Release 1.0.0rc2

.github/workflows/ci.yml

@@ -0,0 +1,38 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install dependencies
+        run: uv sync --dev
+      - name: Run test suite
+        run: uv run pytest
+      - name: Run type check
+        run: uv run mypy src/legis
+
+  override-rate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+      - name: Install dependencies
+        run: uv sync --dev
+      - name: Enforce override-rate gate
+        run: |
+          if [ -f legis-governance.db ]; then
+            uv run legis check-override-rate --db sqlite:///legis-governance.db
+          else
+            echo "::notice::No governance DB artifact found; override-rate gate skipped."
+          fi

.gitignore

@@ -12,3 +12,5 @@ __pycache__/
 *.egg-info/
 # Local audit/scratch databases (never commit audit data)
 *.db
+.filigree
+.filigree.conf

CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes to Legis are documented here. The format follows
+[Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the project
+versions per [PEP 440](https://peps.python.org/pep-0440/) /
+[SemVer](https://semver.org/) (pre-release: `1.0.0rc1`).
+
+## [1.0.0rc1] — 2026-06-03
+
+First release candidate for 1.0. Everything built through Sprint 6 plus the
+WP-M1 service-layer extraction, consolidated behind a stable version.
+
+### Added
+- **git/CI surface** — stateless `GitSurface` (branches, commits, renames with
+  `-M`, merge-base) and a recorded CI `CheckSurface`, exposed over `/git/*` and
+  `/checks/*`; injectable `PullRequestSource` seam with `/git/pull-requests/{n}`.
+- **Graded 2×2 enforcement engine** — chill / coached / structured / protected
+  cells; LLM judge behind an injected `LLMClient` seam (fail-closed verdict
+  parsing); HMAC-signed protected verdicts; decay sweep and the override-rate
+  gate (`legis check-override-rate`, exits 1 on FAIL).
+- **Agent-programmable policy grammar** — `/policy/evaluate` returning
+  CLEAR / VIOLATION / UNKNOWN, with honest `provenance_gap` events (no silent
+  false-green); TOML-backed one-off exemptions.
+- **SEI-keyed attestations** — `identity/clarion_client.py` + resolver
+  (resolve-then-key, honest degrade, lineage snapshot); all governance write
+  paths key on Stable Entity Identity when alive; `/governance/identity-gaps`
+  and `/governance/lineage-integrity` read surfaces.
+- **Suite combinations** — Wardline findings route into the 2×2 via
+  `/wardline/scan-results`; governed SEI-keyed sign-off binding to Filigree
+  issues via a tamper-bound `BindingLedger`.
+- **Console scripts** — `legis serve` (uvicorn factory) and
+  `legis check-override-rate`.
+- **Transport-agnostic service layer (WP-M1)** — `legis.service` extracts the
+  cross-cutting governance logic (`resolve_for_record`, `verified_records`,
+  `compute_override_rate`, the `submit_override` seam) out of the FastAPI route
+  closures and raises domain errors (`ServiceError` subclasses) rather than
+  `HTTPException`, so both HTTP and the forthcoming MCP adapter drive one code
+  path. Behavior-preserving; FastAPI handlers are now thin adapters.
+
+### Known limitations
+- The agent-facing **MCP surface** is designed and decomposed
+  (`docs/superpowers/specs/2026-06-03-legis-mcp-surface-design.md`) with WP-M1
+  landed; WP-M2..M6 (registry + `legis_explain`, the MCP stdio server, the
+  write/governance tools, safety hardening, judge reason-classification) are not
+  yet built.
+- The git-rename provider to Clarion is contract-locked but operatively gated on
+  Clarion driving a committed rev-range.
+- `HttpClarion` runs loopback-unauthenticated; sibling-gated work packages
+  (Filigree signature column, live-Clarion oracle + HMAC auth, operative
+  git-rename feed) remain.
+
+[1.0.0rc1]: https://peps.python.org/pep-0440/

README.md

@@ -4,7 +4,7 @@ Legis is the fourth Loom product: the git/CI and governance side of the suite's
 
 ## Status
 
-Legis is **implemented through Sprint 6**. The standalone git/CI surfaces, the graded 2×2 enforcement engine, the agent-programmable policy grammar, SEI-keyed attestations, and the Wardline/Filigree suite combinations are all built and tested; the git-rename provider to Clarion is contract-locked, operative pending Clarion's committed-range driving. See the combination matrix below for per-pairing status.
+Legis is at **`1.0.0rc1`** — the first release candidate. The standalone git/CI surfaces, the graded 2×2 enforcement engine, the agent-programmable policy grammar, SEI-keyed attestations, and the Wardline/Filigree suite combinations are all built and tested; the git-rename provider to Clarion is contract-locked, operative pending Clarion's committed-range driving. The transport-agnostic service layer (WP-M1) underpinning the forthcoming agent-facing MCP surface has landed. See the combination matrix below for per-pairing status and `CHANGELOG.md` for the release notes.
 
 ## The Loom suite
 

pyproject.toml

@@ -1,9 +1,9 @@
 [project]
 name = "legis"
-version = "0.1.0"
+version = "1.0.0rc2"
 description = "Legis — the git/CI + governance layer of the Loom suite"
 authors = [
-    { name = "John Morrissey", email = "john@pgpl.net" }
+    { name = "John Morrissey", email = "john@foundryside.dev" }
 ]
 requires-python = ">=3.12"
 dependencies = [
@@ -19,6 +19,7 @@ legis = "legis.cli:main"
 dev = [
     "pytest>=8.0",
     "httpx>=0.27",
+    "mypy>=1.19",
 ]
 
 [build-system]
@@ -34,3 +35,9 @@ filterwarnings = [
     # Matched by message (category is StarletteDeprecationWarning, not DeprecationWarning).
     "ignore:Using `httpx` with `starlette.testclient` is deprecated",
 ]
+
+[tool.mypy]
+python_version = "3.12"
+files = ["src/legis"]
+show_error_codes = true
+warn_unused_configs = true

src/legis/__init__.py

@@ -1,3 +1,3 @@
 """Legis — the git/CI + governance layer of the Loom suite."""
 
-__version__ = "0.1.0"
+__version__ = "1.0.0rc2"