v0.2.0

Three additions to the governed-pipeline engine, plus sharper positioning.

Webhook triggers (schedule: webhook)

Opt-in HTTP server: authenticated POST /hooks/<pipeline> runs a pipeline on demand. Bearer auth (constant-time compare), body-size cap, 409 when already running, no port opened unless enabled, refuses to start without a secret. The request body reaches the pipeline as {{webhook_body}} / {{input}}. A trigger only starts a pipeline — the approval gate still runs, so an inbound request can never make the LLM fire an outbound action.

Observability spans (internal/obs)

Opt-in structured JSON spans, one per pipeline and one per step (duration, status, tokens, cost). Off by default; enable with observability.spans: true or DRAFTCAT_TRACE=1. One line per span, ready for a log collector or a future OpenTelemetry exporter.

Schema enforcement: enum + number

output_schema now enforces enum membership and the number type at runtime. Skills already used both, but they were silently ignored. The validator accepts them and flags non-list enums.

Positioning

README adds an agent-harness (Flue / Claude Code) comparison column, framing Draftcat as the deterministic-boundary inverse of an autonomous agent harness.