From 4e610c702b73fef75efc7356192066b25b71f8f2 Mon Sep 17 00:00:00 2001 From: quantamixsol Date: Tue, 15 Sep 2026 07:29:28 +0200 Subject: [PATCH] Release 0.84.0: organisational-intelligence repositioning + compliance packs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Public port of private PR #342 (merged 2026-09-15, merge commit 6c780364). Version bump only — no source changes. All eight files are byte-identical to the merged private/master. Ships the six non-merge commits already on public master 5e80aa21: 129cfeba CR-README-01 reposition README + PyPI (public PR #257) c9bc6456 CR-010.R3 compliance packs as data, x-sox first b9515ef8 CR-DIST-06 sentinel fixes: skip on absent manifests bb71b156 CR-DIST-06 guard that referenced listing assets exist e38ed344 CR-DIST-06 follow-up: marketplace manifests were missed 334d1986 CR-DIST-06 stop distribution manifests drifting WHY THIS RELEASE EXISTS PyPI metadata is immutable per version. 0.83.0 was published 2026-07-31, so pypi.org/project/graqle still renders the OLD README — including the `readme = "README.md"` pointer defect and the two non-existent commands that CR-README-01 fixed. Merging #257 fixed GitHub immediately and did nothing for PyPI. A version bump is the only mechanism that changes that page. Shipping the README alongside x-sox is deliberate: the new README advertises the SOX/COSO pack, and until this release that pack is not installable from PyPI. Releasing the copy alone would describe a capability users cannot get. MANIFEST SYNC — NOT the 0.83.0 three-file shape CR-DIST-06 added tests/test_packaging/test_manifest_version_sync.py, which asserts AT REST that all five distribution manifests equal graqle.__version__. A version bump without syncing them turns five tests red. This commit carries the output of `python scripts/ci/sync_manifest_versions.py 0.84.0`: server.json (x2 keys), both plugin manifests, both marketplace manifests. VERIFICATION ON THIS PUBLIC TREE - All 8 files byte-identical to merged private/master (scoped diff empty). - Version consistency across all 7 carriers: ALL CONSISTENT at 0.84.0. - test_manifest_version_sync + test_readme_snapshot_lock + test_eu_ai_act_docs_present: 71 passed. - Wheel builds as graqle-0.84.0-py3-none-any.whl; METADATA Summary is the new description and long_description is README_PYPI.md (4,762 chars) — new hero present, old hero absent, broken `graq learn ""` absent. NOT DONE HERE — deliberately No tag is pushed. `git tag v0.84.0` triggers ci.yml publish to PyPI via Trusted Publishing, and that is irreversible. Tagging waits until this PR is merged and the owner authorises the release. Co-Authored-By: Claude Opus 5 --- .agents/plugins/marketplace.json | 2 +- .claude-plugin/marketplace.json | 2 +- CHANGELOG.md | 121 ++++++++++++++---- graqle/__version__.py | 2 +- .../graqle/.claude-plugin/plugin.json | 2 +- .../codex/graqle/.codex-plugin/plugin.json | 2 +- pyproject.toml | 8 +- server.json | 4 +- 8 files changed, 108 insertions(+), 35 deletions(-) diff --git a/.agents/plugins/marketplace.json b/.agents/plugins/marketplace.json index 31633db..34879f2 100644 --- a/.agents/plugins/marketplace.json +++ b/.agents/plugins/marketplace.json @@ -13,7 +13,7 @@ "name": "graqle", "source": "./plugins/codex/graqle", "description": "Graph-powered codebase reasoning, impact analysis, and governed edits via the GraQle MCP server, plus governed-workflow skills.", - "version": "0.83.0", + "version": "0.84.0", "author": { "name": "Quantamix Solutions", "url": "https://graqle.com" diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 029ce20..09b086b 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -13,7 +13,7 @@ "name": "graqle", "source": "./plugins/claude-code/graqle", "description": "Graph-powered codebase reasoning, impact analysis, and governed edits via the GraQle MCP server, plus governed-workflow skills and an optional governance gate hook.", - "version": "0.83.0", + "version": "0.84.0", "author": { "name": "Quantamix Solutions", "url": "https://graqle.com" diff --git a/CHANGELOG.md b/CHANGELOG.md index e4d0374..edab620 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -4,6 +4,101 @@ All notable changes to GraQle are documented in this file. --- +## Unreleased — 0.84.0 (DAG-2026 CR-012 foundation) + +> Feature-flagged foundation for the Decision Assurance Gate programme (ADR-RT-004). +> `GRAQLE_DAG_ENABLED` is **off by default** and, while off, changes no SDK behaviour: +> `GovernanceMiddleware.check()` is untouched and byte-identical to 0.83.0. + +### Added (CR-012 / PR-012a) + +- **`graqle.assurance` package** — `is_dag_enabled()` (single-source flag reader, positive + allowlist `1|true|yes|on`, anything else is OFF), `DagSettings` (typed home for every DAG + configuration symbol, `GRAQLE_DAG_*` env prefix, frozen, unknown names rejected), `ConfigurationError`, + `load_dag_settings()` (environment > private file at `GRAQLE_DAG_SECRETS_PATH` > safe default; + cached only on success), `config_version()` (deterministic fingerprint; private values never in + clear), `config_provenance()`, `validate_flag_consistency()` (startup validator, fatal on mismatch). +- **`GraqleConfig.assurance`** section. `assurance.enabled` is derived from the environment flag and is + read-only: setting it in `graqle.yaml` raises `ConfigurationError` before env interpolation. +- **`.env.example`** at the repo root listing every DAG variable name with placeholders (no tuning values). +- **`docs/dag/ground-truth-addendum.md`** — the binding correction of the research charter's description + of 0.83.0 gating, with the SDK team's line-anchor verification notes. + +### Behaviour change when the flag is ON (opt-in only) + +- `GraqleConfig.from_yaml()` now fails closed with `ConfigurationError` if `GRAQLE_DAG_ENABLED` is on and + any required DAG setting is absent. No placeholder fallback exists for a security-critical value. + +## 0.84.0 (2026-09-14) — [Positioning: organisational intelligence + compliance packs as data] + +> Two user-facing changes and one packaging fix. The public pages now lead with **persistent +> organisational intelligence** rather than EU-AI-Act-first governance; compliance frameworks +> become **authorable as data**, with SOX/COSO shipping first; and the distribution manifests +> stop drifting from the shipped version. No breaking changes — every API is unchanged. + +### Positioning (CR-README-01) + +- **The PyPI page finally renders the right file.** `pyproject.toml` pointed `readme` at the long + `README.md`, so the concise `README_PYPI.md` in the repo **never reached PyPI**. The pointer now + targets `README_PYPI.md`. If you have been reading the PyPI page, this is the first release where + it reflects what the repo actually says. +- **New category framing.** Both READMEs and the package description lead with turning codebases, + documents, policies, decisions and workflows into a persistent typed knowledge graph. Governance + is re-ranked as the trust layer that makes that intelligence safe to act on, rather than the + headline. EU AI Act coverage is unchanged and fully retained — it now sits under + *Regulated deployments*, alongside SOX/COSO, ISO/IEC 42001 and GDPR claim limits. +- **Two documented commands did not exist.** The quickstart published `graq learn ""`, which + exits with `No such command` (`learn` is a command group). The correct form is + **`graq learn knowledge ""`**. A capability table published `graq lessons `, which + is not a command at all; the real surface is **`graq learned`**. Both are corrected, and every + command quoted in either README is now machine-checked against `graq --help`. +- **Corrected counts.** The MCP tool count was published as "76+" and "74"; `graq mcp tools` + reports **85** `graq_` tools (each also aliased `kogni_*`). The backend list advertised + **14** including Azure OpenAI, which has no preset, no registry entry and no backend class — + the honest figure is **13 named backends plus any custom HTTP endpoint**. + +### Fixed + +- **A placeholder answer no longer reports a confidence score.** With no LLM backend configured, + the fallback backend returned `"[NO LLM CONFIGURED …] Placeholder analysis for this node. + Confidence: NN%"`. That number was random, and pairing it with placeholder text made an + unconfigured install indistinguishable from a governed answer at a glance. The fallback now + states plainly that no confidence score is reported. Configured backends are unaffected, and + the explicitly-scripted mock path still reports its confidence. + +### Compliance (CR-010.R3) + +- **Compliance packs are data, not code.** A regulatory framework is now a directory holding + `pack.yaml` plus its own `schema.json`. Adding the next framework — NIST AI RMF, ISO/IEC 42001, + SOC 2, HIPAA — requires **no Python and no engine change**. Packs load through + `graqle.compliance.packs` (`discover_packs()`, `load_pack()`, `load_all_packs()`) and each pack + is validated against its own schema in addition to proof-spec v1.0, because v1.0 permits unknown + members and therefore cannot check an extension namespace itself. A malformed pack **fails + closed, loudly** — it is never skipped with a warning. +- **SOX / COSO ships first** (`x-sox`). Binds an AI-assisted decision to a named internal control, + a financial-statement assertion and a reporting period, so a decision taken during a financial + close is auditable offline. References SOX §302/§404 and COSO (2013 / ERM 2017). A typed + bootstrap lives at `graqle.pct.extensions.x_sox`. +- **Management-review gate** (`graqle.compliance.management_review_gate`) — the SOX-vocabulary + counterpart of the Article 14 human-oversight gate: same mechanics, different words. +- Discovery is a first-party packaged-directory scan by deliberate design — no entry points, so a + pack cannot arrive from an untrusted distribution as a side effect of installing an unrelated + library. + +### Packaging (CR-DIST-06) + +- **Distribution manifests no longer drift from the shipped version.** Five manifests + (`server.json`, both plugin manifests, both marketplace manifests) carried a hand-maintained + version that nothing updated — they reached `0.80.0` while PyPI served `0.83.0`, three releases + stale. `scripts/ci/sync_manifest_versions.py` now owns them, CI runs it on publish, and a test + asserts every manifest equals `graqle.__version__` at rest. +- `server.json` was the subtler case: the registry workflow rewrote it *inside the CI checkout*, so + the published entry was always correct while the file in git stayed stale forever. The artifact + and the repo must now agree. +- A pre-submission gate verifies that every listing asset a manifest references actually exists. + +--- + ## 0.83.0 (2026-07-30) — [Enterprise: scheduler contract + free-tier reasoning cap] > ### ⚠️ BREAKING CHANGE — free tier only @@ -390,32 +485,6 @@ All notable changes to GraQle are documented in this file. --- -## 0.72.1 (2026-06-08) — [Authentic, model-aware "Cost Saved" metric] - -> The dashboard's **Cost Saved** figure is now a defensible number: real tokens -> valued at the **real per-model price**, from a single dated source of truth — -> not a hardcoded, model-agnostic flat rate. - -**Added** - -- **`graqle/pricing.py`** — the single source of truth for token pricing. - A dated per-model `$/1M` table (`PRICING_AS_OF`; Opus 4.x $5/$25, Sonnet - $3/$15, Haiku $1/$5), `cost_saved(tokens, model)` valued at the model's - **input** rate, a fail-safe `DEFAULT_MODEL` (Sonnet) for unknown ids, and - `pricing_basis()` so the UI can render the figure honestly (model + as-of date). - -**Changed** - -- **Eliminated three conflicting hardcoded cost rates** ($3/1M dashboard partial, - $15/1M `metrics.html`, $0.015/1K engine+dashboard). All now read - `pricing.cost_saved` via `MetricsEngine.get_summary()['cost_saved_usd']`. -- **Cost is now model-aware.** `MetricsEngine.set_cost_model()` records the model - behind a saving (wired from reasoning), so the figure reflects the model the - user actually ran. At 88.2M tokens saved: $264.60 (Sonnet) / $441.00 (Opus 4.8) - / $88.20 (Haiku). - ---- - ## 0.72.0 (2026-06-07) — [Constitution for every client: OpenAI Codex (AGENTS.md)] > The governance constitution now renders into **every supported AI client**, diff --git a/graqle/__version__.py b/graqle/__version__.py index 0491251..ee231b0 100644 --- a/graqle/__version__.py +++ b/graqle/__version__.py @@ -5,4 +5,4 @@ # constraints: none # ── /graqle:intelligence ── -__version__ = "0.83.0" +__version__ = "0.84.0" diff --git a/plugins/claude-code/graqle/.claude-plugin/plugin.json b/plugins/claude-code/graqle/.claude-plugin/plugin.json index de62b55..6cef614 100644 --- a/plugins/claude-code/graqle/.claude-plugin/plugin.json +++ b/plugins/claude-code/graqle/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "graqle", - "version": "0.83.0", + "version": "0.84.0", "description": "GraQle dev intelligence layer: graph-powered codebase reasoning, impact analysis, and governed edits via MCP, plus governed-workflow skills and an optional governance gate hook.", "author": { "name": "Quantamix Solutions", diff --git a/plugins/codex/graqle/.codex-plugin/plugin.json b/plugins/codex/graqle/.codex-plugin/plugin.json index 8d3e326..92af0f5 100644 --- a/plugins/codex/graqle/.codex-plugin/plugin.json +++ b/plugins/codex/graqle/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "graqle", - "version": "0.83.0", + "version": "0.84.0", "description": "GraQle dev intelligence layer: graph-powered codebase reasoning, impact analysis, and governed edits via MCP, plus governed-workflow skills.", "interface": { "displayName": "GraQle", diff --git a/pyproject.toml b/pyproject.toml index d5c7a32..ef63a51 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -5,7 +5,11 @@ build-backend = "hatchling.build" [project] name = "graqle" # V-ADR240-DELTA: native version bump (G4 config, CG-14 native-edit precedent). -# 0.83.0 = CR-010 R6 scheduler contract (--headless/--json/--report-json, +# 0.84.0 = CR-README-01 public repositioning (README + PyPI long-description now +# lead with persistent organisational intelligence; readme pointer moved to +# README_PYPI.md so PyPI finally renders the conversion page) + CR-010.R3 +# compliance packs as data (x-sox SOX/COSO first) + CR-DIST-06 distribution +# manifest autosync. 0.83.0 = CR-010 R6 scheduler contract (--headless/--json/--report-json, # exit codes 0/1/2/3) + ADR-245 W3 reasoning-quota wall (free monthly cap on # graph reasoning). 0.79.0 = ADR-242-A1 CR-SEED-02: graqle.workflow.seed — seed a project graph # from goal + build profile + source chunks before any code exists, and the @@ -14,7 +18,7 @@ name = "graqle" # (first-to-finish/best-of-N) + CostAwareRouter (auto cost/latency selection) — # dual-provider autonomy. 0.77.0 = ADR-239 Stage 2 # (CheckpointProtocol + run_tests). 0.76.0 = ADR-225 G1 multi-tenant memory. -version = "0.83.0" +version = "0.84.0" description = "Persistent organisational intelligence for AI agents. Turn codebases, documents, policies and decisions into a knowledge graph so Claude Code, Cursor and Copilot reason over architecture, dependencies and prior lessons — with confidence scores and evidence. 13 LLM backends + custom, fully offline capable." readme = "README_PYPI.md" license = {text = "Apache-2.0"} diff --git a/server.json b/server.json index 1f79f60..b21bd5d 100644 --- a/server.json +++ b/server.json @@ -8,12 +8,12 @@ "url": "https://github.com/quantamixsol/graqle", "source": "github" }, - "version": "0.83.0", + "version": "0.84.0", "packages": [ { "registryType": "pypi", "identifier": "graqle", - "version": "0.83.0", + "version": "0.84.0", "transport": { "type": "stdio" }