Release v0.1.8 Iterative appsec + codepros audit-fix pass (3 review iterations to convergence). Security: - GAP-0018: fix connection-thread stack overflow (pre-auth remote DoS / segfault); configurable GRPC_ZIG_CONN_STACK_SIZE, 8 MiB default, CI-gated - NEW-1: cap inbound gRPC message assembly (max_recv_message_bytes, 4 MiB) - NEW-2: peer SETTINGS can no longer raise the inbound frame cap - I2/I5/I6: HPACK Huffman fail-closed, CONTINUATION reassembly bounds, gRPC prefix validation - NEW-A: bound stream-id-skip loop (client liveness DoS) - CM-UAF: close ClientMux stack-slot use-after-free race - O1: loopback-default bind; A5: remove hardcoded benchmark secret Correctness: readMessage trailer-only hang, single-call stream-id reuse, example handler paths, client-mux OOM deadlock, dead-code removal. Docs: truthful security posture, SECURITY.md, CONTRIBUTING.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>