# Changelog

## Unreleased

## 0.2.2

- Expanded `delegated-redis` documentation: operations guide, integration section,
  docs.rs metadata, README links, and `#![deny(missing_docs)]`.
- Linked Redis trust-state docs from the core README and operations guide.
- CI now runs `cargo doc --workspace --no-deps`.

## 0.2.1

- Added contract, engine, and issuance property-test coverage.
- Added 0.2 reference vectors, generator example, and conformance harness.
- Added `delegated-redis` for shared nonce/revocation state.
- Added reference issuer/verifier stack with optional Redis backend.
- Added focused internal security review for the 0.2 evaluation path.

## 0.2.0

- Replaced caller-supplied identity documents with mandatory host-configured issuer keys.
- Replaced caller-supplied action/runtime context with host-only `OperationContext`.
- Made resource and delegation-depth constraints fail closed when host facts are absent.
- Moved atomic nonce consumption after every other authorization check.
- Scoped revocations, deny entries, and nonces by issuer.
- Removed protocol adapters, sidecar, discovery, profile labels, speculative policy signals,
  control-plane helpers, local-file persistence, CLI, and language bindings.
- Marked denial-event claims as unverified input.

This release intentionally breaks the experimental 0.1 wire format and API.
