## AndrewDryga/emisar — v0.44.0…v0.45.0

_121 commits._

### Features
- **Triage new Portal image CVEs** (c9f4830)
- **Add the query helpers the batched client sweep calls** (65d8a0a)

### Fixes
- **Fix the two test pins the merge left stale** (39db0bc)
- **Merge upstream main into the round-9 fix branch** (a77ec6e)
- **Fix process-forensics host access** (5685cda)

### Backend
- **release: v0.45.0 — The v1 failure-path pass** (95ba267)
- **Narrow the synced-group annotations to the page being rendered** (5756bfa)
- **Renew reviewed Portal image exceptions** (7fec82f)
- **Remove stale version and catalog examples** (fc09d34)
- **Preserve UTF-8 in disconnect reasons** (4db786a)
- **Correct public security and action guidance** (b16c013)
- **Charge uncorrelated back-pressure frames and page the synced SSO groups** (d100aba)
- **Reject incomplete runner action descriptors** (37a8700)
- **Stabilize Portal timing tests** (a625e81)
- **Page on a missing backup, stop paging on a bootstrap hold, and check pin labels** (82e3f77)
- **Make the enum check see piped calls and store target selection as an enum** (0374c75)
- **Record the decision to keep the staff account-closure verb** (5888e6f)
- **Make the custom Credo checks and the coverage gate prove what they claim** (9d2181b)
- **Close the portal platform, audit vocabulary, and release findings** (4c24bae)
- **Close the repository tooling, CI, and infrastructure findings** (f8042bd)
- **Pin the installer harness at fifteen portable cases** (00f2658)
- **Accept a literal IPv6 host in airflow and cap the network-tls lookup's redirects** (e81fbdf)
- **Close the r–z pack findings and retire the versions that skipped a gate** (2d67a46)
- **Stage the runner binary privately and activate it with one rename** (bbf5bac)
- **Close the web-boundary, runner-socket, and fleet UI findings** (0cb66cf)
- **Close the catalog and runbook findings** (6511470)
- **Clarify automatic pack publication** (5c45ad7)
- **Collapse unrun invitation repair migrations** (1b749f6)
- **Trust validated manifests in pack lints** (d476761)
- **Remove speculative registry generation ceremony** (f21c69c)
- **Simplify email dark-mode rendering** (7a3ed76)
- **Remove pack accountability paperwork** (bbe9b63)
- **Remove self-reported admin actor labels** (56202e9)
- **Replace dispatch journal with atomic snapshots** (8a5191b)
- **Simplify installer release verification** (8bba13e)
- **Close the staff console, billing, and recurrent-job findings** (2663a93)
- **Rotate simplified release workflow pin** (a13071d)
- **Remove release reviewer ceremony** (903ff99)
- **Confine invitation credential repair** (229d022)
- **Close the SSO, SCIM, and OAuth findings** (06e8313)
- **Close the h–p pack findings and retire the versions that skipped a gate** (cd24d12)
- **Keep the packs page tests true after the note rewrite and the text rule** (185299a)
- **Make the MCP tool surface honour its own contract** (915f188)
- **Close the accounts and tenancy findings** (ed20b03)
- **Close the approvals and runs findings** (77dbe37)
- **Pin the docs claims the contracts commit changed** (1ef4657)
- **Close the runner's cloud, config, self-update, and attestation findings** (e62f83f)
- **Close the runner's execution-core findings** (e0e7ed0)
- **Close the a–g pack findings and retire the versions that skipped a gate** (4948247)
- **Harden the MCP bridge's config edits and the installers** (204735d)
- **Make the public contracts and docs match the code** (604479f)
- **Require signed release checksums** (e8c04ea)
- **Revoke only credentials that predate invitation acceptance** (6b35572)
- **Document safe populated-table migrations** (a4f67ff)
- **Make the managed runner update work on fielded hosts** (d5caa6a)
- **Alert on unexpected registry writers** (8460308)
- **Reject stale pack catalog generations** (2427812)
- **Reconcile duplicate Gmail evidence task** (c99f798)
- **Bound durable dispatch journal writes** (9784970)
- **Measure dispatch log write amplification** (224d13d)
- **Make pack lints follow the manifest** (b838575)
- **Narrow the pack test development mount** (68fbe22)
- **Test MCP temp privilege boundaries** (e69ad63)
- **Test MCP rollback at the real credential path** (e832db3)
- **Split BEAM host access by deployment mode** (026125d)
- **Split debugging host access by capability** (26380b1)
- **Rate MongoDB raw readers honestly** (1afb1cf)
- **Rate Cockroach raw readers honestly** (75f0acf)
- **Rate systemctl status as a journal read** (c81b425)
- **Restore actorless break-glass member recovery** (7a5a4fe)
- **Keep the Agents All filter selected** (2cbc5f0)
- **Keep persisted runbook state after publish failure** (7e3ac69)
- **Make pack deletion state its full scope** (0a2100e)
- **Declare every MCP tool error code** (b0e589f)
- **Bind MCP cursors to credential lineage** (abe1ba0)
- **Approve only the loaded device grant** (60e8b85)
- **Delete only the locked scoped policy** (784c073)
- **Reject missing installer checksum entries** (008171c)
- **Mask secret fields across output value types** (9b33e92)
- **Raise agent picker label contrast** (1a0650f)
- **Rotate trusted release workflow SHA** (1448bec)
- **Anchor release verification to trusted source** (92137bd)
- **Verify exact release environment policies** (908c9a4)
- **Remove impossible signing response branch** (148f841)
- **Remove duplicate Runbook route clause** (16171b2)
- **Delete unused email list renderer** (f5ac276)
- **Disable unused Swoosh production client** (5240a27)
- **Delete dead MCP JSON decoder** (496d95b)
- **Make kernel log reads fail honestly** (942a912)
- **Require accountability for dangerous pack actions** (5028317)
- **Require staff labels on admin mutations** (13b2afe)
- **Fail closed on wrapper command arguments** (47ef0a1)
- **Fail Symbolicator cache checks on denied traversal** (b76a32a)
- **Document installer attestation workflow override** (f8001e9)
- **Enforce frozen migrations in the Portal gate** (eea5b85)
- **Delete the unusable account status task** (3f0716d)
- **Reject case-only release pin drift** (50c76fc)
- **Select every signing and SSO trust seam** (8aec35e)
- **Align Windows MCP installer trust inputs** (05a5547)
- **Disable blank Postmark webhook secrets** (9994972)
- **Honor MCP installer noninteractive values** (9eaa123)
- **Complete action-run audit policy evidence** (7f61a4a)
- **Keep hostile request text out of audit evidence** (13c6156)
- **Finish the list_packs include contract** (bae77c4)
- **Keep Emisar secrets out of browser children** (73a020c)
- **Keep verifier origin on the boot portal** (cff8542)
- **Report every supervised recurrent job** (c90cf91)
- **Keep invitations unauthorized until accepted** (aacfda8)
- **Revoke member credentials atomically** (1256ae6)
- **Keep MFA state out of Sentry crash events** (f79b6a2)
- **Fail closed on corrupt legacy dispatch state** (223ef2f)
- **Hold the real brand design against Gmail's rewrite** (ef757f9)
- **Build the email palette out of brand-scale steps** (e2a50c3)
- **Freeze the emails dark against Gmail's rewrite** (32d5e85)
- **Make failed run audits filterable** (6c40638)
- **Repair diagnostic pack failure paths** (2d76947)
- **Preserve structured JSON through redaction** (6d39c8b)
- **Drop the in-flight bucket from the monthly report** (f528755)
- **Call a denied run Denied in the monthly report, as the console does** (6ecca78)
- **Record what Gmail's dark theme measurably does to an email** (71fa0e0)
- **Design the emails for the dark mode Gmail forces on them** (abbec76)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/AndrewDryga/emisar?utm_source=github-action)._