v0.2.1

0.2.1 (2026-09-22)

Features

• auth: a device-flow provider carries a public client_id and no secret (bcda354)
• auth: device-flow login views — the browser polls, the pipeline decides (e3905b0)
• auth: GitHub device-flow token acquisition — a secretless public client (bdb6c72)
• cares: operator arming switch for a collector's reconcile authority — cares.arm_reconcile, audited, off by default (Issue# 655) [via double-tap-git-serious] (17d4a61)
• cares: the operator arming switch — cares.arm_reconcile gates tap_cares.services.arm_reconcile, which sets a collector's reconcile authority and budget as the collector program actor through the trusted-internal patch on an audit batch of its own (operator, before, after, when); manage.py arm_reconcile <registry> --on|--off [--budget N] --as <username>; off stays the default (2246d86)
• cicd: a version tag requires no fixable High/Critical vulnerability [re-target to main] (be8eccb)
• cicd: plugin CI submits the plugin's own dependency closure, so Dependabot can see it (c51bd46)
• cicd: plugin CI submits the plugin's own dependency closure, so Dependabot can see it (69fee0c)
• grid: manage.py export_grift — serialise a live grid to a re-importable GRIFT batch (0ca266b)
• grid: manage.py export_grift — serialise a live grid to a re-importable GRIFT batch (b3114e0)
• grid: the cascade corpus drives the reconcile verb — a reconcile operation (observed, dropped, budget) builds the run's write batch, completeness statement, candidate record and armed authority from the scenario graph, a fake source answers the probe, and the model oracle and the runner both check applied / contradicted / not_applicable outcomes; four scenarios pin the contradiction rule beside the cascade it would trigger (Issue# 662 - tap) (1be584d)
• grid: the cascade corpus drives the reconcile verb — contradiction, cap, applied and present scenarios (Issue# 662) [via double-tap-git-serious] (8d0ef6c)
• guards,skills: architecture.md gets a fitness guard and an update-architecture walkthrough (b621d36)
• tap_cares: generic run_with_ceiling() for any collector's blocking calls (06b8e73)
• tap_cares: generic run_with_ceiling() for any collector's blocking calls [via gsdt] (ff7dee1)
• tap_cares: name the run_with_ceiling worker thread per caller (5d04cf9)

Bug Fixes

• auth: authorize GitHub accounts by numeric id only, never the login (daaa001)
• auth: keep exception detail in the log, not in the device-flow response (65c624e)
• auth: make both identity writes unconditional, and turn PKCE on (6c15062)
• auth: no empty-secret literal; narrow nosec on two false positives (379321a)
• auth: redact the refusal path; report an unruled route as a security FLAW (a3cd50a)
• auth: report an unrecognised client_id as such, not as a malformed response (68cc6ac)
• auth: rule on provider routes too — the last inherit-by-default path (765e798)
• boot: bump github_core to v0.10.0 with git_core v0.1.1 — the dependencies and the dependent move together (afef58e)
• boot: profiles carry github_core's sibling plugins, in dependency order (ab4cf87)
• boot: profiles carry github_core's sibling plugins, in dependency order (97eda72)
• cares: the arming switch is one locked transaction (Collector row FOR UPDATE, audit batch closed with the write); the audit names the shell's OS user beside the claimed operator; a call with no actor is refused before any read; the requirement row is -12 (the -11 id was already taken) (review round 1, PR# 665 - tap) (96e0511)
• cicd: drop the snapshot CLI's --out — an argv-supplied write path it never needed (dcb1d94)
• grid: drop the TYPE_CHECKING Edge the runtime imports already bind (9b7ef92)
• grid: export_grift — a derived serialisation time, and close the skip ledger over edge spine rows (caa4621)
• grid: export_grift — one snapshot, a clean stdout, and tests for the command (57581e1)
• grid: export_grift writes the snapshot 0600, not at the ambient umask (87f78d2)
• grid: the reconcile corpus runner holds every batch but the lifecycle batch to the exact-state invariant, allows exactly the verb's one write batch as new, asserts the present scenario probed the source exactly once, checks the contradiction's count, and raises instead of asserting (review round 1 + Codacy, PR# 673 - tap) (757784e)
• guards: drop the illustrative RID from the architecture guard — check-rids reads it as a citation (3e8141e)
• guards: the architecture guard raises AssertionError instead of asserting (6ef1faf)
• guards: the vacuity detector learns the raise-based no-op shape (d6585fb)
• health: bound probe detail to the exception type, never its message (90c8503)
• health: bound probe detail to the exception type, never its message (f6c0b8d)
• health: close two AI-review findings on the leak guard (481c7a0)
• health: give the raising test probe a real probe signature (mypy ratchet) (32e47c0)
• plugins: only the absent tap_plugin namespace reads as not-installed — an import error from inside an installed namespace still raises; the module's implements claim re-stamped (review round 1, PR# 667 - tap) (c4d6c87)
• plugins: validate_plugin reads a missing tap_plugin namespace as "dependency not installed here" instead of crashing — find_spec on a dotted name imports the parent first, and the conformance lane's tooling venv holds no plugin at all (found on PR# 154 - tap-plugin-github-core under tap v0.2.0) (834bbda)
• plugins: validate_plugin treats a missing tap_plugin namespace as a dependency not installed here, not a crash (Issue# 666) [via double-tap-git-serious] (832d910)
• tap_cares: name the idempotency constraint the ceiling contract was missing (5c27aef)
• triage: jq --arg instead of filter interpolation; test sources a file, not a process substitution (7353272)
• triage: say which commit an AI verdict covers, and call a stale one stale (18f103d)
• triage: say which commit an AI verdict covers, and call a stale one stale [via triage-sha] (d1a55ef)
• web: regenerate tailwind.css — #619's merge blocker was never cleared (a24a869)
• web: regenerate tailwind.css — the merge blocker on #619 was never cleared (1c22928)

Documentation

• AGENTS.md becomes canonical; CLAUDE.md drops to Claude-only surfaces [via agents-canon] (06b2ae1)
• AGENTS.md becomes the canonical agent guide; CLAUDE.md drops to Claude-only (0f49df0)
• agents: an agent never writes direct ORM — halt and raise it instead (0ce3544)
• agents: an agent never writes direct ORM — halt and raise it instead [via orm-rule] (36010e7)
• agents: restore four constraints the slimming dropped (7348761)
• agents: restore the prior-art trigger and the search requirement (2febc92)
• agents: restore two procedural guards the trim dropped (0c24c12)
• agents: rule plus one sentence of burn, not the whole incident (70ea08a)
• agents: rule plus one sentence of burn, not the whole incident [via agents-slim] (da450c8)
• agents: the aws resource manifest lives in a plugin repo, not this tree (db2e31b)
• architecture: describe TAP as built — four missing subsystems, four false claims, the rulings since May (828014d)
• architecture: George's review pass, plus four corrections (cfa81b9)
• architecture: George's review pass, plus four corrections [via arch-fixes] (292f9b5)
• architecture: one exception list for the service-layer rule, stated once (c0b0068)
• architecture: the appendix says what it actually is, and stops addressing the reader in the second person (13f178d)
• architecture: the ORM exception is per-site and reviewed, not a standing category (b5f35e6)
• auth: cite the issue, not the reviewer, for the numeric-id ruling (c817f0b)
• claude: cite AGENTS.md and the hook, per the AI review (6316fa7)
• claude: drop the circular citation, and correct a false guarantee (020ff43)
• claude: make the ruling checkable, not just asserted (5ec3d6c)
• claude: the hook stamping Signed-off-by is sanctioned, not a defect (835db82)
• claude: the hook stamping Signed-off-by is sanctioned, not a defect [via demo-dev] (d316d93)
• grid: dimensions become nodes — synthesis and five new requirements (324fecc)
• grid: fix two Codex review findings — occupancy is not uniqueness (cc45b12)
• grid: name the tension between the dcom-only trial and the id-keyed map (e2a2046)
• grid: sync the dimension traceability fragment (1ff3da1)
• gryphon: §5.1 was wrong — paths and traversals are complementary (9396331)
• paths: the edge-to-edge stress test — the third and decisive pass (f714f43)
• paths: the persistent-paths dossier and its red team (cb60bf5)
• paths: three independent research passes on persistent paths [via demo-dev] (c9872d4)
• skills: a cited path never becomes a shell word; the review lookup names its author (Codex round 3) (75c02a1)
• skills: add open-a-pr — the twin close-out-pr was missing (93a8155)
• skills: audit the plugin repos — the shared-identity caveat is worse than assumed (4e6e394)
• skills: containment inherits identity — put the key's facts in columns (1e759bd)
• skills: every action that leaves the machine is the operator's; git push leaves the grant (a080ac7)
• skills: git log is a write primitive — the grant keeps no wildcard over a rich command (d5d634a)
• skills: lift close-out-pr onto main — the procedure, without the gate that stranded it (030205f)
• skills: lift close-out-pr onto main — the procedure, without the gate that stranded it [via double-tap-git-serious] (b583ee4)
• skills: no Bash grant at all — a boundary that depends on remembering is not a boundary (084a58b)
• skills: own the skill source in CODEOWNERS; drop the gh wildcards; caveat merge-async (5d4e89f)
• skills: plugin skills carry what a day of building them taught (c53ed72)
• skills: step 1 no longer points at the PR's own worktree; prose matches the grant (ce3170f)
• skills: stop citing git.object as a good example three lines above calling it a defect (5eabafa)
• skills: stop transcribing untrusted paths into commands at all (Codex round 4, high) (1789134)
• skills: the argument check is not a sandbox, and the CODEOWNERS rule closed no gap (17d6071)
• skills: the construct never needed a file; and gh pr * granted the merge it claimed to withhold (4ba0ce8)
• skills: the grant is enumerated, not summarised — no remote write, no arbitrary exec (8d4f674)
• skills: the grant is read-only — git commit runs hooks, and this repo keeps them in-tree (661cde5)
• skills: the grant REQUESTS nothing that can act — it cannot claim what the host enforces (eadc0b2)
• skills: the grant REQUESTS nothing that can act — it cannot claim what the host enforces [via double-tap-git-serious] (a2b9758)
• skills: the PEP 758 check took its path from untrusted text (Codex round 2, high) (9cc3a63)
• skills: the PR's own worktree is untrusted code, not just untrusted text (Codex round 6, critical) (8e10caa)
• skills: the review text this skill reads is untrusted data (Codex review round 1) (4926446)
• skills: the syntax check reports three states, never two (Codex round 5) (53212b8)