What's Changed

🔧 Other Changes

• feat(tls): verify against the OS trust store by default (closes #2004) by @fangkangmi in #2005
• fix(update): re-check transitive dependencies' own semver ranges during apm update by @nadav-y in #2053
• feat(shepherd): enforce canonical owner gate by @danielmeppiel in #2180
• fix(deps): git-semver update idempotency in build_update_plan by @srobroek in #2165
• fix(audit): preserve dependency link paths during replay by @danielmeppiel in #2179
• docs: add deny and doctor CLI references by @danielmeppiel in #2178
• fix(installer): expose stable Windows executable by @danielmeppiel in #2094
• fix(audit): honor locked skill subsets during replay by @danielmeppiel in #2177
• fix(docs): correct relative link depths across docs site by @JasonTame in #2170
• fix(pack): pack subdirectory-prefixed skills by @danielmeppiel in #2176
• fix(policy): preserve strict policy across warm cache reads by @danielmeppiel in #2193
• test(foundation): add hermetic lifecycle integration utilities by @danielmeppiel in #2209
• harden(contracts): add platform and rendered documentation evidence by @danielmeppiel in #2199
• test: add finite taxonomy and quality ratchets by @danielmeppiel in #2198
• test(consume): add real lifecycle contracts by @danielmeppiel in #2212
• test(produce): prove real pack-to-install artifact parity by @danielmeppiel in #2215
• test(consume): expand source/ref/cache matrix by @danielmeppiel in #2219
• test(produce): expand genuine materialization matrix by @danielmeppiel in #2218
• fix(deps): canonicalize virtual package manifest bytes by @danielmeppiel in #2223
• test(govern): prove strict policy lifecycle parity by @danielmeppiel in #2221
• fix(lockfile): converge claude_skill virtual dep name/version across resolution paths (closes #2206) by @danielmeppiel in #2217
• test(quality): synchronize the finite critical-suite count by @danielmeppiel in #2230
• fix(deps): preserve custom port in HTTP git URL persisted to apm.yml by @atulya-singh in #2210
• fix(audit): exempt is_virtual packages from config-consistency manifest check by @hugoguitton-lucca in #2214
• fix(marketplace): close packed source contracts by @danielmeppiel in #2228
• fix(pack): emit category in Claude marketplace output by @mbeacom in #2189
• fix(cache): preserve nested GitLab repository identity by @lidorcg in #2192
• fix(cli): warn when Codex agent tool scope is dropped by @jstar0 in #2186
• fix(deps): accept custom port in shorthand so apm.yml entries re-parse by @atulya-singh in #2211
• harden(shepherd): require exact-head functional owner evidence by @danielmeppiel in #2234
• fix(policy): honor Govern cache TTL with bounded property coverage by @danielmeppiel in #2235
• fix(deps): honor SSH for semver ref resolution by @danielmeppiel in #2229
• fix(ado): preserve lock coordinates for outdated and update by @danielmeppiel in #2226
• fix(deps): bound best-effort ref lookup retries by @danielmeppiel in #2238
• fix(virtual-packages): restore hermetic lifecycle convergence by @danielmeppiel in #2240
• test(architecture): add bounded mutation pilot by @danielmeppiel in #2241
• test(deps): add field-complete lockfile round-trip and reconstruction properties by @danielmeppiel in #2246
• fix: Windows CI CRLF baseline and WebSocket shutdown thread-join (closes #2233) by @danielmeppiel in #2237
• fix(prune): reconcile merged hook ownership after package removal by @danielmeppiel in #2249
• fix(hooks): scope merged-hook wipe to resolved targets, not all KNOWN_TARGETS by @danielmeppiel in #2252
• harden(ci): require hermetic lifecycle smoke subset on pull-request CI by @danielmeppiel in #2247
• feat(mutation): add lockfile-normalization owner to bounded mutmut pilot by @danielmeppiel in #2251
• fix(ci): restore Windows unit reliability by @danielmeppiel in #2262
• fix(deps): add SSH key-auth clone failure guidance by @danielmeppiel in #2244
• test(hooks): promote target-scope uninstall smoke by @danielmeppiel in #2257
• fix(release): package Rich Unicode tables in frozen binaries by @danielmeppiel in #2264
• test(lifecycle): add shared state substrate by @danielmeppiel in #2265
• test: remove duplicate validation suite by @danielmeppiel in #2263
• fix(quality): correct duplicate group count by @danielmeppiel in #2274
• test(fixtures): auth-hardened url_rewrite_subprocess_env for real CLI installs by @danielmeppiel in #2267
• test(lifecycle): cover package shape transitions by @danielmeppiel in #2273
• fix(deps): preserve shared transitive deps still reachable from survivors by @danielmeppiel in #2269
• fix(ci): raise packaged Unix integration timeout by @danielmeppiel in #2276
• test(config): cover configuration and shared-graph lifecycle contracts by @danielmeppiel in #2277
• test: retire six exact duplicate modules by @danielmeppiel in #2278
• fix(install): reconcile dropped-target merge-hook state on target contraction by @danielmeppiel in #2275
• fix(manifest): fold legacy 'all' in targets to auto-detect with a deprecation warning by @kotalab in #2272
• fix: absolutize Copilot user-scope hook commands (closes #2232) by @danielmeppiel in #2236
• fix(hooks): compose per-file routing with dependency targets by @srobroek in #2259
• fix(hooks): rebuild merged hooks from transitive lockfile survivors by @Shaurya2k06 in #2256
• test: retire six header-only twin modules by @danielmeppiel in #2280
• test(integration): add primitive target lifecycle covering array by @danielmeppiel in #2266
• test(ci): isolate the live guardrailing hero by @danielmeppiel in #2281
• fix(deps): recover virtual files from GitHub throttles by @danielmeppiel in #2284
• fix(install): contract generic shared target rows by @danielmeppiel in #2283
• test(integration): retire final header-only test twins by @danielmeppiel in #2285
• feat(agentics): add daily performance-scan agentic workflow by @sergio-sisternes-epam in #2125
• fix(deps): align integration throttle contracts by @danielmeppiel in #2287
• test(outdated): isolate parallel fixtures by @danielmeppiel in #2288
• test(integration): hermeticize packaged lifecycle E2E by @danielmeppiel in #2289
• fix(prune): reconcile deployment ledger ownership by @danielmeppiel in #2292
• fix(install): reconcile dropped target instructions by @danielmeppiel in #2295
• fix: guide compile-only project installs (supersedes #2115, closes #2057) by @danielmeppiel in #2293
• fix(audit): surface ref-consistency before deployment-ledger-owners by @danielmeppiel in #2300
• fix(install): remove shared-root skill orphan on target narrowing by @danielmeppiel in #2299
• fix(skills): report zero-match filters (supersedes #2117, closes #2116) by @danielmeppiel in #2294
• fix: selective update plan must not mark unselected deps removed (closes #2291) by @danielmeppiel in #2305
• test(lifecycle): require real state machine gate by @danielmeppiel in #2309
• fix(lifecycle): repair packaged G0 contracts by @danielmeppiel in #2310
• test(tls): make override oracle state-independent by @danielmeppiel in #2311
• fix(install): defer transient GitHub validation failures by @danielmeppiel in #2313
• fix(integration): hermeticize stale packaged G0 release-blocker tests by @danielmeppiel in #2314
• chore: release v0.26.0 by @danielmeppiel in #2316

New Contributors

• @fangkangmi made their first contribution in #2005
• @JasonTame made their first contribution in #2170
• @atulya-singh made their first contribution in #2210
• @hugoguitton-lucca made their first contribution in #2214
• @mbeacom made their first contribution in #2189
• @lidorcg made their first contribution in #2192
• @jstar0 made their first contribution in #2186
• @kotalab made their first contribution in #2272
• @Shaurya2k06 made their first contribution in #2256