v0.22.3

What's Changed

• fix(vault): respect vault-path/vault-key overrides in init, add overwrite guard by @bug-ops in #6499
• fix(subagent): close secret-leak, trust-cap, and finalize-skip gaps by @bug-ops in #6503
• fix(mcp): fail closed on Untrusted trust level with no tool_allowlist by @bug-ops in #6505
• fix(channels): close fail-open allowlist gap on Discord/Slack by @bug-ops in #6502
• fix(llm): dedupe colliding tool_calls[].id before serialization by @bug-ops in #6506
• fix(sanitizer): close exfiltration guard markdown/HTML image regex bypasses by @bug-ops in #6507
• fix(gateway): fail closed on missing auth token, disclose webhook in wizard by @bug-ops in #6509
• fix(security): close quarantine fail-open and ACP shell permission cache gaps by @bug-ops in #6511
• fix(skills): reuse trust snapshot on transient load failure instead of failing open by @bug-ops in #6513
• fix(channels): clamp negative or non-finite Retry-After before Duration conversion by @bug-ops in #6516
• fix(sanitizer): close case-insensitive scheme and scheme-relative URL bypasses in exfiltration guard by @bug-ops in #6518
• fix(gateway): surface serve() startup failures as TaskStatus::Failed, not Completed by @bug-ops in #6520
• fix(tools): harden shell command pattern-matching against flag-order and blocklist bypasses by @bug-ops in #6521
• fix(vault): thread parse_vault_args env/config resolution into vault subcommand by @bug-ops in #6522
• fix(acp): isolate permission.rs tests from real acp-permissions.toml by @bug-ops in #6514
• fix(sanitizer): close scheme-relative URL gap in exfiltration guard by @bug-ops in #6523
• ci(zeph-acp): add CI guard against AcpPermissionGate::new(_, None) reintroduction by @bug-ops in #6524
• fix(core): add grace window to vault-anchor reconcile-reap sweep by @bug-ops in #6525
• feat(core): enable runaway tool-call rate limiting and daily cost cap by default by @bug-ops in #6528
• refactor(durable): consolidate key-material params and split LocalBackend impl block by @bug-ops in #6529
• feat(subagent): wire per-task tool-allowlist into SpawnContext inheritance by @bug-ops in #6530
• fix(llm): add HTTP-status and transport-level retry to Ollama backend by @bug-ops in #6531
• perf(skills): use embed_batch in embed_skills_with_timeout by @bug-ops in #6532
• refactor(core): split tool_execution/tier_loop.rs into concern-scoped modules by @bug-ops in #6534
• refactor(agent-tools): trim dead AgentChannel scaffolding to only doom_loop_hash by @bug-ops in #6535
• feat(subagent): add delegation-mode gating and token-level transcript streaming by @bug-ops in #6537
• refactor(context): dedupe fetcher budget-append loops via shared helper by @bug-ops in #6540
• feat(subagent): derive tool-allowlist producers from parent permissions and planner by @bug-ops in #6538
• docs(specs): add Telegram rich-text formatting sub-spec for Bot API 10.1/10.2 by @bug-ops in #6542
• refactor(commands): split AgentAccess god-trait into 15 domain sub-traits by @bug-ops in #6543
• feat(memory): add write-time consent gate for untrusted memory writes by @bug-ops in #6544
• fix(core): sanitize compress_context summary before knowledge-block append by @bug-ops in #6585
• fix(serve): wire ContentSanitizer and ML classifier pipeline into zeph serve sessions by @bug-ops in #6586
• fix(security): wire security controls into all agent entry points by @bug-ops in #6587
• fix(bootstrap,durable): resolve vault CLI overrides across all key-material call sites by @bug-ops in #6590
• fix(subagent,sanitizer,tui): mask generic secrets and fix background transcript stall by @bug-ops in #6593
• fix(index,core): add depth-cap guards against unbounded recursion DoS by @bug-ops in #6595
• fix(memory)!: wire GraphConfig::retrieval_strategy into the live graph-recall path by @bug-ops in #6597
• fix(memory): close consent-gate TOCTOU bypasses across turns, tiers, and reload by @bug-ops in #6598
• fix(memory): correct ring-hop distance computation in WaterCircles retrieval by @bug-ops in #6600
• fix(core,memory): correct write-time provenance and audit gating in MemGhost consent gate by @bug-ops in #6599
• feat(channels): adopt Telegram Bot API 10.1 rich-text formatting and fix guest-mode escaping by @bug-ops in #6604
• fix(tools): audit declarative PolicyGateExecutor deny/allow decisions by @bug-ops in #6601
• fix(sanitizer,tools): add depth guards to unbounded JSON recursion in collect_strings by @bug-ops in #6605
• fix(zeph-experiments): route ParameterRange deserialization through new() by @bug-ops in #6606
• fix(acp): align test cfg gate with build_combined_deps' own feature gate by @bug-ops in #6608
• fix(security): close RiskChainAccumulator cross-turn and cross-session gaps by @bug-ops in #6602
• fix(context): require word-boundary match for JSON structural-key fidelity check by @bug-ops in #6611
• fix(cli,vault): honor --vault-key/--vault-path overrides in registry token resolution by @bug-ops in #6610
• refactor(context): dedupe assembler.rs fetcher params and timeout boilerplate by @bug-ops in #6612
• fix(core): repair truncation-severed spotlight wrapper in compaction prompt by @bug-ops in #6613
• refactor(mcp): replace bool parameters with type-safe enums in McpClient connect paths by @bug-ops in #6614
• fix(memory,a2a)!: harden Qdrant search limits and A2A trust defaults by @bug-ops in #6615
• fix(skills): scan and cap trust for self-learning auto-improved skills by @bug-ops in #6619
• refactor(core): remove legacy #[cfg(test)]-only dispatch harness duplicating production tool/LLM dispatch by @bug-ops in #6617
• refactor(core): consolidate security-relevant AgentBuilder wiring across entry points by @bug-ops in #6620
• test(core): add discriminating test for classify_tool_result's [stderr] branch by @bug-ops in #6621
• fix(memory): clamp VectorStore::search trait method directly by @bug-ops in #6622
• refactor(acp): split ZephAcpAgentState god-object into focused modules by @bug-ops in #6624
• fix(subagent): enforce GrantKind::Tool TTL/revocation before dispatch by @bug-ops in #6625
• fix(subagent)!: reject unknown keys in nested tools/permissions frontmatter by @bug-ops in #6626
• refactor(memory): enforce VectorStore search clamp via template method by @bug-ops in #6627
• docs(specs): correct stale references, broken links, and formatting by @bug-ops in #6629
• feat(core,llm,memory): add per-message usage/cost tracking by @bug-ops in #6628
• chore(deps): update github-actions by @bug-ops in #6639
• chore(deps): update ghcr.io/bug-ops/zeph:latest docker digest to ad52423 by @bug-ops in #6638
• chore(deps): update ollama/ollama:latest docker digest to 6345fbc by @bug-ops in #6640
• chore(deps): update prom/prometheus docker tag to v3.13.1 by @bug-ops in #6641
• chore(deps): update rust-minor-patch by @bug-ops in #6642
• chore(deps): update rust crate tokio to 1.53.0 by @bug-ops in #6643
• release: v0.22.3 by @bug-ops in #6645

Full Changelog: v0.22.2...v0.22.3