v1.0.0rc6

What's Changed

• docs(release): record RC5 publication by @wa-pis in #327
• RC6 final candidate hardening by @wa-pis in #329
• fix(openai): suppress provider error chains by @wa-pis in #331
• fix(advisor): reserve placeholder-shaped values by @wa-pis in #332
• fix(openai): redact incomplete status by @wa-pis in #333
• fix(openai): detach provider exceptions by @wa-pis in #334
• fix(advisor): preserve placeholder provenance by @wa-pis in #335
• fix(openai): harden public error boundary by @wa-pis in #336
• fix(advisor): mask categorical egress by @wa-pis in #337
• fix(trino): preserve safe numeric shape by @wa-pis in #338
• fix(rc6): close public release hardening gaps by @wa-pis in #339
• test(rc6): close openai error evidence by @wa-pis in #340
• docs(rc6): record advisor egress closure by @wa-pis in #341
• docs(rc6): record numeric privacy closure by @wa-pis in #342
• fix(advisor): validate proposed constraints by @wa-pis in #343
• fix(mcp): bound generator transport by @wa-pis in #344
• fix(output): harden artifact boundaries by @wa-pis in #345
• fix(mcp): bound shared request work by @wa-pis in #346
• docs(rc6): record S9 closure evidence by @wa-pis in #347
• fix(trino): redact backend failures by @wa-pis in #348
• docs: define product validation and PostgreSQL gate by @wa-pis in #349
• fix(trino): mask safe-select strings by @wa-pis in #350
• fix(generation): bound semantic providers by @wa-pis in #351
• fix(io): harden filesystem publication by @wa-pis in #352
• fix(io): verify single-entity bundles by @wa-pis in #353
• fix(cli): escape untrusted diagnostics by @wa-pis in #354
• ci: load classifier from trusted base by @wa-pis in #355
• ci(release): bind publication to signed source by @wa-pis in #356
• feat(release): enforce acceptance manifest by @wa-pis in #357
• docs(rc6): record pinned profile gate by @wa-pis in #358
• docs(rc6): record deployed release policy by @wa-pis in #359
• docs: specify PostgreSQL multi-source gate by @wa-pis in #360
• fix: replace source-derived categories by @wa-pis in #361
• fix: sanitize advisor constraint literals by @wa-pis in #362
• fix(security): sanitize scalar categories by @wa-pis in #363
• fix(security): mask nested Trino values by @wa-pis in #364
• fix(security): pin Dockerfile frontend by @wa-pis in #365
• fix(safety): bind CSV check to profile by @wa-pis in #366
• fix(artifacts): reserve control basenames by @wa-pis in #367
• fix(validation): reject duplicate entity stems by @wa-pis in #368
• fix(profiling): enforce field deadlines by @wa-pis in #369
• fix(audit): reserve terminal capacity by @wa-pis in #370
• docs(security): record accepted known issues by @wa-pis in #371
• fix(agent): bind plans to source version by @wa-pis in #372
• docs(privacy): scope category preservation by @wa-pis in #373
• feat(privacy): add local category allowlist by @wa-pis in #374
• feat(privacy): enforce safe local category allowlist by @wa-pis in #375
• fix(trino): enforce table-column allowlist for categories by @wa-pis in #376
• fix(advisor): preserve allowlisted categorical literals by @wa-pis in #377
• fix(release): resolve physical temp path by @wa-pis in #378
• fix(release): resolve installed smoke path by @wa-pis in #379
• docs(openspec): define postgres SQL scope by @wa-pis in #380
• fix(cli): parse qualified preserve fields by @wa-pis in #381
• feat(postgres): add bounded source config by @wa-pis in #382
• feat(postgres): add read-only session boundary by @wa-pis in #383
• feat(postgres): add metadata query builders by @wa-pis in #384
• feat(postgres): add aggregate query builders by @wa-pis in #385
• feat(privacy): validate preserved categories by @wa-pis in #386
• fix(postgres): require typed profiling queries by @wa-pis in #387
• feat(postgres): normalize bounded profiles by @wa-pis in #388
• feat(postgres): export deterministic sql by @wa-pis in #389
• feat(cli): export PostgreSQL SQL files by @wa-pis in #390
• build(postgres): add optional driver extra by @wa-pis in #391
• feat(postgres): add profile cli workflow by @wa-pis in #392
• test(postgres): smoke installed sql workflow by @wa-pis in #393
• fix(release): include psycopg evidence by @wa-pis in #394
• fix(validation): ignore JSON key order by @wa-pis in #395
• docs: document PostgreSQL RC6 workflow by @wa-pis in #396

Full Changelog: v1.0.0rc5...v1.0.0rc6