v0.14.0 - Durable evidence, deterministic authorization, and a separate execution boundary

Opt-in durable evidence and versioned state, pure recovery with explicit audit closure, copy-on-write migrations, deterministic authorization, and a separate execution boundary. SETT restores what durable evidence can support and never resumes interrupted work automatically.

✨ Added

• sett.persistence: EvidenceStream and StateRecordStore keep append-only evidence separate from random-access state, bound by PersistenceBackend
• Versioned binary formats for trace preimages, stream positions, stage-state envelopes, private-memory mutations, and migration manifests
• Durable trace evidence preserves the exact preimage used for each entry hash; recovery never reproduces a historical hash by reserialization
• IntegrityPolicy, Sha256IntegrityPolicy and NoDigestPolicy; SHA-256 is documented as change detection, not authentication
• In-memory reference implementations and a SQLite backend with transactional compare-and-append and idempotent state writes
• SQLite durability declarations come from effective pragma readback rather than requested settings
• TraceRecorder.restore() for pure recovery and TraceRecorder.resume() for explicit continuation
• RecoveryReport separates chain integrity, trace completeness, reconstructed outcome, unresolved boundaries, stage descriptors, and the last durable position
• Durable stage-output persistence for run_pipeline_controlled(), with materialization as a separate explicit operation
• Opt-in PrivateMemory persistence through a stable memory_id; ordinary ephemeral memory is unchanged
• AuditClosure as an axis independent from ExecutionStatus, with AuditGapPolicy and SETTAuditClosureError
• Append-only boundary dispositions with typed evidentiary bases
• sett.authorization_ruler: closed GRANT / REQUIRE_APPROVAL / DENY vocabulary, detached requests with explicit field provenance, and store-backed receipts
• ReceiptUse declared per policy decision; replay requires unanimous policy consent plus a controlled request with an idempotency key
• Versioned strict JSON authorization fingerprint with NFC text, signed-zero and integral-float normalization, and exact IEEE-754 hexadecimal for other floats
• AuthorizationRequestResolver and optional paired executor configuration; once enabled, authorization is mandatory for every handler
• sett.execution_ruler owns the effect boundary that verifies authorization receipts
• docs/foreign_callers.md: the stable contract for governing an external tool loop with no dependency in either direction
• examples/foreign_tool_loop.py and examples/governance_card.py, plus reusable adapter and phrasing-expert templates

🔄 Changed

• SETTOrchestrator accepts an optional backend and explicit persistence policy; durable execution is limited to run_pipeline_controlled()
• SETTAgent accepts an optional private_memory_id; omitting it preserves ephemeral behavior
• ExecutionResult carries audit_closure, defaulting to NOT_REQUESTED
• Trace event vocabulary and frame size are bounded before a lifecycle boundary can open, and only when persistence is enabled
• The documented concurrency roster now contains ten narrow guarantees

🐛 Fixed

• A durable terminal whose metadata is rejected records a framework-owned contingency terminal, so invalid terminal metadata cannot leave an already opened boundary unverifiable
• Distribution metadata now uses the PEP 639 SPDX form, declares LICENSE through license-files, and no longer uses the deprecated license table or license classifier
• The release builder now rejects unsafe destinations and option-like artifacts, handles command-line help safely, and fixes cross-platform ZIP entry metadata
• Corrected Convention #21 to record that v0.13.2 was subsequently published, without changing the rationale for its Pocket TTS exception
• Corrected stale Convention #9: human_at_risk is an urgency and audit signal that can conservatively promote ALLOW to WARN; it does not override the harm score
• Completed the source-installation correction begun in v0.13.2 across adapter docs, runtime dependency errors, API examples, and test documentation
• Corrected result_digest() documentation that described an unkeyed digest as unable to reveal its input
• Corrected the public ethics description: numeric harm scoring comes from ContextAnalyzer, not from HarmCategory weights or the rules list
• SQLitePersistenceBackend.open() now returns an object accepted directly by SETTOrchestrator
• verify() now documents that an interrupted run also returns False, and points to RecoveryReport to distinguish interruption from corruption

🛡️ Audit remediation

• M-01: SQLite infrastructure errors are normalized without flattening the domain failures they must not hide
• M-02: world-readable SQLite files are documented rather than silently assumed safe
• M-03: an automated matrix now covers every declared Python version
• L-01: SETTAdapterError.__str__() no longer carries provider-supplied text
• L-02: template distribution corrected

🧹 Maintenance

• CONTRIBUTING.md fixes the lint gate to the Ruff version pinned in pyproject.toml
• Convention #23 enumerates all eight structural pillars and records when the Ruler suffix may name a class
• Release archives use fixed cross-platform entry metadata and are byte-reproducible for identical source bytes under a matching Python/zlib toolchain

✅ Compatibility

• Persistence and authorization are opt-in and add no mandatory dependency; SQLite uses the standard library
• No v0.13.2 public symbol was removed or renamed
• sett.SETTExecutor and sett.core_ruler.executor continue to resolve after the executor moved to sett.execution_ruler
• Supported Python versions are 3.11, 3.12, 3.13 and 3.14; requires-python is now >=3.11, correcting a v0.13.2 claim that never worked
• SETTAdapterError.__str__() drops provider text; structured attributes, safe_view(), reason codes and __cause__ are unchanged. Code that asserted on provider wording inside a message must read __cause__
• 1,255 tests pass, comprising the 1,038-test v0.13.2 baseline plus 217 new tests
• Automatic pipeline resumption, retention, compaction, cross-namespace migration, import, and production secret storage remain outside this release

⚠️ Architectural decision

Two structural pillars enter the framework. Authorization is promoted first and execution derives from it, so the dependency direction points away from the kernel. sett.core_ruler keeps its kernel contracts; its historical executor module is a compatibility reexport, and those kernel contracts have no runtime dependency on Authorization.

💖 Sponsors

Sponsors:
Eight tiers from a symbolic $1 up to logo placement on 4humanityAI.com
With explicit limits on what sponsorship does and does not buy.

See the complete itemized history in CHANGELOG.md.