Decisions

2026-10-19: Advance current v0.10.7 publication markers, coverage identity, frozen review candidate and six closed asset authorities only after the accepted merged source, exact annotated tag, all four tagged jobs, normal protected approval, six independently downloaded files and ten non-yanked registry archives reconcile. Retarget only the published replay job label in the pinned workflow to these verified bytes; preserve the v0.8.0 predecessor, unsigned policy, historical evidence and unperformed independent-review status. The owner delegates this release-specific records PR integration and production deployment without changing future workflow policy or protection settings.

2026-10-21: Resolve the new RUSTSEC-2026-0382 release blocker with the smallest patched rustls-webpki update, 0.103.15 to 0.103.16. Rebind all three reviewed dependency graphs and the scoped unsafe-review digest after comparing downloaded source, preserving graph counts, resolved features, Rust floor, crypto provider, exception expiry, and the existing unsafe-review expiry. The transitive package remains governed by the exact lockfile and graph authority; critical-dependency records require a direct runtime edge.

2026-10-21: Constitution 1.6.0 permits pre-authorized managed Deep Capture process control with narrow query, wait, and terminate rights for exact session-created objects; target memory rights remain forbidden. A retained root process-object receipt and start-event lineage replace image-name inventory as route-release authority, and incomplete ownership produces partial cleanup rather than a false release claim.

2026-10-23: Prepare v0.10.8 from accepted S179 and all ten remaining fragments since v0.10.7. Candidate first-party identities, generated evidence and measured graph digests move together while current public markers remain on v0.10.7. The owner explicitly delegates this release's checked PR integration, exact annotated tag, normal protected approval and publication without changing the repository's future merge, tag or environment policy. Public records advance only after final certified files and all ten crate archives independently reconcile; IGDB #155 and unperformed live-title or independent-review claims remain outside the release.