v0.4.0 — Manual Dual-Control for Malicious Resolution

This release adds one narrow substrate primitive to AgentGate:

manual malicious action resolution now requires dual control.

What changed

Before this release, a manual malicious resolution could finalize from a single eligible non-executor resolver.

Now:

• the first eligible non-executor resolver records a pending malicious vote
• the action remains open after that first vote
• a second distinct eligible non-executor resolver is required to finalize the malicious slash
• duplicate same-resolver malicious votes now fail with DUPLICATE_MALICIOUS_VOTE

What did not change

This release is intentionally narrow.

Unchanged behavior:

• success resolution
• failed resolution
• sweeper auto-slash on expired actions

Sweeper-driven expiry slashing still bypasses manual voting and resolves immediately.

Why it matters

This closes a real substrate gap in the manual malicious-resolution path without redesigning the broader settlement model.

The new honest claim is narrow:

• manual malicious resolution no longer finalizes from one resolver alone
• manual malicious slash now requires two distinct eligible resolver identities
• automatic expiry slashing is unchanged

Verification

Passed:

• focused tests for app / trust-tier / sweeper behavior
• full test suite
• lint
• build

Current suite:

• 123 tests across 12 suites

Notes

This is a substrate-deepening release, not a new repo or a broader framework expansion.