v0.71.0

Added

• Added the synapse sandbox CLI (experimental) — the operator face of the WebAssembly
  sandbox. sandbox validate <manifest> checks a capability manifest and prints its
  normalised, deny-by-default grants; sandbox run <tool.wasm> --manifest <m> [--input <f>] --approve binds the manifest to the exact module by content digest (a swapped
  module is refused), requires an explicit --approve so a capability-bearing run is
  always an operator decision, executes the tool capability-limited, and prints the bounded
  run receipt. Without the [wasm] extra it reports the install hint. With this the
  capability-limited WebAssembly sandbox is usable end-to-end; the design doc is updated to
  reflect the shipped sandbox, with the marketplace remaining the gated next step. 100%
  line+branch.
• Added the WebAssembly sandbox runtime (core/wasm_sandbox.py + core/sandbox_receipt.py)
  behind the optional [wasm] extra — a real capability-limited execution sandbox.
  run_sandboxed executes an untrusted .wasm tool under exactly the manifest's grants:
  a memory cap, a fuel (instruction) budget, a wall-clock epoch backstop, WASI-preopened
  filesystem paths, and no network (WASI preview1 exposes no sockets, so a tool reaches the
  network only through a host import that is never linked). It returns a bounded
  RunReceipt — exit status, fuel used, input/output digests, and granted capabilities. A
  fuel bomb traps out_of_fuel; a wall-clock runaway is interrupted (epoch_deadline). The
  runtime is wasmtime, imported only behind the extra so the single-dependency core stays
  import-clean; the manifest→config derivation is pure. 100% line+branch.
• Added the sandbox capability-manifest policy core (core/sandbox_policy.py), the first
  slice of the capability-limited WebAssembly sandbox (design):
  deny-by-default FilesystemGrant/NetworkGrant/ResourceGrant bundled in a
  CapabilityManifest bound to a .wasm content digest; authorise(manifest, request)
  returns the first failing reason or the granted manifest; to_acl_rules() expresses a
  tool's filesystem/network grants as ACL rules so they flow through the same
  deny-by-default evaluate_access — one authorisation model, not a parallel one (added
  the sandbox permission verb). Pure and I/O-free; the WASM runtime that enforces a
  manifest follows behind the optional [wasm] extra. 100% line+branch.
• Added a sustained-write benchmark (benchmarks/sustained_write_benchmark.py):
  profiles the durable event store under sustained write load on a real on-disk WAL
  database — write-latency distribution and throughput for the synchronous=NORMAL
  commit and the durable=True fsync path, the read_since(0) replay cost as the log
  grows, and how compaction lowers read cost. Committed results, make bench wiring, a
  README section, and focused tests. (KIMI v0.70.0 surfaced this gap — the existing
  harnesses measure coordination/replay, not sustained durable-write latency.)
• Added a two-hub "observe a peer" walkthrough to the
  multi-hub docs: run two hubs with separate event stores,
  coordinate on each, and read the other's observed board and claims with
  synapse multihub observe — including how a peer's claim shows as advisory and where
  cross-host (network-transport) observation stops.
• Added synapse multihub observe (docs): the operator-facing
  read of the multi-hub follower. It opens a peer hub's event store, folds its log through
  MultiHubFollower, and prints the observed board, progress count, and claim view
  (advisory — claims are never granted across hubs), or --json. Read-only by
  construction — it reads the peer store through the same read_since seam (SQLite WAL
  allows a concurrent reader beside the live peer hub) and exits. Classified analysis in
  the surface taxonomy; 100% line+branch. (KIMI v0.70.0 surfaced this as a gap — the
  follower was library-only.)
• Added synapse federation import/list/revoke (docs):
  the operator-facing layer over the federation policy bundle. import reads an
  out-of-band peer-domain bundle, requires a --confirmed-by operator, records the
  provenance (source, time, confirmer), and persists the peering; list shows the
  imported peerings with their provenance; revoke marks a peering revoked so it fails
  authorisation while keeping its audit record. No auto-discovery and no
  trust-on-first-use — every peering is auditable to a human decision. Serialisation and
  the store live in core/federation_store.py (pure; deny-by-default on omissions),
  with a thin CLI shell. Classified governance in the surface taxonomy; 100%
  line+branch on both modules.
• Added the federated trust policy bundle (docs),
  the first slice of the federated trust model. core/federation.py extends the
  single-host trusted-peer notion to trusted peer domains: a FederationPeer records,
  per remote domain, the local namespaces it may address, the accepted certificate pins
  and event-signing key ids, the bounded local scope (ScopeGrant) its subjects map to,
  and an expiry plus revocation. FederationBundle.authorise returns a deny-by-default
  decision (unknown domain → revoked → expired → namespace → key → pin, in order), and
  compose_cross_domain joins it with the external mutual TLS, signature, and ACL
  results so a frame any layer rejects is rejected. Pure and crypto-free — it composes
  the existing primitives and adds no trust root. 100% line+branch. The federation
  runtime (bundle exchange, remote identity resolution, frame-path wiring) remains
  research.