Chore(release): Prepare v0.11.0 — federal wave + pre-tag review fixes#199
Merged
Conversation
…cture, v0.12 plan Release prep per docs/release-checklist.md: - scripts/bump_version.py --to 0.11.0 (manifest-driven: 24 files, 76 substitutions — 8 pyprojects + package.json + inter-package pins + Dockerfile/demo pins + doc version references + the two prose currency anchors); uv.lock regenerated. - CHANGELOG: [Unreleased] cut to [0.11.0] - 2026-07-16 with the federal-wave theme paragraph and the ratified deferral record; fresh [Unreleased] block opened; all five cycle PR refs woven in (#194 #195 #196 #197 #198) — check_changelog_vs_commits reports every commit accounted for. - ROADMAP: v0.11 umbrella -> SHIPPED with a v0.11.0 release entry; NEW '## v0.12 - Pre-1.0 hardening + GUI parity - PLANNED' open cycle linking docs/releases/plans/v0.12-plan.md (ratified 2026-07-16: disposition of the remaining v0.11 waves + the LEAN v0.12 scope); medical-device line re-cut to v1.1+. - capability-matrix: v0.11.0 PRE-TAG re-validation snapshot (federal wave surface delta; parity 93.4% with the 7 api-only rows named); header re-validated-through bumped. - threat-model: v0.11.0 attack-surface delta (conmon ksi file-in/ file-out + vendored-schema provenance; the M-25-21/22 store + API mirrors on the hardened registry-store pattern; the read-only schema-watch sentinel). - README Recent-Releases regenerated (gen_readme_releases.py); wiki mirrors + reference + API docs regenerated. Gates on this tree: pytest full suite green; ruff; mypy 292 files; docs-health --strict 0 FAIL; doc-counts; parity; version-consistency; roadmap-currency (incl. A4 backfill clean); workflow perms/tools strict; uv build 8 wheels + twine PASSED; run_osv_scan PASS (osv-scanner v2.4.0).
The v0.11.0 /pre-release-review security fan-out (5 per-subsystem
reviewers + adversarial verification) surfaced a data-loss BLOCKER and
several hardening gaps in the just-merged Wave-2 code. All fixed before
the tag, with regression tests.
BLOCKER — set-high-impact destroyed recorded M-25-21 practices:
`ai-gov set-high-impact` (the only verb that amends bases/rationale on
an already-classified system) rebuilt OMBHighImpactAssessment from
determination/bases/rationale only, resetting `practices` to {} and
silently wiping every recorded practice status AND the CAIO waiver
written-determination provenance (§4(a)(ii)/(iii) evidence trail) —
contradicting the model's own retention contract. Reproduced live.
Fix: both the API and CLI handlers carry `practices` forward across a
re-determination. Regression tests on both surfaces.
Also fixed (same review):
- conmon ksi now REJECTS duplicate KSI indicator keys in the status
YAML (a duplicate ID was last-wins-merged, silently dropping the
earlier block from the emitted federal SDR).
- conmon ksi WARNS when a --state-file anchor keys a cadence slug that
matches no bundled cadence (its last-completed/next-due dates would
otherwise be silently absent from the SDR).
- conmon ksi --out writes atomically (tmp + os.replace) with a clean
exit-1 error contract instead of a raw pathlib traceback on a
missing/unwritable path.
- PracticeWaiver.issued_by and AIAcquisition.linked_system_id gained
the max_length=256 bound every sibling operator-string field carries
(API mirror field too).
Docs (self-inflicted in the release-prep commit, G28):
- threat-model v0.11.0 delta no longer claims the new API mirrors
inherit the idempotency-key body-hash mechanism (they do not; retry-
dedup is a tracked v0.12 item).
- capability-matrix: the "gen_fedramp_ksi.py --check CI drift gate" and
"CAIO waiver clocks" rows reworded to match what actually ships.
Eight lower-severity findings (idempotency on the acquisition create
route, a shared-helper exit-code nit, an on-demand-only local schema
integrity check, the unwired waiver-clock helpers, a pre-existing
store temp-file race, two CI-sentinel hardening items) are dispositioned
to v0.12 in the per-run review JSON.
Tests: 6 new regression tests; full suite green; ruff; mypy 292 files;
docs-health --strict 0 FAIL.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
allenfbyrd
enabled auto-merge
July 17, 2026 08:36
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
…h bounds The pre-tag review added max_length=256 to PracticeWaiver.issued_by and AIAcquisition.linked_system_id (+ the API RegisterAcquisitionRequest mirror); re-dump packages/evidentia-ui/openapi.json and regenerate the typed client so the openapi-schema-drift gate stays green. Schema delta is exactly the two maxLength additions; frontend typecheck + build pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Release prep: v0.11.0 — the federal wave
Prepares the v0.11.0 tag per
docs/release-checklist.md. Feature scope isalready on
main(PRs #194 / #195 / #196), joined this cycle by theclaim-accuracy sweep (#197) and the CR26 schema re-vendor at the SDR 1.0.0
graduation (#198).
What's in this PR
scripts/bump_version.py(manifest-driven:24 files, 76 substitutions — all 8 pyprojects, package.json, inter-package
pins, doc references, and the two prose currency anchors);
uv.lockregenerated.
[Unreleased]cut to[0.11.0] - 2026-07-16with thefederal-wave theme paragraph and the ratified deferral record; all five
cycle PR refs woven in —
check_changelog_vs_commits.pyreports everycommit since v0.10.18 accounted for.
entry; new
## v0.12 — Pre-1.0 hardening + GUI parity — PLANNEDopencycle linking the ratified
v0.12-plan.md(disposition of the remaining v0.11 waves); medical-device line re-cut to
v1.1+.
check_roadmap_currency.pyfully green including the backfilladvisory.
surface delta; parity stated honestly at 93.4% with the 7 api-only rows
named and their v0.12 disposition linked).
conmon ksifile-in/file-out surface + vendored-schema provenance; the M-25-21/22
store + API mirrors on the hardened registry-store pattern; the read-only
schema-watch sentinel).
regenerated.
Gates on this tree
pytest 4,939 passed (3-OS matrix re-runs in CI) · ruff · mypy 292 files ·
check_docs_health --strict0 FAIL · doc-counts · parity (93.4%, all 5checks) · version-consistency · roadmap-currency · workflow perms/tools
strict ·
uv build8 wheels + twine PASSED ·run_osv_scan.pyPASS(osv-scanner v2.4.0) · changelog-vs-commits advisory clean · Step-6 scour
clean (no live legacy-name refs; zero real emails in history; no new
packages).
Pre-tag review: pre-release-review v5.2 (per-run JSON in
.local/pre-release-review/runs/); Step 3–4 security fan-out resultsrecorded there. Tagging happens after this PR merges, as its own approved
step.
Update: pre-tag
/pre-release-reviewfixes folded inThe v0.11.0 security fan-out (5 per-subsystem reviewers + adversarial verify)
surfaced a data-loss blocker plus hardening gaps in the just-merged Wave-2
code; all fixed on this branch before tag (see the
Fix(ai-gov):commit):ai-gov set-high-impactsilently destroyed recorded M-25-21practice status + CAIO waiver provenance on a bases/rationale amendment
(contradicting the model's retention contract). Fixed on API + CLI; carried
practices forward; regression test on each surface. Reproduced live before
and after.
conmon ksi: rejects duplicate KSI keys (while honoring legal YAML mergekeys), warns on unknown
--state-filecadence slugs, atomic--outwritewith a clean error contract.
max_lengthbounds on the two unbounded operator-string fields.(threat-model idempotency; capability-matrix waiver-clock + gen-
--checkwording).
Eight lower-severity findings dispositioned to v0.12 in the per-run review JSON.
Validated three times: full gate battery, live end-to-end exercise of every
fix, and an adversarial re-review of the fix diff (which itself caught + fixed
a merge-key regression). Full suite 4,947 passed.