v7.2.0 — Web-stack, token-registry and Token ACL coverage; governance and corpus-check CI

Backfilled release: this tag was created on 2026-10-22 at the merge commit that released 7.2.0 on 2026-09-02.

Highlights

Corpus: 20 checklists / 1,390 items / 134 vectors / 13 methodologies

• Web-stack coverage (#7): 44 checklist items for hosted auth providers, API-key issuance, external data-provider integrity, Postgres / ClickHouse, Next.js 16 proxy / Server Actions / RSC, Bun / pnpm / Turborepo, GCP Cloud Run + Terraform, and tracked AI-tooling artifacts.
• Token registries and risk signals (#8): a new methodology, references/methodologies/token-registry-risk.md, with KV-132 (canonical-asset / token-list spoofing and primary-variant hijack) and KV-133 (risk-score / trust-tier farming).
• Token ACL / SRFC-37 (#9): Token-2022 methodology §9 for gate programs, issuers and integrators, invariant T12, and KV-134 (gate-program bypass and permissionless-freeze griefing).

Tooling

• audit-scan (#6) separates init_if_needed from init, records remaining_accounts sites and flags UncheckedAccount fields.

Governance (#10)

• CONTRIBUTING.md, SECURITY.md, a PR template, and a corpus-check CI workflow that checks counts, index links, frontmatter ids, version agreement, repository hygiene and attribution-free commits.

Trail of Bits skills pin: cfe5d7b (cfe5d7b1619e47fb5b38b7e2561dad7e5f1e89af, trailofbits/skills main of 2026-06-30).

Thanks to @frcd10 (#7, #8, #9) and @panditdhamdhere (#6).

Full diff: v7.1.0...v7.2.0