capability-reasoning-kernel 0.4.1__tar.gz → 0.5.0__tar.gz

{capability_reasoning_kernel-0.4.1 → capability_reasoning_kernel-0.5.0}/.env.example

@@ -7,7 +7,9 @@ DEEPSEEK_API_KEY=
 
 # Optional overrides (defaults shown)
 # RK_LLM_PROVIDER_DEFAULT=anthropic
-# RK_LLM_MODEL_ANTHROPIC=claude-sonnet-4-6   # or claude-opus-4-8 (more capable, different pricing)
+# RK_LLM_MODEL_ANTHROPIC=claude-sonnet-5      # or claude-opus-4-8 (more capable, different pricing)
 # RK_LLM_MODEL_OPENAI=gpt-5.5                 # or gpt-5.5-pro (more capable, different pricing)
 # RK_LLM_MODEL_DEEPSEEK=deepseek-v4-flash     # or deepseek-v4-pro (more capable, different pricing)
 # RK_DEEPSEEK_BASE_URL=https://api.deepseek.com
+# RK_LLM_TIMEOUT_SECONDS=120.0                # per-request SDK timeout passed to provider clients
+# RK_LLM_MAX_TOKENS=4096                      # default max_tokens for structured-output calls

capability_reasoning_kernel-0.5.0/.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      github-actions:
+        patterns: ["*"]
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly

capability_reasoning_kernel-0.5.0/.github/workflows/ci.yml

@@ -0,0 +1,151 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      live_providers:
+        description: Comma-separated providers required by the live gate
+        required: true
+        default: deepseek
+        type: string
+  workflow_call:
+    inputs:
+      live_providers:
+        description: Comma-separated providers required by the live gate
+        required: false
+        default: ""
+        type: string
+    secrets:
+      ANTHROPIC_API_KEY:
+        required: false
+      OPENAI_API_KEY:
+        required: false
+      DEEPSEEK_API_KEY:
+        required: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.12.10"
+          checksum: "173d95a0c32d18c896c46ba6fafbf3cf9c14ab74b033f81b76c883ef492a976b"
+          python-version: ${{ matrix.python-version }}
+          enable-cache: true
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Sync dependencies
+        run: uv sync --all-extras --locked
+
+      # The justfile uses `set dotenv-load`; provide a no-secret env so it loads cleanly.
+      # The default suite is key-free and `live` tests are excluded via addopts -m 'not live'.
+      - name: Prepare env
+        run: cp .env.example .env
+
+      - name: Lint
+        run: just lint
+
+      - name: Typecheck
+        run: just typecheck
+
+      - name: Test
+        run: just test # runs with coverage; fails under the threshold in pyproject
+
+      - name: Verify distribution
+        run: just package-check
+
+  artifact-roundtrip:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.12.10"
+          checksum: "173d95a0c32d18c896c46ba6fafbf3cf9c14ab74b033f81b76c883ef492a976b"
+          python-version: "3.12"
+          enable-cache: true
+
+      - name: Build distribution
+        run: |
+          uv sync --all-extras --locked
+          uv build --clear
+          uv run twine check --strict dist/*
+          uv run python scripts/check_artifacts.py dist
+          sha256sum dist/* > SHA256SUMS
+
+      - name: Upload distribution
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: ci-distribution
+          path: |
+            dist/
+            SHA256SUMS
+          if-no-files-found: error
+          retention-days: 1
+
+      - name: Download distribution
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: ci-distribution
+          path: roundtrip
+
+      - name: Verify downloaded bytes
+        working-directory: roundtrip
+        run: sha256sum --check SHA256SUMS
+
+  # Explicit provider qualification: manual or required by the release's reusable workflow call.
+  live:
+    if: inputs.live_providers != ''
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.12.10"
+          checksum: "173d95a0c32d18c896c46ba6fafbf3cf9c14ab74b033f81b76c883ef492a976b"
+          python-version: "3.12"
+          enable-cache: true
+
+      - name: Install just
+        uses: extractions/setup-just@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3 # v4
+
+      - name: Sync dependencies
+        run: uv sync --all-extras --locked
+
+      - name: Run live provider tests
+        env:
+          RK_LIVE_PROVIDERS: ${{ inputs.live_providers }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+        run: just test-live

capability_reasoning_kernel-0.5.0/.github/workflows/pages.yml

@@ -0,0 +1,48 @@
+name: Pages
+
+# Deploy the static landing page in `docs/` to GitHub Pages. No build step — the page is
+# self-contained HTML (CSS + SVG inline). First-time setup requires the repository's
+# Settings → Pages → Source to be set to "GitHub Actions".
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - ".github/workflows/pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow one concurrent deployment; don't cancel an in-progress publish.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      # Actions pinned to immutable commit SHAs (supply-chain hardening); tag in comment.
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Configure Pages
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+        with:
+          enablement: true # self-enable Pages (build_type=workflow) on first run — no manual Settings step
+
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: docs
+
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

capability_reasoning_kernel-0.5.0/.github/workflows/release.yml

@@ -0,0 +1,107 @@
+name: Release
+
+# Test the tagged commit, then promote one immutable distribution through both indexes.
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  quality:
+    uses: ./.github/workflows/ci.yml
+    with:
+      live_providers: deepseek
+    secrets:
+      DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+
+  build:
+    needs: quality
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
+        with:
+          version: "0.12.10"
+          checksum: "173d95a0c32d18c896c46ba6fafbf3cf9c14ab74b033f81b76c883ef492a976b"
+          python-version: "3.12"
+      - run: uv sync --all-extras --locked
+      - name: Validate tag and build
+        run: |
+          uv run python scripts/check_version.py
+          uv build --clear
+          uv run twine check --strict dist/*
+          uv run python scripts/check_artifacts.py dist
+          sha256sum dist/* > SHA256SUMS
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: distribution
+          path: |
+            dist/
+            SHA256SUMS
+          if-no-files-found: error
+
+  testpypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: testpypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distribution
+      - run: sha256sum --check SHA256SUMS
+      - name: Publish to TestPyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          repository-url: https://test.pypi.org/legacy/
+
+  verify-testpypi:
+    needs: testpypi
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distribution
+      - run: sha256sum --check SHA256SUMS
+      - run: python scripts/check_published.py dist testpypi
+
+  pypi:
+    needs: verify-testpypi
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distribution
+      - run: sha256sum --check SHA256SUMS
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+
+  verify-pypi:
+    needs: pypi
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: distribution
+      - run: sha256sum --check SHA256SUMS
+      - run: python scripts/check_published.py dist pypi

capability_reasoning_kernel-0.5.0/.pre-commit-config.yaml

@@ -0,0 +1,33 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: check-yaml
+      - id: check-toml
+      - id: check-added-large-files
+        args: ["--maxkb=1000"]
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  # Ruff and pyright run as local hooks through uv so the hook, `just lint`/`just typecheck`,
+  # and CI all execute the exact versions pinned in uv.lock — no pinned-mirror drift.
+  - repo: local
+    hooks:
+      - id: ruff-check
+        name: ruff check --fix (uv.lock version, same as `just fix`)
+        language: system
+        entry: uv run ruff check --fix src/ tests/ scripts/
+        pass_filenames: false
+        types_or: [python, pyi]
+      - id: ruff-format
+        name: ruff format (uv.lock version, same as `just fix`)
+        language: system
+        entry: uv run ruff format src/ tests/ scripts/
+        pass_filenames: false
+        types_or: [python, pyi]
+      - id: pyright
+        name: pyright (same scope as `just typecheck` — strict dirs set in pyproject)
+        language: system
+        entry: uv run pyright
+        pass_filenames: false
+        types: [python]

capability_reasoning_kernel-0.5.0/CHANGELOG.md

@@ -0,0 +1,225 @@
+# Changelog
+
+All notable changes to this project are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this project adheres to
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.5.0] - 2026-09-06
+
+First stable operational embedding release. It promotes the two release candidates after package,
+provider and real-consumer compatibility validation; each host remains responsible for validating
+its own live adapters and policies.
+
+### Changed
+
+- Qualify OpenAI SDK 3.8 through the required live DeepSeek compatibility gate without calling the
+  OpenAI service, and update the locked Pyright version.
+- Upgrade the SHA-pinned uv and Pages actions after CI artifact round-trip and rendered Pages checks.
+- Validate Vibemonitor's real `KernelGate` integration and complete consumer suite on Python 3.14.
+
+## [0.5.0rc2] - 2026-09-06
+
+Maintenance candidate following the first published operational release. Publication remains
+separate from live host-adapter acceptance.
+
+### Added
+
+- SQLite audit discovery for reserved run IDs and runs needing operator review after incomplete or
+  uncertain execution.
+
+### Changed
+
+- Validate the provider adapters against OpenAI SDK 3.7 and Anthropic SDK 1.4, while bounding their
+  optional dependency ranges below the next untested major versions.
+- Upgrade SHA-pinned GitHub Actions and add a CI upload/download checksum round trip for release
+  artifacts; group future Actions updates into one Dependabot pull request.
+- Refresh the locked Pydantic, pytest and ruff versions used by CI and local development.
+
+### Fixed
+
+- Package builds clear stale distributions, while published-artifact verification ignores unrelated
+  files and still requires exactly one wheel and one source distribution.
+
+## [0.5.0rc1] - 2026-09-06
+
+Published operational embedding candidate. Publication does not imply live-adapter UAT.
+
+### Added
+
+- Single-use `RunSession`, bounded operational defaults and root-wide step/tool/parser/LLM budgets.
+- Explicit tool egress declarations, normalized input verification and output model revalidation.
+- `TraceSink`, memory/SQLite sinks, durable pre-call records and fail-closed storage handling.
+- Correlated invocation IDs, parent run IDs, partial/uncertain effect outcomes and terminal run status.
+- Redacted operational events, detached snapshots and canonical detailed digests.
+- Bounded shared reasoner executor, returned usage/latency capture and public provider result types.
+- Sanitized provider failure categories, HTTP status and allow-listed operational error codes.
+- Crash, concurrency, shared-budget, adapter-contract and provider failure regression tests.
+- Python 3.14 CI, locked dependencies, pinned actions and single-artifact release promotion with
+  a pinned/checksummed uv runtime, version checks, isolated wheel smoke and served-byte verification.
+- Operational/migration guide and conformance checklist.
+
+### Changed
+
+- Require a patched `pydantic-settings>=2.14.2` (GHSA-4xgf-cpjx-pc3j) and refresh its lock entry.
+- Version the SQLite audit schema, migrate the unversioned candidate layout, reject unknown/newer
+  layouts or missing key constraints, and verify released bytes after TestPyPI and PyPI publication.
+- Require an explicit live-provider set in release CI; `0.5.0rc1` qualifies DeepSeek while OpenAI
+  remains supported but is not live-qualified for this candidate.
+- Low-level interpreters reject reuse and context/trace mismatches; child IDs are opaque.
+- Limits span descendants; `RunLimits()` remains unbounded for explicit low-level wiring.
+- Failed tools stop later steps without implying rollback; output validation cannot undo a call.
+- OpenAI-compatible fallback uses structured error parameters, once; refusals/truncations and
+  malformed outputs are terminal errors. DeepSeek routes directly through JSON mode with local
+  schema validation because its compatible API does not implement OpenAI's native JSON Schema mode.
+  Provider exception messages no longer include raw API text.
+- Pyright explicitly resolves the project virtualenv. Documentation distinguishes root planning,
+  delegated untrusted planning and partial effects.
+
+## [0.4.2] - 2026-07-10
+
+A correctness release for the gate's provenance stage, plus fail-closed hardening of the provider
+integrations. No API removals; two behavior changes in the gate/taint semantics (both strictly
+safety-improving) and stricter model resolution.
+
+### Fixed
+
+- **Gate: a tainted value with unrestricted `readers` no longer skips declassification.**
+  `readers=None` is reserved for purely trusted data, but `quarantine_label` preserves the source's
+  readers — so a Q-LLM parse of a *trusted* const yielded a value that was tainted (Q_LLM) yet
+  carried `readers=None`, and the gate's stage 3 auto-permitted it into a WRITE without consulting
+  the declassification policy. The fast-path now requires an **explicit** readers set covering the
+  tool's required capabilities; unscoped tainted flows go through the declassifier. (Regression
+  tests at gate level and end-to-end: a recipient laundered through the Q-LLM is now blocked by the
+  policy instead of auto-committed.)
+- **Taint: `DERIVED` is no longer counted as an untrusted source.** Merging values derived solely
+  from the trusted query no longer manufactures taint (which caused spurious denials in policies
+  keyed on `is_tainted`); taint derives only from the actual presence of `TOOL_READ` / `Q_LLM` in
+  the joined sources. `DERIVED` remains on the label as an audit marker. The two fixes land
+  together deliberately: each previously masked the other.
+- **`RK_LLM_MAX_TOKENS` now has an effect.** `call_structured` / `parse_with_schema` defaulted to a
+  private module constant, silently ignoring the `settings.llm_max_tokens` override; they now read
+  settings (lazily) as the single source of truth.
+
+### Changed
+
+- **Transport faults fail closed with an audit record.** Provider API errors (rate limit exhausted,
+  5xx, network, SDK timeout) are wrapped in a new `TransportError(ReasonerError)` by the Anthropic
+  and OpenAI/Deepseek providers, so an in-flight run ends with a terminal trace event
+  (`PlanRejected`/`RunErrored`) instead of an unrecorded traceback.
+- **Model resolution is strict and construction-time.** `PLLM`/`QLLM` no longer default to
+  `model="fake"` (a real provider without an explicit model got a 404 deep inside a run); an
+  omitted model resolves via `default_model_for(provider.name)` at construction. `default_model_for`
+  now raises `ValueError` for unknown providers instead of silently falling back to the Anthropic
+  model, and maps `"fake"` to the FakeProvider's ignored sentinel. `call_structured` requires
+  `model=` explicitly.
+- **Anthropic default model refreshed**: `claude-sonnet-4-6` → `claude-sonnet-5` (comment variant
+  stays `claude-opus-4-8`); `.env.example` and `docs/DEVELOPMENT.md` updated, including the
+  previously undocumented `RK_LLM_TIMEOUT_SECONDS` / `RK_LLM_MAX_TOKENS` overrides.
+- **Branch coverage enabled** (`coverage: branch = true`): line coverage alone hid the gate's
+  untested readers fast-path; the new gate tests pin both directions of that branch.
+- **Toolchain drift eliminated.** pre-commit now runs ruff and pyright as local hooks through
+  `uv run` (same versions as `uv.lock`, same scope as `just lint`/`just typecheck` and CI, instead
+  of a stale pinned ruff mirror and a partial pyright scope); a new aggregate `just check` runs
+  lint + typecheck + test exactly as CI does. `CLAUDE.md` and the README role map now include
+  `tools/` (the registry is part of the no-bypass argument).
+
+## [0.4.1] - 2026-05-31
+
+### Changed
+
+- **PyPI distribution name** is now `capability-reasoning-kernel` (the import stays `reasoning_kernel`,
+  and the repository stays `reasoning-kernel`): `reasoning-kernel` is taken on PyPI by an unrelated
+  project. Released on real PyPI in addition to TestPyPI.
+
+## [0.4.0] - 2026-05-31
+
+A minor release: a discoverable public API at the package root, with an "Embedding the kernel" snippet,
+a maturity note, and a license section in the README. No breaking changes.
+
+### Added
+
+- **Public top-level API**: `reasoning_kernel` now re-exports the key building blocks and contracts
+  (`Interpreter`, `Gate`, `EffectDispatcher`, `PLLM`/`QLLM`, `ToolRegistry`, `ToolSpec`, `RunContext`,
+  `RunLimits`, the Plan IR, provenance types, …) under `__all__`, so integrators import from the
+  package root. See the README's *Embedding the kernel* section.
+
+## [0.3.0] - 2026-05-31
+
+A feature release: the value-combining `MergeStep` closes the last deferred item, with sound
+object-level taint and no change to the trusted core. No breaking API changes.
+
+### Added
+
+- **`MergeStep`** — the value-COMBINING step. It folds several earlier results into one structured
+  value, labelled with the *join* of its inputs (sources union + `DERIVED`, readers intersection,
+  subjects union), so taint only ever increases. This lets a single-`source` Q-LLM parse or sub-kernel
+  work over a composite of several reads. Taint stays object-level (the join over-approximates, which
+  is strictly safer); field-level labels remain deferred. (`just demo-merge`)
+
+## [0.2.0] - 2026-05-31
+
+A hardening release: the kernel now fails closed on every unsafe path, the trusted core is type-checked
+in strict mode with no suppressions, provider models are current, and composition is real. No breaking
+API changes.
+
+### Added
+
+- **Composable nested sub-kernels (§5.4)**: a `SubKernelStep` delegates untrusted content to an inner
+  kernel at a **clamped, reduced grant** — an injection in that content is confined to what the
+  delegated grant permits. `RunLimits.max_depth` bounds nesting. (`just demo-subkernel`)
+- **Multi-dimensional provenance**: a `ProvenanceLabel` carries *origin* (`sources`), *flow*
+  (`readers`), and *data subject* (`subjects`). Third-party data is never auto-released into a WRITE,
+  and the Q-LLM cannot launder any dimension.
+- **Termination bounds**: `RunLimits` caps steps / effects / q-parses, plus an optional per-call
+  reasoner timeout; a run exceeding a bound aborts closed (`RunAborted`).
+- **Quality bar**: coverage gate at 85% (`pytest-cov`), `pyright` strict over `schemas` + `kernel` +
+  `memory`, pre-commit hooks, and GitHub Actions CI (uv + just) running lint / typecheck / covered
+  tests on push & PR, with an optional manual live-provider job.
+- **Plan IR robustness**: `ArgRef.path` is validated at plan-construction time — a malformed dotted
+  path (empty / leading / trailing / doubled `.`) is rejected with a clear error instead of surfacing
+  opaquely at navigation time.
+- **Docs**: `docs/DEVELOPMENT.md` (setup, quality bar, provider configuration), a typed-library
+  `py.typed` marker, and a complete *Honest limits* section in the README — the trust boundary is
+  axiomatic, control flow is static and data-independent, and verification determinism is a discipline
+  rather than a typed invariant (mirrored in `DEVELOPMENT.md` rule #2 and the `DeclassPolicy` docstring).
+- **Robustness tests**: provider-failure fail-closed, prompt timeout abort, the demo tools failing
+  closed on malformed world state, and key-free coverage of the registry, value store, capability
+  algebra, and the demo declassifier's rejection branches.
+
+### Changed
+
+- **Provider models refreshed to 2026**: Anthropic `claude-sonnet-4-6` (variant `claude-opus-4-8`),
+  OpenAI `gpt-5.5` (variant `gpt-5.5-pro`), Deepseek `deepseek-v4-flash` (variant `deepseek-v4-pro`).
+  Deepseek is OpenAI-compatible and reuses the `openai` SDK via `base_url` (no separate dependency).
+- **Trusted core kept free of `Any`**: `TaintedValue.value` and the `ValueStore` path-navigation are
+  typed `object`; `_eval_step` is exhaustive over the `PlanStep` union (a new step kind that is not
+  handled is a type error).
+- **No suppressions**: removed every `# noqa` / `# type: ignore` from `src` and `tests`, fixing the
+  root cause instead (e.g. tests construct `RunId` / `StepId` via their constructors).
+
+### Fixed
+
+- **Reasoner failure is fail-closed**: a provider returning no usable output (empty / refused /
+  malformed) raises `ReasonerError`; the Conductor records it and commits nothing instead of crashing
+  or acting on a partial result.
+- **Prompt-timeout abort is prompt**: the timeout no longer blocks on the hung call — the executor is
+  shut down without waiting rather than used as a context manager.
+- **Demo tools fail closed**: `read_inbox` on an empty inbox raises a semantic `ValueError` rather than
+  an opaque `IndexError`.
+- Closed a provenance gate footgun and made the Conductor fail closed on any plan it cannot safely run.
+
+## [0.1.0] - 2026
+
+Initial reference implementation of the Reasoning Kernel pattern (strong / CaMeL-like form): the two
+invariants, no-effect-bypasses-the-Verifier by construction, the deterministic declassification seam,
+and the worked email-exfiltration demo.
+
+[0.5.0]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.5.0
+[0.5.0rc2]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.5.0rc2
+[0.5.0rc1]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.5.0rc1
+[0.4.2]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.4.2
+[0.4.1]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.4.1
+[0.4.0]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.4.0
+[0.3.0]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.3.0
+[0.2.0]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.2.0
+[0.1.0]: https://github.com/gianlucamazza/reasoning-kernel/releases/tag/v0.1.0

capability_reasoning_kernel-0.5.0/CLAUDE.md

@@ -0,0 +1,35 @@
+# CLAUDE.md — reasoning-kernel
+
+Framework-agnostic Python **reference implementation** of the Reasoning Kernel pattern (strong,
+CaMeL-like form; Debenedetti et al. 2025): the LLM is treated as untrusted compute, mediated by
+context on input and verification on output. Published to PyPI as `capability-reasoning-kernel`.
+Remote: `gianlucamazza/reasoning-kernel`.
+
+## The two invariants (do not violate)
+- **A** — the reasoner never sees raw reality: every model call gets a system-assembled, inspectable
+  context (`src/reasoning_kernel/context/`).
+- **B** — the reasoner never commits reality: no model output becomes a durable effect except through
+  the single deterministic gate (`src/reasoning_kernel/kernel/gate.py`).
+
+The pattern fixes a *topology*, not a policy guarantee — keep mediation/verification at those
+boundaries by construction.
+
+## Stack & layout
+- Python, `uv` (uv.lock), `pyproject.toml`, `just`. Lint Ruff, types pyright.
+- `src/reasoning_kernel/`: `context/` · `kernel/` (gate) · `reasoner/` · `memory/` · `schemas/` ·
+  `tools/` (registry — sole holder of tool callables, part of the no-bypass argument) · `demo/`
+
+## Commands
+```bash
+just check       # lint + typecheck + test (everything CI runs)
+just lint        # ruff
+just fix         # ruff --fix
+just typecheck   # pyright
+just test-live   # tests against live model
+just demo        # run demo (also: demo-live, demo-subkernel, demo-limits, demo-merge, demo-reasoner-error)
+uv sync          # install/refresh env (--all-extras for providers + dev tools)
+```
+
+## Conventions
+- It's a reference impl + spec, not a turn-key product — favor clarity and conformance over features.
+- Changes touching invariants A/B must preserve the topology; update `docs/` and the README spec.