v0.7.0

Observability + gates (IH-8, IH-29, IH-30, IH-20)

Journal viewer. ironbench journal <file> renders a self-contained offline HTML timeline of a run journal, with kind/actor/connection filters and text search. Hardened against hostile journal content: template-token injection, self-overwrite, NaN/Infinity, deep nesting.

io-core gates and failure journaling (IH-29). The IRONHARNESS_ALLOW_REAL_FLASH safety gate is checked first (before image-path and optional-dependency checks) and every denial is journaled (esp_denied) - a gate without a negative test is decorative, so the deny path is pinned by tests. Failure journaling covers the whole transport family: modbus open/read/write (including dropped-link ConnectionException), mqtt open/publish/subscribe, serial open/write/read/read_line; file_list is journaled; esp_image_info passes chip through. Windows NTFS-junction sandbox-escape test added.

MCP stdio smoke + LLM HTTP layer (IH-30). The real python -m io_core.mcp_server subprocess is driven over the real wire by two independent clients (a hand-rolled line-delimited JSON-RPC client and the official SDK ClientSession); the packaging CI job pings the installed wheel. agent.chat is tested against a local OpenAI-compatible http.server (request shape, content extraction, typed errors, HTTP-500 -> solve infra classification); the LLM config priority chain (explicit > env > .env > default) is pinned.

MCP tool annotations + stdout hygiene (IH-20). All 22 tools declare explicit ToolAnnotations (readOnly only where nothing is consumed; draining reads are not readOnly; destructive only for esp_flash/esp_erase/file_delete/file_write; idempotentHint deliberately unset). The stdio wire is pinned pure: an error battery keeps stdout JSON-RPC-only, and a deliberately noisy handler must land on stderr.

Runner hygiene (merged on the way to the real-hardware track). runner.py split into per-target modules behind a stable facade (runner_common + wokwi/renode/unix/plant/real); _drive_repl returns a structured error_kind; the unix anti-cheat verdict is now a deterministic post-run classification over the final log (previously the wording raced the reader thread); env pins (IRONBENCH_UNIX_BIN, IRONBENCH_RENODE_BIN, WOKWI_CLI_TOKEN priority) covered by tests.

Honest limits (documented, from the pre-release adversarial pass). One journal writer per file: concurrent threads of a session are safe, but two processes sharing one IRONHARNESS_HOME can silently drop lines - keep one agent per home directory (a cross-process lock is queued for IH-32).

Testing: 424 passed / 26 skipped (CI: ubuntu + windows + packaging smoke of the installed wheel). Pre-release adversarial pass over the whole harness found no blockers.