v0.24.1

What's Changed

🔧 Other Changes

• fix(install): actionable hint when self-hosted GitLab host swallows subpath by @rrazvd in #2074
• fix(update): reconcile MCP/LSP servers after apm update by @cffnpwr in #2085
• fix(deps): match local transitive dependencies by install path by @danielmeppiel in #2099
• fix: retain dev dependencies (supersedes #2042, closes #2033) by @danielmeppiel in #2102
• fix(claude): honor CLAUDE_CONFIG_DIR for user MCP config by @danielmeppiel in #2096
• fix(deps): stop virtual dependency tree recursion by @danielmeppiel in #2093
• fix(deps): normalize case-insensitive package identity by @danielmeppiel in #2098
• fix(marketplace): preserve registered SSH transport by @danielmeppiel in #2091
• fix(audit): exempt transitive MCP servers from config-consistency orphan check by @edenfunf in #2084
• fix(codex): preserve literal Windows TOML path keys by @danielmeppiel in #2100
• fix(install): preserve LSP state before lockfile compare by @paul-ww in #2079
• docs(spec): fold spec-guardian recommendations on req-tg-005 (antigravity) by @danielmeppiel in #2087
• fix(skills): key ownership tracking on owner/repo, not the leaf directory name by @nadav-y in #2052
• fix(gh-aw): set min-integrity to unapproved for panel review by @sergio-sisternes-epam in #2040
• chore: release v0.24.1 by @danielmeppiel in #2113
• test(install): align shared-file ownership expectation by @danielmeppiel in #2120

New Contributors

• @rrazvd made their first contribution in #2074
• @cffnpwr made their first contribution in #2085
• @paul-ww made their first contribution in #2079

Full Changelog: v0.24.0...v0.24.1

v0.24.0

What's Changed

🔧 Other Changes

• fix(hooks): rename Copilot hook events to camelCase during merge (closes #1977) by @danielmeppiel in #1979
• fix(audit): stable _apm_source marker in audit replay (closes #1978) by @danielmeppiel in #1980
• fix(mcp): resolve self-defined stdio env ${VAR} placeholders at install time (closes #1963) by @danielmeppiel in #1966
• perf(compile): fast-path universal applyTo matching by @WilliamK112 in #1993
• Fix targets:/skills:/alias: ignored on path: dependency entries by @sergio-sisternes-epam in #1987
• fix: Sanitise marketplace name to kebab-case in output mappers by @sergio-sisternes-epam in #2008
• fix(yaml): preserve apm.yml comments on manifest update (closes #2000) by @danielmeppiel in #2012
• docs: clarify lockfile transitive-graph determinism (refs #2007) by @danielmeppiel in #2010
• fix(utils): keep .git suffix on anonymous HTTPS clone URLs (closes #1995) by @mia106dev in #1997
• fix(install): frozen check matches host-qualified private git deps (closes #1996) by @danielmeppiel in #2011
• fix(pack): pack emits only lockfile-attested dependency content in every format (closes #1999) by @danielmeppiel in #2013
• fix(config): add config list alias by @WilliamK112 in #1991
• fix(mcp): clarify install help forwarded options by @WilliamK112 in #2018
• fix(audit): clarify help summary by @WilliamK112 in #2017
• perf(cache): apply promisor config on the clone, collapsing 3 config spawns to 1 by @srobroek in #1974
• perf(resolve): share one RefResolver per repo so ls-remote runs once per repo by @srobroek in #1975
• perf(resolve): honour locked commits without re-resolving refs over the network by @srobroek in #1973
• Harden plugin bin/ deploy to user-only 0o700 permissions by @danielmeppiel in #2024
• fix(plugin-bin): harden deploy permissions and deny matching by @WilliamK112 in #1971
• Verify runtime archive checksums before extraction by @fallintoplace in #1949
• Harden Artifactory zip extraction by @fallintoplace in #1948
• feat(antigravity): support trigger: glob frontmatter and compile-time dedup by @okamiconcept in #1984
• fix(hooks): route combined hook manifests to every named target (closes #2020) by @garyj in #2021
• fix(hooks): deploy self-contained hook scripts with siblings and package module type (closes #2023) by @danielmeppiel in #2025
• Fix duplicate H1 in generated CLAUDE.md by @WilliamK112 in #2016
• chore: release v0.24.0 by @danielmeppiel in #2032
• fix(install): treat throttled GitHub probe as indeterminate, not inaccessible by @danielmeppiel in #2037
• test(install): make github probe unit tests hermetic (mock requests.get) by @danielmeppiel in #2038

New Contributors

• @mia106dev made their first contribution in #1997
• @srobroek made their first contribution in #1974
• @fallintoplace made their first contribution in #1949
• @okamiconcept made their first contribution in #1984
• @garyj made their first contribution in #2021

Full Changelog: v0.23.1...v0.24.0

v0.23.1

What's Changed

🔧 Other Changes

• docs(enterprise): consolidate governance into a 5-phase ramp + surface lifecycle scripts by @danielmeppiel in #1951
• Fix: make --skill deployment additive, not just persistence (#1786 follow-up) by @danielmeppiel in #1955
• fix(audit): make per-deployed-file content hash line-ending invariant (#1952) by @danielmeppiel in #1959
• chore: release v0.23.1 by @danielmeppiel in #1960

Full Changelog: v0.23.0...v0.23.1

v0.23.0

What's Changed

🔧 Other Changes

• fix(update): treat cached transitive registry deps as unchanged in update plan by @nadav-y in #1921
• fix: honor per-dep targets and plural targets: in audit drift replay by @sergio-sisternes-epam in #1930
• fix(install): prune lockfile when all dependencies are removed from manifest by @nadav-y in #1926
• fix(update): report changed-dependency count, not re-materialized tree size by @nadav-y in #1927
• fix(cli): skip update check for unknown subcommands to fail fast by @maro114510 in #1541
• fix(outdated): use virtual-path basename for monorepo tag pattern matching by @kevinbeier-enbw in #1893
• fix(preview): unpack all three values returned by _auto_compile_prompts by @fmferrari in #1721
• fix(security): clear 4 Dependabot alerts (#62 llm, #68/#69 vite, #65 esbuild) by @danielmeppiel in #1936
• feat: add general-purpose lifecycle hooks framework (#1529) by @sergio-sisternes-epam in #1798
• chore(compile): remove legacy .chatmode.md primitive type by @sergio-sisternes-epam in #1931
• fix(cli): address CLI consistency report findings (#1928) by @sergio-sisternes-epam in #1929
• fix: respect package targets during user-scope (global) MCP install by @sergio-sisternes-epam in #1941
• fix(cli): point version-check hint to apm self-update by @syf2211 in #1943
• docs: reground the whole docs corpus against v0.22.0 source by @danielmeppiel in #1946
• docs(outdated): clarify monorepo tag pattern matching for virtual subdirectory deps by @kevinbeier-enbw in #1895
• feat(view): route 'view versions' to the registry when a default is configured by @nadav-y in #1938
• fix(docs): enable GFM table rendering in Starlight docs by @syf2211 in #1944
• fix(lifecycle): make script executor + lifecycle tests pass on Windows by @danielmeppiel in #1947
• chore: release v0.23.0 by @danielmeppiel in #1950

New Contributors

• @maro114510 made their first contribution in #1541
• @fmferrari made their first contribution in #1721
• @syf2211 made their first contribution in #1943

Full Changelog: v0.22.0...v0.23.0

v0.22.0

What's Changed

🔧 Other Changes

• Fix marketplace install ignoring GitLab host for url-type sources (#1848) by @sergio-sisternes-epam in #1853
• fix: honor CODEX_HOME for user-scope codex config (closes #1861) by @danielmeppiel in #1863
• Fix apm pack omitting version for INTERNAL/private github.com repos by @sergio-sisternes-epam in #1854
• Fix no-orphaned-packages false positive for local-path sub-package deps by @sergio-sisternes-epam in #1855
• Fix cross-package file protection in stale cleanup (#1831) by @sergio-sisternes-epam in #1856
• Add cascading policy repo discovery with ADO support by @sergio-sisternes-epam in #1830
• Remove daily test improver workflow by @danielmeppiel in #1870
• docs(changelog): reconcile [Unreleased] with PRs merged since v0.21.0 by @danielmeppiel in #1871
• feat(targets): converge windsurf skills onto .agents/skills/ by @danielmeppiel in #1802
• Expose apm-version as an import input on shared/apm.md by @danielmeppiel with @Copilot in #1842
• harden(executables): expand allowExecutables gate to mcp and canvas; store approvals user-local by @sergio-sisternes-epam in #1865
• Add configurable default install target (apm config target) with install-time fallback precedence by @danielmeppiel with @Copilot in #1881
• test(ci): empirical proof that the apm-version import-default pins non-opting consumers by @danielmeppiel in #1891
• ci(runtime): make live-inference smoke honestly non-blocking by @danielmeppiel in #1900
• feat(governance): Executable Trust Governance v1 - deny-wins resolver, vocab unification, audit fix by @danielmeppiel in #1875
• chore(gh-aw): upgrade compiler v0.76.1 -> v0.80.9 and recompile all locks by @danielmeppiel in #1903
• fix(install): make Windows pip fallback resilient to stderr under ErrorActionPreference=Stop (closes #1874) by @danielmeppiel in #1876
• feat(compile): explicit apm compile -g + install-time hint for global root context by @danielmeppiel in #1632
• ci: bump apm-action pin to v1.10.0 + pack-format drift trap by @danielmeppiel in #1907
• fix(install): persist --target into auto-bootstrapped apm.yml (#1743) by @danielmeppiel in #1901
• test(ci): repair merge-queue Integration Tests regressions by @danielmeppiel in #1909
• fix(self-update): improve update UX on macOS by @nadav-y in #1872
• fix(registry): registry deps as first-class citizens in display/UX surfaces by @nadav-y in #1908
• fix(tests): make Windows CI-failing tests platform-portable by @danielmeppiel in #1910
• fix(hooks): per-target hook manifest selection (closes #1892) by @danielmeppiel in #1902
• fix(install): write deployed files with LF on every platform by @danielmeppiel in #1913
• feat(lockfile): record installed package name + version per entry (#1888) by @danielmeppiel in #1904
• perf: ADO REST metadata fetcher to avoid clone-based fetch by @Aaryan-Dadu in #1852
• refactor(cowork): DRY internal hot-path cleanup (closes #922) by @danielmeppiel in #1914
• refactor(lockfile): sweep cross-target skill maps onto .agents/skills/ (closes #1805) by @danielmeppiel in #1912
• feat(config): persist non-secret installer prefs for self-update (closes #667) by @danielmeppiel in #1915
• fix(marketplace): propagate marketplace --ref to string sources; fix GitLab slash-ref proxy filenames by @chkp-roniz in #1880
• fix(install): adopt CRLF-source files against LF-deployed targets on Windows by @danielmeppiel in #1916
• docs(compile): document targets: to pin the committed generated set (#1342) by @danielmeppiel in #1583
• chore: release v0.22.0 by @danielmeppiel in #1920
• fix(tests): stub package name/version in MCP lockfile integration mocks by @danielmeppiel in #1922

Full Changelog: v0.21.0...v0.22.0

v0.21.0

What's Changed

🔧 Other Changes

• Add OpenClaw integration documentation page by @sergio-sisternes-epam in #1769
• Delete skill folders for removed packages by @sergio-sisternes-epam in #1767
• Remove apm marketplace publish and marketplace doctor alias (#1134) by @sergio-sisternes-epam in #1766
• Add allowExecutables approval gate for dependency executables by @sergio-sisternes-epam in #1723
• feat(install): experimental Copilot canvas extensions by @sergio-sisternes-epam in #1689
• Fix managed_section ignored in distributed and single-agents compile paths by @sergio-sisternes-epam in #1768
• fix: restore devDependencies.mcp on apm install (closes #1780) by @danielmeppiel in #1787
• Add integration tests for executables approval gate by @sergio-sisternes-epam in #1785
• test: raise integration coverage to 75% by @sergio-sisternes-epam in #1788
• fix(policy): carry all ApmPolicy fields through inheritance merge by @danielmeppiel in #1791
• test(integration): fix merge-queue failures from removed publish/doctor modules by @danielmeppiel in #1797
• docs(policy): clarify what apm-policy.yml governs by @danielmeppiel in #1792
• docs(governance): surface install-vs-runtime plane boundary on travelled paths by @danielmeppiel in #1796
• feat(policy): declarable integrity keys (require_hashes, fail_on_drift) by @danielmeppiel in #1794
• fix(ci): spec-conformance Mode B gate fails closed on unresolvable merge-base by @danielmeppiel in #1801
• fix(marketplace): resolve marketplace check against each entry's host + token by @leocamello in #1763
• feat: add Google Antigravity CLI (agy) as first-class APM target by @sergio-sisternes-epam in #1770
• test(marketplace): pin ADO sourceBase authoring->consume e2e + docs (#1010) by @danielmeppiel in #1810
• feat(audit): surface unmanaged artifacts with reason, type, and deny-conflict by @danielmeppiel in #1793
• feat(export): SBOM export + declared-license recorder (U5 + U6) by @danielmeppiel in #1820
• test(integration): fix 3 semantic-merge test breakages in merge queue by @danielmeppiel in #1834
• fix(outdated): degrade per-dep check failures instead of crashing; stabilize e2e teardown by @danielmeppiel in #1836
• docs(cli): list kiro in update target help by @WilliamK112 in #1821
• fix: emit required "version": 1 in .cursor/hooks.json by @sergio-sisternes-epam in #1840
• Fix {name} placeholder ignored in apm pack marketplace version resolution (#1822) by @sergio-sisternes-epam in #1841
• docs: restore "What to commit" guidance (fix #1837) by @sergio-sisternes-epam in #1839
• Fix marketplace --ref not propagated to relative plugin sources (#1811) by @sergio-sisternes-epam in #1824
• feat(install): route CLI shorthands to default registry when configured by @nadav-y in #1816
• Add extra passthrough for harness-specific MCP keys (#1670) by @sergio-sisternes-epam in #1765
• fix: correct stale tar.gz and --tarball references after zip default by @nadav-y in #1779
• Fix --skill to merge additively with existing skills in apm.yml by @sergio-sisternes-epam in #1786
• feat: add APM Contributor Dashboard canvas package by @sergio-sisternes-epam in #1825
• chore: release v0.21.0 by @danielmeppiel in #1851

New Contributors

• @leocamello made their first contribution in #1763
• @WilliamK112 made their first contribution in #1821

Full Changelog: v0.20.0...v0.21.0

v0.20.0

What's Changed

🔧 Other Changes

• Add experimental Hermes agent target by @altaranenco in #1726
• fix(deps): allow same-repo remote path deps by @danielmeppiel in #1732
• feat(distribution): add enterprise bootstrap mirrors by @danielmeppiel in #1733
• feat(marketplace): add source parity for marketplace add by @danielmeppiel in #1739
• fix(deps): support multi-host dependency identity by @danielmeppiel in #1735
• feat(bootstrap): fold panel follow-ups for enterprise mirror mode (post-#1733) by @danielmeppiel in #1745
• fix(mcp): honor optional registry inputs by @danielmeppiel in #1734
• feat(marketplace): add sourceBase for package sources by @danielmeppiel in #1736
• feat(deps): update revision pins by @danielmeppiel in #1738
• feat(deps): fetch path-scoped files over git transport instead of host API by @danielmeppiel in #1740
• feat(targets): add Kiro IDE support by @danielmeppiel in #1741
• fix(tests): fix Windows path comparison in TestHermesConfigPath by @sergio-sisternes-epam in #1737
• test: fix Windows-only CI failures across 8 unit tests by @danielmeppiel in #1752
• fix(docs): restore reachability of alternative installation methods page (closes #1748) by @danielmeppiel in #1751
• fix(compile): suppress empty AGENTS.md shells for copilot when instructions already in .github/instructions/ by @tillig in #1742
• fix(install): keep copilot in multi-target --target lists by @Addono in #1749
• fix(compile): remove stale APM-generated CLAUDE.md on --clean when .claude/rules/ is populated by @tillig in #1747
• feat(pack): switch --archive to .zip and add --archive-format zip|tar.gz by @nadav-y in #1720
• fix(marketplace): inherit description/version from local-path apm.yml by @danielmeppiel in #1755
• chore: release v0.20.0 by @danielmeppiel in #1756
• test(integration): refresh stale integration tests after v0.20.0 changes by @danielmeppiel in #1757
• test(release): refresh release-validation harness for v0.20.0 behavior changes by @danielmeppiel in #1758

New Contributors

• @altaranenco made their first contribution in #1726
• @Addono made their first contribution in #1749

Full Changelog: v0.19.0...v0.20.0

v0.19.0

What's Changed

🔧 Other Changes

• refactor(auth): debug-log all exception handlers in credential cascade (closes #935) by @danielmeppiel in #1664
• fix(install): keep format-transformed rules tracked + in sync (closes #1662) by @srid in #1665
• fix(deps): scope shorthand-alias guard to exclude @ in #ref fragment (closes #1696) by @danielmeppiel in #1698
• fix(install): unwrap lspServers envelope in plugin .lsp.json (closes #1683) by @sergio-sisternes-epam in #1686
• fix(compile): target-aware instruction dedup for Codex AGENTS.md (closes #1678) by @sergio-sisternes-epam in #1685
• fix(mcp): preserve scoped server names when materializing harness configs (closes #1693) by @danielmeppiel in #1699
• feat: add openclaw as experimental skills target by @sergio-sisternes-epam in #1677
• fix: external scanner UX improvements by @sergio-sisternes-epam in #1692
• fix(deps): preserve transitive dependencies in marketplace and remote subdir installs (closes #1666) by @sergio-sisternes-epam in #1687
• fix(install): support FQDN monorepo subpath on GHES hosts (closes #1673) by @sergio-sisternes-epam in #1684
• fix(deps): add AAD bearer fallback and HTML sign-in detection in download_ado_file (closes #1671) by @danielmeppiel in #1675
• feat: warn on unknown keys dropped in MCPDependency.from_dict() by @danielmeppiel in #1674
• Add Nadav Yogev (JFrog) to maintainers by @danielmeppiel in #1704
• feat(publish): switch publish command archive format from tar.gz to zip by @nadav-y in #1695
• fix(install): honor --skill subset on non-package skill-collection install (closes #1707) by @danielmeppiel in #1709
• fix(install): skip lockfile rewrite when local instructions content is unchanged (closes #1702) by @danielmeppiel in #1710
• fix(install): validate APM_LIB_DIR before rm -rf to prevent data loss (closes #1690) by @dohwi in #1694
• fix(install): dereference in-package symlinks on local install (#1668) by @danielmeppiel in #1676
• feat: surface installed hook actions during apm install (closes #316) by @danielmeppiel in #1700
• Fix Windows CRLF handling in install safety tests by @danielmeppiel in #1717
• fix(tests): skip install.sh safety tests when POSIX bash is unavailable by @danielmeppiel in #1719
• fix(install): cover skill bundles with per-file content-integrity + target-scoped union manifest (closes #1716) by @danielmeppiel in #1718
• fix(apm-review-panel): guarantee non-empty turn exit via synchronous fan-out by @danielmeppiel in #1714
• chore: release v0.19.0 by @danielmeppiel in #1715

New Contributors

• @dohwi made their first contribution in #1694

Full Changelog: v0.18.0...v0.19.0

v0.18.0

What's Changed

🔧 Other Changes

• feat(marketplace): add audit command to flag deps that bypass marketplace pinning by @edenfunf in #881
• fix(deps): reject shorthand alias syntax (supersedes #1301) by @danielmeppiel in #1655
• feat(outdated): support monorepo tag nameing convention by @kevinbeier-enbw in #1504
• fix(compile): match applyTo globs without following symlinks into node_modules by @srid in #1576
• feat(deps): support marketplace dependencies in plugin.json by @stbenjam in #1422
• feat(lsp): add first-class LSP server support to install pipeline by @stbenjam in #1424
• fix(intellij): preserve env-var placeholders in mcp.json (closes #1656) by @danielmeppiel in #1659
• fix(deps): resolve semver ranges against per-package subpath tags (closes #1633) by @danielmeppiel in #1658
• fix(install): rewrite outbound relative links from skill bundles (closes #1625) by @danielmeppiel in #1657
• chore: release v0.18.0 by @danielmeppiel in #1661

New Contributors

• @kevinbeier-enbw made their first contribution in #1504

Full Changelog: v0.17.0...v0.18.0

v0.17.0

What's Changed

🔧 Other Changes

• fix(publish): clarify --package is required and update docs by @nadav-y in #1562
• refactor(pack)!: remove deprecated --marketplace-output flag (#1318) by @danielmeppiel in #1585
• feat(compile): make source-attribution comments opt-in to cut token overhead by @danielmeppiel in #1584
• Extract shepherd-driver engine, rewire skill packages, and harden local-dep drift replay by @danielmeppiel in #1578
• feat(autopilot): author PR bodies via pr-description-skill + post panel outcome per shepherd run by @danielmeppiel in #1598
• fix: dedup parity for Copilot AGENTS.md vs .github/instructions/ by @danielmeppiel in #1590
• feat: managed-section mode for AGENTS.md updates by @danielmeppiel in #1589
• fix: send auth header for GitHub release lookup in installer and self-update by @danielmeppiel in #1588
• fix: skip .gitignore update for global scope installs by @danielmeppiel in #1587
• feat: apm install -g deploys copilot instructions to ~/.copilot/copilot-instructions.md by @danielmeppiel in #1619
• feat: make apm self-update and version-checker respect air-gapped env vars (GITHUB_URL, APM_REPO, VERSION) by @danielmeppiel in #1615
• refactor(models): separate package-format detection into composition model by @danielmeppiel in #1618
• refactor: files_adopted follow-ups from PR #1313 review panel by @danielmeppiel in #1617
• refactor: extract skip_download and locked_ref helpers into _skip_logic.py (#552) by @danielmeppiel in #1614
• fix: polish managed-section error messages by @danielmeppiel in #1609
• fix(auth): expand port hint with git credential fill command and docs URL by @danielmeppiel in #1608
• chore: enable RUF002/RUF003 (ambiguous unicode) and fix 249 violations by @danielmeppiel in #1607
• test(integration): add wiring-invariants guard to close #1166 by @danielmeppiel in #1613
• test: add edge-case coverage for empty and identical managed-section markers by @danielmeppiel in #1602
• docs: add compilation.agents_md sub-object to manifest-schema reference by @danielmeppiel in #1601
• fix: correct broken epilog help reference in apm mcp install by @danielmeppiel in #1604
• docs: clarify install-time discovery rules for marketplace plugins (.apm// vs root convention dirs) by @danielmeppiel in #1603
• docs: remove flake8/black from hello-world python template by @danielmeppiel in #1600
• fix(pack): emit amend+force-with-lease recovery recipe on --check-clean drift by @danielmeppiel in #1610
• feat(compile): add --no-dedup / --force-instructions flag for claude target by @danielmeppiel in #1616
• feat(init): suggest agentrc in Next Steps when no instructions exist by @danielmeppiel in #1611
• perf: skip re-download when callback SHA matches remote in --update mode (#551) by @danielmeppiel in #1612
• feat: deploy bin/ executables for marketplace_plugin packages to ~/.claude/skills//bin/ by @danielmeppiel in #1591
• feat(audit): vendor-agnostic external SARIF scanner ingestion (experimental) by @sergio-sisternes-epam in #1579
• feat(pack): generate plugin.json for Claude and Copilot ecosystems by @sergio-sisternes-epam in #1623
• feat(install, compile): --root DIR to redirect writes while sources resolve from $PWD by @danielmeppiel in #1628
• harden(plugin-bin): restrict deployed bin/ executables to user-only execute (Item 3 from #1620) by @danielmeppiel in #1626
• feat(apm.yml): support homepage, repository, keywords, and structured author fields by @danielmeppiel in #1624
• fix: surface file-missing error before marker search in managed_section mode by @danielmeppiel in #1606
• feat: make apm update a superset of apm deps update by @Aaryan-Dadu in #1574
• test(integration): add hermetic e2e for Artifactory VCS proxy install (closes #1228) by @danielmeppiel in #1630
• chore: audit F401 noqa suppressions -- remove dead imports, document re-exports by @danielmeppiel in #1643
• feat(config): add apm config set/get/unset mcp-registry-url by @danielmeppiel in #1637
• feat: target-aware hook event diagnostics by @danielmeppiel in #1635
• feat: apm find -- trace a deployed file back to its contributing package(s) by @danielmeppiel in #1631
• Add integration tests for install-time audit policy floor (#1642) by @sergio-sisternes-epam in #1646
• fix(parser): normalize list-valued applyTo and parse handoffs in agent frontmatter by @danielmeppiel in #1629
• test(integration): repair stale integration-test drift from recent refactors by @danielmeppiel in #1648
• feat(mcp): add IntelliJ/JetBrains as an MCP install target by @danielmeppiel in #1636
• test(integration): fix guardrailing hero E2E against distributed-compile model by @danielmeppiel in #1651
• refactor: Strangler Stage 1 -- tame worst complexity outliers by @sergio-sisternes-epam in #1464
• add(lock): resolve deps and write apm.lock.yaml without deploying files by @danielmeppiel in #1639
• fix(lock): always write apm.lock.yaml and repair local-dep e2e syntax by @danielmeppiel in #1652
• test: add integration tests for external scanner edge cases by @sergio-sisternes-epam in #1638
• fix: pass --no-llm to SkillSpector and handle non-JSON stdout by @sergio-sisternes-epam in #1645
• fix: strip ANSI escape codes from external SARIF message text by @sergio-sisternes-epam in #1644
• feat(security): external scanner configuration surface (SkillSpector LLM) by @sergio-sisternes-epam in #1647
• chore: release v0.17.0 by @danielmeppiel in #1653

Full Changelog: v0.16.1...v0.17.0