Python SDK 0.4.0

What's Changed

• Create AGENTS.md by @PetrefiedThunder in #107
• Add scoped AGENTS.md (app/services + tests) by @PetrefiedThunder in #108
• Align AWI control plane with research draft by @PetrefiedThunder in #109
• Refresh trust plane README by @PetrefiedThunder in #110
• Sharpen the trust-plane product spine by @PetrefiedThunder in #112
• fix(security): require agent ownership on comms send/ack/handoff by @PetrefiedThunder in #114
• build(deps): update pydantic-settings requirement from >=2.14.0 to >=2.14.1 by @dependabot[bot] in #116
• build(deps): update cryptography requirement from >=46.0.0 to >=48.0.0 by @dependabot[bot] in #117
• build(deps): update uvicorn requirement from >=0.46.0 to >=0.48.0 by @dependabot[bot] in #118
• build(deps): update greenlet requirement from >=3.0.0 to >=3.5.1 by @dependabot[bot] in #119
• build(deps): update fastapi requirement from >=0.136.1 to >=0.136.3 by @dependabot[bot] in #120
• Extract shared wrapper edge client and document KMS path by @PetrefiedThunder in #128
• Bump deps to clear 18 of 19 known CVEs by @PetrefiedThunder in #137
• Flip trust-plane defaults to fail-closed by @PetrefiedThunder in #144
• build(deps): bump pyjwt from 2.12.1 to 2.13.0 by @dependabot[bot] in #133
• build(deps): bump starlette from 1.0.0 to 1.3.1 by @dependabot[bot] in #136
• Bump cryptography & python-multipart in uv.lock (clear CVEs) by @PetrefiedThunder in #145
• build(deps): update redis requirement from >=7.4.0 to >=8.0.0 by @dependabot[bot] in #121
• build(deps): update pytest-asyncio requirement from >=1.3.0 to >=1.4.0 by @dependabot[bot] in #124
• build(deps): update uvicorn requirement from >=0.48.0 to >=0.49.0 by @dependabot[bot] in #127
• build(deps): update stripe requirement from >=15.1.0 to >=15.2.1 by @dependabot[bot] in #129
• build(deps): update greenlet requirement from >=3.5.1 to >=3.5.2 by @dependabot[bot] in #140
• build(deps): bump pydantic-settings from 2.14.1 to 2.14.2 by @dependabot[bot] in #138
• build(deps): update fastapi requirement from >=0.136.3 to >=0.138.1 by @dependabot[bot] in #139
• build(deps): update pydantic-settings requirement from >=2.14.1 to >=2.14.2 by @dependabot[bot] in #142
• build(deps): bump actions/checkout from 6 to 7 by @dependabot[bot] in #141
• build(deps): update pytest requirement from >=9.0.3 to >=9.1.1 by @dependabot[bot] in #143
• Dev-loop efficiency: fast test split, fix mypy hook, quiet warnings by @PetrefiedThunder in #146
• build(deps): bump actions/cache from 5 to 6 by @dependabot[bot] in #147
• build(deps): update sqlmodel requirement from >=0.0.38 to >=0.0.39 by @dependabot[bot] in #148
• build(deps): update stripe requirement from >=15.2.1 to >=15.3.0 by @dependabot[bot] in #149
• build(deps): update redis requirement from >=8.0.0 to >=8.0.1 by @dependabot[bot] in #150
• Phase 1 dev-loop: planner solver fallback + self-contained make test by @PetrefiedThunder in #153
• build(deps): update alembic requirement from >=1.18.4 to >=1.18.5 by @dependabot[bot] in #151
• build(deps): update greenlet requirement from >=3.5.1 to >=3.5.3 by @dependabot[bot] in #152
• Phase 2 (#3): single dependency source — stop committing uv.lock by @PetrefiedThunder in #154
• Repo review + fix KYC IDOR, billing idempotency, and enable real lint by @PetrefiedThunder in #157
• build(deps): update fastapi requirement from >=0.138.1 to >=0.139.0 by @dependabot[bot] in #155
• Remove dead proof-surface code and re-harden mypy by @PetrefiedThunder in #158
• build(deps): update mypy requirement from >=2.1.0 to >=2.2.0 by @dependabot[bot] in #160
• build(deps): update uvicorn requirement from >=0.49.0 to >=0.51.0 by @dependabot[bot] in #161
• Trust/billing/auth hardening: tenant isolation, idempotency, concurrency, audit-chain, and carry #159 to main by @PetrefiedThunder in #162
• build(deps): update stripe requirement from >=15.3.0 to >=15.3.1 by @dependabot[bot] in #163
• build(deps): update mypy requirement from >=2.2.0 to >=2.3.0 by @dependabot[bot] in #165
• build(deps): update uvicorn requirement from >=0.49.0 to >=0.51.0 by @dependabot[bot] in #166
• build(deps): bump actions/setup-python from 6 to 7 by @dependabot[bot] in #167
• build(deps): update fastapi requirement from >=0.139.0 to >=0.141.1 by @dependabot[bot] in #168
• build(deps): update greenlet requirement from >=3.5.3 to >=3.5.4 by @dependabot[bot] in #169
• Harden trust-plane scaffolding and close AWI HTTP bypass by @PetrefiedThunder in #170
• docs: partner first-tool runbook by @PetrefiedThunder in #171
• docs: link partner runbook from WEDGE by @PetrefiedThunder in #172
• Add dogfood trust-plane playground (partner.notes.write) by @PetrefiedThunder in #173
• Harden trust-plane charge/receipt and idempotency (P0) by @PetrefiedThunder in #174
• Sync exactly-once positioning + marketing site draft by @PetrefiedThunder in #175
• Publish site agent discovery pointers by @PetrefiedThunder in #176
• docs(site): agent-middleware naming and Vercel URL by @PetrefiedThunder in #177
• Normalize durable-state DATABASE_URL and fail closed by @PetrefiedThunder in #178
• docs: Phase 1 live verify + Phase 2 partner inventory caveats by @PetrefiedThunder in #179
• fix: gate MCP discovery stubs when proof surfaces are off by @PetrefiedThunder in #180
• docs: Phase 2 live acceptance verified on Railway by @PetrefiedThunder in #181
• Phase 3: Railway deploy posture + production-trust CI by @PetrefiedThunder in #186
• Phase 4: migrations-on-start / reduce create_all reliance by @PetrefiedThunder in #187
• Phase 5: docs / OpenAPI / discovery wedge honesty by @PetrefiedThunder in #188
• Phase 6: freeze proof-surface scaffolding by @PetrefiedThunder in #189
• Phase 7: optional follow-ups (safe slice) by @PetrefiedThunder in #190
• build(deps): update redis requirement from >=8.0.1 to >=8.1.0 by @dependabot[bot] in #182
• build(deps): update uvicorn requirement from >=0.51.0 to >=0.52.0 by @dependabot[bot] in #183
• build(deps): update stripe requirement from >=15.3.1 to >=15.4.0 by @dependabot[bot] in #184
• build(deps): update mcp requirement from <2,>=1.28.0 to >=1.28.0,<3 by @dependabot[bot] in #185
• fix: stop advertising unpublished SDK installs in discovery by @PetrefiedThunder in #191
• docs: mark Alembic stamp + migrate-on-start done by @PetrefiedThunder in #192
• feat: opt-in ENABLE_DOGFOOD_TOOL for live partner.notes.write by @PetrefiedThunder in #193
• fix: flush wallets before ledger FK inserts by @PetrefiedThunder in #194
• fix: validate signing key at startup and health by @PetrefiedThunder in #196
• fix: normalize tz-aware datetime binds to naive UTC for Postgres by @PetrefiedThunder in #195
• fix: explicit naive-UTC normalization before sign + persist by @PetrefiedThunder in #197
• Railway deploy gate + CI fixes + Sentinel human-approval integration by @PetrefiedThunder in #198
• Harden the Sentinel human-approval gate (adversarial review fixes) by @PetrefiedThunder in #199
• chore: fix lint debt outside CI scope, lint whole repo in CI, raise vulnerable dependency floors by @PetrefiedThunder in #200
• security: remove leaked production API key, add secret scanning, harden live test harness by @PetrefiedThunder in #201
• security: API key rotation — runbook, generator/verifier tooling, incident record by @PetrefiedThunder in #202
• fix: close confirmed trust-plane authorization & isolation gaps by @PetrefiedThunder in #203
• fix: make key revocation contain compromises; contain negative-balance chargebacks by @PetrefiedThunder in #204
• feat: ship governed MCP dispatch, SDK release, and crash proofs by @PetrefiedThunder in #205

Full Changelog: v1.2.0-rc.1...python-sdk-v0.4.0