chore(release): 3.29.0 [skip ci]

# [3.29.0](v3.28.0...v3.29.0) (2026-04-22)

### Bug Fixes

* **evidence-export:** address review feedback on streaming export ([3814e33](3814e33))
* **evidence-export:** address two follow-up review findings ([752ed24](752ed24)), closes [#2640](#2640)
* **evidence-export:** tighten S3 missing-object check to specific error codes ([317d407](317d407))

### Features

* **evidence-export:** include task attachments and stream large ZIPs ([1bc86d8](1bc86d8))

chore(release): 3.28.0 [skip ci]

# [3.28.0](v3.27.6...v3.28.0) (2026-04-22)

### Bug Fixes

* **admin-organizations:** harden org purge against silent failures ([3d179d9](3d179d9))
* **admin-organizations:** harden purge per security review ([fae4aeb](fae4aeb))
* **admin-organizations:** make completion audit best-effort; verify non-prefix S3 keys ([463bcab](463bcab))
* ff timeline in framework tab ([987ad1e](987ad1e))

### Features

* **admin:** add platform-admin endpoint to permanently purge an organization ([3cf3b2d](3cf3b2d))

chore(release): 3.27.6 [skip ci]

## [3.27.6](v3.27.5...v3.27.6) (2026-04-22)

### Bug Fixes

* **db:** increase prisma transaction timeout from 30s to 60s ([8d1764a](8d1764a))

chore(release): 3.27.5 [skip ci]

## [3.27.5](v3.27.4...v3.27.5) (2026-04-21)

### Bug Fixes

* **devices:** soften stale tooltip copy to not prescribe a single cause ([71053b6](71053b6))

chore(release): 3.27.4 [skip ci]

## [3.27.4](v3.27.3...v3.27.4) (2026-04-21)

### Bug Fixes

* **devices:** show stale as distinct state on /people device column ([#2629](#2629)) ([6e1a06f](6e1a06f))

chore(release): 3.27.3 [skip ci]

## [3.27.3](v3.27.2...v3.27.3) (2026-04-21)

### Bug Fixes

* **devices:** propagate three-state compliance to employee & device drill-ins (CS-276) ([b56f7dc](b56f7dc))

chore(release): 3.27.2 [skip ci]

## [3.27.2](v3.27.1...v3.27.2) (2026-04-21)

### Bug Fixes

* **digest:** key policy acknowledgment rollup by email, not user.id ([#2624](#2624)) ([75c8888](75c8888))

chore(release): 3.27.1 [skip ci]

## [3.27.1](v3.27.0...v3.27.1) (2026-04-21)

### Bug Fixes

* **api,app:** unblock onboarding frameworks list for users without active org ([8fee034](8fee034))

chore(release): 3.27.0 [skip ci]

# [3.27.0](v3.26.1...v3.27.0) (2026-04-20)

### Bug Fixes

* **devices:** flag stale device agents as non-compliant + CSV export ([#2612](#2612)) ([0d59e8f](0d59e8f))
* **integration-platform:** preserve VCS url fragments in python matcher ([f820738](f820738))
* **integration-platform:** use toml-aware comment stripping for pyproject.toml ([2cf8979](2cf8979))
* **integrations-catalog:** add global request pacing to prevent 429s ([0dfb793](0dfb793))

### Features

* add compliance timeline to overview (feature flagged) ([26c04d8](26c04d8))
* **integration-platform:** expand validation library detection for sanitized inputs check ([964cb1b](964cb1b))
* **integrations-catalog:** add public catalog ([ea297de](ea297de))

### Reverts

* Revert "chore(app): remove the duplicated prisma/ setup" ([#2621](#2621)) ([a1889a1](a1889a1))

chore(release): 3.26.1 [skip ci]

## [3.26.1](v3.26.0...v3.26.1) (2026-04-20)

### Bug Fixes

* **rbac:** gate Auditor View tab on audit:read instead of role string (CS-189) ([fa52778](fa52778))
* **rbac:** scope Auditor View to explicit auditor roles (CS-189 follow-up) ([d7c3936](d7c3936))