Stability checkpoint v0.8.4 — documentation gaps closed (CHANGELOG + CONTRIBUTING + dev index + README refresh) - docs: CHANGELOG.md + CONTRIBUTING.md + docs/dev/README.md + README refresh (4145997) CI : - ✅ MR !53 pipeline green (lint + test + security + build all stages) - ✅ Post-MR-!53 main pipeline (will be confirmed before tag) Local test pass : - ✅ uv run pytest — 313 tests pass (no test changes — same as v0.8.3) - ✅ uv run ruff check src/ tests/ — All checks passed - ✅ uv run ruff format --check — 38 files already formatted - ✅ uv run mypy src/secured_claude/ — Success: no issues found - ✅ uv run bandit -r src/secured_claude/ — Medium: 0, High: 0 Doc check : - ✅ CHANGELOG.md — 32 tags inventoried, recent entries (v0.8.x) carry per-commit bullets, older entries link to GitLab tag pages - ✅ CONTRIBUTING.md — quick-start (uv + gates), commit conventions, branching/merging, ADR proposal flow, testing standards, where-to-look-first - ✅ docs/dev/README.md — index linking developer-environment + agent-container-debug - ✅ README.md — counts refreshed (313 / 91.27% / 47 ADRs / v0.8.3 status), Documentation map section added linking CHANGELOG / CONTRIBUTING / docs/dev / docs/security / docs/adr, ADR-0046 surfaces in highlights table Regression check vs v0.8.3 : - ✅ Code unchanged — 313 tests still pass identically - ✅ Stack end-to-end still works (no docker-compose / orchestrator changes) - 🆕 New contributors now have CONTRIBUTING.md to land their first patch - 🆕 Audit trail (CHANGELOG + tag annotations) is now browsable from the repo root - 🆕 docs/dev/agent-container-debug.md (the v0.8.2 EROFS investigation playbook) is discoverable from README - ⏭ N/A — secured-claude is a security wrapper around Claude Code - 4-layer defense-in-depth (ADR-0012/0022) intact, end-to-end validated since v0.8.2 - Bandit Medium: 0, High: 0 unchanged - Code unchanged - 🆕 docs/security/supply-chain.md still authoritative ; CHANGELOG now references the cosign-signed tag pages - Code unchanged - pytest 313/313 pass, 91.27 % coverage - 🆕 CONTRIBUTING.md now codifies the testing standards (coverage gate ≥ 90 %, ambient-state isolation, integration tests boot real Cerbos) - 🆕 CONTRIBUTING.md documents the `dev` → `main` flow + `--remove-source-branch=false` invariant + Conventional Commits requirement (matches CLAUDE.md global) - 47 ADRs unchanged ; CONTRIBUTING.md now spells out the ADR proposal recipe (copy template → fill 5 sections → regen index → reference in code) - ⏭ N/A — CLI only - 🆕 First-time contributor onboarding now lives in CONTRIBUTING.md (was : implicit, had to read the README + figure out gates) - 🆕 Browse-history-without-git via CHANGELOG.md (was : `git tag -l --format='%(contents)'`) - 🆕 docs/dev/ has a real index, not just two scattered files - (none — TASKS.md was deleted in v0.8.3 ; zero open ☐ items) - v0.9.0 candidates (forks-in-the-road, no tasks pending) : - Signed Cerbos policy bundles (Cerbos supports it) - Multi-principal support (currently single `claude-code-default`) - SIEM export of audit log (Splunk / Datadog forwarders) - Real-LLM smoke gating (currently manual-trigger only)