release: 2.27.0

[Masterplanner25]

Release 2.27.0

Version 2.27.0, Dockerfile pin, four changelog fragments folded and promoted (one status sentence — "has been red on every PR" — corrected on promotion; fresh ## Unreleased left above), app handoff docs/upgrades/APP_HANDOFF_v2.27.0.md + upgrades index row, CLAUDE.md points at the new handoff.

Contents: #810 (python-jose → PyJWT, CVE-2026-85394; pymongo 4.18.2; Boot Smoke DEC-098), #811 + #813 (Dependabot batch), #814 (FR-52 once-per-module-set check; PyJWT[crypto]). Answers the app's FR-51 and FR-52.

Checklist:

• Schema: git diff v2.26.0..HEAD -- AINDY/db/models/ AINDY/memory/memory_persistence.py empty → Alembic 0020, contract 2026-09-20; Upgrade Path Guard passes trivially, negative control carries the meaning.
• Scopes: no enforce_api_key_scope added under AINDY/routes/.
• First-party ecosystem pins (nodus-lang/nodus-mcp): unchanged.
• Release notes read for every moved pin: pymongo 4.18.2 (3 CVEs, the reason), PyJWT (new), starlette 1.7.0 (background tasks after response under BaseHTTPMiddleware — neither repo uses it; multipart 400; anyio>=4), regex (heap OOB write at compile, underflow, segfault — no importer in runtime or app), mako 1.4.2 (Windows-only template traversal — Mako is only Alembic's template), charset-normalizer 3.5.2, pyphen 0.18 (dictionaries, py3.14). Exposure recorded in the handoff §3.
• App source checked 2026-10-09: no import of jose/ecdsa/rsa/pyasn1; the four FR-51 ignore IDs are in their workflow.
• The app's 2.25.0 recall-failure readout (10-09, zero for 7 days) clears DEC-083's AINDY_MEMORY_RECALL_OWN_SESSION flip — not in this release; named in the handoff §4 as the next one.

After merge: wait for main's push CI on the merge commit, then annotated tag v2.27.0 → publish.yml (PyPI + Boot Smoke on the published wheel) → sandbox-escape tag run → audit Entry 041.

🤖 Generated with Claude Code