diff --git a/CHANGELOG.md b/CHANGELOG.md
index e624938..5898a16 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,10 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.20.0] - 2026-10-27
+
 ### Added
 
 - **Path-scoped `ignore.rules` (#680).** An entry can be an object, `- rule: bug-println` with `files: ["crates/cli/**"]` and an optional `reason`, to silence a rule in some directories only while it keeps firing elsewhere; plain strings still silence a rule everywhere. An empty `files` list is a config error. Works in `review`, `scan` and the MCP tools. See `docs/configuration.md`.
 - **Cora Review can use Anthropic workload identity federation (no stored API key).** The review job exchanges its GitHub OIDC token for a short-lived Anthropic access token (when `ANTHROPIC_FEDERATION_RULE_ID`, `ANTHROPIC_ORGANIZATION_ID`, `ANTHROPIC_SERVICE_ACCOUNT_ID` and `ANTHROPIC_WORKSPACE_ID` are set) and sends it only to `api.anthropic.com`; otherwise it falls back to `CORA_API_KEY`, `CORA_BASE_URL` and `CORA_MODEL`. A smoke test workflow verifies the exchange and a Bearer call to `/v1/chat/completions`. See `docs/examples.md`.
+- **`cora.scan_prepare` speaks the CLI's selection language (#686).** The MCP tool accepts `include`/`exclude` globs, `extensions`, `incremental` and `changed_since` (git rev), orders batches source-first (code before docs/data/lockfiles, shallower first; `order: "path"` keeps walk order), and returns planning data — `total_chars`, `estimated_tokens` and per-batch file counts — so an agent can scope a scan before spending tokens. `cora.scan_finalize` takes the same inputs; a fingerprint mismatch refuses the call. See `docs/usage.md`.
 - **Agents validate before they commit (#674).** A review of the staged diff, by an agent (`cora.review_finalize`) or by `cora review --staged`, now leaves a marker bound to that exact change set. `cora hook verify` reports it (exit 0 validated, 10 validated but blocking, 11 not validated) and `cora hook claude-guard` is a Claude Code `PreToolUse` hook that denies a `git commit` that is unreviewed, blocking, uses `--no-verify`, or is not a plain commit of the staged change. The pre-commit hook (now v2, upgraded in place by `cora hook install`) accepts a validated diff and otherwise falls back to `cora review --staged --ci --severity major`; a tooling error is reported as "not a pass". The `/cora-review` skill tells agents to review before every commit. See `docs/usage.md`.
 
 ### Fixed
diff --git a/Cargo.lock b/Cargo.lock
index af45535..a1ed358 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -309,7 +309,7 @@ dependencies = [
 
 [[package]]
 name = "cora-code"
-version = "0.19.0"
+version = "0.20.0"
 dependencies = [
  "anyhow",
  "assert_cmd",
diff --git a/Cargo.toml b/Cargo.toml
index ee9b139..fad7420 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cora-code"
-version = "0.19.0"
+version = "0.20.0"
 edition = "2024"
 description = "CLI-first AI code review — BYOK, diff/scan/branch, pre-commit hooks"
 license = "Apache-2.0"