v3.19.1

94 changes since v3.19.0. This is the release where the name caught up with
the product.

Bernstein began as a scheduler for coding agents. Along the way it started
keeping receipts: for every approval, every key, every model, every span an
agent emits. What ships here is a governance framework for AI agents — the
part that lets a security officer say "I know what the agents did, and I can
prove it", and lets an auditor check the proof without trusting us. It is
Apache-2.0, and every claim in it can be verified by someone who does not
like us.

Seven questions, answered from the record

The question you get asked	Before	Now
Did a person approve this?	An approval gate that timed out counted as approved. Nobody could tell that record from a real one.	It fails closed and the record says timed_out. Approving on timeout is a named opt-in, and the expiry is still written down as an expiry (#5051). We are not proud of the "before".
Where are the secrets?	Copied into Bernstein's store.	They stay in your store. Bernstein brokers a short-lived credential and records the grant, the issuer, the audience and the expiry — never the value (#4984). A token can be bound to the certificate that must present it; a replay from anywhere else is refused, and the refusal is chained (#5030). Secrets surfacing in tool output are redacted before storage (#4992).
Who is this agent, and who says so?	An identity per credential format, minted on request.	One principal type behind both credential formats, and authority decisions are checked against it (#2926). Principals are provisioned and deprovisioned through an append-only, HMAC-chained lifecycle (#4972), and a child identity cannot be minted with a wider scope than its parent (#5046). Your identity system reads the roster over SCIM 2.0 (#5040).
Which model was allowed, on that day?	Whatever today's config file says.	Replayed from chain events at that instant (#5038). Drift observations are signed (#5041), an MCP server's tool-set changes are logged (#4975), every spawn records which endpoint served it (#4908), and plugins and skills are pinned to exact content addresses — latest is refused (#5089), a catalog skill linted for hostile prompt patterns before install (#2899).
What did the agents we did not schedule do?	Nothing on record.	Point the OTLP collector you already run at Bernstein. Spans become receipted chain entries, and the receipt states its coverage limit instead of implying more (#4983, #4962, #5024). A guard that never fired is now distinguishable from a guard that was never reached (#3454).
Show me the audit.	A printout.	bernstein govern is the one CLI (#5010). The report is a chain-anchored artefact: two audits of an unchanged install are byte-identical, an edited report fails verification (#5077). One number scores posture from what the chain evidences (#4989), against checks with stable ids and a verdict that can say "not measurable" (#5072). Per control, compliance coverage says evidenced, partly, or cannot be (#4978), and separates what was observed from what an operator asserted (#5029). govern reconcile --propose asks whether the declared surface is still installed (#5085); governance plan diffs declared posture against what is deployed (#4980); cluster govern-inventory covers the workloads nobody remembered to wire (#4988), and govern inventory --render draws the result (#5133). A run reports what share of its actions a decision covers, and an uploaded receipt gets a verdict (#5067); every external policy verdict is recorded, including "the engine did not answer" (#4912); playbooks hash the same in any clause order (#4979); cost rolls up per principal and per grant (#4985), and crossing a budget cap is a chain event, not a log line (#2918). Evidence exports against the records-derivable subset of ISO/IEC 42001 Annex A (#3238), and the AI-BOM comes from the run's own lineage (#2916).
Can I check this without you?	Mostly.	Signing keys rotate and revoke through a signed succession chain: receipts an auditor already holds stay valid, a revoked key fails (#4211); an out-of-band key can be pinned when verifying an envelope (#5064). Session revocation is chained (#5031). Audit checkpoints can be timestamped by an outside RFC 3161 authority and co-signed by a witness, so a rewind no longer verifies clean (#5147, #3161). Evidence ships as a versioned signed envelope (#5063), receipts are checked against numbered format requirements with an executable corpus (#4987), and bernstein verify picks its verifier from the artefact itself (#5103). Lineage exports to W3C PROV-O (#5039); run evidence exports as a signed TRACE 0.2 record, offline (#4667). KMS adapters live in a custody module (#5033).

The receipt that did not verify

Offline verification of a signed refusal receipt failed on every input, and a
broad exception guard hid it: a valid receipt and a forged one looked the same
(#2980). Fixed, with a test that verifies a real receipt from the on-disk
record alone. The standalone verifier had a second version of the same
problem — run as a script it exited without verifying anything (#5054). In the
same spirit: volunteer bundles are re-run in a clean worktree before they are
believed (#3871); diff comments bind to bytes, not line numbers (#3456);
every adapter kill returns a reap receipt (#5015); scan results record the
invocation that produced them (#5151); receipts on targets carry a freshness
window (#5087); a run receipt binds the audit window it declares, not only its
content hash (#5269); a checkpoint binds the bytes its suspended work was
derived from, so a resume cannot continue on files that moved underneath it
(#5206); findings are canonicalised strictly, so a payload that was silently
accepted before is now rejected (#2953); and sensitivity propagates across a
lineage closure, so a summary of a confidential document is confidential
(#5042). And every number in a pull-request description now describes the same
diff: the diff-stat is asked of the branch, like the commit list beside it,
instead of a snapshot of a worktree that had since been cleaned.

For the engineers

Context: an opt-in pack folds co-change neighbours, the test-to-source map
and the nearest AGENTS.md into one content-addressed prompt section
(#4522); context manifest (#3366) and context segment-prompt (#3455)
digest what an agent was given; structural compaction is reproducible, with
correlation ids derived from the fold rather than a random uuid (#2915);
memory show folds a memory chain to its live claims (#2914). Runs:
deterministic repository-flow samples (#4940) feed a stagnation detector
(#4941); runs report shows lifecycle state and step timings (#5127); a
lease primitive claims a TTL'd resource (#5128); completions can name what
they produced (#5002); the per-task token budget is actually wired into the
tick (#3374); evolve run folds a recurring failure into one issue instead of
many (#4504); GitHub push events respect the cooldown, dedup and filter rules
in triggers.yaml (#4545); a volunteer hub can offer work with no git forge
behind it (#3877). Adapters: Kimchi over ACP (#3100), Nmap (#3618), garak
(#4839), Skyvern (#4876); adapters draft proposes a profile from an
installed CLI (#3763); agents discover --harness-local reports harness
paths, status and content digests (#3969); gptme honours max_tokens
(#4955); feed-pinned Trivy scans verify the database they loaded (#4961);
bernstein activity gained research, data and ops subgroups (#4925); Qwen,
OpenCode, Codex and Gemini all deliver the completion protocol a spawned
agent needs to finish (#5325); a codex run whose sandbox denied every command
is reported as the failure it was, instead of exiting 0 (#5314); an
operator whose host already isolates can declare that, instead of switching
everything off (#5341); and the codex sandbox argv follows the adapter's
declared dangerous-mode strategy rather than a hardcoded flag (#5323). Two paths that could reach the operator's own checkout — a warm-pool
slot with an empty worktree path, and salvage — no longer can.

On upgrade

• bernstein governance forwards to bernstein govern with a warning; it
  goes away in v4.0.0.
• If you relied on approval gates resolving on timeout, set
  approve_on_timeout. The expiry is still recorded as an expiry.
• A skill installed from a catalog is now linted before promotion; a skill
  that fails the lint is refused rather than installed.

Smaller fixes

#2919, #4873, #4904, #4913, #4916, #4918, #4938, #4947, #5048, #4996.

Contributors

Thanks to @vaibhav8a, @Phoenix1504e, @PARZIVAL7498, @saketh-bandi,
@albin-george-kurian, @chuanxu742-glitch, @GOLDMEMARY, @kudala-bharani,
@prateeekbuilds, and @Rehan30g.

---

What's Changed

• volunteer: re-verify result bundles in an independent clean room by @chernistry in #4923
• fix(spawner): apply role_policy model resolution on resume path by @bernstein-orchestrator[bot] in #4926
• chore(deps): update dependency @tanstack/react-query to v5.102.3 by @renovate[bot] in #4924
• feat: merge-tree probe for live worktree pairs (#3279) by @albin-george-kurian in #4927
• fix: add missing trailing newline in test file by @bernstein-orchestrator[bot] in #4929
• feat: Add data run/verify subcommands to activity CLI mirroring browser pattern by @bernstein-orchestrator[bot] in #4925
• chore(orchestration): delete orchestrator_backlog, a diverged copy of ingest_backlog by @vaibhav8a in #4898
• docs(compliance): NIST AI RMF Core subcategory map (#4915) by @PARZIVAL7498 in #4932
• feat(lineage): export OpenLineage RunEvent JSONL from the chain (#4914) by @PARZIVAL7498 in #4931
• feat(adapters): drive a Skyvern server over its HTTP surface by @bernstein-orchestrator[bot] in #4876
• feat(scanners): add feed-pinned trivy adapter by @saketh-bandi in #4933
• fix(ci): read the test-count-drop override where the merge is gated by @chernistry in #4934
• feat: garak adapter - adapter driving garak CLI non-interactively by @bernstein-orchestrator[bot] in #4839
• fix: add trailing newline to test_init_redirects.py by @bernstein-orchestrator[bot] in #4936
• docs: describe surfaces instead of comparing them, and guard it by @chernistry in #4928
• ci(trivy): stop the filesystem gate scanning the scanner fixtures by @chernistry in #4942
• fix(spawner): fall back to main workdir when worktree creation fails by @bernstein-orchestrator[bot] in #4938
• feat(observability): add repository flow stagnation detection module by @bernstein-orchestrator[bot] in #4943
• feat(observability): add append-only repository-flow series persistence (#4940) by @bernstein-orchestrator[bot] in #4944
• feat: add negative case and offline verification tests for research modality by @bernstein-orchestrator[bot] in #4860
• docs(release-notes): edit v3.19.0 down to what it actually says by @chernistry in #4946
• feat: regenerate docs/requirements.txt with fresh transitive pins (#4888) by @bernstein-orchestrator[bot] in #4948
• docs(release-notes): restore the v3.19.0 heading by @chernistry in #4953
• feat(adapters): add load_profile_from_draft to consume persisted drafts by @bernstein-orchestrator[bot] in #4945
• feat(observability): add RepositoryFlowSample and collect_repository_flow by @chernistry in #4950
• test: add #4947 requirement tests for release notes rotation by @bernstein-orchestrator[bot] in #4952
• feat: implement finding-reference resolver and report sidecar verification by @bernstein-orchestrator[bot] in #4821
• feat(routing): escalation ladder schema and evidence records (#4855) by @PARZIVAL7498 in #4887
• docs: scope the replay claim to what the code actually guarantees by @chernistry in #4956
• feat: add depth k=1 vs k=2 differentiation test by @bernstein-orchestrator[bot] in #4951
• docs: scope the replay claim in the social preview meta and the steering page by @chernistry in #4993
• fix(scanners): verify trivy database feed pin by @saketh-bandi in #4961
• fix(security): an unreachable policy engine denies, instead of reading as no-match by @vaibhav8a in #4971
• fix(adapters): wire GPTME_MAX_TOKENS from mcp_config for gptme by @GOLDMEMARY in #4957
• docs: release-note fragment for feed-pinned Trivy database verification by @chernistry in #4994
• test(orchestration): prove reachability package-wide, so a dead copy fails CI by @vaibhav8a in #4896
• feat(scripts): decide contributor-bait labels from provable claims by @chernistry in #4995
• fix(pr): compose every number in the body from the branch diff by @chernistry in #4996
• feat(cli): wire pipeline run to drive tracker pipeline via build_pipeline_from_yaml (#4916) by @prateeekbuilds in #4954
• docs: regenerate adapter last-green table from canary receipts by @chernistry in #4997
• test(adapters): narrow adapter contract exclusions to spawn-only carve-outs (#4935) by @PARZIVAL7498 in #4998
• fix(test): use lock_manager in test_ownership_released_on_reap by @bernstein-orchestrator[bot] in #4949
• test(worker): stop the shim-overflow tests writing into the repository by @chernistry in #5000
• feat: OTLP ingest receiver + typed/untyped activity mapping (Issue #4983) by @bernstein-orchestrator[bot] in #4999
• chore(routing): delete the T565 token-escalation chain, superseded by #3586 by @vaibhav8a in #4991
• Fix/mypy core config server git by @Phoenix1504e in #4894
• feat(security): add change receipt data model and verification by @bernstein-orchestrator[bot] in #5003
• feat(tasks): add content-addressed completion exports by @chuanxu742-glitch in #5005
• fix(ci): keep the branch-protection marker labels under GitHub's description cap by @chernistry in #5008
• docs: state the conformance level a software-only install actually reaches by @chernistry in #5011
• fix(compliance): describe the system by what it governs, from one string by @vaibhav8a in #5012
• test(security): report proved-uncalled and unproven controls as two lists by @vaibhav8a in #5009
• feat(core/compliance): add control-to-event mapping data structure by @bernstein-orchestrator[bot] in #5017
• feat: define inventory and playbook data models for govern plan by @bernstein-orchestrator[bot] in #5013
• feat(lineage): add activity_source field to LineageEntry (issue #4962) by @bernstein-orchestrator[bot] in #5025
• test: add unit tests for audit_receipt_verifier.py by @bernstein-orchestrator[bot] in #5044
• feat(observability): OTLP ingest boundary with anchored receipts (#5024) by @bernstein-orchestrator[bot] in #5050
• Fix/mypy integrations preview skills by @Phoenix1504e in #5014
• feat: add ModelRef dataclass and extend RouteDecision with model response metadata by @bernstein-orchestrator[bot] in #5092
• chore(deps): update dependency astral-sh/uv to v0.12.6 by @renovate[bot] in #5080
• chore(deps-dev): bump browserslist from 4.28.4 to 4.28.8 in /packages/vscode in the npm_and_yarn group across 1 directory by @dependabot[bot] in #5049
• feat: Add decomposition proposal schema and retry exhaustion emission policy by @bernstein-orchestrator[bot] in #4889
• feat(scanners): add transcript-anchored nmap adapter by @saketh-bandi in #5137
• chore(deps): update dependency @tanstack/react-query to v5.102.4 by @renovate[bot] in #5134
• ci: bound the trace-conformance job with a timeout by @chernistry in #5155
• ci: set explicit artifact retention on the two uploads that have none by @chernistry in #5156
• style: apply the pinned formatter to the three files outside the lint gate by @chernistry in #5162
• ci: report workflow registrations that no longer have a file on main by @chernistry in #5158
• ci: shard the macOS nightly suite so it finishes inside its timeout by @chernistry in #5159
• fix: store chain position in revoke_session before save and emit bounded propagation by @chernistry in #5138
• feat(govern): add govern discover --assist CLI command (issue #5020) by @bernstein-orchestrator[bot] in #5173
• ci: recapture the web UI renders on runners when the SPA bundle moves by @chernistry in #5157
• build(web): update browserslist to 4.28.8 by @chernistry in #5186
• feat: add MCP capability drift event to audit chain (#7937) by @bernstein-orchestrator[bot] in #5045
• refactor: move the KMS adapters to a neutral key-custody module and guard direct key loads (#5033) by @chernistry in #5139
• feat(security): record every external policy evaluation in the audit chain (#4912) by @chernistry in #5140
• docs: add 5048 tailscale example release note fragment by @bernstein-orchestrator[bot] in #5143
• feat: derive a content-addressed context manifest from a task's declared paths (#3366) by @chernistry in #5148
• feat: anchor audit checkpoints outside the local filesystem (#5036) by @chernistry in #5147
• fix(approval): fail closed when a review-mode gate times out (#5051) by @Rehan30g in #5196
• feat: re-derive a run's coordination sequence from recorded inputs (#4213) by @chernistry in #5146
• fix(adapters): return reap receipts from manager and cache by @kudala-bharani in #5171
• feat: report per-run governance coverage on the dashboard API (#5067) by @chernistry in #5164
• feat: portable authority envelope schema and standalone verifier (#5055) by @chernistry in #5165
• feat: propagate data sensitivity forward over the lineage closure (#5042) by @chernistry in #5167
• feat: resolve operand lineage taint at the tool-call approval gate (#2957) by @chernistry in #5166
• feat: resolve a task's change set and add 'bernstein undo --dry-run' (#2919) by @chernistry in #5160
• core: digest orchestrator-authored prompt segments (#3455) by @chernistry in #5172
• feat: project a model-admission registry from the audit chain (#5038) by @chernistry in #5163
• feat: anchor foreign-runtime OTLP spans from a file or stdin (#4962) by @chernistry in #5185
• feat: record model drift as signed, chain-anchored observations (#5041) by @chernistry in #5189
• Fix/mypy interop identity crypto by @Phoenix1504e in #5215
• feat: add mailbox rendezvous wait graph and deterministic cycle naming (#3450) by @chernistry in #5168
• feat: bind issued tokens to the X.509-SVID that must present them (#5030) by @chernistry in #5179
• feat(review): anchor operator review annotations to the diff bytes they target (#3456) by @chernistry in #5210
• fix(agents): registry raises on duplicate id instead of overwriting (#5104) by @chernistry in #5217
• feat(security): key lifecycle for receipt signing — rotation, revocation, superseded-key verdicts (#4211) by @chernistry in #5178
• feat: assemble the task context pack and hand it to the spawn (#4522) by @chernistry in #5177
• feat: one durable record per model call, joinable from the cost row (#5107) by @chernistry in #5221
• feat: rotate target secrets with mint, store, apply and a dated receipt (#5119) by @chernistry in #5216
• feat: tag-filtered resource leases with TTL, owner and named locks (#5128) by @chernistry in #5220
• feat: run journal fields, write-time enum validation, and a non-terminal-runs query (#5127) by @chernistry in #5222
• feat: verify a dropped run receipt over the dashboard API (#5067) by @chernistry in #5224
• fix: check the concrete nmap scan target against the network policy (#5150) by @chernistry in #5227
• feat: govern audit watch cycle -- remediate once, re-verify, still fail the cycle (#5125) by @chernistry in #5226
• feat: join inventory records across sources into an entity graph (#5129) by @chernistry in #5223
• fix: stage the SOC 2 evidence pack and promote it atomically (#5123) by @chernistry in #5229
• fix: record which capability tokens the spawn decision evaluated (#5052) by @chernistry in #5231
• feat: run one govern check set over a selected target set and collect every result (#5090) by @chernistry in #5242
• feat: pin an external signing key when verifying an authority envelope (#5064) by @chernistry in #5244
• fix(trackers): persist poll watermarks and bound the recovery poll (#5131) by @chernistry in #5241
• docs: add GOVERNANCE, MAINTAINERS and SUPPORT by @chernistry in #5290
• feat: pin manifest for plugins and skills with parse-time rejection of floating versions (#5089) by @chernistry in #5243
• docs: regenerate adapter last-green table from canary receipts by @chernistry in #5250
• fix(adapters): ScanResult carries the invocation that produced it by @vaibhav8a in #5246
• refactor: declare the offline-verification result shape once, and guard against the next duplicate (#5099) by @chernistry in #5240
• docs: publish the canonical design tokens by @chernistry in #5295
• feat: govern inventory selector grammar and typed target-resolution API (#5116) by @chernistry in #5236
• fix(mypy): resolve typing errors in mcp, approval, trigger_sources, and orchestration by @Phoenix1504e in #5248
• lineage: project the ancestry DAG into PROV-O (#5039) by @chernistry in #5253
• fix(git): construct AuditChainStore from the audit directory by @Phoenix1504e in #5249
• feat: apply receipts on the target and one finding for missing-or-stale (#5087) by @chernistry in #5255
• fix: add governance_group alias in governance_cmd.py for test imports by @bernstein-orchestrator[bot] in #5307
• feat(govern): anchor the audit report as a chain-verifiable artefact (#5077) by @chernistry in #5261
• feat(web): add the /governance route and its coverage panel (#5068) by @chernistry in #5289
• secrets: broker an operator's own secret store behind one contract (#4984) by @chernistry in #5291
• fix: run post-tool redaction on the PostToolUse hook path (#4992) by @chernistry in #5296
• cost: attribute spend to the principal and the grant that authorized it (#4985) by @chernistry in #5294
• govern: validate playbook fields and make its digest order-independent (#4979) by @chernistry in #5298
• ci: weekly project pulse page by @chernistry in #5299
• feat: signed engagement scope grant and pure scope predicate (#2952) by @chernistry in #5187
• feat(audit): atomically-replaced newest-checkpoint pointer, and the verify that reads it (#3160) by @chernistry in #5190
• feat: executable conformance corpus for audit receipt formats (#4987) by @chernistry in #5260
• feat: govern reconcile --propose diffs the governed surface against desired state (#5085) by @chernistry in #5254
• feat: score governance posture from chain-evidenced facts only (#4989) by @chernistry in #5257
• verify: dispatch bom and receipt-bundle artefacts by kind (#5103) by @chernistry in #5238
• fix(mypy): resolve typing errors in core/quality and core/agents by @Phoenix1504e in #5247
• fix: derive compaction correlation ids from the fold instead of uuid4 (#2915) by @chernistry in #5188
• chore(deps): update dependency @tanstack/react-query to v5.102.5 by @renovate[bot] in #5251
• feat(govern): the check contract, stable ids, and the three-state verdict (#5072) by @prateeekbuilds in #5292
• fix(adapters): select the Codex sandbox mode instead of hardcoding it by @chernistry in #5323
• test: auditor conformance harness, fixture and scoreboard (#5054) by @chernistry in #5235
• feat: fold a memory chain to its current state and expose it as memory show (#2914) by @chernistry in #5204
• feat: one agent principal type behind the JWT and Ed25519 credential formats (#2926) by @chernistry in #5192
• feat: derive the AI-BOM snapshot from a run's lineage spine (#2916) by @chernistry in #5195
• feat: report decision provenance for approval-gated actions (#2917) by @chernistry in #5199
• fix: key evolve failure-pattern issues on their fingerprint (#4504) by @chernistry in #5219
• Partial implementation of #3238: add ISO/IEC 42001 Annex A control map by @chernistry in #5191
• feat: serve read-only SCIM 2.0 discovery and GET /Users (#5040) by @chernistry in #5193
• fix: resolve glob pattern matching in identity scope validation by @bernstein-orchestrator[bot] in #5306
• Partial implementation of #2958: add Semgrep scanner adapter by @chernistry in #5200
• feat(agents): record and surface the digest of harness-local agent directories (#3969) by @chernistry in #5197
• refactor: one receipt protocol with a single sign/verify pair (#5096) by @chernistry in #5230
• feat(cost): record budget cap halts in the audit chain (#2918) by @chernistry in #5194
• Partial implementation of #3112: source fetcher protocol and recorded corpus by @chernistry in #5203
• feat(quality): add the absence_verified completion signal (#3650) by @chernistry in #5202
• feat: project journal steps onto a schema-stable trajectory row (#2926) by @chernistry in #5207
• fix: bind a finding artifact to its invocation instead of defaulting it away (#2953) by @chernistry in #5198
• core: record instruction origin and derive grant from tracker webhooks (#3683) by @chernistry in #5208
• fix(teams): refuse a role modality no worker in this tree runs (#3111) by @chernistry in #5211
• docs+feat(volunteer): close protocol.md and manifest-projection gaps (#3883) by @chernistry in #5212
• resume: write a checkpoint before every automatic stall kill (#3376) by @chernistry in #5205
• feat(skills): gate catalog installs on strict lint with a chain-anchored refusal (#2899) by @chernistry in #5209
• feat(checkpoint): make a resume onto moved observations a discard candidate (#3649) by @chernistry in #5206
• feat(govern): inventory topology render from the store (#5133) by @code-gamerr in #5149
• chore(deps): update dependency @tanstack/react-query to v5.102.6 by @renovate[bot] in #5329
• Govern the GitHub push webhook route with trigger rules (#4545) by @chernistry in #5175
• adapters: deliver the system addendum through the prompt for qwen, opencode, codex and gemini (#5325) by @chernistry in #5326
• observability: record guard evaluations, not just violations (#3454) by @chernistry in #5174
• fix(adapters): detect a codex run whose every shell call the sandbox refused by @ARAVIND281 in #5327
• docs: state the policy-as-code framing in the README by @chernistry in #5331
• feat(cluster): govern agent workloads by declaration, without editing their manifests (#4988) by @chernistry in #5213
• test: add the auditor conformance harness, fixture and scoreboard (#5057) by @chernistry in #5330
• feat(audit): witness co-signing of chain checkpoints (#3161) by @chernistry in #5214
• test: add the integrity conformance vectors, questions 15-20 by @chernistry in #5333
• feat(volunteer): hub-native task board for work with no git forge behind it (#3877) by @chernistry in #5218
• test(trackers): drive a synthetic transaction through a real adapter (#5124) by @chernistry in #5233
• feat: order-independent render receipt bytes and the render delta algebra (#3276) by @chernistry in #5201
• feat: type policy inputs as observed or operator-asserted (#5029) by @chernistry in #5300
• docs: supersede ADR-006 and guard the decision record (#5026) by @chernistry in #5303
• feat: provision and deprovision agent principals through the standard directory schema (#4972) by @chernistry in #5301
• chore(vscode): refresh fast-uri in the extension lockfile by @chernistry in #5340
• ci: render the project pulse as a card with weekly history and trend charts by @chernistry in #5339
• schemas: publish the JSON Schema ids under bernstein.run by @chernistry in #5342
• adapters: declare host isolation for codex and drop its vendor sandbox only when the host isolates by @chernistry in #5343
• fix: wire per-task token budget kill switch into orchestrator tick (#3374) by @chernistry in #5176
• fix(spawner,git): never spawn an agent, or salvage, in the operator checkout by @tenequm in #5344
• feat: evidence envelope v1 schema, canonical form and golden vector (#5063) by @chernistry in #5228
• fix: bind audit-range since/until/head_hmac into the signed run-receipt subject by @AmirF194 in #5346
• feat: speak AuthZEN 1.0 at the permission decision boundary (#5032) by @chernistry in #5161
• test: guard reachability of compliance-framework check modules (#5098) by @chernistry in #5232
• fix(cost): dedupe the unpriced-model warning and label estimates "unpriced" (#5337) by @Rehan30g in #5347
• feat: add grant sweep assertion to reconcile every run to check revoked grants are absent from by @bernstein-orchestrator[bot] in #5349
• feat: project agent principals from the audit chain into a listable registry (#4969) by @chernistry in #5316
• feat(govern): one observation envelope per entity, with an errors map that names each gap (#5082) by @atirna in #5332
• fix(pulse): count merged pull requests in the weekly snapshot by @chernistry in #5335
• feat: update contrast test self-checks post-accent-migration by @bernstein-orchestrator[bot] in #5353
• fix(spawner): show active file locks in agent prompts by @atirna in #5355
• chore(release): v3.19.1 by @chernistry in #5312

New Contributors

• @albin-george-kurian made their first contribution in #4927
• @chuanxu742-glitch made their first contribution in #5005
• @kudala-bharani made their first contribution in #5171
• @code-gamerr made their first contribution in #5149
• @tenequm made their first contribution in #5344

Full Changelog: v3.19.0...v3.19.1