chore(main): release codex-pooler 0.5.19

[github-actions]

🤖 I have created a release beep boop

0.5.19 (2026-08-10)

Features

• admin: expose metrics authentication state (7ada8d5)
• admin: show runtime firewall session state (de3bd07)
• ingress: add explicit forwarded client policy (1652d3a)
• ingress: expose firewall denial telemetry (6f3db40)
• mcp: support the 2026-07-28 protocol (cacc0cd)
• observability: expose reset confirmation phases (5645e43)
• security: retain bounded ingress peer provenance (0b482bf)

Bug Fixes

• admin: clarify runtime firewall route scope (0e6962f)
• admin: complete firewall session state coverage (fe7ea2d)
• admin: correct quota and saved reset meter states (c263d90)
• admin: describe bridge ring rendezvous ordering (c8dbe44)
• admin: explain applied reset quota confirmation (d549738)
• admin: keep provider quota authoritative across reset precision (c6085c2)
• admin: render unknown quota meters as static (da65a05)
• catalog: avoid duplicate-key errors on pricing reimports (1913451)
• deps: update dependency @astrojs/starlight to v0.41.7 (#265) (c1bea14)
• deps: update dependency apexcharts to v6.7.1 (#274) (246faf8)
• dev: preserve lifecycle command PATH (32d8002)
• dev: recover verified legacy server state (aea8f49)
• dev: resolve impeccable live helper from its handshake file (439acec)
• dev: scope impeccable live constants to the dev-features guard (ef8553f)
• docs: enforce ingress boundary contract (3bbea63)
• gateway: cancel abandoned websocket work across topologies (4cf4b18)
• gateway: close abandoned upstream websocket requests (4988adb)
• gateway: enforce image generation policy in dispatch (51ad37a)
• gateway: stagger websocket owner lease renewals (c9bd890)
• ingress: add canonical runtime path classification (0d29c8d)
• ingress: bound forwarded client resolution (28d9391)
• ingress: enforce configured forwarded client source (0b68691)
• ingress: enforce decoded runtime path boundaries (2487c2a)
• ingress: enforce strict canonical IP rules (f68ae51)
• ingress: fail closed on unavailable settings (16ce194)
• ingress: reuse forwarded client resolution (b3d3311)
• mcp: align unsupported protocol error messages (bb67216)
• mcp: suppress non-remainder quota balances (2e00690)
• monitoring: scope firewall denial dashboard (3b8dbc7)
• openai: adapt explicit prompt cache controls (7ae45e7)
• preserve quota and credit state convergence (5966d7d)
• quota: derive freshness at read time (79eb794)
• quota: normalize freshness evidence aliases (799c3da)
• quota: preserve explicit account reset provenance (d54383f)
• responses: accept custom tools inside namespaces (245e280)
• responses: clarify namespace tool validation error (77cb8fd)
• routing: bind circuit completions to admitted probes (61006b1)
• routing: record attempt-owned circuit recovery outcomes (791d844)
• routing: score reported-percent exhaustion as empty (844b737)
• saved-resets: close post-consume convergence handoff (1bc9f83)
• saved-resets: defer burns for recoverable circuit siblings (21bf4b3)
• security: bind local browser trust to the immediate peer (e9580ba)
• security: enforce ingress firewall for pruned runtime routes (67fbefd)
• security: reject malformed immediate peer addresses (2da890e)
• security: validate preserved peer addresses with OTP (e0f3c02)
• settings: make instance cache self-healing (d16895d)
• settings: remove unsupported database setting env aliases (2ba2287)
• test: isolate database state and expected logs (64c5f42)
• upstreams: parse Cloudflare cookie dates without httpd (e69a78e)
• usage: omit synthetic credits metadata (d8c1579)
• usage: require all emitted quota windows to allow (7552c20)
• v1: centralize pool compatibility authorization (baed23c)
• websocket: revoke sockets after firewall updates (578b90a)

Performance Improvements

• gateway: compile test settings overrides out of production (10fba6e)

---

This PR was generated with Release Please. See documentation.