AIP v0.7.2

v0.7.2 is a checkpoint release. It adds no architecture question, source family, canonical
relationship, schema, claim type, limitation code or MCP tool. The six read-only MCP tools and their
answers are semantically unchanged from v0.7.1.

What changed

• Hosted six-tool endpoint, externally verified. The public read-only instance
  (https://mcp.daip.io/mcp) exposes all six tools. examples/pitstop-demo/hosted/verify_public_edge.py
  checks it from outside, without credentials: tool inventory, typed refusals, closed non-MCP routes,
  host and size limits. See the I1 record.
• Hosted Sokol111 dataset. The instance serves a frozen local Kafka observation of the Sokol111
  e-commerce system (catalog.product.events, captured 2026-10-21T17:53:57Z). It is a replay of what was
  true at that time, not live consumption and not a complete view of the system. The acceptance check gains
  --profile sokol111, which requires the get_destination_consumers answer with its capture time and
  same-snapshot evidence drill-down. See the I2 record and
  the replay package.
• Clearer get_destination_consumers wording. The tool description and the UNKNOWN_DESTINATION and
  BROKER_MISMATCH refusal messages now say that destination_id is the canonical Topic id (never a name)
  and broker_id is the stable broker id (the BrokerRef name, not the canonical broker:owned: id).
  Refusal codes, data: null, the request and answer schemas and the tool inventory are unchanged.
• Image hardening. The runtime image no longer contains the base image's system pip, which AIP never
  uses, and the base is re-pinned to its current digest. This removes pip's bundled certifi (including
  GHSA-6q48-6c7w-9gw2), and the re-pinned base carries the fixed ca-certificates (DSA-6572-1) and
  liblzma5 (DSA-6549-1). The locked opentelemetry-api moves to 1.45.1 (CVE-2026-114603).

Product, Producer and MCP server version become 0.7.2. Existing configurations and the published
schemas are unchanged.

Product-boundary checkpoint

A controlled comparison ran one bounded Sokol111 change with a mature context engine alone and with AIP
added (comparison record). The owner's disposition is
DEFER.

• AIP's data was correct and hosted, but once agents could reach it, it changed no consumer set, change
  list or rollout gate; source, configuration and the stock broker output already gave the same result.
• On the packaged dataset no change-impact question is answerable only by AIP, and Sokol111 as found does
  not emit the runtime caller-attribution evidence in which AIP could add value.
• v0.8 keeps cross-view synthesis in the context-engine and agent layer; this release introduces no
  AIP-owned composition and no discovery tool.

Known limitations

• The comparison is one run per arm, one model and one task, and its implementation step did not finish in
  the last run. It is an observation, not a measurement.
• The hosted dataset is one frozen local capture of four consumer groups. Production is not observed.
• Dependabot's certifi advisory GHSA-6q48-6c7w-9gw2 in the repository harness harness/locality-capture
  (not part of the image) stays open until after this release.