UNITARES v3.0.0

A major release from master, following v2.22.1. It is major because the
changes listed under Compatibility break existing installs and callers. It
carries source changes merged since v2.22.0 on master, including the v2.22.1
maintenance history through its forward-merge. Deploy is continuous from
master, so this tag is a citation and rollback anchor rather than the first appearance of these
changes on a running server.

Compatibility. Several changes break existing callers or installs, and
COMPATIBILITY.md carries the full upgrade and rollback
policy:

• Python 3.14. The server package now requires Python 3.14 (the container
  already ran it); a bare-metal install on 3.12 or 3.13 no longer installs it.
  The SDK keeps >=3.12.
• Compose upgrade command. scripts/unitares update now upgrades the
  install instead of posting a check-in (check-ins move to
  unitares call process_agent_update). From a v2.22.x checkout, follow the
  one-time step in the install manual ("Releases before this command
  existed") first; the v2.22.x script's update migrates nothing.
• Tool discovery. Profiles are gone. Any GOVERNANCE_TOOL_MODE value,
  full included, is accepted and ignored, and the initial tools/list is
  progressive: the workflow tools plus list_tools, describe_tool and
  use_tool, which reach the rest. Every registered tool stays callable, and
  UNITARES_TOOL_ADVERTISEMENT=full advertises every schema up front. The
  v2.22.x advice to set lite in .env no longer has any effect.
• Removed. The direct_resume_if_safe tool (use self_recovery), the
  unused dialectic vote parameter, the server's coupling to the retired Pi
  plugin, new v2 party-HMAC signatures on dialectic resolutions (existing ones
  stay readable), and the served discord-bridge skill.
• Contract. The interface contract moves from 1.1.0 to 1.22.0 and
  input-schema digests move; a client that pins hashes must re-pin. The server
  reports serverInfo.name as unitares, not governance-monitor-v1.
• Deployment settings. Deployment-specific HTTP routes are mounted only
  when UNITARES_ROUTE_PACKS names them, and dashboard passkeys need
  UNITARES_DASHBOARD_RP_ID; see their entries' upgrade notes. The production
  mcp pin moves to 2.2.0.

Migrations. Two schema migrations, which must be applied before the new
code starts: 070_outcome_prediction_bindings (a ledger table for
exactly-once prediction-bound outcomes, a cleanup function, and a replaced
outcome-partition drop function) and
071_knowledge_closure_class_survives_tiering (widens a CHECK constraint so a
classified finding can be archived). Until 070 lands, record_result with a
prediction_id fails with DB_ERROR; until 071 lands, a classified finding
cannot be archived. A Docker Compose install applies them with
scripts/unitares update, which backs up the database first; an operator
install runs scripts/dev/apply_migrations.py --apply. Rolling back to
v2.22.1 with 071 applied is safe only while no finding carries a
closure_class: COMPATIBILITY.md gives the check and the statement that
clears the classes.

Artifacts. The server image, and from this release a separate
unitares-lease-plane image pinned by docker-compose.yml, are published for
linux/amd64 and linux/arm64 with SBOMs and build provenance.
unitares-sdk 0.4.0 ships alongside (tag sdk-v0.4.0). Its behavior changes:
checkin reads the verdict from the response envelope, so
GovernanceAgent's pause and reject handling (VerdictError) can now fire
where every verdict used to parse as proceed; get_metrics().action is the
policy action and MetricsResult gains verdict, action, coherence and
risk; audit_knowledge no longer requests a model by default; and the
async GovernanceClient raises GovernanceToolRefused (a subclass of
GovernanceConnectionError) when a tool answers success: false. It also
adds an optional NeMo Relay integration. The skills bundle changed, and the
governance plugin carries it as v0.4.18.

Full changelog

The complete entry cites every change merged since v2.22.1 (341 pull requests, with 17 declared exemptions and their reasons): docs/CHANGELOG.md at v3.0.0.

Evidence

• Release PR #2550, merged as d3266ab. CI green on the reviewed head: Python test shards, Elixir, Docker Quickstart, documentation, scope, Release Seams and the review gate.
• Changelog coverage at the tagged commit: 348 first-parent changes, all attributed; 341 of 341 merged pull requests cited or declared.
• Docker quickstart: the Docker Quickstart workflow built the stack and ran the demo on the release PR, which changed docker-compose.yml, and on master at the last container-input commit before the cut (#2499, run 36305272574).
• Review: an independent review of the notes, version choice and upgrade path (its corrections are in the entry), and native Codex review, which flagged the original 2.23.0 number as a SemVer break; it was renumbered 3.0.0 and the re-review was clean.
• The server and lease-plane images, SBOMs and provenance are verified by Promote Release before latest moves; until then latest stays on v2.22.1.

Known limits

• This tag is a citation and rollback anchor. It does not establish that any running deployment was upgraded.
• Existing Compose installs on v2.22.x need the one-time manual step in the install manual before scripts/unitares update can upgrade them.
• Rolling back to v2.22.1 with migration 071 applied is safe only while no finding carries a closure_class; see COMPATIBILITY.md.

Rollback

Pin ghcr.io/cirwel/unitares:v2.22.1 (and build the lease plane from source, as v2.22.1 did). Both migrations stay applied; neither is read by v2.22.1, subject to the closure_class condition above.