release: 3.7.7

[CryptoJones]

Cuts 3.7.7 — the follow-up batch to 3.7.6, resolving the seven deferred findings from the 2026-07-01 adversarial code review.

• Security: web stored-XSS sanitization (DOMPurify) + Host allowlist (Web UI: sanitize rendered note HTML (stored XSS) and add localhost auth / Host allowlist #125)
• Changed: macOS CI + wheel smoke test (CI: add macOS to the test matrix and build + smoke-test the wheel #126); dependency upper bounds + install-by-tag (Packaging: pin runtime dependency upper bounds and install the fleet by tag #131)
• Fixed: graph render perf/leaks (Web UI: fix O(n^2) synchronous graph settle and leaked render loops #129); store cache lock + MCP graph cache (MCP server + web: run vault I/O off the event loop and lock the shared store #130); tombstone TTL (Mesh: expire / GC tombstones so a re-created note is not silently deleted #127); per-session loop-guard scoping (loopguard: scope the autonomous-loop guard per session #128)

Version bumped in lockstep (pyproject.toml / __init__.py / uv.lock); [Unreleased] moved to [3.7.7]. Full suite 724 passed, ruff + mypy clean.

🤖 Generated with Claude Code

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/