Stability checkpoint v0.8.3 — 3 ergonomic/quality fixes batched (zero open TASKS items) - fix(audit): --since accepts relative durations like '5m', '1h', '1d' (5086c23) - fix(tests): isolate cli status tests from a live host-side broker (2e9836a) - fix(ci): drop docker-compose.ci.yml host port mapping (8765 collision) (e4628e6) CI : - ✅ MR !52 pipeline green (lint + test + security + build all stages) - ✅ Post-MR-!52 main pipeline (will be confirmed before tag) — smoke + sbom + sonar - ✅ Earlier tag pipelines (v0.8.0, v0.8.1, v0.8.2) all retroactively still green Local test pass : - ✅ uv run pytest — 313 tests pass (was 303 in v0.8.2 ; +10 parse_since tests) - ✅ uv run ruff check src/ tests/ — All checks passed - ✅ uv run ruff format --check — 38 files already formatted - ✅ uv run mypy src/secured_claude/ — Success: no issues found in 17 source files - ✅ uv run bandit -r src/secured_claude/ — Medium: 0, High: 0 - ✅ bash bin/test-full-stack.sh — 2/2 ALLOW/DENY assertions pass end-to-end - ✅ Host broker (8765) + CI broker container coexist verified — collision resolved Regression check vs v0.8.2 : - ✅ End-to-end Claude → hook → broker → Cerbos → audit row still works - ✅ v0.8.1 host-side broker auto-start preserved - ✅ v0.8.0 redaction (ADR-0046) preserved - 🆕 `secured-claude audit --since 5m` now actually returns the rows in the last 5 minutes (was : silently empty due to lexicographic-string compare bug) - ⏭ N/A — secured-claude is a security wrapper around Claude Code - 4-layer defense-in-depth (ADR-0012) intact, end-to-end validated since v0.8.2 - Bandit Medium: 0, High: 0 — supply-chain posture unchanged - 🆕 Audit ergonomics fixed — relative duration filters work as users expect (`5m`, `1h`, `1d`, `1w`) ; ISO 8601 still works ; clear error message on bad input - v0.8 trilogy + this polish = a v0.8 milestone fully landed - 🆕 CI smoke + local `secured-claude up` no longer collide on port 8765 — single architecture path effectively achieved (the CI broker is internal-only on the docker bridge ; the host port is reserved for the v0.8.1 host-side broker per ADR-0006) - Audit log queryable with relative durations now — closes a real DX hole - pytest 313/313 pass (+10 since v0.8.2), 91 %+ coverage - mypy strict clean, ruff clean, bandit Medium: 0 - 🆕 Test isolation : cli status tests no longer flake when a developer happens to have `secured-claude up` running - 7-stage GitLab pipeline still green (lint → test → security → build → smoke → publish → release) - macbook-local arm64 runner, cosign keyless signing on tags - 🆕 docker-compose.ci.yml no longer publishes a host port — broker container is internal-only on the docker bridge - ADR-0006 (host-side broker) reinforced — the 8765 port belongs to the host-side broker per the trust-boundary contract ; CI testing happens on a sibling-container path (ADR-0033) that doesn't compete for the host port - ADR-0046 (redaction) intact - ⏭ N/A — CLI only - 🆕 `audit --since 5m` works (was : silently broken) - 🆕 No more port-8765 collision foot-gun for local devs running both `secured-claude up` AND the CI smoke compose stack - 🆕 `pytest` no longer flakes based on whether the user happens to have `secured-claude up` running - (none — TASKS.md was deleted in this batch ; zero open ☐ items) - v0.9.0 candidates (no fork-in-the-road yet, just possibilities) : - Signed Cerbos policy bundles (Cerbos supports it) - Multi-principal support (currently single `claude-code-default`) - SIEM export of audit log (Splunk / Datadog forwarders) - Real-LLM smoke gating (currently manual-trigger only)