docs: changelog gets its own life, README tells the truth about v0.2.3.1

changelog entries for v0.2.2.0 (state machine + orchestrator), v0.2.3.0
(OSV batch, closure-wide checks), v0.2.3.1 (vuln is a full stop).
README condensed to point at CHANGELOG.md, gate description updated
from "soon" to what it actually does now.

README.md

@@ -2,7 +2,7 @@
 
 **Self-hosted update management for operators who own their stack.**
 
-`v0.2.3.1` — May 2026 · MIT License
+`v0.2.3.1` — June 2026 · MIT License
 
 > **You're early — nearly 600 of you cloned this before it was announced.**
 > If you want it to keep existing, [sponsor the work](#sponsorship--consulting).
@@ -15,7 +15,7 @@ Every command the server issues is Ed25519-signed. Agents verify the signature,
 
 It also just manages your updates — across Linux and Windows, including Docker containers running on those hosts — from a single dashboard, with a human approval step before anything gets installed.
 
-Next up is the supply-chain gate: the server mints a signed capability token over the exact resolved package closure, and a network-less privileged executor verifies the signature and artifact hashes before anything installs. Wired up and in live testing now — soon.
+The supply-chain gate goes deeper: when an update is approved, the server resolves the full dependency closure, checks every transitive artifact against OSV.dev, and mints a signed capability token binding the exact artifact hashes. A network-less privileged executor verifies the signature and every hash before anything installs. A known vulnerability anywhere in the closure is a full stop — the operator must override with a documented reason, or the token is never minted. The signing and hash verification have no skip path.
 
 ConnectWise charges $50/agent/month. RedFlag doesn't.
 
@@ -150,13 +150,14 @@ Before a package is installed: the agent fetches the expected SHA-256 from the s
 **Implemented:**
 - Linux and Windows agent registration and update management
 - APT, DNF, Winget, Windows Update, Docker image scanning
-- Dry-run dependency checking
-- Real-time heartbeat and rapid polling
+- Package state machine with enforced transitions and lifecycle orchestrator
+- Dry-run dependency checking with full closure resolution
+- Supply chain gate: OSV batch checks across transitive closures, vuln-is-a-full-stop enforcement, audited override path
 - Ed25519 key rotation and replay protection
-- Supply chain hash verification and OSV.dev checks
 - Maintenance windows
 - Upstream version tracking (GitHub, Gitea, GitLab, Bitbucket, Repology, endoflife.date)
 - Agent self-update via privileged helper (zero agent sudo)
+- Real-time heartbeat and rapid polling
 
 **Not yet done:**
 - Live end-to-end gate test (GATE-002)
@@ -243,50 +244,19 @@ I am a Systems Architect with 25 years on the frontier. I build sovereign agent
 
 ## Changelog
 
-**v0.2.1.0 (May 2026)**
-- Helper privilege split: `redflag-helper` now invoked via `sudo systemd-run --pipe` as its own transient service, escaping the agent's `ProtectSystem=strict` sandbox. The helper and its dnf/apt children see the real root filesystem.
-- Token-is-the-command: all package-manager operations now routed through one of two paths — discovery (scan, dry-run, hash-resolve) through a unified `DiscoveryRunner`, mutation (install, upgrade) exclusively through `consumer.go → systemd-run --pipe → redflag-helper`. The agent no longer has code to run `dnf install -y` or `apt install -y` directly.
-- `SecureCommandExecutor` deleted — replaced by `DiscoveryRunner` for discovery and the helper for mutation.
-- Sudoers narrowed: agent user can no longer run mutation commands (`dnf install *`, `apt install -y *`, etc.) — only discovery + the helper invocation.
-- `EcosystemConfig` registry: adding a new package ecosystem (AUR, Snap, Flatpak, Homebrew) means one config entry and implementing the discovery interface. Mutation is automatic via the token path.
-- Hash verification fail-closed: empty expected hash now returns an error instead of silently passing.
-- `Installer` interface shrunk from 7 methods to 4: `IsAvailable`, `GetPackageType`, `DryRun`, `VerifyHash`.
-- `apt-get` → `apt` throughout (ecosystem config, sudoers, discovery commands).
+See [CHANGELOG.md](CHANGELOG.md) for the full history. Recent highlights:
 
-**v0.2.0.7 (May 2026)**
-- Refresh-token rotation with accept-previous-once crash-recovery grace
-- Machine-bound renewal path closes stolen-config.json replay attack
-- Typed sentinel errors for auth failures in agent polling loop
-- Loud terminal-state detection: revoked refresh tokens and machine-ID mismatches surface as critical events, not silent retries
-- No-more-unsigned-binaries: signing-disabled path removed from orchestrator; unsigned fallback removed from download handler
+**v0.2.3.1** — Supply chain gate hardened: vuln in the dependency closure is a full stop at approval. Audited operator override path. Ack tracking fixed (no more 34-deep recycling).
 
-**v0.2.0.6 (May 2026)**
-- Agent cold-start trust root: signed release manifest verified before first binary execution
-- Supply-chain hash registry (Layer 1): expected SHA-256 stored server-side, verified by agents before install
-- Drift → UpdatePackage bridge: drifted bindings automatically create pending update packages
-- Upstream tracking UI with release-source adapters (GitHub, Gitea, GitLab, Bitbucket)
-- Attention panel: surfaces offline agents, failed updates, EOL drift, upstream movement
+**v0.2.3.0** — OSV batch checks across full dependency closures. DNF dry-run detection fix. Auto-confirm frisks the whole closure.
 
-**v0.2.0.0 (May 2026)**
-- Maintenance windows for scheduling/gating installs
-- OSV.dev supply chain checks at approval time (npm/PyPI)
-- Ed25519 key rotation with TTL-based auto-refresh
-- Command signing v3: agent_id binding prevents relay attacks
-- Replay protection via signed nonces (10-minute window)
-- Semver-aware version comparison
-- Binary path traversal protection
-- Machine ID rebind endpoint for hardware migration
-- 170+ tests across 18 packages
-- Command lifecycle v2: `received` state, disk-persisted dedup, authenticated binary download
+**v0.2.2.0** — Package state machine enforced. Lifecycle orchestrator foundation. Vulnerability dashboard.
 
-**v0.1.27 (December 2025)**
-- Hardware binding with machine fingerprinting
-- Ed25519 signing for all commands and updates
-- Error transparency system (ETHOS #1)
-- Circuit breakers and retry logic
-- Agent auto-update fully implemented
-- Rate limiting (60 req/min, configurable)
-- Command deduplication and idempotency
+**v0.2.1.1** — Zero-sudo agent. Helper self-upgrade. OSV expansion to apt/dnf. Staging page.
+
+**v0.2.1.0** — Token-is-the-command. Helper privilege split. DiscoveryRunner. Installer interface shrunk to 4 methods.
+
+**v0.2.0.7** — Refresh-token rotation. Machine-bound renewal. No unsigned binaries.
 
 ---