feat!: upgrade CPEX to PPE 0.6.0 with RustCrypto

.github/workflows/docs-build.yaml

@@ -65,11 +65,11 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           set -euo pipefail
-          for target in demos/main policy/v0.5.0; do
+          for target in demos/main policy/v0.5.0 policy/v0.6.0; do
             repo="${target%/*}"
             ref="${target#*/}"
             for attempt in 1 2 3; do
-              if gh api "repos/praxis-proxy/$repo/git/trees/$ref?recursive=1" > "$RUNNER_TEMP/$repo-tree.json"; then
+              if gh api "repos/praxis-proxy/$repo/git/trees/$ref?recursive=1" > "$RUNNER_TEMP/$repo-$ref-tree.json"; then
                 break
               fi
               if [ "$attempt" -eq 3 ]; then exit 1; fi
@@ -83,8 +83,8 @@ jobs:
           from pathlib import Path
 
           missing = []
-          for repo, ref in (("demos", "main"), ("policy", "v0.5.0")):
-              tree = json.loads((Path(sys.argv[1]) / f"{repo}-tree.json").read_text())
+          for repo, ref in (("demos", "main"), ("policy", "v0.5.0"), ("policy", "v0.6.0")):
+              tree = json.loads((Path(sys.argv[1]) / f"{repo}-{ref}-tree.json").read_text())
               if tree.get("truncated"):
                   raise SystemExit(f"{repo} repository tree was truncated")
               available = {entry["path"] for entry in tree["tree"] if entry["type"] == "blob"}

CHANGELOG.md

@@ -15,6 +15,26 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-11-09
+
+### Changed
+
+- Upgrade the engine to PPE 0.6.0 with an explicit RustCrypto backend.
+- Preserve inbound identity headers in Python and Go bindings and thread request context through fused identity calls.
+- **Breaking:** CIBA plugins require `store: { kind: memory }` or an explicit Valkey store. JWT credential extraction uses location-independent denial codes.
+- **Breaking:** conversation history contains CMF messages; Go uses `[]Message`. FFI ABI is now 4; rebuild the Go module and native library together.
+- Go HTTP extensions carry query strings and normalized client addresses; identities carry verified DPoP key bindings. Serialized queries are redacted and must be restored from the original request between hooks.
+- The legacy Python worker rejects unsupported query, LLM-request and acquired-metadata access rather than dropping it. Rate-limit hook dispatch and nonserialized LLM-request/acquired-metadata inputs require a Rust host.
+- PPE now accepts enabled audit sinks alongside policy routes. Reference sinks require explicit output destinations and remain outside the bundled set.
+
+### Fixed
+
+- Make the parity gate propagate Cargo failures on macOS Make 3.81.
+
+### Security
+
+- Update `ctutils`, `rustls-webpki` and `webpki-roots` to patched versions. The separate Biscuit dependency still resolves vulnerable `crypto-bigint` 0.5.5 (RUSTSEC-2026-0387); release audit remains blocked pending an upstream-compatible fix.
+
 ## [0.3.1] - 2026-10-15
 
 ### Added

CONTRIBUTING.md

@@ -85,17 +85,17 @@ and a `version`; when adding a new internal dependency, include the `version` so
 the crate remains publishable. `cpex-ffi` is `publish = false` (distributed as
 signed prebuilt artifacts).
 
-For 0.3.1 the complete crates.io publish order is `cpex-hosts-python`,
+For 0.4.0 the complete crates.io publish order is `cpex-hosts-python`,
 `cpex-plugin-delegator-biscuit`, `cpex`, then `cpex-python`. The facade consumes
-PPE 0.5.0 from crates.io; the removed CPEX core, SDK, APL and builtin crates
+PPE 0.6.0 from crates.io; the removed CPEX core, SDK, APL and builtin crates
 remain at 0.2.3 and must not be added back to the release list.
 
 Run the local preparation checks before tagging:
 
 ```bash
-make release-check VERSION=0.3.1   # manifests, Go demo, PPE pins, publish set, ABI
-make release-dry VERSION=0.3.1     # cargo-release preview; no changes
-make release-verify VERSION=0.3.1  # lint, tests, verified .crates, FFI, examples
+make release-check VERSION=0.4.0   # manifests, Go demo, PPE pins, publish set, ABI
+make release-dry VERSION=0.4.0     # cargo-release preview; no changes
+make release-verify VERSION=0.4.0  # lint, tests, verified .crates, FFI, examples
 ```
 
 `make publish-dry` builds and verifies all four `.crate` archives in
@@ -112,8 +112,8 @@ The Rust workflow packages and verifies every retained crate before any
 publish, and tests the facade with `python-host` enabled as well. The FFI
 workflow checks all five target bundles, with Go race tests on the GNU/Linux
 and macOS targets. Actual publishing requires a tag matching the workspace
-version. `make tag VERSION=0.3.1` creates and pushes the `v0.3.1`,
-`go/cpex/v0.3.1` and `0.3.1` tags; it starts publication immediately.
+version. `make tag VERSION=0.4.0` creates and pushes the `v0.4.0`,
+`go/cpex/v0.4.0` and `0.4.0` tags; it starts publication immediately.
 
 The broader integration checks remain separate: `make test-python-e2e`
 requires a compatible `CPEX_PYTHON_SOURCE` checkout, `make parity` needs