What's Changed

🔒 Security

• Fix RUSTSEC-2026-0185: remote memory exhaustion in quinn-proto — upgraded quinn-proto from 0.11.14 to 0.11.15. The vulnerability allowed remote memory exhaustion via unbounded out-of-order stream reassembly. CVSS 7.5 (high). All users on v0.10.9 or earlier should upgrade immediately. (#132)

✨ Added

• dakera_tif_evaluate tool (Power tier) — Truth-Indeterminacy-Falsity reliability scoring on memory feedback. Given a memory_id, computes normalised T-I-F scores and returns a reuse classification (confident_reuse, surface_contradiction, ask_clarification, verify_before_use). Pure arithmetic on feedback signals — no external LLM. Brings the Power profile to 69 tools and All profile to 87 tools.

🐛 Bug Fixes

• Memory feedback tools: missing agent_id forwarded — dakera_memory_feedback and dakera_memory_feedback_get now correctly forward the required agent_id field. Previously all feedback calls returned 422, silently breaking the memory reinforcement loop for all agents. (#136)
• Docker documentation: corrected port mapping — changed 3300:3300 → 3300:3000 in README examples. (#133)
• Playground badge URL — badge now correctly links to dakera.ai/playground (frontend) rather than the API endpoint. (#131)
• MCP Registry org case restored — repository.url in server.json now uses the correct Dakera-AI casing (DAK-7032). (#128)
• CI integration tests — added explicit GHCR docker/login-action step to prevent stale-credential failures on self-hosted ARM runners.

🔧 CI & Distribution

• ARM runner lockfile-aware stale cache purge — eliminates spurious compilation failures from stale Cargo.lock artifacts. (#135)
• Bumped GitHub Actions: actions/checkout v4 → v7 (#127, #130), actions/cache v5 → v6 (#134)

Full diff: v0.10.9...v0.10.10