v0.11.0

Added

• examples/real_data/iso_ne_case1/ holds the first non-synthetic sealed PRC
  evidence the shipped chain produced: a documented real ISO-NE forced
  oscillation (near 0.27 Hz) adapted with spo pmu-ieee-adapt and screened with
  spo pmu-ringdown. The sealed pmu_ringdown_prc_evidence.json records the
  recovered inter-area modes (0.2753 / 0.2851 Hz flagged), the pre-processing
  controls, and the source digest of the derived series; a README documents the
  citation-only data acquisition (the raw capture is not redistributed) and the
  exact reproduction commands, and tests/test_iso_ne_case1_real_evidence.py
  recomputes the content seals and asserts the documented mode is flagged. The
  docs site adds a Real-Data Case Study: ISO-NE Forced Oscillation validation
  page presenting the disturbance, the pipeline, the recovered modes, and the
  honest scope limits.
• scpn_phase_orchestrator.runtime.pmu_ieee_adapter adapts the wide,
  multi-header PMU concentrator CSV used by phasor measurement units and the
  oscillation-detection literature into the two-column time_s,frequency_hz
  series the ringdown screener consumes. It parses the header block by its
  quantity-type row, enumerates the frequency channels with their dropout and
  non-finite counts, selects the dropout-free channel within a plausible band of
  the nominal frequency (breaking ties toward the largest peak-to-peak swing),
  and writes the selected channel with a SHA-256 provenance record linking the
  derived CSV back to the source capture. spo pmu-ieee-adapt exposes the path
  and its derived CSV feeds spo pmu-ringdown directly.
• Perf-isolated branch-coverage gate: tools/coverage_guard.py now parses and
  enforces branch rates (global / per-domain / per-file) alongside line rates,
  failing closed when branch floors are configured against a line-only report;
  a new CI branch-coverage lane re-runs the ffi-test selection with
  performance tests deselected and --cov-branch enabled, gated by the
  no-decrease floors in tools/coverage_guard_branch_thresholds.json;
  tools/preflight.py --branch-coverage mirrors the lane locally. The main
  coverage matrix stays line-only because branch instrumentation flips
  host-sensitive wall-clock performance tests.
• scpn_phase_orchestrator.assurance.report.render_conformity_report renders an
  assurance-case bundle as a deterministic, human-readable Markdown conformity
  report — a per-standard, clause-by-clause table of conformance status,
  contributing evidence, and rationale, under the regulatory disclaimer and
  anchored to the bundle hash. The certification evidence package now seals the
  rendered report as conformity_report.md, and spo assurance-case --report-out
  writes it standalone. render_conformity_report_pdf and
  spo assurance-case --report-pdf-out render the same report as a deterministic,
  dependency-free text PDF (the distributable artefact an assessor files), built on
  the new reusable scpn_phase_orchestrator.reporting.markdown_to_pdf_bytes helper.
  Review-only; adds no claim beyond the sealed bundle.
• scpn_phase_orchestrator.assurance.build_run_evidence derives audit-stream
  integrity and conformal admission-gate evidence directly from a serialised
  SimulationResult record, and spo assurance-case / spo certification-evidence
  gain --run-result to assemble a conformity package from a run summary without
  hand-authoring evidence JSON. It consumes the JSON record (not the runtime
  object) and emits nothing for a surface that did not run.
• The certification evidence package now also seals the rendered
  conformity_report.pdf (the filable text PDF) alongside the Markdown report;
  CertificationEvidencePackage file contents are now byte payloads and
  to_files() returns dict[str, bytes].
• spo assurance-case / spo certification-evidence gain --verify-determinism:
  with --audit-log, the logged run is re-executed and a replay_determinism
  evidence item recording the deterministic re-execution result is added to the
  bundle, mapping to the reproducibility/robustness clauses.
• scpn_phase_orchestrator.assurance.build_formal_verification_evidence maps a
  serialised FormalVerificationPackage manifest (the supervisor formal
  exporters' PRISM/TLA/SMT artefact hashes, property library, and non-executing
  checker commands) into a formal_verification evidence item, and
  spo assurance-case / spo certification-evidence gain --formal-package to
  attach the formal argument to a conformity bundle. It consumes the JSON manifest
  (not the package object), restates it verbatim, and records which properties were
  posed against which artefacts — never that any checker accepted them.
• scpn_phase_orchestrator.assurance.build_signed_certification_envelope /
  verify_signed_certification_envelope bind a certification package hash to the
  run's audit-chain tip in a deterministic SignedCertificationEnvelope, anchoring
  the package to a specific, replayable, tamper-evident execution and optionally
  carrying a post-quantum ML-DSA seal (FIPS 204) over that tip. spo certification-evidence gains --sign-envelope (writes signed_envelope.json
  anchored to --audit-log) and --signing-seed-file (adds the ML-DSA seal). The
  envelope reuses the existing runtime.audit_pqc seal verbatim; the assurance leaf
  only validates and binds.
• spo evolutionary-policy-dsl-search, spo evolutionary-petri-mutation, and
  spo evolutionary-topology-mutation now run the deterministic offline supervisor
  mutation-search grammars from local source artefacts and emit review-only
  candidate bundles. The commands surface the existing
  supervisor.evolutionary_policy_dsl, supervisor.evolutionary_petri_grammar,
  and supervisor.evolutionary_topology_grammar searches without actuating,
  merging, hot-patching, or executing any mutated candidate.
• spo federated-dp-noise-service-preflight now turns a DP-noise request JSON and a
  deployment declaration JSON into deterministic request/response manifests and a
  non-actuating deployment readiness bundle. Missing deployment prerequisites are
  reported as a not-ready readiness verdict; only malformed inputs fail closed. The
  command validates the existing supervisor DP noise-service surface without opening
  sockets or permitting live DP noise-service execution.
• spo federated-secure-aggregation-preflight now turns federated node-commitment
  JSONL and a deployment declaration JSON into the deterministic secure-aggregation
  manifest, a custody/quorum deployment preflight, and a non-actuating preflight
  bundle. The command validates the existing supervisor secure-aggregation surface
  without opening sockets or permitting live secure-aggregation execution.
• spo federated-transport-preflight now turns federated node-update JSONL and a
  transport declaration JSON into signed/hash-linked envelopes, a replay ledger,
  and a deterministic non-actuating deployment preflight bundle. The command
  validates the existing supervisor federated-transport surface without opening
  sockets or permitting live transport execution.
• SupervisorPolicy now accepts an optional PolicyCBFAdmissionGate that
  constrains matched control proposals through verified neural CBF filters before
  returning actions. Each admission emits a deterministic audit record with CBF
  filter/certificate digests and an SMT-LIB artefact hash for the scalar
  admission constraint; default runtime behaviour remains unchanged unless a
  deployment supplies a verified gate.
• Optional Rust supervisor backend readiness auditing now validates the
  spo_kernel/spo-supervisor PyO3 surface through
  audit_rust_supervisor_backend() and reports a separate rust-supervisor
  optional backend in spo doctor. The probe checks required supervisor FFI
  symbols and deterministic, non-actuating regime/boundary/coherence smoke
  behavior while keeping the Python supervisor as the default live-control path.
• spo formal-export --export policy-smt now emits deterministic SMT-LIB v2
  feasibility models for supervisor policy rules, with real-valued metric and
  regime inputs, bounded rule-fire counters, rule/action predicates, and a
  final check-sat envelope for Z3. Formal package export now includes the
  generated policy_smt artifact and a non-executing Z3 command/readiness
  record alongside PRISM/TLA evidence.
• spo certification-evidence now assembles a deterministic standards-shaped
  review package around the existing assurance-case bundle. It writes
  manifest.json, assurance_bundle.json, and test_vectors.json, refuses
  non-empty output directories, seals package files with SHA-256 digests, and
  keeps the output explicitly review-only.
• The spo-wasm browser playground now has deterministic scenario presets for
  weak coupling drift, the critical transition, strong synchronisation, and wide
  frequency dispersion. The DOM-free helper module exposes validated
  scenarioOptions and scenarioParams helpers, with Node and pytest coverage
  keeping the HTML, helper catalogue, and WasmEngine integration aligned.
• The hosted GitHub Pages /demo/ playground now uses the current WasmEngine
  class API instead of the removed free-function WASM API. The Docs workflow
  generates the docs/wasm-pkg/ bundle before publishing, the hosted helper
  mirrors the source playground helper, and the playground test suite now guards
  both source and hosted surfaces.

Fixed

• PMU ringdown PRC screening (runtime.pmu_ringdown.screen_pmu_ringdown_csv,
  spo pmu-ringdown) now recovers real oscillation modes from operator
  captures. The deviation signal is mean-detrended so the operating-point
  offset is not fit as a dominant 0 Hz mode that buries the electromechanical
  swing; timestamp uniformity is measured against the best-fit uniform grid so
  decimal-rounded operator timestamps are accepted; analysis_rate_hz provides
  anti-alias block-mean decimation with a max_analysis_samples ceiling that
  fails closed rather than making the estimate intractable; and the default
  model order is bounded so a noisy signal does not fragment into spurious
  modes. The command gains --detrend and --analysis-rate-hz, and the sealed
  record adds the detrend mode plus the post-decimation analysis rate and
  sample count. Validated on a documented real inter-area oscillation event.
• tests/test_itpc_bridge_paths.py failed-subprocess test grants the execute
  bit to its fake Mojo artefact: the hardened runtime probe rejects
  non-executable artefacts before the subprocess path, so the test never
  reached the non-zero-exit surface it targets.
• TestNeurocoreBridgeScaleTiming now carries the performance marker: its
  per-step wall-clock budgets are host-sensitive and flip under branch
  instrumentation or machine load, so perf-isolated lanes deselect the class.
• Source-tree imports now expose the same __version__ as pyproject.toml, and
  the version-sync guard checks the package constant alongside pyproject.toml,
  CITATION.cff, and spo-kernel/Cargo.toml.
• .gitignore now covers root-level TODO scratch files and node_modules/
  build trees.

Security

• DSSE/provenance round-trip tests now assert the exact SLSA predicate type
  instead of using URL-prefix substring checks, resolving the CodeQL
  incomplete-URL-substring-sanitisation alerts in those tests.
• CI test and FFI lanes now deselect host-sensitive performance tests, the
  Lyapunov wall-clock guard carries the performance marker, and Windows doc
  contract tests read UTF-8 Markdown explicitly instead of relying on the
  platform default codec.