Release v1.9.0 — Document Review & Approval Workflow · risk-sentinel/sparc

SPARC v1.9.0 — Document Review & Approval Workflow.

Highlights

Document review & approval workflow (#640, #630–634) — new Approvable model, review queue, and BaselineReviewService/DocumentApprovalService. Gated by SPARC_REQUIRE_DOCUMENT_APPROVAL (default off, so existing publish flows are unchanged until an org opts in).
Authoritative sources & federation (#657, #646) — add/import an authoritative source, plus a release-validation gate (API-coverage + nav CSP sweep).
Bulk delete for CDEF + Authorization Boundary index (admin) (#638, #629).
Content-completeness gate + empty-shell recovery (#637, #627/#628).

HDF→OSCAL translation restored on hdf-cli 3.2.0 (#662, #648) — 3.2.0 made baselines required for hdf→oscal-sar and removed the direct hdf→oscal-poam converter. SPARC now injects baselines: [] for real scanner HDF (gated on a profiles key so non-HDF input is still rejected), and poam_from_hdf returns 501 (POA&M was re-sourced upstream to hdf-amendments → oscal-poam; tracked as #663).
CSP hardening (#656) — eliminated inline event handlers (#645/#647), Cache-Control: no-store on login (#649), and CSP violation reporting (#528).

Dropped the unused thruster gem — clears 8 Go-module CRITICAL CVEs (#651, #612/#639).
nokogiri 1.19.4 — fixes two use-after-free advisories (GHSA-wfpw-mmfh-qq69, GHSA-wjv4-x9w8-wm3h), reachable via untrusted XML upload parsing (via #662).
rubyzip 3.4.0 + shoulda-matchers 8.0 (#658); patch-updates group (#652).
SHA-pinned every GitHub Action repo-wide (#659) — clears Sonar supply-chain hotspots and makes Dependabot SHA-pin going forward.

README refresh — Key Features + dev setup for v1.9.0 (#664).
System specs now always exercise the mandatory login consent banner (#190), independent of a developer's .env (via #662).

API contract suite has pre-existing schema drift (#644) — scheduled post-release.
Profile-index a11y color-contrast on the "Duplicate" button (#668).