Merge remote-tracking branch 'origin/dev' into feat/cpex_python_bindings

Author: tedhabeck

CHANGELOG.md

@@ -15,8 +15,11 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-06-26
+
 ### Added
 
+- CPEX redesign as a Rust framework with Go bindings
 - APL (Attribute Policy Language) governance is now bundled into `libcpex_ffi.a`. New `cpex_apl_install` extern C entry point registers the standard APL plugin/PDP factories (`validator/pii-scan`, `audit/logger`, `identity/jwt`, `delegator/oauth`, `cedar-direct`) and installs the APL config visitor on a manager. Call it after `cpex_manager_new_default` and before `cpex_load_config`. Go hosts use `PluginManager.EnableAPL()`. (#60)
 - Publish `libcpex_ffi.a` as signed GitHub Release artifacts on every semver tag push (`linux-amd64-gnu`, `linux-arm64-gnu`, `linux-amd64-musl`, `linux-arm64-musl`, `darwin-arm64`). Cosign keyless signatures + SHA256 checksums; see `crates/cpex-ffi/RELEASE.md` for the schema and the verify-and-consume recipe. (#60)
 - FFI ABI versioning: `cpex_ffi_abi_version()` extern C accessor exposes `FFI_ABI_VERSION`. The Go binding checks this in `init()` and panics on mismatch. Other language bindings must replicate the check. (#60)
@@ -61,6 +64,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 - Initial release
 
-[Unreleased]: https://github.com/contextforge-org/cpex/compare/0.1.1...HEAD
+[Unreleased]: https://github.com/contextforge-org/cpex/compare/0.2.0...HEAD
+[0.2.0]: https://github.com/contextforge-org/cpex/compare/0.1.1...0.2.0
 [0.1.1]: https://github.com/contextforge-org/cpex/compare/0.1.0...0.1.1
 [0.1.0]: https://github.com/contextforge-org/cpex/releases/tag/0.1.0