@withpica/mcp-server 2.65.0 → 2.67.0

package/CHANGELOG.md

@@ -11,6 +11,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.67.0] - 2026-06-01
+
+Enrichment field-level source ranking surfaces on the resolve tools. Requires `@withpica/mcp-sdk` ^1.36.0.
+
+### Added
+
+- **`force` on `pica_resolve_work` + `pica_resolve_recording`** — force a re-enrich past the per-source idempotence stamps. Safe by construction: the field-level authority gate never clobbers a human-entered, higher-authority, or pre-provenance (unprovenanced) value, so a forced re-run only fills gaps and upgrades lower-ranked automated values.
+- **Overwrite receipts on both resolve tools** — the structured result now carries `overwrote[]` (a higher-authority source replaced a lower-ranked value, with old/new source) and `skipped_lower_authority[]` (a source was refused because the existing value out-ranked it, equalled it, or was a human/verified/unprovenanced value). The summary line reports the overwrote/kept counts.
+
+### Changed
+
+- **Resolve tool descriptions** now explain the authority gate (higher-authority sources win, human-entered and pre-provenance values are locked) and the two receipt arrays.
+
+## [2.66.0] - 2026-06-01
+
+ADR-250 human-in-the-loop approval goes live, plus the close-out batch carried by this release.
+
+### Added
+
+- **`pica_approval_status`** — read-only poll for an out-of-band human approval. When a delegated-agent destructive write is deferred, the dispatcher returns a `human_approval_required` envelope carrying an `approval_reference`; pass that as `approval_id` to check whether the grant owner has decided (`pending` / `approved` / `denied` / `expired` / `executed` / `failed`) and when/how. Ownership is enforced server-side — a foreign approval comes back as `not_found`, never a leak. ADR-250 PR-c.
+
+### Changed
+
+- **ADR-250 human-in-the-loop approval gate is active.** `pica_people_bulk_delete` now carries `approvalMode: "human"`: a delegated-agent caller proposes the deletion, the grant owner approves out-of-band, and PICA replays the frozen params server-side. Session and first-party-key callers fall through to the existing `dry_run`/destructive path unchanged. The tool stays connector-reachable rather than blanket-excluded.
+
 ## [2.65.0] - 2026-05-30
 
 ### Added