[BaaRai]

What

Release preparation for 0.6.0: the CHANGELOG section only. One file changes, CHANGELOG.md. Same shape as the 0.5.0 and 0.5.1 release commits.

The v0.6.0 tag is NOT created. It waits for the owner's go. Do not tag from this PR alone.

Version files changed

None besides CHANGELOG.md, because the repository has no version string to bump. The version comes from the git tag at build time:

• cmd/artex/main.go:27: var version = "dev", overwritten through -ldflags "-X main.version=...".
• build.sh:93-101: ARTEX_BUILD_VERSION defaults to git describe --tags --always --dirty, and the leading v is removed. build.sh:224 passes it to -X main.version.
• .github/workflows/release.yml:4 runs on v* tags. release.yml:55 sets ARTEX_BUILD_VERSION: ${{ github.ref_name }}.
• Dockerfile:34 ARG ARTEX_VERSION=dev and docker-compose.yml:24 ARTEX_VERSION: ${ARTEX_VERSION:-dev}: these are build-time overrides and default to dev.
• server/server.go:38: BuildVersion = "dev", which cmd/artex/main.go:61 sets from main.version at startup.

Left alone because they are not the app version: web/package.json:3 (2.2.0, never changed at a release), extension/manifest.json:4 (1.0.0), and the MCP clientInfo version mcphttp/client.go:266 ("0.2").

What is in 0.6.0

Changes since v0.5.1, grouped by theme:

• Verified findings (S1): POE level and verification status (feat: verified findings backend (S1) #162), UI badge and filter (feat: verification badge, filter and note in the findings UI #163), retest linkage (feat: a completed retest updates the verification state #164), and gzip/deflate decoding of evidence bodies (fix(verification): decode gzip/deflate bodies before the S1 quote check #169).
• Intercept decision tracing: decided_by on approvals (feat: record which actor decided an intercept approval #165). Judge decisions are no longer stored as unknown (fix(intercept): judge decisions were stored as unknown (prefix case mismatch) #159).
• Notifications (notify: make IM summary/asset truncation configurable (120 runes / 3 assets are hard-coded) #168 closed): the hidden count in the overflow suffix (notify: report hidden asset count in overflow suffix #170, db: report hidden asset count in malformed-ip warning suffix #171), configurable limits (notify: make the summary and asset limits configurable #172) and their UI (web: add the notification render limits to the notify settings page #173), and Feishu digest packing (notify: pack Feishu digests against the serialized request body #174).
• Agentic prompt hardening (Adversarial audit: map the 2026 agentic attack classes (memory poisoning, plan hijacking, tool abuse) onto ARTEX itself #124 phase B): untrusted-content tails for the planner, the compactor and all chat agents, the planner goal anchor, and bbot skill rules (agent: code-owned prompt-injection tails and planner goal anchor (#124, part 1) #189).
• Agentic guards (Adversarial audit: map the 2026 agentic attack classes (memory poisoning, plan hijacking, tool abuse) onto ARTEX itself #124 phase B): goal_met refuses while goals are open, prove_goal requires an observed fact, hints record their origin, and built-in rules apply to the planner and the main agent (Agentic guards: goal_met/prove_goal, hint origin, built-in rules for planner Bash (#124 F5, F6, F11) #190).
• Target gate, S3b phase 1 and 2.1, OFF by default and API-only: hooks and scope (feat(guard): planner and main-agent hooks, target-gate scope in every session (S3b 1.1) #177), schema, flag and requests (feat(intercept): target-gate schema, opt-in flag and approval requests (S3b 1.2-1.4) #178), extraction, resolver and exemptions (feat(intercept): target extraction, resolver, exemptions and the gate in the hook (S3b 1.5-1.7) #179), rendered custom-tool targets (feat(intercept): gate the rendered targets of custom tools (S3b 1.8) #180), inheritance (feat(intercept): spawned tasks and triggered conversations inherit the target gate #182), the declared form checked first (fix(intercept): match block rules on the declared targets before any lookup #183), redirect hops (feat(intercept): check every redirect hop against the target gate (S3b 1.9) #185), and the pinned dialer (feat(intercept): pinned dialer for WebFetch and the custom http tool (S3b 2.1) #186). Decision D2 (gate on by default) is NOT in 0.6.0.
• Other: custom LLM User-Agent (feat(llm): optional custom User-Agent for LLM requests #155), the untrusted-output boundary toggle (feat: enable the untrusted-output boundary with ARTEX_UNTRUSTED_BOUNDARY #166), and the intent claim lease and fencing (feat(engine): intent claim heartbeat, TTL and fencing token (S3c) #176).
• Fixed: the custom-tool proxy scheme (Fix doubled scheme in the custom http tool's recording proxy URL #187), the list_task_credentials schema (fix(tools): list_task_credentials emits invalid "required": [""] and breaks workers on strict LLM providers #130), and MCP protocol version negotiation (fix(mcp): negotiate protocol version with fallback #132).
• Build, Docker and tests: Docker tool verification (chore(docker): verify tool downloads and pin build inputs #188), secrets kept out of the build context (chore: keep secrets out of the Docker build context; drop stale README step #153), server tests skip without a DSN (server: skip Postgres-backed tests when no database is configured #175), and Norma v0.4.4 to v0.4.8 (deps: bump Norma replace to v0.4.5 #160, chore: norma v0.4.6 (boundary stays disabled) #161, chore: bump Norma to v0.4.7 #184, feat(intercept): pinned dialer for WebFetch and the custom http tool (S3b 2.1) #186).
• Docs: the LLM base URL note (docs: Anthropic base URL must not end in /v1 #157, docs: openai-responses base URL suffix #158).

Known limits (also in the CHANGELOG)

• The target gate is OFF by default and can only be set through the API. D2 is not in this release.
• For subprocesses, the gate detects declared inputs but does not enforce them. A target that is built at run time, or a script tool's stored code, is not seen. Only WebFetch and direct custom http calls are bound when they connect.
• URL rules match the URL as written (fix(intercept): match block rules on the declared targets before any lookup #183).
• prove_goal trusts the confidence the model declared. F4 fact provenance and the source check come in 0.7.0.
• The prompt rules are advisory to the model, and their effect was not measured.
• The new tool descriptions only reach fresh databases. The intent claim leases need a single version per database. No code path produces the verification states blocked or false_positive yet.

Verification

WSL Kali, go1.26.10 linux/amd64, ARTEX_PG_DSN unset, no database:

• go build ./...: ok
• go vet ./...: ok
• go test -count=1 ./...: exit 0. 14 packages ok, 2 have no test files. 574 top-level tests pass, 0 fail and 392 skip. Of the skips, 388 are Postgres-backed tests with no database, 3 are the existing self-skips tracked in Add CI: go build/vet/tests with postgres + web typecheck and static build #9, and 1 is TestLiveContextReview, which needs ARTEX_REVIEW_LIVE_CONFIG. The Postgres-backed tests run only in CI.
• gofmt: no Go file changed.