@cognium-ai/mcp-server 4.16.4 → 4.17.0

package/CHANGELOG.md

@@ -0,0 +1,1820 @@
+# Changelog
+
+## [4.17.0] - 2026-10-01
+
+**Deprecated. This is the last release of `@cognium-ai/mcp-server`.** The package is now a shim
+over [`@cognium/mcp-server`](https://www.npmjs.com/package/@cognium/mcp-server), the one MCP
+server. Install that and `circle-ir-ai`, and run `mcp-server-cognium-dev`, to get the same tools.
+
+### Changed
+- **The ten tools moved to `circle-ir-ai/mcp`** and are served by `@cognium/mcp-server`, which
+  loads that module next to its own eleven tools. Nothing here implements a tool any more.
+  Tested with `@cognium/mcp-server` 0.2.0, `circle-ir-ai` 4.17.0 and `circle-ir` 4.9.29.
+- **`cognium-mcp` still starts a server**, now the one server: it prints a deprecation notice
+  on stderr and then serves 21 tools — the ten it always did, with the same names and
+  arguments, plus the eleven of `@cognium/mcp-server`.
+- **`buildServer()` keeps its name and stays synchronous**, and returns a server with the same
+  21 tools. `createServer()` from the one server is re-exported for hosts that can await.
+- Dependencies are now `@cognium/mcp-server` ^0.2.0, `circle-ir-ai` ^4.17.0 and MCP SDK
+  ^1.30.1. `circle-ir`, `minimatch` and `zod` are no longer direct dependencies.
+
+#### Consumer Impact
+- **`serverInfo` is now `@cognium/mcp-server` and its version**, not `cognium-mcp` / `0.4.0`.
+  A client matching on the old name stops matching.
+- **`find_credential_exposure` with `llm_verify: true` is refused** unless `COGNIUM_ENDPOINT`
+  or a licence token is configured: an error result with one line of text and no
+  `structuredContent`. Before, verification was skipped without saying so.
+- **Every response from the ten tools gains a `provenance` field**, and their input schemas
+  are generated by zod 4; names, types and required arguments are unchanged.
+
+## [4.16.5] - 2026-10-01
+
+### Changed
+- **`circle-ir` 4.9.27 → 4.9.29** (fleet re-pin; 4.9.28 was pinned briefly and never published).
+  C# product-path recall on Juliet reaches **93.5%** (from 10.6%), with a sharp precision
+  regression confined to the families cognium-dev#508 applies to, plus a carried-over Rust
+  deser-sink regression (cognium-dev#541). See `circle-ir-ai/CHANGELOG.md` for the full table.
+  Suite passes unchanged; exactly one copy of `circle-ir` resolves.
+
+## [4.16.4] - 2026-09-29
+
+### Changed
+- **`circle-ir` 4.9.26 → 4.9.27** (fleet chain; see circle-ir-ai 4.16.4 for the C# benchmark
+  deltas this engine bump produces — recall up on Juliet shapes, one new xss false positive from
+  an uncredited `HtmlEncoder`, cognium-dev#520). Test suite passes unchanged; exactly one copy of
+  `circle-ir` resolves.
+
+## [4.16.3] - 2026-09-24
+
+### Changed
+- **circle-ir 4.9.25 → 4.9.26, circle-ir-ai ^4.16.2 → ^4.16.3** (fleet chain; see circle-ir-ai
+  4.16.3). Go/C# batch: cognium-dev#472 stops Go taint leaking to a same-named local in another
+  function (**live in the 4.16.2 pin** — it shipped in 4.9.23 via the #459 `r.Body` source),
+  #343 Go `bufio` over the request body, #339 C# bare expression-statement sinks, #473 `initParser`
+  no longer caches a failed init forever. **Go finding counts move in both directions** — #472
+  re-attributes source lines, so a baseline keyed on `sink@source->sink` shows one removal plus one
+  addition per affected flow. Measured on the Go synthetic suite: score 64.2 % → **89.5 %**,
+  FPR 20.0 % → **0.0 %**; OWASP/Juliet/Bash/HTML stay at 100 %. Lockfile refreshed; single
+  circle-ir copy verified.
+
+## [4.16.2] - 2026-09-24
+
+### Changed
+- **circle-ir 4.9.23 → 4.9.25, circle-ir-ai ^4.16.1 → ^4.16.2** (fleet chain; see circle-ir-ai
+  4.16.2). Skips 4.9.24, which carries two upstream `analyzeProject` robustness fixes: a Python
+  starred parameter (`*args` / `**kwargs`) no longer fails the project analysis closed on an
+  uncompilable `\b<name>\b` regexp (cognium-dev#458), and a minified / bundled file no longer
+  wedges the scan (cognium-dev#460). No detection change on ordinary source; no tool behaviour
+  change here. Lockfile refreshed; single circle-ir copy verified.
+
+## [4.16.1] - 2026-09-23
+
+### Changed
+- circle-ir-ai ^4.15.1 → ^4.16.1 (fleet chain; see cognium-ai 4.16.1). circle-ir stays at 4.9.23.
+  Lockfile refreshed; single circle-ir copy verified.
+
+## [4.15.1] - 2026-09-22
+
+### Changed
+- circle-ir 4.9.22 → 4.9.23, circle-ir-ai ^4.15.0 → ^4.15.1 (fleet chain; see cognium-ai 4.15.1).
+  Lockfile refreshed; single circle-ir copy verified.
+
+## [4.15.0] - 2026-09-22
+
+### Changed
+- circle-ir 4.9.20 → 4.9.22, circle-ir-ai ^4.14.3 → ^4.15.0 (fleet chain; see cognium-ai 4.15.0).
+  Lockfile refreshed; single circle-ir copy verified.
+
+## [4.14.2] - 2026-09-19
+
+### Changed
+- Bump circle-ir 4.9.17 + circle-ir-ai ^4.14.2. Single circle-ir copy verified; typecheck clean.
+
+# Changelog
+
+## [4.14.1] - 2026-09-18
+
+### Changed
+- Bump circle-ir 4.9.14 → 4.9.16 and circle-ir-ai ^4.14.0 → ^4.14.1 (SAST-team precision/detection fixes). Single circle-ir copy verified; typecheck clean.
+
+
+## [4.14.0] - 2026-09-15
+
+### Changed
+
+- **circle-ir-ai ^4.13.0 → ^4.14.0.** Moves with the fleet; no behaviour change in this package. Carries the skills-detector + scanner precision fixes (cognium-ai#447/#449/#452/#461/#463).
+
+## [4.13.0] - 2026-09-14
+
+### Changed
+
+- **Fleet pin: circle-ir 4.9.13 → 4.9.14, circle-ir-ai ^4.12.0 → ^4.13.0.** No behaviour change; moves with the fleet so the pin-uniformity gate holds across all four packages in one commit.
+
+## [4.12.0] - 2026-09-11
+
+### Changed
+
+- **Fleet pin: `circle-ir` 4.9.10 → 4.9.13, `circle-ir-ai` ^4.11.0 → ^4.12.0.** No behaviour
+  change in this package; it moves with the fleet so the `circle-ir pin uniformity` gate holds
+  across all four packages in one commit. Verified: one copy of `circle-ir`, typecheck, build
+  and 11 tests clean.
+
+## [4.11.0] - 2026-09-08
+
+- Engine refresh: `circle-ir-ai` `^4.10.1` → `^4.11.0` (skills precision passes 2–3, Python manifests, SR-D scanners, JS sink shapes, model-aware LLM completion budget). No tool changes. `circle-ir` stays 4.9.10.
+
+All notable changes to `@cognium-ai/mcp-server` are documented here.
+This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
+and the [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) format.
+
+## [4.10.1] - 2026-09-02
+
+### Changed
+
+- Bump `circle-ir` 4.9.9 → 4.9.10 and `circle-ir-ai` ^4.10.0 → ^4.10.1 (lockstep
+  dep refresh; no MCP surface change). See circle-ir-ai 4.10.1 for the upstream
+  fix list (XXE reach map, Rust `format!` sink, C# #275 sinks).
+- `test/smoke-stdio.mjs` now expects `layer_bom` in `tools/list` (was missing
+  from the stdio smoke since the tool shipped). Verified: 11 tests + stdio smoke
+  pass, single `circle-ir` copy.
+
+## [4.10.0] - 2026-08-28
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.9.0 → ^4.10.0 (cognium-ai#337 durable degraded latch for
+  connection-class LLM outages). No MCP surface change; lockstep dep refresh.
+
+## [4.9.0] - 2026-08-28
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.13 -> ^4.9.0 (circle-ir stays 4.9.9). Picks up the
+  skillsregistry#85 verdict reproducibility guard — instruction-safety reads can no
+  longer flip a skill to VULNERABLE without deterministic corroboration, so the MCP
+  skill tools return reproducible verdicts. Kill switch:
+  `SKILL_INSTRUCTION_VERDICT_GUARD=0`.
+
+## [4.8.13] - 2026-08-28
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.12 -> ^4.8.13 (circle-ir stays 4.9.9). Clears the last two skillsregistry#82 residuals (bare API-key/env-var + bare CRUD reads no longer flip HIGH).
+
+## [4.8.12] - 2026-08-28
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.11 -> ^4.8.12 (circle-ir stays 4.9.9). Generalizes skillsregistry#81 (config_injection keys on payload not filename) + #82 (disclosed-capability keys on CWE class).
+
+## [4.8.11] - 2026-08-28
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.10 -> ^4.8.11 (circle-ir stays 4.9.9). Clears skillsregistry#82 (disclosed-capability exfil/escalation over-reads) + #81 reopened (config_injection on self-install scripts) — the scale FP contamination.
+
+## [4.8.10] - 2026-08-28
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.9 -> ^4.8.10 (circle-ir stays 4.9.9). Clears the last skillsregistry#80 flip (keumbang safety_subversion on a safe-by-default opt-in gate).
+
+## [4.8.9] - 2026-08-28
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.8 -> ^4.8.9 (circle-ir stays 4.9.9). Clears skillsregistry#80 (instruction-safety downweight now matches the quoted skill text) + #81 (config_injection ignores comments / in-repo manifests).
+
+## [4.8.8] - 2026-08-27
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.7 -> ^4.8.8 (circle-ir stays 4.9.9). Clears skillsregistry#67/#77 residual detector-logic FPs (description_injection tagline, safety_subversion default-off gate, api_base_url_hijack generic base-URL to a data API).
+
+## [4.8.7] - 2026-08-27
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.6 -> ^4.8.7 (circle-ir stays 4.9.9). Adds skillsregistry#72 batch 3 `schema_violation` detector (structural validation of a present mcp-config.json).
+
+## [4.8.6] - 2026-08-27
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.5 -> ^4.8.6 (circle-ir stays 4.9.9). SR-precision batch: #67 (defensive-advice over-read), #79 + #77 residuals, cognium-ai#261 deterministic severity (opt-in LLM_DETERMINISTIC_SEVERITY=1).
+
+## [4.8.5] - 2026-08-27
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.4 -> ^4.8.5 (circle-ir stays 4.9.9). Surfaces skillsregistry#79 the decisive capability_mismatch severity FLOOR (deterministic zero-medium+ for env/network/file undisclosed classes; the verifiable-histogram fix) + #72 batch-2 supply-chain bridge (opt-in).
+
+## [4.8.4] - 2026-08-27
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.3 -> ^4.8.4 (circle-ir stays 4.9.9). Surfaces skillsregistry#72 detector-coverage batch 1 — new `memory_file_poisoning` + `broken_reference` skill detectors.
+
+## [4.8.3] - 2026-08-27
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.2 -> ^4.8.3 (circle-ir stays 4.9.9). Surfaces skillsregistry#79 — capability_mismatch disclosed-purpose + vuln-reframe false-positive fix (the #1 false-flag driver, ~70-85% FP on the network/file/env "undisclosed capability" class).
+
+## [4.8.2] - 2026-08-26
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.1 -> ^4.8.2 (circle-ir stays 4.9.9). Surfaces the skillsregistry#77 SR-feedback follow-up (broadened test-path gate: scripts/e2e_*, bench/, bin/, vendored trees) and #75 (mcp-permissions undisclosed-network CRITICAL -> MEDIUM).
+
+## [4.8.1] - 2026-08-26
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.8.0 -> ^4.8.1 (circle-ir stays 4.9.9). Surfaces the complete skillsregistry#77 engine fix: test-path gate for behavioral/cred-exfil/base-URL detectors, capability-mismatch test-file exclusion (CWE-200/#75), and per-skill collapse of repeated patterns (the monorepo revocation amplifier).
+
+## [4.8.0] - 2026-08-26
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.7.0 → ^4.8.0 and `circle-ir` 4.9.8 → 4.9.9. Inherits
+  the circle-ir 4.9.9 large-file taint perf fix (#305), the #117 Specifica
+  sink-class allowlist, and skillsregistry#65 (CWE-494 non-public-host guard). No
+  MCP tool or API changes.
+
+## [4.7.0] - 2026-08-25
+
+### Changed
+
+- Bump `circle-ir-ai` ^4.6.1 → ^4.7.0 and `circle-ir` 4.9.7 → 4.9.8. Inherits the
+  engine's #336 graph-path gate (library/tool HIGH/CRIT `graph_path_exists=false`
+  → medium) and the circle-ir 4.9.8 dependency/security refresh. No MCP tool or
+  API changes.
+
+## [4.6.1] - 2026-08-24
+
+### Changed — bump circle-ir-ai ^4.6.1 (#304 + #335 verify over-chunking fix)
+
+No mcp-server source changes; single circle-ir copy verified, typecheck clean.
+
+## [4.6.0] - 2026-08-23
+
+### Added — `layer_bom` tool + engine bump to `circle-ir-ai@^4.6.0`
+
+New `layer_bom` MCP tool exposes the Conformis 9-layer BOM inventory (the engine
+primitive, per conformis-execution-plan.md §7). Pulls the 4.6.0 engine (#334 verify
+fix + BOM op). Single circle-ir copy; typecheck clean, 11 tests.
+
+## [4.5.0] - 2026-08-22
+
+### Changed — bump circle-ir-ai ^4.5.0 + circle-ir 4.9.7
+
+Pulls the 4.5.0 engine (circle-ir 4.8.2 → 4.9.7 — OWASP 100.0%; #332 verify
+over-chunking fix, #244 prompt prefix-caching, #245 dispatch scaling). No
+mcp-server source changes; single circle-ir copy verified, typecheck clean,
+11 tests pass.
+
+## [4.4.0] - 2026-08-21
+
+### Changed — bump circle-ir-ai ^4.4.0 + circle-ir 4.8.2
+
+Pulls the 4.4.0 engine (circle-ir 4.7.2 → 4.8.2 — OWASP 100.0%, #121 non-JSON fail-fast,
+#315 parse guard). No mcp-server source changes; single circle-ir copy verified,
+typecheck clean, 11 tests pass.
+
+## [4.3.2] - 2026-08-21
+
+### Changed — bump circle-ir-ai ^4.3.2 + circle-ir 4.7.2
+
+Pulls the 4.3.2 engine (circle-ir 4.7.2, #329 P1 verifier-perf, #71/#70 skill
+precision, #323 returnPerFileIR). No mcp-server source changes; single circle-ir copy
+verified.
+
+## [4.3.1] - 2026-08-19
+
+### Changed — bump circle-ir-ai ^4.3.1
+
+Pulls the 4.3.1 engine (trust scoring-map fixes #327, 429-storm degradation #314, and
+the #120/#198 LLM-trust-pass work). No mcp-server source changes; `circle-ir` stays
+pinned at `4.7.1`.
+
+## [4.3.0] - 2026-08-19
+
+### Changed — bump circle-ir-ai ^4.3.0 (LLM-verifier precision cluster #265 + #266 + #267)
+Picks up the `--llm-verify` precision cluster (#265 closed-enum source type; #267 honest `graph_path_exists`; #266 de-biased verifier prompt, validated gemma3:12b 100% → 9% manufactured-pair TP). All recall-safe. No local source change. Single circle-ir copy; typecheck clean; 11 tests pass.
+
+## [4.2.0] - 2026-08-17
+
+### Changed — bump circle-ir-ai ^4.2.0 (skill-verdict precision #308 + #309)
+Picks up the engine's skill-verdict precision fixes (#308 MEDIUM `capability_mismatch` no longer flips VULNERABLE; #309 zero-coverage → UNKNOWN / trust 0). No local source change. Single circle-ir copy; typecheck clean; 11 tests pass.
+
+## [4.1.0] - 2026-08-16
+
+### Changed — bump circle-ir-ai ^4.1.0 (#68 shared skill-scan precision layer)
+ Picks up the #68 shared skill-scan precision layer. No local source change. Single circle-ir copy; typecheck clean.
+
+## [4.0.7] - 2026-08-16
+
+### Changed — bump circle-ir 4.7.0 → 4.7.1 + circle-ir-ai ^4.0.7
+
+Engine pin bump to latest 4.x. No source changes. Single circle-ir copy; typecheck
+clean, 11 tests pass.
+
+## [4.0.6] - 2026-08-14
+
+### Changed — bump circle-ir-ai ^4.0.6 (cognium-ai#58 pool-helper export)
+
+Picks up the exported parse-isolation pool helpers. No source changes. Single
+circle-ir copy; typecheck clean.
+
+## [4.0.5] - 2026-08-13
+
+### Changed — bump circle-ir-ai ^4.0.5 (skillsregistry FP precision: sr#65 + sr#56)
+
+Picks up the sprint-C batch-2 skill-scan FP fixes. No mcp-server source changes.
+Single circle-ir copy; typecheck clean, 11 tests pass.
+
+## [4.0.4] - 2026-08-13
+
+### Changed — bump circle-ir 4.6.0 → 4.7.0 + circle-ir-ai ^4.0.4
+
+Engine pin bump to latest 4.x. No source changes. Single circle-ir copy verified;
+typecheck clean, 11 tests pass.
+
+## [4.0.3] - 2026-08-12
+
+### Changed — bump circle-ir 4.5.0 → 4.6.0 + circle-ir-ai ^4.0.3
+
+Engine pin bump to latest 4.x. No source changes. Single circle-ir copy verified;
+typecheck clean, 11 tests pass.
+
+## [4.0.2] - 2026-08-12
+
+### Changed — bump circle-ir 4.4.0 → 4.5.0 + circle-ir-ai ^4.0.2
+
+Engine pin bump to latest 4.x. No source changes. Single circle-ir copy verified;
+typecheck clean, 11 tests pass.
+
+## [4.0.1] - 2026-08-11
+
+### Changed — bump circle-ir 4.3.1 → 4.4.0 + circle-ir-ai ^4.0.1
+
+Engine pin bump to latest 4.x. No tool-surface changes. Single circle-ir copy; typecheck clean.
+
+## [4.0.0] - 2026-08-10
+
+### Changed — fleet version alignment to 4.x (cognium-ai#289)
+
+Realign 0.10.0 -> 4.0.0 to match the fleet major (circle-ir 4.x); bump circle-ir-ai ^3.0.0 -> ^4.0.0. No tool-surface changes. Single circle-ir copy; typecheck clean.
+
+## [0.10.0] - 2026-08-10
+
+### Changed — adopt circle-ir 4.3.1 + circle-ir-ai ^3.0.0 (cognium-ai#289)
+
+Bump `circle-ir` `3.216.0 → 4.3.1` (C#/.NET, 8th language) + `circle-ir-ai`
+`^2.104.0 → ^3.0.0`. No tool-surface changes. Single circle-ir copy verified;
+typecheck clean, 11 tests pass.
+
+## [0.9.17] - 2026-08-10
+
+### Changed — bump circle-ir 3.215.0 → 3.216.0 + circle-ir-ai ^2.103.0 → ^2.104.0
+
+Engine pin bump to stay current. No tool-surface changes. Single circle-ir copy
+verified.
+
+## [0.9.16] - 2026-08-10
+
+### Changed — bump circle-ir 3.214.0 → 3.215.0 + circle-ir-ai ^2.102.0 → ^2.103.0
+
+Engine pin bump (skillsregistry #49/#50/#51/#53 + cognium-ai#264). No
+tool-surface changes. Single circle-ir copy verified.
+
+## [0.9.15] - 2026-08-09
+
+### Changed — bump circle-ir-ai ^2.101.0 → ^2.102.0
+
+Engine sync: instruction-safety FP guards (sr#55/#56) + VEX real-CWE emission
+(cognium-ai#280). No tool-surface changes.
+
+## [0.9.14] - 2026-08-09
+
+### Changed — bump circle-ir-ai ^2.100.0 → ^2.101.0
+
+Engine sync: capability-mismatch + instruction-safety precision fixes
+(skillsregistry #4/#35/#18 — safe-mirror FPs cleared, undisclosed_capability TP
+preserved). Single-copy asserted; typecheck clean.
+
+## [0.9.13] - 2026-08-08
+
+### Changed — bump circle-ir-ai ^2.99.0 → ^2.100.0
+
+Engine sync: adds the `fetch_and_execute` + `persistence` skills code-threat
+detectors (skillsregistry #25 partial; #30 fetch_and_execute). Single-copy
+asserted; typecheck clean.
+
+## [0.9.12] - 2026-08-08
+
+### Changed — bump circle-ir-ai ^2.98.0 → ^2.99.0
+
+Engine sync: adds the marketplace/plugin listing scanner (detectMarketplaceThreats
+— namespace_squatting #41, listing_shadowing) per skillsregistry #41/#9.
+Single-copy asserted; typecheck clean.
+
+## [0.9.11] - 2026-08-08
+
+### Changed — bump circle-ir-ai ^2.97.0 → ^2.98.0
+
+Engine sync: adds the SR-D2 `trigger_hijack` + SR-E7 `shadow_features` skills
+detectors (#24/#19). Single-copy asserted; typecheck clean.
+
+## [0.9.10] - 2026-08-08
+
+### Changed — bump circle-ir-ai ^2.96.0 → ^2.97.0
+
+Engine sync to 2.97.0: cache-dir EACCES resilience + CIRCLE_IR_CACHE_DIR override
+(fixes api.cognium.net 0-findings) and the four critical SR-E skills detectors
+(#20/#30/#21/#40). Single-copy asserted; typecheck clean.
+
+## [0.9.9] - 2026-08-07
+
+### Changed — bump circle-ir 3.213.0 → 3.214.0 + circle-ir-ai ^2.95.0 → ^2.96.0
+
+Engine sync for single-copy resolution across the circle-pack build. 3.214.0 =
+cognium-ai#264 Defect A fix; circle-ir-ai 2.96.0 = #264 residual precision +
+sr#19 HIDDEN_URL fix. No mcp-server tool-surface change. Single-copy asserted.
+
+## [0.9.8] - 2026-08-07
+
+### Changed — bump circle-ir-ai ^2.93.0 → ^2.95.0
+
+Engine sync for single-copy resolution across the circle-pack build. 2.95.0
+lands the SR-A instruction-safety detectors + five more skills code-threat
+detectors. No mcp-server tool-surface change. Single-copy assertion post-publish.
+
+## [0.9.7] - 2026-08-06
+
+### Changed — circle-ir 3.209.0 → 3.213.0 + circle-ir-ai ^2.93.0
+
+Engine sync (per-context token meter + #123 dependency-hardening pass land via
+circle-ir-ai 2.92.0). Single-copy assertion post-publish.
+
+## [0.9.6] - 2026-08-04
+
+### Changed — bump circle-ir 3.206.0 → 3.209.0 + circle-ir-ai ^2.90.0
+
+Engine sync to the latest FP-fix line (cognium-dev#269): #268 (StringBuilder XSS
+over-broad sink), #253 (connection-string secrets). Single-copy assertion holds,
+typecheck clean.
+
+## [0.9.5] - 2026-08-04
+
+### Changed — bump circle-ir-ai ^2.88.0 → ^2.89.0 (verifier severity cap, #258)
+
+Engine sync. Picks up the verifier-severity-cap fix (#258): the verifier can no
+longer elevate a finding above the detector's baseline severity. Single-copy
+assertion holds, typecheck clean.
+
+## [0.9.4] - 2026-08-04
+
+### Changed — bump circle-ir 3.204.0 → 3.206.0 + circle-ir-ai ^2.85.0 → ^2.88.0
+
+Engine sync. Single-copy assertion holds (1 circle-ir copy), typecheck clean.
+Picks up circle-ir-ai #262 (fail-closed unverified findings) and #129 (go/js
+`log_injection` CWE-117 static parity via circle-ir 3.206.0).
+
+## [0.9.3] - 2026-08-03
+
+### Changed — bump circle-ir 3.200.0 → 3.204.0, circle-ir-ai ^2.83.0 → ^2.85.0
+
+Uniform fleet pin onto the negative-cache (#180) + cache-event telemetry (#182)
+release. No source change; typecheck + build clean, 11 tests pass, single
+`circle-ir` copy at 3.204.0.
+
+## [0.9.2] - 2026-08-03
+
+### Changed — bump circle-ir-ai ^2.82.1 → ^2.83.0
+
+Uniform fleet pin onto the skills code-threat detector release (cognium-ai#259).
+mcp-server does not consume the new skills passes; this keeps the pin uniform.
+No source change; typecheck + build clean, 11 tests pass, single `circle-ir`
+copy at 3.200.0.
+
+## [0.9.1] - 2026-08-02
+
+### Changed — bump circle-ir-ai ^2.81.0 → ^2.82.1, circle-ir 3.198.0 → 3.200.0
+
+Uniform fleet pin; single-copy dedupe verified (one `circle-ir` at 3.200.0,
+`circle-ir-ai` 2.82.1). Tracks the circle-ir-ai 2.82.1 parse-isolation worker
+fix (#252). No mcp-server source change; typecheck + build clean, 11 tests pass.
+
+> Note: changelog entries for 0.7.x–0.9.0 were not recorded (pre-existing
+> drift); those were uniform circle-ir/circle-ir-ai fleet-pin bumps.
+
+## [0.6.58] - 2026-07-28
+
+### Changed — bump circle-ir-ai ^2.59.1 → ^2.60.1
+
+Uniform fleet pin; single-copy dedupe. Tracks the Q5 conformance-attestation
+engine release (circle-ir-ai 2.60.1). No mcp-server source change.
+
+## [0.6.57] - 2026-07-28
+
+### Changed — bump circle-ir 3.192.0 → 3.193.0 + circle-ir-ai ^2.59.1
+
+Uniform fleet pin; single-copy dedupe. No source change.
+
+## [0.6.56] - 2026-07-26
+
+### Dependencies
+
+- Bump `circle-ir-ai` ^2.58.0 → **^2.59.0** (minified skip catches `-min.js`
+  dash variant; circle-ir-ai#243). circle-ir stays 3.192.0, single-copy dedupe.
+  No MCP tool/contract change.
+
+## [0.6.55] - 2026-07-25
+
+### Dependencies
+
+- Bump `circle-ir-ai` ^2.57.0 → **^2.58.0** (filename-based minified-artifact
+  skip; circle-ir-ai#243). circle-ir stays 3.192.0, single-copy dedupe. No MCP
+  tool/contract change.
+
+## [0.6.54] - 2026-07-24
+
+### Dependencies
+
+- Bump `circle-ir` 3.176.0 → **3.192.0** and `circle-ir-ai` ^2.56.1 → **^2.57.0**
+  (adaptive verify sizing + client-timeout AIMD; circle-ir-ai#244). Deduped to a
+  single circle-ir 3.192.0. No MCP tool/contract change — the 9 tools are
+  unchanged; this is an engine refresh that inherits the LLM-verify reliability
+  fixes for tools that run the verify path.
+
+## [0.6.53] - 2026-07-20
+
+### Dependencies
+
+- Bump `circle-ir` 3.175.0 → **3.176.0** and `circle-ir-ai` → **^2.56.1**
+  (routine engine refresh). Deduped to a single circle-ir 3.176.0. Build + 11
+  tests green. (Publishing this unblocks circle-pack's full dedupe onto 3.176.0.)
+
+## [0.6.52] - 2026-07-20
+
+### Dependencies
+
+- Bump `circle-ir` 3.174.0 → **3.175.0** and `circle-ir-ai` → **^2.56.0**
+  (app-code prompt-injection LLM01 recall, cognium-ai#211/#233). Uniform fleet
+  pin; deduped to a single circle-ir 3.175.0. Build + 11 tests green.
+
+## [0.6.51] - 2026-07-17
+
+### Dependencies
+
+- Bump `circle-ir` 3.173.0 → **3.174.0** (app-code prompt-injection taint sink,
+  cognium-ai#233) and `circle-ir-ai` → **^2.55.1** (trust-completeness legs
+  L1–L6, cognium-ai#234). Uniform fleet pin; deduped to a single circle-ir
+  3.174.0. Build + 11 tests green.
+
+## [0.6.50] - 2026-07-16
+
+### Dependencies
+
+- Bump circle-ir-ai ^2.47.1 → ^2.48.0 (uniform-pin alignment with the ecosystem; 2.48.0 is the scan clustering-gate release, cognium-ai#231 — no MCP-surface impact, the tool server doesn't use the scan path). Zero tool-surface change; 11 tests pass.
+
+## [0.6.49] - 2026-07-15
+
+### Dependencies
+
+- Bump circle-ir 3.168.0 → 3.173.0 and circle-ir-ai ^2.41.0 → ^2.47.1 (circle-ir perf sweep). Zero MCP tool-surface change; 11 tests pass.
+
+## [0.6.48] - 2026-07-11
+
+### Dependencies
+
+- Bump circle-ir 3.166.0 to 3.168.0 and circle-ir-ai ^2.40.1 to ^2.41.0 (completes the cognium-dev#250 source-misattribution fix). Zero MCP tool-surface change; 11 tests pass.
+
+## [0.6.47] - 2026-07-11
+
+### Dependencies
+
+- Bump `circle-ir` `3.165.0 → 3.166.0` and `circle-ir-ai`
+  `^2.40.0 → ^2.40.1`. Incremental core bump; zero MCP tool-surface
+  change. 11 tests pass.
+
+## [0.6.46] - 2026-07-10
+
+### Dependencies
+
+- Bump `circle-ir` `3.164.0 → 3.165.0` and `circle-ir-ai`
+  `^2.39.0 → ^2.40.0` (picks up the cognium-dev#250 source-misattribution
+  precision fix). Zero MCP tool-surface change; 11 tests pass.
+
+## [0.6.45] - 2026-07-10
+
+### Dependencies
+
+- Bump `circle-ir` `3.162.0 → 3.164.0` and `circle-ir-ai`
+  `^2.38.0 → ^2.39.0` (picks up the #119 trust-scoring fix + circle-ir
+  3.164.0). Zero MCP tool-surface change; 11 tests pass.
+
+## [0.6.44] - 2026-07-10
+
+### Dependencies
+
+- Bump `circle-ir` `3.160.0 → 3.162.0` and `circle-ir-ai`
+  `^2.37.16 → ^2.38.0` (picks up the #211 LLM04 tool-poisoning
+  detection + circle-ir 3.162.0). Zero MCP tool-surface change; 11
+  tests pass.
+
+## [0.6.43] - 2026-07-09
+
+### Dependencies
+
+- Bump `circle-ir` `3.159.0 → 3.160.0` and `circle-ir-ai`
+  `^2.37.15 → ^2.37.16`. Core engine pin bump; zero MCP tool-surface
+  change. 11 tests pass.
+
+## [0.6.42] - 2026-07-09
+
+### Dependencies
+
+- Bump `circle-ir` `3.158.0 → 3.159.0` and `circle-ir-ai`
+  `^2.37.13 → ^2.37.15`. Zero MCP tool-surface change; cascade with
+  the #212 deep-merge + #213 verified-path dedup engine fixes. 11
+  tests pass.
+
+## [0.6.41] - 2026-07-08
+
+### Dependencies
+
+- Bump `circle-ir` `3.156.0 → 3.158.0` and `circle-ir-ai`
+  `^2.37.11 → ^2.37.13`. Zero MCP tool-surface change; cascade with
+  the `circle-ir@3.158.0` upgrade across the four packages.
+
+## [0.6.40] - 2026-07-07
+
+### Re-forwarded
+
+- Repin `circle-ir` `3.155.0 → 3.156.0` and `circle-ir-ai` `^2.37.10 → ^2.37.11`.
+  Zero MCP tool-surface change. Undoes the 0.6.39 rollback after the
+  rollback-verification sweep proved the `cognium-ai#202` "regression" was
+  a false alarm caused by cache-warmth artifact in the golden baseline
+  (200+ zero-token `verifyTaintPathsBatch` cache-hit log entries were
+  compared against cold-cache real calls in the 3.156.0 sweep).
+- Cold-cache rollback sweep on 2.31.10 / 3.155.0 came in **higher**
+  (5,543 realCalls) than the "regression" it was meant to fix
+  (4,272 realCalls), confirming the engine's static pipeline is
+  invariant across `3.155.0 → 3.156.0`. See `circle-ir-ai@2.37.11`
+  CHANGELOG for the full diagnosis.
+
+### Tests
+
+- 1 file, 11 passed. Typecheck + build clean.
+
+## [0.6.39] - 2026-07-06
+
+### Rolled back
+
+- Repin `circle-ir` `3.156.0 → 3.155.0` and `circle-ir-ai` `^2.37.9 → ^2.37.10`.
+  Zero MCP tool-surface change. Tracks the engine rollback in
+  `circle-ir-ai@2.37.10` — see
+  [cognium-ai#202](https://github.com/cogniumhq/cognium-ai/issues/202)
+  (3.156.0 Tier-2 verifier-cost regression). Holding at `circle-ir@3.155.0`
+  until upstream fix. **Supersedes 0.6.38** — do not use.
+
+## [0.6.38] - 2026-07-06
+
+### Dependencies
+
+- Bump `circle-ir` `3.155.0 → 3.156.0` and `circle-ir-ai` `^2.37.8 → ^2.37.9`.
+  Zero MCP tool-surface change; cascade to keep engine + core pinned
+  uniformly across `cognium-ai` / `circle-ir-ai` / `@cognium-ai/mcp-server`
+  / `circle-pack`.
+
+**Superseded by 0.6.39** — the 3.156.0 engine caused a Tier-2 regression
+(cognium-ai#202); do not use 0.6.38 (also never published).
+
+## [0.6.37] - 2026-07-06
+
+### Dependencies
+
+- Bump `circle-ir` `3.154.0 → 3.155.0` and `circle-ir-ai` `^2.37.7 → ^2.37.8`.
+  Zero MCP tool-surface change; cascade to keep engine + core pinned
+  uniformly across `cognium-ai` / `circle-ir-ai` / `@cognium-ai/mcp-server`
+  / `circle-pack`. Supersedes the unpublished 0.6.36 which pinned 3.154.0.
+
+## [0.6.36] - 2026-07-06
+
+### Dependencies
+
+- Bump `circle-ir` `3.153.0 → 3.154.0` and `circle-ir-ai` `^2.37.6 → ^2.37.7`.
+  Zero MCP tool-surface change; cascade to keep engine + core pinned
+  uniformly across `cognium-ai` / `circle-ir-ai` / `@cognium-ai/mcp-server`
+  / `circle-pack`.
+
+## [0.6.35] - 2026-07-06
+
+### Dependencies
+
+- Bump `circle-ir` `3.152.0 → 3.153.0` and `circle-ir-ai` `^2.37.5 → ^2.37.6`.
+  Zero MCP tool-surface change; pure cascade to keep engine + core pinned
+  uniformly across `cognium-ai` / `circle-ir-ai` / `@cognium-ai/mcp-server`
+  / `circle-pack`.
+
+## [0.6.32] - 2026-07-05
+
+### Dependencies
+
+- Bump `circle-ir` `3.150.0 → 3.152.0` and `circle-ir-ai` `^2.37.0 → ^2.37.3`.
+  Picks up **cognium-ai#189** — two `library/*` project-profile gates
+  targeting Tier 2 FP-drop (~45% combined on library/production repos):
+  - **Source-side gate** (circle-ir 3.151.0): drops `interprocedural_param`
+    / `constructor_field` seeds under `library/*`, removing Scenario-B
+    `external_taint_escape` (CWE-668) synthesis (~35% FP-drop).
+  - **Sink-side gate** (circle-ir 3.152.0, pass
+    `library-profile-sink-gate` #112): drops entire `log_injection`
+    (CWE-117) sink class from the taint graph before flow generation
+    when `Meta.projectProfile` begins with `library/` (~10% FP-drop).
+- Zero MCP tool-surface change. `find_pattern` and other tools that
+  route through the discovery engine inherit the library-profile
+  filtering automatically once callers pass a `projectProfile` on the
+  underlying `analyze()` invocation (auto-populated onto `Meta` per the
+  3.150.1 contract).
+
+## [0.6.31] - 2026-07-03
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.36.0 → ^2.37.0` (cognium-ai#191 — surface
+  silent LLM-error swallow). MCP tool surface unaffected. The engine
+  now:
+  - Distinguishes "LLM said no vulnerability" from "LLM call failed"
+    via a new optional `llmError?: { kind, message }` field on
+    `DiscoveryResult` (additive schema change).
+  - Increments a process-wide `llmErrorCounter` on every
+    discovery-stage LLM failure, with a first-error stderr warning.
+  - Categorizes failures as `empty_response | parse_error | timeout |
+    http_error | rate_limited | connection_error |
+    transient_server_error | unknown`.
+
+  MCP callers that consume `DiscoveryResult` values via
+  `find_pattern` / spec-related tools may now see the `llmError`
+  field populated when the LLM backend is misconfigured or degraded.
+  Absent field = engine reports no LLM transport failure (existing
+  behavior).
+
+- No MCP schema changes, no tool-surface changes, no auth changes.
+
+**Rollback:** downgrade to `@cognium-ai/mcp-server@0.6.30` +
+`circle-ir-ai@2.36.0`.
+
+## [0.6.30] - 2026-07-03
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.35.0 → ^2.36.0` (cognium-ai#189 — cache
+  Round 3, model-in-path). MCP tool surface unaffected — the change
+  is cache-layer only:
+  - R2/local-fs layout for `verify` / `discovery` / `classifier`
+    caches gains a `<model-slug>/` path segment.
+  - `SCHEMA_VER 'cic:v2' → 'cic:v3'` invalidates warm cache entries
+    on first tool invocation post-upgrade.
+- Bump `circle-ir` unchanged at `3.150.0`.
+
+### Operator impact for the mcp-server
+
+- MCP tools that indirectly exercise LLM caches (via
+  `SecurityScanner.scan()` → `analyzeFile()` → `discovery-cache` /
+  `verify-cache`) will cold-populate on first call after upgrade.
+- Long-running MCP clients caching prior tool responses at their own
+  layer see no protocol change; only the on-disk / R2 cache shape
+  moves. Steady-state hit rate returns after re-population.
+
+## [0.6.29] - 2026-07-03
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.34.0 → ^2.35.0`. Picks up Sprint P2 Batch 4's
+  wide precision pass, all reaching the MCP tool surface via
+  `SecurityScanner.scan()` / `analyzeFile()`:
+  - **cognium-ai#173** — build / CI script path suppression gate
+    (`isBuildOrCiScriptPath()` predicate; suppresses sinks under
+    `docs?/`, `scripts?/`, `tools/`, `examples/`, `samples/`,
+    `demos/`, `benchmarks?/` + build-file shapes like `conf.py`,
+    `noxfile.py`, `conftest.py`).
+  - **cognium-ai#127 + wide** — TIER_1_BY_SUPERTYPE extension covering
+    Netty (`ChannelInboundHandler` family), Vert.x (`Handler` with
+    param-type disambiguation), gRPC (`ServerCallHandler`,
+    `ServerCall.Listener`, `BindableService`), Spring WebFlux
+    (`HandlerFunction`, `WebFilter`), JAX-WS (`Provider`). Additive:
+    previously-uncaught endpoint sinks on these frameworks now flip
+    into TP.
+  - **cognium-ai#169** — verifier prompt directive hardening for
+    gemma3:12b. `BATCH_VERIFICATION_PROMPT` tier block rewritten from
+    advisory to directive language + Batch 4 supertype list + pinned
+    short-reasoning template. 5-test regression fixture in engine.
+
+  No MCP tool surface change. See `circle-ir-ai/CHANGELOG.md#2.35.0`
+  for the full rationale, regex specs, evidence, and test coverage
+  (14 sink-filter + 16 entry-point + 5 verifier regression tests,
+  1324 pass + 3 skipped total).
+
+Unit-test surface unchanged. Typecheck: clean.
+
+## [0.6.28] - 2026-07-03
+
+### Dependencies
+
+- Bump `circle-ir` `3.148.0 → 3.150.0` and `circle-ir-ai` `^2.33.5 →
+  ^2.34.0`. Picks up two precision wins in `circle-ir-ai@2.34.0` that
+  reach the MCP tool surface via `SecurityScanner.scan()` /
+  `analyzeFile()`:
+  - **cognium-ai#167** — XPath / XXE / crypto library-internal FP
+    gates (JsonPath / Jaxen / Saxon / DOM4j XPath, jsoup / HtmlCleaner,
+    JJWT / Nimbus JOSE / BouncyCastle / Tink + JCA SPI subclass check).
+    Projected ~23 CRIT FP drop on the 2026-06-24 top-100 Java baseline.
+  - **cognium-ai#168** — LLM-path `explanation` field preservation.
+    The 2026-07-01 top-10 sweep shipped 495/496 CRIT+HIGH LLM findings
+    with `explanation: ""`; workflow + scanner fallback chain now
+    surface `verification.reasoning` so the MCP finding payload
+    populates the narrative field ≥99% of the time.
+
+  No MCP tool surface change. See `circle-ir-ai/CHANGELOG.md#2.34.0`
+  for the full rationale, predicate regexes, evidence, and test
+  coverage (28 gate tests + 5 field-preservation tests, 1289 pass +
+  3 skipped total).
+
+Unit-test surface unchanged. Typecheck: clean.
+
+## [0.6.27] - 2026-07-02
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.33.4 → ^2.33.5`. Picks up the XSS FP suppression
+  on servlet writer sinks preceded by `response.setContentType("application/
+  json…")` in the same enclosing method (cognium-ai#172). No MCP tool surface
+  change — the filter runs inside the engine's `SecurityScanner.scan()` /
+  `analyzeFile()` pipelines that the `find_pattern` and
+  `find_credential_exposure` tools already delegate to. See
+  `circle-ir-ai/CHANGELOG.md#2.33.5` for the full rationale.
+
+Unit-test surface unchanged (11 pass). Typecheck: clean.
+
+## [0.6.26] - 2026-07-02
+
+### Dependencies
+
+- Bump `circle-ir` `3.146.0 → 3.148.0`. Minor upstream release in the
+  CWE-078 restore train (cognium-ai#184); dep-refresh only.
+- Bump `circle-ir-ai` `^2.28.4 → ^2.33.4`. Corrects the stale minor-line
+  pin to match the current engine major; picks up:
+  - **`2.33.3`** (cognium-ai#127) — threads static per-source
+    trust-boundary classification + entry-point tier into the LLM
+    verifier user prompt, adds the `## REACHABILITY CONTEXT` rubric so
+    the model can weight each tag. No MCP tool surface change.
+  - **`2.33.4`** — follow-on `circle-ir 3.146.0 → 3.148.0` bump.
+
+All 11 tests pass, typecheck clean.
+
+## [0.6.23] - 2026-07-01
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.28.3` → `^2.28.4`. Picks up
+  cognium-ai#163 landing-plan step 2 (B3 + B4 + B5):
+  - **B3** — R2 cache-backend errors now categorized into 7 buckets
+    and emitted as synthetic JSONL rows (dedup + first-time stderr
+    surfacing).
+  - **B4** — pinned SHA-256 snapshots of all LLM prompt templates.
+  - **B5** — engine-side CI job asserts uniform `circle-ir` pin
+    across all 4 workspace packages.
+
+  No MCP tool surface change. All 11 tests pass, typecheck clean.
+
+## [0.6.22] - 2026-07-01
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.28.1` → `^2.28.3`. Picks up
+  cognium-ai#163 landing-plan step 1 (B1 + B2):
+  discovery per-CWE cache key now covers `annotations` +
+  top-20 sorted `imports` (sentinel `disc-v1 → disc-v2`);
+  `existingSources` / `existingSinks` canonicalized before
+  hashing in the mastra workflow. No MCP tool surface change.
+- Bump `circle-ir` `3.135.0` → `3.139.0`.
+
+All 11 tests pass, typecheck clean.
+
+## [0.6.21] - 2026-06-30
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.26.0` → `^2.28.1`. Picks up Phase 2 of
+  cognium-ai#158 (Round 2 cache key + path layout reshape,
+  D1/D2/D3/D4/D6 — including the tree-cache absolute-path leak fix
+  that lets two CI runners share verifier cache entries via R2).
+  No MCP tool surface change.
+- Bump `circle-ir` `3.129.0` → `3.135.0`.
+
+All 11 tests pass, typecheck clean.
+
+## [0.6.20] - 2026-06-30
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.22.0` → `^2.26.0`. Cascades the full epic
+  #155 stack (P1–P4) — four engine releases land in this single MCP
+  bump:
+  - **2.23.0 (cognium-ai#152, P1):** persistent verify cache
+    (`.cognium/cache/verify/`, 24h TTL, model-fingerprinted). Env:
+    `LLM_VERIFY_CACHE=0`.
+  - **2.24.0 (cognium-ai#134, P2):** persistent discovery cache
+    (`.cognium/cache/discovery/`, 24h TTL, model-fingerprinted).
+    Env: `LLM_DISCOVERY_CACHE=0`.
+  - **2.25.0 (cognium-ai#153, P3):** persistent tree cache
+    (`.cognium/cache/tree/`, 7-day TTL, keyed on engine versions
+    not model). Env: `LLM_TREE_CACHE=0`.
+  - **2.26.0 (cognium-ai#154, P4 foundation):** new `src/cluster/`
+    module (`clusterFiles`, `extractClusterVector`, `ClusterPolicy`).
+    Foundation only — no consumption inside mcp-server yet.
+
+  Routine pass-through for the MCP server itself: all 9 tools
+  retain their existing surface. Warm-scan behavior tools see the
+  same speedup as `cognium-ai scan` since the underlying engine
+  cache stack is shared. Tests + typecheck remain clean (11 pass).
+
+## [0.6.19] - 2026-06-30
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.21.0` → `^2.22.0`. Picks up the cache-key
+  model-dimension wire-through (cognium-ai#151 P0 spike, acceptance
+  criteria 4 + 6). Routine pass-through; no MCP surface change.
+  Tests + typecheck remain clean (11 pass).
+
+## [0.6.18] - 2026-06-30
+
+### Dependencies
+
+- Bump `circle-ir` `3.126.0` → `3.129.0` and `circle-ir-ai`
+  `^2.20.10` → `^2.21.0`. Routine engine refresh pass-through; picks
+  up circle-ir-ai 2.21.0's 23-callsite `withLLMContext` wrap (closes
+  cognium-ai#149 per-signature granularity gap in JSONL logs). Tests
+  + typecheck remain clean (11 pass).
+
+## [0.6.17] - 2026-06-29
+
+### Dependencies
+
+- Bump `circle-ir` `3.123.0` → `3.126.0` and `circle-ir-ai`
+  `^2.20.8` → `^2.20.10`. Routine engine refresh pass-through; picks up
+  circle-ir-ai 2.20.9's #151 two-model split env vars
+  (`LLM_DISCOVERY_MODEL` / `LLM_VERIFICATION_MODEL` /
+  `LLM_COMPONENT_MODEL`) and 2.20.10's circle-ir 3.126.0 refresh.
+  Tests + typecheck remain clean.
+
+## [0.6.16] - 2026-06-29
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.20.6` → `^2.20.8`. Picks up:
+  - **circle-ir-ai 2.20.7 LLM cost-reduction batch** — `#144`
+    `LLM_MAX_PAIRS_PER_CHUNK` env knob, `#145` enrichment static
+    pre-filter (`fileNeedsEnrichment(code)`), `#138 step 3`
+    verifier submission-side dedup at `verifyTaintPathsBatch`.
+    No MCP-surface impact; downstream LLM calls from any tool that
+    triggers enrichment / verification benefit from the same call
+    reduction.
+  - **circle-ir-ai 2.20.8** — bump `circle-ir` `3.121.0` → `3.123.0`
+    (routine engine refresh).
+- Bump direct `circle-ir` pin `3.121.0` → `3.123.0` to match.
+- Cross-checks: 11/11 tests pass, typecheck clean.
+
+## [0.6.15] - 2026-06-29
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.20.4` → `^2.20.6`. Picks up the
+  **cognium-ai#148 retry-attribution fix** — `kind:"call"` JSONL log
+  row now reports the actual `attemptIdx` from `_chatJSONImpl`'s
+  inline retry loop instead of always 0. Per-attempt rows were
+  correct; only the per-call summary lied. Fixed via a
+  `lastAttemptCount` side-channel field populated in a try/finally
+  around the queue-task body so every return path captures the
+  final counter. No MCP-surface impact; downstream `analyze-llm-log`
+  consumers now see honest retry rates.
+
+## [0.6.14] - 2026-06-29
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.20.2` → `^2.20.4`. Picks up the
+  cognium-ai#146 scan-output regression fix (verified-LLM emit path
+  now populates `type: sink.type`, preserves the full `verification`
+  object instead of a hardcoded `llm_verified: true` stub, and the
+  sanity gate is relaxed from `length >= 20` to `length > 0` so
+  terse-explainer models aren't force-demoted) plus the `circle-ir`
+  `3.107.0` → `3.121.0` bump (adds Vue SFC support upstream).
+- Bump `circle-ir` pin `3.107.0` → `3.121.0` (lockstep with engine).
+- No MCP tool-surface changes. Typecheck clean, 11 tests pass.
+
+## [0.6.13] - 2026-06-28
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.20.1` → `^2.20.2`. Engine now captures the
+  OpenAI-compatible `usage.{prompt_tokens, completion_tokens}` block
+  from LLM responses and surfaces it on the JSONL call log via new
+  optional `inputTokens` / `outputTokens` fields on each
+  `LLMCallEntry` (cognium-ai#125 Phase 1). No MCP tool surface
+  changes; all 9 tools unaffected. The token fields appear in the
+  file at `$LLM_LOG_JSONL` when the MCP server is invoked with that
+  env var set (existing log readers ignore unknown fields).
+
+## [0.6.12] - 2026-06-28
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.20.0` → `^2.20.1`. Engine fixes the
+  recursive verifier fan-out (cognium-ai#143). No MCP tool surface
+  changes; all 9 tools (`verify_spec_conformance`, `find_spec_drift`,
+  `find_pattern`, `find_credential_exposure`,
+  `check_license_compliance`, `find_stale_dependencies`,
+  `find_install_script_risk`, `find_typosquats`,
+  `find_excessive_permissions`) unaffected.
+
+## [0.6.11] - 2026-06-28
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.19.4` → `^2.20.0`. Engine drops the orphan
+  role-classification LLM call from mastra `runEnrich` (cognium-ai#139):
+  `cognium-ai scan` enrichment now fires 2 LLM calls per file instead
+  of 3. No MCP tool surface changes — the mastra path is not exposed
+  through MCP tools (MCP exposes `find_pattern`, `verify_spec_*`,
+  `find_credential_exposure`, etc., which go through different code
+  paths). The reduction surfaces transparently for any MCP caller
+  that downstream-invokes `scan`.
+
+## [0.6.10] - 2026-06-28
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.19.3` → `^2.19.4`. Upstream 2.19.4 ships
+  cognium-ai#138 steps 1 + 2: opt-in chunk-split telemetry
+  (`LLM_LOG_VERIFY_SPLITS=1`) + `context.file` on verifier JSONL
+  rows. No MCP tool surface changes; both additions are
+  diagnostic / attribution foundations transparent to MCP callers.
+
+## [0.6.9] - 2026-06-28
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.19.2` → `^2.19.3`. Upstream 2.19.3 is a
+  pure bugfix release (submission-side dedup at the
+  `discoverVulnerabilities` boundary, fixing cognium-ai#136 — see
+  `circle-ir-ai/CHANGELOG.md#2193`). No MCP tool surface changes;
+  the dedup is transparent to MCP callers.
+
+## [0.6.8] - 2026-06-26
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.19.1` → `^2.19.2`. Upstream 2.19.2 is a
+  benchmarks-only release (published `dist/` byte-identical to 2.19.1
+  — chunking refactor lives only in `benchmarks/runners/`). Bumping
+  to stay in lockstep on the release timeline; no MCP tool surface
+  changes.
+
+## [0.6.7] - 2026-06-25
+
+### Dependencies
+
+- Bump `circle-ir` `3.106.0` → `3.107.0`.
+- Bump `circle-ir-ai` `^2.18.3` → `^2.19.1`.
+
+Pure cascade. No MCP tool surface changes; the 9 stdio tools
+(`verify_spec_conformance`, `find_spec_drift`, `find_pattern`,
+`find_credential_exposure`, `check_license_compliance`,
+`find_stale_dependencies`, `find_install_script_risk`,
+`find_typosquats`, `find_excessive_permissions`) are unchanged.
+
+### What this pulls in (via the engine cascade)
+
+`circle-ir@3.107.0` (sink-filter-layer FP fixes):
+
+- JS `setInterval` / `setTimeout` no longer flagged as
+  `code_injection` when the first arg is a function reference
+  (cognium-dev#152).
+- Java `xxe` no longer over-matches on CommonMark `Parser.parse()`
+  (cognium-dev#181).
+- Java `sql_injection` regex-allowlist-quoter wrappers no longer
+  trigger taint sinks (cognium-dev#191 / FP-77).
+
+`circle-ir-ai@2.19.1` is a pure cascade of the same three engine fixes
+on top of the 2.19.0 ADR-008 projectProfile wiring (cognium-ai#130).
+
+### Verification
+
+- `npm run typecheck` — clean.
+- `npm test` — 11/11 pass.
+- `npm run build` — clean.
+- `npm run smoke` — stdio handshake + 9 tools list.
+
+## [0.6.6] - 2026-06-24
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.18.2` → `^2.18.3`.
+- circle-ir pin remains at `3.106.0` (matched 0.6.5 already; this
+  release picks up the engine cascade through circle-ir-ai).
+
+Pure cascade. No MCP tool surface changes; the 9 stdio tools
+(`verify_spec_conformance`, `find_spec_drift`, `find_pattern`,
+`find_credential_exposure`, `check_license_compliance`,
+`find_stale_dependencies`, `find_install_script_risk`,
+`find_typosquats`, `find_excessive_permissions`) are unchanged.
+
+### What this pulls in (via the engine cascade)
+
+`circle-ir-ai@2.18.3` ships Sprints 47 + 48 from cognium-dev:
+
+- **Sprint 47** (3.105.0) — central library-API-surface downgrade
+  (cognium-dev #161, #163, #164, #165, #168, #177). Sinks owned by
+  library-API-surface methods (default-config, factory, accessor
+  patterns) are downgraded from `high` to `info` and tagged
+  `library-api-surface:caller-responsibility`; pre-downgrade severity
+  preserved on `SastFinding.original_severity`.
+- **Sprint 48** (3.106.0) — ADR-008 project-profile architecture
+  (cognium-dev#169). `AnalyzerOptions.projectProfile` accepts a
+  `{ shape, env }` declaration and drives the engine's 5×5 matrix
+  severity transform. **Not yet wired** through any MCP tool surface;
+  programmatic API callers wanting to opt in must invoke the engine
+  directly.
+
+### Verification
+
+- `npm run typecheck` — clean.
+- `npm test` — **11 / 11 pass**.
+- `npm ls circle-ir circle-ir-ai` — resolves to `3.106.0` and
+  `2.18.3` respectively (flat tree, deduped).
+
+## [0.6.5] - 2026-06-24
+
+### Dependencies
+
+- Bump `circle-ir` `3.95.0` → `3.104.0`.
+- Bump `circle-ir-ai` `^2.18.1` → `^2.18.2`.
+
+### What this pulls in (via the engine cascade)
+
+`circle-ir@3.96.0–3.104.0` (Sprints 41–46, cognium-dev monorepo) —
+pass / filter layer FP suppressions across Java SAST rules:
+
+- **3.96.0 / 3.97.0 / 3.98.0** — Jinja2 / Python f-string
+  `sql_injection` FP cluster (cognium-dev#159 / #160 / #163).
+- **3.99.0 / 3.100.0** — Tier-1 cluster releases (6 Java FPs across
+  command_injection / xxe / weak-crypto).
+- **3.101.0** — picocli `CommandLine` constructor, DocumentBuilder
+  factory, InputSource path-only XXE (cognium-dev#167 / #173 / #170).
+- **3.102.0** — argv-form `ProcessBuilder`, JDK 8u121+ XXE hardening
+  recognition (cognium-dev#179 Sink 1 / #166).
+- **3.103.0** — `throw new SQLException(...)` sink-line gate +
+  `resource-leak` factory-method heuristic (cognium-dev#157 / #158).
+- **3.104.0** — PEM delimiter body-adjacency, CLI option-key
+  kebab-case negative predicate, protocol-mandated DES / RC4 / MD4 /
+  MD5 file-context allow-list (cognium-dev#176 / #174 / #175).
+
+`circle-ir-ai@2.18.2` adds `ScanOptions.enableLLMVerify?: boolean`
+(default `true` when `enableLLM` is set) — cognium-ai#124, P1 of the
+2026-06-24 baseline operating principles. MCP tools don't surface
+this knob; `verify_spec_conformance` and friends remain unchanged.
+No new MCP tool surface or JSON-RPC schema changes.
+
+### Verification
+
+- `npm run typecheck` — clean.
+- `npm test` — **11 / 11 pass**.
+- `npm ls circle-ir circle-ir-ai` — resolves to `3.104.0` and
+  `2.18.2` respectively (flat tree).
+
+## [0.6.4] - 2026-06-23
+
+### Dependencies
+
+- Bump `circle-ir` `3.90.0` → `3.95.0`.
+- Bump `circle-ir-ai` `^2.18.0` → `^2.18.1`.
+
+### What this pulls in (via the engine cascade)
+
+`circle-ir@3.91.0–3.95.0` adds:
+
+- `#136` Tier 1 stereotype-bean classification (3.91.0).
+- `#142` defensive per-file finding cap (3.92.0).
+- `#154` Netty entry-point classifier (3.93.0).
+- `#153` pre-req — speculative-finding suppression infrastructure
+  with `SastFinding.confidence` tri-state (3.94.0).
+- `#137` `AnalyzerOptions.enableEntryPointGate` opt-out toggle
+  (3.95.0) — Java-only; default `true` matches existing behaviour.
+
+`circle-ir-ai@2.18.1` is the engine-bump-only release that adopts
+the above. No new MCP tool surface or JSON-RPC schema changes.
+
+### Verification
+
+- `npm run typecheck` — clean.
+- `npm test` — **11 / 11 pass**.
+- `npm ls circle-ir circle-ir-ai` — resolves to `3.95.0` and
+  `2.18.1` respectively (flat tree).
+
+## [0.6.3] - 2026-06-22
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.17.0` → `^2.18.0`.
+- `circle-ir` pinned at `3.90.0` (unchanged from 0.6.2).
+
+### What this pulls in (via the engine bump)
+
+`circle-ir-ai@2.18.0` adds `CIRCLE_IR_INSTRUMENT_FINDINGS=1` env-var
+wiring (cognium-dev#145 PR C). Setting the env var when invoking any
+MCP tool that calls into circle-ir's `analyze()` —
+`find_credential_exposure`, `verify_spec_conformance`, `find_pattern`
+— emits one `[finding]` JSON line per `SastFinding` plus one
+`[findings-summary]` line per file on stderr. The JSONL stream
+carries `dedup_group_id` for cognium-dev#143 coalesce-candidate
+measurement and is fully no-op when the env var is unset.
+
+Tool inputs / JSON-RPC schemas unchanged. The env var is the entire
+control surface — clients control it by setting it in the MCP server's
+environment (or via the launch wrapper script).
+
+### Verification
+
+- `npm install --prefer-online` — clean resolution; `npm ls
+  circle-ir-ai` shows `2.18.0`; `npm ls circle-ir` shows `3.90.0`.
+- `npm run typecheck` — clean.
+- `npm test` — **11 / 11 pass**.
+
+Tool surface unchanged — same 9 tools, same JSON-RPC schemas.
+
+## [0.6.2] - 2026-06-22
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.16.0` → `^2.17.0`.
+- Bump `circle-ir` `3.89.1` → `3.90.0` (pinned; flattens transitive
+  drift with `circle-ir-ai@2.17.0`).
+
+### What this pulls in (via the engine bump)
+
+`circle-ir@3.90.0` adds the **findings-emission instrumentation hook**
+(cognium-dev#145 PR B). `circle-ir-ai@2.17.0` re-exports it but does
+not wire it through the mastra `runPatternMatch` path yet (gated on
+PR C). The 9 MCP tools exposed here (`verify_spec_conformance`,
+`find_spec_drift`, `find_pattern`, `find_credential_exposure`,
+`check_license_compliance`, `find_stale_dependencies`,
+`find_install_script_risk`, `find_typosquats`,
+`find_excessive_permissions`) produce identical output to 0.6.1 in
+this release.
+
+### Verification
+
+- `npm install --prefer-online` — clean resolution; `npm ls
+  circle-ir-ai` shows `2.17.0`; `npm ls circle-ir` shows `3.90.0`.
+- `npm run build` — clean.
+- `npm run typecheck` — clean.
+- `npm test` — **11 / 11 pass**.
+
+Tool surface unchanged — same 9 tools, same JSON-RPC schemas.
+
+## [0.6.1] - 2026-06-22
+
+### Dependencies
+
+- Bump `circle-ir-ai` `^2.15.0` → `^2.16.0`.
+- `circle-ir` pinned at `3.89.1` (unchanged).
+
+### What this pulls in (via the engine bump)
+
+1. **Bound `scanGitHistory()` (ai#112)** — the `find_credential_exposure`
+   MCP tool, when run against a repo with `scanHistory: true`, now
+   honors the engine's three new bounds:
+   `SecretScanOptions.historyScanTotalBudgetMs` (60_000ms default),
+   `perCommitTimeoutMs` (5_000ms), `maxDiffBytes` (5 * 1024 * 1024).
+   Tool inputs unchanged; bounds applied via engine defaults until a
+   client opts in via a future input-schema extension. Partial results
+   on bound trip carry the new `historyScanTimedOut` /
+   `commitsSkippedLarge` / `commitsTimedOut` diagnostic fields when
+   present in the engine result payload.
+2. **`ProjectOptions.crossFileBudgetMs`** is plumbed through the
+   `circle-ir-ai` `analyzeProject` consumer surface; no MCP tool
+   currently calls into that path, so no tool input change today.
+
+### Verification
+
+- `npm install --prefer-online` — clean resolution; `npm ls
+  circle-ir-ai` shows `2.16.0`.
+- `npm run build` — clean.
+- `npm run typecheck` — clean.
+- `npm test` — **11 / 11 pass**.
+
+Tool surface unchanged — same 9 tools, same JSON-RPC schemas, same
+defaults for callers that don't set the new engine fields.
+
+## [0.6.0] - 2026-06-22
+
+### Dependencies
+
+- Bump `circle-ir` `3.88.1` → `3.89.1`.
+- Bump `circle-ir-ai` `2.14.1` → `2.15.0`.
+
+### What this pulls in (via the engine bump)
+
+1. **Cross-file pre-index perf (cognium-dev#141 mitigation)** —
+   scan-class MCP tools (`find_pattern`, `verify_spec_conformance`,
+   etc.) no longer hang on Java codebases of the sa-token-core shape
+   (35+ CPU-min → 27ms wall).
+2. **Cross-file budget breaker** — engine accepts
+   `crossFileBudgetMs` (default `300_000`); partial results returned
+   with `cross_file_budget_exceeded` flag when budget hit.
+3. **`Finding.source.type`/`sink.type`** — present in scan-class
+   tool outputs (already true since 0.5.1 via the engine path).
+4. **Logger routing** — `info` → stderr by default; MCP stdio
+   transport (the actual JSON-RPC payload on stdout) unaffected.
+
+Tool surface unchanged — same 9 tools, same JSON-RPC schemas.
+
+### Verification
+
+- `npm install --prefer-online` — clean resolution.
+- `npm run build` — clean.
+- `npm test` — **11 / 11 pass** (smoke + stdio transport).
+
+### Why minor (`0.5.1 → 0.6.0`)
+
+Inherits the engine minor (additive `crossFileBudgetMs` option +
+`cross_file_budget_exceeded` flag). Bumping minor here to mirror
+the engine's observable-surface delta even though MCP doesn't yet
+plumb the option through tool inputs.
+
+## [0.5.1] - 2026-06-22
+
+### Dependencies
+
+- Bump `circle-ir` `3.86.0` → `3.88.1`.
+- Bump `circle-ir-ai` `2.14.0` → `2.14.1`.
+
+Picks up the cross-file taint type-axis dedup fix (cognium-dev#144,
+circle-ir 3.88.1): scan-class MCP tools now surface both findings
+when a direct flow and an interprocedural path land at the same
+`(file, line)` coordinates but carry different sink types. Also
+absorbs the required `Finding.line` field added in circle-ir 3.87.0
+(cognium-dev#134) via `circle-ir-ai@2.14.1`.
+
+Tool surface unchanged — same 9 tools, same JSON-RPC schemas.
+
+Verification:
+- `npm install --prefer-online` — clean resolution.
+- `npm run build` — clean.
+- `npm test` — **11 / 11 pass** (smoke + stdio transport).
+
+## [0.5.0] - 2026-06-21
+
+### Added — picks up cognium-dev#128 entry-point gate (via `circle-ir-ai@2.14.0`)
+
+MCP tools that invoke the mastra workflow (security scan paths) now
+benefit from the cognium-dev#128 Tier-3 gate: speculative
+`interprocedural_param` taint sources on Java library-API methods are
+dropped before LLM verification.
+
+Tool surface unchanged — same 9 tools, same JSON-RPC schemas. The
+behavior change is internal to `scan`-class invocations.
+
+### Dependencies
+
+- Bump `circle-ir-ai` `2.13.4` → `2.14.0`.
+- `circle-ir` pin unchanged at `3.86.0`.
+
+Verification:
+- `npm run typecheck` clean
+- `npm test` — **11 / 11 pass** (smoke covers stdio transport + tool list)
+- `npm ls circle-ir-ai` — `2.14.0` (clean dep graph)
+
+Minor bump (0.4.22 → 0.5.0) reflects the observable scan output
+change inherited from `circle-ir-ai@2.14.0`.
+
+References: see `circle-ir-ai/CHANGELOG.md` 2.14.0 for the full gate
+spec.
+
+## [0.4.22] - 2026-06-21
+
+### Dependencies
+
+- Bump `circle-ir` `3.85.1` → `3.86.0`.
+- Bump `circle-ir-ai` `2.13.3` → `2.13.4`.
+- **Drop the `overrides` block** — `circle-ir-ai@2.13.4` pins
+  `circle-ir@3.86.0` directly, so the normal dep graph resolves
+  uniformly without the override. Mirrors the same cleanup that landed
+  in `cognium-ai@2.15.1`.
+
+No MCP-surface changes; routine dependency catch-up.
+
+Verification:
+- `npm run typecheck` clean
+- `npm test` — 11/11 pass
+
+## [0.4.21] - 2026-06-21
+
+### Dependencies
+
+- Bump `circle-ir` `3.82.0` → `3.85.1` (3-version catch-up).
+- Bump `circle-ir-ai` `2.12.5` → `2.13.3` (3-version catch-up).
+
+Picks up the **cogniumhq/cognium-dev#126** hotfix from circle-ir@3.85.1
+— bounds the Gate 3 string-array constant-table span walker in the
+4-gate hardcoded-credential-entropy detector so it no longer scans
+unbounded literal tables. Eliminates the 2.7×–14.5× scan regression
+that landed in 3.85.0 (timed out gson / Hystrix / openapi-generator /
+hutool on the top-25 Java OSS harness).
+
+Also picks up intermediate circle-ir improvements 3.82.0 → 3.85.1
+(inter-procedural taint walker enhancements, cognium-dev#19 / #28 /
+#17 fixes) and circle-ir-ai 2.12.5 → 2.13.3 (engine sync).
+
+No MCP-surface changes; routine catch-up release.
+
+## [0.4.20] - 2026-06-19
+
+### Dependencies
+
+- Bump `circle-ir-ai` `2.12.4` → `2.12.5`.
+
+Picks up the cognium-ai#109 fix — assertion utilities (Spring/hutool
+`Assert.*`, Guava `Preconditions`/`Verify.*`, `Objects.requireNonNull*`,
+Apache Commons `Validate.*`) are now suppressed by
+`isSuppressedSinkShape()` across all 12 taint-flow CWEs before the LLM
+verifier sees them. No MCP-surface changes; routine engine-sync release.
+
+## [0.4.19] - 2026-06-19
+
+### Dependencies
+
+- Bump `circle-ir` `3.74.0` → `3.75.0`.
+- Bump `circle-ir-ai` `2.12.0` → `2.12.4`.
+
+Routine upstream sync. 11 tests pass + typecheck clean.
+
+## [0.4.18] - 2026-06-19
+
+### Added — REFACTOR-019: expose LLM verify controls on find_credential_exposure
+
+The `find_credential_exposure` MCP tool now accepts two new optional
+inputs that flow through to the engine's `scanForSecrets`:
+
+- `llm_verify: boolean` (default: `false`) — enable LLM verification
+  to reduce false positives. Requires `LLM_API_KEY` on auth-required
+  endpoints; the engine silently falls back to static-only on missing
+  config (ES-004).
+- `verify_budget: number` (default: `100`, min: `0`) — cap on LLM
+  verifier calls per scan. `0` disables verify entirely even when
+  `llm_verify: true` — matches cognium-ai 2.14.x semantics.
+
+Defaulting `llm_verify` to `false` on the MCP surface is intentional:
+clients invoking tools via MCP may not have `LLM_API_KEY` available,
+so an opt-in surface is friendlier than a silent ON. (cognium-ai's
+CLI defaults `llmVerify` to ON because users opt into the CLI; MCP
+clients haven't.)
+
+Closes loose-end REFACTOR-019 from the hardcoded-secrets implementation
+plan (`.specifica/hardcoded-secrets/tasks.md`).
+
+### Dependencies
+
+- **circle-ir-ai** `2.11.5` → `2.12.0` — picks up the 4-tier verify
+  + `DEFAULT_VERIFY_BUDGET` API surface that this change exposes.
+
+Tests: 1 file / 11 pass (unchanged). Typecheck clean.
+
+## [0.4.17] - 2026-06-18
+
+### Dependencies
+
+- **circle-ir** `3.71.0` → `3.74.0` (skips 3.72.0 / 3.72.1 / 3.73.0).
+- **circle-ir-ai** `2.11.4` → `2.11.5` — engine-consumer cascade for
+  the circle-ir 3.74.0 bump. No MCP-tool surface change.
+
+Tests: 1 file / 11 pass (unchanged). Typecheck clean.
+
+## [0.4.16] - 2026-06-18
+
+### Dependencies
+
+- **circle-ir-ai** `2.11.3` → `2.11.4` — engine-consumer cascade
+  for cognium-dev#21 boundary-audit cleanup. `dead-code` resolver
+  now consumes `CallInfo.receiver_type` / `receiver_type_fqn`
+  (circle-ir 3.43.0, cognium-dev#25); LLM-path sink-shape filter
+  retained with surviving-rationale block. No MCP-tool surface
+  change.
+
+Tests: 1 file / 11 pass (unchanged).
+
+## [0.4.15] - 2026-06-18
+
+### Dependencies
+
+- **circle-ir** `3.69.0` → `3.71.0` — Sprint 20/21 engine bump:
+  - 3.70.0 adds the `cache-no-vary` pass (CWE-524, severity
+    medium) for shared-cache leaks where an authenticated
+    response is marked `Cache-Control: public` without `Vary`.
+    Strict 3-signal auth-qualifier mode covers
+    Express/Fastify/Koa, Flask/FastAPI/Django,
+    `net/http`/gin, Spring/Servlet. Will surface through
+    `find_pattern` when an MCP client searches for the new
+    `cache-no-vary` rule.
+  - 3.71.0 closes two real-world OOP safe-mirror sanitizer FPs
+    (cognium-dev#105): FP-31 allowlist-guarded getter
+    (`if x not in UPPER_SNAKE_CONST: raise`), FP-32 MongoDB
+    value-bound filter dict
+    (`{field: {"$lte": value}}` operator-injection now only
+    fires when the operator key itself is user-controlled).
+    Quieter `find_pattern` results for `nosql_injection` on
+    Mongo aggregation pipelines.
+- **circle-ir-ai** `2.11.2` → `2.11.3` — corresponding bump,
+  no API surface change.
+
+### Tooling
+
+No tool-handler changes. All 9 tools (`verify_spec_conformance`,
+`find_spec_drift`, `find_pattern`,
+`find_credential_exposure`, `check_license_compliance`,
+`find_stale_dependencies`, `find_install_script_risk`,
+`find_typosquats`, `find_excessive_permissions`) continue to
+operate over the existing stdio + HTTP transports.
+
+## [0.4.14] - 2026-06-18
+
+### Dependencies
+
+- **circle-ir** `3.66.0` → `3.69.0` — Sprint 17/18/19 engine bump:
+  - 3.67.0 closes the Java safe-corpus FP long-tail (`SafeService`
+    `path_traversal`+`xxe`, `FalsePositiveCorpus` cmdi switch→constant)
+    that surfaced cognium-dev#103's closure review.
+  - 3.68.0 adds Python `urllib.request.urlretrieve` sinks (ssrf +
+    path_traversal) and locks the Python FP corpus.
+  - 3.69.0 ships new `module-side-effect` pass (CWE-829) for
+    supply-chain droppers across JS/TS/Python/Go/Rust.
+- **circle-ir-ai** `2.11.1` → `2.11.2` — corresponding engine
+  re-export bump; no API surface change for `@cognium-ai/mcp-server`.
+
+No tool-handler code changes; 1 file / 11 tests pass; typecheck clean.
+
+## [0.4.13] - 2026-06-18
+
+### Dependencies
+
+- **circle-ir** `3.59.0` → `3.66.0` — promotes `tsx` to a first-class
+  `SupportedLanguage` enum member (was previously a sub-bucket of
+  `typescript`). Engine consumers (`circle-ir-ai`) handle the new
+  variant; no direct surface change here. **Note:** `detectLanguage`
+  still returns `undefined` for `.tsx`/`.jsx` extensions — the
+  type infra is in place but extension wiring is incomplete
+  (tracked at cognium-dev#88).
+- **circle-ir-ai** `2.11.0` → `2.11.1` — picks up the engine bump and
+  the 4 `Record<SupportedLanguage, …>` map updates required by the
+  `tsx` enum addition.
+
+No surface-level changes to the 9 MCP tools; existing
+`verify_spec_conformance`, `find_spec_drift`, `find_pattern`,
+`find_credential_exposure`, `check_license_compliance`,
+`find_stale_dependencies`, `find_install_script_risk`,
+`find_typosquats`, `find_excessive_permissions` continue to behave
+identically. Smoke (`npm run smoke`) and the 11-test vitest suite
+pass against the new engine.
+
+## [0.4.12] - 2026-06-17
+
+### Fixed
+
+- **`bin/cognium-mcp` no-op under npm symlinks** — the ESM `isMain`
+  guard added in 0.4.x (`import.meta.url === \`file://${process.argv[1]}\``)
+  silently exited 0 without attaching stdio when the binary was spawned
+  via `node_modules/.bin/cognium-mcp`, because npm bin entries are
+  symlinks: Node sets `import.meta.url` to the realpath of the executed
+  module but leaves `process.argv[1]` as the symlink path, so the
+  string compare never matches and `main()` never runs. MCP clients
+  (e.g. cognium-code) saw `engine closed stdout before request id 1
+  was answered`. Fixed by resolving `process.argv[1]` through
+  `realpathSync` and comparing via `pathToFileURL(...).href` before
+  the equality check. Library imports (`import { buildServer } from
+  '@cognium-ai/mcp-server'`) remain unaffected — they still see
+  `isMain === false` and skip the stdio bootstrap.
+
+No dependency changes.
+
+## [0.4.11] - 2026-06-17
+
+### Dependencies
+
+- **`circle-ir`** `3.57.0` → `3.59.0` **(exact pin)** — drop-in
+  engine bump.
+- **`circle-ir-ai`** `2.10.1` → `2.11.0` **(exact pin)** — adopts
+  circle-ir's `generateFindings()` in the mastra `runReport`
+  no-verification branch (#26): canSourceReachSink + DFG/proximity
+  gates now apply to the LLM-enrichment path; new additive
+  `vulnerabilities[].discoveryMethod` field (`'static' | 'llm' |
+  'mixed'`); evidence-aware severity (proximity-only flows
+  emit `'high'` instead of the old hardcoded `'critical'`).
+
+No code changes in this package. 11 tests pass.
+
+## [0.4.10] - 2026-06-16
+
+### Dependencies
+
+- **`circle-ir`** `3.56.0` → `3.57.0` **(exact pin)** — Sprint 8
+  upstream release (cognium-dev #50, #51, #62, #73, #84, #90, #91):
+  Java for-each element-taint propagation, Map.put + StringBuilder
+  taint propagation, Go `filepath.Base`/`Clean`/`EvalSymlinks` +
+  `path.Clean` path-traversal sanitizers, `SecurityHeadersPass`
+  global-middleware suppression (helmet / Talisman /
+  SecurityFilterChain), Bash function-local `$1`/`$2` no longer
+  conflated with script-CLI positionals (regex-allowlist guard
+  deferred to Sprint 9).
+- **`circle-ir-ai`** `2.10.0` → `2.10.1` **(exact pin)** — engine
+  re-export bump for the above.
+
+No surface changes to the 9 MCP tools (`verify_spec_conformance`,
+`find_spec_drift`, `find_pattern`, `find_credential_exposure`,
+`check_license_compliance`, `find_stale_dependencies`,
+`find_install_script_risk`, `find_typosquats`,
+`find_excessive_permissions`). Existing stdio + HTTP transports
+unchanged.
+
+## [0.4.9] - 2026-06-16
+
+### Dependencies
+
+- **`circle-ir`** `3.52.0` → `3.56.0` **(exact pin)** — four upstream
+  feature releases:
+  - **3.53.0** (cognium-dev#52 + #87) — Text4Shell, FreeMarker SSTI,
+    Zip-Slip source reclassify, Java weak-crypto config (IV / key /
+    RSA), taint matcher receiver-type fix.
+  - **3.54.0** (Sprint 5) — `jwt-verify-disabled` (CWE-347),
+    `redos` sink (CWE-1333), `format_string` sink (CWE-134).
+  - **3.55.0** (Sprint 6) — `crlf` sink (CWE-113), `mass_assignment`
+    sink (CWE-915), `csrf-protection-disabled` (CWE-352),
+    `xml-entity-expansion` (CWE-776), `mass-assignment` pattern.
+  - **3.56.0** (Sprint 7) — Python + Go `weak-crypto` parity
+    (ECB, hardcoded keys, weak RSA).
+- **`circle-ir-ai`** `2.9.0` → `2.10.0` **(exact pin)** — pure engine
+  re-export; no LLM-layer changes.
+
+MCP tool surface unchanged. Tool consumers may see additional
+`finding.type` values (`crlf`, `mass_assignment`, `redos`,
+`format_string`) in `find_pattern` results. Patch bump.
+
+## [0.4.8] - 2026-06-16
+
+### Dependencies
+
+- **`circle-ir-ai`** `2.8.24` → `2.9.0` **(exact pin)** — picks up two
+  LLM-verification improvements:
+  - **cognium-ai#86** — windowed source/sink batch-verification.
+    Extracts merged ±N line windows around each center (preserving
+    original 1-based line numbers) instead of single-cut truncation.
+    Two new env vars: `LLM_VERIFY_WINDOW_LINES` (default `80`),
+    `LLM_VERIFY_MAX_CHUNKS` (default `4`).
+  - **cognium-ai#102** — skip LLM verification on minified content.
+    Conservative triple-condition heuristic (>50 KB AND max line
+    >5,000 c AND avg line >500 c) short-circuits the verifier before
+    any LLM call on minified / bundled single-line JS, where windowed
+    chunking degenerates. Static-analysis findings unaffected.
+
+MCP tool surface unchanged. Patch bump.
+
+## [0.4.7] - 2026-06-16
+
+### Dependencies
+
+- **`circle-ir`** `3.50.0` → `3.52.0` **(exact pin)** — two upstream
+  feature releases:
+  - **3.51.0** (cognium-dev#88.1 + circle-ir#88.3): `.jsx` / `.cjs`
+    routed to the JS plugin (no longer silently skipped). Go
+    `text/template` modeled as `xss` / CWE-79 / high sink — Template.
+    Execute and Template.ExecuteTemplate do NOT HTML-escape (only
+    `html/template` does).
+  - **3.52.0** (cognium-dev#60): **four new analysis passes** for
+    config / absence patterns that were previously misregistered as
+    taint sinks and never fired:
+    - `weak-hash` (CWE-328) — MD2/MD4/MD5/SHA-1 across Java/Python/JS/Go.
+    - `weak-crypto` (CWE-327) — DES/3DES/RC2/RC4/Blowfish/IDEA/SEED/
+      CAST5 + ECB (incl. Java AES default = ECB).
+    - `weak-random` (CWE-330) — non-CSPRNG (`Math.random`, `random.*`,
+      `new Random()`, `math/rand`, import-aware).
+    - `tls-verify-disabled` (CWE-295, new) — Go `InsecureSkipVerify`,
+      Python `requests/httpx(verify=False)` +
+      `ssl._create_unverified_context`, JS `rejectUnauthorized:false` +
+      `NODE_TLS_REJECT_UNAUTHORIZED='0'`, Java NoopHostnameVerifier.
+  - `insecure-cookie` extended to Python (Flask/Django/Starlette
+    `response.set_cookie` without `secure=True`/`httponly=True`) and
+    Java (`new javax.servlet.http.Cookie(...)` files missing
+    `.setSecure(true)` + `.setHttpOnly(true)`).
+- **`circle-ir-ai`** `2.8.23` → `2.8.24` **(exact pin)** — surfaces the
+  3.52.0 passes through the engine layer.
+
+No mcp-server source change — dep-only bump.
+
+## [0.4.6] - 2026-06-16
+
+### Dependencies
+
+- **`circle-ir`** `3.49.0` → `3.50.0` **(exact pin)** — inline-source
+  taint fix (circle-ir#83, subsumes #76). Bare-arg call/concat shapes
+  where a tainted source appears inline as an argument now propagate
+  to the sink without an intermediate variable:
+  - Java: `Runtime.getRuntime().exec("echo " + req.getParameter("u"))`
+  - JS/TS: `eval(req.query.x)`, `vm.runInThisContext(req.cookies.c)`,
+    `child_process.exec(req.body.cmd)`
+  - Python: `os.system("echo " + request.args.get("u"))` and for-loop
+    iterables `for x in request.form.getlist("y"): ...`
+  - Four upstream sub-fixes: inline-source colocation pass,
+    Python for-loop iterable derivation w/ virtual http_param anchor,
+    loosened empty-source early-returns, `canSourceReachSink` matrix
+    expansion for JS RCE shapes (code_injection accepts http_param/
+    query/header/cookie sources).
+- **`circle-ir-ai`** `2.8.22` → `2.8.23` **(exact pin)** — engine bump
+  to pick up circle-ir@3.50.0.
+
+No tool surface change. `find_pattern` and the 8 other MCP tools
+benefit transparently via the upgraded SAST base.
+
+## [0.4.5] - 2026-06-16
+
+### Dependencies
+
+- **`circle-ir`** `3.48.0` → `3.49.0` **(exact pin)** — surfaces new
+  upstream SAST coverage to MCP consumers:
+  - `insecure-cookie` pass for JS/TS (CWE-614, circle-ir#43)
+  - `log_injection` sinks for Java + JS/TS (CWE-117, circle-ir#44)
+  - `nosql_injection` mongoose Model/Query coverage (CWE-943, #45)
+  - Classless `open_redirect` for Express `res.redirect()` (CWE-601, #46)
+  - Python `path_traversal` sanitizers: `os.path.realpath`,
+    `os.path.abspath` (#48 pt 2)
+  - Rust actix-web / axum typed extractor taint flows (#71)
+- **`circle-ir-ai`** `2.8.20` → `2.8.22` **(exact pin)** — engine bump
+  that includes 2.8.21 (capability_mismatch severity inversion fix
+  for over-declared skill capabilities, cognium-ai#100 Bug #2; bundled
+  `MAX_CODE_CONTEXT_LENGTH` raised 8000 → 32000 to stop dropping
+  ~85% of real vulnerability-bearing files; `LLM_MAX_CONCURRENT`
+  raised 5 → 10) plus 2.8.22 (the circle-ir dep bump). No MCP tool
+  API surface change in this release.
+
+## [0.4.4] - 2026-06-13
+
+### Dependencies
+
+- **`circle-ir`** `3.39.0` → `3.48.0` **(exact pin)** — 9-minor bump
+  rolling up taint-engine and pass improvements. No API surface change
+  in the MCP tool layer; engine is consumed transitively via
+  `circle-ir-ai`.
+- **`circle-ir-ai`** `2.8.14` → `2.8.20` **(exact pin)** — engine bump
+  that bundles the cognium-ai#88 parse-failure visibility work
+  (structured `parseFailure` records, always-on `[SKIP]` /
+  `[PARSER_FAIL]` / `[LLM_FAIL]` stderr markers, additive
+  `parseFailures[]` + `filesParseFailed` / `filesSkipped` counters on
+  `ScanResult`, `withTimeout` wrap on the Mastra LLM path) and 5
+  intermediate releases (`2.8.15`–`2.8.19` — ax-client robustness,
+  FP-epic shape filters, deep LLM debug mode). MCP tools that surface
+  scan output now pick up structured parse-failure detail through the
+  same JSON spread.
+
+Build clean, typecheck clean, 11 tests pass.
+
+## [0.4.3] - 2026-06-12
+
+### Dependencies
+
+- **`circle-ir`** `3.38.0` → `3.39.0` **(exact pin)** — cross-instance
+  field-binding taint propagation (`FieldTaintInfo` summaries for
+  `@DataBoundConstructor` / `@Autowired` / `@Inject` annotated fields)
+  and caller-body sink emission for cases where the final sink lives in
+  the caller's own method body rather than a cross-file callee. Test
+  suite expanded 1935 → 1939 (4 new Jenkins/Spring DI fixtures).
+- **`circle-ir-ai`** `2.8.13` → `2.8.14` **(exact pin)** — engine bump
+  that consumes the new `circle-ir@3.39.0`; no API surface changes,
+  drop-in upgrade for the 9 MCP tools.
+
+## [0.4.2] - 2026-06-12
+
+### Added
+
+- Export `buildServer` from the package entry so HTTP transport hosts
+  (e.g. circle-pack `/api/mcp`) can build and connect to a configured
+  `McpServer` without spawning a subprocess.
+- `import.meta.url === file://${process.argv[1]}` guard around the
+  stdio bootstrap so library imports do not silently start a stdio
+  server on the host process's stdin/stdout.
+
+## [0.4.1] - 2026-06-11
+
+- Pinned `circle-ir@3.38.0` + `circle-ir-ai@2.8.13` (exact).