon-switch launch overlay (AO2.5.1–.3b) by @randlee in #978
• fix(ao2.6): restore admission writer batching regression by @randlee in #982
• fix(smoke): mandatory benchmark snapshot/restore lifecycle (AO2.5.4) by @randlee in #983
• build: centralize pinned bootstrap tooling ('just bootstrap') by @randlee in #986
• fix(graft): receiver reconnect + nudge body propagation (GH-985) by @randlee in #987
• fix(benchmark): remove mutating daemon start from post-restore readiness check by @randlee in #992
• fix: scope benchmark daemon-switch preflight to owner UID by @randlee in #991
• fix(benchmark): regenerate stale mTLS identity during account bootstrap by @randlee in #993
• test(benchmark): fix WAL-mode snapshot contract regression from PR #992 by @randlee in #994
• fix: writer/batch-concurrency throughput regression (AO2.7 sqlite parity) by @randlee in #990
• fix(bench): cap atmbench connection workers to RLIMIT_NOFILE reserve by @randlee in #995
• fix(bench): dedupe signing identity selection by certificate fingerprint by @randlee in #996
• perf(search): omit unused FTS5 column sizes + wire sqlite/UDS into default benchmark matrix by @randlee in #997
• fix(benchmark): bootstrap dedicated-account six-frame plaintext baseline by @randlee in #998
• docs(benchmark): close out f64 concurrency-collapse diagnostic by @randlee in #999
• AO2.10-AO2.13: benchmark-report simplification plan (supersedes AO2.9) by @randlee in #1006
• fix(ao2-7): close minimal benchmark harness QA findings by @randlee in #1009
• ci: trigger PR checks on fix/, feature/, sprint/* base branches by @randlee in #1008
• fix(bootstrap): synchronize local macOS seed tools on version drift by @randlee in #1010
• fix(benchmark): AO2.7 direct-peer benchmark harness (f8 matrix, campaign XHTML publish) by @randlee in #988
• feat(ao2-10): benchmark data contract v4 — classify_status(), baseline ratchet, ledger removal by @randlee in #1012
• fix(graph-orchestration): branch-scoped open-findings ignores stale legacy Resolution/status by @randlee in #1017
• AO2.11: Benchmark rendering pipeline by @randlee in #1013
• docs(ao2): AO2.12 migration-contract amendments from critical review by @randlee in #1016
• docs(ao2): AO2.14 daemon-owned peer connection pooling sprint plan by @randlee in #1018
• AO2.12: Historical data migration + AO2.11 QA-1 fix round (F002/F005) by @randlee in #1014
• AO2.13: benchmark-run skill + just benchmark-publish recipe by @randlee in #1015
• docs(aq): Phase AQ plan — PRD, phase plan, sprints AQ1-AQ6 (hardened) by @randlee in #1011
• docs(plan): AO2.15 — just benchmark-official unattended trigger by @randlee in #1022
• AO2.14: Peer connection pooling by @randlee in #1020
• fix: restore SQLite benchmark target to async_storage_admission by @randlee in #1021
• fix(benchmark): TLS session/context reuse + f8 client saturation (controlled-baseline harness) by @randlee in #1023
• AO2.15: just benchmark-official — unattended, CI-triggerable benchmark trigger by @randlee in #1024
• site: announce atm-core v1.4.3 by @randlee in #1025
• main->develop by @randlee in #1027
• fix(ci): remove bootstrap source-build wall-clock regression by @randlee in #1026
• evidence: AO2 official Windows benchmark by @rand-lee in #1029
• Phase AO2: opt-in mTLS peer-wire transport (in progress) by @randlee in #966
• docs: replace tmux send-keys nudge with atm send re-dispatch guidance by @randlee in #1031
• feat(atm-dev): 5-agent team, 3-window layout (cipher + fenix + publisher) by @randlee in #1038
• AU.1: boundary code fixes (easy wave) — retire 11 sc-boundary findings by @randlee in #1034
• AU.2: sc-lint-boundary calibration (mid wave) — precise identity for 10 findings by @randlee in #1035
• AU.3: ack/send shared write module (hard wave) — retire the ack↔send cycle by @randlee in #1036
• docs: Phase AU plan — sc-boundary debt retirement (22 findings, GH #1028) by @randlee in #1032
• Phase AU: retire the 22-finding sc-boundary debt (AU.1–AU.3) by @randlee in #1041
• docs(plan): AQ2.5 post-merge hardening — selector-file ownership + deliverable-4 code contract by @randlee in #1019
• test: widen direct peer loopback timeout on CI by @randlee in #1037
• docs(plan): phase AT manifest-driven publishing recovery by @randlee in #963
• feat(release): install pinned sc-publish package by @rand-lee in #1044
• ci(release): register pypi-publish.yml on default branch by @randlee in #1047
• docs(at1): record failed TestPyPI attempt evidence in AT.1 receipt by @randlee in #1052
• docs(at1): forward-only publishing amendment — TestPyPI retargeted to kit-era v1.4.4 by @randlee in #1062
• docs(at2): retarget deletion gates to first kit-era release (forward-only publishing) by @randlee in #1063
• AT.2: legacy publish surface deletion (execute-now with deferrals) by @randlee in #1064
• Phase AT: manifest-driven publishing recovery (AT.1 + AT.2) by @randlee in #1065
• release-prep: 1.4.4 changelog + published sc-lint-attributes cutover by @randlee in #1068
• Release v1.4.4 — first kit-era release (Phase AT) by @randlee in #1067
• chore(release): re-pin sc-publish kit to blessed revision 25668ec by @randlee in #1069
• release: forward sc-publish re-pin to main for v1.4.4 by @randlee in #1071
• Release v1.4.4 by @randlee in #1072

Full Changelog: v1.4.3...v1.4.4