v0.9.0

What's Changed

• feat(state): load org membership from members.json; seed anna/ben in acme by @tas50 in #70
• fix(api): correct five confirmed bugs with regression tests by @tas50 in #72
• fix(api): preserve actor key on update; constant-time password check; name-robustness tests by @tas50 in #73
• ci: bump the github-actions group with 6 updates by @dependabot[bot] in #71
• fix(search): stop a stray ]/} hanging the query lexer; add fuzzing, body cap, and coverage by @tas50 in #74
• test(auth): fuzz the signature/header verification path by @tas50 in #75
• docs: note the build artifact path in CLAUDE.md by @tas50 in #76
• test(state): expand dev/test-repo to 99 nodes by @tas50 in #77
• test(state): client version drift, bare nodes, and recent check-ins by @tas50 in #78
• Back test nodes with fauxhai ohai data + uptime by @tas50 in #79
• Pluggable storage backend: memory + SQLite (the persistence foundation) by @tas50 in #80
• Wire Store/Org onto the pluggable Backend + --storage/--db flags by @tas50 in #81
• Idempotent restart on a durable store (stable keys) + persistence docs by @tas50 in #82
• Atomic Tx for the storage backend; provision orgs transactionally by @tas50 in #83
• docs: rewrite intro — in-memory or SQLite, drop-in for testing and production by @tas50 in #84
• Loadable SQLite dev database + dedicated developer docs (cinc-console wiring) by @tas50 in #85
• ci: hardened container release workflow (mirrors cinc-console) by @tas50 in #86
• docs: move docs/superpowers/specs to docs/specs by @tas50 in #87
• docs: correct cinc-console description and repo link by @tas50 in #89
• feat(sqlite): forward-only schema migration engine by @tas50 in #88
• docs: add a security/footprint section to 'Why cinc-zero' by @tas50 in #90
• feat(authz): enforce ACLs by default in the binary + faithful client bootstrap by @tas50 in #91
• feat(dev): faithful authz for seeded console users; rename anna/ben to tim/jack by @tas50 in #92
• feat(dev): ship a committed ~1100-node ACME business fixture via seedgen by @tas50 in #93
• feat(fleetsim): steady-state fleet check-in traffic simulator by @tas50 in #94
• Update the loadtest CLI options + remove the binary by @tas50 in #95
• Add more files to the gitignore by @tas50 in #96
• perf(sqlite): cap pool to one connection to end write busy-wait under fleet load by @tas50 in #97
• perf(sqlite): give reads a dedicated WAL pool so dashboards don't starve under fleet load by @tas50 in #98
• perf(sqlite): reuse prepared statements on the objects-table hot path by @tas50 in #99
• perf(sqlite): prepare the org-probe and blob single-row statements by @tas50 in #100
• perf(sqlite): optional group commit to coalesce writes under fleet load by @tas50 in #101
• docs: tighten "Why cinc-zero" and drop em-dashes from the README by @tas50 in #102

Full Changelog: v0.8.0...v0.9.0