[github-actions]

🤖 I have created a release beep boop

0.2.0 (2026-10-31)

Features

• api: adopt the ostium jwt and backchannel packages with locked restore (#164) (#177) (4fdad04)
• bff: rate limiting and encrypted data protection key ring (#122) (#140) (1b5f749)
• deploy: build and publish a self-built caddy image (#188) (#189) (61114c3)
• deploy: deployable stack with compose publish, caddy edge and file secrets (#120) (a4fc469)
• deploy: deployable stack with compose publish, caddy edge and file secrets (#120) (de480ba)
• deploy: switch the stack to the self-built caddy image (#225) (#226) (06f4455)
• identity: production realm, admin mfa and auth event logging (#121) (#139) (f48c7b1)
• image-scan: adr-0022 delta pr gate, gate-change comparison and deploy freshness gate (#222) (#224) (4acf8f8)

Bug Fixes

• claude: deny agent writes to .user, obj and node_modules files (#218) (#220) (144e629)
• deploy: image-scan rules, caddy 2.11.7 and ci fixes for the deployable stack (#120) (8c1368d)
• deploy: keycloak admin paths on their own port, nas ingress without allow-lists (#178) (#182) (ceac939)
• deps: bump transitive zod to 4.6.7 for GHSA-mrhx-c7xc-m3w5 (#192) (#193) (9a1aefe)
• gates: review-required check covers renames, leading-zero branches, failed diffs (#148) (#149) (8d982fb)
• image-scan: bump postgres, redis and caddy for zlib cve-2026-85091; except caddy curl (#183) (#184) (1ee709c)
• image-scan: caddy go item 4, collector 0.163.1, .net 10.0.13, #120 renewals (#143) (#144) (e08f61b), closes #142 #166
• image-scan: clear the 2026-10-26 drift with the caddy bridge (#195, #187, #212) (#215) (8930453)
• image-scan: except two unfixed keycloak findings; renew api/bff libc6 (#190) (#191) (cd7fbc1)
• tests: bash-based tests never start the wsl launcher on windows (#217) (#219) (6fc8118)
• tooling: roster ignores untracked local skills (#135) (#138) (354eb8b)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v0.2.0

🌻