Release 0.84.0: organisational-intelligence repositioning + compliance packs

[quantamixsol]

Release 0.84.0 — version bump only, no source changes

Public port of private PR #342 (merged 2026-09-15, merge commit 6c780364). All eight files are
byte-identical to the merged private/master.

Ships the six non-merge commits already on public master 5e80aa21:

Commit	What
129cfeba	CR-README-01 — reposition README + PyPI (public PR #257)
c9bc6456	CR-010.R3 — compliance packs as data, x-sox first
b9515ef8	CR-DIST-06 — sentinel fixes: skip on absent manifests
bb71b156	CR-DIST-06 — guard that referenced listing assets exist
e38ed344	CR-DIST-06 — follow-up: marketplace manifests were missed
334d1986	CR-DIST-06 — stop distribution manifests drifting

---

Why this release exists

PyPI metadata is immutable per version. 0.83.0 was published 2026-07-31, so
pypi.org/project/graqle still renders the old README — including the readme = "README.md"
pointer defect and the two non-existent commands that CR-README-01 fixed.

Merging #257 fixed the GitHub page immediately. It did nothing for PyPI. A version bump is the
only mechanism that changes that page.

Shipping the README alongside x-sox is deliberate: the new README advertises the SOX/COSO
pack, and until this release that pack is not installable from PyPI. Releasing the copy alone
would describe a capability users cannot actually get.

---

⚠️ Not the 0.83.0 three-file shape

The 0.83.0 release commit touched only CHANGELOG.md plus the two version carriers. That is no
longer sufficient. CR-DIST-06 added tests/test_packaging/test_manifest_version_sync.py, which
asserts at rest that all five distribution manifests equal graqle.__version__. A bump without
syncing them turns five tests red.

This PR therefore also carries the output of python scripts/ci/sync_manifest_versions.py 0.84.0:
server.json (both keys), both plugin manifests, both marketplace manifests.

---

Verification on this public tree

Check	Result
All 8 files vs merged private/master	byte-identical (scoped diff empty)
Version consistency across all 7 carriers	ALL CONSISTENT at 0.84.0
test_manifest_version_sync + test_readme_snapshot_lock + test_eu_ai_act_docs_present	71 passed
Wheel build	graqle-0.84.0-py3-none-any.whl ✅
Wheel METADATA	Summary = new description; long_description = README_PYPI.md (4,762 chars); new hero present, old hero absent, broken graq learn "<text>" absent

Release Gate (PyPI) will fail here as it does on every PR touching pyproject.toml or
graqle/** (empty GRAQLE_LICENSE, No graph file found). It is not a required check — the
only required context on master is ip-protection-gate.

---

🛑 No tag is pushed by this PR

git tag v0.84.0 triggers ci.yml → publish to PyPI via Trusted Publishing, and that is
irreversible. Tagging waits until this PR is merged and the owner explicitly authorises the
release.

After this merges

1. Owner authorises → git tag v0.84.0 && git push origin v0.84.0
2. CI builds, publishes to PyPI, then auto-syncs manifests back to master (expect a bot commit)
3. Verify pypi.org/project/graqle renders the new README

🤖 Generated with Claude Code

[github-actions]

🛡️ GraQle PR Guardian

💥 Blast Radius: 8 modules affected

Module	Files Changed	Risk Level	Impact Radius
.agents	1	🟡 T2	1
.claude-plugin	1	🟡 T2	1
CHANGELOG.md	1	🟡 T2	1
graqle	1	🟡 T2	1
plugins	2	🟡 T2	2
pyproject.toml	1	🟡 T2	1
server.json	1	🟡 T2	1

Total blast radius: 8

---

🏛️ Governance Verdict

⚠️ WARN

• T2: Advisory warnings detected. Review recommended.

---

🔍 SHACL Violations

No SHACL violations detected. ✅

---

🔐 Approval Requirements

This PR requires approval from: T2

• A Senior Engineer or above must approve.

❌ Approval requirement NOT yet satisfied.

---

Metric	Value
Blast Radius	8
Files Analyzed	8
Blocked	0
SHACL Violations	0
Verdict	WARN

---

_{🔬 Powered by GraQle PR Guardian v0.1.0 · Scan completed 2026-09-15T05:30:41.793985+00:00}