chore(main): release 3.4.0

[github-actions]

🤖 I have created a release beep boop

3.4.0 (2026-09-03)

Features

• add semantic projection reports (#1079) (8283fa5)
• add source-neutral SDL candidate synthesis (#1113) (48748ee)
• add target-node CPU architecture semantics to SDL (#1056) (2e4aabb)
• carry authored OS identity through realization (#1141) (7b73821)
• carry resolved realization authority through plans (#1081) (5c210d5)
• define account fixture credential semantics (#1073) (0248946)
• enforce participant flow policy at final runtime sinks (#1058) (6b47385)
• examples: add the canonical minimal cross-backend scenario (#1149) (789e7b5)
• govern portable runtime process limits (#1080) (0e30b38)
• publish adversarial participant flow-control contracts (#1053) (7159012)
• runtime: declare adversarial-control apparatus and backend capabilities (API-407) (#1062) (021dc7a)
• sdl: define participant episode termination semantics and RL closure record (SEM-222) (#1059) (1fdb85b)
• separate compute kind from realization substrate (#1082) (3d6e369)

Bug Fixes

• conformance: keep the default adapter probe envelope-neutral (#1159) (e014281)
• contracts: admit expanded scenario snapshot parents (#1040) (#1123) (14bfc7b)
• harden repo-policy governance check timeout, host, and status reporting (#1060) (92e6e23)
• libvirt: bind reproducible guest operations to fresh evidence (#1128) (1a38538)
• libvirt: record suppressed native failures on the operator side (#1163) (3b853a3)
• module-registry: harden OCI publication and caching (#1130) (15e6118)
• processor: bound dependency-cycle detection (#1103) (d4b4432)
• processor: bound dependency-cycle detection (#1126) (d4b4432)
• processor: bound the complete solver operation (#1108) (#1127) (e4612cf)
• processor: enforce evaluator capability admission (#1036) (#1119) (f005152)
• processor: enforce solver deadline boundaries (#1142) (eacfc46)
• proof: make offline Isabelle replay portable on Ubuntu (#1131) (990e8fb)
• reference-backend: anchor the OCI digest-pinned image-trust check (#1084) (83c3651)
• release: gate publication on the verified release SHA (#1138) (701858d)
• runtime: harden HTTP API admission and offload (#1133) (944b461)
• runtime: reconcile workflow timeouts fail closed (#1132) (96b20ae)
• runtime: settle concurrent participant batches reliably (#1135) (2d53aa3)
• runtime: synchronize operational summary reads (#1148) (915b0c0)
• supply-chain: gate vulnerable dependencies and scanner cache (#1121) (0f296b9)

Performance Improvements

• cli: bypass command imports for exact version (#1111) (3cd0f49)
• cli: bypass command imports for exact version (#1129) (3cd0f49)
• processor: materialize explicitness once per compile (#1099) (6fb2820)
• processor: materialize explicitness once per compile (#1120) (6fb2820)

Documentation

• add Ground Control requirement specs as repo-local files (#1064) (771756f)
• joint design for participant episode + budget model (SEM-222/223, DSL-120/121, ACT-623/624) (#1055) (645ef61)

---

This PR was generated with Release Please. See documentation.

[github-actions]

🤖 Created releases:

• v3.4.0

🌻