[Masterplanner25]

Release 2.28.0. No schema step: Alembic head 0020, contract 2026-09-20. No new scope, no default changed. @aindy/ui-kit 2.1.1 stays current.

Files:

• AINDY/_version.py and the Dockerfile pin → 2.28.0.
• Three changelog fragments folded with scripts/assemble_changelog.py and promoted under operator notes; ## Unreleased reset to "Nothing yet.".
• docs/upgrades/APP_HANDOFF_v2.28.0.md and its upgrades index row.
• CLAUDE.md's latest-handoff pointer (39,990 / 40,000 chars).

What ships:

• fix(security): bind outside-written payload user_id to the caller; mcp-server loads plugins (FR-53) #831, FR-53 (b), DEC-099: an outside-written payload user_id is filled when absent and refused when it names anyone but the caller. Applies to MCP, the Nodus sys() seam (whose setdefault kept a script's id) and POST /platform/syscall.
• fix(security): bind outside-written payload user_id to the caller; mcp-server loads plugins (FR-53) #831, FR-53 (a), DEC-101: mcp-server loads plugins and stops on a failed one. The escape is AINDY_BOOT_PROFILE=platform-only.
• feat(kernel): count payload user_id mismatches in the dispatcher, never refuse (PAYLOAD-IDENTITY-DISPATCH-1) #832, DEC-100: aindy_payload_identity_mismatch_total{syscall} observes in-process dispatch without refusing it.
• docs(decisions): accept DEC-101 — a failed plugin load stops mcp-server; document the escape #833: DEC-101 accepted.
• chore(deps): batch the thirteen Dependabot bumps of 2026-10-14 #830: dependency batch.

Release notes read for each moved runtime pin (handoff §4):

• OpenTelemetry 1.45.1: fixes quadratic-time tracestate parsing. This is reachable: FastAPIInstrumentor.instrument_app(app) always runs, so any client's header was parsed before authentication.
• pydantic 2.14.0: now rejects newlines in NameEmail, which neither repo uses.
• uvicorn 0.54.0: changes only its experimental HTTP/2 path.
• jiter 0.17.0: performance only.

App handoff, checked against the app's source on 2026-10-14:

• Their only sys() script passes its own owner's id.
• Their scripts/mcp_server.py launcher, which loads plugins and then calls serve_stdio(), was run in exactly that shape on this build. The second load is harmless.
• Their manifest is profile-format, so the DEC-101 escape applies.
• Nothing is owed from earlier releases.

Release watcher: the app's handoff watcher (A.I.N.D.Y. #471) follows this publish for the first time. publish.yml's trigger, job names, production gate and the handoff path are unchanged from 2.27.0, as confirmed to the app session.

Checked locally: assemble_changelog.py --check clean; the CI docs validator (142 docs); check_schema_version.py exit 0; ruff; packaging, compatibility, schema-contract, alembic-head, decision-log and debt-registry suites.

🤖 Generated with Claude Code