v0.2.0

Release notes

Features

• Global dry-run via defaults.dryRun (bool, default false): the whole policy is evaluated but no deny is enforced; every request returns 200.
• Access log and metrics report the verdict each request would have received. Shadow denies log decision: deny with dry_run: true at WARN.
• Metrics count shadow denies under request_validator_rule_decisions_total{outcome="deny",dry_run="true"}.

Fixes

• Per-rule dryRun no longer reports decision: allow for a rule that would deny; the access log now shows the real verdict (decision: deny, dry_run: true). Enforcement suppression moved from the evaluator to the HTTP layer.
• Body-read failures pass through with 200 under global dry-run instead of returning 403.

Behavior changes

• x-rv-result always carries the real verdict; x-rv-dry-run is true when enforcement is suppressed by either the deciding rule's dryRun or defaults.dryRun.

v0.1.0

🚀 Initial Release!!