chore: prepare the authorized 0.7.0 release

[timeleft--]

Owner decision

On September 13, Younes explicitly approved 0.7.0 tag and release, superseding the unreleased 0.6.1 candidate. Latest published version remains 0.6.0. This task prepares the reviewed code for that release; Captain owns tagging, workflow approval, publication, and post-publication verification.

Merge when clean: yes

Scope

Prepare version 0.7.0 from current main in the existing isolated worker workflow. Update project metadata, module fallback, the local package entry in uv.lock, and version-sensitive tests/examples needed for consistency. Do not blindly replace unrelated dependency versions such as ollama 0.6.1.

Consolidate all changes since v0.6.0 into a readable 0.7.0 candidate changelog: governed read/draft isolation, MCP SDK compatibility and schemas, Rich Views, JJ installer/current-stable policy, Trust Gate egress disclosure and bounded secret preflight, honest substring recall, safer onboarding, tool context measurements, and local-only sync. Link the relevant issues/PRs. Explain migration/identity compatibility considerations and avoid promising truth verification, complete DLP, semantic search, or measured user adoption. Adjust current installation/version docs so they describe the 0.7.0 candidate accurately before publication. Historical 0.6.0 reports remain historical; no claim PyPI has 0.7.0 before publication.

The owner waived the five-real-session Rich Views acceptance wait; do not claim those sessions happened. Do not alter real trails data, runtime selections, secrets, default provider, release environment policy, or publish/tag anything as worker.

Acceptance

• Metadata and loaded product version consistently report 0.7.0; dependency lock remains frozen and unrelated versions stay intact.
• Release notes truthfully summarize merged changes and compatibility, with issue links; unpublished status remains clear before publication.
• Relevant version/package tests and full suite pass; existing release workflow still validates built wheel/sdist/native MCP and upgrade from 0.6.0 before publication.
• One PR, canonical metadata pr_url, no direct main push. Captain independently reviews current exact head before merge.

Execution limits

One bounded release-preparation task, maximum 60 minutes. Use configured xai-oauth / grok-4.6. Single physical worker capacity; existing poller alone creates same-PR repairs if Captain reports genuine defects.

[timeleft--]

Release-note source inventory (Captain verified): merged PRs #90/#91 dependency fixes, #92/#97 Rich Views, #93 governed recall, #94 MCP 2 protocol, #95 reviewed duplicate migration/recovery tooling, #96 private gateway docs, #108 JJ installer, #109 verified release pipeline, #110 honest recall/claims, #111 Trust Gate egress disclosure, #112 bounded secret preflight, #113/#114 onboarding, #115 compact tool surface/measurement, #116 local-only sync. Candidate is remote main 30ac24e. No claim migration was executed by this release task or that existing runtime selectors already include all these changes. Task remains deliberately undispatched while Helmet repairs own the physical worker.

[timeleft--]

Release completed under the owner September 13 authorization.

PR #118 was independently reviewed at 878b265ff570a1b950dd248810772b14959d341e: 1,061 Captain tests passed, and all nine current CI checks were green. It merged as 10f689f7455c0c5c5898f2a2e6bc8cf4fe84a6d7, and immutable v0.7.0 was tagged there.

The existing gated Release workflow succeeded. The public GitHub release and PyPI 0.7.0 were independently verified. Published PyPI hashes match attached candidate-SHA256SUMS:

• Wheel: 4c21e92c54e692df0a75f789b34e508f17727fa70fc6524bdcf947ad76fa235f
• Sdist: 73031a53f17d9c5371f93fd98b784717436de7e0d75082892f5aca270f3108eb

Small docs-only PR #119 updates preparation-era unpublished wording after publication. Immutable release artifacts stay unchanged. Local runtime selection was not changed by this release task.