release: v0.8.0 — receipt spec, policy registry, open core

CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to **signetry-core** are documented here. The format follows
 [Semantic Versioning](https://semver.org/). Until `1.0.0` the public API may
 change between minor versions.
 
-## [Unreleased]
+## [0.8.0] — 2026-09-01
 
 ### Added — the receipt format is now a published, independently testable spec
 

CONTRIBUTING.md

@@ -42,6 +42,14 @@ CI should be green.
 and [Discussions](https://github.com/Signetry/signetry/discussions).
 Well-scoped areas in this repo:
 
+- **A policy for the registry** — the most approachable change here: one YAML file in
+  `signetry_core/policies/` describing a stack's safe blast radius. No Python required,
+  and no test to write — `tests/test_policy_registry.py` is parametrized over every
+  entry, so your file is checked the moment it lands (metadata complete, declared blocks
+  actually blocked, declared allows actually allowed, no overlap between them).
+  `signetry policies` lists what exists and
+  [docs/site/policy-registry.md](docs/site/policy-registry.md) explains the fields; a
+  policy installs byte-for-byte, so what you write is exactly what an adopter gets.
 - **A new detection rule** — add a vuln class or language to
   `signetry_core/pipeline/findings/` with a test in `tests/test_findings_engine.py`.
 - **An executor adapter** — wire a new coding agent behind the `Executor` protocol

README.md

@@ -58,12 +58,12 @@ One core (`run_admission`), five checkpoints an agent's change must pass through
 
 ```bash
 # Not on PyPI — install from the source repo:
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 | Surface | Governs | Command |
 |---|---|---|
-| **Source install** | anything you script | `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"` |
+| **Source install** | anything you script | `pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"` |
 | **CLI + git hook** | the agent on your machine | `signetry admit . --mission "..." --agent claude-code` |
 | **Detection scan** | find vulns in any repo (7 languages) + govern the fix | `signetry scan . --sarif` · `signetry scan . --fix` |
 | **GitHub Action** | **every** agent's PR (Claude Code, Codex, Cursor, Copilot, Devin) | [Marketplace: Signetry Admission](https://github.com/marketplace/actions/signetry-admission) · [`@v1`](https://github.com/Signetry/action) |

SECURITY.md

@@ -20,7 +20,7 @@ dev-key verification trust, and — in the companion GitHub Action `< v0.1.3` 
 workflow script-injection sink). `0.5.1+` adds bring-your-own-key credential
 redaction for `--fix`. Pin the Action to `@v1` (which moves forward) or
 `@v0.1.3+`, and install `signetry-core` from source at `@v0.5.3` or later
-(`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`).
+(`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`).
 
 ## Reporting a vulnerability
 

docs/INTEGRATIONS.md

@@ -14,7 +14,7 @@ Codex, Cursor, Copilot, Devin, or a human, identically.
 
 ```bash
 # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 ```python
@@ -75,7 +75,7 @@ status check* in branch protection and nothing merges without a receipt.
 ## 4. MCP server (agents call governance themselves)
 
 ```bash
-pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0"
 python -m signetry_core.mcp_server            # stdio transport
 ```
 

docs/LAUNCH.md

@@ -35,7 +35,7 @@ provenance. Make it a required status check and nothing merges without a receipt
 
 Agent-agnostic; **open core** — the engine is source-available under BUSL-1.1
 (Apache-2.0 on 2030-08-31) and every integration is Apache-2.0 — installed from
-source (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`).
+source (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`).
 On the GitHub Marketplace:
 https://github.com/marketplace/actions/signetry-admission
 
@@ -97,7 +97,7 @@ jobs:
 Live demo — a permitted change passes, a forbidden `deploy.yml` edit is blocked:
 https://github.com/Signetry/autofix-demo/pulls
 
-Also usable as a CLI (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"`
+Also usable as a CLI (`pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"`
 → `signetry admit`), a git pre-push hook, an MCP server, or a Python library.
 Open core: the engine is source-available under BUSL-1.1 (Apache-2.0 on 2030-08-31)
 and every integration around it is Apache-2.0.

docs/RELEASING.md

@@ -5,7 +5,7 @@ Apache-2.0 on 2030-08-31) and is **not published to PyPI** — it is distributed
 installed **from source by tag**:
 
 ```bash
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 Pushing a version tag runs [`.github/workflows/release.yml`](../.github/workflows/release.yml),
@@ -15,14 +15,24 @@ as all prior PyPI releases were yanked).
 
 ## Cutting a release
 
-1. Bump the version in [`pyproject.toml`](../pyproject.toml) (`[project].version`).
-2. Commit: `git commit -am "release: v0.5.3"`.
-3. Tag and push:
+1. Move `## [Unreleased]` in [`CHANGELOG.md`](../CHANGELOG.md) to `## [X.Y.Z] — <date>`.
+   The release notes are extracted from that heading, so a release cut without it
+   ships the fallback text instead of its own changelog.
+2. Bump the version in [`pyproject.toml`](../pyproject.toml) (`[project].version`) to
+   match. The workflow fails the release if the two disagree.
+3. Update every `core@vX.Y.Z` pin that names the current release — the README, the
+   docs, `install.sh`, and the bundled integrations all print an install command a
+   user copies. `grep -rn 'core@v'` finds them; leave the `@v0.5.3 or later`-style
+   floors alone.
+4. Open a PR with those changes and merge it. `main` is protected and requires its
+   status checks, so a release cannot be pushed straight to it.
+5. Tag the merged commit and push the tag alone:
    ```bash
-   git tag v0.5.3
-   git push origin main --tags
+   git checkout main && git pull
+   git tag vX.Y.Z
+   git push origin vX.Y.Z
    ```
-4. The `Release` workflow will:
+6. The `Release` workflow will:
    - verify the tag matches `pyproject.toml`,
    - run `ruff` + `pytest`,
    - build sdist + wheel and run `twine check`,

docs/site/index.md

@@ -35,7 +35,7 @@ false — a human merges.
 
 ```bash
 # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 - Source (install from here): <https://github.com/Signetry/core>

docs/site/quickstart.md

@@ -4,7 +4,7 @@
 
 ```bash
 # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 signetry completion zsh >> ~/.zshrc   # optional: shell completion (bash | zsh | fish)
 ```
 

docs/site/scan-quickstart.md

@@ -10,7 +10,7 @@ proving it — start at [Quickstart](quickstart.md).
 
 ```bash
 # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source
-pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 ```
 
 ## Scan

install.sh

@@ -20,7 +20,7 @@
 set -eu
 
 # optional: SIGNETRY_VERSION=0.5.3 sh install.sh  (defaults to the latest hardened tag)
-VERSION="${SIGNETRY_VERSION:-0.6.0}"
+VERSION="${SIGNETRY_VERSION:-0.8.0}"
 SPEC="signetry-core @ git+https://github.com/Signetry/core@v${VERSION}"
 
 say() { printf '  %s\n' "$1"; }

integrations/git-hooks/pre-push

@@ -20,7 +20,7 @@ if [[ "${SIGNETRY_SKIP:-0}" == "1" ]]; then
 fi
 
 if ! command -v signetry >/dev/null 2>&1; then
-  echo "signetry: CLI not found — install from source with 'pip install \"signetry-core @ git+https://github.com/Signetry/core@v0.7.0\"'." >&2
+  echo "signetry: CLI not found — install from source with 'pip install \"signetry-core @ git+https://github.com/Signetry/core@v0.8.0\"'." >&2
   echo "signetry: skipping the governance gate (not installed)." >&2
   exit 0
 fi

integrations/github-action/action.yml

@@ -46,7 +46,7 @@ runs:
     - name: Install signetry-core
       shell: bash
       # BUSL-1.1 (Apache-2.0 on 2030-08-31); not on PyPI — install from source.
-      run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.7.0"
+      run: pip install "signetry-core @ git+https://github.com/Signetry/core@v0.8.0"
 
     - name: Stage the PR change as a working-tree diff
       id: stage

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "signetry-core"
-version = "0.7.0"
+version = "0.8.0"
 description = "An agent-agnostic change-control plane for coding agents. Governs Codex, Claude Code, Cursor, or any agent behind one admission pipeline and proves every change with a signed receipt."
 readme = "README.md"
 requires-python = ">=3.11"

signetry_core/mcp_server.py

@@ -7,7 +7,7 @@
 receipt; the verdict is produced outside the model.
 
 Run it:
-    pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0"
+    pip install "signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0"
     python -m signetry_core.mcp_server        # stdio transport
 
 Register it with an MCP client (e.g. Claude Code) pointing at this command.
@@ -106,7 +106,7 @@ def build_server():  # pragma: no cover - exercised only when mcp is installed
     except ImportError as exc:  # noqa: F841
         raise SystemExit(
             "The MCP server needs the optional dependency: pip install "
-            "'signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.7.0'"
+            "'signetry-core[mcp] @ git+https://github.com/Signetry/core@v0.8.0'"
         ) from None
 
     mcp = FastMCP("signetry-core")