## mattrobinsonsre/terrapod — v1.7.7…v1.8.0

_33 commits._

### Features
- **feat(1842): let a policy set share data files and helpers (#1850)** (6c200b5)
- **feat(1837): fire run tasks at the pre_plan and pre_apply boundaries (#1844)** (7c861e0)
- **feat(1755): the PR comment says what changed, what it costs and what gated it (#1756) (#1810)** (dae606e)
- **feat(vcs): acknowledge every command, and say why a dropped one was dropped (#1803) (#1805)** (04abc5f)
- **feat(1766): the AI plan summary as a post-plan policy gate (#1792)** (6f19730)
- **feat(1765): OPA policy sets manageable as code (#1790)** (fd8b917)
- **feat(1764): per-workspace runner debug mode (#1779)** (01b7b78)
- **feat(1763): per-workspace settings reachable from every surface that manages workspaces (#1777)** (29cbb27)

### Fixes
- **fix(1862): an inverted override guard, a fail-open as-code path, and four false claims (#1863)** (b1baab5)
- **fix(1858): the last of the v1.8.0 release review (#1859)** (f9092f0)
- **fix(1855): the v1.8.0 release review's should-fix tier (#1856)** (bcc146c)
- **fix(1852): the v1.8.0 release review's blocker tier (#1853)** (ba13acb)
- **fix(1837,1838): the release-review blocker, the unreachable-callback wedge, and two false signals (#1847) (#1848)** (ad3da9c)
- **fix(1838): a token created at another user's endpoint is bound to that user (#1843)** (5b14c86)
- **fix(1836): answer commands, not conversations (#1836)** (a6b4328)
- **fix(1835): the should-fix tier from the v1.7.5 adversarial review (#1835)** (f906fce)
- **fix(1831): two headline fixes that were inert in the case they were written for (#1832)** (2c70bbc)
- **fix(1829): validate redirect_uri before delivering the code to it (#1830)** (2bc0f33)
- **fix(1822): a held run with no verdict reports blocking, so the UI keeps the override (#1825)** (9f408ba)
- **fix(1823): tofu login completes in Safari, and the fallback is no longer (#1824)** (df405b0)
- **fix(1766): name the AI policy gate when it is what holds a run (#1820)** (25c1851)
- **fix(1766): close the three ways the AI gate could hold every run forever (#1815)** (049d459)
- **fix(1763): finish surface parity, and make it a rule rather than advice (#1811)** (756cec7)
- **fix(sdk): carry debug-mode, ai-policy-mode and the policy-set name rules (#1808)** (fd25e91)
- **fix(vcs): the five PR-feedback bugs Event Horizon reported (#1801)** (8847e47)
- **fix(1781): a signing-key change rolls the API, and renderers never mint one (#1784)** (b2f9a9f)

### Tests
- **test(1766): real-database coverage for the AI gate's hold and release (#1817)** (19bfacc)
- **test(1766): cover the AI policy gate's two endpoints at the router tier (#1807)** (f00c430)

### Docs
- **docs(1861): v1.8.0 pre-release audit — steps A and H (#1861)** (f0a94e3)
- **docs: correct the claims the AI policy gate made false (#1809)** (23cb6a1)
- **docs(1786): own the token signing key Secret under a GitOps controller (#1788)** (9b7a8b2)

### Chore
- **chore(1860): v1.8.0 platform-tool review and risk-register refresh (#1860)** (c5978db)
- **chore: v1.8.0 pre-release audit fixes (#1804)** (e12c731)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/mattrobinsonsre/terrapod?utm_source=github-action)._