chore(release): v0.3.0

[ubercylon8]

Seventy-one commits since v0.2.1. Version bumped in the three places that carry it (pyproject.toml, core/pyproject.toml, core/f0_sectools_core/__init__.py) plus uv.lock; servers stay at 0.0.1 since they are not independently published.

What's in it

Added — sentinel-mcp as the ninth server (SIEM pillar: KQL telemetry, the SOC incident queue, detection coverage, fast M365 audit search); the Umbrella cloud firewall as a second hunt_firewall surface; searchable and readable Umbrella identities; a local eval dashboard; the detection-coverage pillar in the CISO report.

Changed — MCP Python SDK 2.0 across all servers; credential files located by search rather than by working directory, and scoped to their own platform's variables; the Sentinel incident queue defaults to open work.

Fixed — the three cross-cutting ones are the reason this is a minor bump rather than a patch. Each was a guarantee CLAUDE.md already stated and the code did not keep:

• Credentials were resolved against the process CWD, so launching a runtime from a subdirectory started all nine servers with no credentials, failing with an error that pointed at the credentials rather than the launch context.
• Unmapped exceptions propagated past every server's redaction boundary and reached the client as raw strings — Critical Rules 3 and 4, on all 58 tools.
• The Sentinel server shipped after the read-tool staleness audit was declared complete across eight servers, and inherited none of it: its "SOC incident queue" returned closed incidents as current work (23 Closed against 2 New on a tenant with 2 open), and three of seven tools truncated silently.

Security — every GitHub Action pinned to a SHA; TruffleHog, dependency-review and zizmor added; the cryptography and Pygments advisories held back by LimaCharlie's pins cleared via capped overrides.

Operator-visible behaviour changes

1. list_sentinel_incidents returns open incidents by default. status="any" restores the previous behaviour.
2. A .env.<platform> file now contributes only its own <PLATFORM>_* variables. Anything else in it — including process-wide values such as HTTPS_PROXY, which httpx honours on calls carrying a live token — is ignored and must be exported in the environment instead.
3. f0_sentinel_mcp.tools.hunt_firewall takes surface as its first argument. MCP clients pass by name and are unaffected; direct positional callers must be updated.

Verification

1080 tests passing, ruff and mypy clean, no gen_docs drift. Every claim in the changelog was checked against the code (58 registered tools, 58 guarded, 9 servers, 30 skills) rather than taken from the commit messages.

Note: the [0.3.0] compare link in CHANGELOG.md 404s until the tag exists, so lychee may flag it on this PR. It resolves the moment the tag is pushed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01XYTy7da8Z5ZHhkwcCpjojZ

[claude]

Claude finished @ubercylon8's task in 47s —— View job

---

Security review of PR #106

Scope: the diff vs. origin/main (5 files, +99/-9) is a pure release commit — CHANGELOG.md prose, three version-string bumps (pyproject.toml, core/pyproject.toml, core/f0_sectools_core/__init__.py), and the corresponding uv.lock version fields. No source code, tool definitions, core/ logic, workflow files, or dependency graph changes ship in this diff.

• Gather context
• Review diff against origin/main for security issues per CLAUDE.md Critical Rules
• Spot-check CHANGELOG.md's security-relevant claims against current repo state
• Post final findings

Findings

Nothing significant. This PR doesn't touch anything covered by the Critical Rules (read-only/gating, secret handling, redaction, findings schema, small-model-safe tool design) — there's no tool code, core/ logic, or CI workflow in the diff to assess against them.

I spot-checked two of the CHANGELOG's own security claims against the current tree since they're exactly the kind of thing a security review should verify rather than take on faith:

• "Every GitHub Action pinned to a SHA" — confirmed; all 9 files in .github/workflows/ use uses: ...@<40-hex-sha> refs, none unpinned.
• "Only <PLATFORM>_* variables are injected" from .env.<platform> files — confirmed in core/f0_sectools_core/auth/env.py's load_platform_env: it filters dotenv_values() to keys prefixed with f"{platform.upper()}_" before setdefault-ing them into os.environ, matching Critical Rule 7 (per-platform credential isolation) and the HTTPS_PROXY-leak fix described in the changelog.

uv.lock changes are limited to the two in-repo package version fields (f0-sectools, f0-sectools-core) — no new dependencies or source changes, so no new supply-chain surface.

One informational note (not a defect, already called out in the PR description): the [0.3.0] compare link added at the bottom of CHANGELOG.md will 404 until the v0.3.0 tag is pushed — expected and self-resolving, no action needed.