v0.1.0-alpha.254

What's Changed

• fix(ai-tools): R4 PR1 — field-access guards for entity.search and revision-restore tools (security) by @jonesrussell in #1879
• fix(ai-tools): R4 PR2 — relationship.traverse endpoint-identity visibility gate (security) by @jonesrussell in #1880
• fix(ai-agent): R4 PR3 — enforce owner-only access before wayfinding trail edits (security) by @jonesrussell in #1881
• fix(relationship): R5 — endpoint-visibility field-access policy closes the public REST endpoint-identity leak (security) by @jonesrussell in #1882
• fix(ssr): R6 PR1 — field-access filter the SSR HTML render path (security) by @jonesrussell in #1883
• fix(ssr): R6 PR2 — gate SSR node rendering and relationship-nav on entity view access (security) by @jonesrussell in #1884
• fix(seo): R6 PR3 — access-gate the public sitemap/llms enumeration (security) by @jonesrussell in #1885
• fix(access,ssr,seo,api,ai-tools): R7 PR1 — gate the entity label/title on field-access at every anonymous-reachable emission site (security) by @jonesrussell in #1891
• fix(relationship,api): R7 PR2 — access-gate the discovery/browse relationship endpoints (security, last surface) by @jonesrussell in #1892
• fix(ssr): R8 PR1 — generalize the SSR entity-level view gate to every entity type (security, R8-a) by @jonesrussell in #1893
• fix(api,foundation,ai-tools): R8 PR2 — gate the source entity on discovery/traverse/read, close the existence-oracle class (security, R8-c) by @jonesrussell in #1894
• fix(genealogy): R8 PR3 — field-access gate the pedigree label emission (security, defense-in-depth, R8-b) by @jonesrussell in #1895
• fix(cli): R10 PR1 — install command persisted admin password in plaintext and broke admin login (security, A7 F1) by @jonesrussell in #1896
• fix(ai-agent): R10 PR2 — enforce AgentDefinition::requiresCapability at the shared run chokepoint (security, A7 F2) by @jonesrussell in #1897
• fix(cli): R10 PR3 — close make:* codegen PHP-source injection with a Unicode-aware identifier allowlist (security, A7 F3/F4) by @jonesrussell in #1898
• fix(graphql): R11 — close the anonymous mutation existence oracle on the entity surface (security, A9) by @jonesrussell in #1899

Full Changelog: v0.1.0-alpha.253...v0.1.0-alpha.254