chore(master): release 1.10.0

[github-actions]

🤖 I have created a release beep boop

1.10.0 (2026-07-22)

Features

• 16-01: atomic temp+rename write in pkg/output/writer.go (55f7cc2)
• 16-02: pin github.com/modelcontextprotocol/go-sdk v1.6.1 (09d9e96)
• 16-03: create cpg mcp server skeleton and register command (93e7b3e)
• 17-01: add nil-safe OnFinal hook to PipelineConfig (507d0b3)
• 17-02: add pkg/session pipeline config builder + crash guard (c3b233e)
• 17-02: add pkg/session state model + result shapes (5fd92f7)
• 17-03: create pkg/session/manager.go single-slot state machine (6674d8b)
• 17-04: register session MCP tools and wire Manager into runMCPServer (83f70c0)
• 17-05: add terminal-error data layer to pkg/session (4bf0063)
• 17-05: autonomously transition State on genuine pipeline failure (e0ce76d)
• 17-06: bound MCP-supplied timeout/flush_interval above 24h (WR-03) (bf3012c)
• 17-06: merge sessionCtx into setupCtx so Shutdown aborts mid-setup (WR-02) (f8f9bdd)
• 17-08: classify genuine crash on sessionCtx cancellation, not error identity (WR-01) (cca60a1)
• 17-08: track explicit-stop separately from State via atomic Swap (WR-02) (0159b66)
• 17-09: broaden autonomous-exit guard to fire on clean nil drain (d4fdbb1)
• 18-01: implement pkg/explain with exported Filter/Output/Render* (GREEN) (667f5ba)
• 18-01: thin cmd/cpg/explain.go to call pkg/explain (GREEN) (ca5b920)
• 18-02: export cluster-health types and add hubble.ReadClusterHealth (7dabea1)
• 18-02: export output.ReadPolicyFile with wrapped-not-exist contract (7ace14c)
• 18-03: implement get_cluster_health with D-13 3-way branch (1576330)
• 18-03: implement list_policies and get_policy query tools (ee6a6c1)
• 18-04: implement get_evidence — paginated pkg/explain evidence (QRY-03) (dd6d39f)
• 18-04: implement pagination + enum-schema infra (mustQuerySchema, cursor, paginate) (2b722b0)
• 18-05: implement list_dropped_flows composed view (QRY-01) (9836802)
• 19-01: SEC-01 RTA reachability + direct-call-scan audit test (258decc)
• 19-02: add graceful e2e lifecycle test + SRV-01 handshake/schema/annotation assertions (cade360)
• 19-02: build e2e infra - fake Hubble relay, -race build helper, subprocess/tee harness, drop-flow fixtures (2648732)
• 19-04: add ungraceful-disconnect e2e variant (SRV-04/D-08/D-09) (140d25f)
• v1.5: MCP integration — readonly stdio server (phases 16-19) (81ebf2c)

Bug Fixes

• 16: guard seam-audit identity assertion against test2json stderr aliasing (ab665c5)
• 16: make seam-audit test immune to global stdout swaps (2cf0754)
• 16: WR-01 check cleanup error returns in atomic write path (2389f2f)
• 16: WR-02 stop swallowing cpg mcp startup/runtime errors (4fb7ba2)
• 18: WR-01 classify DROP_REASON_UNKNOWN evidence samples as unknown, not transient (8ea5a42)
• 18: WR-02 paginate list_policies and cap get_cluster_health breakdown maps (afab493)
• 18: WR-03 read policy file once in get_policy to avoid metadata/YAML skew (794175a)
• 18: WR-04 add session.DeriveSessionPaths as single source of truth for output layout (d733cbb)
• 19: address plan-checker findings (dropclass scope, k8s-verb heuristic) (356e50c)
• 19: correct D-10 dropclass scope in context/research/patterns + close out validation strategy (a6ab6ab)
• 19: IN-01 acknowledge func-value call dispatch is unchecked by Stage 3 scan (8c9e6f5)
• 19: IN-02 soften README exec-plugin timeout claim, note kubeconfig-load exception (f0d706e)
• 19: WR-01 replace tautological BFS self-check with real reachability assertions (7665120)
• 19: WR-02 extend disallowedFSWrite watchlist with metadata/link/truncate os.* mutators (37dbea4)
• 19: WR-03 add DeleteCollection/UpdateStatus/ApplyStatus to k8sWriteVerbs (e92669f)
• 19: WR-04 add t.Cleanup to guarantee e2e subprocess termination (5b5d5c7)
• deps: bump golang.org/x/text to v0.39.0 (GO-2026-5970) (bbce104)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v1.10.0

🌻