Release AKTA v1.0.0

.github/CROSS_REPO_CI.md

@@ -1,103 +1,91 @@
-# Cross-repo CI configuration (v0.7.1)
+# Cross-repo CI configuration (v1.0)
 
-AKTA default CI runs entirely in-repo. Optional jobs validate live exports against sibling repositories when repository variables or secrets are configured.
+AKTA default CI (`make ci`) runs entirely in-repo. The **release-gate** workflow runs on every PR to `main` and additionally exercises the live trust-stack when sibling clone URLs or repository variables are configured.
 
-## Repository variables
+## Repository variables (self-hosted / pre-checked-out siblings)
 
-Set these under **Settings → Secrets and variables → Actions → Variables**:
+Set under **Settings → Secrets and variables → Actions → Variables**:
 
-| Variable | Purpose | Activates job |
-|----------|---------|---------------|
-| `PF_CORE_REPO_PATH` | Absolute path to a checked-out PF-Core repo on the runner | `cross-repo-pf-pcs` (PF step) |
-| `PCS_CORE_REPO_PATH` | Absolute path to a checked-out PCS-Core repo | `cross-repo-pf-pcs` (PCS step) |
-| `SCOPE_REPO_PATH` | Absolute path to a checked-out SCOPE repo | `cross-repo-scope` |
-| `PCS_BENCH_REPO_PATH` | Absolute path to a checked-out PCS-Bench repo | `cross-repo-pcs-bench` |
+| Variable | Purpose |
+|----------|---------|
+| `PF_CORE_REPO_PATH` | Absolute path to PF-Core checkout on the runner |
+| `PCS_CORE_REPO_PATH` | Absolute path to PCS-Core checkout |
+| `SCOPE_REPO_PATH` | Absolute path to SCOPE checkout (optional if clone secret set) |
+| `PCS_BENCH_REPO_PATH` | Absolute path to PCS-Bench checkout |
+| `VSA_REPO_PATH` | Absolute path to VSA checkout |
+| `MEMORY_REPO_PATH` | Absolute path to Scientific Memory checkout |
 
-## Repository secrets
+When a `*_REPO_PATH` variable is set but the path is missing, release-gate **fails closed** (does not silently skip).
+
+## Repository secrets (clone URLs)
+
+Set under **Settings → Secrets and variables → Actions → Secrets**:
 
 | Secret | Purpose |
 |--------|---------|
-| `SCOPE_REPO_URL` | Git clone URL for SCOPE; CI clones to `$GITHUB_WORKSPACE/scope-sibling` and sets `SCOPE_REPO_PATH` |
+| `SCOPE_REPO_URL` | Git clone URL for SCOPE |
+| `PF_CORE_REPO_URL` | Git clone URL for PF-Core |
+| `PCS_CORE_REPO_URL` | Git clone URL for PCS-Core |
+| `PCS_BENCH_REPO_URL` | Git clone URL for PCS-Bench |
+| `VSA_REPO_URL` | Git clone URL for VSA |
+| `MEMORY_REPO_URL` | Git clone URL for Scientific Memory |
 
-## Manual sibling checkout pattern
+Optional **public** fallbacks (repository variables) when secrets are unset:
 
-Self-hosted or composite runners with sibling repos on disk:
+| Variable | Default public URL |
+|----------|-------------------|
+| `SCOPE_PUBLIC_REPO_URL` | `https://github.com/fraware/SCOPE.git` |
+| `PF_CORE_PUBLIC_REPO_URL` | `https://github.com/SentinelOps-CI/provability-fabric-core.git` |
+| `PCS_CORE_PUBLIC_REPO_URL` | `https://github.com/SentinelOps-CI/pcs-core.git` |
+| `PCS_BENCH_PUBLIC_REPO_URL` | `https://github.com/fraware/pcs-bench.git` |
+| `VSA_PUBLIC_REPO_URL` | `https://github.com/fraware/verified-science-agent.git` |
+| `MEMORY_PUBLIC_REPO_URL` | `https://github.com/fraware/scientific-memory.git` |
 
-```yaml
-env:
-  PF_CORE_REPO_PATH: /opt/siblings/PF-Core
-  PCS_CORE_REPO_PATH: /opt/siblings/PCS-Core
-  SCOPE_REPO_PATH: /opt/siblings/SCOPE
-  PCS_BENCH_REPO_PATH: /opt/siblings/PCS-Bench
-```
+The composite action `.github/actions/clone-siblings` clones configured siblings and exports `SCOPE_REPO_PATH`, `PF_CORE_REPO_PATH`, etc. to `GITHUB_ENV`.
 
-Run locally:
+**SCOPE is mandatory on release-gate:** if clone fails, the workflow fails. Default public SCOPE URL is used when no secret is configured.
+
+## Manual sibling checkout pattern
 
 ```bash
 export PF_CORE_REPO_PATH=/path/to/PF-Core
 export PCS_CORE_REPO_PATH=/path/to/PCS-Core
 export SCOPE_REPO_PATH=/path/to/SCOPE
 export PCS_BENCH_REPO_PATH=/path/to/PCS-Bench
+export VSA_REPO_PATH=/path/to/verified-science-agent
+export MEMORY_REPO_PATH=/path/to/scientific-memory
 pytest tests/contracts/ -v -m integration
+python scripts/verify_v1_release.py
 ```
 
-PowerShell:
-
-```powershell
-$env:PF_CORE_REPO_PATH = "C:\path\to\PF-Core"
-$env:PCS_CORE_REPO_PATH = "C:\path\to\PCS-Core"
-$env:SCOPE_REPO_PATH = "C:\path\to\SCOPE"
-$env:PCS_BENCH_REPO_PATH = "C:\path\to\PCS-Bench"
-pytest tests/contracts/ -v -m integration
-```
-
-## Live SCOPE verification (v0.7)
-
-After configuring a SCOPE sibling:
-
-```bash
-export SCOPE_REPO_PATH=/path/to/SCOPE
-python scripts/verify_scope_live_chain.py --mode python-import
-
-export SCOPE_CLI=scope
-python scripts/verify_scope_live_chain.py --mode cli
-
-export SCOPE_CLI_MODE=akta-review
-python scripts/verify_scope_live_chain.py --mode akta-review
-```
-
-The verifier fails when the adapter falls back to `simulated` mode or when PCS export accepts an overbroad grant. See [docs/scope_live_conformance.md](../docs/scope_live_conformance.md).
-
-## Job behavior
-
-### `cross-repo-pf-pcs`
+## Release-gate jobs
 
-Runs when `PF_CORE_REPO_PATH` or `PCS_CORE_REPO_PATH` is non-empty. Exports AKTA artifacts and validates against sibling PF-Core / PCS-Core validators via `tests/contracts/cross_repo_helpers.py`.
+| Job | Runs on PR | Purpose |
+|-----|------------|---------|
+| `scope-live-gate` | Yes | Live SCOPE (python-import mandatory), pilot bundle, strict contract |
+| `sibling-live-matrix` | Yes | PF runtime proof, PCS ingest, PCS-Bench harness, VSA, Memory |
+| `eval-bench-v1` | Yes | Oracle-independent, holdout, adversarial, behavioral, gate-derived metrics |
 
-### `cross-repo-scope`
-
-Runs when `SCOPE_REPO_PATH` is set or `SCOPE_REPO_URL` secret is present. Clones SCOPE when only the secret is configured, then runs SCOPE python-import contract tests and optional live chain verification.
-
-### `cross-repo-pcs-bench`
+## External PCS-Bench integration
 
-Runs when `PCS_BENCH_REPO_PATH` is set. Invokes external PCS-Bench runner when available; contract tests verify in-repo fallback when the path is unset.
+When `PCS_BENCH_REPO_PATH` is set, `adapters.pcs_bench.external_harness.run_external_harness()` shells to the sibling PCS-Bench CLI or falls back to `adapters.pcs_bench.runner.run_pcs_bench_suite()`.
 
-## External PCS-Bench integration
+## Fail-closed defaults
 
-When `PCS_BENCH_REPO_PATH` points to a sibling checkout, `adapters/pcs_bench/runner.run_pcs_bench_suite()` attempts, in order:
+- SCOPE live gate never skips all verification steps on PRs (public clone URL fallback).
+- Sibling steps fail when repository `*_REPO_PATH` variables are set but paths are missing.
+- Invalid sibling paths for PCS-Bench fall back to in-repo runner only when the variable is unset.
 
-1. Python import: `pcs_bench.runners.akta.run_akta_suite`
-2. CLI script: `scripts/run_akta_suite.py`
-3. In-repo `AKTABenchScenario` runner (default)
+## Branch protection (required checks)
 
-## Fail-closed defaults
+Configure on `main`:
 
-- Jobs are skipped when variables are unset; default CI remains green without siblings.
-- Invalid `PCS_BENCH_REPO_PATH` values fall back to the in-repo runner rather than silently passing external validation.
-- SCOPE python-import and CLI modes do not fall back to simulated grants when `SCOPE_REPO_PATH` or `SCOPE_CLI` is set.
+- `CI` (`.github/workflows/ci.yml`) — `make ci`
+- `Release Gate / scope-live-gate`
+- `Release Gate / eval-bench-v1`
 
-## Release acceptance
+Optional but recommended when sibling secrets are configured:
 
-Default release gate: `make ci` (see [docs/RELEASE.md](../docs/RELEASE.md)). Cross-repo jobs are optional enhancements, not required for public release.
+- `Release Gate / sibling-live-matrix`
 
-See also [tests/contracts/README.md](../tests/contracts/README.md).
+See [docs/RELEASE.md](../docs/RELEASE.md).

.github/actions/clone-siblings/action.yml

@@ -0,0 +1,65 @@
+name: Clone AKTA sibling repositories
+description: >-
+  Clone trust-stack sibling repos when clone URLs or secrets are set.
+  Exports SCOPE_REPO_PATH, PF_CORE_REPO_PATH, PCS_CORE_REPO_PATH,
+  PCS_BENCH_REPO_PATH, VSA_REPO_PATH, and MEMORY_REPO_PATH to GITHUB_ENV.
+inputs:
+  workspace:
+    description: GitHub workspace directory
+    required: true
+  scope_repo_url:
+    description: SCOPE clone URL (secret or public default)
+    required: false
+    default: https://github.com/fraware/SCOPE.git
+  pf_core_repo_url:
+    description: PF-Core clone URL
+    required: false
+    default: ""
+  pcs_core_repo_url:
+    description: PCS-Core clone URL
+    required: false
+    default: ""
+  pcs_bench_repo_url:
+    description: PCS-Bench clone URL
+    required: false
+    default: ""
+  vsa_repo_url:
+    description: VSA clone URL
+    required: false
+    default: ""
+  memory_repo_url:
+    description: Scientific Memory clone URL
+    required: false
+    default: ""
+runs:
+  using: composite
+  steps:
+    - name: Clone sibling repositories
+      shell: bash
+      run: |
+        set -euo pipefail
+        WS="${{ inputs.workspace }}"
+
+        clone_repo() {
+          local name="$1"
+          local url="$2"
+          local env_var="$3"
+          if [ -z "$url" ]; then
+            return 0
+          fi
+          local dest="$WS/${name}-sibling"
+          echo "Cloning ${name} from ${url} -> ${dest}"
+          git clone --depth 1 "$url" "$dest"
+          echo "${env_var}=${dest}" >> "$GITHUB_ENV"
+        }
+
+        SCOPE_URL="${{ inputs.scope_repo_url }}"
+        if [ -z "$SCOPE_URL" ]; then
+          SCOPE_URL="https://github.com/fraware/SCOPE.git"
+        fi
+        clone_repo "scope" "$SCOPE_URL" "SCOPE_REPO_PATH"
+        clone_repo "pf-core" "${{ inputs.pf_core_repo_url }}" "PF_CORE_REPO_PATH"
+        clone_repo "pcs-core" "${{ inputs.pcs_core_repo_url }}" "PCS_CORE_REPO_PATH"
+        clone_repo "pcs-bench" "${{ inputs.pcs_bench_repo_url }}" "PCS_BENCH_REPO_PATH"
+        clone_repo "vsa" "${{ inputs.vsa_repo_url }}" "VSA_REPO_PATH"
+        clone_repo "memory" "${{ inputs.memory_repo_url }}" "MEMORY_REPO_PATH"