v0.3.0

What's Changed

• fix(pages): guard runbook Liquid tokens so the Jekyll build succeeds by @rmednitzer in #118
• docs(pages): dark theme (midnight) + drop the "Home" landing title by @rmednitzer in #119
• docs(pages): rebuild the documentation site with MkDocs Material by @rmednitzer in #120
• chore(deps): update github-actions by @renovate[bot] in #121
• chore(deps): update pre-commit hook astral-sh/ruff-pre-commit to v0.15.20 by @renovate[bot] in #122
• fix(deps): update python dependencies - autoclosed by @renovate[bot] in #123
• chore(deps): update actions/checkout action to v7 by @renovate[bot] in #124
• chore(renovate): adopt shared renovate-config preset (keep repo rules) by @rmednitzer in #125
• chore(renovate): repoint preset to infra-hosted renovate-preset by @rmednitzer in #127
• feat(broker): opt-in Tier-3 confirmation broker (ADR 0009) + 2026-07-15 audit by @rmednitzer in #128
• Add Tier-3 confirmation broker configuration by @rmednitzer in #129
• fix(security): redaction secret leak + ReDoS + SSH deny/broker gaps (2026-07-15 adversarial + perf pass) by @rmednitzer in #130
• fix(renovate): drop unresolvable external preset to unpause Renovate (#126) by @rmednitzer in #131
• chore(deps): update dependency cryptography to v49 by @renovate[bot] in #134
• chore(deps): update actions/upload-pages-artifact action to v5 by @renovate[bot] in #133
• chore(deps): update actions/deploy-pages action to v5 by @renovate[bot] in #132
• docs(deployment): host integrity + config-drift monitoring (DOC-6) by @rmednitzer in #135
• docs: add ADR 0009 to the mkdocs nav by @rmednitzer in #136
• feat(audit_tail): read-only triage filters; close AUD-1 (split disposition) by @rmednitzer in #137
• fix(sshpool,sessions): idle reaper must not evict in-use connections/sessions by @rmednitzer in #138
• fix(sshpool): pin the connection for the duration of run() by @rmednitzer in #139
• test(policy): pin session_send payload classification; document the limit by @rmednitzer in #140
• fix(redaction): RED-8 — quoted secret tail leaked past the P1 scan window by @rmednitzer in #141
• fix(oauth): AUTH-3 — enforce token expiry atomically at exchange by @rmednitzer in #142
• docs(adr): add ADR 0010 — rollback/verify broker (BRK-2), proposed/deferred by @rmednitzer in #143
• docs(adr): add ADR 0011 — Windows targets via OpenSSH + PowerShell 7 by @rmednitzer in #144
• feat(policy): WIN-1 — Windows/PowerShell-7 tier classification (ADR 0011) by @rmednitzer in #145
• feat(redaction): WIN-1 — PowerShell credential redaction (ADR 0011 inc. C) by @rmednitzer in #146
• release: prepare v0.3.0 by @rmednitzer in #147

Full Changelog: v0.2.0...v0.3.0