chore(release): prepare ACE 0.6.0 candidate

[eamirian]

Problem

ACE 0.6.0 needs final package and workflow identities for the already merged Measured Intelligence
runtime without publishing or claiming the milestone complete.

This draft prepares the bounded release candidate only. It does not merge, tag, publish, close
#38, or make any proposal effective.

Scope

• align Core package/import/engine/container/workflow identities on 0.6.0
• release the separately distributed reference workspace-action adapter as 0.2.0 with
  ace-core>=0.6.0,<0.7
• retain the adapter's unchanged executable capability identity at 0.1.0
• normalize the separately built adapter sdist for reproducible release artifacts
• add candidate README/changelog copy, focused identity guards, a bounded work packet, and
  point-in-time evidence

The runtime contract remains domain-neutral. Core/Intelligence contain no World nouns or source
policy, and measured-impact proposals remain non-effective.

Exact candidate proof

Source implementation commit: 6e1a3a733e17a5c8e0d7edc9bcb8017ff5f0e8f0

Fixed epoch: 1786477483

Two independent builds were byte-equal:

• Core wheel: baf11e4a6283a28e1593adb992a8d59a3bfcec29dba003aeb06c94ae3043647f
• Core sdist: a42984b3dcb5dfb0872230767de74ed745e79566937d85f47109c3c49510d67a
• Adapter wheel: 32ec89012aea11fbc08018ccb80dc72ccae435b92c187e65a8b0ad23d3fcc58a
• Adapter sdist: 0cd3e7fbe746c7780baa6206d9cc2d568d884cb9f949578cabaf0569991db523

All four passed strict metadata validation and archive-boundary inspection. A clean Python 3.12.13
environment installed only the exact wheels plus public dependencies and reported Core 0.6.0,
adapter distribution 0.2.0, adapter implementation 0.1.0, and exactly 11 thin runtime tools.
pip-audit 2.10.0 reported no known vulnerabilities, skipping only the two intentionally
unpublished candidate distributions.

Verification

• focused package/build/measured-impact/disposition/adapter suites: 51 passed, 2 skipped
• evidence/index/package/build regression: 16 passed
• ruff check .: passed
• ruff format --check .: passed, 2,047 files
• local fast suite: 7,299 passed, 241 skipped, 249 deselected, 7 environmental failures
  • four loopback tests passed unchanged when rerun with loopback access
  • three checksum-frozen historical baseline tests require GitHub's normal checkout rather than
    a linked worktree

This PR must remain draft until the normal-checkout required gates pass.

Dependencies and release boundary

Advances #38; does not close it.

Release closeout still depends on:

• review and merge of docs(intelligence): bind merged-source convergence #95
• review and merge of World Intelligence PR
  World measured-intelligence live-main convergence domain-world-intelligence#17
• final artifact rebuild from the eventual release merge
• clean public-index install and independent World artifact reproduction
• compatibility/security acceptance and explicit release-owner approval

Issue #49 F1 and F5 are complete. F3 remains open, unwaived, contained, and due 2026-11-05.

Risk and rollback

Primary risk is identity drift between a candidate and the eventual merge/tag. Any later source
change invalidates these hashes and requires a fresh build. Rollback is a straight revert of the
two release-candidate commits; no schema, runtime contract, governed state, action, tag, release,
or registry state is mutated.

[eamirian]

Merge-order and owner-disposition receipt:

• Review/merge Core docs(intelligence): bind merged-source convergence #95 before rebasing this release candidate.
• The only direct changed-file overlap between docs(intelligence): bind merged-source convergence #95 and chore(release): prepare ACE 0.6.0 candidate #96 is
  docs/evidence/README.md. A three-way merge produces one adjacent-entry conflict there; the
  correct resolution is additive and retains both the merged-source-convergence entry and the
  0.6.0 release-candidate entry.
• Do not pre-merge docs(intelligence): bind merged-source convergence #95 into this draft: that would widen chore(release): prepare ACE 0.6.0 candidate #96's review surface and change its source
  identity. After docs(intelligence): bind merged-source convergence #95 merges, rebase chore(release): prepare ACE 0.6.0 candidate #96 onto exact main, resolve the index additively, and rerun
  the reproducible build, clean-install, audit, World-artifact, and required-CI gates. Existing
  candidate hashes are point-in-time evidence and must not be reused as final-release hashes.
• World PR World measured-intelligence live-main convergence domain-world-intelligence#17 remains an independent
  review/merge dependency; it has no repository-level file overlap with this Core branch.
• Issue Track accepted E1 post-release security hardening (F1–F7) #49 owner disposition is complete and supersedes the earlier pending-status note on docs(intelligence): bind merged-source convergence #95:
  F1 and F5 are checked against merged Core
  7013de62ae7320c51c3de9e9a03b049e768e4d84; F3 remains unresolved and unwaived, explicitly due
  2026-11-05 under the public containment.

All three drafts remain open, mergeable, green, and without submitted reviews. This note authorizes
no merge, tag, publication, issue closure, or 0.6 completion claim.

[eamirian]

Disposable merge-preview receipt (no live branch mutation):

base: f0d2191ba7cf2d33ccfc3c821422786929be8349
merge first: Core #95 head 475cdf537e1ebae941785adb539bb2b48489c739
apply second: Core #96 commits through 54812c6008bd0594c35d287a8605ac653b8b4734

• docs(intelligence): bind merged-source convergence #95 merged cleanly onto the exact current-main base used by chore(release): prepare ACE 0.6.0 candidate #96.
• Applying chore(release): prepare ACE 0.6.0 candidate #96 produced exactly one conflict, in docs/evidence/README.md.
• The additive resolution retained both the merged-source-convergence entry and the 0.6.0
  release-candidate entry.
• The resulting preview contains the complete 22-file union of both PRs; no runtime, release,
  roadmap, maturity, work-packet, or evidence file was dropped.
• Focused evidence-index, package-identity, build-backend, measured-impact, disposition, and
  reference-adapter verification: 56 passed, 2 skipped.
• ruff check ., ruff format --check . (2,047 files), and git diff --check: passed.
• The disposable checkout is detached and unpushed. No candidate hash is promoted to a final
  release hash.

This confirms the documented merge order and exact conflict resolution. Final review still must
merge #95 first; #96 must then be rebased onto actual main and all artifact, installed-consumer,
World, security, and CI gates rerun from the resulting exact source.

[eamirian]

Release-owner final candidate authorization (2026-08-11)

I authorize this exact rebased candidate for squash merge as the ACE 0.6.0 release-preparation packet.

Exact candidate identity and gates:

• head: 13dd676331b597768bb3e22e00670cecba5fb5cf
• CI: run 31533859313 — lint, security audit, fast suite, zero-extension kernel, Canvas, and Docker all passed
• focused release/impact suite: 56 passed, 2 skipped
• reproducible Core wheel SHA-256: 01e3a8f98a636a00b221888857a8d8107d97948d7791f49b39c9ec528d194be9
• reproducible Core sdist SHA-256: 31c0c0bd26208a8724cdc8f9a8f5498980fdf9b678c68ef33de20157a438cf83
• reproducible reference-adapter wheel SHA-256: fe9e2898086e9f9fc49f230aa0a2c468f8f0625e56432f0537b1d25a69c2cc6e
• normalized reference-adapter sdist SHA-256: 2246e287f1e6879cf0708ada9196f29b48e6046cbbe1318fe9bb99cb1cb15de8
• strict archive checks, isolated-wheel installation, eleven-tool boundary, and vulnerability audit passed
• PyPI ace-core==0.6.0 identity was unoccupied at the candidate check
• prerequisite Core PR docs(intelligence): bind merged-source convergence #95 and World PR IA-R1: add the read-only Product map #17 are merged; both merged default-branch workflows passed

The committed candidate evidence remains an immutable point-in-time record of its stated source identity. The squash-merged release commit and public artifacts will receive fresh hashes and a separate released-artifact closeout record.

This authorization permits merge and the subsequent gated release process. It does not waive exact-tag rebuilding, trusted publishing, public-index installation, World 0.10.0 reproduction, or milestone closeout checks.