v4.0.0

⚠ BREAKING CHANGES

• adopt RAES environment-pack identity
• provenance schema_version is now scenario-pack-provenance/v2 with sources[].kind removed; the scenario-pack contract version is 3; a challenges[].category field is rejected by validation (ADR 0014).
• remove bespoke oracle model (#109)
• validate pack sdl/ through ACES and cross-check flag placement (#92)

Features

• add reusable infrastructure kit authoring (#226) (ff8149d)
• add scenario-pack validation and release tooling (16a5889)
• add single-pack consumer validation API (#104) (5d73177)
• add single-pack consumer validation API (#104) (fa1383d)
• add TechVault example scenario pack (#228) (49a3d56)
• add the TechVault environment pack (#238) (462dc23)
• adopt RAES environment-pack identity (1fe4e57)
• adopt RAES environment-pack identity (#164) (1fe4e57)
• align pack vocabularies to ACES concept-authority (#111) (e8a20e6)
• catalog: render pack cards and a machine-readable catalog index (#206) (58013af)
• cli: add beginner-safe static pack check with actionable diagnostics (#193) (2d8b29f)
• consume ACES associated-artifact manifests (#98) (2b3f730)
• consumer-api: public single-open pack artifact resolver (#209) (f05338e)
• define the environment-pack publication profile for artifact satisfaction (#184) (9af729d)
• discover all supported pack checks (#117) (a8ddd35)
• distribution: add verified pack supply-chain workflows (#257) (759ec95)
• remove bespoke oracle model (#109) (6cadaf3)
• require the compatibility-tested RAES 3.x runtime contract (b7fafc4)
• require the compatibility-tested RAES 3.x runtime contract (5ad5d9c), closes #217
• scaffold: replace the monolithic scaffold with a progressive wizard (#211) (2acc73a)
• strip ACES semantic extensions and add an anti-extension guard (#91) (7892dcf), closes #83
• techvault: author operator-access proxies + capture sidecar as component builds (7cf97fb)
• techvault: author the indexer internal_users.yml (58e79a9)
• techvault: declare aptl-tempo config and startup command (18d2f10)
• techvault: declare Cortex job index as ADR-088 initial service state (#269) (d5385f8)
• techvault: declare misp-db and shuffle-opensearch runtime environment (a1a1211)
• techvault: declare SOC app configs (otel, grafana, cortex, thehive) (#259) (d448316)
• techvault: declare suricata run config + cortex-index-init placement (#259) (02314a8)
• techvault: declare wazuh cluster env desired-state (#259) (4ef0569)
• techvault: declare wazuh loopback published ports (c318349)
• techvault: declare wazuh sidecar agent environment (6abf245)
• techvault: declare wazuh-dashboard config content (#259) (a2a2ddc)
• techvault: declare wazuh-indexer opensearch.yml security config (#259) (499bd04)
• techvault: fully declare cortex-index-init (image, entrypoint, script) (99973e7)
• techvault: replace subset SDL with the full canonical TechVault scenario (0122582)
• techvault: replace subset SDL with the full canonical TechVault scenario (7fb9bc5)
• validate pack sdl/ through ACES and cross-check flag placement (#92) (f7129ea)

Bug Fixes

• accept explicit pack validation roots (#116) (74dbac8)
• adopt ACES schema $id namespace and schema_version string form (#110) (7c2f305)
• adopt RAES 2 and recover interrupted releases (#171) (687418e)
• deps: bump aces-sdl from 0.21.0 to 0.23.0 (#123) (db7035d)
• deps: bump aces-sdl from 0.23.0 to 0.23.1 (#131) (6e65fd7)
• deps: bump annotated-doc from 0.0.4 to 0.0.5 (#201) (c2811a9)
• deps: bump coverage from 7.13.1 to 7.15.2 (#145) (81df034)
• deps: bump cyclonedx-bom from 7.3.0 to 7.3.1 (#150) (412f11a)
• deps: bump fastapi from 0.140.0 to 0.140.7 (#167) (bf743a4)
• deps: bump fastapi from 0.140.7 to 0.141.1 (#199) (6535ff5)
• deps: bump furo from 2025.7.19 to 2025.12.19 (#149) (7fbf5f9)
• deps: bump hatchling from 1.30.0 to 1.31.0 (#147) (5ed85e9)
• deps: bump myst-parser from 4.0.1 to 5.1.0 (#151) (0e265ba)
• deps: bump raes from 1.1.0 to 2.0.0 (#168) (42d0e31)
• deps: bump uvicorn from 0.51.0 to 0.52.0 (#202) (c502425)
• deps: bump websockets from 16.1.1 to 17.0 (#243) (6f52cc2)
• export verified tags for manual recovery (#175) (a8eca33)
• issue-skeleton: stop defaulting pack issues to env-packs (#195) (91f0ca6)
• pin RAES 3.3.0 (#247) (f900df5)
• pin working gitsign verifier (#173) (4691f20)
• publish infrastructure kits in env-packs (#232) (079cb84)
• publish only the active PyPI distribution (#179) (7ef700e)
• reject participant/restricted artifact-boundary overlaps (#127) (56e0eab)
• restore locked tooling for historical release (#177) (d465e18)
• ship TechVault in PyPI distributions (#253) (1b5b99c)
• techvault: align soc-certificate output paths with the issued layout (f4444a9)
• techvault: declare thehive-es ES env (single-node, security off, 512m heap) (#259) (8601f71)
• techvault: mark cortex-index-init as one-shot (autoremove) (#259) (09ff951)
• techvault: realize the misp-sync TLS flag and the db-log forwarding source (74ba39d)
• techvault: suricata direct exec, cortex-init ES wait, ad samba caps (#259) (32857a9)
• techvault: update proxy component-build spec digests (1d842ce)

Reverts

• 21 contract-v1 provenance ledger; restore provenance.v0 (95991af)
• contract-v1 provenance ledger (#21) — content-safety attestation unworkable for live-fire (5e88f70)

Documentation

• add ACES scenario-pack contract (ASP-0002) (42a524e)
• add documentation scrub policy and migration scrub checklist (5e705e2)
• add Ground Control requirement specs as repo-local files (#264) (ed7d966)
• add migration scrub policy (#108) (1913856)
• add template scenario-pack scaffold (ASP-0003) (e0b6b77)
• add versioning and branch-protection governance for ASP-0001 (71fe219)
• clarify the RAES env-pack format ownership boundary (#160) (d8b7835)
• consume ACES reusable-asset trust policy for pack provenance (#90) (dc3f106)
• establish ACES-subordinate charter (ADR 0009) and align governing docs (#88) (db73b71)
• fix contract reference doc tool paths (aces-pack-validate/release) (bb8864b)
• make current for first release; remove Ground Control from docs (2af0225)
• move scenario-pack definition from penumbra-scenarios (a376bca)
• record authoring and tooling ownership plan (ASP-0013) (622d024)
• record capture workflow placement decision for ASP-0014 (4485f2d)
• record release-please signing constraints in ADR 0017 (#130) (d20b5d7)
• rewrite documentation for users, splitting public from developer docs (#186) (0d5f22c)