chore(release): v0.76.0 -- G1 multi-tenant memory isolation + WS-F trade-secret wheel gate

[quantamixsol]

chore(release): v0.76.0 — G1 multi-tenant memory isolation + WS-F trade-secret wheel gate

What changed

• ADR-225 G1 multi-tenant memory: Per-tenant ReasoningMemory registry with thread-safe provision() factory. validate_tenant_id() normalisation pipeline blocks NUL bytes, double-encoding, unicode homographs, and path-traversal sequences. _SCOPING_ON read at import-time as TOCTOU guard. merge_concurrent() and rollback() validate every entrys tenant_id` before committing.
• WS-F trade-secret wheel gate (ADR-BIZ-001): CI gate inspects the Community wheel RECORD manifest on every PR and tag push; fails build if graqle/governance/calibration*.py appear. Stem matching covers compiled variants.
• ip_content_scan case-insensitive fix (PR fix(ci): WS-F Sentinel hotfix - case-insensitive allowlist + 12 tests for ip_content_scan #218 follow-on).
• Studio/server static mount ordering fix -- app.mount moved after all include_router calls.
• deploy-lambda.yml CI restore -- gate was silently no-op since PR fix(ci): restore deploy-lambda.yml (emptied by cherry-pick conflict resolution) #215 cherry-pick conflict.
• 501 new tests (884 total passing).

ADR-209 Sentinel chain

Check	Result
graq_safety_check	MEDIUM / 0 blockers
graq_review(all) x2	APPROVED -- 91%/87% confidence
graq_predict	SKIPPED_LOW_CONFIDENCE -- all risks ground-truthed as false positives
graq_review(security)	ALL 5 OWASP CLEAR (A01/A02/A03/A07/A09)

Private PR #208 merged on quantamixsol/research-development-graqle. This is a cherry-pick of commit 7631c71c (CHANGELOG only, no source code changes).

Sole approver: Harish Kumar (CR-001 para 9).

After merging this PR

Tag v0.76.0 will be moved to this merge commit and PyPI publish will be triggered via CI OIDC trusted-publish.

Upgrade notes (0.75.1 -> 0.76.0)

• No breaking changes. All new parameters have defaults.
• GRAQLE_TENANT_SCOPING=1 required to use non-default tenant IDs.
• clear_registry() raises RuntimeError unless GRAQLE_TEST_MODE=1.

[github-actions]

🛡️ GraQle PR Guardian

💥 Blast Radius: 1 module affected

Module	Files Changed	Risk Level	Impact Radius
CHANGELOG.md	1	🟡 T2	1

Total blast radius: 1

---

🏛️ Governance Verdict

⚠️ WARN

• T2: Advisory warnings detected. Review recommended.

---

🔍 SHACL Violations

No SHACL violations detected. ✅

---

🔐 Approval Requirements

This PR requires approval from: T2

• A Senior Engineer or above must approve.

❌ Approval requirement NOT yet satisfied.

---

Metric	Value
Blast Radius	1
Files Analyzed	1
Blocked	0
SHACL Violations	0
Verdict	WARN

---

_{🔬 Powered by GraQle PR Guardian v0.1.0 · Scan completed 2026-06-26T15:24:06.615405+00:00}