Changelog

0.3.0 - 2026-09-13

Snapshot authenticated SQLite bytes into a private file before queries and sign sealed receipt bytes, removing mutable-path time-of-check/time-of-use windows.
Require consumer-supplied reviewer trust roots during signed verification and activation; support retired reviewer keys with OpenSSH validity epochs.
Hash the exact source descriptor stream consumed by parsers and add configurable expanded-byte, record, database-growth, query-output and diff-output limits.
Bind identity decisions to entity metadata, redact descriptions from typed diffs, include diff attribution and keep CrUX job IDs stable across output-only limits.
Migrate writer stores to schema/rules version 3 while allowing activation over pinned version 1 and version 2 generations for revocation checks.

Open generations from an authenticated immutable SQLite file descriptor and reject sidecars, symlinks and unexpected generation files.
Authenticate exact reviewer decisions with SSH signatures, retain their proofs and re-verify every decision before release signing.
Explain resolver abstentions with typed statuses and decision counts.
Add exact entity, URL/domain, source-separated popularity, redacted category and registry-statistics audit views.
Stream typed diffs across source selections, projections, decisions and explicit equivalences.
Add bounded native evaluation with multilingual, regional and deceptive-query regressions plus latency evidence.
Normalize rights-bearing future crawler observations without admitting them as identity or ownership evidence.

Initial independent extraction with five rights-reviewed source adapters, deterministic normalization, immutable generations and conservative regional resolution.