Highlights:
- Session error-path integrity: tool results survive provider errors
- /plugins command shows loaded WASM plugin packages
- Memory admission: novelty × utility with sensitive content filter
- External-path authorization (SEC-001)
- RuntimeBuilder: hook_registry + skill_index for embedded consumers
- CI: parallel native-platform builds (no zig/xwin/LLVM)