Release AKTA v0.7.0

.github/CROSS_REPO_CI.md

@@ -1,4 +1,4 @@
-# Cross-repo CI configuration (v0.6)
+# Cross-repo CI configuration (v0.7.1)
 
 AKTA default CI runs entirely in-repo. Optional jobs validate live exports against sibling repositories when repository variables or secrets are configured.
 
@@ -33,6 +33,16 @@ env:
 
 Run locally:
 
+```bash
+export PF_CORE_REPO_PATH=/path/to/PF-Core
+export PCS_CORE_REPO_PATH=/path/to/PCS-Core
+export SCOPE_REPO_PATH=/path/to/SCOPE
+export PCS_BENCH_REPO_PATH=/path/to/PCS-Bench
+pytest tests/contracts/ -v -m integration
+```
+
+PowerShell:
+
 ```powershell
 $env:PF_CORE_REPO_PATH = "C:\path\to\PF-Core"
 $env:PCS_CORE_REPO_PATH = "C:\path\to\PCS-Core"
@@ -41,6 +51,23 @@ $env:PCS_BENCH_REPO_PATH = "C:\path\to\PCS-Bench"
 pytest tests/contracts/ -v -m integration
 ```
 
+## Live SCOPE verification (v0.7)
+
+After configuring a SCOPE sibling:
+
+```bash
+export SCOPE_REPO_PATH=/path/to/SCOPE
+python scripts/verify_scope_live_chain.py --mode python-import
+
+export SCOPE_CLI=scope
+python scripts/verify_scope_live_chain.py --mode cli
+
+export SCOPE_CLI_MODE=akta-review
+python scripts/verify_scope_live_chain.py --mode akta-review
+```
+
+The verifier fails when the adapter falls back to `simulated` mode or when PCS export accepts an overbroad grant. See [docs/scope_live_conformance.md](../docs/scope_live_conformance.md).
+
 ## Job behavior
 
 ### `cross-repo-pf-pcs`
@@ -49,7 +76,7 @@ Runs when `PF_CORE_REPO_PATH` or `PCS_CORE_REPO_PATH` is non-empty. Exports AKTA
 
 ### `cross-repo-scope`
 
-Runs when `SCOPE_REPO_PATH` is set or `SCOPE_REPO_URL` secret is present. Clones SCOPE when only the secret is configured, then runs SCOPE python-import contract tests.
+Runs when `SCOPE_REPO_PATH` is set or `SCOPE_REPO_URL` secret is present. Clones SCOPE when only the secret is configured, then runs SCOPE python-import contract tests and optional live chain verification.
 
 ### `cross-repo-pcs-bench`
 
@@ -67,6 +94,10 @@ When `PCS_BENCH_REPO_PATH` points to a sibling checkout, `adapters/pcs_bench/run
 
 - Jobs are skipped when variables are unset; default CI remains green without siblings.
 - Invalid `PCS_BENCH_REPO_PATH` values fall back to the in-repo runner rather than silently passing external validation.
-- SCOPE python-import mode does not fall back to simulated grants when `SCOPE_REPO_PATH` is set.
+- SCOPE python-import and CLI modes do not fall back to simulated grants when `SCOPE_REPO_PATH` or `SCOPE_CLI` is set.
+
+## Release acceptance
+
+Default release gate: `make ci` (see [docs/RELEASE.md](../docs/RELEASE.md)). Cross-repo jobs are optional enhancements, not required for public release.
 
 See also [tests/contracts/README.md](../tests/contracts/README.md).

CHANGELOG.md

@@ -4,6 +4,42 @@ All notable changes to AKTA are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [0.7.1] - 2026-06-28
+
+### Added
+
+- `evaluate_prior_review()` enforces `prior_review_allowed_tools` and `prior_review_blocked_tools`
+- SCOPE adapter `akta-review-cli` mode (`SCOPE_CLI_MODE=akta-review`) calling `scope akta review`
+- `schemas/scope_akta_review_summary.schema.json` for summary validation
+- Tests: `test_review_context_allowed_tools.py`, `test_review_context_blocked_tools.py`, `test_scope_akta_review_cli.py`
+- Reconstructable demo Cases A/B/C with explicit post-grant decision assertions
+
+### Changed
+
+- `scope_grant_to_context_metadata()` copies blocked_tools, grant_id, provenance, and full grant metadata
+- Reconstructable demo uses weak-evidence queue-priority scenario; documents SCOPE grant vs AKTA policy layers
+- Documentation polish for v0.7.1 public release; added [docs/RELEASE.md](docs/RELEASE.md)
+
+## [0.7.0] - 2026-06-28
+
+### Added
+
+- Live SCOPE verification: `scripts/verify_scope_live_chain.py` (python-import and CLI modes)
+- Policy integrity modes: `dev_unsigned`, `deployment_hmac_attested`, `release_ed25519_signed` (`akta/policy_signing.py`)
+- `policy/release_keys.yaml` public Ed25519 key registry for published reference bundles
+- Closed-loop review semantics: `akta/review_loop.py` with grant allowlist, protocol/evidence invalidation, SCOPE blocked_tools preservation
+- Reconstructable experiment demo outputs canonical chain to `dist/reconstructable_experiment/` (00–11 artifacts + reports)
+- PCS scope grant fixtures: `tests/fixtures/scope_grants/` (real and simulated narrow/overbroad)
+- Adversarial transitions: F01–F15 `failure_class` per scenario, per-class reporting, inter-rater stats in eval report
+- Docs: `scope_live_conformance.md`, `failure_class_taxonomy.md`, `scenario_labeling_guidelines.md`, `holdout_private_governance.md`
+- Tests: `test_policy_signing_modes.py`, `test_evaluate_with_grant.py`, `test_pcs_scope_grant_export.py`, live SCOPE contract tests, reconstructable demo integration test
+
+### Changed
+
+- Package version `0.7.0`; `evaluate_with_grant()` applies `review_loop` constraints
+- PCS manifest records `integrity_mode`; decisions include `policy_integrity_mode`
+- `evals/adversarial_transitions.py` writes default report to `evals/reports/adversarial_transitions.json`
+
 ## [0.6.0] - 2026-06-28
 
 ### Added

GOVERNANCE.md

@@ -2,26 +2,34 @@
 
 ## Project type
 
-AKTA is an open protocol with a reference implementation. It is stewarded as a standalone engineering artifact for scientific action admissibility.
+AKTA is an open protocol with a reference implementation under the MIT license. It is stewarded as a standalone engineering artifact for scientific action admissibility. It is not a safety certification.
 
 ## Decision-making
 
 - **Protocol changes** (schemas, ontologies, deployment profiles): require design review and version bump.
 - **Reference kernel changes**: follow normal pull request review.
-- **Domain overlays**: core reference overlays (generic lab, materials, computational science) are operational. Biology, chemistry, and clinical overlays are experimental (v0.5) and not deployment-ready without institutional governance.
+- **Domain overlays**: core reference overlays (generic lab, materials, computational science) are operational. Biology, chemistry, and clinical overlays are experimental and not deployment-ready without institutional governance.
 
 ## Versioning
 
-AKTA follows semantic versioning for the reference implementation package (`akta-protocol`). Schema versions are embedded in artifact metadata (e.g., `akta-core-v0.5`, `akta-record-v0.5`).
+AKTA follows semantic versioning for the reference implementation package (`akta-protocol`, currently v0.7.1). Schema versions are embedded in artifact metadata (e.g., `akta-core-v0.5`, `akta-record-v0.5`).
 
 ## Non-certification
 
-AKTA does not certify autonomous labs, safety compliance, or scientific correctness. The AKTA Card is an institutional disclosure artifact, not a certification.
+AKTA does not certify autonomous labs, safety compliance, or scientific correctness. The AKTA Card is an institutional disclosure artifact, not a certification. PCS export records provenance; it does not certify deployment safety.
+
+## Authority boundary
+
+AKTA decides pre-action admissibility. SCOPE grants scoped authorization after human review. AKTA does not broaden SCOPE grants; SCOPE grants do not override AKTA evidence or deployment-profile policy by default.
 
 ## P7 exclusion
 
 Deployment profile P7 (fully autonomous scientific operator) is defined for future taxonomy only. AKTA raises `UnsupportedProfileError` if P7 is requested. **P7 runtime is a permanent non-goal** unless the Open Scientific Action Protocol specification explicitly adds P7 support in a future version.
 
+## Release acceptance
+
+Public releases follow [docs/RELEASE.md](docs/RELEASE.md): `make ci`, integrated demos, and optional live SCOPE verification.
+
 ## Maintainers
 
 Initial stewardship: [fraware/AKTA](https://github.com/fraware/AKTA) repository maintainers.