Update changelog: CLI v2.36.4 and Aug 4-7 Platform releases

[mintlify]

Summary

Adds changelog entries for CLI v2.36.4 and the Platform releases dated August 4, 5, and 7, 2026.

Changes

• CLI v2.36.4: kosli attest attachments fix (no longer chowns when staging multi-path attachments).
• Platform, August 4: rich override attestation view; fix for trail-by-artifact lookups failing with flow_tag.
• Platform, August 5: login email autofocus; htmx off-canvas double-login fix.
• Platform, August 7: SCIM role changes sync from Descope; React pages redirect to login on session timeout; unmatched /api/* returns JSON 404.

Context

• CLI v2.36.5 (chore/deps and tests only) skipped — no user-facing changes.
• Server release-2026-08-06 skipped — only deps bumps and expand-phase refactor with nothing user-visible.
• No new kosli-dev/terraform-provider-kosli tags in window.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
kosli	🔴 Failed	–	Aug 10, 2026, 9:10 AM

[claude]

Claude finished @mintlify[bot]'s task in 1m 56s —— View job

---

PR Review: Changelog updates

• Read CLAUDE.md and doc-review skill
• Read changed file (changelog/index.mdx)
• Check for content/formatting issues
• Post review findings

---

Findings

No critical issues found. The entries are well-written, follow existing changelog conventions, and comply with CLAUDE.md.

Improvement

Location	Issue	Recommendation
changelog/index.mdx:42	Link text says `kosli attest` reference but target is the kosli attest artifact page (/client_reference/kosli_attest_artifact).	Update text to `kosli attest artifact` reference so it matches the linked page. (See inline suggestion.)

Suggestions

Location	Issue	Recommendation
changelog/index.mdx:12-13	Aug 7 "React pages redirect to login on session timeout" and "Unmatched /api/* returns JSON 404" are listed under Updates but both describe fixing incorrect behavior (generic error / HTML redirect for API calls).	Consider moving these to a Bug fixes section for consistency with how similar items are categorized elsewhere.

What looks good

• Reverse chronological order is correct (Aug 7 → 5 → 4 → 3).
• <Update> component format matches existing entries: description="" for Platform, description="v2.36.4" for CLI.
• Internal link /client_reference/kosli_attest_artifact resolves to an existing page.
• No relative links — all root-relative.
• Writing style follows CLAUDE.md (active voice, "Kosli" not "the Kosli platform", American spelling).
• No new pages added, so no config/navigation.json update needed.

Build status

The Mintlify preview deployment failed. This doesn't appear to be caused by the changelog content (format matches existing entries exactly). Worth checking the Mintlify dashboard for build logs.

---

Summary

Clean changelog PR with 4 well-structured entries. One minor link-text accuracy suggestion (inline comment posted) and one categorization suggestion. No blockers.

[claude]

Suggestion: The link text says `kosli attest` reference but points to the kosli_attest_artifact page. Consider updating the text to match the actual target:

Suggested change

- **`kosli attest` no longer fails on container-produced attachments** — passing two or more `--attachments` paths could abort with `chown ...: operation not permitted` when an attachment (for example lint, test, or coverage output) had been written by a Docker container running as a different user. The CLI no longer tries to preserve file ownership when staging attachments for upload. A genuine copy error now also names the evidence path you passed rather than an internal temp directory. See the [`kosli attest` reference](/client_reference/kosli_attest_artifact) for usage.

- **`kosli attest` no longer fails on container-produced attachments** — passing two or more `--attachments` paths could abort with `chown ...: operation not permitted` when an attachment (for example lint, test, or coverage output) had been written by a Docker container running as a different user. The CLI no longer tries to preserve file ownership when staging attachments for upload. A genuine copy error now also names the evidence path you passed rather than an internal temp directory. See the [`kosli attest artifact` reference](/client_reference/kosli_attest_artifact) for usage.