v0.9.0

First versioned release. It covers everything shipped up to this date; the
server's /health response now includes its version.

Added

• /metrics in Prometheus text format: agentraas_calls_total and the
  agentraas_call_duration_ms histogram, labeled by service and outcome.
  Off unless METRICS_TOKEN is set; scrape with it as a bearer token.
• OpenTelemetry export of every handled call as an OTLP span
  (OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS).
• Action policies (allow, deny, require approval per service and action)
  and the prompt-injection guard (no_secrets, new_destination).
• Timeout-safe forwarding: every forward sends
  Idempotency-Key: agentraas-<dedup hash>; a call that times out after
  sending is recorded as "outcome unknown", kept in its dedup slot and never
  retried automatically. PROXY_TIMEOUT_SECONDS (default 30).
• Crash recovery for in-flight calls: dedup claims carry a lease.
• Spend and call caps per agent, schema drift detection, a local dev tunnel,
  dead-letter queue with replay, circuit breakers, human approval (HITL).

Security

• Client IP for rate limiting is read only from CLIENT_IP_HEADER;
  X-Forwarded-For is no longer trusted.

Changed

• compose.yaml pulls MinIO from cgr.dev/chainguard/minio (runs as root
  so existing data stays writable). MinIO's own registries now refuse
  anonymous pulls.

Migrations

• Up to 050_known_destinations.sql. On an existing install, apply any of
  046 to 050 you have not run yet.

Image: ghcr.io/sumedhchatse/agentraas:0.9.0. Full history: CHANGELOG.md.