safe-chains v0.220.0

Released 2026-07-31 · View on GitHub

feat *(registry)* Add the atom output kind, wired fail-closed
feat *(regions)* Drop the peer dot-shield; the credential shield carries it
feat *(engine)* Confine a flanked atom leaf under its literal prefix
feat *(engine)* Add the locus.anchoring axis and explain an unconfined path as one
fix *(ci)* Install cargo-fuzz the supported way in the property-target job
fix *(engine)* Dot-only flanking does not confine an atom
fix *(engine)* --help / --version void a command's output claim
fix *(hook)* Render internal substitution sentinels as $(…) before a human sees them
fix *(hook)* A sentinel LOOKALIKE must not truncate the path a nudge reports
fix *(hook)* An interpolated path keeps its credential warning
other *(todo)* Revise atom layer 1 — the tagged-substitution sentinel already carries it
other *(todo)* Record the $SCRATCH residue found in adversarial review