# Changelog

## 0.3.0 - 2026-09-13

- Snapshot authenticated SQLite bytes into a private file before queries and sign
  sealed receipt bytes, removing mutable-path time-of-check/time-of-use windows.
- Require consumer-supplied reviewer trust roots during signed verification and
  activation; support retired reviewer keys with OpenSSH validity epochs.
- Hash the exact source descriptor stream consumed by parsers and add configurable
  expanded-byte, record, database-growth, query-output and diff-output limits.
- Bind identity decisions to entity metadata, redact descriptions from typed diffs,
  include diff attribution and keep CrUX job IDs stable across output-only limits.
- Migrate writer stores to schema/rules version 3 while allowing activation over
  pinned version 1 and version 2 generations for revocation checks.

## 0.2.0 - 2026-09-13

- Open generations from an authenticated immutable SQLite file descriptor and
  reject sidecars, symlinks and unexpected generation files.
- Authenticate exact reviewer decisions with SSH signatures, retain their proofs
  and re-verify every decision before release signing.
- Explain resolver abstentions with typed statuses and decision counts.
- Add exact entity, URL/domain, source-separated popularity, redacted category and
  registry-statistics audit views.
- Stream typed diffs across source selections, projections, decisions and explicit
  equivalences.
- Add bounded native evaluation with multilingual, regional and deceptive-query
  regressions plus latency evidence.
- Normalize rights-bearing future crawler observations without admitting them as
  identity or ownership evidence.

## 0.1.0 - 2026-09-12

- Initial independent extraction with five rights-reviewed source adapters,
  deterministic normalization, immutable generations and conservative regional
  resolution.