AGNT v0.4.1 — Security hardening sprint

AGNT v0.4.1 is a dedicated security release resulting from a comprehensive red-team audit of the platform. The audit identified vulnerabilities across three priority levels. P0 (critical) items included prompt injection vectors in LLM inputs, unenforced global spend caps that could allow runaway API costs, and missing backpressure controls on the LLM gateway that could be exploited for denial-of-service.

P1 (high) fixes address delta-sync integrity — ensuring that incremental memory updates cannot be tampered with or replayed. The hypothesis engine ('dreaming' feature) gained guards preventing agents from acting on unvalidated hypotheses. Key rotation was automated so API keys and JWT secrets rotate on schedule without manual intervention. The audit log was expanded to cover every A2A transaction, admin dashboard action, and configuration change.

P2 (medium) patches enforce booking constraints server-side (preventing double-bookings via API manipulation), defend against wiki content reconnaissance attacks, and switch all rate limiters to fail-closed mode — if the rate limiter itself fails, traffic is blocked rather than allowed through. The CVE count across all dependencies dropped from 51 to 1 after a full dependency audit and upgrade cycle.