From b7e0e308a948f6a88b89e897d8da8af46c27b7d7 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 07:52:03 +0000
Subject: [PATCH 01/16] chore(main): release 4.0.1

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 7 +++++++
 pyproject.toml                | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index e6f87756..cf533f28 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.0.0"
+  ".": "4.0.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa39211e..d56a25a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,13 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [4.0.1](https://github.com/Brad-Edwards/aptl/compare/v4.0.0...v4.0.1) (2026-07-06)
+
+
+### Bug Fixes
+
+* publish under the aptl-labs distribution name ([#651](https://github.com/Brad-Edwards/aptl/issues/651)) ([8b9174a](https://github.com/Brad-Edwards/aptl/commit/8b9174a90f8be2677f07f4278a21a1e47fd912ae))
+
 ## [4.0.0](https://github.com/Brad-Edwards/aptl/compare/v3.0.10...v4.0.0) (2026-07-06)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index d390abd7..38ea7c00 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "4.0.0"
+version = "4.0.1"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"

From 87bed6a7dc4be9e208388c7b5337c69664327743 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:00:14 +0000
Subject: [PATCH 02/16] chore(main): release 4.1.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 12 ++++++++++++
 pyproject.toml                |  2 +-
 3 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index cf533f28..411256bc 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.0.1"
+  ".": "4.1.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d56a25a0..b08de8aa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,18 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [4.1.0](https://github.com/Brad-Edwards/aptl/compare/v4.0.1...v4.1.0) (2026-07-06)
+
+
+### Features
+
+* bundle lab assets so pipx install runs a lab without a clone ([#660](https://github.com/Brad-Edwards/aptl/issues/660)) ([00fe44b](https://github.com/Brad-Edwards/aptl/commit/00fe44bd9ddc33744648aeb22b76224162d39d5b))
+
+
+### Bug Fixes
+
+* correct grc.boundaries surfaces to GC adapter vocabulary ([#644](https://github.com/Brad-Edwards/aptl/issues/644)) ([471f381](https://github.com/Brad-Edwards/aptl/commit/471f381bbffd48ff623b9cd69f50900d5eb5f9e9)), closes [#634](https://github.com/Brad-Edwards/aptl/issues/634)
+
 ## [4.0.1](https://github.com/Brad-Edwards/aptl/compare/v4.0.0...v4.0.1) (2026-07-06)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 9bc01df9..b1bd0712 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "4.0.1"
+version = "4.1.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"

From c00994d7a756f153626c9731ef7c6d5b9f79bb31 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:46:49 +0000
Subject: [PATCH 03/16] chore(main): release 4.1.1

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 7 +++++++
 pyproject.toml                | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 411256bc..9965c417 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.1.0"
+  ".": "4.1.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b08de8aa..6705a1d7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,13 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [4.1.1](https://github.com/Brad-Edwards/aptl/compare/v4.1.0...v4.1.1) (2026-07-06)
+
+
+### Bug Fixes
+
+* drop removed --workers flag from web-api container CMD ([#664](https://github.com/Brad-Edwards/aptl/issues/664)) ([8717e6a](https://github.com/Brad-Edwards/aptl/commit/8717e6a81e4eb6369b8b9ff9f35163f5e546115c))
+
 ## [4.1.0](https://github.com/Brad-Edwards/aptl/compare/v4.0.1...v4.1.0) (2026-07-06)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index b1bd0712..04f6d29d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "4.1.0"
+version = "4.1.1"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"

From cab9c99d77b597538e402b203d6b617d0b2e52d4 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 23:00:11 +0000
Subject: [PATCH 04/16] chore(main): release 4.1.2

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 7 +++++++
 pyproject.toml                | 2 +-
 src/aptl/__init__.py          | 2 +-
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 9965c417..ec2d45d7 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.1.1"
+  ".": "4.1.2"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6705a1d7..3160e716 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,13 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [4.1.2](https://github.com/Brad-Edwards/aptl/compare/v4.1.1...v4.1.2) (2026-07-06)
+
+
+### Bug Fixes
+
+* report the correct aptl --version on released installs ([#669](https://github.com/Brad-Edwards/aptl/issues/669)) ([fb749bd](https://github.com/Brad-Edwards/aptl/commit/fb749bd5121bae8cbe281993858fc9f45b0107c0))
+
 ## [4.1.1](https://github.com/Brad-Edwards/aptl/compare/v4.1.0...v4.1.1) (2026-07-06)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 04f6d29d..9653804d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "4.1.1"
+version = "4.1.2"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 62be4906..7835c754 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "4.1.1"  # x-release-please-version
+__version__ = "4.1.2"  # x-release-please-version

From 1b516504ab1ac5affdbc22f199d0002e06e8fd84 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 17:26:44 +0000
Subject: [PATCH 05/16] chore(main): release 4.2.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 33 +++++++++++++++++++++++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 36 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ec2d45d7..34a3350a 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.1.2"
+  ".": "4.2.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3160e716..1e12b934 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,39 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [4.2.0](https://github.com/Brad-Edwards/aptl/compare/v4.1.2...v4.2.0) (2026-07-08)
+
+
+### Features
+
+* add host platform detection layer ([#693](https://github.com/Brad-Edwards/aptl/issues/693)) ([aa4a2b5](https://github.com/Brad-Edwards/aptl/commit/aa4a2b54cd5090a961e7f0ca277c8fe95b61a679))
+* auto-remap in-use host ports and report real URLs on lab start ([#706](https://github.com/Brad-Edwards/aptl/issues/706)) ([75055b2](https://github.com/Brad-Edwards/aptl/commit/75055b262d230766865a3cecdee7d96142391c0f))
+
+
+### Bug Fixes
+
+* bind mailserver ports to loopback (ADR-034/ADR-039) ([#674](https://github.com/Brad-Edwards/aptl/issues/674)) ([e11a327](https://github.com/Brad-Edwards/aptl/commit/e11a3272c99ce9ae9ed0923dcbfd10f4876c468c))
+* generate certs as host user on native Docker ([#694](https://github.com/Brad-Edwards/aptl/issues/694)) ([a75b5f3](https://github.com/Brad-Edwards/aptl/commit/a75b5f37ada87481ede224510376f0b48447c08f))
+* harden SSH keys on Windows ([#698](https://github.com/Brad-Edwards/aptl/issues/698)) ([60fbeb3](https://github.com/Brad-Edwards/aptl/commit/60fbeb31b0f0fb032592b11e40e2e3b5ae3574b2))
+* point TheHive references at https (it serves HTTPS on 9000) ([#675](https://github.com/Brad-Edwards/aptl/issues/675)) ([700ab31](https://github.com/Brad-Edwards/aptl/commit/700ab31c1e913c14785c4ad1699b5faf6cdcaa51))
+* preserve LF line endings for rendered configs ([25290f0](https://github.com/Brad-Edwards/aptl/commit/25290f0e2e62d1ef47cf10d49ffc9fee1d8a9afe))
+* preserve LF rendered configs ([#701](https://github.com/Brad-Edwards/aptl/issues/701)) ([25290f0](https://github.com/Brad-Edwards/aptl/commit/25290f0e2e62d1ef47cf10d49ffc9fee1d8a9afe))
+* repair Suricata seed ownership without host sudo ([#695](https://github.com/Brad-Edwards/aptl/issues/695)) ([4cc3987](https://github.com/Brad-Edwards/aptl/commit/4cc39873fdb524f63b1c8e4f7726e7c95b20ade7))
+* satisfy release sonar gate ([#708](https://github.com/Brad-Edwards/aptl/issues/708)) ([9fbe0c5](https://github.com/Brad-Edwards/aptl/commit/9fbe0c572878fda3a87359ca93f747d1cab2228a))
+* skip vm max map count check off native Docker ([#697](https://github.com/Brad-Edwards/aptl/issues/697)) ([6c9fd2e](https://github.com/Brad-Edwards/aptl/commit/6c9fd2e740248d652c0f3e8da6fc7a6c8e1ba41e))
+* use exception logging for cert generator ([#704](https://github.com/Brad-Edwards/aptl/issues/704)) ([958009c](https://github.com/Brad-Edwards/aptl/commit/958009c15770de8f7a0c8462fbefdb40ab903c02))
+* use exception logging for sysreq parse errors ([#705](https://github.com/Brad-Edwards/aptl/issues/705)) ([b0fc394](https://github.com/Brad-Edwards/aptl/commit/b0fc394b4bdbe7571bbb8f198a849022dd136177))
+* validate m8 cross-platform blockers ([#702](https://github.com/Brad-Edwards/aptl/issues/702)) ([122c4bf](https://github.com/Brad-Edwards/aptl/commit/122c4bff3f8f3339948cc22999d350cece81a1c7))
+
+
+### Documentation
+
+* add per-OS prerequisites ([#700](https://github.com/Brad-Edwards/aptl/issues/700)) ([7882e29](https://github.com/Brad-Edwards/aptl/commit/7882e290ae6f1c09b9666fda0b8b75a289366344))
+* add workshop playbook + lab walkthrough ([c8ae705](https://github.com/Brad-Edwards/aptl/commit/c8ae70512766a4b06214863afd5e57aaaf9879b9))
+* add workshop playbook and lab walkthrough ([#687](https://github.com/Brad-Edwards/aptl/issues/687)) ([c8ae705](https://github.com/Brad-Edwards/aptl/commit/c8ae70512766a4b06214863afd5e57aaaf9879b9))
+* genericize private workflow-platform references ([239f369](https://github.com/Brad-Edwards/aptl/commit/239f369531467d27324dda977d7be70dc8cd1953))
+* genericize private workflow-platform references in public docs ([#673](https://github.com/Brad-Edwards/aptl/issues/673)) ([239f369](https://github.com/Brad-Edwards/aptl/commit/239f369531467d27324dda977d7be70dc8cd1953))
+
 ## [4.1.2](https://github.com/Brad-Edwards/aptl/compare/v4.1.1...v4.1.2) (2026-07-06)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 9653804d..6ab44d0e 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "4.1.2"
+version = "4.2.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 7835c754..a269c3f9 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "4.1.2"  # x-release-please-version
+__version__ = "4.2.0"  # x-release-please-version

From 92ffa328fc4297a775429c013c31435399af5645 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 19:05:12 +0000
Subject: [PATCH 06/16] chore(main): release 4.2.1

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 8 ++++++++
 pyproject.toml                | 2 +-
 src/aptl/__init__.py          | 2 +-
 4 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 34a3350a..3d3c5268 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.2.0"
+  ".": "4.2.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1e12b934..a73f8305 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,14 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [4.2.1](https://github.com/Brad-Edwards/aptl/compare/v4.2.0...v4.2.1) (2026-07-08)
+
+
+### Bug Fixes
+
+* **release:** document release-please title parsing ([a92119d](https://github.com/Brad-Edwards/aptl/commit/a92119dad58a513bf4e3bbc4a577d65ad3e86221))
+* **release:** document release-please title parsing ([#717](https://github.com/Brad-Edwards/aptl/issues/717)) ([e2746f3](https://github.com/Brad-Edwards/aptl/commit/e2746f356fbb1e842bf4126f08e3ac1d2f6133c2))
+
 ## [4.2.0](https://github.com/Brad-Edwards/aptl/compare/v4.1.2...v4.2.0) (2026-07-08)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 6ab44d0e..cde5deb9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "4.2.0"
+version = "4.2.1"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index a269c3f9..9fd055c5 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "4.2.0"  # x-release-please-version
+__version__ = "4.2.1"  # x-release-please-version

From 0be5607b1ccd531c1684b3c91d8e6b7421f37b72 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 8 Jul 2026 20:06:05 +0000
Subject: [PATCH 07/16] chore(main): release 4.2.2

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 12 ++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 3d3c5268..132ec753 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.2.1"
+  ".": "4.2.2"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a73f8305..2934911b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,18 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [4.2.2](https://github.com/Brad-Edwards/aptl/compare/v4.2.1...v4.2.2) (2026-07-08)
+
+
+### Bug Fixes
+
+* enable full SOC lab in default config so init+start works ([#727](https://github.com/Brad-Edwards/aptl/issues/727)) ([0d18d7d](https://github.com/Brad-Edwards/aptl/commit/0d18d7d27b42de2f49b408a4c4a8d23a06fe8389))
+
+
+### Documentation
+
+* **troubleshooting:** triage 'Up (unhealthy)' containers — memory-tight vs daemons-crashed ([#726](https://github.com/Brad-Edwards/aptl/issues/726)) ([46b7b3e](https://github.com/Brad-Edwards/aptl/commit/46b7b3eaed0942f478f965db0b889914c205766b))
+
 ## [4.2.1](https://github.com/Brad-Edwards/aptl/compare/v4.2.0...v4.2.1) (2026-07-08)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index cde5deb9..b6e26d78 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "4.2.1"
+version = "4.2.2"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 9fd055c5..65052c68 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "4.2.1"  # x-release-please-version
+__version__ = "4.2.2"  # x-release-please-version

From 883ebc2ab0c9d43baa2084905e59aeb3866a8860 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 15 Jul 2026 00:05:57 +0000
Subject: [PATCH 08/16] chore(main): release 5.0.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 47 +++++++++++++++++++++++++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 50 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 132ec753..32dbe0e2 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "4.2.2"
+  ".": "5.0.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2934911b..be656112 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,53 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.0.0](https://github.com/Brad-Edwards/aptl/compare/v4.2.2...v5.0.0) (2026-07-15)
+
+
+### ⚠ BREAKING CHANGES
+
+* the `aptl aces-inventory` command is removed. Asset-inventory capture is owned by ACES.
+
+### Features
+
+* **aces:** realize account/group placements via DeploymentBackend ([#768](https://github.com/Brad-Edwards/aptl/issues/768)) ([a4a0984](https://github.com/Brad-Edwards/aptl/commit/a4a09843e639ff7f1e131d2429ece45039aaecb2))
+* **aces:** realize TechVault content and account placements or fail closed ([#750](https://github.com/Brad-Edwards/aptl/issues/750)) ([45c6ece](https://github.com/Brad-Edwards/aptl/commit/45c6ecebc789d90555adc4c43ef3cf1fb1db7687))
+* **deployment:** surface a redacted stderr hint when a volume seed exits nonzero ([#756](https://github.com/Brad-Edwards/aptl/issues/756)) ([f168e43](https://github.com/Brad-Edwards/aptl/commit/f168e43e80cb5620b503ef68d263796a37f8fc29))
+* **deployment:** surface redacted stderr hint on volume seed failure ([f168e43](https://github.com/Brad-Edwards/aptl/commit/f168e43e80cb5620b503ef68d263796a37f8fc29))
+* realize runtime services and honest SEM-218 disclosure via RuntimeManager ([#770](https://github.com/Brad-Edwards/aptl/issues/770)) ([10dc1e2](https://github.com/Brad-Edwards/aptl/commit/10dc1e205d4cb8dd42a950b317ca49e26558452d))
+* run MCP build and SOC seed shell steps on native Windows ([#729](https://github.com/Brad-Edwards/aptl/issues/729)) ([5a0b7f9](https://github.com/Brad-Edwards/aptl/commit/5a0b7f92c46ac7c2280aadd5af7760ba2acf74a5))
+* **web:** add /config summary, Settings dialog, and local-use notice ([#751](https://github.com/Brad-Edwards/aptl/issues/751)) ([98cabd2](https://github.com/Brad-Edwards/aptl/commit/98cabd2bc1cc71479d9e1aef6b546f44602ddc4c))
+
+
+### Bug Fixes
+
+* **ci:** clear Sonar test code smells ([#771](https://github.com/Brad-Edwards/aptl/issues/771)) ([cf02a61](https://github.com/Brad-Edwards/aptl/commit/cf02a61f3ebe561643ce308439d2bf1c281dc133))
+* **cli:** `aptl lab info` reflects live published ports, not compile-time defaults ([9d2d29b](https://github.com/Brad-Edwards/aptl/commit/9d2d29bc18084a334f90edd1ca54074847e95aef)), closes [#737](https://github.com/Brad-Edwards/aptl/issues/737)
+* **cli+windows:** clear [#739](https://github.com/Brad-Edwards/aptl/issues/739) SonarCloud smells and green the suite on native Windows ([#747](https://github.com/Brad-Edwards/aptl/issues/747)) ([dc4e2f1](https://github.com/Brad-Edwards/aptl/commit/dc4e2f1fba9b9867ecc5bb0960ba414fef3a1d8c))
+* **cli:** reflect live published ports in `aptl lab info` (was hardcoded defaults) ([#738](https://github.com/Brad-Edwards/aptl/issues/738)) ([9d2d29b](https://github.com/Brad-Edwards/aptl/commit/9d2d29bc18084a334f90edd1ca54074847e95aef))
+* **compose:** raise suricata memory limit 1g -&gt; 3g so IDS stays up under full rule set ([d9b7676](https://github.com/Brad-Edwards/aptl/commit/d9b7676e3e923b4720af98086e578bd08d2827a1))
+* **compose:** suricata memory 1g -&gt; 3g so IDS stays up under full APTL rule set ([#731](https://github.com/Brad-Edwards/aptl/issues/731)) ([d9b7676](https://github.com/Brad-Edwards/aptl/commit/d9b7676e3e923b4720af98086e578bd08d2827a1))
+* constrain ACES and define libvirt service boundary ([#767](https://github.com/Brad-Edwards/aptl/issues/767)) ([2bf9988](https://github.com/Brad-Edwards/aptl/commit/2bf99883ff4714ef63408aedf48b8a21cefb2cc5))
+* **lab:** cross-platform lab-start fixes (indexer wait, WSL detection, Sonar smells) ([#740](https://github.com/Brad-Edwards/aptl/issues/740)) ([40244be](https://github.com/Brad-Edwards/aptl/commit/40244be63684b755895101531be3a9243ab0613c))
+* **lab:** restart wazuh-manager between compose retries if daemons never spawn ([#736](https://github.com/Brad-Edwards/aptl/issues/736)) ([75a050d](https://github.com/Brad-Edwards/aptl/commit/75a050d6bd33635a05dd208e189bf6d9e75e28a5))
+* **lab:** use resolved indexer host port in readiness probe (was hardcoded 9200) ([#735](https://github.com/Brad-Edwards/aptl/issues/735)) ([e45c3a6](https://github.com/Brad-Edwards/aptl/commit/e45c3a6b3e4d57ade35cbeb7f2512de6543c05c6)), closes [#733](https://github.com/Brad-Edwards/aptl/issues/733)
+* make generated cert mounts container-readable ([#734](https://github.com/Brad-Edwards/aptl/issues/734)) ([ac5224a](https://github.com/Brad-Edwards/aptl/commit/ac5224a9a29b00bc80e345a3b6619162a87de795))
+* narrow evaluator surface to conditions and objectives ([#749](https://github.com/Brad-Edwards/aptl/issues/749)) ([1b2159d](https://github.com/Brad-Edwards/aptl/commit/1b2159d1ad27de525be84002d72c7c9b1ab4216b))
+* **techvault:** stop lab-boot crash on prose content and realize weak-password accounts ([#754](https://github.com/Brad-Edwards/aptl/issues/754)) ([c6bda8b](https://github.com/Brad-Edwards/aptl/commit/c6bda8b7ca9a5d9da44b395f6201280217e77bc9))
+
+
+### Documentation
+
+* align ACES backend capability claims ([#766](https://github.com/Brad-Edwards/aptl/issues/766)) ([81c268f](https://github.com/Brad-Edwards/aptl/commit/81c268fd6563b759262602794bfbef851881bfdb))
+* generalize workshop rollout capacity example ([b3657c4](https://github.com/Brad-Edwards/aptl/commit/b3657c4abfabbec14889b41f108782aae5fd1549))
+* **workshop:** document emergency rollout ([#746](https://github.com/Brad-Edwards/aptl/issues/746)) ([33966d3](https://github.com/Brad-Edwards/aptl/commit/33966d33ef4101784527c100182e4cdf11b714dc))
+* **workshop:** generalize rollout capacity example ([#748](https://github.com/Brad-Edwards/aptl/issues/748)) ([b3657c4](https://github.com/Brad-Edwards/aptl/commit/b3657c4abfabbec14889b41f108782aae5fd1549))
+
+
+### Code Refactoring
+
+* remove ACES capture inventory and the SCN-010 parity surface ([#757](https://github.com/Brad-Edwards/aptl/issues/757)) ([b4b9c04](https://github.com/Brad-Edwards/aptl/commit/b4b9c04dd380ae259f59320000bf496959801b14))
+
 ## [4.2.2](https://github.com/Brad-Edwards/aptl/compare/v4.2.1...v4.2.2) (2026-07-08)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 9d6aa85f..f2a536c2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "4.2.2"
+version = "5.0.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 65052c68..57b2c637 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "4.2.2"  # x-release-please-version
+__version__ = "5.0.0"  # x-release-please-version

From 9a43127152285ec1256996e85f69e968ac1d27b7 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 25 Jul 2026 17:07:25 +0000
Subject: [PATCH 09/16] chore(main): release 5.1.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 50 +++++++++++++++++++++++++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 53 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 32dbe0e2..affd1ab3 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.0.0"
+  ".": "5.1.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index be656112..25a2e962 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,56 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.1.0](https://github.com/Brad-Edwards/aptl/compare/v5.0.0...v5.1.0) (2026-07-25)
+
+
+### Features
+
+* **aces:** image-free generic-materializer realization envelope ([#581](https://github.com/Brad-Edwards/aptl/issues/581)) ([#805](https://github.com/Brad-Edwards/aptl/issues/805)) ([421a836](https://github.com/Brad-Edwards/aptl/commit/421a836d47135008d4cfc831f3b4f1669a860c2e))
+* **aces:** realize the TechVault SDL dynamically, retire hand-authored compose plumbing ([#581](https://github.com/Brad-Edwards/aptl/issues/581)) ([#812](https://github.com/Brad-Edwards/aptl/issues/812)) ([96a14a0](https://github.com/Brad-Edwards/aptl/commit/96a14a029e98db3ba6dd9e8d993bc8b60d4fcb2e))
+* **aces:** realize Wazuh stateful services from SDL ([#796](https://github.com/Brad-Edwards/aptl/issues/796)) ([a4423db](https://github.com/Brad-Edwards/aptl/commit/a4423db9a5f49be6dc2462cb52c1e53e1935d0a6))
+* add ACES experiment specification admission and trial planning (EXP-002) ([#806](https://github.com/Brad-Edwards/aptl/issues/806)) ([955f7d6](https://github.com/Brad-Edwards/aptl/commit/955f7d6c772d6007fff4b35017a958a60cd1506d))
+* add experiment correlation identity and clock-context projection (OBS-002) ([#808](https://github.com/Brad-Edwards/aptl/issues/808)) ([a4c60db](https://github.com/Brad-Edwards/aptl/commit/a4c60db424301cb0814a9af57f8edc39796303ac))
+* consume ACES runtime-substituted plans ([#798](https://github.com/Brad-Edwards/aptl/issues/798)) ([c0dc206](https://github.com/Brad-Edwards/aptl/commit/c0dc206982810e71009a3e17e5d441ef195649e2))
+* **evidence:** acquire ACES experiment evidence from admitted capture bindings ([#811](https://github.com/Brad-Edwards/aptl/issues/811)) ([e9373f5](https://github.com/Brad-Edwards/aptl/commit/e9373f5bec57b2c315c4a9c5d7ab837983b19595))
+* **experiment:** admit capture requirements via a code-owned collector registry ([#810](https://github.com/Brad-Edwards/aptl/issues/810)) ([5dfc017](https://github.com/Brad-Edwards/aptl/commit/5dfc017b103895fd191531920ad9d25d887e6060))
+* **scenario:** restore TechVault content parity for dynamic realization ([#581](https://github.com/Brad-Edwards/aptl/issues/581)) ([#818](https://github.com/Brad-Edwards/aptl/issues/818)) ([2a3bd09](https://github.com/Brad-Edwards/aptl/commit/2a3bd099611cd48d2db6e42b9a7d02d7710c6f7d))
+
+
+### Bug Fixes
+
+* **aces:** restore custom Wazuh rule/decoder mounts dropped by stateful !override ([#814](https://github.com/Brad-Edwards/aptl/issues/814)) ([3da3bee](https://github.com/Brad-Edwards/aptl/commit/3da3beee5f6552e681de84085dc075e16b10a78c))
+* **aces:** restore custom Wazuh rule/decoder mounts in stateful realization ([3da3bee](https://github.com/Brad-Edwards/aptl/commit/3da3beee5f6552e681de84085dc075e16b10a78c))
+* **aces:** truth up backend manifest ([#792](https://github.com/Brad-Edwards/aptl/issues/792)) ([9ce7ef3](https://github.com/Brad-Edwards/aptl/commit/9ce7ef3af3e88d0bfad025dccc7d6ea6cd0cfee3))
+* align live smoke tests with current lab ([70f0731](https://github.com/Brad-Edwards/aptl/commit/70f0731d067356b7e64dc140d6fcd57d17a30f6e))
+* **certs:** restore vendored wazuh-certs-tool.sh to its pinned digest ([#813](https://github.com/Brad-Edwards/aptl/issues/813)) ([ec54ee2](https://github.com/Brad-Edwards/aptl/commit/ec54ee2da2cd59c58eb17f1dd7737483901b1838))
+* document Linux Buildx prerequisite ([#789](https://github.com/Brad-Edwards/aptl/issues/789)) ([c573dca](https://github.com/Brad-Edwards/aptl/commit/c573dca42854c5542787e00862c8b06d493f8612))
+* flush Kali captures before session close ([#780](https://github.com/Brad-Edwards/aptl/issues/780)) ([cf15604](https://github.com/Brad-Edwards/aptl/commit/cf1560451e54abc9b5d144de90e5f4b08ebac267))
+* generate certs producer-owned and repair fresh lab start ([#801](https://github.com/Brad-Edwards/aptl/issues/801)) ([abb3fc1](https://github.com/Brad-Edwards/aptl/commit/abb3fc1b42dc78baac51e59b4d57b3e7a2db65db))
+* generate current MCP client configuration ([#788](https://github.com/Brad-Edwards/aptl/issues/788)) ([aafa008](https://github.com/Brad-Edwards/aptl/commit/aafa008c6c4821e7d972ab7b67b1daec98454f52))
+* harden Suricata seed ownership-repair helper container ([#807](https://github.com/Brad-Edwards/aptl/issues/807)) ([304d121](https://github.com/Brad-Edwards/aptl/commit/304d1217f72d053b0e4201844eb731d5f513e24a))
+* hide disabled reverse access ([#773](https://github.com/Brad-Edwards/aptl/issues/773)) ([bf97101](https://github.com/Brad-Edwards/aptl/commit/bf97101f9d85dc5b185fa911407554c78398486b))
+* keep Shuffle writable on high-usage hosts ([#779](https://github.com/Brad-Edwards/aptl/issues/779)) ([00e7d87](https://github.com/Brad-Edwards/aptl/commit/00e7d8707616da0e9a591a9b4d9c605b949689d5))
+* keep TheHive and Cortex writable on high-usage hosts ([#784](https://github.com/Brad-Edwards/aptl/issues/784)) ([85b3645](https://github.com/Brad-Edwards/aptl/commit/85b36455527141af9d2157fea95656ecc2f8ce55))
+* make MISP event seeding idempotent ([#785](https://github.com/Brad-Edwards/aptl/issues/785)) ([1b7cc40](https://github.com/Brad-Edwards/aptl/commit/1b7cc40671eedbed465f5c33e717f3f940336290))
+* make SEM-218 realization disclosure non-vacuous ([#794](https://github.com/Brad-Edwards/aptl/issues/794)) ([c05fedd](https://github.com/Brad-Edwards/aptl/commit/c05fedd9f64a1bff075e0f0ea49853b8246a7f5f))
+* preserve participant endpoints on repeated starts ([#775](https://github.com/Brad-Edwards/aptl/issues/775)) ([c9b3754](https://github.com/Brad-Edwards/aptl/commit/c9b3754dd5dadce969e87496c40a0debda1e7393))
+* remove seeded volumes during full lab cleanup ([#776](https://github.com/Brad-Edwards/aptl/issues/776)) ([f50593b](https://github.com/Brad-Edwards/aptl/commit/f50593b83b9a91203d56454f33ac58aa3da5afe1))
+* report live host-port remaps accurately ([#774](https://github.com/Brad-Edwards/aptl/issues/774)) ([057d645](https://github.com/Brad-Edwards/aptl/commit/057d6458f868e1364157a4698465a332745105d4))
+* reuse generated credentials in manual SOC seeding ([#777](https://github.com/Brad-Edwards/aptl/issues/777)) ([386a7e0](https://github.com/Brad-Edwards/aptl/commit/386a7e0d7c662cd03e6c80f44e28c6392b68ede7))
+* reuse lab credentials in manual SOC seeding ([386a7e0](https://github.com/Brad-Edwards/aptl/commit/386a7e0d7c662cd03e6c80f44e28c6392b68ede7))
+* scope host port planning to active profiles ([#787](https://github.com/Brad-Edwards/aptl/issues/787)) ([fc31e1a](https://github.com/Brad-Edwards/aptl/commit/fc31e1a74d436d7ced2c3d85baa02e64e3f01787))
+* scope SOC seed and retry to the scenario's selected profiles ([#797](https://github.com/Brad-Edwards/aptl/issues/797)) ([7b7769c](https://github.com/Brad-Edwards/aptl/commit/7b7769c1c6c1e0359575ac5811cf7febe628d250))
+* **security:** content-source deny-list + Linux capability allowlist ([#817](https://github.com/Brad-Edwards/aptl/issues/817)) ([5f8d6a8](https://github.com/Brad-Edwards/aptl/commit/5f8d6a88bbff169f08a8a22bff857af4505cc0d4))
+* serialize first-run Vale bootstrap ([#781](https://github.com/Brad-Edwards/aptl/issues/781)) ([19c1101](https://github.com/Brad-Edwards/aptl/commit/19c1101032b5a8125de9203d7cd29bf62b64bafd))
+* **shuffle:** make the Wazuh-&gt;Shuffle-&gt;TheHive alert-to-case loop work ([#815](https://github.com/Brad-Edwards/aptl/issues/815)) ([b9dc59e](https://github.com/Brad-Edwards/aptl/commit/b9dc59ea70510919cbf8fd7fe2f5098d333e8a2c))
+* surface required prime seed failures ([#786](https://github.com/Brad-Edwards/aptl/issues/786)) ([932c0ea](https://github.com/Brad-Edwards/aptl/commit/932c0eac809ecfd25da4c5b27243dc5c2ffde9ed))
+
+
+### Documentation
+
+* add ADR-047 for ACES experiment admission and trial-plan boundary ([#800](https://github.com/Brad-Edwards/aptl/issues/800)) ([e931d28](https://github.com/Brad-Edwards/aptl/commit/e931d287eb90e3bf55b58dbb06d174773c8ba7bf))
+
 ## [5.0.0](https://github.com/Brad-Edwards/aptl/compare/v4.2.2...v5.0.0) (2026-07-15)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index b61f1c1f..9c8c4445 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "5.0.0"
+version = "5.1.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 57b2c637..5e25876a 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "5.0.0"  # x-release-please-version
+__version__ = "5.1.0"  # x-release-please-version

From 8082a9277d28fdfa52c0d0f7751321ccd67dc270 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Sat, 25 Jul 2026 20:13:02 +0000
Subject: [PATCH 10/16] chore(main): release 5.1.1

---
 .release-please-manifest.json | 2 +-
 CHANGELOG.md                  | 8 ++++++++
 pyproject.toml                | 2 +-
 src/aptl/__init__.py          | 2 +-
 4 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index affd1ab3..6c877557 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.1.0"
+  ".": "5.1.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 25a2e962..96fc4349 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,14 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.1.1](https://github.com/Brad-Edwards/aptl/compare/v5.1.0...v5.1.1) (2026-07-25)
+
+
+### Documentation
+
+* adopt sealed appliance delivery boundary ([#830](https://github.com/Brad-Edwards/aptl/issues/830)) ([98dd2a6](https://github.com/Brad-Edwards/aptl/commit/98dd2a693b300739433535a95f99946e8465bd0c))
+* clarify raes env pack ownership ([#831](https://github.com/Brad-Edwards/aptl/issues/831)) ([5a0ee78](https://github.com/Brad-Edwards/aptl/commit/5a0ee787dcb0ce63b69019ed61114700b3f2527c))
+
 ## [5.1.0](https://github.com/Brad-Edwards/aptl/compare/v5.0.0...v5.1.0) (2026-07-25)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 9c8c4445..3021ef4c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "5.1.0"
+version = "5.1.1"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 5e25876a..6b05cd53 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "5.1.0"  # x-release-please-version
+__version__ = "5.1.1"  # x-release-please-version

From e93eaddd2408d3d7180521dfe5f86dd5ffe3854e Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 3 Sep 2026 02:27:06 +0000
Subject: [PATCH 11/16] chore(main): release 5.2.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 43 +++++++++++++++++++++++++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 6c877557..b5e91573 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.1.1"
+  ".": "5.2.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 96fc4349..1fd0f014 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,49 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.2.0](https://github.com/Brad-Edwards/aptl/compare/v5.1.1...v5.2.0) (2026-09-03)
+
+
+### Features
+
+* add host-side appliance seat launcher for kiosk lifecycle ([#860](https://github.com/Brad-Edwards/aptl/issues/860)) ([c0854bf](https://github.com/Brad-Edwards/aptl/commit/c0854bf902401a9d3ea486d3e7fe97ee52daa8ed))
+* add in-appliance participant workbench ([#835](https://github.com/Brad-Edwards/aptl/issues/835)) ([4a188b9](https://github.com/Brad-Edwards/aptl/commit/4a188b9b777133d8a5f4e44a1ecd9ba9f0f8bc01))
+* add pack backend interaction seam ([#927](https://github.com/Brad-Edwards/aptl/issues/927)) ([ebb4db2](https://github.com/Brad-Edwards/aptl/commit/ebb4db29b2a5bc6b5ebfc93eca75b909c9af8d03))
+* add safe experimental parameter binding ([#857](https://github.com/Brad-Edwards/aptl/issues/857)) ([2726603](https://github.com/Brad-Edwards/aptl/commit/272660373ef63d39e7bbf8fc3d3ae82a7e04c1e1))
+* add versioned disposable lab appliance ([#840](https://github.com/Brad-Edwards/aptl/issues/840)) ([f71a72e](https://github.com/Brad-Edwards/aptl/commit/f71a72ea59194493334a93db49831855472b1250))
+* define bounded participant lab profile ([#836](https://github.com/Brad-Edwards/aptl/issues/836)) ([621b4cb](https://github.com/Brad-Edwards/aptl/commit/621b4cb5346c3b2ee494bc07dd455eac3cc86fca))
+* enforce appliance network boundary ([#838](https://github.com/Brad-Edwards/aptl/issues/838)) ([f7d343f](https://github.com/Brad-Edwards/aptl/commit/f7d343fa2bf22e5ab76b34479eb4d4e3bd7568c9))
+* **evidence:** add portable research evidence bundle export (EXP-008) ([#873](https://github.com/Brad-Edwards/aptl/issues/873)) ([a6322b3](https://github.com/Brad-Edwards/aptl/commit/a6322b3c3138a42a4880be1a1be0b65a5206da68))
+* honest per-dimension runtime readback for dynamic composition ([#876](https://github.com/Brad-Edwards/aptl/issues/876)) ([#893](https://github.com/Brad-Edwards/aptl/issues/893)) ([3db5171](https://github.com/Brad-Edwards/aptl/commit/3db5171f3e4add842efd1d81fa0d4fe078511b7e))
+* qualify bounded RAES participant agency ([#855](https://github.com/Brad-Edwards/aptl/issues/855)) ([19014ac](https://github.com/Brad-Edwards/aptl/commit/19014ac209c41599ffa3832de26995f23f62eca2))
+* **raes:** declare Cortex index as ADR-088 initial service state, native materializer + readback ([#889](https://github.com/Brad-Edwards/aptl/issues/889)) ([#911](https://github.com/Brad-Edwards/aptl/issues/911)) ([aaf9235](https://github.com/Brad-Edwards/aptl/commit/aaf9235b43fcafbff352ae1afcef33f31e5041c7))
+* record run-scoped apparatus and detection-content provenance ([#871](https://github.com/Brad-Edwards/aptl/issues/871)) ([ca648f1](https://github.com/Brad-Edwards/aptl/commit/ca648f10fbd08bc2a9468315ae7545958b3d5f54))
+* rename ACES to RAES and migrate to the raes 1.1.0 distribution ([#846](https://github.com/Brad-Edwards/aptl/issues/846)) ([ced66dc](https://github.com/Brad-Edwards/aptl/commit/ced66dcc408b0462dc7ea774b5332fb7fd0627a1))
+* **scenario:** declare TechVault content in the SDL via the env-pack ([#875](https://github.com/Brad-Edwards/aptl/issues/875)) ([#908](https://github.com/Brad-Edwards/aptl/issues/908)) ([4dcf07b](https://github.com/Brad-Edwards/aptl/commit/4dcf07bd9c61184cbe9e137eacc6df67753e8819))
+* **scenario:** realization contract for TechVault, scenario-verification plugin seam, and standup fixes ([#866](https://github.com/Brad-Edwards/aptl/issues/866)) ([#890](https://github.com/Brad-Edwards/aptl/issues/890)) ([7b21cdb](https://github.com/Brad-Edwards/aptl/commit/7b21cdbda7b497b7249e3e779e41754ef6a20d4f))
+* seal ACES run and evidence records for terminal execution attempts ([#872](https://github.com/Brad-Edwards/aptl/issues/872)) ([1f6d17e](https://github.com/Brad-Edwards/aptl/commit/1f6d17e58d12ff23714be354aa75794b0de3ab85))
+
+
+### Bug Fixes
+
+* adopt OpenSSF Scorecard and remediate the supply-chain findings it reported ([#850](https://github.com/Brad-Edwards/aptl/issues/850)) ([20ed98f](https://github.com/Brad-Edwards/aptl/commit/20ed98f761a96355202a33f8cb5fa4437a3292ea))
+* bind explicit models to installed participants ([#865](https://github.com/Brad-Edwards/aptl/issues/865)) ([e2b8241](https://github.com/Brad-Edwards/aptl/commit/e2b8241de84a2f9b780f3d3153b640639e4fae82))
+* **ci:** allow exact dev promotion titles ([#941](https://github.com/Brad-Edwards/aptl/issues/941)) ([95b16d5](https://github.com/Brad-Edwards/aptl/commit/95b16d525106d1cf91e4a15c9a1912e96f8038f2))
+* clear appliance boundary quality gate ([#839](https://github.com/Brad-Edwards/aptl/issues/839)) ([5a6c113](https://github.com/Brad-Edwards/aptl/commit/5a6c1137ff90c5fc716bd7a21af61fb83a5aeac6))
+* complete participant workbench integration ([#837](https://github.com/Brad-Edwards/aptl/issues/837)) ([583e100](https://github.com/Brad-Edwards/aptl/commit/583e100853ac42240de4827678a20d94edb93d7d))
+* harden lab lifecycle recovery ([#933](https://github.com/Brad-Edwards/aptl/issues/933)) ([fece8b2](https://github.com/Brad-Edwards/aptl/commit/fece8b2ff6098b2d12a1b08fabfa3f3534950d55))
+* make participant credential sourcing explicit ([#928](https://github.com/Brad-Edwards/aptl/issues/928)) ([96302e4](https://github.com/Brad-Edwards/aptl/commit/96302e4686f46012b47b5ba4c0db88f63c3ff61d))
+* preserve bounded participant execution semantics ([#861](https://github.com/Brad-Edwards/aptl/issues/861)) ([0f0d8ee](https://github.com/Brad-Edwards/aptl/commit/0f0d8ee775562ee8558fd309e209a46dae024df8))
+* **quality:** resolve SonarCloud new-code findings blocking the dev gate ([#938](https://github.com/Brad-Edwards/aptl/issues/938)) ([8689d02](https://github.com/Brad-Edwards/aptl/commit/8689d02a6514493b9927b190bf0643a580438f05))
+
+
+### Documentation
+
+* add Ground Control requirement specs as repo-local files ([#904](https://github.com/Brad-Edwards/aptl/issues/904)) ([9320c7a](https://github.com/Brad-Edwards/aptl/commit/9320c7af3d03debdd3d1b558af466f8d7262884c))
+* cross-reference the OpenRAE env-pack companion repo ([#926](https://github.com/Brad-Edwards/aptl/issues/926)) ([15dead9](https://github.com/Brad-Edwards/aptl/commit/15dead977ac73eef2d57128c432970a39c659c9f))
+* name the scenario language in full in the readme ([#844](https://github.com/Brad-Edwards/aptl/issues/844)) ([0b3c61c](https://github.com/Brad-Edwards/aptl/commit/0b3c61c1a2279692cf33cafe7a8b98ba7e209dbb))
+* sync branch-protection baseline with live required checks ([#854](https://github.com/Brad-Edwards/aptl/issues/854)) ([8280f20](https://github.com/Brad-Edwards/aptl/commit/8280f203dd122e5e9c78d1b1199ebd67c5516a04))
+
 ## [5.1.1](https://github.com/Brad-Edwards/aptl/compare/v5.1.0...v5.1.1) (2026-07-25)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index f18408be..d03ca355 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "5.1.1"
+version = "5.2.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 6b05cd53..5f8d2c39 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "5.1.1"  # x-release-please-version
+__version__ = "5.2.0"  # x-release-please-version

From d44bd2f5c19f59fdf569677b256422557884f71a Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Fri, 11 Sep 2026 00:00:43 +0000
Subject: [PATCH 12/16] chore(main): release 5.3.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 25 +++++++++++++++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 28 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index b5e91573..ce65b73e 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.2.0"
+  ".": "5.3.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1fd0f014..431fded2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,31 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.3.0](https://github.com/Brad-Edwards/aptl/compare/v5.2.0...v5.3.0) (2026-09-11)
+
+
+### Features
+
+* define scenario verification plugin seam ([#973](https://github.com/Brad-Edwards/aptl/issues/973)) ([ff73990](https://github.com/Brad-Edwards/aptl/commit/ff739906acb342a7735fecf10f41017ed8ae7c45))
+* realize runtime orchestration authority ([#959](https://github.com/Brad-Edwards/aptl/issues/959)) ([6539050](https://github.com/Brad-Edwards/aptl/commit/65390508db54d118b4dd685db742f3a282b4f366))
+* **scenario:** qualify verifier compatibility atomically and install it on the gate path ([#982](https://github.com/Brad-Edwards/aptl/issues/982)) ([e83dd86](https://github.com/Brad-Edwards/aptl/commit/e83dd86f05db1753128176ac0efdfd799237cb3e))
+
+
+### Bug Fixes
+
+* derive lab-start pre-flight from the admitted realization ([#960](https://github.com/Brad-Edwards/aptl/issues/960)) ([170593a](https://github.com/Brad-Edwards/aptl/commit/170593a6a9b4dc8aac1b4f47bfb209318102cd62))
+* retire Shuffle post-realization mutation ([#950](https://github.com/Brad-Edwards/aptl/issues/950)) ([b6928e5](https://github.com/Brad-Edwards/aptl/commit/b6928e52fdf6f88d02a4422b3592f4f003f1e3c6))
+* **workbench:** escalate group teardown unconditionally and stop reading EPERM as presence ([#997](https://github.com/Brad-Edwards/aptl/issues/997)) ([7c673a1](https://github.com/Brad-Edwards/aptl/commit/7c673a19f9fb6a3eb1d17305104196b600bd59cc))
+
+
+### Documentation
+
+* audit APTL-to-LilRAE rename boundary ([#972](https://github.com/Brad-Edwards/aptl/issues/972)) ([201b258](https://github.com/Brad-Edwards/aptl/commit/201b25835ba394ef1acb7444a08ab6a0b149c143))
+* clarify scenario-pack ownership terminology ([#975](https://github.com/Brad-Edwards/aptl/issues/975)) ([fb7d535](https://github.com/Brad-Edwards/aptl/commit/fb7d53562277fbab513425ddd3994b5393680600))
+* clarify scenario-pack terminology ([fb7d535](https://github.com/Brad-Edwards/aptl/commit/fb7d53562277fbab513425ddd3994b5393680600))
+* record capture asset ownership ([#981](https://github.com/Brad-Edwards/aptl/issues/981)) ([e76f66f](https://github.com/Brad-Edwards/aptl/commit/e76f66f898817381113290b6a49b428bee0329b5))
+* review APTL readiness for LilRAE migration ([#971](https://github.com/Brad-Edwards/aptl/issues/971)) ([d48d2b7](https://github.com/Brad-Edwards/aptl/commit/d48d2b7e7fb1c1828b2982be917b7b0a98aa6db1))
+
 ## [5.2.0](https://github.com/Brad-Edwards/aptl/compare/v5.1.1...v5.2.0) (2026-09-03)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 8bd5e2cb..f3cb5fdb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "5.2.0"
+version = "5.3.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 5f8d2c39..b884a412 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "5.2.0"  # x-release-please-version
+__version__ = "5.3.0"  # x-release-please-version

From 2389ecaf6a19fc60f087846a84357aa303c4a766 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 15 Sep 2026 20:09:45 +0000
Subject: [PATCH 13/16] chore(main): release 5.3.1

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 15 +++++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index ce65b73e..e3690fe1 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.3.0"
+  ".": "5.3.1"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 431fded2..fdc9a033 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,21 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.3.1](https://github.com/Brad-Edwards/aptl/compare/v5.3.0...v5.3.1) (2026-09-15)
+
+
+### Bug Fixes
+
+* **env:** reconcile hash-pinned indexer/dashboard fixtures during .env hydration ([#1023](https://github.com/Brad-Edwards/aptl/issues/1023)) ([31d8f85](https://github.com/Brad-Edwards/aptl/commit/31d8f853688c02e3c1047d27e5868eddd53750a2)), closes [#1021](https://github.com/Brad-Edwards/aptl/issues/1021)
+* prevent partial lab startup success ([#1001](https://github.com/Brad-Edwards/aptl/issues/1001)) ([16dc3d3](https://github.com/Brad-Edwards/aptl/commit/16dc3d38694b4017f5c6afcfa50a123cf8279ae2))
+* **readiness:** quiet Wazuh API warm-up and fail closed on persistent failure ([#1016](https://github.com/Brad-Edwards/aptl/issues/1016)) ([29bc37e](https://github.com/Brad-Edwards/aptl/commit/29bc37efea39a8cc8179826394fe5590b15077d8))
+* **validation:** stop BC-09's fixture losing the timeout race to its own setup ([#1008](https://github.com/Brad-Edwards/aptl/issues/1008)) ([d66d7b5](https://github.com/Brad-Edwards/aptl/commit/d66d7b566815ad08eb057b2f82b245aac75c682c))
+
+
+### Documentation
+
+* align CLI-003 with the current lab start sequence and ADR-030 failure policy ([#1019](https://github.com/Brad-Edwards/aptl/issues/1019)) ([30e876e](https://github.com/Brad-Edwards/aptl/commit/30e876eb26d4314b17e4cb2fd3d801b9567d8b58))
+
 ## [5.3.0](https://github.com/Brad-Edwards/aptl/compare/v5.2.0...v5.3.0) (2026-09-11)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index f3cb5fdb..48e9fa80 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "5.3.0"
+version = "5.3.1"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index b884a412..a1b569a1 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "5.3.0"  # x-release-please-version
+__version__ = "5.3.1"  # x-release-please-version

From 0e3c6d000f37beac21b299abd4a2995df0e47ba3 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 02:51:21 +0000
Subject: [PATCH 14/16] chore(main): release 5.4.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 14 ++++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index e3690fe1..448d10af 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.3.1"
+  ".": "5.4.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fdc9a033..8f7f79e4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,20 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.4.0](https://github.com/Brad-Edwards/aptl/compare/v5.3.1...v5.4.0) (2026-09-16)
+
+
+### Features
+
+* add scope-aware backend evidence capture ([#1020](https://github.com/Brad-Edwards/aptl/issues/1020)) ([3414c83](https://github.com/Brad-Edwards/aptl/commit/3414c83a001de6076c190496d875b8a081163908))
+* **deployment:** honor a unix:// DOCKER_HOST for the local Docker control endpoint ([#1039](https://github.com/Brad-Edwards/aptl/issues/1039)) ([d4ec7c7](https://github.com/Brad-Edwards/aptl/commit/d4ec7c7af977ab4a006841f3f5d8d58f98a6fea8))
+
+
+### Bug Fixes
+
+* synchronize Starlette lock state ([ace1bda](https://github.com/Brad-Edwards/aptl/commit/ace1bdaced395f7929ff718a1166127e90a477a8))
+* synchronize starlette lock state ([#1035](https://github.com/Brad-Edwards/aptl/issues/1035)) ([ace1bda](https://github.com/Brad-Edwards/aptl/commit/ace1bdaced395f7929ff718a1166127e90a477a8))
+
 ## [5.3.1](https://github.com/Brad-Edwards/aptl/compare/v5.3.0...v5.3.1) (2026-09-15)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 3d8a8fa0..8f260ed6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "5.3.1"
+version = "5.4.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index a1b569a1..8f8008ef 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "5.3.1"  # x-release-please-version
+__version__ = "5.4.0"  # x-release-please-version

From 4fade493e3fd8951bb43f0a112766e3b935a428a Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 17 Sep 2026 05:01:40 +0000
Subject: [PATCH 15/16] chore(main): release 5.5.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 13 +++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 448d10af..9bf38528 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.4.0"
+  ".": "5.5.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8f7f79e4..43ef9f30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,19 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.5.0](https://github.com/Brad-Edwards/aptl/compare/v5.4.0...v5.5.0) (2026-09-17)
+
+
+### Features
+
+* enforce scope-aware TechVault evidence capture ([#1046](https://github.com/Brad-Edwards/aptl/issues/1046)) ([042be31](https://github.com/Brad-Edwards/aptl/commit/042be3176a63fda24eef9e8267e6fce5212eb6c0))
+* **mcp:** resolve MCP client host ports from the lab's remapped publications ([#1047](https://github.com/Brad-Edwards/aptl/issues/1047)) ([eb618a9](https://github.com/Brad-Edwards/aptl/commit/eb618a940aa242c29ffe5fa6c80d21ce268cc9c4))
+
+
+### Bug Fixes
+
+* **certs:** run the Wazuh cert generator as container-root under rootless Docker ([#1044](https://github.com/Brad-Edwards/aptl/issues/1044)) ([6b65e71](https://github.com/Brad-Edwards/aptl/commit/6b65e71421a032c9512ff195dd3aaa7c85f838e1))
+
 ## [5.4.0](https://github.com/Brad-Edwards/aptl/compare/v5.3.1...v5.4.0) (2026-09-16)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index 7fd5cab3..0406c6ba 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "5.4.0"
+version = "5.5.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 8f8008ef..4bf53b4e 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "5.4.0"  # x-release-please-version
+__version__ = "5.5.0"  # x-release-please-version

From c08652e74e03ee34a111d673d5cf994805681c33 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Tue, 22 Sep 2026 05:35:00 +0000
Subject: [PATCH 16/16] chore(main): release 5.6.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 35 +++++++++++++++++++++++++++++++++++
 pyproject.toml                |  2 +-
 src/aptl/__init__.py          |  2 +-
 4 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index 9bf38528..d49c9e28 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "5.5.0"
+  ".": "5.6.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 43ef9f30..b5e30900 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,41 @@ This file is maintained by [release-please](https://github.com/googleapis/releas
 from Conventional Commit messages; release sections are generated on release,
 not hand-edited in PRs.
 
+## [5.6.0](https://github.com/Brad-Edwards/aptl/compare/v5.5.0...v5.6.0) (2026-09-22)
+
+
+### Features
+
+* add installed scenario pack adapter seams ([#1141](https://github.com/Brad-Edwards/aptl/issues/1141)) ([9b86286](https://github.com/Brad-Edwards/aptl/commit/9b86286c5cd69066182393f31088a784270daa39))
+* **appliance:** deliver qualified KVM seats and public artifacts ([#1107](https://github.com/Brad-Edwards/aptl/issues/1107)) ([35ebb3b](https://github.com/Brad-Edwards/aptl/commit/35ebb3bead57f340c50e4b299dc0b34e6323d0db))
+* integrate full TechVault delivery and host MCP access ([#1102](https://github.com/Brad-Edwards/aptl/issues/1102)) ([ffecaf0](https://github.com/Brad-Edwards/aptl/commit/ffecaf079038277dca6ac6bee272cbb8324237e6))
+* scope backend resource ownership ([#1054](https://github.com/Brad-Edwards/aptl/issues/1054)) ([d9dfbb6](https://github.com/Brad-Edwards/aptl/commit/d9dfbb6e34170c8607fa125f5ec73ace30222438))
+
+
+### Bug Fixes
+
+* address backend resources by their workspace-scoped names in integration tests ([#1104](https://github.com/Brad-Edwards/aptl/issues/1104)) ([1448f16](https://github.com/Brad-Edwards/aptl/commit/1448f16299f3a146bf04cf50c005ac8541ef2ec5))
+* **detection,mcp:** fire custom Suricata rules (303020) and repair MISP add_indicator ([#1036](https://github.com/Brad-Edwards/aptl/issues/1036)) ([ba41876](https://github.com/Brad-Edwards/aptl/commit/ba418763a87eb250f7631de09afdc5f708cdf451))
+* **detection,mcp:** fire custom Suricata rules and repair MISP add_indicator ([ba41876](https://github.com/Brad-Edwards/aptl/commit/ba418763a87eb250f7631de09afdc5f708cdf451)), closes [#1034](https://github.com/Brad-Edwards/aptl/issues/1034)
+* ground Wazuh evidence and scenario credentials ([#1152](https://github.com/Brad-Edwards/aptl/issues/1152)) ([d1871df](https://github.com/Brad-Edwards/aptl/commit/d1871df37dc7180da664c4128075c203f68aa7df))
+* make issue 956 lab startup and QA reliable ([#1110](https://github.com/Brad-Edwards/aptl/issues/1110)) ([5a2a9b1](https://github.com/Brad-Edwards/aptl/commit/5a2a9b1e47fa64095f7429b1e61f6346ad61eec6))
+* realize authored spawn-template images as written ([#1131](https://github.com/Brad-Edwards/aptl/issues/1131)) ([3ce89ad](https://github.com/Brad-Edwards/aptl/commit/3ce89ad5d65251d646b78589e5d9a82a420a7132)), closes [#974](https://github.com/Brad-Edwards/aptl/issues/974)
+* realize SDL runtime authority as authored ([#1108](https://github.com/Brad-Edwards/aptl/issues/1108)) ([18dcc70](https://github.com/Brad-Edwards/aptl/commit/18dcc7026f7cfb6922a689861123e255b99b0fa4))
+* realize unfixed host publications and persist workflow history ([#1142](https://github.com/Brad-Edwards/aptl/issues/1142)) ([faf39e3](https://github.com/Brad-Edwards/aptl/commit/faf39e3c1b1f9ca387f4efe29e07dd0583f99755))
+* remove helpers stranded by a killed aptl process on stop ([#1147](https://github.com/Brad-Edwards/aptl/issues/1147)) ([a810dac](https://github.com/Brad-Edwards/aptl/commit/a810daca81974674e586dbee1631afe6cccc797f))
+* retire MISP and Redis post-realization mutation ([#1109](https://github.com/Brad-Edwards/aptl/issues/1109)) ([e6bef3c](https://github.com/Brad-Edwards/aptl/commit/e6bef3c6f61d368a560f373fca28e123ed193065))
+* **security:** drop privileges to install the operator key and keep credentials off argv ([#1106](https://github.com/Brad-Edwards/aptl/issues/1106)) ([0b2e0d2](https://github.com/Brad-Edwards/aptl/commit/0b2e0d293ab35418a7f72d1c62aec2b0bdf95e7a))
+* stop helper containers and anonymous volumes outliving teardown ([#1145](https://github.com/Brad-Edwards/aptl/issues/1145)) ([5d3ab1f](https://github.com/Brad-Edwards/aptl/commit/5d3ab1f4c0e3527b23482183011b265acdc933c5))
+* stop the TechVault build cache accepting caller-supplied paths ([#1154](https://github.com/Brad-Edwards/aptl/issues/1154)) ([dd9145b](https://github.com/Brad-Edwards/aptl/commit/dd9145bcfec61533b328672a71ac5d38e10f52c2))
+
+
+### Documentation
+
+* improve first-time lab guidance ([#1150](https://github.com/Brad-Edwards/aptl/issues/1150)) ([8bb1529](https://github.com/Brad-Edwards/aptl/commit/8bb1529048237f7e82fd49b04fb17dccdc016a18))
+* prepare badge and dual docs publishing ([5b57bbc](https://github.com/Brad-Edwards/aptl/commit/5b57bbc03552dca66a3b7419a1963c396aa90db2))
+* prepare OpenSSF badge and dual docs publishing ([#1153](https://github.com/Brad-Edwards/aptl/issues/1153)) ([5b57bbc](https://github.com/Brad-Edwards/aptl/commit/5b57bbc03552dca66a3b7419a1963c396aa90db2))
+* record issue 956 candidate manual QA ([#1111](https://github.com/Brad-Edwards/aptl/issues/1111)) ([4d55a94](https://github.com/Brad-Edwards/aptl/commit/4d55a9498192ba9e3803f04e864ccd08508a1b93))
+
 ## [5.5.0](https://github.com/Brad-Edwards/aptl/compare/v5.4.0...v5.5.0) (2026-09-17)
 
 
diff --git a/pyproject.toml b/pyproject.toml
index af7e0cca..2e426289 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "aptl-labs"
-version = "5.5.0"
+version = "5.6.0"
 description = "Advanced Purple Team Lab CLI"
 readme = "README.md"
 requires-python = ">=3.11"
diff --git a/src/aptl/__init__.py b/src/aptl/__init__.py
index 4bf53b4e..c4135721 100644
--- a/src/aptl/__init__.py
+++ b/src/aptl/__init__.py
@@ -6,4 +6,4 @@
 # pyproject.toml, not this src-layout __init__.py). Keep the annotation comment
 # on the same line as the literal, and keep the literal equal to pyproject's
 # `version` — test_version_consistency.py enforces the latter.
-__version__ = "5.5.0"  # x-release-please-version
+__version__ = "5.6.0"  # x-release-please-version