# Changelog

## Unreleased

- Bound JSON nesting before parsing and return a JSON-RPC parse error instead
  of dropping the request connection.
- Bound request-body reads and return HTTP 408 for incomplete slow requests.
- Enforce the advertised object-item schema for result evidence and review
  findings.
- Correct the documented post-`CHANGES_REQUESTED` remediation path.

All notable changes to this project are documented here.

## 0.1.0 — 2026-07-30

Initial review candidate:

- generic project, actor-role, work-package, result, review, decision,
  escalation, gate, baseline, and event models;
- append-only SQLite event log with cursor synchronization;
- concurrency-safe and idempotent mutation handling;
- stateless MCP Streamable HTTP tool interface;
- transport authentication abstraction and BASDM separation controls;
- tests, container example, contract, threat model, production profile, and
  WP-PA-001 review evidence.