[PyYoshi]

Summary

Cut the v0.4.1 release in the CHANGELOG. The [Unreleased] entries move under ## [0.4.1] - 2026-10-23, an empty [Unreleased] section stays on top, and the compare links are updated ([Unreleased] from v0.4.1, and a new [0.4.1] link against v0.4.0).

Why a patch bump: there are no exported API changes and scan behavior is unchanged. The user-visible change is the Go toolchain floor moving from 1.27.2 to 1.27.3 within the Go 1.27 line for the GO-2026-6809 fix in crypto/x509 (#27). The Added and Fixed entries cover the Claude Code git-command guard and its regression table (#26), which are contributor tooling, not library features. The maintainer confirmed v0.4.1.

After merge: signed tag v0.4.1 and the GitHub release (release skill, step 4).

Checklist

• make verify passes locally (build + lint + tests) — on go1.27.3
• make integration passes (required when client.go / conn.go / commands.go / internal/proto/ / docker/ changed) — not run locally; only CHANGELOG.md changed. CI integration (1.4) and integration (1.5) pass on 3204a30
• README.md and README.ja.md updated together, or the change touches neither
• CHANGELOG.md updated under [Unreleased] for user-visible changes
• No new dependencies, no assembled EICAR string, no weakened guards; design changes reference an ADR
• Reviewed against the AGENTS.md Review checklist by someone other than the author, covering the merged commit (recorded in the PR); every finding fixed or answered

Review record

Independent review by a fresh reviewer agent (not the authoring session) against the AGENTS.md Review checklist, the Definition of Done and the release skill. Reviewed commit: 3204a305b6a93895fda275681ef8842b814f7123 (origin/main..3204a30, the whole PR). Recommendation: APPROVE. No critical, major or minor findings.

The reviewer checked that:

• the entries moved without loss or duplication, and an empty [Unreleased] section stays on top;
• the compare links match the existing style;
• the date is correct;
• every change since v0.4.0 (Close bypasses in the git-command guard hook #26, Raise the Go toolchain floor to 1.27.3 #27) is covered, and no .go file changed;
• a patch bump is consistent with the release skill and with the v0.2.1 and v0.2.2 precedents (a floor raise within one Go line; an Added section of contributor tooling only);
• v0.4.1 does not exist yet locally, on the remote or as a GitHub release;
• the commit signature and the factual claims are correct.

#	Severity	Finding	Resolution
1	nit	The make integration box was ticked although it was not run locally (the earlier release cuts left it unticked)	Fixed in this description: unticked with the precedent wording, citing the CI integration jobs passing on 3204a30.
2	nit (process)	Release skill step 1 requires green CI on main, but the cut was committed while the main run for the #27 merge (9b75cea) was still in progress	Answered: that run, 39915690536, has since completed with success, so the precondition holds before the merge and the tag. Next time, check main CI before cutting.