Release 0.11.0: security hardening + 10-issue improvement program#35

Merged

blackaxgit merged 38 commits into

mainfrom

Jun 7, 2026

Commits on Jun 6, 2026

fix(policy): rewrite read-only classifier to token-parse with default-deny
blackaxgit
committed
fix(policy): make L1 cache key injective with NUL separator
blackaxgit
committed
fix(policy): normalize ':' symmetrically in glob_match pattern and text
blackaxgit
committed
refactor(core): add single-source Codex trust reader in clx-core
blackaxgit
committed
refactor(core): type the trustlist errors and drop dead Error variants
blackaxgit
committed
fix(llm): bound the Azure health probe with a 2s per-request timeout
blackaxgit
committed
fix(llm): make fallback cooldown survive across hook processes
blackaxgit
committed
fix(credentials): retry transient zero-byte reads on the credential path
blackaxgit
committed
fix(storage): wrap v1 migration in a transaction for atomicity
blackaxgit
committed
fix(core): correct percentile doc and remove redaction byte-as-char hazard
blackaxgit
committed

Commits on Jun 7, 2026